2113 files changed, 25692 insertions, 13477 deletions

diff --git a/.mailmap b/.mailmap
index 1469ff0d3f4d..e18cab73e209 100644
--- a/.mailmap
+++ b/.mailmap
@@ -107,6 +107,7 @@ Linus Lüssing <linus.luessing@c0d3.blue> <linus.luessing@ascom.ch>
 Maciej W. Rozycki <macro@mips.com> <macro@imgtec.com>
 Marcin Nowakowski <marcin.nowakowski@mips.com> <marcin.nowakowski@imgtec.com>
 Mark Brown <broonie@sirena.org.uk>
+Mark Yao <markyao0591@gmail.com> <mark.yao@rock-chips.com>
 Martin Kepplinger <martink@posteo.de> <martin.kepplinger@theobroma-systems.com>
 Martin Kepplinger <martink@posteo.de> <martin.kepplinger@ginzinger.com>
 Matthieu CASTET <castet.matthieu@free.fr>
diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
index d6d862db3b5d..bfd29bc8d37a 100644
--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
@@ -375,3 +375,19 @@ Contact:	Linux kernel mailing list <linux-kernel@vger.kernel.org>
 Description:    information about CPUs heterogeneity.
 
                 cpu_capacity: capacity of cpu#.
+
+What:           /sys/devices/system/cpu/vulnerabilities
+                /sys/devices/system/cpu/vulnerabilities/meltdown
+                /sys/devices/system/cpu/vulnerabilities/spectre_v1
+                /sys/devices/system/cpu/vulnerabilities/spectre_v2
+Date:           January 2018
+Contact:        Linux kernel mailing list <linux-kernel@vger.kernel.org>
+Description:    Information about CPU vulnerabilities
+
+                The files are named after the code names of CPU
+                vulnerabilities. The output of those files reflects the
+                state of the CPUs in the system. Possible output values:
+
+                "Not affected"    CPU is not affected by the vulnerability
+                "Vulnerable"      CPU is affected and no mitigation in effect
+                "Mitigation: $M"  CPU is affected and mitigation $M is in effect
diff --git a/Documentation/admin-guide/kernel-parameters.rst b/Documentation/admin-guide/kernel-parameters.rst
index b2598cc9834c..7242cbda15dd 100644
--- a/Documentation/admin-guide/kernel-parameters.rst
+++ b/Documentation/admin-guide/kernel-parameters.rst
@@ -109,6 +109,7 @@ parameter is applicable::
         IPV6    IPv6 support is enabled.
         ISAPNP  ISA PnP code is enabled.
         ISDN    Appropriate ISDN support is enabled.
+        ISOL    CPU Isolation is enabled.
         JOY     Appropriate joystick support is enabled.
         KGDB    Kernel debugger support is enabled.
         KVM     Kernel Virtual Machine support is enabled.
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 6571fbfdb2a1..46b26bfee27b 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -328,11 +328,15 @@
                         not play well with APC CPU idle - disable it if you have
                         APC and your system crashes randomly.
 
-        apic=           [APIC,X86-32] Advanced Programmable Interrupt Controller
+        apic=           [APIC,X86] Advanced Programmable Interrupt Controller
                         Change the output verbosity whilst booting
                         Format: { quiet (default) | verbose | debug }
                         Change the amount of debugging information output
                         when initialising the APIC and IO-APIC components.
+                        For X86-32, this can also be used to specify an APIC
+                        driver name.
+                        Format: apic=driver_name
+                        Examples: apic=bigsmp
 
         apic_extnmi=    [APIC,X86] External NMI delivery setting
                         Format: { bsp (default) | all | none }
@@ -709,9 +713,6 @@
                         It will be ignored when crashkernel=X,high is not used
                         or memory reserved is below 4G.
 
-        crossrelease_fullstack
-                        [KNL] Allow to record full stack trace in cross-release
-
         cryptomgr.notests
                         [KNL] Disable crypto self-tests
 
@@ -1737,7 +1738,7 @@
         isapnp=         [ISAPNP]
                         Format: <RDP>,<reset>,<pci_scan>,<verbosity>
 
-        isolcpus=       [KNL,SMP] Isolate a given set of CPUs from disturbance.
+        isolcpus=       [KNL,SMP,ISOL] Isolate a given set of CPUs from disturbance.
                         [Deprecated - use cpusets instead]
                         Format: [flag-list,]<cpu-list>
 
@@ -2622,6 +2623,11 @@
         nosmt           [KNL,S390] Disable symmetric multithreading (SMT).
                         Equivalent to smt=1.
 
+        nospectre_v2    [X86] Disable all mitigations for the Spectre variant 2
+                        (indirect branch prediction) vulnerability. System may
+                        allow data leaks with this option, which is equivalent
+                        to spectre_v2=off.
+
         noxsave         [BUGS=X86] Disables x86 extended register state save
                         and restore using xsave. The kernel will fallback to
                         enabling legacy floating-point and sse state.
@@ -2662,7 +2668,7 @@
                         Valid arguments: on, off
                         Default: on
 
-        nohz_full=      [KNL,BOOT]
+        nohz_full=      [KNL,BOOT,SMP,ISOL]
                         The argument is a cpu list, as described above.
                         In kernels built with CONFIG_NO_HZ_FULL=y, set
                         the specified list of CPUs whose tick will be stopped
@@ -3094,6 +3100,12 @@
                 pcie_scan_all   Scan all possible PCIe devices.  Otherwise we
                                 only look for one device below a PCIe downstream
                                 port.
+                big_root_window Try to add a big 64bit memory window to the PCIe
+                                root complex on AMD CPUs. Some GFX hardware
+                                can resize a BAR to allow access to all VRAM.
+                                Adding the window is slightly risky (it may
+                                conflict with unreported devices), so this
+                                taints the kernel.
 
         pcie_aspm=      [PCIE] Forcibly enable or disable PCIe Active State Power
                         Management.
@@ -3282,6 +3294,21 @@
         pt.             [PARIDE]
                         See Documentation/blockdev/paride.txt.
 
+        pti=            [X86_64] Control Page Table Isolation of user and
+                        kernel address spaces.  Disabling this feature
+                        removes hardening, but improves performance of
+                        system calls and interrupts.
+
+                        on   - unconditionally enable
+                        off  - unconditionally disable
+                        auto - kernel detects whether your CPU model is
+                               vulnerable to issues that PTI mitigates
+
+                        Not specifying this option is equivalent to pti=auto.
+
+        nopti           [X86_64]
+                        Equivalent to pti=off
+
         pty.legacy_count=
                         [KNL] Number of legacy pty's. Overwrites compiled-in
                         default number.
@@ -3931,6 +3958,29 @@
         sonypi.*=       [HW] Sony Programmable I/O Control Device driver
                         See Documentation/laptops/sonypi.txt
 
+        spectre_v2=     [X86] Control mitigation of Spectre variant 2
+                        (indirect branch speculation) vulnerability.
+
+                        on   - unconditionally enable
+                        off  - unconditionally disable
+                        auto - kernel detects whether your CPU model is
+                               vulnerable
+
+                        Selecting 'on' will, and 'auto' may, choose a
+                        mitigation method at run time according to the
+                        CPU, the available microcode, the setting of the
+                        CONFIG_RETPOLINE configuration option, and the
+                        compiler with which the kernel was built.
+
+                        Specific mitigations can also be selected manually:
+
+                        retpoline         - replace indirect branches
+                        retpoline,generic - google's original retpoline
+                        retpoline,amd     - AMD-specific minimal thunk
+
+                        Not specifying this option is equivalent to
+                        spectre_v2=auto.
+
         spia_io_base=   [HW,MTD]
         spia_fio_base=
         spia_pedr=
diff --git a/Documentation/admin-guide/thunderbolt.rst b/Documentation/admin-guide/thunderbolt.rst
index de50a8561774..9b55952039a6 100644
--- a/Documentation/admin-guide/thunderbolt.rst
+++ b/Documentation/admin-guide/thunderbolt.rst
@@ -230,7 +230,7 @@ If supported by your machine this will be exposed by the WMI bus with
 a sysfs attribute called "force_power".
 
 For example the intel-wmi-thunderbolt driver exposes this attribute in:
-  /sys/devices/platform/PNP0C14:00/wmi_bus/wmi_bus-PNP0C14:00/86CCFD48-205E-4A77-9C48-2021CBEDE341/force_power
+  /sys/bus/wmi/devices/86CCFD48-205E-4A77-9C48-2021CBEDE341/force_power
 
   To force the power to on, write 1 to this attribute file.
   To disable force power, write 0 to this attribute file.
diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt
index 304bf22bb83c..fc1c884fea10 100644
--- a/Documentation/arm64/silicon-errata.txt
+++ b/Documentation/arm64/silicon-errata.txt
@@ -75,3 +75,4 @@ stable kernels.
 | Qualcomm Tech. | Falkor v1       | E1003           | QCOM_FALKOR_ERRATUM_1003    |
 | Qualcomm Tech. | Falkor v1       | E1009           | QCOM_FALKOR_ERRATUM_1009    |
 | Qualcomm Tech. | QDF2400 ITS     | E0065           | QCOM_QDF2400_ERRATUM_0065   |
+| Qualcomm Tech. | Falkor v{1,2}   | E1041           | QCOM_FALKOR_ERRATUM_1041    |
diff --git a/Documentation/cgroup-v2.txt b/Documentation/cgroup-v2.txt
index 779211fbb69f..2cddab7efb20 100644
--- a/Documentation/cgroup-v2.txt
+++ b/Documentation/cgroup-v2.txt
@@ -898,6 +898,13 @@ controller implements weight and absolute bandwidth limit models for
 normal scheduling policy and absolute bandwidth allocation model for
 realtime scheduling policy.
 
+WARNING: cgroup2 doesn't yet support control of realtime processes and
+the cpu controller can only be enabled when all RT processes are in
+the root cgroup.  Be aware that system management software may already
+have placed RT processes into nonroot cgroups during the system boot
+process, and these processes may need to be moved to the root cgroup
+before the cpu controller can be enabled.
+
 
 CPU Interface Files
 ~~~~~~~~~~~~~~~~~~~
diff --git a/Documentation/core-api/genericirq.rst b/Documentation/core-api/genericirq.rst
index 0054bd48be84..4da67b65cecf 100644
--- a/Documentation/core-api/genericirq.rst
+++ b/Documentation/core-api/genericirq.rst
@@ -225,9 +225,9 @@ interrupts.
 
 The following control flow is implemented (simplified excerpt)::
 
-    :c:func:`desc->irq_data.chip->irq_mask_ack`;
+    desc->irq_data.chip->irq_mask_ack();
     handle_irq_event(desc->action);
-    :c:func:`desc->irq_data.chip->irq_unmask`;
+    desc->irq_data.chip->irq_unmask();
 
 
 Default Fast EOI IRQ flow handler
@@ -239,7 +239,7 @@ which only need an EOI at the end of the handler.
 The following control flow is implemented (simplified excerpt)::
 
     handle_irq_event(desc->action);
-    :c:func:`desc->irq_data.chip->irq_eoi`;
+    desc->irq_data.chip->irq_eoi();
 
 
 Default Edge IRQ flow handler
@@ -251,15 +251,15 @@ interrupts.
 The following control flow is implemented (simplified excerpt)::
 
     if (desc->status & running) {
-        :c:func:`desc->irq_data.chip->irq_mask_ack`;
+        desc->irq_data.chip->irq_mask_ack();
         desc->status |= pending | masked;
         return;
     }
-    :c:func:`desc->irq_data.chip->irq_ack`;
+    desc->irq_data.chip->irq_ack();
     desc->status |= running;
     do {
         if (desc->status & masked)
-            :c:func:`desc->irq_data.chip->irq_unmask`;
+            desc->irq_data.chip->irq_unmask();
         desc->status &= ~pending;
         handle_irq_event(desc->action);
     } while (status & pending);
@@ -293,10 +293,10 @@ simplified version without locking.
 The following control flow is implemented (simplified excerpt)::
 
     if (desc->irq_data.chip->irq_ack)
-        :c:func:`desc->irq_data.chip->irq_ack`;
+        desc->irq_data.chip->irq_ack();
     handle_irq_event(desc->action);
     if (desc->irq_data.chip->irq_eoi)
-            :c:func:`desc->irq_data.chip->irq_eoi`;
+        desc->irq_data.chip->irq_eoi();
 
 
 EOI Edge IRQ flow handler
diff --git a/Documentation/devicetree/bindings/arm/ccn.txt b/Documentation/devicetree/bindings/arm/ccn.txt
index 29801456c9ee..43b5a71a5a9d 100644
--- a/Documentation/devicetree/bindings/arm/ccn.txt
+++ b/Documentation/devicetree/bindings/arm/ccn.txt
@@ -15,7 +15,7 @@ Required properties:
 
 Example:
 
-        ccn@0x2000000000 {
+        ccn@2000000000 {
                 compatible = "arm,ccn-504";
                 reg = <0x20 0x00000000 0 0x1000000>;
                 interrupts = <0 181 4>;
diff --git a/Documentation/devicetree/bindings/arm/omap/crossbar.txt b/Documentation/devicetree/bindings/arm/omap/crossbar.txt
index bb5727ae004a..ecb360ed0e33 100644
--- a/Documentation/devicetree/bindings/arm/omap/crossbar.txt
+++ b/Documentation/devicetree/bindings/arm/omap/crossbar.txt
@@ -49,7 +49,7 @@ An interrupt consumer on an SoC using crossbar will use:
         interrupts = <GIC_SPI request_number interrupt_level>
 
 Example:
-        device_x@0x4a023000 {
+        device_x@4a023000 {
                 /* Crossbar 8 used */
                 interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>;
                 ...
diff --git a/Documentation/devicetree/bindings/arm/tegra/nvidia,tegra20-mc.txt b/Documentation/devicetree/bindings/arm/tegra/nvidia,tegra20-mc.txt
index 866d93421eba..f9632bacbd04 100644
--- a/Documentation/devicetree/bindings/arm/tegra/nvidia,tegra20-mc.txt
+++ b/Documentation/devicetree/bindings/arm/tegra/nvidia,tegra20-mc.txt
@@ -8,7 +8,7 @@ Required properties:
 - interrupts : Should contain MC General interrupt.
 
 Example:
-        memory-controller@0x7000f000 {
+        memory-controller@7000f000 {
                 compatible = "nvidia,tegra20-mc";
                 reg = <0x7000f000 0x024
                        0x7000f03c 0x3c4>;
diff --git a/Documentation/devicetree/bindings/clock/axi-clkgen.txt b/Documentation/devicetree/bindings/clock/axi-clkgen.txt
index fb40da303d25..aca94fe9416f 100644
--- a/Documentation/devicetree/bindings/clock/axi-clkgen.txt
+++ b/Documentation/devicetree/bindings/clock/axi-clkgen.txt
@@ -17,7 +17,7 @@ Optional properties:
 - clock-output-names : From common clock binding.
 
 Example:
-        clock@0xff000000 {
+        clock@ff000000 {
                 compatible = "adi,axi-clkgen";
                 #clock-cells = <0>;
                 reg = <0xff000000 0x1000>;
diff --git a/Documentation/devicetree/bindings/clock/brcm,bcm2835-aux-clock.txt b/Documentation/devicetree/bindings/clock/brcm,bcm2835-aux-clock.txt
index 7a837d2182ac..4acfc8f641b6 100644
--- a/Documentation/devicetree/bindings/clock/brcm,bcm2835-aux-clock.txt
+++ b/Documentation/devicetree/bindings/clock/brcm,bcm2835-aux-clock.txt
@@ -23,7 +23,7 @@ Example:
                 clocks = <&clk_osc>;
         };
 
-        aux: aux@0x7e215004 {
+        aux: aux@7e215004 {
                 compatible = "brcm,bcm2835-aux";
                 #clock-cells = <1>;
                 reg = <0x7e215000 0x8>;
diff --git a/Documentation/devicetree/bindings/clock/exynos4-clock.txt b/Documentation/devicetree/bindings/clock/exynos4-clock.txt
index bc61c952cb0b..17bb11365354 100644
--- a/Documentation/devicetree/bindings/clock/exynos4-clock.txt
+++ b/Documentation/devicetree/bindings/clock/exynos4-clock.txt
@@ -24,7 +24,7 @@ tree sources.
 
 Example 1: An example of a clock controller node is listed below.
 
-        clock: clock-controller@0x10030000 {
+        clock: clock-controller@10030000 {
                 compatible = "samsung,exynos4210-clock";
                 reg = <0x10030000 0x20000>;
                 #clock-cells = <1>;
diff --git a/Documentation/devicetree/bindings/clock/exynos5250-clock.txt b/Documentation/devicetree/bindings/clock/exynos5250-clock.txt
index 536eacd1063f..aff266a12eeb 100644
--- a/Documentation/devicetree/bindings/clock/exynos5250-clock.txt
+++ b/Documentation/devicetree/bindings/clock/exynos5250-clock.txt
@@ -22,7 +22,7 @@ tree sources.
 
 Example 1: An example of a clock controller node is listed below.
 
-        clock: clock-controller@0x10010000 {
+        clock: clock-controller@10010000 {
                 compatible = "samsung,exynos5250-clock";
                 reg = <0x10010000 0x30000>;
                 #clock-cells = <1>;
diff --git a/Documentation/devicetree/bindings/clock/exynos5410-clock.txt b/Documentation/devicetree/bindings/clock/exynos5410-clock.txt
index 4527de3ea205..c68b0d29b3d0 100644
--- a/Documentation/devicetree/bindings/clock/exynos5410-clock.txt
+++ b/Documentation/devicetree/bindings/clock/exynos5410-clock.txt
@@ -30,7 +30,7 @@ Example 1: An example of a clock controller node is listed below.
                 #clock-cells = <0>;
         };
 
-        clock: clock-controller@0x10010000 {
+        clock: clock-controller@10010000 {
                 compatible = "samsung,exynos5410-clock";
                 reg = <0x10010000 0x30000>;
                 #clock-cells = <1>;
diff --git a/Documentation/devicetree/bindings/clock/exynos5420-clock.txt b/Documentation/devicetree/bindings/clock/exynos5420-clock.txt
index d54f42cf0440..717a7b1531c7 100644
--- a/Documentation/devicetree/bindings/clock/exynos5420-clock.txt
+++ b/Documentation/devicetree/bindings/clock/exynos5420-clock.txt
@@ -23,7 +23,7 @@ tree sources.
 
 Example 1: An example of a clock controller node is listed below.
 
-        clock: clock-controller@0x10010000 {
+        clock: clock-controller@10010000 {
                 compatible = "samsung,exynos5420-clock";
                 reg = <0x10010000 0x30000>;
                 #clock-cells = <1>;
diff --git a/Documentation/devicetree/bindings/clock/exynos5440-clock.txt b/Documentation/devicetree/bindings/clock/exynos5440-clock.txt
index 5f7005f73058..c7d227c31e95 100644
--- a/Documentation/devicetree/bindings/clock/exynos5440-clock.txt
+++ b/Documentation/devicetree/bindings/clock/exynos5440-clock.txt
@@ -21,7 +21,7 @@ tree sources.
 
 Example: An example of a clock controller node is listed below.
 
-        clock: clock-controller@0x10010000 {
+        clock: clock-controller@10010000 {
                 compatible = "samsung,exynos5440-clock";
                 reg = <0x160000 0x10000>;
                 #clock-cells = <1>;
diff --git a/Documentation/devicetree/bindings/clock/ti-keystone-pllctrl.txt b/Documentation/devicetree/bindings/clock/ti-keystone-pllctrl.txt
index 3e6a81e99804..c35cb6c4af4d 100644
--- a/Documentation/devicetree/bindings/clock/ti-keystone-pllctrl.txt
+++ b/Documentation/devicetree/bindings/clock/ti-keystone-pllctrl.txt
@@ -14,7 +14,7 @@ Required properties:
 
 Example:
 
-pllctrl: pll-controller@0x02310000 {
+pllctrl: pll-controller@02310000 {
         compatible = "ti,keystone-pllctrl", "syscon";
         reg = <0x02310000 0x200>;
 };
diff --git a/Documentation/devicetree/bindings/clock/zx296702-clk.txt b/Documentation/devicetree/bindings/clock/zx296702-clk.txt
index e85ecb510d56..5c91c9e4f1be 100644
--- a/Documentation/devicetree/bindings/clock/zx296702-clk.txt
+++ b/Documentation/devicetree/bindings/clock/zx296702-clk.txt
@@ -20,13 +20,13 @@ ID in its "clocks" phandle cell. See include/dt-bindings/clock/zx296702-clock.h
 for the full list of zx296702 clock IDs.
 
 
-topclk: topcrm@0x09800000 {
+topclk: topcrm@09800000 {
         compatible = "zte,zx296702-topcrm-clk";
         reg = <0x09800000 0x1000>;
         #clock-cells = <1>;
 };
 
-uart0: serial@0x09405000 {
+uart0: serial@09405000 {
         compatible = "zte,zx296702-uart";
         reg = <0x09405000 0x1000>;
         interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
diff --git a/Documentation/devicetree/bindings/crypto/fsl-sec4.txt b/Documentation/devicetree/bindings/crypto/fsl-sec4.txt
index 7aef0eae58d4..76aec8a3724d 100644
--- a/Documentation/devicetree/bindings/crypto/fsl-sec4.txt
+++ b/Documentation/devicetree/bindings/crypto/fsl-sec4.txt
@@ -456,7 +456,7 @@ System ON/OFF key driver
       Definition: this is phandle to the register map node.
 
 EXAMPLE:
-        snvs-pwrkey@0x020cc000 {
+        snvs-pwrkey@020cc000 {
                 compatible = "fsl,sec-v4.0-pwrkey";
                 regmap = <&snvs>;
                 interrupts = <0 4 0x4>
@@ -545,7 +545,7 @@ FULL EXAMPLE
                         interrupts = <93 2>;
                 };
 
-                snvs-pwrkey@0x020cc000 {
+                snvs-pwrkey@020cc000 {
                         compatible = "fsl,sec-v4.0-pwrkey";
                         regmap = <&sec_mon>;
                         interrupts = <0 4 0x4>;
diff --git a/Documentation/devicetree/bindings/devfreq/event/rockchip-dfi.txt b/Documentation/devicetree/bindings/devfreq/event/rockchip-dfi.txt
index 001dd63979a9..148191b0fc15 100644
--- a/Documentation/devicetree/bindings/devfreq/event/rockchip-dfi.txt
+++ b/Documentation/devicetree/bindings/devfreq/event/rockchip-dfi.txt
@@ -9,7 +9,7 @@ Required properties:
 - clock-names : the name of clock used by the DFI, must be "pclk_ddr_mon";
 
 Example:
-        dfi: dfi@0xff630000 {
+        dfi: dfi@ff630000 {
                 compatible = "rockchip,rk3399-dfi";
                 reg = <0x00 0xff630000 0x00 0x4000>;
                 rockchip,pmu = <&pmugrf>;
diff --git a/Documentation/devicetree/bindings/display/atmel,lcdc.txt b/Documentation/devicetree/bindings/display/atmel,lcdc.txt
index 1a21202778ee..acb5a0132127 100644
--- a/Documentation/devicetree/bindings/display/atmel,lcdc.txt
+++ b/Documentation/devicetree/bindings/display/atmel,lcdc.txt
@@ -27,7 +27,7 @@ Optional properties:
 
 Example:
 
-        fb0: fb@0x00500000 {
+        fb0: fb@00500000 {
                 compatible = "atmel,at91sam9g45-lcdc";
                 reg = <0x00500000 0x1000>;
                 interrupts = <23 3 0>;
@@ -41,7 +41,7 @@ Example:
 
 Example for fixed framebuffer memory:
 
-        fb0: fb@0x00500000 {
+        fb0: fb@00500000 {
                 compatible = "atmel,at91sam9263-lcdc";
                 reg = <0x00700000 0x1000 0x70000000 0x200000>;
                 [...]
diff --git a/Documentation/devicetree/bindings/dma/qcom_hidma_mgmt.txt b/Documentation/devicetree/bindings/dma/qcom_hidma_mgmt.txt
index 55492c264d17..b3408cc57be6 100644
--- a/Documentation/devicetree/bindings/dma/qcom_hidma_mgmt.txt
+++ b/Documentation/devicetree/bindings/dma/qcom_hidma_mgmt.txt
@@ -73,7 +73,7 @@ Hypervisor OS configuration:
                 max-read-transactions = <31>;
                 channel-reset-timeout-cycles = <0x500>;
 
-                hidma_24: dma-controller@0x5c050000 {
+                hidma_24: dma-controller@5c050000 {
                         compatible = "qcom,hidma-1.0";
                         reg = <0 0x5c050000 0x0 0x1000>,
                               <0 0x5c0b0000 0x0 0x1000>;
@@ -85,7 +85,7 @@ Hypervisor OS configuration:
 
 Guest OS configuration:
 
-        hidma_24: dma-controller@0x5c050000 {
+        hidma_24: dma-controller@5c050000 {
                 compatible = "qcom,hidma-1.0";
                 reg = <0 0x5c050000 0x0 0x1000>,
                       <0 0x5c0b0000 0x0 0x1000>;
diff --git a/Documentation/devicetree/bindings/dma/zxdma.txt b/Documentation/devicetree/bindings/dma/zxdma.txt
index abec59f35fde..0ab80f69e566 100644
--- a/Documentation/devicetree/bindings/dma/zxdma.txt
+++ b/Documentation/devicetree/bindings/dma/zxdma.txt
@@ -13,7 +13,7 @@ Required properties:
 Example:
 
 Controller:
-        dma: dma-controller@0x09c00000{
+        dma: dma-controller@09c00000{
                 compatible = "zte,zx296702-dma";
                 reg = <0x09c00000 0x1000>;
                 clocks = <&topclk ZX296702_DMA_ACLK>;
diff --git a/Documentation/devicetree/bindings/eeprom/at25.txt b/Documentation/devicetree/bindings/eeprom/at25.txt
index 1d3447165c37..e823d90b802f 100644
--- a/Documentation/devicetree/bindings/eeprom/at25.txt
+++ b/Documentation/devicetree/bindings/eeprom/at25.txt
@@ -1,7 +1,12 @@
 EEPROMs (SPI) compatible with Atmel at25.
 
 Required properties:
-- compatible : "atmel,at25".
+- compatible : Should be "<vendor>,<type>", and generic value "atmel,at25".
+  Example "<vendor>,<type>" values:
+    "microchip,25lc040"
+    "st,m95m02"
+    "st,m95256"
+
 - reg : chip select number
 - spi-max-frequency : max spi frequency to use
 - pagesize : size of the eeprom page
@@ -13,7 +18,7 @@ Optional properties:
 - spi-cpol : SPI inverse clock polarity, as per spi-bus bindings.
 - read-only : this parameter-less property disables writes to the eeprom
 
-Obsolete legacy properties are can be used in place of "size", "pagesize",
+Obsolete legacy properties can be used in place of "size", "pagesize",
 "address-width", and "read-only":
 - at25,byte-len : total eeprom size in bytes
 - at25,addr-mode : addr-mode flags, as defined in include/linux/spi/eeprom.h
@@ -22,8 +27,8 @@ Obsolete legacy properties are can be used in place of "size", "pagesize",
 Additional compatible properties are also allowed.
 
 Example:
-        at25@0 {
-                compatible = "atmel,at25", "st,m95256";
+        eeprom@0 {
+                compatible = "st,m95256", "atmel,at25";
                 reg = <0>
                 spi-max-frequency = <5000000>;
                 spi-cpha;
diff --git a/Documentation/devicetree/bindings/gpio/gpio-altera.txt b/Documentation/devicetree/bindings/gpio/gpio-altera.txt
index 826a7208ca93..146e554b3c67 100644
--- a/Documentation/devicetree/bindings/gpio/gpio-altera.txt
+++ b/Documentation/devicetree/bindings/gpio/gpio-altera.txt
@@ -30,7 +30,7 @@ Optional properties:
 
 Example:
 
-gpio_altr: gpio@0xff200000 {
+gpio_altr: gpio@ff200000 {
         compatible = "altr,pio-1.0";
         reg = <0xff200000 0x10>;
         interrupts = <0 45 4>;
diff --git a/Documentation/devicetree/bindings/gpio/gpio-pca953x.txt b/Documentation/devicetree/bindings/gpio/gpio-pca953x.txt
index 7f57271df2bc..0d0158728f89 100644
--- a/Documentation/devicetree/bindings/gpio/gpio-pca953x.txt
+++ b/Documentation/devicetree/bindings/gpio/gpio-pca953x.txt
@@ -27,7 +27,7 @@ Required properties:
         ti,tca6424
         ti,tca9539
         ti,tca9554
-        onsemi,pca9654
+        onnn,pca9654
         exar,xra1202
 
 Optional properties:
diff --git a/Documentation/devicetree/bindings/i2c/i2c-jz4780.txt b/Documentation/devicetree/bindings/i2c/i2c-jz4780.txt
index 231e4cc4008c..d4a082acf92f 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-jz4780.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-jz4780.txt
@@ -18,7 +18,7 @@ Optional properties:
 Example
 
 / {
-        i2c4: i2c4@0x10054000 {
+        i2c4: i2c4@10054000 {
                 compatible = "ingenic,jz4780-i2c";
                 reg = <0x10054000 0x1000>;
 
diff --git a/Documentation/devicetree/bindings/iio/pressure/hp03.txt b/Documentation/devicetree/bindings/iio/pressure/hp03.txt
index 54e7e70bcea5..831dbee7a5c3 100644
--- a/Documentation/devicetree/bindings/iio/pressure/hp03.txt
+++ b/Documentation/devicetree/bindings/iio/pressure/hp03.txt
@@ -10,7 +10,7 @@ Required properties:
 
 Example:
 
-hp03@0x77 {
+hp03@77 {
         compatible = "hoperf,hp03";
         reg = <0x77>;
         xclr-gpio = <&portc 0 0x0>;
diff --git a/Documentation/devicetree/bindings/input/touchscreen/bu21013.txt b/Documentation/devicetree/bindings/input/touchscreen/bu21013.txt
index ca5a2c86480c..56d835242af2 100644
--- a/Documentation/devicetree/bindings/input/touchscreen/bu21013.txt
+++ b/Documentation/devicetree/bindings/input/touchscreen/bu21013.txt
@@ -15,7 +15,7 @@ Optional properties:
 Example:
 
         i2c@80110000 {
-                bu21013_tp@0x5c {
+                bu21013_tp@5c {
                         compatible = "rohm,bu21013_tp";
                         reg = <0x5c>;
                         touch-gpio = <&gpio2 20 0x4>;
diff --git a/Documentation/devicetree/bindings/interrupt-controller/arm,gic.txt b/Documentation/devicetree/bindings/interrupt-controller/arm,gic.txt
index 560d8a727b8f..2f3244648646 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/arm,gic.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/arm,gic.txt
@@ -155,7 +155,7 @@ Example:
                       <0x0 0xe112f000 0 0x02000>,
                       <0x0 0xe1140000 0 0x10000>,
                       <0x0 0xe1160000 0 0x10000>;
-                v2m0: v2m@0x8000 {
+                v2m0: v2m@8000 {
                         compatible = "arm,gic-v2m-frame";
                         msi-controller;
                         reg = <0x0 0x80000 0 0x1000>;
@@ -163,7 +163,7 @@ Example:
 
                 ....
 
-                v2mN: v2m@0x9000 {
+                v2mN: v2m@9000 {
                         compatible = "arm,gic-v2m-frame";
                         msi-controller;
                         reg = <0x0 0x90000 0 0x1000>;
diff --git a/Documentation/devicetree/bindings/interrupt-controller/img,meta-intc.txt b/Documentation/devicetree/bindings/interrupt-controller/img,meta-intc.txt
index 80994adab392..42431f44697f 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/img,meta-intc.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/img,meta-intc.txt
@@ -71,7 +71,7 @@ Example 2:
          * An interrupt generating device that is wired to a Meta external
          * trigger block.
          */
-        uart1: uart@0x02004c00 {
+        uart1: uart@02004c00 {
                 // Interrupt source '5' that is level-sensitive.
                 // Note that there are only two cells as specified in the
                 // interrupt parent's '#interrupt-cells' property.
diff --git a/Documentation/devicetree/bindings/interrupt-controller/img,pdc-intc.txt b/Documentation/devicetree/bindings/interrupt-controller/img,pdc-intc.txt
index a69118550344..5dc2a55ad811 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/img,pdc-intc.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/img,pdc-intc.txt
@@ -51,7 +51,7 @@ Example 1:
         /*
          * TZ1090 PDC block
          */
-        pdc: pdc@0x02006000 {
+        pdc: pdc@02006000 {
                 // This is an interrupt controller node.
                 interrupt-controller;
 
diff --git a/Documentation/devicetree/bindings/interrupt-controller/st,spear3xx-shirq.txt b/Documentation/devicetree/bindings/interrupt-controller/st,spear3xx-shirq.txt
index 715a013ed4bd..2ab0ea39867b 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/st,spear3xx-shirq.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/st,spear3xx-shirq.txt
@@ -39,7 +39,7 @@ Example:
 
 The following is an example from the SPEAr320 SoC dtsi file.
 
-shirq: interrupt-controller@0xb3000000 {
+shirq: interrupt-controller@b3000000 {
         compatible = "st,spear320-shirq";
         reg = <0xb3000000 0x1000>;
         interrupts = <28 29 30 1>;
diff --git a/Documentation/devicetree/bindings/mailbox/altera-mailbox.txt b/Documentation/devicetree/bindings/mailbox/altera-mailbox.txt
index c2619797ce0c..49cfc8c337c4 100644
--- a/Documentation/devicetree/bindings/mailbox/altera-mailbox.txt
+++ b/Documentation/devicetree/bindings/mailbox/altera-mailbox.txt
@@ -14,7 +14,7 @@ Optional properties:
                         depends on the interrupt controller parent.
 
 Example:
-        mbox_tx: mailbox@0x100 {
+        mbox_tx: mailbox@100 {
                 compatible = "altr,mailbox-1.0";
                 reg = <0x100 0x8>;
                 interrupt-parent = < &gic_0 >;
@@ -22,7 +22,7 @@ Example:
                 #mbox-cells = <1>;
         };
 
-        mbox_rx: mailbox@0x200 {
+        mbox_rx: mailbox@200 {
                 compatible = "altr,mailbox-1.0";
                 reg = <0x200 0x8>;
                 interrupt-parent = < &gic_0 >;
@@ -40,7 +40,7 @@ support only one channel).The equivalent "mbox-names" property value can be
 used to give a name to the communication channel to be used by the client user.
 
 Example:
-        mclient0: mclient0@0x400 {
+        mclient0: mclient0@400 {
                 compatible = "client-1.0";
                 reg = <0x400 0x10>;
                 mbox-names = "mbox-tx", "mbox-rx";
diff --git a/Documentation/devicetree/bindings/mailbox/brcm,iproc-pdc-mbox.txt b/Documentation/devicetree/bindings/mailbox/brcm,iproc-pdc-mbox.txt
index 0f3ee81d92c2..9bcdf2087625 100644
--- a/Documentation/devicetree/bindings/mailbox/brcm,iproc-pdc-mbox.txt
+++ b/Documentation/devicetree/bindings/mailbox/brcm,iproc-pdc-mbox.txt
@@ -15,7 +15,7 @@ Optional properties:
 - brcm,use-bcm-hdr:  present if a BCM header precedes each frame.
 
 Example:
-        pdc0: iproc-pdc0@0x612c0000 {
+        pdc0: iproc-pdc0@612c0000 {
                 compatible = "brcm,iproc-pdc-mbox";
                 reg = <0 0x612c0000 0 0x445>;  /* PDC FS0 regs */
                 interrupts = <GIC_SPI 187 IRQ_TYPE_LEVEL_HIGH>;
diff --git a/Documentation/devicetree/bindings/media/exynos5-gsc.txt b/Documentation/devicetree/bindings/media/exynos5-gsc.txt
index 0d4fdaedc6f1..bc963a6d305a 100644
--- a/Documentation/devicetree/bindings/media/exynos5-gsc.txt
+++ b/Documentation/devicetree/bindings/media/exynos5-gsc.txt
@@ -17,7 +17,7 @@ Optional properties:
 
 Example:
 
-gsc_0:  gsc@0x13e00000 {
+gsc_0:  gsc@13e00000 {
         compatible = "samsung,exynos5250-gsc";
         reg = <0x13e00000 0x1000>;
         interrupts = <0 85 0>;
diff --git a/Documentation/devicetree/bindings/media/mediatek-vcodec.txt b/Documentation/devicetree/bindings/media/mediatek-vcodec.txt
index 46c15c54175d..2a615d84a682 100644
--- a/Documentation/devicetree/bindings/media/mediatek-vcodec.txt
+++ b/Documentation/devicetree/bindings/media/mediatek-vcodec.txt
@@ -68,7 +68,7 @@ vcodec_dec: vcodec@16000000 {
                   "vdec_bus_clk_src";
   };
 
-  vcodec_enc: vcodec@0x18002000 {
+  vcodec_enc: vcodec@18002000 {
     compatible = "mediatek,mt8173-vcodec-enc";
     reg = <0 0x18002000 0 0x1000>,    /*VENC_SYS*/
           <0 0x19002000 0 0x1000>;    /*VENC_LT_SYS*/
diff --git a/Documentation/devicetree/bindings/media/rcar_vin.txt b/Documentation/devicetree/bindings/media/rcar_vin.txt
index 6e4ef8caf759..19357d0bbe65 100644
--- a/Documentation/devicetree/bindings/media/rcar_vin.txt
+++ b/Documentation/devicetree/bindings/media/rcar_vin.txt
@@ -44,7 +44,7 @@ Device node example
                vin0 = &vin0;
         };
 
-        vin0: vin@0xe6ef0000 {
+        vin0: vin@e6ef0000 {
                 compatible = "renesas,vin-r8a7790", "renesas,rcar-gen2-vin";
                 clocks = <&mstp8_clks R8A7790_CLK_VIN0>;
                 reg = <0 0xe6ef0000 0 0x1000>;
diff --git a/Documentation/devicetree/bindings/media/samsung-fimc.txt b/Documentation/devicetree/bindings/media/samsung-fimc.txt
index e4e15d8d7521..48c599dacbdf 100644
--- a/Documentation/devicetree/bindings/media/samsung-fimc.txt
+++ b/Documentation/devicetree/bindings/media/samsung-fimc.txt
@@ -138,7 +138,7 @@ Example:
                 };
 
                 /* MIPI CSI-2 bus IF sensor */
-                s5c73m3: sensor@0x1a {
+                s5c73m3: sensor@1a {
                         compatible = "samsung,s5c73m3";
                         reg = <0x1a>;
                         vddio-supply = <...>;
diff --git a/Documentation/devicetree/bindings/media/sh_mobile_ceu.txt b/Documentation/devicetree/bindings/media/sh_mobile_ceu.txt
index 1ce4e46bcbb7..17a8e81ca0cc 100644
--- a/Documentation/devicetree/bindings/media/sh_mobile_ceu.txt
+++ b/Documentation/devicetree/bindings/media/sh_mobile_ceu.txt
@@ -8,7 +8,7 @@ Bindings, specific for the sh_mobile_ceu_camera.c driver:
 
 Example:
 
-ceu0: ceu@0xfe910000 {
+ceu0: ceu@fe910000 {
         compatible = "renesas,sh-mobile-ceu";
         reg = <0xfe910000 0xa0>;
         interrupt-parent = <&intcs>;
diff --git a/Documentation/devicetree/bindings/media/video-interfaces.txt b/Documentation/devicetree/bindings/media/video-interfaces.txt
index 3994b0143dd1..258b8dfddf48 100644
--- a/Documentation/devicetree/bindings/media/video-interfaces.txt
+++ b/Documentation/devicetree/bindings/media/video-interfaces.txt
@@ -154,7 +154,7 @@ imx074 is linked to ceu0 through the MIPI CSI-2 receiver (csi2). ceu0 has a
 'port' node which may indicate that at any time only one of the following data
 pipelines can be active: ov772x -> ceu0 or imx074 -> csi2 -> ceu0.
 
-        ceu0: ceu@0xfe910000 {
+        ceu0: ceu@fe910000 {
                 compatible = "renesas,sh-mobile-ceu";
                 reg = <0xfe910000 0xa0>;
                 interrupts = <0x880>;
@@ -193,9 +193,9 @@ pipelines can be active: ov772x -> ceu0 or imx074 -> csi2 -> ceu0.
                 };
         };
 
-        i2c0: i2c@0xfff20000 {
+        i2c0: i2c@fff20000 {
                 ...
-                ov772x_1: camera@0x21 {
+                ov772x_1: camera@21 {
                         compatible = "ovti,ov772x";
                         reg = <0x21>;
                         vddio-supply = <&regulator1>;
@@ -219,7 +219,7 @@ pipelines can be active: ov772x -> ceu0 or imx074 -> csi2 -> ceu0.
                         };
                 };
 
-                imx074: camera@0x1a {
+                imx074: camera@1a {
                         compatible = "sony,imx074";
                         reg = <0x1a>;
                         vddio-supply = <&regulator1>;
@@ -239,7 +239,7 @@ pipelines can be active: ov772x -> ceu0 or imx074 -> csi2 -> ceu0.
                 };
         };
 
-        csi2: csi2@0xffc90000 {
+        csi2: csi2@ffc90000 {
                 compatible = "renesas,sh-mobile-csi2";
                 reg = <0xffc90000 0x1000>;
                 interrupts = <0x17a0>;
diff --git a/Documentation/devicetree/bindings/memory-controllers/ti/emif.txt b/Documentation/devicetree/bindings/memory-controllers/ti/emif.txt
index fd823d6091b2..152eeccbde1c 100644
--- a/Documentation/devicetree/bindings/memory-controllers/ti/emif.txt
+++ b/Documentation/devicetree/bindings/memory-controllers/ti/emif.txt
@@ -46,7 +46,7 @@ Optional properties:
 
 Example:
 
-emif1: emif@0x4c000000 {
+emif1: emif@4c000000 {
         compatible      = "ti,emif-4d";
         ti,hwmods       = "emif2";
         phy-type        = <1>;
diff --git a/Documentation/devicetree/bindings/mfd/ti-keystone-devctrl.txt b/Documentation/devicetree/bindings/mfd/ti-keystone-devctrl.txt
index 20963c76b4bc..71a1f5963936 100644
--- a/Documentation/devicetree/bindings/mfd/ti-keystone-devctrl.txt
+++ b/Documentation/devicetree/bindings/mfd/ti-keystone-devctrl.txt
@@ -13,7 +13,7 @@ Required properties:
 
 Example:
 
-devctrl: device-state-control@0x02620000 {
+devctrl: device-state-control@02620000 {
         compatible = "ti,keystone-devctrl", "syscon";
         reg = <0x02620000 0x1000>;
 };
diff --git a/Documentation/devicetree/bindings/misc/brcm,kona-smc.txt b/Documentation/devicetree/bindings/misc/brcm,kona-smc.txt
index 6c9f176f3571..05b47232ed9e 100644
--- a/Documentation/devicetree/bindings/misc/brcm,kona-smc.txt
+++ b/Documentation/devicetree/bindings/misc/brcm,kona-smc.txt
@@ -9,7 +9,7 @@ Required properties:
 - reg : Location and size of bounce buffer
 
 Example:
-        smc@0x3404c000 {
+        smc@3404c000 {
                 compatible = "brcm,bcm11351-smc", "brcm,kona-smc";
                 reg = <0x3404c000 0x400>; //1 KiB in SRAM
         };
diff --git a/Documentation/devicetree/bindings/mmc/brcm,kona-sdhci.txt b/Documentation/devicetree/bindings/mmc/brcm,kona-sdhci.txt
index aaba2483b4ff..7f5dd83f5bd9 100644
--- a/Documentation/devicetree/bindings/mmc/brcm,kona-sdhci.txt
+++ b/Documentation/devicetree/bindings/mmc/brcm,kona-sdhci.txt
@@ -12,7 +12,7 @@ Refer to clocks/clock-bindings.txt for generic clock consumer properties.
 
 Example:
 
-sdio2: sdio@0x3f1a0000 {
+sdio2: sdio@3f1a0000 {
         compatible = "brcm,kona-sdhci";
         reg = <0x3f1a0000 0x10000>;
         clocks = <&sdio3_clk>;
diff --git a/Documentation/devicetree/bindings/mmc/brcm,sdhci-iproc.txt b/Documentation/devicetree/bindings/mmc/brcm,sdhci-iproc.txt
index 954561d09a8e..fa90d253dc7e 100644
--- a/Documentation/devicetree/bindings/mmc/brcm,sdhci-iproc.txt
+++ b/Documentation/devicetree/bindings/mmc/brcm,sdhci-iproc.txt
@@ -24,7 +24,7 @@ Optional properties:
 
 Example:
 
-sdhci0: sdhci@0x18041000 {
+sdhci0: sdhci@18041000 {
         compatible = "brcm,sdhci-iproc-cygnus";
         reg = <0x18041000 0x100>;
         interrupts = <GIC_SPI 108 IRQ_TYPE_LEVEL_HIGH>;
diff --git a/Documentation/devicetree/bindings/mmc/ti-omap-hsmmc.txt b/Documentation/devicetree/bindings/mmc/ti-omap-hsmmc.txt
index 3a4ac401e6f9..19f5508a7569 100644
--- a/Documentation/devicetree/bindings/mmc/ti-omap-hsmmc.txt
+++ b/Documentation/devicetree/bindings/mmc/ti-omap-hsmmc.txt
@@ -55,7 +55,7 @@ Examples:
 
 [hwmod populated DMA resources]
 
-        mmc1: mmc@0x4809c000 {
+        mmc1: mmc@4809c000 {
                 compatible = "ti,omap4-hsmmc";
                 reg = <0x4809c000 0x400>;
                 ti,hwmods = "mmc1";
@@ -67,7 +67,7 @@ Examples:
 
 [generic DMA request binding]
 
-        mmc1: mmc@0x4809c000 {
+        mmc1: mmc@4809c000 {
                 compatible = "ti,omap4-hsmmc";
                 reg = <0x4809c000 0x400>;
                 ti,hwmods = "mmc1";
diff --git a/Documentation/devicetree/bindings/mtd/gpmc-nor.txt b/Documentation/devicetree/bindings/mtd/gpmc-nor.txt
index 131d3a74d0bd..c8567b40fe13 100644
--- a/Documentation/devicetree/bindings/mtd/gpmc-nor.txt
+++ b/Documentation/devicetree/bindings/mtd/gpmc-nor.txt
@@ -82,15 +82,15 @@ gpmc: gpmc@6e000000 {
                         label = "bootloader-nor";
                         reg = <0 0x40000>;
                 };
-                partition@0x40000 {
+                partition@40000 {
                         label = "params-nor";
                         reg = <0x40000 0x40000>;
                 };
-                partition@0x80000 {
+                partition@80000 {
                         label = "kernel-nor";
                         reg = <0x80000 0x200000>;
                 };
-                partition@0x280000 {
+                partition@280000 {
                         label = "filesystem-nor";
                         reg = <0x240000 0x7d80000>;
                 };
diff --git a/Documentation/devicetree/bindings/mtd/jedec,spi-nor.txt b/Documentation/devicetree/bindings/mtd/jedec,spi-nor.txt
index 376fa2f50e6b..956bb046e599 100644
--- a/Documentation/devicetree/bindings/mtd/jedec,spi-nor.txt
+++ b/Documentation/devicetree/bindings/mtd/jedec,spi-nor.txt
@@ -13,7 +13,6 @@ Required properties:
                  at25df321a
                  at25df641
                  at26df081a
-                 en25s64
                  mr25h128
                  mr25h256
                  mr25h10
@@ -33,7 +32,6 @@ Required properties:
                  s25fl008k
                  s25fl064k
                  sst25vf040b
-                 sst25wf040b
                  m25p40
                  m25p80
                  m25p16
diff --git a/Documentation/devicetree/bindings/mtd/mtk-nand.txt b/Documentation/devicetree/bindings/mtd/mtk-nand.txt
index dbf9e054c11c..0431841de781 100644
--- a/Documentation/devicetree/bindings/mtd/mtk-nand.txt
+++ b/Documentation/devicetree/bindings/mtd/mtk-nand.txt
@@ -131,7 +131,7 @@ Example:
                                 read-only;
                                 reg = <0x00000000 0x00400000>;
                         };
-                        android@0x00400000 {
+                        android@00400000 {
                                 label = "android";
                                 reg = <0x00400000 0x12c00000>;
                         };
diff --git a/Documentation/devicetree/bindings/net/altera_tse.txt b/Documentation/devicetree/bindings/net/altera_tse.txt
index a706297998e9..0e21df94a53f 100644
--- a/Documentation/devicetree/bindings/net/altera_tse.txt
+++ b/Documentation/devicetree/bindings/net/altera_tse.txt
@@ -52,7 +52,7 @@ Optional properties:
 
 Example:
 
-        tse_sub_0_eth_tse_0: ethernet@0x1,00000000 {
+        tse_sub_0_eth_tse_0: ethernet@1,00000000 {
                 compatible = "altr,tse-msgdma-1.0";
                 reg =   <0x00000001 0x00000000 0x00000400>,
                         <0x00000001 0x00000460 0x00000020>,
@@ -90,7 +90,7 @@ Example:
                 };
         };
 
-        tse_sub_1_eth_tse_0: ethernet@0x1,00001000 {
+        tse_sub_1_eth_tse_0: ethernet@1,00001000 {
                 compatible = "altr,tse-msgdma-1.0";
                 reg =   <0x00000001 0x00001000 0x00000400>,
                         <0x00000001 0x00001460 0x00000020>,
diff --git a/Documentation/devicetree/bindings/net/mdio.txt b/Documentation/devicetree/bindings/net/mdio.txt
index 96a53f89aa6e..e3e1603f256c 100644
--- a/Documentation/devicetree/bindings/net/mdio.txt
+++ b/Documentation/devicetree/bindings/net/mdio.txt
@@ -18,7 +18,7 @@ Example :
 This example shows these optional properties, plus other properties
 required for the TI Davinci MDIO driver.
 
-        davinci_mdio: ethernet@0x5c030000 {
+        davinci_mdio: ethernet@5c030000 {
                 compatible = "ti,davinci_mdio";
                 reg = <0x5c030000 0x1000>;
                 #address-cells = <1>;
diff --git a/Documentation/devicetree/bindings/net/socfpga-dwmac.txt b/Documentation/devicetree/bindings/net/socfpga-dwmac.txt
index b30d04b54ee9..17d6819669c8 100644
--- a/Documentation/devicetree/bindings/net/socfpga-dwmac.txt
+++ b/Documentation/devicetree/bindings/net/socfpga-dwmac.txt
@@ -28,7 +28,7 @@ Required properties:
 
 Example:
 
-gmii_to_sgmii_converter: phy@0x100000240 {
+gmii_to_sgmii_converter: phy@100000240 {
         compatible = "altr,gmii-to-sgmii-2.0";
         reg = <0x00000001 0x00000240 0x00000008>,
                 <0x00000001 0x00000200 0x00000040>;
diff --git a/Documentation/devicetree/bindings/nios2/nios2.txt b/Documentation/devicetree/bindings/nios2/nios2.txt
index d6d0a94cb3bb..b95e831bcba3 100644
--- a/Documentation/devicetree/bindings/nios2/nios2.txt
+++ b/Documentation/devicetree/bindings/nios2/nios2.txt
@@ -36,7 +36,7 @@ Optional properties:
 
 Example:
 
-cpu@0x0 {
+cpu@0 {
         device_type = "cpu";
         compatible = "altr,nios2-1.0";
         reg = <0>;
diff --git a/Documentation/devicetree/bindings/pci/altera-pcie.txt b/Documentation/devicetree/bindings/pci/altera-pcie.txt
index 495880193adc..a1dc9366a8fc 100644
--- a/Documentation/devicetree/bindings/pci/altera-pcie.txt
+++ b/Documentation/devicetree/bindings/pci/altera-pcie.txt
@@ -25,7 +25,7 @@ Optional properties:
 - bus-range:    PCI bus numbers covered
 
 Example
-        pcie_0: pcie@0xc00000000 {
+        pcie_0: pcie@c00000000 {
                 compatible = "altr,pcie-root-port-1.0";
                 reg = <0xc0000000 0x20000000>,
                         <0xff220000 0x00004000>;
diff --git a/Documentation/devicetree/bindings/pci/fsl,imx6q-pcie.txt b/Documentation/devicetree/bindings/pci/fsl,imx6q-pcie.txt
index 7b1e48bf172b..149d8f7f86b0 100644
--- a/Documentation/devicetree/bindings/pci/fsl,imx6q-pcie.txt
+++ b/Documentation/devicetree/bindings/pci/fsl,imx6q-pcie.txt
@@ -52,7 +52,7 @@ Additional required properties for imx7d-pcie:
 
 Example:
 
-        pcie@0x01000000 {
+        pcie@01000000 {
                 compatible = "fsl,imx6q-pcie", "snps,dw-pcie";
                 reg = <0x01ffc000 0x04000>,
                       <0x01f00000 0x80000>;
diff --git a/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt b/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt
index bdb7ab39d2d7..7bf9df047a1e 100644
--- a/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt
+++ b/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt
@@ -21,7 +21,7 @@ Optional properties:
 - dma-coherent: Present if DMA operations are coherent.
 
 Hip05 Example (note that Hip06 is the same except compatible):
-        pcie@0xb0080000 {
+        pcie@b0080000 {
                 compatible = "hisilicon,hip05-pcie", "snps,dw-pcie";
                 reg = <0 0xb0080000 0 0x10000>, <0x220 0x00000000 0 0x2000>;
                 reg-names = "rc_dbi", "config";
diff --git a/Documentation/devicetree/bindings/phy/sun4i-usb-phy.txt b/Documentation/devicetree/bindings/phy/sun4i-usb-phy.txt
index cbc7847dbf6c..c1ce5a0a652e 100644
--- a/Documentation/devicetree/bindings/phy/sun4i-usb-phy.txt
+++ b/Documentation/devicetree/bindings/phy/sun4i-usb-phy.txt
@@ -45,7 +45,7 @@ Optional properties:
 - usb3_vbus-supply : regulator phandle for controller usb3 vbus
 
 Example:
-        usbphy: phy@0x01c13400 {
+        usbphy: phy@01c13400 {
                 #phy-cells = <1>;
                 compatible = "allwinner,sun4i-a10-usb-phy";
                 /* phy base regs, phy1 pmu reg, phy2 pmu reg */
diff --git a/Documentation/devicetree/bindings/pinctrl/brcm,cygnus-pinmux.txt b/Documentation/devicetree/bindings/pinctrl/brcm,cygnus-pinmux.txt
index 3600d5c6c4d7..3914529a3214 100644
--- a/Documentation/devicetree/bindings/pinctrl/brcm,cygnus-pinmux.txt
+++ b/Documentation/devicetree/bindings/pinctrl/brcm,cygnus-pinmux.txt
@@ -25,7 +25,7 @@ Documentation/devicetree/bindings/pinctrl/pinctrl-bindings.txt
 
 For example:
 
-        pinmux: pinmux@0x0301d0c8 {
+        pinmux: pinmux@0301d0c8 {
                 compatible = "brcm,cygnus-pinmux";
                 reg = <0x0301d0c8 0x1b0>;
 
diff --git a/Documentation/devicetree/bindings/pinctrl/pinctrl-atlas7.txt b/Documentation/devicetree/bindings/pinctrl/pinctrl-atlas7.txt
index eecf028ff485..bf9b07016c87 100644
--- a/Documentation/devicetree/bindings/pinctrl/pinctrl-atlas7.txt
+++ b/Documentation/devicetree/bindings/pinctrl/pinctrl-atlas7.txt
@@ -96,14 +96,14 @@ For example, pinctrl might have subnodes like the following:
 
 For a specific board, if it wants to use sd1,
 it can add the following to its board-specific .dts file.
-sd1: sd@0x12340000 {
+sd1: sd@12340000 {
         pinctrl-names = "default";
         pinctrl-0 = <&sd1_pmx0>;
 }
 
 or
 
-sd1: sd@0x12340000 {
+sd1: sd@12340000 {
         pinctrl-names = "default";
         pinctrl-0 = <&sd1_pmx1>;
 }
diff --git a/Documentation/devicetree/bindings/pinctrl/pinctrl-sirf.txt b/Documentation/devicetree/bindings/pinctrl/pinctrl-sirf.txt
index 5f55be59d914..f8420520e14b 100644
--- a/Documentation/devicetree/bindings/pinctrl/pinctrl-sirf.txt
+++ b/Documentation/devicetree/bindings/pinctrl/pinctrl-sirf.txt
@@ -41,7 +41,7 @@ For example, pinctrl might have subnodes like the following:
 
 For a specific board, if it wants to use uart2 without hardware flow control,
 it can add the following to its board-specific .dts file.
-uart2: uart@0xb0070000 {
+uart2: uart@b0070000 {
         pinctrl-names = "default";
         pinctrl-0 = <&uart2_noflow_pins_a>;
 }
diff --git a/Documentation/devicetree/bindings/pinctrl/rockchip,pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/rockchip,pinctrl.txt
index 4864e3a74de3..a01a3b8a2363 100644
--- a/Documentation/devicetree/bindings/pinctrl/rockchip,pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/rockchip,pinctrl.txt
@@ -136,7 +136,7 @@ Example for rk3188:
                 #size-cells = <1>;
                 ranges;
 
-                gpio0: gpio0@0x2000a000 {
+                gpio0: gpio0@2000a000 {
                         compatible = "rockchip,rk3188-gpio-bank0";
                         reg = <0x2000a000 0x100>;
                         interrupts = <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>;
@@ -149,7 +149,7 @@ Example for rk3188:
                         #interrupt-cells = <2>;
                 };
 
-                gpio1: gpio1@0x2003c000 {
+                gpio1: gpio1@2003c000 {
                         compatible = "rockchip,gpio-bank";
                         reg = <0x2003c000 0x100>;
                         interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>;
diff --git a/Documentation/devicetree/bindings/regulator/regulator.txt b/Documentation/devicetree/bindings/regulator/regulator.txt
index 378f6dc8b8bd..3cbf56ce66ea 100644
--- a/Documentation/devicetree/bindings/regulator/regulator.txt
+++ b/Documentation/devicetree/bindings/regulator/regulator.txt
@@ -107,7 +107,7 @@ regulators (twl_reg1 and twl_reg2),
                 ...
         };
 
-        mmc: mmc@0x0 {
+        mmc: mmc@0 {
                 ...
                 ...
                 vmmc-supply = <&twl_reg1>;
diff --git a/Documentation/devicetree/bindings/serial/efm32-uart.txt b/Documentation/devicetree/bindings/serial/efm32-uart.txt
index 8adbab268ca3..4f8d8fde0c1c 100644
--- a/Documentation/devicetree/bindings/serial/efm32-uart.txt
+++ b/Documentation/devicetree/bindings/serial/efm32-uart.txt
@@ -12,7 +12,7 @@ Optional properties:
 
 Example:
 
-uart@0x4000c400 {
+uart@4000c400 {
         compatible = "energymicro,efm32-uart";
         reg = <0x4000c400 0x400>;
         interrupts = <15>;
diff --git a/Documentation/devicetree/bindings/serio/allwinner,sun4i-ps2.txt b/Documentation/devicetree/bindings/serio/allwinner,sun4i-ps2.txt
index f311472990a7..75996b6111bb 100644
--- a/Documentation/devicetree/bindings/serio/allwinner,sun4i-ps2.txt
+++ b/Documentation/devicetree/bindings/serio/allwinner,sun4i-ps2.txt
@@ -14,7 +14,7 @@ Required properties:
 
 
 Example:
-        ps20: ps2@0x01c2a000 {
+        ps20: ps2@01c2a000 {
                 compatible = "allwinner,sun4i-a10-ps2";
                 reg = <0x01c2a000 0x400>;
                 interrupts = <0 62 4>;
diff --git a/Documentation/devicetree/bindings/soc/ti/keystone-navigator-qmss.txt b/Documentation/devicetree/bindings/soc/ti/keystone-navigator-qmss.txt
index 64c66a5644e7..77cd42cc5f54 100644
--- a/Documentation/devicetree/bindings/soc/ti/keystone-navigator-qmss.txt
+++ b/Documentation/devicetree/bindings/soc/ti/keystone-navigator-qmss.txt
@@ -220,7 +220,7 @@ qmss: qmss@2a40000 {
                 #address-cells = <1>;
                 #size-cells = <1>;
                 ranges;
-                pdsp0@0x2a10000 {
+                pdsp0@2a10000 {
                         reg = <0x2a10000 0x1000>,
                               <0x2a0f000 0x100>,
                               <0x2a0c000 0x3c8>,
diff --git a/Documentation/devicetree/bindings/sound/adi,axi-i2s.txt b/Documentation/devicetree/bindings/sound/adi,axi-i2s.txt
index 5875ca459ed1..4248b662deff 100644
--- a/Documentation/devicetree/bindings/sound/adi,axi-i2s.txt
+++ b/Documentation/devicetree/bindings/sound/adi,axi-i2s.txt
@@ -21,7 +21,7 @@ please check:
 
 Example:
 
-        i2s: i2s@0x77600000 {
+        i2s: i2s@77600000 {
                 compatible = "adi,axi-i2s-1.00.a";
                 reg = <0x77600000 0x1000>;
                 clocks = <&clk 15>, <&audio_clock>;
diff --git a/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt b/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt
index 4eb7997674a0..7b664e7cb4ae 100644
--- a/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt
+++ b/Documentation/devicetree/bindings/sound/adi,axi-spdif-tx.txt
@@ -20,7 +20,7 @@ please check:
 
 Example:
 
-        spdif: spdif@0x77400000 {
+        spdif: spdif@77400000 {
                 compatible = "adi,axi-spdif-tx-1.00.a";
                 reg = <0x77600000 0x1000>;
                 clocks = <&clk 15>, <&audio_clock>;
diff --git a/Documentation/devicetree/bindings/sound/ak4613.txt b/Documentation/devicetree/bindings/sound/ak4613.txt
index 1783f9ef0930..49a2e74fd9cb 100644
--- a/Documentation/devicetree/bindings/sound/ak4613.txt
+++ b/Documentation/devicetree/bindings/sound/ak4613.txt
@@ -20,7 +20,7 @@ Optional properties:
 Example:
 
 &i2c {
-        ak4613: ak4613@0x10 {
+        ak4613: ak4613@10 {
                 compatible = "asahi-kasei,ak4613";
                 reg = <0x10>;
         };
diff --git a/Documentation/devicetree/bindings/sound/ak4642.txt b/Documentation/devicetree/bindings/sound/ak4642.txt
index 340784db6808..58e48ee97175 100644
--- a/Documentation/devicetree/bindings/sound/ak4642.txt
+++ b/Documentation/devicetree/bindings/sound/ak4642.txt
@@ -17,7 +17,7 @@ Optional properties:
 Example 1:
 
 &i2c {
-        ak4648: ak4648@0x12 {
+        ak4648: ak4648@12 {
                 compatible = "asahi-kasei,ak4642";
                 reg = <0x12>;
         };
diff --git a/Documentation/devicetree/bindings/sound/da7218.txt b/Documentation/devicetree/bindings/sound/da7218.txt
index 5ca5a709b6aa..3ab9dfef38d1 100644
--- a/Documentation/devicetree/bindings/sound/da7218.txt
+++ b/Documentation/devicetree/bindings/sound/da7218.txt
@@ -73,7 +73,7 @@ Example:
                 compatible = "dlg,da7218";
                 reg = <0x1a>;
                 interrupt-parent = <&gpio6>;
-                interrupts = <11 IRQ_TYPE_LEVEL_HIGH>;
+                interrupts = <11 IRQ_TYPE_LEVEL_LOW>;
                 wakeup-source;
 
                 VDD-supply = <&reg_audio>;
diff --git a/Documentation/devicetree/bindings/sound/da7219.txt b/Documentation/devicetree/bindings/sound/da7219.txt
index cf61681826b6..5b54d2d045c3 100644
--- a/Documentation/devicetree/bindings/sound/da7219.txt
+++ b/Documentation/devicetree/bindings/sound/da7219.txt
@@ -77,7 +77,7 @@ Example:
                 reg = <0x1a>;
 
                 interrupt-parent = <&gpio6>;
-                interrupts = <11 IRQ_TYPE_LEVEL_HIGH>;
+                interrupts = <11 IRQ_TYPE_LEVEL_LOW>;
 
                 VDD-supply = <&reg_audio>;
                 VDDMIC-supply = <&reg_audio>;
diff --git a/Documentation/devicetree/bindings/sound/max98371.txt b/Documentation/devicetree/bindings/sound/max98371.txt
index 6c285235e64b..8b2b2704b574 100644
--- a/Documentation/devicetree/bindings/sound/max98371.txt
+++ b/Documentation/devicetree/bindings/sound/max98371.txt
@@ -10,7 +10,7 @@ Required properties:
 Example:
 
 &i2c {
-        max98371: max98371@0x31 {
+        max98371: max98371@31 {
                 compatible = "maxim,max98371";
                 reg = <0x31>;
         };
diff --git a/Documentation/devicetree/bindings/sound/max9867.txt b/Documentation/devicetree/bindings/sound/max9867.txt
index 394cd4eb17ec..b8bd914ee697 100644
--- a/Documentation/devicetree/bindings/sound/max9867.txt
+++ b/Documentation/devicetree/bindings/sound/max9867.txt
@@ -10,7 +10,7 @@ Required properties:
 Example:
 
 &i2c {
-        max9867: max9867@0x18 {
+        max9867: max9867@18 {
                 compatible = "maxim,max9867";
                 reg = <0x18>;
         };
diff --git a/Documentation/devicetree/bindings/sound/renesas,fsi.txt b/Documentation/devicetree/bindings/sound/renesas,fsi.txt
index 0d0ab51105b0..0cf0f819b823 100644
--- a/Documentation/devicetree/bindings/sound/renesas,fsi.txt
+++ b/Documentation/devicetree/bindings/sound/renesas,fsi.txt
@@ -20,7 +20,7 @@ Required properties:
 
 Example:
 
-sh_fsi2: sh_fsi2@0xec230000 {
+sh_fsi2: sh_fsi2@ec230000 {
         compatible = "renesas,sh_fsi2";
         reg = <0xec230000 0x400>;
         interrupts = <0 146 0x4>;
diff --git a/Documentation/devicetree/bindings/sound/rockchip-spdif.txt b/Documentation/devicetree/bindings/sound/rockchip-spdif.txt
index 0a1dc4e1815c..ec20c1271e92 100644
--- a/Documentation/devicetree/bindings/sound/rockchip-spdif.txt
+++ b/Documentation/devicetree/bindings/sound/rockchip-spdif.txt
@@ -33,7 +33,7 @@ Required properties on RK3288:
 
 Example for the rk3188 SPDIF controller:
 
-spdif: spdif@0x1011e000 {
+spdif: spdif@1011e000 {
         compatible = "rockchip,rk3188-spdif", "rockchip,rk3066-spdif";
         reg = <0x1011e000 0x2000>;
         interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
diff --git a/Documentation/devicetree/bindings/sound/st,sti-asoc-card.txt b/Documentation/devicetree/bindings/sound/st,sti-asoc-card.txt
index 40068ec0e9a5..9c1ee52fed5b 100644
--- a/Documentation/devicetree/bindings/sound/st,sti-asoc-card.txt
+++ b/Documentation/devicetree/bindings/sound/st,sti-asoc-card.txt
@@ -51,7 +51,7 @@ Optional properties:
 
 Example:
 
-        sti_uni_player1: sti-uni-player@0x8D81000 {
+        sti_uni_player1: sti-uni-player@8D81000 {
                 compatible = "st,stih407-uni-player-hdmi";
                 #sound-dai-cells = <0>;
                 st,syscfg = <&syscfg_core>;
@@ -63,7 +63,7 @@ Example:
                 st,tdm-mode = <1>;
         };
 
-        sti_uni_player2: sti-uni-player@0x8D82000 {
+        sti_uni_player2: sti-uni-player@8D82000 {
                 compatible = "st,stih407-uni-player-pcm-out";
                 #sound-dai-cells = <0>;
                 st,syscfg = <&syscfg_core>;
@@ -74,7 +74,7 @@ Example:
                 dma-names = "tx";
         };
 
-        sti_uni_player3: sti-uni-player@0x8D85000 {
+        sti_uni_player3: sti-uni-player@8D85000 {
                 compatible = "st,stih407-uni-player-spdif";
                 #sound-dai-cells = <0>;
                 st,syscfg = <&syscfg_core>;
@@ -85,7 +85,7 @@ Example:
                 dma-names = "tx";
         };
 
-        sti_uni_reader1: sti-uni-reader@0x8D84000 {
+        sti_uni_reader1: sti-uni-reader@8D84000 {
                 compatible = "st,stih407-uni-reader-hdmi";
                 #sound-dai-cells = <0>;
                 st,syscfg = <&syscfg_core>;
diff --git a/Documentation/devicetree/bindings/spi/efm32-spi.txt b/Documentation/devicetree/bindings/spi/efm32-spi.txt
index 2c1e6a43930b..e0fa61a1be0c 100644
--- a/Documentation/devicetree/bindings/spi/efm32-spi.txt
+++ b/Documentation/devicetree/bindings/spi/efm32-spi.txt
@@ -19,7 +19,7 @@ Recommended properties :
 
 Example:
 
-spi1: spi@0x4000c400 { /* USART1 */
+spi1: spi@4000c400 { /* USART1 */
         #address-cells = <1>;
         #size-cells = <0>;
         compatible = "energymicro,efm32-spi";
diff --git a/Documentation/devicetree/bindings/spi/fsl-imx-cspi.txt b/Documentation/devicetree/bindings/spi/fsl-imx-cspi.txt
index 5bf13960f7f4..e3c48b20b1a6 100644
--- a/Documentation/devicetree/bindings/spi/fsl-imx-cspi.txt
+++ b/Documentation/devicetree/bindings/spi/fsl-imx-cspi.txt
@@ -12,24 +12,30 @@ Required properties:
   - "fsl,imx53-ecspi" for SPI compatible with the one integrated on i.MX53 and later Soc
 - reg : Offset and length of the register set for the device
 - interrupts : Should contain CSPI/eCSPI interrupt
-- cs-gpios : Specifies the gpio pins to be used for chipselects.
 - clocks : Clock specifiers for both ipg and per clocks.
 - clock-names : Clock names should include both "ipg" and "per"
 See the clock consumer binding,
         Documentation/devicetree/bindings/clock/clock-bindings.txt
-- dmas: DMA specifiers for tx and rx dma. See the DMA client binding,
-                Documentation/devicetree/bindings/dma/dma.txt
-- dma-names: DMA request names should include "tx" and "rx" if present.
 
-Obsolete properties:
-- fsl,spi-num-chipselects : Contains the number of the chipselect
+Recommended properties:
+- cs-gpios : GPIOs to use as chip selects, see spi-bus.txt.  While the native chip
+select lines can be used, they appear to always generate a pulse between each
+word of a transfer.  Most use cases will require GPIO based chip selects to
+generate a valid transaction.
 
 Optional properties:
+- num-cs :  Number of total chip selects, see spi-bus.txt.
+- dmas: DMA specifiers for tx and rx dma. See the DMA client binding,
+Documentation/devicetree/bindings/dma/dma.txt.
+- dma-names: DMA request names, if present, should include "tx" and "rx".
 - fsl,spi-rdy-drctl: Integer, representing the value of DRCTL, the register
 controlling the SPI_READY handling. Note that to enable the DRCTL consideration,
 the SPI_READY mode-flag needs to be set too.
 Valid values are: 0 (disabled), 1 (edge-triggered burst) and 2 (level-triggered burst).
 
+Obsolete properties:
+- fsl,spi-num-chipselects : Contains the number of the chipselect
+
 Example:
 
 ecspi@70010000 {
diff --git a/Documentation/devicetree/bindings/thermal/thermal.txt b/Documentation/devicetree/bindings/thermal/thermal.txt
index 88b6ea1ad290..44d7cb2cb2c0 100644
--- a/Documentation/devicetree/bindings/thermal/thermal.txt
+++ b/Documentation/devicetree/bindings/thermal/thermal.txt
@@ -239,7 +239,7 @@ cpus {
          * A simple fan controller which supports 10 speeds of operation
          * (represented as 0-9).
          */
-        fan0: fan@0x48 {
+        fan0: fan@48 {
                 ...
                 cooling-min-level = <0>;
                 cooling-max-level = <9>;
@@ -252,7 +252,7 @@ ocp {
         /*
          * A simple IC with a single bandgap temperature sensor.
          */
-        bandgap0: bandgap@0x0000ED00 {
+        bandgap0: bandgap@0000ED00 {
                 ...
                 #thermal-sensor-cells = <0>;
         };
@@ -330,7 +330,7 @@ ocp {
         /*
          * A simple IC with several bandgap temperature sensors.
          */
-        bandgap0: bandgap@0x0000ED00 {
+        bandgap0: bandgap@0000ED00 {
                 ...
                 #thermal-sensor-cells = <1>;
         };
@@ -447,7 +447,7 @@ one thermal zone.
         /*
          * A simple IC with a single temperature sensor.
          */
-        adc: sensor@0x49 {
+        adc: sensor@49 {
                 ...
                 #thermal-sensor-cells = <0>;
         };
@@ -458,7 +458,7 @@ ocp {
         /*
          * A simple IC with a single bandgap temperature sensor.
          */
-        bandgap0: bandgap@0x0000ED00 {
+        bandgap0: bandgap@0000ED00 {
                 ...
                 #thermal-sensor-cells = <0>;
         };
@@ -516,7 +516,7 @@ with many sensors and many cooling devices.
         /*
          * An IC with several temperature sensor.
          */
-        adc_dummy: sensor@0x50 {
+        adc_dummy: sensor@50 {
                 ...
                 #thermal-sensor-cells = <1>; /* sensor internal ID */
         };
diff --git a/Documentation/devicetree/bindings/ufs/ufs-qcom.txt b/Documentation/devicetree/bindings/ufs/ufs-qcom.txt
index 1f69ee1a61ea..21d9a93db2e9 100644
--- a/Documentation/devicetree/bindings/ufs/ufs-qcom.txt
+++ b/Documentation/devicetree/bindings/ufs/ufs-qcom.txt
@@ -32,7 +32,7 @@ Optional properties:
 
 Example:
 
-        ufsphy1: ufsphy@0xfc597000 {
+        ufsphy1: ufsphy@fc597000 {
                 compatible = "qcom,ufs-phy-qmp-20nm";
                 reg = <0xfc597000 0x800>;
                 reg-names = "phy_mem";
@@ -53,7 +53,7 @@ Example:
                         <&clock_gcc clk_gcc_ufs_rx_cfg_clk>;
         };
 
-        ufshc@0xfc598000 {
+        ufshc@fc598000 {
                 ...
                 phys = <&ufsphy1>;
                 phy-names = "ufsphy";
diff --git a/Documentation/devicetree/bindings/ufs/ufshcd-pltfrm.txt b/Documentation/devicetree/bindings/ufs/ufshcd-pltfrm.txt
index a99ed5565b26..c39dfef76a18 100644
--- a/Documentation/devicetree/bindings/ufs/ufshcd-pltfrm.txt
+++ b/Documentation/devicetree/bindings/ufs/ufshcd-pltfrm.txt
@@ -46,7 +46,7 @@ Note: If above properties are not defined it can be assumed that the supply
 regulators or clocks are always on.
 
 Example:
-        ufshc@0xfc598000 {
+        ufshc@fc598000 {
                 compatible = "jedec,ufs-1.1";
                 reg = <0xfc598000 0x800>;
                 interrupts = <0 28 0>;
diff --git a/Documentation/devicetree/bindings/usb/am33xx-usb.txt b/Documentation/devicetree/bindings/usb/am33xx-usb.txt
index 7a33f22c815a..7a198a30408a 100644
--- a/Documentation/devicetree/bindings/usb/am33xx-usb.txt
+++ b/Documentation/devicetree/bindings/usb/am33xx-usb.txt
@@ -95,6 +95,7 @@ usb: usb@47400000 {
                 reg = <0x47401300 0x100>;
                 reg-names = "phy";
                 ti,ctrl_mod = <&ctrl_mod>;
+                #phy-cells = <0>;
         };
 
         usb0: usb@47401000 {
@@ -141,6 +142,7 @@ usb: usb@47400000 {
                 reg = <0x47401b00 0x100>;
                 reg-names = "phy";
                 ti,ctrl_mod = <&ctrl_mod>;
+                #phy-cells = <0>;
         };
 
         usb1: usb@47401800 {
diff --git a/Documentation/devicetree/bindings/usb/ehci-st.txt b/Documentation/devicetree/bindings/usb/ehci-st.txt
index 9feea6c3e4d9..065c91d955ad 100644
--- a/Documentation/devicetree/bindings/usb/ehci-st.txt
+++ b/Documentation/devicetree/bindings/usb/ehci-st.txt
@@ -22,7 +22,7 @@ See: Documentation/devicetree/bindings/reset/reset.txt
 
 Example:
 
-        ehci1: usb@0xfe203e00 {
+        ehci1: usb@fe203e00 {
                 compatible = "st,st-ehci-300x";
                 reg = <0xfe203e00 0x100>;
                 interrupts = <GIC_SPI 148 IRQ_TYPE_NONE>;
diff --git a/Documentation/devicetree/bindings/usb/ohci-st.txt b/Documentation/devicetree/bindings/usb/ohci-st.txt
index d893ec9131c3..44c998c16f85 100644
--- a/Documentation/devicetree/bindings/usb/ohci-st.txt
+++ b/Documentation/devicetree/bindings/usb/ohci-st.txt
@@ -20,7 +20,7 @@ See: Documentation/devicetree/bindings/reset/reset.txt
 
 Example:
 
-        ohci0: usb@0xfe1ffc00 {
+        ohci0: usb@fe1ffc00 {
                 compatible = "st,st-ohci-300x";
                 reg = <0xfe1ffc00 0x100>;
                 interrupts = <GIC_SPI 149 IRQ_TYPE_NONE>;
diff --git a/Documentation/devicetree/bindings/watchdog/ingenic,jz4740-wdt.txt b/Documentation/devicetree/bindings/watchdog/ingenic,jz4740-wdt.txt
index e27763ef0049..3c7a1cd13b10 100644
--- a/Documentation/devicetree/bindings/watchdog/ingenic,jz4740-wdt.txt
+++ b/Documentation/devicetree/bindings/watchdog/ingenic,jz4740-wdt.txt
@@ -6,7 +6,7 @@ reg: Register address and length for watchdog registers
 
 Example:
 
-watchdog: jz4740-watchdog@0x10002000 {
+watchdog: jz4740-watchdog@10002000 {
         compatible = "ingenic,jz4740-watchdog";
         reg = <0x10002000 0x100>;
 };
diff --git a/Documentation/driver-api/dmaengine/client.rst b/Documentation/driver-api/dmaengine/client.rst
index 6245c99af8c1..fbbb2831f29f 100644
--- a/Documentation/driver-api/dmaengine/client.rst
+++ b/Documentation/driver-api/dmaengine/client.rst
@@ -185,7 +185,7 @@ The details of these operations are:
       void dma_async_issue_pending(struct dma_chan *chan);
 
 Further APIs:
-------------
+-------------
 
 1. Terminate APIs
 
diff --git a/Documentation/driver-api/pci.rst b/Documentation/driver-api/pci.rst
index 01a6c8b7d3a7..ca85e5e78b2c 100644
--- a/Documentation/driver-api/pci.rst
+++ b/Documentation/driver-api/pci.rst
@@ -25,9 +25,6 @@ PCI Support Library
 .. kernel-doc:: drivers/pci/irq.c
    :export:
 
-.. kernel-doc:: drivers/pci/htirq.c
-   :export:
-
 .. kernel-doc:: drivers/pci/probe.c
    :export:
 
diff --git a/Documentation/filesystems/nilfs2.txt b/Documentation/filesystems/nilfs2.txt
index c0727dc36271..f2f3f8592a6f 100644
--- a/Documentation/filesystems/nilfs2.txt
+++ b/Documentation/filesystems/nilfs2.txt
@@ -25,8 +25,8 @@ available from the following download page.  At least "mkfs.nilfs2",
 cleaner or garbage collector) are required.  Details on the tools are
 described in the man pages included in the package.
 
-Project web page:    http://nilfs.sourceforge.net/
-Download page:       http://nilfs.sourceforge.net/en/download.html
+Project web page:    https://nilfs.sourceforge.io/
+Download page:       https://nilfs.sourceforge.io/en/download.html
 List info:           http://vger.kernel.org/vger-lists.html#linux-nilfs
 
 Caveats
diff --git a/Documentation/filesystems/overlayfs.txt b/Documentation/filesystems/overlayfs.txt
index 8caa60734647..e6a5f4912b6d 100644
--- a/Documentation/filesystems/overlayfs.txt
+++ b/Documentation/filesystems/overlayfs.txt
@@ -156,6 +156,40 @@ handle it in two different ways:
    root of the overlay.  Finally the directory is moved to the new
    location.
 
+There are several ways to tune the "redirect_dir" feature.
+
+Kernel config options:
+
+- OVERLAY_FS_REDIRECT_DIR:
+    If this is enabled, then redirect_dir is turned on by  default.
+- OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW:
+    If this is enabled, then redirects are always followed by default. Enabling
+    this results in a less secure configuration.  Enable this option only when
+    worried about backward compatibility with kernels that have the redirect_dir
+    feature and follow redirects even if turned off.
+
+Module options (can also be changed through /sys/module/overlay/parameters/*):
+
+- "redirect_dir=BOOL":
+    See OVERLAY_FS_REDIRECT_DIR kernel config option above.
+- "redirect_always_follow=BOOL":
+    See OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW kernel config option above.
+- "redirect_max=NUM":
+    The maximum number of bytes in an absolute redirect (default is 256).
+
+Mount options:
+
+- "redirect_dir=on":
+    Redirects are enabled.
+- "redirect_dir=follow":
+    Redirects are not created, but followed.
+- "redirect_dir=off":
+    Redirects are not created and only followed if "redirect_always_follow"
+    feature is enabled in the kernel/module config.
+- "redirect_dir=nofollow":
+    Redirects are not created and not followed (equivalent to "redirect_dir=off"
+    if "redirect_always_follow" feature is not enabled).
+
 Non-directories
 ---------------
 
diff --git a/Documentation/gpu/i915.rst b/Documentation/gpu/i915.rst
index 2e7ee0313c1c..e94d3ac2bdd0 100644
--- a/Documentation/gpu/i915.rst
+++ b/Documentation/gpu/i915.rst
@@ -341,10 +341,7 @@ GuC
 GuC-specific firmware loader
 ----------------------------
 
-.. kernel-doc:: drivers/gpu/drm/i915/intel_guc_loader.c
-   :doc: GuC-specific firmware loader
-
-.. kernel-doc:: drivers/gpu/drm/i915/intel_guc_loader.c
+.. kernel-doc:: drivers/gpu/drm/i915/intel_guc_fw.c
    :internal:
 
 GuC-based command submission
diff --git a/Documentation/kbuild/kconfig-language.txt b/Documentation/kbuild/kconfig-language.txt
index 262722d8867b..c4a293a03c33 100644
--- a/Documentation/kbuild/kconfig-language.txt
+++ b/Documentation/kbuild/kconfig-language.txt
@@ -200,10 +200,14 @@ module state. Dependency expressions have the following syntax:
 <expr> ::= <symbol>                             (1)
            <symbol> '=' <symbol>                (2)
            <symbol> '!=' <symbol>               (3)
-           '(' <expr> ')'                       (4)
-           '!' <expr>                           (5)
-           <expr> '&&' <expr>                   (6)
-           <expr> '||' <expr>                   (7)
+           <symbol1> '<' <symbol2>              (4)
+           <symbol1> '>' <symbol2>              (4)
+           <symbol1> '<=' <symbol2>             (4)
+           <symbol1> '>=' <symbol2>             (4)
+           '(' <expr> ')'                       (5)
+           '!' <expr>                           (6)
+           <expr> '&&' <expr>                   (7)
+           <expr> '||' <expr>                   (8)
 
 Expressions are listed in decreasing order of precedence. 
 
@@ -214,10 +218,13 @@ Expressions are listed in decreasing order of precedence.
     otherwise 'n'.
 (3) If the values of both symbols are equal, it returns 'n',
     otherwise 'y'.
-(4) Returns the value of the expression. Used to override precedence.
-(5) Returns the result of (2-/expr/).
-(6) Returns the result of min(/expr/, /expr/).
-(7) Returns the result of max(/expr/, /expr/).
+(4) If value of <symbol1> is respectively lower, greater, lower-or-equal,
+    or greater-or-equal than value of <symbol2>, it returns 'y',
+    otherwise 'n'.
+(5) Returns the value of the expression. Used to override precedence.
+(6) Returns the result of (2-/expr/).
+(7) Returns the result of min(/expr/, /expr/).
+(8) Returns the result of max(/expr/, /expr/).
 
 An expression can have a value of 'n', 'm' or 'y' (or 0, 1, 2
 respectively for calculations). A menu entry becomes visible when its
diff --git a/Documentation/locking/crossrelease.txt b/Documentation/locking/crossrelease.txt
deleted file mode 100644
index bdf1423d5f99..000000000000
--- a/Documentation/locking/crossrelease.txt
+++ /dev/null
@@ -1,874 +0,0 @@
-Crossrelease
-============
-
-Started by Byungchul Park <byungchul.park@lge.com>
-
-Contents:
-
- (*) Background
-
-     - What causes deadlock
-     - How lockdep works
-
- (*) Limitation
-
-     - Limit lockdep
-     - Pros from the limitation
-     - Cons from the limitation
-     - Relax the limitation
-
- (*) Crossrelease
-
-     - Introduce crossrelease
-     - Introduce commit
-
- (*) Implementation
-
-     - Data structures
-     - How crossrelease works
-
- (*) Optimizations
-
-     - Avoid duplication
-     - Lockless for hot paths
-
- (*) APPENDIX A: What lockdep does to work aggresively
-
- (*) APPENDIX B: How to avoid adding false dependencies
-
-
-==========
-Background
-==========
-
-What causes deadlock
---------------------
-
-A deadlock occurs when a context is waiting for an event to happen,
-which is impossible because another (or the) context who can trigger the
-event is also waiting for another (or the) event to happen, which is
-also impossible due to the same reason.
-
-For example:
-
-   A context going to trigger event C is waiting for event A to happen.
-   A context going to trigger event A is waiting for event B to happen.
-   A context going to trigger event B is waiting for event C to happen.
-
-A deadlock occurs when these three wait operations run at the same time,
-because event C cannot be triggered if event A does not happen, which in
-turn cannot be triggered if event B does not happen, which in turn
-cannot be triggered if event C does not happen. After all, no event can
-be triggered since any of them never meets its condition to wake up.
-
-A dependency might exist between two waiters and a deadlock might happen
-due to an incorrect releationship between dependencies. Thus, we must
-define what a dependency is first. A dependency exists between them if:
-
-   1. There are two waiters waiting for each event at a given time.
-   2. The only way to wake up each waiter is to trigger its event.
-   3. Whether one can be woken up depends on whether the other can.
-
-Each wait in the example creates its dependency like:
-
-   Event C depends on event A.
-   Event A depends on event B.
-   Event B depends on event C.
-
-   NOTE: Precisely speaking, a dependency is one between whether a
-   waiter for an event can be woken up and whether another waiter for
-   another event can be woken up. However from now on, we will describe
-   a dependency as if it's one between an event and another event for
-   simplicity.
-
-And they form circular dependencies like:
-
-    -> C -> A -> B -
-   /                \
-   \                /
-    ----------------
-
-   where 'A -> B' means that event A depends on event B.
-
-Such circular dependencies lead to a deadlock since no waiter can meet
-its condition to wake up as described.
-
-CONCLUSION
-
-Circular dependencies cause a deadlock.
-
-
-How lockdep works
------------------
-
-Lockdep tries to detect a deadlock by checking dependencies created by
-lock operations, acquire and release. Waiting for a lock corresponds to
-waiting for an event, and releasing a lock corresponds to triggering an
-event in the previous section.
-
-In short, lockdep does:
-
-   1. Detect a new dependency.
-   2. Add the dependency into a global graph.
-   3. Check if that makes dependencies circular.
-   4. Report a deadlock or its possibility if so.
-
-For example, consider a graph built by lockdep that looks like:
-
-   A -> B -
-           \
-            -> E
-           /
-   C -> D -
-
-   where A, B,..., E are different lock classes.
-
-Lockdep will add a dependency into the graph on detection of a new
-dependency. For example, it will add a dependency 'E -> C' when a new
-dependency between lock E and lock C is detected. Then the graph will be:
-
-       A -> B -
-               \
-                -> E -
-               /      \
-    -> C -> D -        \
-   /                   /
-   \                  /
-    ------------------
-
-   where A, B,..., E are different lock classes.
-
-This graph contains a subgraph which demonstrates circular dependencies:
-
-                -> E -
-               /      \
-    -> C -> D -        \
-   /                   /
-   \                  /
-    ------------------
-
-   where C, D and E are different lock classes.
-
-This is the condition under which a deadlock might occur. Lockdep
-reports it on detection after adding a new dependency. This is the way
-how lockdep works.
-
-CONCLUSION
-
-Lockdep detects a deadlock or its possibility by checking if circular
-dependencies were created after adding each new dependency.
-
-
-==========
-Limitation
-==========
-
-Limit lockdep
--------------
-
-Limiting lockdep to work on only typical locks e.g. spin locks and
-mutexes, which are released within the acquire context, the
-implementation becomes simple but its capacity for detection becomes
-limited. Let's check pros and cons in next section.
-
-
-Pros from the limitation
-------------------------
-
-Given the limitation, when acquiring a lock, locks in a held_locks
-cannot be released if the context cannot acquire it so has to wait to
-acquire it, which means all waiters for the locks in the held_locks are
-stuck. It's an exact case to create dependencies between each lock in
-the held_locks and the lock to acquire.
-
-For example:
-
-   CONTEXT X
-   ---------
-   acquire A
-   acquire B /* Add a dependency 'A -> B' */
-   release B
-   release A
-
-   where A and B are different lock classes.
-
-When acquiring lock A, the held_locks of CONTEXT X is empty thus no
-dependency is added. But when acquiring lock B, lockdep detects and adds
-a new dependency 'A -> B' between lock A in the held_locks and lock B.
-They can be simply added whenever acquiring each lock.
-
-And data required by lockdep exists in a local structure, held_locks
-embedded in task_struct. Forcing to access the data within the context,
-lockdep can avoid racy problems without explicit locks while handling
-the local data.
-
-Lastly, lockdep only needs to keep locks currently being held, to build
-a dependency graph. However, relaxing the limitation, it needs to keep
-even locks already released, because a decision whether they created
-dependencies might be long-deferred.
-
-To sum up, we can expect several advantages from the limitation:
-
-   1. Lockdep can easily identify a dependency when acquiring a lock.
-   2. Races are avoidable while accessing local locks in a held_locks.
-   3. Lockdep only needs to keep locks currently being held.
-
-CONCLUSION
-
-Given the limitation, the implementation becomes simple and efficient.
-
-
-Cons from the limitation
-------------------------
-
-Given the limitation, lockdep is applicable only to typical locks. For
-example, page locks for page access or completions for synchronization
-cannot work with lockdep.
-
-Can we detect deadlocks below, under the limitation?
-
-Example 1:
-
-   CONTEXT X       CONTEXT Y       CONTEXT Z
-   ---------       ---------       ----------
-                   mutex_lock A
-   lock_page B
-                   lock_page B
-                                   mutex_lock A /* DEADLOCK */
-                                   unlock_page B held by X
-                   unlock_page B
-                   mutex_unlock A
-                                   mutex_unlock A
-
-   where A and B are different lock classes.
-
-No, we cannot.
-
-Example 2:
-
-   CONTEXT X               CONTEXT Y
-   ---------               ---------
-                           mutex_lock A
-   mutex_lock A
-                           wait_for_complete B /* DEADLOCK */
-   complete B
-                           mutex_unlock A
-   mutex_unlock A
-
-   where A is a lock class and B is a completion variable.
-
-No, we cannot.
-
-CONCLUSION
-
-Given the limitation, lockdep cannot detect a deadlock or its
-possibility caused by page locks or completions.
-
-
-Relax the limitation
---------------------
-
-Under the limitation, things to create dependencies are limited to
-typical locks. However, synchronization primitives like page locks and
-completions, which are allowed to be released in any context, also
-create dependencies and can cause a deadlock. So lockdep should track
-these locks to do a better job. We have to relax the limitation for
-these locks to work with lockdep.
-
-Detecting dependencies is very important for lockdep to work because
-adding a dependency means adding an opportunity to check whether it
-causes a deadlock. The more lockdep adds dependencies, the more it
-thoroughly works. Thus Lockdep has to do its best to detect and add as
-many true dependencies into a graph as possible.
-
-For example, considering only typical locks, lockdep builds a graph like:
-
-   A -> B -
-           \
-            -> E
-           /
-   C -> D -
-
-   where A, B,..., E are different lock classes.
-
-On the other hand, under the relaxation, additional dependencies might
-be created and added. Assuming additional 'FX -> C' and 'E -> GX' are
-added thanks to the relaxation, the graph will be:
-
-         A -> B -
-                 \
-                  -> E -> GX
-                 /
-   FX -> C -> D -
-
-   where A, B,..., E, FX and GX are different lock classes, and a suffix
-   'X' is added on non-typical locks.
-
-The latter graph gives us more chances to check circular dependencies
-than the former. However, it might suffer performance degradation since
-relaxing the limitation, with which design and implementation of lockdep
-can be efficient, might introduce inefficiency inevitably. So lockdep
-should provide two options, strong detection and efficient detection.
-
-Choosing efficient detection:
-
-   Lockdep works with only locks restricted to be released within the
-   acquire context. However, lockdep works efficiently.
-
-Choosing strong detection:
-
-   Lockdep works with all synchronization primitives. However, lockdep
-   suffers performance degradation.
-
-CONCLUSION
-
-Relaxing the limitation, lockdep can add additional dependencies giving
-additional opportunities to check circular dependencies.
-
-
-============
-Crossrelease
-============
-
-Introduce crossrelease
-----------------------
-
-In order to allow lockdep to handle additional dependencies by what
-might be released in any context, namely 'crosslock', we have to be able
-to identify those created by crosslocks. The proposed 'crossrelease'
-feature provoides a way to do that.
-
-Crossrelease feature has to do:
-
-   1. Identify dependencies created by crosslocks.
-   2. Add the dependencies into a dependency graph.
-
-That's all. Once a meaningful dependency is added into graph, then
-lockdep would work with the graph as it did. The most important thing
-crossrelease feature has to do is to correctly identify and add true
-dependencies into the global graph.
-
-A dependency e.g. 'A -> B' can be identified only in the A's release
-context because a decision required to identify the dependency can be
-made only in the release context. That is to decide whether A can be
-released so that a waiter for A can be woken up. It cannot be made in
-other than the A's release context.
-
-It's no matter for typical locks because each acquire context is same as
-its release context, thus lockdep can decide whether a lock can be
-released in the acquire context. However for crosslocks, lockdep cannot
-make the decision in the acquire context but has to wait until the
-release context is identified.
-
-Therefore, deadlocks by crosslocks cannot be detected just when it
-happens, because those cannot be identified until the crosslocks are
-released. However, deadlock possibilities can be detected and it's very
-worth. See 'APPENDIX A' section to check why.
-
-CONCLUSION
-
-Using crossrelease feature, lockdep can work with what might be released
-in any context, namely crosslock.
-
-
-Introduce commit
-----------------
-
-Since crossrelease defers the work adding true dependencies of
-crosslocks until they are actually released, crossrelease has to queue
-all acquisitions which might create dependencies with the crosslocks.
-Then it identifies dependencies using the queued data in batches at a
-proper time. We call it 'commit'.
-
-There are four types of dependencies:
-
-1. TT type: 'typical lock A -> typical lock B'
-
-   Just when acquiring B, lockdep can see it's in the A's release
-   context. So the dependency between A and B can be identified
-   immediately. Commit is unnecessary.
-
-2. TC type: 'typical lock A -> crosslock BX'
-
-   Just when acquiring BX, lockdep can see it's in the A's release
-   context. So the dependency between A and BX can be identified
-   immediately. Commit is unnecessary, too.
-
-3. CT type: 'crosslock AX -> typical lock B'
-
-   When acquiring B, lockdep cannot identify the dependency because
-   there's no way to know if it's in the AX's release context. It has
-   to wait until the decision can be made. Commit is necessary.
-
-4. CC type: 'crosslock AX -> crosslock BX'
-
-   When acquiring BX, lockdep cannot identify the dependency because
-   there's no way to know if it's in the AX's release context. It has
-   to wait until the decision can be made. Commit is necessary.
-   But, handling CC type is not implemented yet. It's a future work.
-
-Lockdep can work without commit for typical locks, but commit step is
-necessary once crosslocks are involved. Introducing commit, lockdep
-performs three steps. What lockdep does in each step is:
-
-1. Acquisition: For typical locks, lockdep does what it originally did
-   and queues the lock so that CT type dependencies can be checked using
-   it at the commit step. For crosslocks, it saves data which will be
-   used at the commit step and increases a reference count for it.
-
-2. Commit: No action is reauired for typical locks. For crosslocks,
-   lockdep adds CT type dependencies using the data saved at the
-   acquisition step.
-
-3. Release: No changes are required for typical locks. When a crosslock
-   is released, it decreases a reference count for it.
-
-CONCLUSION
-
-Crossrelease introduces commit step to handle dependencies of crosslocks
-in batches at a proper time.
-
-
-==============
-Implementation
-==============
-
-Data structures
----------------
-
-Crossrelease introduces two main data structures.
-
-1. hist_lock
-
-   This is an array embedded in task_struct, for keeping lock history so
-   that dependencies can be added using them at the commit step. Since
-   it's local data, it can be accessed locklessly in the owner context.
-   The array is filled at the acquisition step and consumed at the
-   commit step. And it's managed in circular manner.
-
-2. cross_lock
-
-   One per lockdep_map exists. This is for keeping data of crosslocks
-   and used at the commit step.
-
-
-How crossrelease works
-----------------------
-
-It's the key of how crossrelease works, to defer necessary works to an
-appropriate point in time and perform in at once at the commit step.
-Let's take a look with examples step by step, starting from how lockdep
-works without crossrelease for typical locks.
-
-   acquire A /* Push A onto held_locks */
-   acquire B /* Push B onto held_locks and add 'A -> B' */
-   acquire C /* Push C onto held_locks and add 'B -> C' */
-   release C /* Pop C from held_locks */
-   release B /* Pop B from held_locks */
-   release A /* Pop A from held_locks */
-
-   where A, B and C are different lock classes.
-
-   NOTE: This document assumes that readers already understand how
-   lockdep works without crossrelease thus omits details. But there's
-   one thing to note. Lockdep pretends to pop a lock from held_locks
-   when releasing it. But it's subtly different from the original pop
-   operation because lockdep allows other than the top to be poped.
-
-In this case, lockdep adds 'the top of held_locks -> the lock to acquire'
-dependency every time acquiring a lock.
-
-After adding 'A -> B', a dependency graph will be:
-
-   A -> B
-
-   where A and B are different lock classes.
-
-And after adding 'B -> C', the graph will be:
-
-   A -> B -> C
-
-   where A, B and C are different lock classes.
-
-Let's performs commit step even for typical locks to add dependencies.
-Of course, commit step is not necessary for them, however, it would work
-well because this is a more general way.
-
-   acquire A
-   /*
-    * Queue A into hist_locks
-    *
-    * In hist_locks: A
-    * In graph: Empty
-    */
-
-   acquire B
-   /*
-    * Queue B into hist_locks
-    *
-    * In hist_locks: A, B
-    * In graph: Empty
-    */
-
-   acquire C
-   /*
-    * Queue C into hist_locks
-    *
-    * In hist_locks: A, B, C
-    * In graph: Empty
-    */
-
-   commit C
-   /*
-    * Add 'C -> ?'
-    * Answer the following to decide '?'
-    * What has been queued since acquire C: Nothing
-    *
-    * In hist_locks: A, B, C
-    * In graph: Empty
-    */
-
-   release C
-
-   commit B
-   /*
-    * Add 'B -> ?'
-    * Answer the following to decide '?'
-    * What has been queued since acquire B: C
-    *
-    * In hist_locks: A, B, C
-    * In graph: 'B -> C'
-    */
-
-   release B
-
-   commit A
-   /*
-    * Add 'A -> ?'
-    * Answer the following to decide '?'
-    * What has been queued since acquire A: B, C
-    *
-    * In hist_locks: A, B, C
-    * In graph: 'B -> C', 'A -> B', 'A -> C'
-    */
-
-   release A
-
-   where A, B and C are different lock classes.
-
-In this case, dependencies are added at the commit step as described.
-
-After commits for A, B and C, the graph will be:
-
-   A -> B -> C
-
-   where A, B and C are different lock classes.
-
-   NOTE: A dependency 'A -> C' is optimized out.
-
-We can see the former graph built without commit step is same as the
-latter graph built using commit steps. Of course the former way leads to
-earlier finish for building the graph, which means we can detect a
-deadlock or its possibility sooner. So the former way would be prefered
-when possible. But we cannot avoid using the latter way for crosslocks.
-
-Let's look at how commit steps work for crosslocks. In this case, the
-commit step is performed only on crosslock AX as real. And it assumes
-that the AX release context is different from the AX acquire context.
-
-   BX RELEASE CONTEXT              BX ACQUIRE CONTEXT
-   ------------------              ------------------
-                                   acquire A
-                                   /*
-                                    * Push A onto held_locks
-                                    * Queue A into hist_locks
-                                    *
-                                    * In held_locks: A
-                                    * In hist_locks: A
-                                    * In graph: Empty
-                                    */
-
-                                   acquire BX
-                                   /*
-                                    * Add 'the top of held_locks -> BX'
-                                    *
-                                    * In held_locks: A
-                                    * In hist_locks: A
-                                    * In graph: 'A -> BX'
-                                    */
-
-   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-   It must be guaranteed that the following operations are seen after
-   acquiring BX globally. It can be done by things like barrier.
-   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-   acquire C
-   /*
-    * Push C onto held_locks
-    * Queue C into hist_locks
-    *
-    * In held_locks: C
-    * In hist_locks: C
-    * In graph: 'A -> BX'
-    */
-
-   release C
-   /*
-    * Pop C from held_locks
-    *
-    * In held_locks: Empty
-    * In hist_locks: C
-    * In graph: 'A -> BX'
-    */
-                                   acquire D
-                                   /*
-                                    * Push D onto held_locks
-                                    * Queue D into hist_locks
-                                    * Add 'the top of held_locks -> D'
-                                    *
-                                    * In held_locks: A, D
-                                    * In hist_locks: A, D
-                                    * In graph: 'A -> BX', 'A -> D'
-                                    */
-   acquire E
-   /*
-    * Push E onto held_locks
-    * Queue E into hist_locks
-    *
-    * In held_locks: E
-    * In hist_locks: C, E
-    * In graph: 'A -> BX', 'A -> D'
-    */
-
-   release E
-   /*
-    * Pop E from held_locks
-    *
-    * In held_locks: Empty
-    * In hist_locks: D, E
-    * In graph: 'A -> BX', 'A -> D'
-    */
-                                   release D
-                                   /*
-                                    * Pop D from held_locks
-                                    *
-                                    * In held_locks: A
-                                    * In hist_locks: A, D
-                                    * In graph: 'A -> BX', 'A -> D'
-                                    */
-   commit BX
-   /*
-    * Add 'BX -> ?'
-    * What has been queued since acquire BX: C, E
-    *
-    * In held_locks: Empty
-    * In hist_locks: D, E
-    * In graph: 'A -> BX', 'A -> D',
-    *           'BX -> C', 'BX -> E'
-    */
-
-   release BX
-   /*
-    * In held_locks: Empty
-    * In hist_locks: D, E
-    * In graph: 'A -> BX', 'A -> D',
-    *           'BX -> C', 'BX -> E'
-    */
-                                   release A
-                                   /*
-                                    * Pop A from held_locks
-                                    *
-                                    * In held_locks: Empty
-                                    * In hist_locks: A, D
-                                    * In graph: 'A -> BX', 'A -> D',
-                                    *           'BX -> C', 'BX -> E'
-                                    */
-
-   where A, BX, C,..., E are different lock classes, and a suffix 'X' is
-   added on crosslocks.
-
-Crossrelease considers all acquisitions after acqiuring BX are
-candidates which might create dependencies with BX. True dependencies
-will be determined when identifying the release context of BX. Meanwhile,
-all typical locks are queued so that they can be used at the commit step.
-And then two dependencies 'BX -> C' and 'BX -> E' are added at the
-commit step when identifying the release context.
-
-The final graph will be, with crossrelease:
-
-               -> C
-              /
-       -> BX -
-      /       \
-   A -         -> E
-      \
-       -> D
-
-   where A, BX, C,..., E are different lock classes, and a suffix 'X' is
-   added on crosslocks.
-
-However, the final graph will be, without crossrelease:
-
-   A -> D
-
-   where A and D are different lock classes.
-
-The former graph has three more dependencies, 'A -> BX', 'BX -> C' and
-'BX -> E' giving additional opportunities to check if they cause
-deadlocks. This way lockdep can detect a deadlock or its possibility
-caused by crosslocks.
-
-CONCLUSION
-
-We checked how crossrelease works with several examples.
-
-
-=============
-Optimizations
-=============
-
-Avoid duplication
------------------
-
-Crossrelease feature uses a cache like what lockdep already uses for
-dependency chains, but this time it's for caching CT type dependencies.
-Once that dependency is cached, the same will never be added again.
-
-
-Lockless for hot paths
-----------------------
-
-To keep all locks for later use at the commit step, crossrelease adopts
-a local array embedded in task_struct, which makes access to the data
-lockless by forcing it to happen only within the owner context. It's
-like how lockdep handles held_locks. Lockless implmentation is important
-since typical locks are very frequently acquired and released.
-
-
-=================================================
-APPENDIX A: What lockdep does to work aggresively
-=================================================
-
-A deadlock actually occurs when all wait operations creating circular
-dependencies run at the same time. Even though they don't, a potential
-deadlock exists if the problematic dependencies exist. Thus it's
-meaningful to detect not only an actual deadlock but also its potential
-possibility. The latter is rather valuable. When a deadlock occurs
-actually, we can identify what happens in the system by some means or
-other even without lockdep. However, there's no way to detect possiblity
-without lockdep unless the whole code is parsed in head. It's terrible.
-Lockdep does the both, and crossrelease only focuses on the latter.
-
-Whether or not a deadlock actually occurs depends on several factors.
-For example, what order contexts are switched in is a factor. Assuming
-circular dependencies exist, a deadlock would occur when contexts are
-switched so that all wait operations creating the dependencies run
-simultaneously. Thus to detect a deadlock possibility even in the case
-that it has not occured yet, lockdep should consider all possible
-combinations of dependencies, trying to:
-
-1. Use a global dependency graph.
-
-   Lockdep combines all dependencies into one global graph and uses them,
-   regardless of which context generates them or what order contexts are
-   switched in. Aggregated dependencies are only considered so they are
-   prone to be circular if a problem exists.
-
-2. Check dependencies between classes instead of instances.
-
-   What actually causes a deadlock are instances of lock. However,
-   lockdep checks dependencies between classes instead of instances.
-   This way lockdep can detect a deadlock which has not happened but
-   might happen in future by others but the same class.
-
-3. Assume all acquisitions lead to waiting.
-
-   Although locks might be acquired without waiting which is essential
-   to create dependencies, lockdep assumes all acquisitions lead to
-   waiting since it might be true some time or another.
-
-CONCLUSION
-
-Lockdep detects not only an actual deadlock but also its possibility,
-and the latter is more valuable.
-
-
-==================================================
-APPENDIX B: How to avoid adding false dependencies
-==================================================
-
-Remind what a dependency is. A dependency exists if:
-
-   1. There are two waiters waiting for each event at a given time.
-   2. The only way to wake up each waiter is to trigger its event.
-   3. Whether one can be woken up depends on whether the other can.
-
-For example:
-
-   acquire A
-   acquire B /* A dependency 'A -> B' exists */
-   release B
-   release A
-
-   where A and B are different lock classes.
-
-A depedency 'A -> B' exists since:
-
-   1. A waiter for A and a waiter for B might exist when acquiring B.
-   2. Only way to wake up each is to release what it waits for.
-   3. Whether the waiter for A can be woken up depends on whether the
-      other can. IOW, TASK X cannot release A if it fails to acquire B.
-
-For another example:
-
-   TASK X                          TASK Y
-   ------                          ------
-                                   acquire AX
-   acquire B /* A dependency 'AX -> B' exists */
-   release B
-   release AX held by Y
-
-   where AX and B are different lock classes, and a suffix 'X' is added
-   on crosslocks.
-
-Even in this case involving crosslocks, the same rule can be applied. A
-depedency 'AX -> B' exists since:
-
-   1. A waiter for AX and a waiter for B might exist when acquiring B.
-   2. Only way to wake up each is to release what it waits for.
-   3. Whether the waiter for AX can be woken up depends on whether the
-      other can. IOW, TASK X cannot release AX if it fails to acquire B.
-
-Let's take a look at more complicated example:
-
-   TASK X                          TASK Y
-   ------                          ------
-   acquire B
-   release B
-   fork Y
-                                   acquire AX
-   acquire C /* A dependency 'AX -> C' exists */
-   release C
-   release AX held by Y
-
-   where AX, B and C are different lock classes, and a suffix 'X' is
-   added on crosslocks.
-
-Does a dependency 'AX -> B' exist? Nope.
-
-Two waiters are essential to create a dependency. However, waiters for
-AX and B to create 'AX -> B' cannot exist at the same time in this
-example. Thus the dependency 'AX -> B' cannot be created.
-
-It would be ideal if the full set of true ones can be considered. But
-we can ensure nothing but what actually happened. Relying on what
-actually happens at runtime, we can anyway add only true ones, though
-they might be a subset of true ones. It's similar to how lockdep works
-for typical locks. There might be more true dependencies than what
-lockdep has detected in runtime. Lockdep has no choice but to rely on
-what actually happens. Crossrelease also relies on it.
-
-CONCLUSION
-
-Relying on what actually happens, lockdep can avoid adding false
-dependencies.
diff --git a/Documentation/media/dvb-drivers/frontends.rst b/Documentation/media/dvb-drivers/frontends.rst
new file mode 100644
index 000000000000..1f5f57989196
--- /dev/null
+++ b/Documentation/media/dvb-drivers/frontends.rst
@@ -0,0 +1,30 @@
+****************
+Frontend drivers
+****************
+
+Frontend attach headers
+***********************
+
+.. Keep it on alphabetic order
+
+.. kernel-doc:: drivers/media/dvb-frontends/a8293.h
+.. kernel-doc:: drivers/media/dvb-frontends/af9013.h
+.. kernel-doc:: drivers/media/dvb-frontends/ascot2e.h
+.. kernel-doc:: drivers/media/dvb-frontends/cxd2820r.h
+.. kernel-doc:: drivers/media/dvb-frontends/drxk.h
+.. kernel-doc:: drivers/media/dvb-frontends/dvb-pll.h
+.. kernel-doc:: drivers/media/dvb-frontends/helene.h
+.. kernel-doc:: drivers/media/dvb-frontends/horus3a.h
+.. kernel-doc:: drivers/media/dvb-frontends/ix2505v.h
+.. kernel-doc:: drivers/media/dvb-frontends/m88ds3103.h
+.. kernel-doc:: drivers/media/dvb-frontends/mb86a20s.h
+.. kernel-doc:: drivers/media/dvb-frontends/mn88472.h
+.. kernel-doc:: drivers/media/dvb-frontends/rtl2830.h
+.. kernel-doc:: drivers/media/dvb-frontends/rtl2832.h
+.. kernel-doc:: drivers/media/dvb-frontends/rtl2832_sdr.h
+.. kernel-doc:: drivers/media/dvb-frontends/stb6000.h
+.. kernel-doc:: drivers/media/dvb-frontends/tda10071.h
+.. kernel-doc:: drivers/media/dvb-frontends/tda826x.h
+.. kernel-doc:: drivers/media/dvb-frontends/zd1301_demod.h
+.. kernel-doc:: drivers/media/dvb-frontends/zl10036.h
+
diff --git a/Documentation/media/dvb-drivers/index.rst b/Documentation/media/dvb-drivers/index.rst
index 376141143ae9..314e127d82e3 100644
--- a/Documentation/media/dvb-drivers/index.rst
+++ b/Documentation/media/dvb-drivers/index.rst
@@ -41,4 +41,5 @@ For more details see the file COPYING in the source distribution of Linux.
         technisat
         ttusb-dec
         udev
+        frontends
         contributors
diff --git a/Documentation/networking/index.rst b/Documentation/networking/index.rst
index 66e620866245..7d4b15977d61 100644
--- a/Documentation/networking/index.rst
+++ b/Documentation/networking/index.rst
@@ -9,6 +9,7 @@ Contents:
    batman-adv
    kapi
    z8530book
+   msg_zerocopy
 
 .. only::  subproject
 
@@ -16,4 +17,3 @@ Contents:
    =======
 
    * :ref:`genindex`
-
diff --git a/Documentation/networking/msg_zerocopy.rst b/Documentation/networking/msg_zerocopy.rst
index 77f6d7e25cfd..291a01264967 100644
--- a/Documentation/networking/msg_zerocopy.rst
+++ b/Documentation/networking/msg_zerocopy.rst
@@ -72,6 +72,10 @@ this flag, a process must first signal intent by setting a socket option:
         if (setsockopt(fd, SOL_SOCKET, SO_ZEROCOPY, &one, sizeof(one)))
                 error(1, errno, "setsockopt zerocopy");
 
+Setting the socket option only works when the socket is in its initial
+(TCP_CLOSED) state.  Trying to set the option for a socket returned by accept(),
+for example, will lead to an EBUSY error. In this case, the option should be set
+to the listening socket and it will be inherited by the accepted sockets.
 
 Transmission
 ------------
diff --git a/Documentation/scsi/scsi_mid_low_api.txt b/Documentation/scsi/scsi_mid_low_api.txt
index 6338400eed73..2c31d9ee6776 100644
--- a/Documentation/scsi/scsi_mid_low_api.txt
+++ b/Documentation/scsi/scsi_mid_low_api.txt
@@ -319,12 +319,12 @@ struct Scsi_Host:
         instance. If the reference count reaches 0 then the given instance
         is freed
 
-The Scsi_device structure has had reference counting infrastructure added.
-This effectively spreads the ownership of struct Scsi_device instances
+The scsi_device structure has had reference counting infrastructure added.
+This effectively spreads the ownership of struct scsi_device instances
 across the various SCSI layers which use them. Previously such instances
 were exclusively owned by the mid level. See the access functions declared
 towards the end of include/scsi/scsi_device.h . If an LLD wants to keep
-a copy of a pointer to a Scsi_device instance it should use scsi_device_get()
+a copy of a pointer to a scsi_device instance it should use scsi_device_get()
 to bump its reference count. When it is finished with the pointer it can
 use scsi_device_put() to decrement its reference count (and potentially
 delete it).
diff --git a/Documentation/usb/gadget-testing.txt b/Documentation/usb/gadget-testing.txt
index 441a4b9b666f..5908a21fddb6 100644
--- a/Documentation/usb/gadget-testing.txt
+++ b/Documentation/usb/gadget-testing.txt
@@ -693,7 +693,7 @@ such specification consists of a number of lines with an inverval value
 in each line. The rules stated above are best illustrated with an example:
 
 # mkdir functions/uvc.usb0/control/header/h
-# cd functions/uvc.usb0/control/header/h
+# cd functions/uvc.usb0/control/
 # ln -s header/h class/fs
 # ln -s header/h class/ss
 # mkdir -p functions/uvc.usb0/streaming/uncompressed/u/360p
diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
index f670e4b9e7f3..fc3ae951bc07 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -2901,14 +2901,19 @@ userspace buffer and its length:
 
 struct kvm_s390_irq_state {
         __u64 buf;
-        __u32 flags;
+        __u32 flags;        /* will stay unused for compatibility reasons */
         __u32 len;
-        __u32 reserved[4];
+        __u32 reserved[4];  /* will stay unused for compatibility reasons */
 };
 
 Userspace passes in the above struct and for each pending interrupt a
 struct kvm_s390_irq is copied to the provided buffer.
 
+The structure contains a flags and a reserved field for future extensions. As
+the kernel never checked for flags == 0 and QEMU never pre-zeroed flags and
+reserved, these fields can not be used in the future without breaking
+compatibility.
+
 If -ENOBUFS is returned the buffer provided was too small and userspace
 may retry with a bigger buffer.
 
@@ -2932,10 +2937,14 @@ containing a struct kvm_s390_irq_state:
 
 struct kvm_s390_irq_state {
         __u64 buf;
+        __u32 flags;        /* will stay unused for compatibility reasons */
         __u32 len;
-        __u32 pad;
+        __u32 reserved[4];  /* will stay unused for compatibility reasons */
 };
 
+The restrictions for flags and reserved apply as well.
+(see KVM_S390_GET_IRQ_STATE)
+
 The userspace memory referenced by buf contains a struct kvm_s390_irq
 for each interrupt to be injected into the guest.
 If one of the interrupts could not be injected for some reason the
@@ -3394,6 +3403,52 @@ invalid, if invalid pages are written to (e.g. after the end of memory)
 or if no page table is present for the addresses (e.g. when using
 hugepages).
 
+4.108 KVM_PPC_GET_CPU_CHAR
+
+Capability: KVM_CAP_PPC_GET_CPU_CHAR
+Architectures: powerpc
+Type: vm ioctl
+Parameters: struct kvm_ppc_cpu_char (out)
+Returns: 0 on successful completion
+         -EFAULT if struct kvm_ppc_cpu_char cannot be written
+
+This ioctl gives userspace information about certain characteristics
+of the CPU relating to speculative execution of instructions and
+possible information leakage resulting from speculative execution (see
+CVE-2017-5715, CVE-2017-5753 and CVE-2017-5754).  The information is
+returned in struct kvm_ppc_cpu_char, which looks like this:
+
+struct kvm_ppc_cpu_char {
+        __u64   character;              /* characteristics of the CPU */
+        __u64   behaviour;              /* recommended software behaviour */
+        __u64   character_mask;         /* valid bits in character */
+        __u64   behaviour_mask;         /* valid bits in behaviour */
+};
+
+For extensibility, the character_mask and behaviour_mask fields
+indicate which bits of character and behaviour have been filled in by
+the kernel.  If the set of defined bits is extended in future then
+userspace will be able to tell whether it is running on a kernel that
+knows about the new bits.
+
+The character field describes attributes of the CPU which can help
+with preventing inadvertent information disclosure - specifically,
+whether there is an instruction to flash-invalidate the L1 data cache
+(ori 30,30,0 or mtspr SPRN_TRIG2,rN), whether the L1 data cache is set
+to a mode where entries can only be used by the thread that created
+them, whether the bcctr[l] instruction prevents speculation, and
+whether a speculation barrier instruction (ori 31,31,0) is provided.
+
+The behaviour field describes actions that software should take to
+prevent inadvertent information disclosure, and thus describes which
+vulnerabilities the hardware is subject to; specifically whether the
+L1 data cache should be flushed when returning to user mode from the
+kernel, and whether a speculation barrier should be placed between an
+array bounds check and the array access.
+
+These fields use the same bit definitions as the new
+H_GET_CPU_CHARACTERISTICS hypercall.
+
 5. The kvm_run structure
 ------------------------
 
diff --git a/Documentation/vm/zswap.txt b/Documentation/vm/zswap.txt
index 89fff7d611cc..0b3a1148f9f0 100644
--- a/Documentation/vm/zswap.txt
+++ b/Documentation/vm/zswap.txt
@@ -98,5 +98,25 @@ request is made for a page in an old zpool, it is uncompressed using its
 original compressor.  Once all pages are removed from an old zpool, the zpool
 and its compressor are freed.
 
+Some of the pages in zswap are same-value filled pages (i.e. contents of the
+page have same value or repetitive pattern). These pages include zero-filled
+pages and they are handled differently. During store operation, a page is
+checked if it is a same-value filled page before compressing it. If true, the
+compressed length of the page is set to zero and the pattern or same-filled
+value is stored.
+
+Same-value filled pages identification feature is enabled by default and can be
+disabled at boot time by setting the "same_filled_pages_enabled" attribute to 0,
+e.g. zswap.same_filled_pages_enabled=0. It can also be enabled and disabled at
+runtime using the sysfs "same_filled_pages_enabled" attribute, e.g.
+
+echo 1 > /sys/module/zswap/parameters/same_filled_pages_enabled
+
+When zswap same-filled page identification is disabled at runtime, it will stop
+checking for the same-value filled pages during store operation. However, the
+existing pages which are marked as same-value filled pages remain stored
+unchanged in zswap until they are either loaded or invalidated.
+
 A debugfs interface is provided for various statistic about pool size, number
-of pages stored, and various counters for the reasons pages are rejected.
+of pages stored, same-value filled pages and various counters for the reasons
+pages are rejected.
diff --git a/Documentation/x86/pti.txt b/Documentation/x86/pti.txt
new file mode 100644
index 000000000000..5cd58439ad2d
--- /dev/null
+++ b/Documentation/x86/pti.txt
@@ -0,0 +1,186 @@
+Overview
+========
+
+Page Table Isolation (pti, previously known as KAISER[1]) is a
+countermeasure against attacks on the shared user/kernel address
+space such as the "Meltdown" approach[2].
+
+To mitigate this class of attacks, we create an independent set of
+page tables for use only when running userspace applications.  When
+the kernel is entered via syscalls, interrupts or exceptions, the
+page tables are switched to the full "kernel" copy.  When the system
+switches back to user mode, the user copy is used again.
+
+The userspace page tables contain only a minimal amount of kernel
+data: only what is needed to enter/exit the kernel such as the
+entry/exit functions themselves and the interrupt descriptor table
+(IDT).  There are a few strictly unnecessary things that get mapped
+such as the first C function when entering an interrupt (see
+comments in pti.c).
+
+This approach helps to ensure that side-channel attacks leveraging
+the paging structures do not function when PTI is enabled.  It can be
+enabled by setting CONFIG_PAGE_TABLE_ISOLATION=y at compile time.
+Once enabled at compile-time, it can be disabled at boot with the
+'nopti' or 'pti=' kernel parameters (see kernel-parameters.txt).
+
+Page Table Management
+=====================
+
+When PTI is enabled, the kernel manages two sets of page tables.
+The first set is very similar to the single set which is present in
+kernels without PTI.  This includes a complete mapping of userspace
+that the kernel can use for things like copy_to_user().
+
+Although _complete_, the user portion of the kernel page tables is
+crippled by setting the NX bit in the top level.  This ensures
+that any missed kernel->user CR3 switch will immediately crash
+userspace upon executing its first instruction.
+
+The userspace page tables map only the kernel data needed to enter
+and exit the kernel.  This data is entirely contained in the 'struct
+cpu_entry_area' structure which is placed in the fixmap which gives
+each CPU's copy of the area a compile-time-fixed virtual address.
+
+For new userspace mappings, the kernel makes the entries in its
+page tables like normal.  The only difference is when the kernel
+makes entries in the top (PGD) level.  In addition to setting the
+entry in the main kernel PGD, a copy of the entry is made in the
+userspace page tables' PGD.
+
+This sharing at the PGD level also inherently shares all the lower
+layers of the page tables.  This leaves a single, shared set of
+userspace page tables to manage.  One PTE to lock, one set of
+accessed bits, dirty bits, etc...
+
+Overhead
+========
+
+Protection against side-channel attacks is important.  But,
+this protection comes at a cost:
+
+1. Increased Memory Use
+  a. Each process now needs an order-1 PGD instead of order-0.
+     (Consumes an additional 4k per process).
+  b. The 'cpu_entry_area' structure must be 2MB in size and 2MB
+     aligned so that it can be mapped by setting a single PMD
+     entry.  This consumes nearly 2MB of RAM once the kernel
+     is decompressed, but no space in the kernel image itself.
+
+2. Runtime Cost
+  a. CR3 manipulation to switch between the page table copies
+     must be done at interrupt, syscall, and exception entry
+     and exit (it can be skipped when the kernel is interrupted,
+     though.)  Moves to CR3 are on the order of a hundred
+     cycles, and are required at every entry and exit.
+  b. A "trampoline" must be used for SYSCALL entry.  This
+     trampoline depends on a smaller set of resources than the
+     non-PTI SYSCALL entry code, so requires mapping fewer
+     things into the userspace page tables.  The downside is
+     that stacks must be switched at entry time.
+  c. Global pages are disabled for all kernel structures not
+     mapped into both kernel and userspace page tables.  This
+     feature of the MMU allows different processes to share TLB
+     entries mapping the kernel.  Losing the feature means more
+     TLB misses after a context switch.  The actual loss of
+     performance is very small, however, never exceeding 1%.
+  d. Process Context IDentifiers (PCID) is a CPU feature that
+     allows us to skip flushing the entire TLB when switching page
+     tables by setting a special bit in CR3 when the page tables
+     are changed.  This makes switching the page tables (at context
+     switch, or kernel entry/exit) cheaper.  But, on systems with
+     PCID support, the context switch code must flush both the user
+     and kernel entries out of the TLB.  The user PCID TLB flush is
+     deferred until the exit to userspace, minimizing the cost.
+     See intel.com/sdm for the gory PCID/INVPCID details.
+  e. The userspace page tables must be populated for each new
+     process.  Even without PTI, the shared kernel mappings
+     are created by copying top-level (PGD) entries into each
+     new process.  But, with PTI, there are now *two* kernel
+     mappings: one in the kernel page tables that maps everything
+     and one for the entry/exit structures.  At fork(), we need to
+     copy both.
+  f. In addition to the fork()-time copying, there must also
+     be an update to the userspace PGD any time a set_pgd() is done
+     on a PGD used to map userspace.  This ensures that the kernel
+     and userspace copies always map the same userspace
+     memory.
+  g. On systems without PCID support, each CR3 write flushes
+     the entire TLB.  That means that each syscall, interrupt
+     or exception flushes the TLB.
+  h. INVPCID is a TLB-flushing instruction which allows flushing
+     of TLB entries for non-current PCIDs.  Some systems support
+     PCIDs, but do not support INVPCID.  On these systems, addresses
+     can only be flushed from the TLB for the current PCID.  When
+     flushing a kernel address, we need to flush all PCIDs, so a
+     single kernel address flush will require a TLB-flushing CR3
+     write upon the next use of every PCID.
+
+Possible Future Work
+====================
+1. We can be more careful about not actually writing to CR3
+   unless its value is actually changed.
+2. Allow PTI to be enabled/disabled at runtime in addition to the
+   boot-time switching.
+
+Testing
+========
+
+To test stability of PTI, the following test procedure is recommended,
+ideally doing all of these in parallel:
+
+1. Set CONFIG_DEBUG_ENTRY=y
+2. Run several copies of all of the tools/testing/selftests/x86/ tests
+   (excluding MPX and protection_keys) in a loop on multiple CPUs for
+   several minutes.  These tests frequently uncover corner cases in the
+   kernel entry code.  In general, old kernels might cause these tests
+   themselves to crash, but they should never crash the kernel.
+3. Run the 'perf' tool in a mode (top or record) that generates many
+   frequent performance monitoring non-maskable interrupts (see "NMI"
+   in /proc/interrupts).  This exercises the NMI entry/exit code which
+   is known to trigger bugs in code paths that did not expect to be
+   interrupted, including nested NMIs.  Using "-c" boosts the rate of
+   NMIs, and using two -c with separate counters encourages nested NMIs
+   and less deterministic behavior.
+
+        while true; do perf record -c 10000 -e instructions,cycles -a sleep 10; done
+
+4. Launch a KVM virtual machine.
+5. Run 32-bit binaries on systems supporting the SYSCALL instruction.
+   This has been a lightly-tested code path and needs extra scrutiny.
+
+Debugging
+=========
+
+Bugs in PTI cause a few different signatures of crashes
+that are worth noting here.
+
+ * Failures of the selftests/x86 code.  Usually a bug in one of the
+   more obscure corners of entry_64.S
+ * Crashes in early boot, especially around CPU bringup.  Bugs
+   in the trampoline code or mappings cause these.
+ * Crashes at the first interrupt.  Caused by bugs in entry_64.S,
+   like screwing up a page table switch.  Also caused by
+   incorrectly mapping the IRQ handler entry code.
+ * Crashes at the first NMI.  The NMI code is separate from main
+   interrupt handlers and can have bugs that do not affect
+   normal interrupts.  Also caused by incorrectly mapping NMI
+   code.  NMIs that interrupt the entry code must be very
+   careful and can be the cause of crashes that show up when
+   running perf.
+ * Kernel crashes at the first exit to userspace.  entry_64.S
+   bugs, or failing to map some of the exit code.
+ * Crashes at first interrupt that interrupts userspace. The paths
+   in entry_64.S that return to userspace are sometimes separate
+   from the ones that return to the kernel.
+ * Double faults: overflowing the kernel stack because of page
+   faults upon page faults.  Caused by touching non-pti-mapped
+   data in the entry code, or forgetting to switch to kernel
+   CR3 before calling into C functions which are not pti-mapped.
+ * Userspace segfaults early in boot, sometimes manifesting
+   as mount(8) failing to mount the rootfs.  These have
+   tended to be TLB invalidation issues.  Usually invalidating
+   the wrong PCID, or otherwise missing an invalidation.
+
+1. https://gruss.cc/files/kaiser.pdf
+2. https://meltdownattack.com/meltdown.pdf
diff --git a/Documentation/x86/x86_64/mm.txt b/Documentation/x86/x86_64/mm.txt
index 3448e675b462..ea91cb61a602 100644
--- a/Documentation/x86/x86_64/mm.txt
+++ b/Documentation/x86/x86_64/mm.txt
@@ -1,6 +1,4 @@
 
-<previous description obsolete, deleted>
-
 Virtual memory map with 4 level page tables:
 
 0000000000000000 - 00007fffffffffff (=47 bits) user space, different per mm
@@ -14,13 +12,17 @@ ffffea0000000000 - ffffeaffffffffff (=40 bits) virtual memory map (1TB)
 ... unused hole ...
 ffffec0000000000 - fffffbffffffffff (=44 bits) kasan shadow memory (16TB)
 ... unused hole ...
+                                    vaddr_end for KASLR
+fffffe0000000000 - fffffe7fffffffff (=39 bits) cpu_entry_area mapping
+fffffe8000000000 - fffffeffffffffff (=39 bits) LDT remap for PTI
 ffffff0000000000 - ffffff7fffffffff (=39 bits) %esp fixup stacks
 ... unused hole ...
 ffffffef00000000 - fffffffeffffffff (=64 GB) EFI region mapping space
 ... unused hole ...
 ffffffff80000000 - ffffffff9fffffff (=512 MB)  kernel text mapping, from phys 0
-ffffffffa0000000 - ffffffffff5fffff (=1526 MB) module mapping space (variable)
-ffffffffff600000 - ffffffffffdfffff (=8 MB) vsyscalls
+ffffffffa0000000 - [fixmap start]   (~1526 MB) module mapping space (variable)
+[fixmap start]   - ffffffffff5fffff kernel-internal fixmap range
+ffffffffff600000 - ffffffffff600fff (=4 kB) legacy vsyscall ABI
 ffffffffffe00000 - ffffffffffffffff (=2 MB) unused hole
 
 Virtual memory map with 5 level page tables:
@@ -29,26 +31,31 @@ Virtual memory map with 5 level page tables:
 hole caused by [56:63] sign extension
 ff00000000000000 - ff0fffffffffffff (=52 bits) guard hole, reserved for hypervisor
 ff10000000000000 - ff8fffffffffffff (=55 bits) direct mapping of all phys. memory
-ff90000000000000 - ff91ffffffffffff (=49 bits) hole
-ff92000000000000 - ffd1ffffffffffff (=54 bits) vmalloc/ioremap space
+ff90000000000000 - ff9fffffffffffff (=52 bits) LDT remap for PTI
+ffa0000000000000 - ffd1ffffffffffff (=54 bits) vmalloc/ioremap space (12800 TB)
 ffd2000000000000 - ffd3ffffffffffff (=49 bits) hole
 ffd4000000000000 - ffd5ffffffffffff (=49 bits) virtual memory map (512TB)
 ... unused hole ...
 ffdf000000000000 - fffffc0000000000 (=53 bits) kasan shadow memory (8PB)
 ... unused hole ...
+                                    vaddr_end for KASLR
+fffffe0000000000 - fffffe7fffffffff (=39 bits) cpu_entry_area mapping
+... unused hole ...
 ffffff0000000000 - ffffff7fffffffff (=39 bits) %esp fixup stacks
 ... unused hole ...
 ffffffef00000000 - fffffffeffffffff (=64 GB) EFI region mapping space
 ... unused hole ...
 ffffffff80000000 - ffffffff9fffffff (=512 MB)  kernel text mapping, from phys 0
-ffffffffa0000000 - ffffffffff5fffff (=1526 MB) module mapping space
-ffffffffff600000 - ffffffffffdfffff (=8 MB) vsyscalls
+ffffffffa0000000 - fffffffffeffffff (1520 MB) module mapping space
+[fixmap start]   - ffffffffff5fffff kernel-internal fixmap range
+ffffffffff600000 - ffffffffff600fff (=4 kB) legacy vsyscall ABI
 ffffffffffe00000 - ffffffffffffffff (=2 MB) unused hole
 
 Architecture defines a 64-bit virtual address. Implementations can support
 less. Currently supported are 48- and 57-bit virtual addresses. Bits 63
-through to the most-significant implemented bit are set to either all ones
-or all zero. This causes hole between user space and kernel addresses.
+through to the most-significant implemented bit are sign extended.
+This causes hole between user space and kernel addresses if you interpret them
+as unsigned.
 
 The direct mapping covers all memory in the system up to the highest
 memory address (this means in some cases it can also include PCI memory
@@ -58,19 +65,15 @@ vmalloc space is lazily synchronized into the different PML4/PML5 pages of
 the processes using the page fault handler, with init_top_pgt as
 reference.
 
-Current X86-64 implementations support up to 46 bits of address space (64 TB),
-which is our current limit. This expands into MBZ space in the page tables.
-
 We map EFI runtime services in the 'efi_pgd' PGD in a 64Gb large virtual
 memory window (this size is arbitrary, it can be raised later if needed).
 The mappings are not part of any other kernel PGD and are only available
 during EFI runtime calls.
 
-The module mapping space size changes based on the CONFIG requirements for the
-following fixmap section.
-
 Note that if CONFIG_RANDOMIZE_MEMORY is enabled, the direct mapping of all
 physical memory, vmalloc/ioremap space and virtual memory map are randomized.
 Their order is preserved but their base will be offset early at boot time.
 
--Andi Kleen, Jul 2004
+Be very careful vs. KASLR when changing anything here. The KASLR address
+range must not overlap with anything except the KASAN shadow area, which is
+correct as KASAN disables KASLR.
diff --git a/MAINTAINERS b/MAINTAINERS
index 1facaa8cd6c9..c588625c2250 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -62,7 +62,15 @@ trivial patch so apply some common sense.
 
 7.      When sending security related changes or reports to a maintainer
         please Cc: security@kernel.org, especially if the maintainer
-        does not respond.
+        does not respond. Please keep in mind that the security team is
+        a small set of people who can be efficient only when working on
+        verified bugs. Please only Cc: this list when you have identified
+        that the bug would present a short-term risk to other users if it
+        were publicly disclosed. For example, reports of address leaks do
+        not represent an immediate threat and are better handled publicly,
+        and ideally, should come with a patch proposal. Please do not send
+        automated reports to this list either. Such bugs will be handled
+        better and faster in the usual public places.
 
 8.      Happy hacking.
 
@@ -554,13 +562,13 @@ S:	Orphan
 F:      Documentation/filesystems/affs.txt
 F:      fs/affs/
 
-AFS FILESYSTEM & AF_RXRPC SOCKET DOMAIN
+AFS FILESYSTEM
 M:      David Howells <dhowells@redhat.com>
 L:      linux-afs@lists.infradead.org
 S:      Supported
 F:      fs/afs/
-F:      include/net/af_rxrpc.h
-F:      net/rxrpc/af_rxrpc.c
+F:      include/trace/events/afs.h
+F:      Documentation/filesystems/afs.txt
 W:      https://www.infradead.org/~dhowells/kafs/
 
 AGPGART DRIVER
@@ -859,7 +867,8 @@ F:	kernel/configs/android*
 ANDROID DRIVERS
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 M:      Arve Hjønnevåg <arve@android.com>
-M:      Riley Andrews <riandrews@android.com>
+M:      Todd Kjos <tkjos@android.com>
+M:      Martijn Coenen <maco@android.com>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
 L:      devel@driverdev.osuosl.org
 S:      Supported
@@ -2046,7 +2055,7 @@ F:	arch/arm/boot/dts/uniphier*
 F:      arch/arm/include/asm/hardware/cache-uniphier.h
 F:      arch/arm/mach-uniphier/
 F:      arch/arm/mm/cache-uniphier.c
-F:      arch/arm64/boot/dts/socionext/
+F:      arch/arm64/boot/dts/socionext/uniphier*
 F:      drivers/bus/uniphier-system-bus.c
 F:      drivers/clk/uniphier/
 F:      drivers/gpio/gpio-uniphier.c
@@ -2620,24 +2629,22 @@ F:	fs/bfs/
 F:      include/uapi/linux/bfs_fs.h
 
 BLACKFIN ARCHITECTURE
-M:      Steven Miao <realmz6@gmail.com>
 L:      adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
 T:      git git://git.code.sf.net/p/adi-linux/code
 W:      http://blackfin.uclinux.org
-S:      Supported
+S:      Orphan
 F:      arch/blackfin/
 
 BLACKFIN EMAC DRIVER
 L:      adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
 W:      http://blackfin.uclinux.org
-S:      Supported
+S:      Orphan
 F:      drivers/net/ethernet/adi/
 
 BLACKFIN MEDIA DRIVER
-M:      Scott Jiang <scott.jiang.linux@gmail.com>
 L:      adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
 W:      http://blackfin.uclinux.org/
-S:      Supported
+S:      Orphan
 F:      drivers/media/platform/blackfin/
 F:      drivers/media/i2c/adv7183*
 F:      drivers/media/i2c/vs6624*
@@ -2645,25 +2652,25 @@ F:	drivers/media/i2c/vs6624*
 BLACKFIN RTC DRIVER
 L:      adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
 W:      http://blackfin.uclinux.org
-S:      Supported
+S:      Orphan
 F:      drivers/rtc/rtc-bfin.c
 
 BLACKFIN SDH DRIVER
 L:      adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
 W:      http://blackfin.uclinux.org
-S:      Supported
+S:      Orphan
 F:      drivers/mmc/host/bfin_sdh.c
 
 BLACKFIN SERIAL DRIVER
 L:      adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
 W:      http://blackfin.uclinux.org
-S:      Supported
+S:      Orphan
 F:      drivers/tty/serial/bfin_uart.c
 
 BLACKFIN WATCHDOG DRIVER
 L:      adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
 W:      http://blackfin.uclinux.org
-S:      Supported
+S:      Orphan
 F:      drivers/watchdog/bfin_wdt.c
 
 BLINKM RGB LED DRIVER
@@ -5150,15 +5157,15 @@ F:	sound/usb/misc/ua101.c
 EFI TEST DRIVER
 L:      linux-efi@vger.kernel.org
 M:      Ivan Hu <ivan.hu@canonical.com>
-M:      Matt Fleming <matt@codeblueprint.co.uk>
+M:      Ard Biesheuvel <ard.biesheuvel@linaro.org>
 S:      Maintained
 F:      drivers/firmware/efi/test/
 
 EFI VARIABLE FILESYSTEM
 M:      Matthew Garrett <matthew.garrett@nebula.com>
 M:      Jeremy Kerr <jk@ozlabs.org>
-M:      Matt Fleming <matt@codeblueprint.co.uk>
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi.git
+M:      Ard Biesheuvel <ard.biesheuvel@linaro.org>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi.git
 L:      linux-efi@vger.kernel.org
 S:      Maintained
 F:      fs/efivarfs/
@@ -5319,7 +5326,6 @@ S:	Supported
 F:      security/integrity/evm/
 
 EXTENSIBLE FIRMWARE INTERFACE (EFI)
-M:      Matt Fleming <matt@codeblueprint.co.uk>
 M:      Ard Biesheuvel <ard.biesheuvel@linaro.org>
 L:      linux-efi@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi.git
@@ -5430,7 +5436,7 @@ F:	drivers/media/tuners/fc2580*
 
 FCOE SUBSYSTEM (libfc, libfcoe, fcoe)
 M:      Johannes Thumshirn <jth@kernel.org>
-L:      fcoe-devel@open-fcoe.org
+L:      linux-scsi@vger.kernel.org
 W:      www.Open-FCoE.org
 S:      Supported
 F:      drivers/scsi/libfc/
@@ -6611,16 +6617,6 @@ L:	linux-i2c@vger.kernel.org
 S:      Maintained
 F:      drivers/i2c/i2c-stub.c
 
-i386 BOOT CODE
-M:      "H. Peter Anvin" <hpa@zytor.com>
-S:      Maintained
-F:      arch/x86/boot/
-
-i386 SETUP CODE / CPU ERRATA WORKAROUNDS
-M:      "H. Peter Anvin" <hpa@zytor.com>
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/hpa/linux-2.6-x86setup.git
-S:      Maintained
-
 IA64 (Itanium) PLATFORM
 M:      Tony Luck <tony.luck@intel.com>
 M:      Fenghua Yu <fenghua.yu@intel.com>
@@ -7766,6 +7762,7 @@ F:	security/keys/
 
 KGDB / KDB /debug_core
 M:      Jason Wessel <jason.wessel@windriver.com>
+M:      Daniel Thompson <daniel.thompson@linaro.org>
 W:      http://kgdb.wiki.kernel.org/
 L:      kgdb-bugreport@lists.sourceforge.net
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/kgdb.git
@@ -9086,6 +9083,7 @@ F:	drivers/usb/image/microtek.*
 
 MIPS
 M:      Ralf Baechle <ralf@linux-mips.org>
+M:      James Hogan <jhogan@kernel.org>
 L:      linux-mips@linux-mips.org
 W:      http://www.linux-mips.org/
 T:      git git://git.linux-mips.org/pub/scm/ralf/linux.git
@@ -9639,8 +9637,8 @@ F:	include/uapi/linux/sunrpc/
 NILFS2 FILESYSTEM
 M:      Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
 L:      linux-nilfs@vger.kernel.org
-W:      http://nilfs.sourceforge.net/
-W:      http://nilfs.osdn.jp/
+W:      https://nilfs.sourceforge.io/
+W:      https://nilfs.osdn.jp/
 T:      git git://github.com/konis/nilfs2.git
 S:      Supported
 F:      Documentation/filesystems/nilfs2.txt
@@ -10135,7 +10133,7 @@ F:	drivers/irqchip/irq-ompic.c
 F:      drivers/irqchip/irq-or1k-*
 
 OPENVSWITCH
-M:      Pravin Shelar <pshelar@nicira.com>
+M:      Pravin B Shelar <pshelar@ovn.org>
 L:      netdev@vger.kernel.org
 L:      dev@openvswitch.org
 W:      http://openvswitch.org
@@ -11652,8 +11650,8 @@ F:	drivers/mtd/nand/r852.h
 RISC-V ARCHITECTURE
 M:      Palmer Dabbelt <palmer@sifive.com>
 M:      Albert Ou <albert@sifive.com>
-L:      patches@groups.riscv.org
-T:      git https://github.com/riscv/riscv-linux
+L:      linux-riscv@lists.infradead.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux.git
 S:      Supported
 F:      arch/riscv/
 K:      riscv
@@ -11777,6 +11775,18 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/jes/linux.git rtl8xxxu-deve
 S:      Maintained
 F:      drivers/net/wireless/realtek/rtl8xxxu/
 
+RXRPC SOCKETS (AF_RXRPC)
+M:      David Howells <dhowells@redhat.com>
+L:      linux-afs@lists.infradead.org
+S:      Supported
+F:      net/rxrpc/
+F:      include/keys/rxrpc-type.h
+F:      include/net/af_rxrpc.h
+F:      include/trace/events/rxrpc.h
+F:      include/uapi/linux/rxrpc.h
+F:      Documentation/networking/rxrpc.txt
+W:      https://www.infradead.org/~dhowells/kafs/
+
 S3 SAVAGE FRAMEBUFFER DRIVER
 M:      Antonino Daplas <adaplas@gmail.com>
 L:      linux-fbdev@vger.kernel.org
@@ -12222,7 +12232,7 @@ M:	Security Officers <security@kernel.org>
 S:      Supported
 
 SECURITY SUBSYSTEM
-M:      James Morris <james.l.morris@oracle.com>
+M:      James Morris <jmorris@namei.org>
 M:      "Serge E. Hallyn" <serge@hallyn.com>
 L:      linux-security-module@vger.kernel.org (suggested Cc:)
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git
@@ -12630,6 +12640,14 @@ S:	Maintained
 F:      drivers/ssb/
 F:      include/linux/ssb/
 
+SONY IMX274 SENSOR DRIVER
+M:      Leon Luo <leonl@leopardimaging.com>
+L:      linux-media@vger.kernel.org
+T:      git git://linuxtv.org/media_tree.git
+S:      Maintained
+F:      drivers/media/i2c/imx274.c
+F:      Documentation/devicetree/bindings/media/i2c/imx274.txt
+
 SONY MEMORYSTICK CARD SUPPORT
 M:      Alex Dubov <oakad@yahoo.com>
 W:      http://tifmxx.berlios.de/
@@ -13096,6 +13114,7 @@ F:	drivers/dma/dw/
 
 SYNOPSYS DESIGNWARE ENTERPRISE ETHERNET DRIVER
 M:      Jie Deng <jiedeng@synopsys.com>
+M:      Jose Abreu <Jose.Abreu@synopsys.com>
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/synopsys/
@@ -13471,6 +13490,7 @@ M:	Mika Westerberg <mika.westerberg@linux.intel.com>
 M:      Yehezkel Bernat <yehezkel.bernat@intel.com>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt.git
 S:      Maintained
+F:      Documentation/admin-guide/thunderbolt.rst
 F:      drivers/thunderbolt/
 F:      include/linux/thunderbolt.h
 
@@ -13648,10 +13668,8 @@ F:	drivers/net/wireless/ti/
 F:      include/linux/wl12xx.h
 
 TILE ARCHITECTURE
-M:      Chris Metcalf <cmetcalf@mellanox.com>
 W:      http://www.mellanox.com/repository/solutions/tile-scm/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile.git
-S:      Supported
+S:      Orphan
 F:      arch/tile/
 F:      drivers/char/tile-srom.c
 F:      drivers/edac/tile_edac.c
@@ -14839,7 +14857,7 @@ F:	net/x25/
 X86 ARCHITECTURE (32-BIT AND 64-BIT)
 M:      Thomas Gleixner <tglx@linutronix.de>
 M:      Ingo Molnar <mingo@redhat.com>
-M:      "H. Peter Anvin" <hpa@zytor.com>
+R:      "H. Peter Anvin" <hpa@zytor.com>
 M:      x86@kernel.org
 L:      linux-kernel@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git x86/core
diff --git a/Makefile b/Makefile
index c988e46a53cd..c8b8e902d5a4 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 15
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION =
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
@@ -484,26 +484,6 @@ CLANG_GCC_TC	:= --gcc-toolchain=$(GCC_TOOLCHAIN)
 endif
 KBUILD_CFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC)
 KBUILD_AFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC)
-KBUILD_CPPFLAGS += $(call cc-option,-Qunused-arguments,)
-KBUILD_CFLAGS += $(call cc-disable-warning, unused-variable)
-KBUILD_CFLAGS += $(call cc-disable-warning, format-invalid-specifier)
-KBUILD_CFLAGS += $(call cc-disable-warning, gnu)
-KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member)
-# Quiet clang warning: comparison of unsigned expression < 0 is always false
-KBUILD_CFLAGS += $(call cc-disable-warning, tautological-compare)
-# CLANG uses a _MergedGlobals as optimization, but this breaks modpost, as the
-# source of a reference will be _MergedGlobals and not on of the whitelisted names.
-# See modpost pattern 2
-KBUILD_CFLAGS += $(call cc-option, -mno-global-merge,)
-KBUILD_CFLAGS += $(call cc-option, -fcatch-undefined-behavior)
-KBUILD_CFLAGS += $(call cc-option, -no-integrated-as)
-KBUILD_AFLAGS += $(call cc-option, -no-integrated-as)
-else
-
-# These warnings generated too much noise in a regular build.
-# Use make W=1 to enable them (see scripts/Makefile.extrawarn)
-KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable)
-KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable)
 endif
 
 ifeq ($(config-targets),1)
@@ -716,6 +696,29 @@ ifdef CONFIG_CC_STACKPROTECTOR
 endif
 KBUILD_CFLAGS += $(stackp-flag)
 
+ifeq ($(cc-name),clang)
+KBUILD_CPPFLAGS += $(call cc-option,-Qunused-arguments,)
+KBUILD_CFLAGS += $(call cc-disable-warning, unused-variable)
+KBUILD_CFLAGS += $(call cc-disable-warning, format-invalid-specifier)
+KBUILD_CFLAGS += $(call cc-disable-warning, gnu)
+KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member)
+# Quiet clang warning: comparison of unsigned expression < 0 is always false
+KBUILD_CFLAGS += $(call cc-disable-warning, tautological-compare)
+# CLANG uses a _MergedGlobals as optimization, but this breaks modpost, as the
+# source of a reference will be _MergedGlobals and not on of the whitelisted names.
+# See modpost pattern 2
+KBUILD_CFLAGS += $(call cc-option, -mno-global-merge,)
+KBUILD_CFLAGS += $(call cc-option, -fcatch-undefined-behavior)
+KBUILD_CFLAGS += $(call cc-option, -no-integrated-as)
+KBUILD_AFLAGS += $(call cc-option, -no-integrated-as)
+else
+
+# These warnings generated too much noise in a regular build.
+# Use make W=1 to enable them (see scripts/Makefile.extrawarn)
+KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable)
+KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable)
+endif
+
 ifdef CONFIG_FRAME_POINTER
 KBUILD_CFLAGS   += -fno-omit-frame-pointer -fno-optimize-sibling-calls
 else
@@ -789,6 +792,9 @@ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign)
 # disable invalid "can't wrap" optimizations for signed / pointers
 KBUILD_CFLAGS   += $(call cc-option,-fno-strict-overflow)
 
+# Make sure -fstack-check isn't enabled (like gentoo apparently did)
+KBUILD_CFLAGS  += $(call cc-option,-fno-stack-check,)
+
 # conserve stack if available
 KBUILD_CFLAGS   += $(call cc-option,-fconserve-stack)
 
diff --git a/arch/alpha/include/uapi/asm/Kbuild b/arch/alpha/include/uapi/asm/Kbuild
index b15bf6bc0e94..14a2e9af97e9 100644
--- a/arch/alpha/include/uapi/asm/Kbuild
+++ b/arch/alpha/include/uapi/asm/Kbuild
@@ -1,2 +1,4 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
+
+generic-y += bpf_perf_event.h
diff --git a/arch/alpha/kernel/sys_sio.c b/arch/alpha/kernel/sys_sio.c
index 37bd6d9b8eb9..a6bdc1da47ad 100644
--- a/arch/alpha/kernel/sys_sio.c
+++ b/arch/alpha/kernel/sys_sio.c
@@ -102,6 +102,15 @@ sio_pci_route(void)
                                    alpha_mv.sys.sio.route_tab);
 }
 
+static bool sio_pci_dev_irq_needs_level(const struct pci_dev *dev)
+{
+        if ((dev->class >> 16 == PCI_BASE_CLASS_BRIDGE) &&
+            (dev->class >> 8 != PCI_CLASS_BRIDGE_PCMCIA))
+                return false;
+
+        return true;
+}
+
 static unsigned int __init
 sio_collect_irq_levels(void)
 {
@@ -110,8 +119,7 @@ sio_collect_irq_levels(void)
 
         /* Iterate through the devices, collecting IRQ levels.  */
         for_each_pci_dev(dev) {
-                if ((dev->class >> 16 == PCI_BASE_CLASS_BRIDGE) &&
-                    (dev->class >> 8 != PCI_CLASS_BRIDGE_PCMCIA))
+                if (!sio_pci_dev_irq_needs_level(dev))
                         continue;
 
                 if (dev->irq)
@@ -120,8 +128,7 @@ sio_collect_irq_levels(void)
         return level_bits;
 }
 
-static void __init
-sio_fixup_irq_levels(unsigned int level_bits)
+static void __sio_fixup_irq_levels(unsigned int level_bits, bool reset)
 {
         unsigned int old_level_bits;
 
@@ -139,12 +146,21 @@ sio_fixup_irq_levels(unsigned int level_bits)
          */
         old_level_bits = inb(0x4d0) | (inb(0x4d1) << 8);
 
-        level_bits |= (old_level_bits & 0x71ff);
+        if (reset)
+                old_level_bits &= 0x71ff;
+
+        level_bits |= old_level_bits;
 
         outb((level_bits >> 0) & 0xff, 0x4d0);
         outb((level_bits >> 8) & 0xff, 0x4d1);
 }
 
+static inline void
+sio_fixup_irq_levels(unsigned int level_bits)
+{
+        __sio_fixup_irq_levels(level_bits, true);
+}
+
 static inline int
 noname_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
@@ -181,7 +197,14 @@ noname_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
         const long min_idsel = 6, max_idsel = 14, irqs_per_slot = 5;
         int irq = COMMON_TABLE_LOOKUP, tmp;
         tmp = __kernel_extbl(alpha_mv.sys.sio.route_tab, irq);
-        return irq >= 0 ? tmp : -1;
+
+        irq = irq >= 0 ? tmp : -1;
+
+        /* Fixup IRQ level if an actual IRQ mapping is detected */
+        if (sio_pci_dev_irq_needs_level(dev) && irq >= 0)
+                __sio_fixup_irq_levels(1 << irq, false);
+
+        return irq;
 }
 
 static inline int
diff --git a/arch/alpha/lib/ev6-memset.S b/arch/alpha/lib/ev6-memset.S
index 316a99aa9efe..1cfcfbbea6f0 100644
--- a/arch/alpha/lib/ev6-memset.S
+++ b/arch/alpha/lib/ev6-memset.S
@@ -18,7 +18,7 @@
  * The algorithm for the leading and trailing quadwords remains the same,
  * however the loop has been unrolled to enable better memory throughput,
  * and the code has been replicated for each of the entry points: __memset
- * and __memsetw to permit better scheduling to eliminate the stalling
+ * and __memset16 to permit better scheduling to eliminate the stalling
  * encountered during the mask replication.
  * A future enhancement might be to put in a byte store loop for really
  * small (say < 32 bytes) memset()s.  Whether or not that change would be
@@ -34,7 +34,7 @@
         .globl memset
         .globl __memset
         .globl ___memset
-        .globl __memsetw
+        .globl __memset16
         .globl __constant_c_memset
 
         .ent ___memset
@@ -415,9 +415,9 @@ end:
          * to mask stalls.  Note that entry point names also had to change
          */
         .align 5
-        .ent __memsetw
+        .ent __memset16
 
-__memsetw:
+__memset16:
         .frame $30,0,$26,0
         .prologue 0
 
@@ -596,8 +596,8 @@ end_w:
         nop
         ret $31,($26),1         # L0 :
 
-        .end __memsetw
-        EXPORT_SYMBOL(__memsetw)
+        .end __memset16
+        EXPORT_SYMBOL(__memset16)
 
 memset = ___memset
 __memset = ___memset
diff --git a/arch/arc/boot/dts/axc003.dtsi b/arch/arc/boot/dts/axc003.dtsi
index 4e6e9f57e790..dc91c663bcc0 100644
--- a/arch/arc/boot/dts/axc003.dtsi
+++ b/arch/arc/boot/dts/axc003.dtsi
@@ -35,6 +35,14 @@
                         reg = <0x80 0x10>, <0x100 0x10>;
                         #clock-cells = <0>;
                         clocks = <&input_clk>;
+
+                        /*
+                         * Set initial core pll output frequency to 90MHz.
+                         * It will be applied at the core pll driver probing
+                         * on early boot.
+                         */
+                        assigned-clocks = <&core_clk>;
+                        assigned-clock-rates = <90000000>;
                 };
 
                 core_intc: archs-intc@cpu {
diff --git a/arch/arc/boot/dts/axc003_idu.dtsi b/arch/arc/boot/dts/axc003_idu.dtsi
index 63954a8b0100..69ff4895f2ba 100644
--- a/arch/arc/boot/dts/axc003_idu.dtsi
+++ b/arch/arc/boot/dts/axc003_idu.dtsi
@@ -35,6 +35,14 @@
                         reg = <0x80 0x10>, <0x100 0x10>;
                         #clock-cells = <0>;
                         clocks = <&input_clk>;
+
+                        /*
+                         * Set initial core pll output frequency to 100MHz.
+                         * It will be applied at the core pll driver probing
+                         * on early boot.
+                         */
+                        assigned-clocks = <&core_clk>;
+                        assigned-clock-rates = <100000000>;
                 };
 
                 core_intc: archs-intc@cpu {
diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
index 8f627c200d60..006aa3de5348 100644
--- a/arch/arc/boot/dts/hsdk.dts
+++ b/arch/arc/boot/dts/hsdk.dts
@@ -114,6 +114,14 @@
                         reg = <0x00 0x10>, <0x14B8 0x4>;
                         #clock-cells = <0>;
                         clocks = <&input_clk>;
+
+                        /*
+                         * Set initial core pll output frequency to 1GHz.
+                         * It will be applied at the core pll driver probing
+                         * on early boot.
+                         */
+                        assigned-clocks = <&core_clk>;
+                        assigned-clock-rates = <1000000000>;
                 };
 
                 serial: serial@5000 {
diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig
index 7b8f8faf8a24..ac6b0ed8341e 100644
--- a/arch/arc/configs/hsdk_defconfig
+++ b/arch/arc/configs/hsdk_defconfig
@@ -49,10 +49,11 @@ CONFIG_SERIAL_8250_DW=y
 CONFIG_SERIAL_OF_PLATFORM=y
 # CONFIG_HW_RANDOM is not set
 # CONFIG_HWMON is not set
+CONFIG_DRM=y
+# CONFIG_DRM_FBDEV_EMULATION is not set
+CONFIG_DRM_UDL=y
 CONFIG_FB=y
-CONFIG_FB_UDL=y
 CONFIG_FRAMEBUFFER_CONSOLE=y
-CONFIG_USB=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
 CONFIG_USB_OHCI_HCD=y
diff --git a/arch/arc/include/asm/uaccess.h b/arch/arc/include/asm/uaccess.h
index f35974ee7264..c9173c02081c 100644
--- a/arch/arc/include/asm/uaccess.h
+++ b/arch/arc/include/asm/uaccess.h
@@ -668,6 +668,7 @@ __arc_strncpy_from_user(char *dst, const char __user *src, long count)
                 return 0;
 
         __asm__ __volatile__(
+        "       mov     lp_count, %5            \n"
         "       lp      3f                      \n"
         "1:     ldb.ab  %3, [%2, 1]             \n"
         "       breq.d  %3, 0, 3f               \n"
@@ -684,8 +685,8 @@ __arc_strncpy_from_user(char *dst, const char __user *src, long count)
         "       .word   1b, 4b                  \n"
         "       .previous                       \n"
         : "+r"(res), "+r"(dst), "+r"(src), "=r"(val)
-        : "g"(-EFAULT), "l"(count)
-        : "memory");
+        : "g"(-EFAULT), "r"(count)
+        : "lp_count", "lp_start", "lp_end", "memory");
 
         return res;
 }
diff --git a/arch/arc/include/uapi/asm/Kbuild b/arch/arc/include/uapi/asm/Kbuild
index fa6d0ff4ff89..170b5db64afe 100644
--- a/arch/arc/include/uapi/asm/Kbuild
+++ b/arch/arc/include/uapi/asm/Kbuild
@@ -3,6 +3,7 @@ include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += auxvec.h
 generic-y += bitsperlong.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += fcntl.h
 generic-y += ioctl.h
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 7ef7d9a8ff89..9d27331fe69a 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -199,7 +199,7 @@ static void read_arc_build_cfg_regs(void)
                         unsigned int exec_ctrl;
 
                         READ_BCR(AUX_EXEC_CTRL, exec_ctrl);
-                        cpu->extn.dual_enb = exec_ctrl & 1;
+                        cpu->extn.dual_enb = !(exec_ctrl & 1);
 
                         /* dual issue always present for this core */
                         cpu->extn.dual = 1;
diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
index 74315f302971..bf40e06f3fb8 100644
--- a/arch/arc/kernel/stacktrace.c
+++ b/arch/arc/kernel/stacktrace.c
@@ -163,7 +163,7 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
  */
 static int __print_sym(unsigned int address, void *unused)
 {
-        __print_symbol("  %s\n", address);
+        printk("  %pS\n", (void *)address);
         return 0;
 }
 
diff --git a/arch/arc/kernel/traps.c b/arch/arc/kernel/traps.c
index bcd7c9fc5d0f..133a4dae41fe 100644
--- a/arch/arc/kernel/traps.c
+++ b/arch/arc/kernel/traps.c
@@ -83,6 +83,7 @@ DO_ERROR_INFO(SIGILL, "Illegal Insn (or Seq)", insterror_is_error, ILL_ILLOPC)
 DO_ERROR_INFO(SIGBUS, "Invalid Mem Access", __weak do_memory_error, BUS_ADRERR)
 DO_ERROR_INFO(SIGTRAP, "Breakpoint Set", trap_is_brkpt, TRAP_BRKPT)
 DO_ERROR_INFO(SIGBUS, "Misaligned Access", do_misaligned_error, BUS_ADRALN)
+DO_ERROR_INFO(SIGSEGV, "gcc generated __builtin_trap", do_trap5_error, 0)
 
 /*
  * Entry Point for Misaligned Data access Exception, for emulating in software
@@ -115,6 +116,8 @@ void do_machine_check_fault(unsigned long address, struct pt_regs *regs)
  * Thus TRAP_S <n> can be used for specific purpose
  *  -1 used for software breakpointing (gdb)
  *  -2 used by kprobes
+ *  -5 __builtin_trap() generated by gcc (2018.03 onwards) for toggle such as
+ *     -fno-isolate-erroneous-paths-dereference
  */
 void do_non_swi_trap(unsigned long address, struct pt_regs *regs)
 {
@@ -134,6 +137,9 @@ void do_non_swi_trap(unsigned long address, struct pt_regs *regs)
                 kgdb_trap(regs);
                 break;
 
+        case 5:
+                do_trap5_error(address, regs);
+                break;
         default:
                 break;
         }
@@ -155,3 +161,11 @@ void do_insterror_or_kprobe(unsigned long address, struct pt_regs *regs)
 
         insterror_is_error(address, regs);
 }
+
+/*
+ * abort() call generated by older gcc for __builtin_trap()
+ */
+void abort(void)
+{
+        __asm__ __volatile__("trap_s  5\n");
+}
diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
index 7d8c1d6c2f60..6e9a0a9a6a04 100644
--- a/arch/arc/kernel/troubleshoot.c
+++ b/arch/arc/kernel/troubleshoot.c
@@ -163,6 +163,9 @@ static void show_ecr_verbose(struct pt_regs *regs)
                 else
                         pr_cont("Bus Error, check PRM\n");
 #endif
+        } else if (vec == ECR_V_TRAP) {
+                if (regs->ecr_param == 5)
+                        pr_cont("gcc generated __builtin_trap\n");
         } else {
                 pr_cont("Check Programmer's Manual\n");
         }
diff --git a/arch/arc/plat-axs10x/axs10x.c b/arch/arc/plat-axs10x/axs10x.c
index f1ac6790da5f..46544e88492d 100644
--- a/arch/arc/plat-axs10x/axs10x.c
+++ b/arch/arc/plat-axs10x/axs10x.c
@@ -317,25 +317,23 @@ static void __init axs103_early_init(void)
          * Instead of duplicating defconfig/DT for SMP/QUAD, add a small hack
          * of fudging the freq in DT
          */
+#define AXS103_QUAD_CORE_CPU_FREQ_HZ    50000000
+
         unsigned int num_cores = (read_aux_reg(ARC_REG_MCIP_BCR) >> 16) & 0x3F;
         if (num_cores > 2) {
-                u32 freq = 50, orig;
-                /*
-                 * TODO: use cpu node "cpu-freq" param instead of platform-specific
-                 * "/cpu_card/core_clk" as it works only if we use fixed-clock for cpu.
-                 */
+                u32 freq;
                 int off = fdt_path_offset(initial_boot_params, "/cpu_card/core_clk");
                 const struct fdt_property *prop;
 
                 prop = fdt_get_property(initial_boot_params, off,
-                                        "clock-frequency", NULL);
-                orig = be32_to_cpu(*(u32*)(prop->data)) / 1000000;
+                                        "assigned-clock-rates", NULL);
+                freq = be32_to_cpu(*(u32 *)(prop->data));
 
                 /* Patching .dtb in-place with new core clock value */
-                if (freq != orig ) {
-                        freq = cpu_to_be32(freq * 1000000);
+                if (freq != AXS103_QUAD_CORE_CPU_FREQ_HZ) {
+                        freq = cpu_to_be32(AXS103_QUAD_CORE_CPU_FREQ_HZ);
                         fdt_setprop_inplace(initial_boot_params, off,
-                                            "clock-frequency", &freq, sizeof(freq));
+                                            "assigned-clock-rates", &freq, sizeof(freq));
                 }
         }
 #endif
diff --git a/arch/arc/plat-hsdk/platform.c b/arch/arc/plat-hsdk/platform.c
index fd0ae5e38639..2958aedb649a 100644
--- a/arch/arc/plat-hsdk/platform.c
+++ b/arch/arc/plat-hsdk/platform.c
@@ -38,42 +38,6 @@ static void __init hsdk_init_per_cpu(unsigned int cpu)
 #define CREG_PAE                (CREG_BASE + 0x180)
 #define CREG_PAE_UPDATE         (CREG_BASE + 0x194)
 
-#define CREG_CORE_IF_CLK_DIV    (CREG_BASE + 0x4B8)
-#define CREG_CORE_IF_CLK_DIV_2  0x1
-#define CGU_BASE                ARC_PERIPHERAL_BASE
-#define CGU_PLL_STATUS          (ARC_PERIPHERAL_BASE + 0x4)
-#define CGU_PLL_CTRL            (ARC_PERIPHERAL_BASE + 0x0)
-#define CGU_PLL_STATUS_LOCK     BIT(0)
-#define CGU_PLL_STATUS_ERR      BIT(1)
-#define CGU_PLL_CTRL_1GHZ       0x3A10
-#define HSDK_PLL_LOCK_TIMEOUT   500
-
-#define HSDK_PLL_LOCKED() \
-        !!(ioread32((void __iomem *) CGU_PLL_STATUS) & CGU_PLL_STATUS_LOCK)
-
-#define HSDK_PLL_ERR() \
-        !!(ioread32((void __iomem *) CGU_PLL_STATUS) & CGU_PLL_STATUS_ERR)
-
-static void __init hsdk_set_cpu_freq_1ghz(void)
-{
-        u32 timeout = HSDK_PLL_LOCK_TIMEOUT;
-
-        /*
-         * As we set cpu clock which exceeds 500MHz, the divider for the interface
-         * clock must be programmed to div-by-2.
-         */
-        iowrite32(CREG_CORE_IF_CLK_DIV_2, (void __iomem *) CREG_CORE_IF_CLK_DIV);
-
-        /* Set cpu clock to 1GHz */
-        iowrite32(CGU_PLL_CTRL_1GHZ, (void __iomem *) CGU_PLL_CTRL);
-
-        while (!HSDK_PLL_LOCKED() && timeout--)
-                cpu_relax();
-
-        if (!HSDK_PLL_LOCKED() || HSDK_PLL_ERR())
-                pr_err("Failed to setup CPU frequency to 1GHz!");
-}
-
 #define SDIO_BASE               (ARC_PERIPHERAL_BASE + 0xA000)
 #define SDIO_UHS_REG_EXT        (SDIO_BASE + 0x108)
 #define SDIO_UHS_REG_EXT_DIV_2  (2 << 30)
@@ -98,12 +62,6 @@ static void __init hsdk_init_early(void)
          * minimum possible div-by-2.
          */
         iowrite32(SDIO_UHS_REG_EXT_DIV_2, (void __iomem *) SDIO_UHS_REG_EXT);
-
-        /*
-         * Setup CPU frequency to 1GHz.
-         * TODO: remove it after smart hsdk pll driver will be introduced.
-         */
-        hsdk_set_cpu_freq_1ghz();
 }
 
 static const char *hsdk_compat[] __initconst = {
diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi
index 1b81c4e75772..d37f95025807 100644
--- a/arch/arm/boot/dts/am33xx.dtsi
+++ b/arch/arm/boot/dts/am33xx.dtsi
@@ -630,6 +630,7 @@
                                 reg-names = "phy";
                                 status = "disabled";
                                 ti,ctrl_mod = <&usb_ctrl_mod>;
+                                #phy-cells = <0>;
                         };
 
                         usb0: usb@47401000 {
@@ -678,6 +679,7 @@
                                 reg-names = "phy";
                                 status = "disabled";
                                 ti,ctrl_mod = <&usb_ctrl_mod>;
+                                #phy-cells = <0>;
                         };
 
                         usb1: usb@47401800 {
diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
index e5b061469bf8..4714a59fd86d 100644
--- a/arch/arm/boot/dts/am4372.dtsi
+++ b/arch/arm/boot/dts/am4372.dtsi
@@ -927,7 +927,8 @@
                         reg = <0x48038000 0x2000>,
                               <0x46000000 0x400000>;
                         reg-names = "mpu", "dat";
-                        interrupts = <80>, <81>;
+                        interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>,
+                                     <GIC_SPI 81 IRQ_TYPE_LEVEL_HIGH>;
                         interrupt-names = "tx", "rx";
                         status = "disabled";
                         dmas = <&edma 8 2>,
@@ -941,7 +942,8 @@
                         reg = <0x4803C000 0x2000>,
                               <0x46400000 0x400000>;
                         reg-names = "mpu", "dat";
-                        interrupts = <82>, <83>;
+                        interrupts = <GIC_SPI 82 IRQ_TYPE_LEVEL_HIGH>,
+                                     <GIC_SPI 83 IRQ_TYPE_LEVEL_HIGH>;
                         interrupt-names = "tx", "rx";
                         status = "disabled";
                         dmas = <&edma 10 2>,
diff --git a/arch/arm/boot/dts/am437x-cm-t43.dts b/arch/arm/boot/dts/am437x-cm-t43.dts
index 9e92d480576b..3b9a94c274a7 100644
--- a/arch/arm/boot/dts/am437x-cm-t43.dts
+++ b/arch/arm/boot/dts/am437x-cm-t43.dts
@@ -301,8 +301,8 @@
         status = "okay";
         pinctrl-names = "default";
         pinctrl-0 = <&spi0_pins>;
-        dmas = <&edma 16
-                &edma 17>;
+        dmas = <&edma 16 0
+                &edma 17 0>;
         dma-names = "tx0", "rx0";
 
         flash: w25q64cvzpig@0 {
diff --git a/arch/arm/boot/dts/armada-385-db-ap.dts b/arch/arm/boot/dts/armada-385-db-ap.dts
index 25d2d720dc0e..678aa023335d 100644
--- a/arch/arm/boot/dts/armada-385-db-ap.dts
+++ b/arch/arm/boot/dts/armada-385-db-ap.dts
@@ -236,6 +236,7 @@
         usb3_phy: usb3_phy {
                 compatible = "usb-nop-xceiv";
                 vcc-supply = <&reg_xhci0_vbus>;
+                #phy-cells = <0>;
         };
 
         reg_xhci0_vbus: xhci0-vbus {
diff --git a/arch/arm/boot/dts/armada-385-linksys.dtsi b/arch/arm/boot/dts/armada-385-linksys.dtsi
index e1f355ffc8f7..434dc9aaa5e4 100644
--- a/arch/arm/boot/dts/armada-385-linksys.dtsi
+++ b/arch/arm/boot/dts/armada-385-linksys.dtsi
@@ -66,6 +66,7 @@
         usb3_1_phy: usb3_1-phy {
                 compatible = "usb-nop-xceiv";
                 vcc-supply = <&usb3_1_vbus>;
+                #phy-cells = <0>;
         };
 
         usb3_1_vbus: usb3_1-vbus {
diff --git a/arch/arm/boot/dts/armada-385-synology-ds116.dts b/arch/arm/boot/dts/armada-385-synology-ds116.dts
index 36ad571e76f3..0a3552ebda3b 100644
--- a/arch/arm/boot/dts/armada-385-synology-ds116.dts
+++ b/arch/arm/boot/dts/armada-385-synology-ds116.dts
@@ -191,11 +191,13 @@
         usb3_0_phy: usb3_0_phy {
                 compatible = "usb-nop-xceiv";
                 vcc-supply = <&reg_usb3_0_vbus>;
+                #phy-cells = <0>;
         };
 
         usb3_1_phy: usb3_1_phy {
                 compatible = "usb-nop-xceiv";
                 vcc-supply = <&reg_usb3_1_vbus>;
+                #phy-cells = <0>;
         };
 
         reg_usb3_0_vbus: usb3-vbus0 {
diff --git a/arch/arm/boot/dts/armada-388-gp.dts b/arch/arm/boot/dts/armada-388-gp.dts
index f503955dbd3b..51b4ee6df130 100644
--- a/arch/arm/boot/dts/armada-388-gp.dts
+++ b/arch/arm/boot/dts/armada-388-gp.dts
@@ -276,11 +276,13 @@
         usb2_1_phy: usb2_1_phy {
                 compatible = "usb-nop-xceiv";
                 vcc-supply = <&reg_usb2_1_vbus>;
+                #phy-cells = <0>;
         };
 
         usb3_phy: usb3_phy {
                 compatible = "usb-nop-xceiv";
                 vcc-supply = <&reg_usb3_vbus>;
+                #phy-cells = <0>;
         };
 
         reg_usb3_vbus: usb3-vbus {
diff --git a/arch/arm/boot/dts/aspeed-g4.dtsi b/arch/arm/boot/dts/aspeed-g4.dtsi
index 45d815a86d42..de08d9045cb8 100644
--- a/arch/arm/boot/dts/aspeed-g4.dtsi
+++ b/arch/arm/boot/dts/aspeed-g4.dtsi
@@ -219,7 +219,7 @@
                                 compatible = "aspeed,ast2400-vuart";
                                 reg = <0x1e787000 0x40>;
                                 reg-shift = <2>;
-                                interrupts = <10>;
+                                interrupts = <8>;
                                 clocks = <&clk_uart>;
                                 no-loopback-test;
                                 status = "disabled";
diff --git a/arch/arm/boot/dts/at91-tse850-3.dts b/arch/arm/boot/dts/at91-tse850-3.dts
index 5f29010cdbd8..9b82cc8843e1 100644
--- a/arch/arm/boot/dts/at91-tse850-3.dts
+++ b/arch/arm/boot/dts/at91-tse850-3.dts
@@ -221,6 +221,7 @@
         jc42@18 {
                 compatible = "nxp,se97b", "jedec,jc-42.4-temp";
                 reg = <0x18>;
+                smbus-timeout-disable;
         };
 
         dpot: mcp4651-104@28 {
diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi
index 528b9e3bc1da..dcc55aa84583 100644
--- a/arch/arm/boot/dts/bcm-nsp.dtsi
+++ b/arch/arm/boot/dts/bcm-nsp.dtsi
@@ -85,7 +85,7 @@
                 timer@20200 {
                         compatible = "arm,cortex-a9-global-timer";
                         reg = <0x20200 0x100>;
-                        interrupts = <GIC_PPI 11 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_PPI 11 IRQ_TYPE_EDGE_RISING>;
                         clocks = <&periph_clk>;
                 };
 
@@ -93,7 +93,7 @@
                         compatible = "arm,cortex-a9-twd-timer";
                         reg = <0x20600 0x20>;
                         interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(2) |
-                                                  IRQ_TYPE_LEVEL_HIGH)>;
+                                                  IRQ_TYPE_EDGE_RISING)>;
                         clocks = <&periph_clk>;
                 };
 
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index 013431e3d7c3..dcde93c85c2d 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -639,5 +639,6 @@
 
         usbphy: phy {
                 compatible = "usb-nop-xceiv";
+                #phy-cells = <0>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958623hr.dts b/arch/arm/boot/dts/bcm958623hr.dts
index 3bc50849d013..b8bde13de90a 100644
--- a/arch/arm/boot/dts/bcm958623hr.dts
+++ b/arch/arm/boot/dts/bcm958623hr.dts
@@ -141,10 +141,6 @@
         status = "okay";
 };
 
-&sata {
-        status = "okay";
-};
-
 &qspi {
         bspi-sel = <0>;
         flash: m25p80@0 {
diff --git a/arch/arm/boot/dts/bcm958625hr.dts b/arch/arm/boot/dts/bcm958625hr.dts
index d94d14b3c745..6a44b8021702 100644
--- a/arch/arm/boot/dts/bcm958625hr.dts
+++ b/arch/arm/boot/dts/bcm958625hr.dts
@@ -177,10 +177,6 @@
         status = "okay";
 };
 
-&sata {
-        status = "okay";
-};
-
 &srab {
         compatible = "brcm,bcm58625-srab", "brcm,nsp-srab";
         status = "okay";
diff --git a/arch/arm/boot/dts/da850-lcdk.dts b/arch/arm/boot/dts/da850-lcdk.dts
index eed89e659143..a1f4d6d5a569 100644
--- a/arch/arm/boot/dts/da850-lcdk.dts
+++ b/arch/arm/boot/dts/da850-lcdk.dts
@@ -293,12 +293,12 @@
                                         label = "u-boot env";
                                         reg = <0 0x020000>;
                                 };
-                                partition@0x020000 {
+                                partition@20000 {
                                         /* The LCDK defaults to booting from this partition */
                                         label = "u-boot";
                                         reg = <0x020000 0x080000>;
                                 };
-                                partition@0x0a0000 {
+                                partition@a0000 {
                                         label = "free space";
                                         reg = <0x0a0000 0>;
                                 };
diff --git a/arch/arm/boot/dts/da850-lego-ev3.dts b/arch/arm/boot/dts/da850-lego-ev3.dts
index 413dbd5d9f64..81942ae83e1f 100644
--- a/arch/arm/boot/dts/da850-lego-ev3.dts
+++ b/arch/arm/boot/dts/da850-lego-ev3.dts
@@ -178,7 +178,7 @@
          */
         battery {
                 pinctrl-names = "default";
-                pintctrl-0 = <&battery_pins>;
+                pinctrl-0 = <&battery_pins>;
                 compatible = "lego,ev3-battery";
                 io-channels = <&adc 4>, <&adc 3>;
                 io-channel-names = "voltage", "current";
@@ -392,7 +392,7 @@
         batt_volt_en {
                 gpio-hog;
                 gpios = <6 GPIO_ACTIVE_HIGH>;
-                output-low;
+                output-high;
         };
 };
 
diff --git a/arch/arm/boot/dts/dm814x.dtsi b/arch/arm/boot/dts/dm814x.dtsi
index 9708157f5daf..681f5487406e 100644
--- a/arch/arm/boot/dts/dm814x.dtsi
+++ b/arch/arm/boot/dts/dm814x.dtsi
@@ -75,6 +75,7 @@
                                 reg = <0x47401300 0x100>;
                                 reg-names = "phy";
                                 ti,ctrl_mod = <&usb_ctrl_mod>;
+                                #phy-cells = <0>;
                         };
 
                         usb0: usb@47401000 {
@@ -385,6 +386,7 @@
                                         reg = <0x1b00 0x100>;
                                         reg-names = "phy";
                                         ti,ctrl_mod = <&usb_ctrl_mod>;
+                                        #phy-cells = <0>;
                                 };
                         };
 
diff --git a/arch/arm/boot/dts/exynos5800-peach-pi.dts b/arch/arm/boot/dts/exynos5800-peach-pi.dts
index b2b95ff205e8..0029ec27819c 100644
--- a/arch/arm/boot/dts/exynos5800-peach-pi.dts
+++ b/arch/arm/boot/dts/exynos5800-peach-pi.dts
@@ -664,6 +664,10 @@
         status = "okay";
 };
 
+&mixer {
+        status = "okay";
+};
+
 /* eMMC flash */
 &mmc_0 {
         status = "okay";
diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi
index 589a67c5f796..84f17f7abb71 100644
--- a/arch/arm/boot/dts/imx53.dtsi
+++ b/arch/arm/boot/dts/imx53.dtsi
@@ -433,15 +433,6 @@
                                 clock-names = "ipg", "per";
                         };
 
-                        srtc: srtc@53fa4000 {
-                                compatible = "fsl,imx53-rtc", "fsl,imx25-rtc";
-                                reg = <0x53fa4000 0x4000>;
-                                interrupts = <24>;
-                                interrupt-parent = <&tzic>;
-                                clocks = <&clks IMX5_CLK_SRTC_GATE>;
-                                clock-names = "ipg";
-                        };
-
                         iomuxc: iomuxc@53fa8000 {
                                 compatible = "fsl,imx53-iomuxc";
                                 reg = <0x53fa8000 0x4000>;
diff --git a/arch/arm/boot/dts/kirkwood-openblocks_a7.dts b/arch/arm/boot/dts/kirkwood-openblocks_a7.dts
index cf2f5240e176..27cc913ca0f5 100644
--- a/arch/arm/boot/dts/kirkwood-openblocks_a7.dts
+++ b/arch/arm/boot/dts/kirkwood-openblocks_a7.dts
@@ -53,7 +53,8 @@
                 };
 
                 pinctrl: pin-controller@10000 {
-                        pinctrl-0 = <&pmx_dip_switches &pmx_gpio_header>;
+                        pinctrl-0 = <&pmx_dip_switches &pmx_gpio_header
+                                     &pmx_gpio_header_gpo>;
                         pinctrl-names = "default";
 
                         pmx_uart0: pmx-uart0 {
@@ -85,11 +86,16 @@
                          * ground.
                          */
                         pmx_gpio_header: pmx-gpio-header {
-                                marvell,pins = "mpp17", "mpp7", "mpp29", "mpp28",
+                                marvell,pins = "mpp17", "mpp29", "mpp28",
                                                "mpp35", "mpp34", "mpp40";
                                 marvell,function = "gpio";
                         };
 
+                        pmx_gpio_header_gpo: pxm-gpio-header-gpo {
+                                marvell,pins = "mpp7";
+                                marvell,function = "gpo";
+                        };
+
                         pmx_gpio_init: pmx-init {
                                 marvell,pins = "mpp38";
                                 marvell,function = "gpio";
diff --git a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
index 38faa90007d7..2fa5eb4bd402 100644
--- a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
+++ b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
@@ -72,7 +72,8 @@
 };
 
 &gpmc {
-        ranges = <1 0 0x08000000 0x1000000>;    /* CS1: 16MB for LAN9221 */
+        ranges = <0 0 0x30000000 0x1000000      /* CS0: 16MB for NAND */
+                  1 0 0x2c000000 0x1000000>;    /* CS1: 16MB for LAN9221 */
 
         ethernet@gpmc {
                 pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi
index 26cce4d18405..29cb804d10cc 100644
--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
+++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
@@ -33,11 +33,12 @@
         hsusb2_phy: hsusb2_phy {
                 compatible = "usb-nop-xceiv";
                 reset-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>; /* gpio_4 */
+                #phy-cells = <0>;
         };
 };
 
 &gpmc {
-        ranges = <0 0 0x00000000 0x1000000>;    /* CS0: 16MB for NAND */
+        ranges = <0 0 0x30000000 0x1000000>;    /* CS0: 16MB for NAND */
 
         nand@0,0 {
                 compatible = "ti,omap2-nand";
@@ -121,7 +122,7 @@
 
 &mmc3 {
         interrupts-extended = <&intc 94 &omap3_pmx_core2 0x46>;
-        pinctrl-0 = <&mmc3_pins>;
+        pinctrl-0 = <&mmc3_pins &wl127x_gpio>;
         pinctrl-names = "default";
         vmmc-supply = <&wl12xx_vmmc>;
         non-removable;
@@ -132,8 +133,8 @@
         wlcore: wlcore@2 {
                 compatible = "ti,wl1273";
                 reg = <2>;
-                interrupt-parent = <&gpio5>;
-                interrupts = <24 IRQ_TYPE_LEVEL_HIGH>; /* gpio 152 */
+                interrupt-parent = <&gpio1>;
+                interrupts = <2 IRQ_TYPE_LEVEL_HIGH>; /* gpio 2 */
                 ref-clock-frequency = <26000000>;
         };
 };
@@ -157,8 +158,6 @@
                         OMAP3_CORE1_IOPAD(0x2166, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat5.sdmmc3_dat1 */
                         OMAP3_CORE1_IOPAD(0x2168, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat6.sdmmc3_dat2 */
                         OMAP3_CORE1_IOPAD(0x216a, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat6.sdmmc3_dat3 */
-                        OMAP3_CORE1_IOPAD(0x2184, PIN_INPUT_PULLUP | MUX_MODE4) /* mcbsp4_clkx.gpio_152 */
-                        OMAP3_CORE1_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4)       /* sys_boot1.gpio_3 */
                         OMAP3_CORE1_IOPAD(0x21d0, PIN_INPUT_PULLUP | MUX_MODE3) /* mcspi1_cs1.sdmmc3_cmd */
                         OMAP3_CORE1_IOPAD(0x21d2, PIN_INPUT_PULLUP | MUX_MODE3) /* mcspi1_cs2.sdmmc_clk */
                 >;
@@ -228,6 +227,12 @@
                         OMAP3_WKUP_IOPAD(0x2a0e, PIN_OUTPUT | MUX_MODE4)        /* sys_boot2.gpio_4 */
                 >;
         };
+        wl127x_gpio: pinmux_wl127x_gpio_pin {
+                pinctrl-single,pins = <
+                        OMAP3_WKUP_IOPAD(0x2a0c, PIN_INPUT | MUX_MODE4)         /* sys_boot0.gpio_2 */
+                        OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4)        /* sys_boot1.gpio_3 */
+                >;
+        };
 };
 
 &omap3_pmx_core2 {
diff --git a/arch/arm/boot/dts/ls1021a-qds.dts b/arch/arm/boot/dts/ls1021a-qds.dts
index 940875316d0f..67b4de0e3439 100644
--- a/arch/arm/boot/dts/ls1021a-qds.dts
+++ b/arch/arm/boot/dts/ls1021a-qds.dts
@@ -215,7 +215,7 @@
                                 reg = <0x2a>;
                                 VDDA-supply = <&reg_3p3v>;
                                 VDDIO-supply = <&reg_3p3v>;
-                                clocks = <&sys_mclk 1>;
+                                clocks = <&sys_mclk>;
                         };
                 };
         };
diff --git a/arch/arm/boot/dts/ls1021a-twr.dts b/arch/arm/boot/dts/ls1021a-twr.dts
index a8b148ad1dd2..44715c8ef756 100644
--- a/arch/arm/boot/dts/ls1021a-twr.dts
+++ b/arch/arm/boot/dts/ls1021a-twr.dts
@@ -187,7 +187,7 @@
                 reg = <0x0a>;
                 VDDA-supply = <&reg_3p3v>;
                 VDDIO-supply = <&reg_3p3v>;
-                clocks = <&sys_mclk 1>;
+                clocks = <&sys_mclk>;
         };
 };
 
diff --git a/arch/arm/boot/dts/meson.dtsi b/arch/arm/boot/dts/meson.dtsi
index 4926133077b3..0d9faf1a51ea 100644
--- a/arch/arm/boot/dts/meson.dtsi
+++ b/arch/arm/boot/dts/meson.dtsi
@@ -85,15 +85,6 @@
                                 reg = <0x7c00 0x200>;
                         };
 
-                        gpio_intc: interrupt-controller@9880 {
-                                compatible = "amlogic,meson-gpio-intc";
-                                reg = <0xc1109880 0x10>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                amlogic,channel-interrupts = <64 65 66 67 68 69 70 71>;
-                                status = "disabled";
-                        };
-
                         hwrng: rng@8100 {
                                 compatible = "amlogic,meson-rng";
                                 reg = <0x8100 0x8>;
@@ -191,6 +182,15 @@
                                 status = "disabled";
                         };
 
+                        gpio_intc: interrupt-controller@9880 {
+                                compatible = "amlogic,meson-gpio-intc";
+                                reg = <0x9880 0x10>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                amlogic,channel-interrupts = <64 65 66 67 68 69 70 71>;
+                                status = "disabled";
+                        };
+
                         wdt: watchdog@9900 {
                                 compatible = "amlogic,meson6-wdt";
                                 reg = <0x9900 0x8>;
diff --git a/arch/arm/boot/dts/nspire.dtsi b/arch/arm/boot/dts/nspire.dtsi
index ec2283b1a638..1a5ae4cd107f 100644
--- a/arch/arm/boot/dts/nspire.dtsi
+++ b/arch/arm/boot/dts/nspire.dtsi
@@ -56,6 +56,7 @@
 
         usb_phy: usb_phy {
                 compatible = "usb-nop-xceiv";
+                #phy-cells = <0>;
         };
 
         vbus_reg: vbus_reg {
diff --git a/arch/arm/boot/dts/omap3-beagle-xm.dts b/arch/arm/boot/dts/omap3-beagle-xm.dts
index 683b96a8f73e..0349fcc9dc26 100644
--- a/arch/arm/boot/dts/omap3-beagle-xm.dts
+++ b/arch/arm/boot/dts/omap3-beagle-xm.dts
@@ -90,6 +90,7 @@
                 compatible = "usb-nop-xceiv";
                 reset-gpios = <&gpio5 19 GPIO_ACTIVE_LOW>; /* gpio_147 */
                 vcc-supply = <&hsusb2_power>;
+                #phy-cells = <0>;
         };
 
         tfp410: encoder0 {
diff --git a/arch/arm/boot/dts/omap3-beagle.dts b/arch/arm/boot/dts/omap3-beagle.dts
index 4d2eaf843fa9..3ca8991a6c3e 100644
--- a/arch/arm/boot/dts/omap3-beagle.dts
+++ b/arch/arm/boot/dts/omap3-beagle.dts
@@ -64,6 +64,7 @@
                 compatible = "usb-nop-xceiv";
                 reset-gpios = <&gpio5 19 GPIO_ACTIVE_LOW>;      /* gpio_147 */
                 vcc-supply = <&hsusb2_power>;
+                #phy-cells = <0>;
         };
 
         sound {
diff --git a/arch/arm/boot/dts/omap3-cm-t3x.dtsi b/arch/arm/boot/dts/omap3-cm-t3x.dtsi
index 31d5ebf38892..ab6003fe5a43 100644
--- a/arch/arm/boot/dts/omap3-cm-t3x.dtsi
+++ b/arch/arm/boot/dts/omap3-cm-t3x.dtsi
@@ -43,12 +43,14 @@
         hsusb1_phy: hsusb1_phy {
                 compatible = "usb-nop-xceiv";
                 vcc-supply = <&hsusb1_power>;
+                #phy-cells = <0>;
         };
 
         /* HS USB Host PHY on PORT 2 */
         hsusb2_phy: hsusb2_phy {
                 compatible = "usb-nop-xceiv";
                 vcc-supply = <&hsusb2_power>;
+                #phy-cells = <0>;
         };
 
         ads7846reg: ads7846-reg {
diff --git a/arch/arm/boot/dts/omap3-evm-common.dtsi b/arch/arm/boot/dts/omap3-evm-common.dtsi
index dbc3f030a16c..ee64191e41ca 100644
--- a/arch/arm/boot/dts/omap3-evm-common.dtsi
+++ b/arch/arm/boot/dts/omap3-evm-common.dtsi
@@ -29,6 +29,7 @@
                 compatible = "usb-nop-xceiv";
                 reset-gpios = <&gpio1 21 GPIO_ACTIVE_LOW>; /* gpio_21 */
                 vcc-supply = <&hsusb2_power>;
+                #phy-cells = <0>;
         };
 
         leds {
diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
index 4504908c23fe..3dc56fb156b7 100644
--- a/arch/arm/boot/dts/omap3-gta04.dtsi
+++ b/arch/arm/boot/dts/omap3-gta04.dtsi
@@ -120,6 +120,7 @@
         hsusb2_phy: hsusb2_phy {
                 compatible = "usb-nop-xceiv";
                 reset-gpios = <&gpio6 14 GPIO_ACTIVE_LOW>;
+                #phy-cells = <0>;
         };
 
         tv0: connector {
diff --git a/arch/arm/boot/dts/omap3-igep0020-common.dtsi b/arch/arm/boot/dts/omap3-igep0020-common.dtsi
index 667f96245729..ecbec23af49f 100644
--- a/arch/arm/boot/dts/omap3-igep0020-common.dtsi
+++ b/arch/arm/boot/dts/omap3-igep0020-common.dtsi
@@ -58,6 +58,7 @@
                 compatible = "usb-nop-xceiv";
                 reset-gpios = <&gpio1 24 GPIO_ACTIVE_LOW>; /* gpio_24 */
                 vcc-supply = <&hsusb1_power>;
+                #phy-cells = <0>;
         };
 
         tfp410: encoder {
diff --git a/arch/arm/boot/dts/omap3-igep0030-common.dtsi b/arch/arm/boot/dts/omap3-igep0030-common.dtsi
index e94d9427450c..443f71707437 100644
--- a/arch/arm/boot/dts/omap3-igep0030-common.dtsi
+++ b/arch/arm/boot/dts/omap3-igep0030-common.dtsi
@@ -37,6 +37,7 @@
         hsusb2_phy: hsusb2_phy {
                 compatible = "usb-nop-xceiv";
                 reset-gpios = <&gpio2 22 GPIO_ACTIVE_LOW>;              /* gpio_54 */
+                #phy-cells = <0>;
         };
 };
 
diff --git a/arch/arm/boot/dts/omap3-lilly-a83x.dtsi b/arch/arm/boot/dts/omap3-lilly-a83x.dtsi
index 343a36d8031d..7ada1e93e166 100644
--- a/arch/arm/boot/dts/omap3-lilly-a83x.dtsi
+++ b/arch/arm/boot/dts/omap3-lilly-a83x.dtsi
@@ -51,6 +51,7 @@
         hsusb1_phy: hsusb1_phy {
                 compatible = "usb-nop-xceiv";
                 vcc-supply = <&reg_vcc3>;
+                #phy-cells = <0>;
         };
 };
 
diff --git a/arch/arm/boot/dts/omap3-overo-base.dtsi b/arch/arm/boot/dts/omap3-overo-base.dtsi
index f25e158e7163..ac141fcd1742 100644
--- a/arch/arm/boot/dts/omap3-overo-base.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-base.dtsi
@@ -51,6 +51,7 @@
                 compatible = "usb-nop-xceiv";
                 reset-gpios = <&gpio6 23 GPIO_ACTIVE_LOW>;      /* gpio_183 */
                 vcc-supply = <&hsusb2_power>;
+                #phy-cells = <0>;
         };
 
         /* Regulator to trigger the nPoweron signal of the Wifi module */
diff --git a/arch/arm/boot/dts/omap3-pandora-common.dtsi b/arch/arm/boot/dts/omap3-pandora-common.dtsi
index 53e007abdc71..cd53dc6c0051 100644
--- a/arch/arm/boot/dts/omap3-pandora-common.dtsi
+++ b/arch/arm/boot/dts/omap3-pandora-common.dtsi
@@ -205,6 +205,7 @@
                 compatible = "usb-nop-xceiv";
                 reset-gpios = <&gpio1 16 GPIO_ACTIVE_LOW>; /* GPIO_16 */
                 vcc-supply = <&vaux2>;
+                #phy-cells = <0>;
         };
 
         /* HS USB Host VBUS supply
diff --git a/arch/arm/boot/dts/omap3-tao3530.dtsi b/arch/arm/boot/dts/omap3-tao3530.dtsi
index 9a601d15247b..6f5bd027b717 100644
--- a/arch/arm/boot/dts/omap3-tao3530.dtsi
+++ b/arch/arm/boot/dts/omap3-tao3530.dtsi
@@ -46,6 +46,7 @@
                 compatible = "usb-nop-xceiv";
                 reset-gpios = <&gpio6 2 GPIO_ACTIVE_LOW>;       /* gpio_162 */
                 vcc-supply = <&hsusb2_power>;
+                #phy-cells = <0>;
         };
 
         sound {
diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
index 90b5c7148feb..bb33935df7b0 100644
--- a/arch/arm/boot/dts/omap3.dtsi
+++ b/arch/arm/boot/dts/omap3.dtsi
@@ -715,6 +715,7 @@
                                 compatible = "ti,ohci-omap3";
                                 reg = <0x48064400 0x400>;
                                 interrupts = <76>;
+                                remote-wakeup-connected;
                         };
 
                         usbhsehci: ehci@48064800 {
diff --git a/arch/arm/boot/dts/omap4-droid4-xt894.dts b/arch/arm/boot/dts/omap4-droid4-xt894.dts
index 8b93d37310f2..24a463f8641f 100644
--- a/arch/arm/boot/dts/omap4-droid4-xt894.dts
+++ b/arch/arm/boot/dts/omap4-droid4-xt894.dts
@@ -73,6 +73,7 @@
         /* HS USB Host PHY on PORT 1 */
         hsusb1_phy: hsusb1_phy {
                 compatible = "usb-nop-xceiv";
+                #phy-cells = <0>;
         };
 
         /* LCD regulator from sw5 source */
diff --git a/arch/arm/boot/dts/omap4-duovero.dtsi b/arch/arm/boot/dts/omap4-duovero.dtsi
index 6e6810c258eb..eb123b24c8e3 100644
--- a/arch/arm/boot/dts/omap4-duovero.dtsi
+++ b/arch/arm/boot/dts/omap4-duovero.dtsi
@@ -43,6 +43,7 @@
         hsusb1_phy: hsusb1_phy {
                 compatible = "usb-nop-xceiv";
                 reset-gpios = <&gpio2 30 GPIO_ACTIVE_LOW>;      /* gpio_62 */
+                #phy-cells = <0>;
 
                 pinctrl-names = "default";
                 pinctrl-0 = <&hsusb1phy_pins>;
diff --git a/arch/arm/boot/dts/omap4-panda-common.dtsi b/arch/arm/boot/dts/omap4-panda-common.dtsi
index 22c1eee9b07a..5501d1b4e6cd 100644
--- a/arch/arm/boot/dts/omap4-panda-common.dtsi
+++ b/arch/arm/boot/dts/omap4-panda-common.dtsi
@@ -89,6 +89,7 @@
         hsusb1_phy: hsusb1_phy {
                 compatible = "usb-nop-xceiv";
                 reset-gpios = <&gpio2 30 GPIO_ACTIVE_LOW>;   /* gpio_62 */
+                #phy-cells = <0>;
                 vcc-supply = <&hsusb1_power>;
                 clocks = <&auxclk3_ck>;
                 clock-names = "main_clk";
diff --git a/arch/arm/boot/dts/omap4-var-som-om44.dtsi b/arch/arm/boot/dts/omap4-var-som-om44.dtsi
index 6500bfc8d130..10fce28ceb5b 100644
--- a/arch/arm/boot/dts/omap4-var-som-om44.dtsi
+++ b/arch/arm/boot/dts/omap4-var-som-om44.dtsi
@@ -44,6 +44,7 @@
 
                 reset-gpios = <&gpio6 17 GPIO_ACTIVE_LOW>; /* gpio 177 */
                 vcc-supply = <&vbat>;
+                #phy-cells = <0>;
 
                 clocks = <&auxclk3_ck>;
                 clock-names = "main_clk";
diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi
index 1dc5a76b3c71..cc1a07a3620f 100644
--- a/arch/arm/boot/dts/omap4.dtsi
+++ b/arch/arm/boot/dts/omap4.dtsi
@@ -398,7 +398,7 @@
                 elm: elm@48078000 {
                         compatible = "ti,am3352-elm";
                         reg = <0x48078000 0x2000>;
-                        interrupts = <4>;
+                        interrupts = <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>;
                         ti,hwmods = "elm";
                         status = "disabled";
                 };
@@ -1081,14 +1081,13 @@
                         usbhsohci: ohci@4a064800 {
                                 compatible = "ti,ohci-omap3";
                                 reg = <0x4a064800 0x400>;
-                                interrupt-parent = <&gic>;
                                 interrupts = <GIC_SPI 76 IRQ_TYPE_LEVEL_HIGH>;
+                                remote-wakeup-connected;
                         };
 
                         usbhsehci: ehci@4a064c00 {
                                 compatible = "ti,ehci-omap";
                                 reg = <0x4a064c00 0x400>;
-                                interrupt-parent = <&gic>;
                                 interrupts = <GIC_SPI 77 IRQ_TYPE_LEVEL_HIGH>;
                         };
                 };
diff --git a/arch/arm/boot/dts/omap5-board-common.dtsi b/arch/arm/boot/dts/omap5-board-common.dtsi
index 575ecffb0e9e..1b20838bb9a4 100644
--- a/arch/arm/boot/dts/omap5-board-common.dtsi
+++ b/arch/arm/boot/dts/omap5-board-common.dtsi
@@ -73,12 +73,14 @@
                 clocks = <&auxclk1_ck>;
                 clock-names = "main_clk";
                 clock-frequency = <19200000>;
+                #phy-cells = <0>;
         };
 
         /* HS USB Host PHY on PORT 3 */
         hsusb3_phy: hsusb3_phy {
                 compatible = "usb-nop-xceiv";
                 reset-gpios = <&gpio3 15 GPIO_ACTIVE_LOW>; /* gpio3_79 ETH_NRESET */
+                #phy-cells = <0>;
         };
 
         tpd12s015: encoder {
diff --git a/arch/arm/boot/dts/omap5-cm-t54.dts b/arch/arm/boot/dts/omap5-cm-t54.dts
index 5b172a04b6f1..5e21fb430a65 100644
--- a/arch/arm/boot/dts/omap5-cm-t54.dts
+++ b/arch/arm/boot/dts/omap5-cm-t54.dts
@@ -63,12 +63,14 @@
         hsusb2_phy: hsusb2_phy {
                 compatible = "usb-nop-xceiv";
                 reset-gpios = <&gpio3 12 GPIO_ACTIVE_LOW>; /* gpio3_76 HUB_RESET */
+                #phy-cells = <0>;
         };
 
         /* HS USB Host PHY on PORT 3 */
         hsusb3_phy: hsusb3_phy {
                 compatible = "usb-nop-xceiv";
                 reset-gpios = <&gpio3 19 GPIO_ACTIVE_LOW>; /* gpio3_83 ETH_RESET */
+                #phy-cells = <0>;
         };
 
         leds {
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index 4cd0005e462f..51a7fb3d7b9a 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -940,6 +940,7 @@
                                 compatible = "ti,ohci-omap3";
                                 reg = <0x4a064800 0x400>;
                                 interrupts = <GIC_SPI 76 IRQ_TYPE_LEVEL_HIGH>;
+                                remote-wakeup-connected;
                         };
 
                         usbhsehci: ehci@4a064c00 {
diff --git a/arch/arm/boot/dts/r8a7790.dtsi b/arch/arm/boot/dts/r8a7790.dtsi
index 2f017fee4009..62baabd757b6 100644
--- a/arch/arm/boot/dts/r8a7790.dtsi
+++ b/arch/arm/boot/dts/r8a7790.dtsi
@@ -1201,6 +1201,7 @@
                 clock-names = "extal", "usb_extal";
                 #clock-cells = <2>;
                 #power-domain-cells = <0>;
+                #reset-cells = <1>;
         };
 
         prr: chipid@ff000044 {
diff --git a/arch/arm/boot/dts/r8a7792.dtsi b/arch/arm/boot/dts/r8a7792.dtsi
index 131f65b0426e..3d080e07374c 100644
--- a/arch/arm/boot/dts/r8a7792.dtsi
+++ b/arch/arm/boot/dts/r8a7792.dtsi
@@ -829,6 +829,7 @@
                         clock-names = "extal";
                         #clock-cells = <2>;
                         #power-domain-cells = <0>;
+                        #reset-cells = <1>;
                 };
         };
 
diff --git a/arch/arm/boot/dts/r8a7793.dtsi b/arch/arm/boot/dts/r8a7793.dtsi
index 58eae569b4e0..0cd1035de1a4 100644
--- a/arch/arm/boot/dts/r8a7793.dtsi
+++ b/arch/arm/boot/dts/r8a7793.dtsi
@@ -1088,6 +1088,7 @@
                 clock-names = "extal", "usb_extal";
                 #clock-cells = <2>;
                 #power-domain-cells = <0>;
+                #reset-cells = <1>;
         };
 
         rst: reset-controller@e6160000 {
diff --git a/arch/arm/boot/dts/r8a7794.dtsi b/arch/arm/boot/dts/r8a7794.dtsi
index 905e50c9b524..5643976c1356 100644
--- a/arch/arm/boot/dts/r8a7794.dtsi
+++ b/arch/arm/boot/dts/r8a7794.dtsi
@@ -1099,6 +1099,7 @@
                 clock-names = "extal", "usb_extal";
                 #clock-cells = <2>;
                 #power-domain-cells = <0>;
+                #reset-cells = <1>;
         };
 
         rst: reset-controller@e6160000 {
diff --git a/arch/arm/boot/dts/rk3066a-marsboard.dts b/arch/arm/boot/dts/rk3066a-marsboard.dts
index c6d92c25df42..d23ee6d911ac 100644
--- a/arch/arm/boot/dts/rk3066a-marsboard.dts
+++ b/arch/arm/boot/dts/rk3066a-marsboard.dts
@@ -83,6 +83,10 @@
         };
 };
 
+&cpu0 {
+        cpu0-supply = <&vdd_arm>;
+};
+
 &i2c1 {
         status = "okay";
         clock-frequency = <400000>;
diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
index cd24894ee5c6..6102e4e7f35c 100644
--- a/arch/arm/boot/dts/rk3288.dtsi
+++ b/arch/arm/boot/dts/rk3288.dtsi
@@ -956,7 +956,7 @@
         iep_mmu: iommu@ff900800 {
                 compatible = "rockchip,iommu";
                 reg = <0x0 0xff900800 0x0 0x40>;
-                interrupts = <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH 0>;
+                interrupts = <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>;
                 interrupt-names = "iep_mmu";
                 #iommu-cells = <0>;
                 status = "disabled";
diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
index b91300d49a31..4f2f2eea0755 100644
--- a/arch/arm/boot/dts/sun4i-a10.dtsi
+++ b/arch/arm/boot/dts/sun4i-a10.dtsi
@@ -502,8 +502,8 @@
                         reg = <0x01c16000 0x1000>;
                         interrupts = <58>;
                         clocks = <&ccu CLK_AHB_HDMI0>, <&ccu CLK_HDMI>,
-                                 <&ccu 9>,
-                                 <&ccu 18>;
+                                 <&ccu CLK_PLL_VIDEO0_2X>,
+                                 <&ccu CLK_PLL_VIDEO1_2X>;
                         clock-names = "ahb", "mod", "pll-0", "pll-1";
                         dmas = <&dma SUN4I_DMA_NORMAL 16>,
                                <&dma SUN4I_DMA_NORMAL 16>,
@@ -1104,7 +1104,7 @@
 
                                         be1_out_tcon0: endpoint@0 {
                                                 reg = <0>;
-                                                remote-endpoint = <&tcon1_in_be0>;
+                                                remote-endpoint = <&tcon0_in_be1>;
                                         };
 
                                         be1_out_tcon1: endpoint@1 {
diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi
index 6ae4d95e230e..316cb8b2945b 100644
--- a/arch/arm/boot/dts/sun5i-a10s.dtsi
+++ b/arch/arm/boot/dts/sun5i-a10s.dtsi
@@ -82,8 +82,8 @@
                         reg = <0x01c16000 0x1000>;
                         interrupts = <58>;
                         clocks = <&ccu CLK_AHB_HDMI>, <&ccu CLK_HDMI>,
-                                 <&ccu 9>,
-                                 <&ccu 16>;
+                                 <&ccu CLK_PLL_VIDEO0_2X>,
+                                 <&ccu CLK_PLL_VIDEO1_2X>;
                         clock-names = "ahb", "mod", "pll-0", "pll-1";
                         dmas = <&dma SUN4I_DMA_NORMAL 16>,
                                <&dma SUN4I_DMA_NORMAL 16>,
diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi
index 8bfa12b548e0..72d3fe44ecaf 100644
--- a/arch/arm/boot/dts/sun6i-a31.dtsi
+++ b/arch/arm/boot/dts/sun6i-a31.dtsi
@@ -429,8 +429,8 @@
                         interrupts = <GIC_SPI 88 IRQ_TYPE_LEVEL_HIGH>;
                         clocks = <&ccu CLK_AHB1_HDMI>, <&ccu CLK_HDMI>,
                                  <&ccu CLK_HDMI_DDC>,
-                                 <&ccu 7>,
-                                 <&ccu 13>;
+                                 <&ccu CLK_PLL_VIDEO0_2X>,
+                                 <&ccu CLK_PLL_VIDEO1_2X>;
                         clock-names = "ahb", "mod", "ddc", "pll-0", "pll-1";
                         resets = <&ccu RST_AHB1_HDMI>;
                         reset-names = "ahb";
diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
index 68dfa82544fc..bd0cd3204273 100644
--- a/arch/arm/boot/dts/sun7i-a20.dtsi
+++ b/arch/arm/boot/dts/sun7i-a20.dtsi
@@ -581,8 +581,8 @@
                         reg = <0x01c16000 0x1000>;
                         interrupts = <GIC_SPI 58 IRQ_TYPE_LEVEL_HIGH>;
                         clocks = <&ccu CLK_AHB_HDMI0>, <&ccu CLK_HDMI>,
-                                 <&ccu 9>,
-                                 <&ccu 18>;
+                                 <&ccu CLK_PLL_VIDEO0_2X>,
+                                 <&ccu CLK_PLL_VIDEO1_2X>;
                         clock-names = "ahb", "mod", "pll-0", "pll-1";
                         dmas = <&dma SUN4I_DMA_NORMAL 16>,
                                <&dma SUN4I_DMA_NORMAL 16>,
@@ -1354,7 +1354,7 @@
 
                                         be1_out_tcon0: endpoint@0 {
                                                 reg = <0>;
-                                                remote-endpoint = <&tcon1_in_be0>;
+                                                remote-endpoint = <&tcon0_in_be1>;
                                         };
 
                                         be1_out_tcon1: endpoint@1 {
diff --git a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
index 98715538932f..a021ee6da396 100644
--- a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
+++ b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
@@ -146,6 +146,7 @@
         status = "okay";
 
         axp81x: pmic@3a3 {
+                compatible = "x-powers,axp813";
                 reg = <0x3a3>;
                 interrupt-parent = <&r_intc>;
                 interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
diff --git a/arch/arm/boot/dts/tango4-common.dtsi b/arch/arm/boot/dts/tango4-common.dtsi
index 0ec1b0a317b4..ff72a8efb73d 100644
--- a/arch/arm/boot/dts/tango4-common.dtsi
+++ b/arch/arm/boot/dts/tango4-common.dtsi
@@ -156,7 +156,6 @@
                         reg = <0x6e000 0x400>;
                         ranges = <0 0x6e000 0x400>;
                         interrupt-parent = <&gic>;
-                        interrupt-controller;
                         #address-cells = <1>;
                         #size-cells = <1>;
 
diff --git a/arch/arm/boot/dts/vf610-zii-dev-rev-c.dts b/arch/arm/boot/dts/vf610-zii-dev-rev-c.dts
index 02a6227c717c..4b8edc8982cf 100644
--- a/arch/arm/boot/dts/vf610-zii-dev-rev-c.dts
+++ b/arch/arm/boot/dts/vf610-zii-dev-rev-c.dts
@@ -121,7 +121,7 @@
                                         switch0port10: port@10 {
                                                 reg = <10>;
                                                 label = "dsa";
-                                                phy-mode = "xgmii";
+                                                phy-mode = "xaui";
                                                 link = <&switch1port10>;
                                         };
                                 };
@@ -208,7 +208,7 @@
                                         switch1port10: port@10 {
                                                 reg = <10>;
                                                 label = "dsa";
-                                                phy-mode = "xgmii";
+                                                phy-mode = "xaui";
                                                 link = <&switch0port10>;
                                         };
                                 };
@@ -359,7 +359,7 @@
 };
 
 &i2c1 {
-        at24mac602@0 {
+        at24mac602@50 {
                 compatible = "atmel,24c02";
                 reg = <0x50>;
                 read-only;
diff --git a/arch/arm/configs/sunxi_defconfig b/arch/arm/configs/sunxi_defconfig
index 5caaf971fb50..df433abfcb02 100644
--- a/arch/arm/configs/sunxi_defconfig
+++ b/arch/arm/configs/sunxi_defconfig
@@ -10,6 +10,7 @@ CONFIG_SMP=y
 CONFIG_NR_CPUS=8
 CONFIG_AEABI=y
 CONFIG_HIGHMEM=y
+CONFIG_CMA=y
 CONFIG_ARM_APPENDED_DTB=y
 CONFIG_ARM_ATAG_DTB_COMPAT=y
 CONFIG_CPU_FREQ=y
@@ -33,6 +34,7 @@ CONFIG_CAN_SUN4I=y
 # CONFIG_WIRELESS is not set
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_DMA_CMA=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_ATA=y
 CONFIG_AHCI_SUNXI=y
diff --git a/arch/arm/include/asm/kvm_arm.h b/arch/arm/include/asm/kvm_arm.h
index c8781450905b..3ab8b3781bfe 100644
--- a/arch/arm/include/asm/kvm_arm.h
+++ b/arch/arm/include/asm/kvm_arm.h
@@ -161,8 +161,7 @@
 #else
 #define VTTBR_X         (5 - KVM_T0SZ)
 #endif
-#define VTTBR_BADDR_SHIFT (VTTBR_X - 1)
-#define VTTBR_BADDR_MASK  (((_AC(1, ULL) << (40 - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT)
+#define VTTBR_BADDR_MASK  (((_AC(1, ULL) << (40 - VTTBR_X)) - 1) << VTTBR_X)
 #define VTTBR_VMID_SHIFT  _AC(48, ULL)
 #define VTTBR_VMID_MASK(size)   (_AT(u64, (1 << size) - 1) << VTTBR_VMID_SHIFT)
 
diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
index 242151ea6908..a9f7d3f47134 100644
--- a/arch/arm/include/asm/kvm_host.h
+++ b/arch/arm/include/asm/kvm_host.h
@@ -285,6 +285,11 @@ static inline void kvm_arm_init_debug(void) {}
 static inline void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) {}
 static inline void kvm_arm_clear_debug(struct kvm_vcpu *vcpu) {}
 static inline void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu) {}
+static inline bool kvm_arm_handle_step_debug(struct kvm_vcpu *vcpu,
+                                             struct kvm_run *run)
+{
+        return false;
+}
 
 int kvm_arm_vcpu_arch_set_attr(struct kvm_vcpu *vcpu,
                                struct kvm_device_attr *attr);
diff --git a/arch/arm/include/uapi/asm/Kbuild b/arch/arm/include/uapi/asm/Kbuild
index 4d53de308ee0..4d1cc1847edf 100644
--- a/arch/arm/include/uapi/asm/Kbuild
+++ b/arch/arm/include/uapi/asm/Kbuild
@@ -7,6 +7,7 @@ generated-y += unistd-oabi.h
 generated-y += unistd-eabi.h
 
 generic-y += bitsperlong.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += ioctl.h
 generic-y += ipcbuf.h
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 5cf04888c581..3e26c6f7a191 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -793,7 +793,6 @@ void abort(void)
         /* if that doesn't kill us, halt */
         panic("Oops failed to kill thread");
 }
-EXPORT_SYMBOL(abort);
 
 void __init trap_init(void)
 {
diff --git a/arch/arm/lib/csumpartialcopyuser.S b/arch/arm/lib/csumpartialcopyuser.S
index 1712f132b80d..b83fdc06286a 100644
--- a/arch/arm/lib/csumpartialcopyuser.S
+++ b/arch/arm/lib/csumpartialcopyuser.S
@@ -85,7 +85,11 @@
                 .pushsection .text.fixup,"ax"
                 .align  4
 9001:           mov     r4, #-EFAULT
+#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+                ldr     r5, [sp, #9*4]          @ *err_ptr
+#else
                 ldr     r5, [sp, #8*4]          @ *err_ptr
+#endif
                 str     r4, [r5]
                 ldmia   sp, {r1, r2}            @ retrieve dst, len
                 add     r2, r2, r1
diff --git a/arch/arm/mach-davinci/dm365.c b/arch/arm/mach-davinci/dm365.c
index 8be04ec95adf..5ace9380626a 100644
--- a/arch/arm/mach-davinci/dm365.c
+++ b/arch/arm/mach-davinci/dm365.c
@@ -868,10 +868,10 @@ static const struct dma_slave_map dm365_edma_map[] = {
         { "spi_davinci.0", "rx", EDMA_FILTER_PARAM(0, 17) },
         { "spi_davinci.3", "tx", EDMA_FILTER_PARAM(0, 18) },
         { "spi_davinci.3", "rx", EDMA_FILTER_PARAM(0, 19) },
-        { "dm6441-mmc.0", "rx", EDMA_FILTER_PARAM(0, 26) },
-        { "dm6441-mmc.0", "tx", EDMA_FILTER_PARAM(0, 27) },
-        { "dm6441-mmc.1", "rx", EDMA_FILTER_PARAM(0, 30) },
-        { "dm6441-mmc.1", "tx", EDMA_FILTER_PARAM(0, 31) },
+        { "da830-mmc.0", "rx", EDMA_FILTER_PARAM(0, 26) },
+        { "da830-mmc.0", "tx", EDMA_FILTER_PARAM(0, 27) },
+        { "da830-mmc.1", "rx", EDMA_FILTER_PARAM(0, 30) },
+        { "da830-mmc.1", "tx", EDMA_FILTER_PARAM(0, 31) },
 };
 
 static struct edma_soc_info dm365_edma_pdata = {
@@ -925,12 +925,14 @@ static struct resource edma_resources[] = {
         /* not using TC*_ERR */
 };
 
-static struct platform_device dm365_edma_device = {
-        .name                   = "edma",
-        .id                     = 0,
-        .dev.platform_data      = &dm365_edma_pdata,
-        .num_resources          = ARRAY_SIZE(edma_resources),
-        .resource               = edma_resources,
+static const struct platform_device_info dm365_edma_device __initconst = {
+        .name           = "edma",
+        .id             = 0,
+        .dma_mask       = DMA_BIT_MASK(32),
+        .res            = edma_resources,
+        .num_res        = ARRAY_SIZE(edma_resources),
+        .data           = &dm365_edma_pdata,
+        .size_data      = sizeof(dm365_edma_pdata),
 };
 
 static struct resource dm365_asp_resources[] = {
@@ -1428,13 +1430,18 @@ int __init dm365_init_video(struct vpfe_config *vpfe_cfg,
 
 static int __init dm365_init_devices(void)
 {
+        struct platform_device *edma_pdev;
         int ret = 0;
 
         if (!cpu_is_davinci_dm365())
                 return 0;
 
         davinci_cfg_reg(DM365_INT_EDMA_CC);
-        platform_device_register(&dm365_edma_device);
+        edma_pdev = platform_device_register_full(&dm365_edma_device);
+        if (IS_ERR(edma_pdev)) {
+                pr_warn("%s: Failed to register eDMA\n", __func__);
+                return PTR_ERR(edma_pdev);
+        }
 
         platform_device_register(&dm365_mdio_device);
         platform_device_register(&dm365_emac_device);
diff --git a/arch/arm/mach-meson/platsmp.c b/arch/arm/mach-meson/platsmp.c
index 2555f9056a33..cad7ee8f0d6b 100644
--- a/arch/arm/mach-meson/platsmp.c
+++ b/arch/arm/mach-meson/platsmp.c
@@ -102,7 +102,7 @@ static void __init meson_smp_prepare_cpus(const char *scu_compatible,
 
         scu_base = of_iomap(node, 0);
         if (!scu_base) {
-                pr_err("Couln't map SCU registers\n");
+                pr_err("Couldn't map SCU registers\n");
                 return;
         }
 
diff --git a/arch/arm/mach-omap2/cm_common.c b/arch/arm/mach-omap2/cm_common.c
index d555791cf349..83c6fa74cc31 100644
--- a/arch/arm/mach-omap2/cm_common.c
+++ b/arch/arm/mach-omap2/cm_common.c
@@ -68,14 +68,17 @@ void __init omap2_set_globals_cm(void __iomem *cm, void __iomem *cm2)
 int cm_split_idlest_reg(struct clk_omap_reg *idlest_reg, s16 *prcm_inst,
                         u8 *idlest_reg_id)
 {
+        int ret;
         if (!cm_ll_data->split_idlest_reg) {
                 WARN_ONCE(1, "cm: %s: no low-level function defined\n",
                           __func__);
                 return -EINVAL;
         }
 
-        return cm_ll_data->split_idlest_reg(idlest_reg, prcm_inst,
+        ret = cm_ll_data->split_idlest_reg(idlest_reg, prcm_inst,
                                            idlest_reg_id);
+        *prcm_inst -= cm_base.offset;
+        return ret;
 }
 
 /**
@@ -337,6 +340,7 @@ int __init omap2_cm_base_init(void)
                 if (mem) {
                         mem->pa = res.start + data->offset;
                         mem->va = data->mem + data->offset;
+                        mem->offset = data->offset;
                 }
 
                 data->np = np;
diff --git a/arch/arm/mach-omap2/omap-secure.c b/arch/arm/mach-omap2/omap-secure.c
index 5ac122e88f67..fa7f308c9027 100644
--- a/arch/arm/mach-omap2/omap-secure.c
+++ b/arch/arm/mach-omap2/omap-secure.c
@@ -73,6 +73,27 @@ phys_addr_t omap_secure_ram_mempool_base(void)
         return omap_secure_memblock_base;
 }
 
+#if defined(CONFIG_ARCH_OMAP3) && defined(CONFIG_PM)
+u32 omap3_save_secure_ram(void __iomem *addr, int size)
+{
+        u32 ret;
+        u32 param[5];
+
+        if (size != OMAP3_SAVE_SECURE_RAM_SZ)
+                return OMAP3_SAVE_SECURE_RAM_SZ;
+
+        param[0] = 4;           /* Number of arguments */
+        param[1] = __pa(addr);  /* Physical address for saving */
+        param[2] = 0;
+        param[3] = 1;
+        param[4] = 1;
+
+        ret = save_secure_ram_context(__pa(param));
+
+        return ret;
+}
+#endif
+
 /**
  * rx51_secure_dispatcher: Routine to dispatch secure PPA API calls
  * @idx: The PPA API index
diff --git a/arch/arm/mach-omap2/omap-secure.h b/arch/arm/mach-omap2/omap-secure.h
index bae263fba640..c509cde71f93 100644
--- a/arch/arm/mach-omap2/omap-secure.h
+++ b/arch/arm/mach-omap2/omap-secure.h
@@ -31,6 +31,8 @@
 /* Maximum Secure memory storage size */
 #define OMAP_SECURE_RAM_STORAGE (88 * SZ_1K)
 
+#define OMAP3_SAVE_SECURE_RAM_SZ        0x803F
+
 /* Secure low power HAL API index */
 #define OMAP4_HAL_SAVESECURERAM_INDEX   0x1a
 #define OMAP4_HAL_SAVEHW_INDEX          0x1b
@@ -65,6 +67,8 @@ extern u32 omap_smc2(u32 id, u32 falg, u32 pargs);
 extern u32 omap_smc3(u32 id, u32 process, u32 flag, u32 pargs);
 extern phys_addr_t omap_secure_ram_mempool_base(void);
 extern int omap_secure_ram_reserve_memblock(void);
+extern u32 save_secure_ram_context(u32 args_pa);
+extern u32 omap3_save_secure_ram(void __iomem *save_regs, int size);
 
 extern u32 rx51_secure_dispatcher(u32 idx, u32 process, u32 flag, u32 nargs,
                                   u32 arg1, u32 arg2, u32 arg3, u32 arg4);
diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
index d45cbfdb4be6..f0388058b7da 100644
--- a/arch/arm/mach-omap2/omap_device.c
+++ b/arch/arm/mach-omap2/omap_device.c
@@ -391,10 +391,8 @@ omap_device_copy_resources(struct omap_hwmod *oh,
         const char *name;
         int error, irq = 0;
 
-        if (!oh || !oh->od || !oh->od->pdev) {
-                error = -EINVAL;
-                goto error;
-        }
+        if (!oh || !oh->od || !oh->od->pdev)
+                return -EINVAL;
 
         np = oh->od->pdev->dev.of_node;
         if (!np) {
@@ -516,8 +514,10 @@ struct platform_device __init *omap_device_build(const char *pdev_name,
                 goto odbs_exit1;
 
         od = omap_device_alloc(pdev, &oh, 1);
-        if (IS_ERR(od))
+        if (IS_ERR(od)) {
+                ret = PTR_ERR(od);
                 goto odbs_exit1;
+        }
 
         ret = platform_device_add_data(pdev, pdata, pdata_len);
         if (ret)
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index d2106ae4410a..52c9d585b44d 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -1646,6 +1646,7 @@ static struct omap_hwmod omap3xxx_mmc3_hwmod = {
         .main_clk       = "mmchs3_fck",
         .prcm           = {
                 .omap2 = {
+                        .module_offs = CORE_MOD,
                         .prcm_reg_id = 1,
                         .module_bit = OMAP3430_EN_MMC3_SHIFT,
                         .idlest_reg_id = 1,
diff --git a/arch/arm/mach-omap2/pm.h b/arch/arm/mach-omap2/pm.h
index b668719b9b25..8e30772cfe32 100644
--- a/arch/arm/mach-omap2/pm.h
+++ b/arch/arm/mach-omap2/pm.h
@@ -81,10 +81,6 @@ extern unsigned int omap3_do_wfi_sz;
 /* ... and its pointer from SRAM after copy */
 extern void (*omap3_do_wfi_sram)(void);
 
-/* save_secure_ram_context function pointer and size, for copy to SRAM */
-extern int save_secure_ram_context(u32 *addr);
-extern unsigned int save_secure_ram_context_sz;
-
 extern void omap3_save_scratchpad_contents(void);
 
 #define PM_RTA_ERRATUM_i608             (1 << 0)
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index 841ba19d64a6..36c55547137c 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -48,6 +48,7 @@
 #include "prm3xxx.h"
 #include "pm.h"
 #include "sdrc.h"
+#include "omap-secure.h"
 #include "sram.h"
 #include "control.h"
 #include "vc.h"
@@ -66,7 +67,6 @@ struct power_state {
 
 static LIST_HEAD(pwrst_list);
 
-static int (*_omap_save_secure_sram)(u32 *addr);
 void (*omap3_do_wfi_sram)(void);
 
 static struct powerdomain *mpu_pwrdm, *neon_pwrdm;
@@ -121,8 +121,8 @@ static void omap3_save_secure_ram_context(void)
                  * will hang the system.
                  */
                 pwrdm_set_next_pwrst(mpu_pwrdm, PWRDM_POWER_ON);
-                ret = _omap_save_secure_sram((u32 *)(unsigned long)
-                                __pa(omap3_secure_ram_storage));
+                ret = omap3_save_secure_ram(omap3_secure_ram_storage,
+                                            OMAP3_SAVE_SECURE_RAM_SZ);
                 pwrdm_set_next_pwrst(mpu_pwrdm, mpu_next_state);
                 /* Following is for error tracking, it should not happen */
                 if (ret) {
@@ -434,15 +434,10 @@ static int __init pwrdms_setup(struct powerdomain *pwrdm, void *unused)
  *
  * The minimum set of functions is pushed to SRAM for execution:
  * - omap3_do_wfi for erratum i581 WA,
- * - save_secure_ram_context for security extensions.
  */
 void omap_push_sram_idle(void)
 {
         omap3_do_wfi_sram = omap_sram_push(omap3_do_wfi, omap3_do_wfi_sz);
-
-        if (omap_type() != OMAP2_DEVICE_TYPE_GP)
-                _omap_save_secure_sram = omap_sram_push(save_secure_ram_context,
-                                save_secure_ram_context_sz);
 }
 
 static void __init pm_errata_configure(void)
@@ -553,7 +548,7 @@ int __init omap3_pm_init(void)
         clkdm_add_wkdep(neon_clkdm, mpu_clkdm);
         if (omap_type() != OMAP2_DEVICE_TYPE_GP) {
                 omap3_secure_ram_storage =
-                        kmalloc(0x803F, GFP_KERNEL);
+                        kmalloc(OMAP3_SAVE_SECURE_RAM_SZ, GFP_KERNEL);
                 if (!omap3_secure_ram_storage)
                         pr_err("Memory allocation failed when allocating for secure sram context\n");
 
diff --git a/arch/arm/mach-omap2/prcm-common.h b/arch/arm/mach-omap2/prcm-common.h
index 0592b23902c6..0977da0dab76 100644
--- a/arch/arm/mach-omap2/prcm-common.h
+++ b/arch/arm/mach-omap2/prcm-common.h
@@ -528,6 +528,7 @@ struct omap_prcm_irq_setup {
 struct omap_domain_base {
         u32 pa;
         void __iomem *va;
+        s16 offset;
 };
 
 /**
diff --git a/arch/arm/mach-omap2/prm33xx.c b/arch/arm/mach-omap2/prm33xx.c
index d2c5bcabdbeb..ebaf80d72a10 100644
--- a/arch/arm/mach-omap2/prm33xx.c
+++ b/arch/arm/mach-omap2/prm33xx.c
@@ -176,17 +176,6 @@ static int am33xx_pwrdm_read_pwrst(struct powerdomain *pwrdm)
         return v;
 }
 
-static int am33xx_pwrdm_read_prev_pwrst(struct powerdomain *pwrdm)
-{
-        u32 v;
-
-        v = am33xx_prm_read_reg(pwrdm->prcm_offs, pwrdm->pwrstst_offs);
-        v &= AM33XX_LASTPOWERSTATEENTERED_MASK;
-        v >>= AM33XX_LASTPOWERSTATEENTERED_SHIFT;
-
-        return v;
-}
-
 static int am33xx_pwrdm_set_lowpwrstchange(struct powerdomain *pwrdm)
 {
         am33xx_prm_rmw_reg_bits(AM33XX_LOWPOWERSTATECHANGE_MASK,
@@ -357,7 +346,6 @@ struct pwrdm_ops am33xx_pwrdm_operations = {
         .pwrdm_set_next_pwrst           = am33xx_pwrdm_set_next_pwrst,
         .pwrdm_read_next_pwrst          = am33xx_pwrdm_read_next_pwrst,
         .pwrdm_read_pwrst               = am33xx_pwrdm_read_pwrst,
-        .pwrdm_read_prev_pwrst          = am33xx_pwrdm_read_prev_pwrst,
         .pwrdm_set_logic_retst          = am33xx_pwrdm_set_logic_retst,
         .pwrdm_read_logic_pwrst         = am33xx_pwrdm_read_logic_pwrst,
         .pwrdm_read_logic_retst         = am33xx_pwrdm_read_logic_retst,
diff --git a/arch/arm/mach-omap2/sleep34xx.S b/arch/arm/mach-omap2/sleep34xx.S
index fa5fd24f524c..22daf4efed68 100644
--- a/arch/arm/mach-omap2/sleep34xx.S
+++ b/arch/arm/mach-omap2/sleep34xx.S
@@ -93,20 +93,13 @@ ENTRY(enable_omap3630_toggle_l2_on_restore)
 ENDPROC(enable_omap3630_toggle_l2_on_restore)
 
 /*
- * Function to call rom code to save secure ram context. This gets
- * relocated to SRAM, so it can be all in .data section. Otherwise
- * we need to initialize api_params separately.
+ * Function to call rom code to save secure ram context.
+ *
+ * r0 = physical address of the parameters
  */
-        .data
-        .align  3
 ENTRY(save_secure_ram_context)
         stmfd   sp!, {r4 - r11, lr}     @ save registers on stack
-        adr     r3, api_params          @ r3 points to parameters
-        str     r0, [r3,#0x4]           @ r0 has sdram address
-        ldr     r12, high_mask
-        and     r3, r3, r12
-        ldr     r12, sram_phy_addr_mask
-        orr     r3, r3, r12
+        mov     r3, r0                  @ physical address of parameters
         mov     r0, #25                 @ set service ID for PPA
         mov     r12, r0                 @ copy secure service ID in r12
         mov     r1, #0                  @ set task id for ROM code in r1
@@ -120,18 +113,7 @@ ENTRY(save_secure_ram_context)
         nop
         nop
         ldmfd   sp!, {r4 - r11, pc}
-        .align
-sram_phy_addr_mask:
-        .word   SRAM_BASE_P
-high_mask:
-        .word   0xffff
-api_params:
-        .word   0x4, 0x0, 0x0, 0x1, 0x1
 ENDPROC(save_secure_ram_context)
-ENTRY(save_secure_ram_context_sz)
-        .word   . - save_secure_ram_context
-
-        .text
 
 /*
  * ======================
diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index c199990e12b6..323a4df59a6c 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -27,14 +27,58 @@
 
 int bpf_jit_enable __read_mostly;
 
+/*
+ * eBPF prog stack layout:
+ *
+ *                         high
+ * original ARM_SP =>     +-----+
+ *                        |     | callee saved registers
+ *                        +-----+ <= (BPF_FP + SCRATCH_SIZE)
+ *                        | ... | eBPF JIT scratch space
+ * eBPF fp register =>    +-----+
+ *   (BPF_FP)             | ... | eBPF prog stack
+ *                        +-----+
+ *                        |RSVD | JIT scratchpad
+ * current ARM_SP =>      +-----+ <= (BPF_FP - STACK_SIZE + SCRATCH_SIZE)
+ *                        |     |
+ *                        | ... | Function call stack
+ *                        |     |
+ *                        +-----+
+ *                          low
+ *
+ * The callee saved registers depends on whether frame pointers are enabled.
+ * With frame pointers (to be compliant with the ABI):
+ *
+ *                                high
+ * original ARM_SP =>     +------------------+ \
+ *                        |        pc        | |
+ * current ARM_FP =>      +------------------+ } callee saved registers
+ *                        |r4-r8,r10,fp,ip,lr| |
+ *                        +------------------+ /
+ *                                low
+ *
+ * Without frame pointers:
+ *
+ *                                high
+ * original ARM_SP =>     +------------------+
+ *                        | r4-r8,r10,fp,lr  | callee saved registers
+ * current ARM_FP =>      +------------------+
+ *                                low
+ *
+ * When popping registers off the stack at the end of a BPF function, we
+ * reference them via the current ARM_FP register.
+ */
+#define CALLEE_MASK     (1 << ARM_R4 | 1 << ARM_R5 | 1 << ARM_R6 | \
+                         1 << ARM_R7 | 1 << ARM_R8 | 1 << ARM_R10 | \
+                         1 << ARM_FP)
+#define CALLEE_PUSH_MASK (CALLEE_MASK | 1 << ARM_LR)
+#define CALLEE_POP_MASK  (CALLEE_MASK | 1 << ARM_PC)
+
 #define STACK_OFFSET(k) (k)
 #define TMP_REG_1       (MAX_BPF_JIT_REG + 0)   /* TEMP Register 1 */
 #define TMP_REG_2       (MAX_BPF_JIT_REG + 1)   /* TEMP Register 2 */
 #define TCALL_CNT       (MAX_BPF_JIT_REG + 2)   /* Tail Call Count */
 
-/* Flags used for JIT optimization */
-#define SEEN_CALL       (1 << 0)
-
 #define FLAG_IMM_OVERFLOW       (1 << 0)
 
 /*
@@ -95,7 +139,6 @@ static const u8 bpf2a32[][2] = {
  * idx                  :       index of current last JITed instruction.
  * prologue_bytes       :       bytes used in prologue.
  * epilogue_offset      :       offset of epilogue starting.
- * seen                 :       bit mask used for JIT optimization.
  * offsets              :       array of eBPF instruction offsets in
  *                              JITed code.
  * target               :       final JITed code.
@@ -110,7 +153,6 @@ struct jit_ctx {
         unsigned int idx;
         unsigned int prologue_bytes;
         unsigned int epilogue_offset;
-        u32 seen;
         u32 flags;
         u32 *offsets;
         u32 *target;
@@ -179,8 +221,13 @@ static void jit_fill_hole(void *area, unsigned int size)
                 *ptr++ = __opcode_to_mem_arm(ARM_INST_UDF);
 }
 
-/* Stack must be multiples of 16 Bytes */
-#define STACK_ALIGN(sz) (((sz) + 3) & ~3)
+#if defined(CONFIG_AEABI) && (__LINUX_ARM_ARCH__ >= 5)
+/* EABI requires the stack to be aligned to 64-bit boundaries */
+#define STACK_ALIGNMENT 8
+#else
+/* Stack must be aligned to 32-bit boundaries */
+#define STACK_ALIGNMENT 4
+#endif
 
 /* Stack space for BPF_REG_2, BPF_REG_3, BPF_REG_4,
  * BPF_REG_5, BPF_REG_7, BPF_REG_8, BPF_REG_9,
@@ -194,7 +241,7 @@ static void jit_fill_hole(void *area, unsigned int size)
          + SCRATCH_SIZE + \
          + 4 /* extra for skb_copy_bits buffer */)
 
-#define STACK_SIZE STACK_ALIGN(_STACK_SIZE)
+#define STACK_SIZE ALIGN(_STACK_SIZE, STACK_ALIGNMENT)
 
 /* Get the offset of eBPF REGISTERs stored on scratch space. */
 #define STACK_VAR(off) (STACK_SIZE-off-4)
@@ -285,16 +332,19 @@ static inline void emit_mov_i(const u8 rd, u32 val, struct jit_ctx *ctx)
                 emit_mov_i_no8m(rd, val, ctx);
 }
 
-static inline void emit_blx_r(u8 tgt_reg, struct jit_ctx *ctx)
+static void emit_bx_r(u8 tgt_reg, struct jit_ctx *ctx)
 {
-        ctx->seen |= SEEN_CALL;
-#if __LINUX_ARM_ARCH__ < 5
-        emit(ARM_MOV_R(ARM_LR, ARM_PC), ctx);
-
         if (elf_hwcap & HWCAP_THUMB)
                 emit(ARM_BX(tgt_reg), ctx);
         else
                 emit(ARM_MOV_R(ARM_PC, tgt_reg), ctx);
+}
+
+static inline void emit_blx_r(u8 tgt_reg, struct jit_ctx *ctx)
+{
+#if __LINUX_ARM_ARCH__ < 5
+        emit(ARM_MOV_R(ARM_LR, ARM_PC), ctx);
+        emit_bx_r(tgt_reg, ctx);
 #else
         emit(ARM_BLX_R(tgt_reg), ctx);
 #endif
@@ -354,7 +404,6 @@ static inline void emit_udivmod(u8 rd, u8 rm, u8 rn, struct jit_ctx *ctx, u8 op)
         }
 
         /* Call appropriate function */
-        ctx->seen |= SEEN_CALL;
         emit_mov_i(ARM_IP, op == BPF_DIV ?
                    (u32)jit_udiv32 : (u32)jit_mod32, ctx);
         emit_blx_r(ARM_IP, ctx);
@@ -620,8 +669,6 @@ static inline void emit_a32_lsh_r64(const u8 dst[], const u8 src[], bool dstk,
         /* Do LSH operation */
         emit(ARM_SUB_I(ARM_IP, rt, 32), ctx);
         emit(ARM_RSB_I(tmp2[0], rt, 32), ctx);
-        /* As we are using ARM_LR */
-        ctx->seen |= SEEN_CALL;
         emit(ARM_MOV_SR(ARM_LR, rm, SRTYPE_ASL, rt), ctx);
         emit(ARM_ORR_SR(ARM_LR, ARM_LR, rd, SRTYPE_ASL, ARM_IP), ctx);
         emit(ARM_ORR_SR(ARM_IP, ARM_LR, rd, SRTYPE_LSR, tmp2[0]), ctx);
@@ -656,8 +703,6 @@ static inline void emit_a32_arsh_r64(const u8 dst[], const u8 src[], bool dstk,
         /* Do the ARSH operation */
         emit(ARM_RSB_I(ARM_IP, rt, 32), ctx);
         emit(ARM_SUBS_I(tmp2[0], rt, 32), ctx);
-        /* As we are using ARM_LR */
-        ctx->seen |= SEEN_CALL;
         emit(ARM_MOV_SR(ARM_LR, rd, SRTYPE_LSR, rt), ctx);
         emit(ARM_ORR_SR(ARM_LR, ARM_LR, rm, SRTYPE_ASL, ARM_IP), ctx);
         _emit(ARM_COND_MI, ARM_B(0), ctx);
@@ -692,8 +737,6 @@ static inline void emit_a32_lsr_r64(const u8 dst[], const u8 src[], bool dstk,
         /* Do LSH operation */
         emit(ARM_RSB_I(ARM_IP, rt, 32), ctx);
         emit(ARM_SUBS_I(tmp2[0], rt, 32), ctx);
-        /* As we are using ARM_LR */
-        ctx->seen |= SEEN_CALL;
         emit(ARM_MOV_SR(ARM_LR, rd, SRTYPE_LSR, rt), ctx);
         emit(ARM_ORR_SR(ARM_LR, ARM_LR, rm, SRTYPE_ASL, ARM_IP), ctx);
         emit(ARM_ORR_SR(ARM_LR, ARM_LR, rm, SRTYPE_LSR, tmp2[0]), ctx);
@@ -828,8 +871,6 @@ static inline void emit_a32_mul_r64(const u8 dst[], const u8 src[], bool dstk,
         /* Do Multiplication */
         emit(ARM_MUL(ARM_IP, rd, rn), ctx);
         emit(ARM_MUL(ARM_LR, rm, rt), ctx);
-        /* As we are using ARM_LR */
-        ctx->seen |= SEEN_CALL;
         emit(ARM_ADD_R(ARM_LR, ARM_IP, ARM_LR), ctx);
 
         emit(ARM_UMULL(ARM_IP, rm, rd, rt), ctx);
@@ -872,33 +913,53 @@ static inline void emit_str_r(const u8 dst, const u8 src, bool dstk,
 }
 
 /* dst = *(size*)(src + off) */
-static inline void emit_ldx_r(const u8 dst, const u8 src, bool dstk,
-                              const s32 off, struct jit_ctx *ctx, const u8 sz){
+static inline void emit_ldx_r(const u8 dst[], const u8 src, bool dstk,
+                              s32 off, struct jit_ctx *ctx, const u8 sz){
         const u8 *tmp = bpf2a32[TMP_REG_1];
-        u8 rd = dstk ? tmp[1] : dst;
+        const u8 *rd = dstk ? tmp : dst;
         u8 rm = src;
+        s32 off_max;
 
-        if (off) {
+        if (sz == BPF_H)
+                off_max = 0xff;
+        else
+                off_max = 0xfff;
+
+        if (off < 0 || off > off_max) {
                 emit_a32_mov_i(tmp[0], off, false, ctx);
                 emit(ARM_ADD_R(tmp[0], tmp[0], src), ctx);
                 rm = tmp[0];
+                off = 0;
+        } else if (rd[1] == rm) {
+                emit(ARM_MOV_R(tmp[0], rm), ctx);
+                rm = tmp[0];
         }
         switch (sz) {
-        case BPF_W:
-                /* Load a Word */
-                emit(ARM_LDR_I(rd, rm, 0), ctx);
+        case BPF_B:
+                /* Load a Byte */
+                emit(ARM_LDRB_I(rd[1], rm, off), ctx);
+                emit_a32_mov_i(dst[0], 0, dstk, ctx);
                 break;
         case BPF_H:
                 /* Load a HalfWord */
-                emit(ARM_LDRH_I(rd, rm, 0), ctx);
+                emit(ARM_LDRH_I(rd[1], rm, off), ctx);
+                emit_a32_mov_i(dst[0], 0, dstk, ctx);
                 break;
-        case BPF_B:
-                /* Load a Byte */
-                emit(ARM_LDRB_I(rd, rm, 0), ctx);
+        case BPF_W:
+                /* Load a Word */
+                emit(ARM_LDR_I(rd[1], rm, off), ctx);
+                emit_a32_mov_i(dst[0], 0, dstk, ctx);
+                break;
+        case BPF_DW:
+                /* Load a Double Word */
+                emit(ARM_LDR_I(rd[1], rm, off), ctx);
+                emit(ARM_LDR_I(rd[0], rm, off + 4), ctx);
                 break;
         }
         if (dstk)
-                emit(ARM_STR_I(rd, ARM_SP, STACK_VAR(dst)), ctx);
+                emit(ARM_STR_I(rd[1], ARM_SP, STACK_VAR(dst[1])), ctx);
+        if (dstk && sz == BPF_DW)
+                emit(ARM_STR_I(rd[0], ARM_SP, STACK_VAR(dst[0])), ctx);
 }
 
 /* Arithmatic Operation */
@@ -906,7 +967,6 @@ static inline void emit_ar_r(const u8 rd, const u8 rt, const u8 rm,
                              const u8 rn, struct jit_ctx *ctx, u8 op) {
         switch (op) {
         case BPF_JSET:
-                ctx->seen |= SEEN_CALL;
                 emit(ARM_AND_R(ARM_IP, rt, rn), ctx);
                 emit(ARM_AND_R(ARM_LR, rd, rm), ctx);
                 emit(ARM_ORRS_R(ARM_IP, ARM_LR, ARM_IP), ctx);
@@ -945,7 +1005,7 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx)
         const u8 *tcc = bpf2a32[TCALL_CNT];
         const int idx0 = ctx->idx;
 #define cur_offset (ctx->idx - idx0)
-#define jmp_offset (out_offset - (cur_offset))
+#define jmp_offset (out_offset - (cur_offset) - 2)
         u32 off, lo, hi;
 
         /* if (index >= array->map.max_entries)
@@ -956,7 +1016,7 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx)
         emit_a32_mov_i(tmp[1], off, false, ctx);
         emit(ARM_LDR_I(tmp2[1], ARM_SP, STACK_VAR(r2[1])), ctx);
         emit(ARM_LDR_R(tmp[1], tmp2[1], tmp[1]), ctx);
-        /* index (64 bit) */
+        /* index is 32-bit for arrays */
         emit(ARM_LDR_I(tmp2[1], ARM_SP, STACK_VAR(r3[1])), ctx);
         /* index >= array->map.max_entries */
         emit(ARM_CMP_R(tmp2[1], tmp[1]), ctx);
@@ -997,7 +1057,7 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx)
         emit_a32_mov_i(tmp2[1], off, false, ctx);
         emit(ARM_LDR_R(tmp[1], tmp[1], tmp2[1]), ctx);
         emit(ARM_ADD_I(tmp[1], tmp[1], ctx->prologue_bytes), ctx);
-        emit(ARM_BX(tmp[1]), ctx);
+        emit_bx_r(tmp[1], ctx);
 
         /* out: */
         if (out_offset == -1)
@@ -1070,54 +1130,22 @@ static void build_prologue(struct jit_ctx *ctx)
         const u8 r2 = bpf2a32[BPF_REG_1][1];
         const u8 r3 = bpf2a32[BPF_REG_1][0];
         const u8 r4 = bpf2a32[BPF_REG_6][1];
-        const u8 r5 = bpf2a32[BPF_REG_6][0];
-        const u8 r6 = bpf2a32[TMP_REG_1][1];
-        const u8 r7 = bpf2a32[TMP_REG_1][0];
-        const u8 r8 = bpf2a32[TMP_REG_2][1];
-        const u8 r10 = bpf2a32[TMP_REG_2][0];
         const u8 fplo = bpf2a32[BPF_REG_FP][1];
         const u8 fphi = bpf2a32[BPF_REG_FP][0];
-        const u8 sp = ARM_SP;
         const u8 *tcc = bpf2a32[TCALL_CNT];
 
-        u16 reg_set = 0;
-
-        /*
-         * eBPF prog stack layout
-         *
-         *                         high
-         * original ARM_SP =>     +-----+ eBPF prologue
-         *                        |FP/LR|
-         * current ARM_FP =>      +-----+
-         *                        | ... | callee saved registers
-         * eBPF fp register =>    +-----+ <= (BPF_FP)
-         *                        | ... | eBPF JIT scratch space
-         *                        |     | eBPF prog stack
-         *                        +-----+
-         *                        |RSVD | JIT scratchpad
-         * current A64_SP =>      +-----+ <= (BPF_FP - STACK_SIZE)
-         *                        |     |
-         *                        | ... | Function call stack
-         *                        |     |
-         *                        +-----+
-         *                          low
-         */
-
         /* Save callee saved registers. */
-        reg_set |= (1<<r4) | (1<<r5) | (1<<r6) | (1<<r7) | (1<<r8) | (1<<r10);
 #ifdef CONFIG_FRAME_POINTER
-        reg_set |= (1<<ARM_FP) | (1<<ARM_IP) | (1<<ARM_LR) | (1<<ARM_PC);
-        emit(ARM_MOV_R(ARM_IP, sp), ctx);
+        u16 reg_set = CALLEE_PUSH_MASK | 1 << ARM_IP | 1 << ARM_PC;
+        emit(ARM_MOV_R(ARM_IP, ARM_SP), ctx);
         emit(ARM_PUSH(reg_set), ctx);
         emit(ARM_SUB_I(ARM_FP, ARM_IP, 4), ctx);
 #else
-        /* Check if call instruction exists in BPF body */
-        if (ctx->seen & SEEN_CALL)
-                reg_set |= (1<<ARM_LR);
-        emit(ARM_PUSH(reg_set), ctx);
+        emit(ARM_PUSH(CALLEE_PUSH_MASK), ctx);
+        emit(ARM_MOV_R(ARM_FP, ARM_SP), ctx);
 #endif
         /* Save frame pointer for later */
-        emit(ARM_SUB_I(ARM_IP, sp, SCRATCH_SIZE), ctx);
+        emit(ARM_SUB_I(ARM_IP, ARM_SP, SCRATCH_SIZE), ctx);
 
         ctx->stack_size = imm8m(STACK_SIZE);
 
@@ -1140,33 +1168,19 @@ static void build_prologue(struct jit_ctx *ctx)
         /* end of prologue */
 }
 
+/* restore callee saved registers. */
 static void build_epilogue(struct jit_ctx *ctx)
 {
-        const u8 r4 = bpf2a32[BPF_REG_6][1];
-        const u8 r5 = bpf2a32[BPF_REG_6][0];
-        const u8 r6 = bpf2a32[TMP_REG_1][1];
-        const u8 r7 = bpf2a32[TMP_REG_1][0];
-        const u8 r8 = bpf2a32[TMP_REG_2][1];
-        const u8 r10 = bpf2a32[TMP_REG_2][0];
-        u16 reg_set = 0;
-
-        /* unwind function call stack */
-        emit(ARM_ADD_I(ARM_SP, ARM_SP, ctx->stack_size), ctx);
-
-        /* restore callee saved registers. */
-        reg_set |= (1<<r4) | (1<<r5) | (1<<r6) | (1<<r7) | (1<<r8) | (1<<r10);
 #ifdef CONFIG_FRAME_POINTER
-        /* the first instruction of the prologue was: mov ip, sp */
-        reg_set |= (1<<ARM_FP) | (1<<ARM_SP) | (1<<ARM_PC);
+        /* When using frame pointers, some additional registers need to
+         * be loaded. */
+        u16 reg_set = CALLEE_POP_MASK | 1 << ARM_SP;
+        emit(ARM_SUB_I(ARM_SP, ARM_FP, hweight16(reg_set) * 4), ctx);
         emit(ARM_LDM(ARM_SP, reg_set), ctx);
 #else
-        if (ctx->seen & SEEN_CALL)
-                reg_set |= (1<<ARM_PC);
         /* Restore callee saved registers. */
-        emit(ARM_POP(reg_set), ctx);
-        /* Return back to the callee function */
-        if (!(ctx->seen & SEEN_CALL))
-                emit(ARM_BX(ARM_LR), ctx);
+        emit(ARM_MOV_R(ARM_SP, ARM_FP), ctx);
+        emit(ARM_POP(CALLEE_POP_MASK), ctx);
 #endif
 }
 
@@ -1394,8 +1408,6 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
                         emit_rev32(rt, rt, ctx);
                         goto emit_bswap_uxt;
                 case 64:
-                        /* Because of the usage of ARM_LR */
-                        ctx->seen |= SEEN_CALL;
                         emit_rev32(ARM_LR, rt, ctx);
                         emit_rev32(rt, rd, ctx);
                         emit(ARM_MOV_R(rd, ARM_LR), ctx);
@@ -1448,22 +1460,7 @@ exit:
                 rn = sstk ? tmp2[1] : src_lo;
                 if (sstk)
                         emit(ARM_LDR_I(rn, ARM_SP, STACK_VAR(src_lo)), ctx);
-                switch (BPF_SIZE(code)) {
-                case BPF_W:
-                        /* Load a Word */
-                case BPF_H:
-                        /* Load a Half-Word */
-                case BPF_B:
-                        /* Load a Byte */
-                        emit_ldx_r(dst_lo, rn, dstk, off, ctx, BPF_SIZE(code));
-                        emit_a32_mov_i(dst_hi, 0, dstk, ctx);
-                        break;
-                case BPF_DW:
-                        /* Load a double word */
-                        emit_ldx_r(dst_lo, rn, dstk, off, ctx, BPF_W);
-                        emit_ldx_r(dst_hi, rn, dstk, off+4, ctx, BPF_W);
-                        break;
-                }
+                emit_ldx_r(dst, rn, dstk, off, ctx, BPF_SIZE(code));
                 break;
         /* R0 = ntohx(*(size *)(((struct sk_buff *)R6)->data + imm)) */
         case BPF_LD | BPF_ABS | BPF_W:
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index a93339f5178f..c9a7e9e1414f 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -557,7 +557,6 @@ config QCOM_QDF2400_ERRATUM_0065
 
           If unsure, say Y.
 
-
 config SOCIONEXT_SYNQUACER_PREITS
         bool "Socionext Synquacer: Workaround for GICv3 pre-ITS"
         default y
@@ -576,6 +575,17 @@ config HISILICON_ERRATUM_161600802
           a 128kB offset to be applied to the target address in this commands.
 
           If unsure, say Y.
+
+config QCOM_FALKOR_ERRATUM_E1041
+        bool "Falkor E1041: Speculative instruction fetches might cause errant memory access"
+        default y
+        help
+          Falkor CPU may speculatively fetch instructions from an improper
+          memory location when MMU translation is changed from SCTLR_ELn[M]=1
+          to SCTLR_ELn[M]=0. Prefix an ISB instruction to fix the problem.
+
+          If unsure, say Y.
+
 endmenu
 
 
diff --git a/arch/arm64/boot/dts/Makefile b/arch/arm64/boot/dts/Makefile
index d7c22d51bc50..4aa50b9b26bc 100644
--- a/arch/arm64/boot/dts/Makefile
+++ b/arch/arm64/boot/dts/Makefile
@@ -12,6 +12,7 @@ subdir-y += cavium
 subdir-y += exynos
 subdir-y += freescale
 subdir-y += hisilicon
+subdir-y += lg
 subdir-y += marvell
 subdir-y += mediatek
 subdir-y += nvidia
@@ -22,5 +23,4 @@ subdir-y += rockchip
 subdir-y += socionext
 subdir-y += sprd
 subdir-y += xilinx
-subdir-y += lg
 subdir-y += zte
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
index 45bdbfb96126..4a8d3f83a36e 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
@@ -75,6 +75,7 @@
         pinctrl-0 = <&rgmii_pins>;
         phy-mode = "rgmii";
         phy-handle = <&ext_rgmii_phy>;
+        phy-supply = <&reg_dc1sw>;
         status = "okay";
 };
 
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
index 806442d3e846..604cdaedac38 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
@@ -77,6 +77,7 @@
         pinctrl-0 = <&rmii_pins>;
         phy-mode = "rmii";
         phy-handle = <&ext_rmii_phy1>;
+        phy-supply = <&reg_dc1sw>;
         status = "okay";
 
 };
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
index 0eb2acedf8c3..abe179de35d7 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
@@ -82,6 +82,7 @@
         pinctrl-0 = <&rgmii_pins>;
         phy-mode = "rgmii";
         phy-handle = <&ext_rgmii_phy>;
+        phy-supply = <&reg_dc1sw>;
         status = "okay";
 };
 
@@ -95,7 +96,7 @@
 &mmc2 {
         pinctrl-names = "default";
         pinctrl-0 = <&mmc2_pins>;
-        vmmc-supply = <&reg_vcc3v3>;
+        vmmc-supply = <&reg_dcdc1>;
         vqmmc-supply = <&reg_vcc1v8>;
         bus-width = <8>;
         non-removable;
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi
index a5da18a6f286..43418bd881d8 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi
@@ -45,19 +45,10 @@
 
 #include "sun50i-a64.dtsi"
 
-/ {
-        reg_vcc3v3: vcc3v3 {
-                compatible = "regulator-fixed";
-                regulator-name = "vcc3v3";
-                regulator-min-microvolt = <3300000>;
-                regulator-max-microvolt = <3300000>;
-        };
-};
-
 &mmc0 {
         pinctrl-names = "default";
         pinctrl-0 = <&mmc0_pins>;
-        vmmc-supply = <&reg_vcc3v3>;
+        vmmc-supply = <&reg_dcdc1>;
         non-removable;
         disable-wp;
         bus-width = <4>;
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus2.dts
index b6b7a561df8c..a42fd79a62a3 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus2.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus2.dts
@@ -71,7 +71,7 @@
         pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin>;
         vmmc-supply = <&reg_vcc3v3>;
         bus-width = <4>;
-        cd-gpios = <&pio 5 6 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&pio 5 6 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
 
diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
index 7c9bdc7ab50b..9db19314c60c 100644
--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
@@ -66,6 +66,7 @@
                                      <&cpu1>,
                                      <&cpu2>,
                                      <&cpu3>;
+                interrupt-parent = <&intc>;
         };
 
         psci {
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
index ead895a4e9a5..1fb8b9d6cb4e 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
@@ -753,12 +753,12 @@
 
 &uart_B {
         clocks = <&xtal>, <&clkc CLKID_UART1>, <&xtal>;
-        clock-names = "xtal", "core", "baud";
+        clock-names = "xtal", "pclk", "baud";
 };
 
 &uart_C {
         clocks = <&xtal>, <&clkc CLKID_UART2>, <&xtal>;
-        clock-names = "xtal", "core", "baud";
+        clock-names = "xtal", "pclk", "baud";
 };
 
 &vpu {
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
index 8ed981f59e5a..6524b89e7115 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
@@ -688,7 +688,7 @@
 
 &uart_A {
         clocks = <&xtal>, <&clkc CLKID_UART0>, <&xtal>;
-        clock-names = "xtal", "core", "baud";
+        clock-names = "xtal", "pclk", "baud";
 };
 
 &uart_AO {
@@ -703,12 +703,12 @@
 
 &uart_B {
         clocks = <&xtal>, <&clkc CLKID_UART1>, <&xtal>;
-        clock-names = "xtal", "core", "baud";
+        clock-names = "xtal", "pclk", "baud";
 };
 
 &uart_C {
         clocks = <&xtal>, <&clkc CLKID_UART2>, <&xtal>;
-        clock-names = "xtal", "core", "baud";
+        clock-names = "xtal", "pclk", "baud";
 };
 
 &vpu {
diff --git a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
index e3b64d03fbd8..9c7724e82aff 100644
--- a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
@@ -63,8 +63,10 @@
                         cpm_ethernet: ethernet@0 {
                                 compatible = "marvell,armada-7k-pp22";
                                 reg = <0x0 0x100000>, <0x129000 0xb000>;
-                                clocks = <&cpm_clk 1 3>, <&cpm_clk 1 9>, <&cpm_clk 1 5>;
-                                clock-names = "pp_clk", "gop_clk", "mg_clk";
+                                clocks = <&cpm_clk 1 3>, <&cpm_clk 1 9>,
+                                         <&cpm_clk 1 5>, <&cpm_clk 1 18>;
+                                clock-names = "pp_clk", "gop_clk",
+                                              "mg_clk","axi_clk";
                                 marvell,system-controller = <&cpm_syscon0>;
                                 status = "disabled";
                                 dma-coherent;
@@ -155,7 +157,8 @@
                                 #size-cells = <0>;
                                 compatible = "marvell,orion-mdio";
                                 reg = <0x12a200 0x10>;
-                                clocks = <&cpm_clk 1 9>, <&cpm_clk 1 5>;
+                                clocks = <&cpm_clk 1 9>, <&cpm_clk 1 5>,
+                                         <&cpm_clk 1 6>, <&cpm_clk 1 18>;
                                 status = "disabled";
                         };
 
@@ -338,8 +341,8 @@
                                 compatible = "marvell,armada-cp110-sdhci";
                                 reg = <0x780000 0x300>;
                                 interrupts = <ICU_GRP_NSR 27 IRQ_TYPE_LEVEL_HIGH>;
-                                clock-names = "core";
-                                clocks = <&cpm_clk 1 4>;
+                                clock-names = "core","axi";
+                                clocks = <&cpm_clk 1 4>, <&cpm_clk 1 18>;
                                 dma-coherent;
                                 status = "disabled";
                         };
diff --git a/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi b/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
index 0d51096c69f8..87ac68b2cf37 100644
--- a/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
@@ -63,8 +63,10 @@
                         cps_ethernet: ethernet@0 {
                                 compatible = "marvell,armada-7k-pp22";
                                 reg = <0x0 0x100000>, <0x129000 0xb000>;
-                                clocks = <&cps_clk 1 3>, <&cps_clk 1 9>, <&cps_clk 1 5>;
-                                clock-names = "pp_clk", "gop_clk", "mg_clk";
+                                clocks = <&cps_clk 1 3>, <&cps_clk 1 9>,
+                                         <&cps_clk 1 5>, <&cps_clk 1 18>;
+                                clock-names = "pp_clk", "gop_clk",
+                                              "mg_clk", "axi_clk";
                                 marvell,system-controller = <&cps_syscon0>;
                                 status = "disabled";
                                 dma-coherent;
@@ -155,7 +157,8 @@
                                 #size-cells = <0>;
                                 compatible = "marvell,orion-mdio";
                                 reg = <0x12a200 0x10>;
-                                clocks = <&cps_clk 1 9>, <&cps_clk 1 5>;
+                                clocks = <&cps_clk 1 9>, <&cps_clk 1 5>,
+                                         <&cps_clk 1 6>, <&cps_clk 1 18>;
                                 status = "disabled";
                         };
 
diff --git a/arch/arm64/boot/dts/renesas/salvator-common.dtsi b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
index a298df74ca6c..dbe2648649db 100644
--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
@@ -255,7 +255,6 @@
 &avb {
         pinctrl-0 = <&avb_pins>;
         pinctrl-names = "default";
-        renesas,no-ether-link;
         phy-handle = <&phy0>;
         status = "okay";
 
diff --git a/arch/arm64/boot/dts/renesas/ulcb.dtsi b/arch/arm64/boot/dts/renesas/ulcb.dtsi
index 0d85b315ce71..73439cf48659 100644
--- a/arch/arm64/boot/dts/renesas/ulcb.dtsi
+++ b/arch/arm64/boot/dts/renesas/ulcb.dtsi
@@ -145,7 +145,6 @@
 &avb {
         pinctrl-0 = <&avb_pins>;
         pinctrl-names = "default";
-        renesas,no-ether-link;
         phy-handle = <&phy0>;
         status = "okay";
 
diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
index d4f80786e7c2..3890468678ce 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
@@ -132,6 +132,8 @@
         assigned-clocks = <&cru SCLK_MAC2IO>, <&cru SCLK_MAC2IO_EXT>;
         assigned-clock-parents = <&gmac_clkin>, <&gmac_clkin>;
         clock_in_out = "input";
+        /* shows instability at 1GBit right now */
+        max-speed = <100>;
         phy-supply = <&vcc_io>;
         phy-mode = "rgmii";
         pinctrl-names = "default";
diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
index 41d61840fb99..2426da631938 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
@@ -514,7 +514,7 @@
         tsadc: tsadc@ff250000 {
                 compatible = "rockchip,rk3328-tsadc";
                 reg = <0x0 0xff250000 0x0 0x100>;
-                interrupts = <GIC_SPI 58 IRQ_TYPE_LEVEL_HIGH 0>;
+                interrupts = <GIC_SPI 58 IRQ_TYPE_LEVEL_HIGH>;
                 assigned-clocks = <&cru SCLK_TSADC>;
                 assigned-clock-rates = <50000>;
                 clocks = <&cru SCLK_TSADC>, <&cru PCLK_TSADC>;
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
index 910628d18add..1fc5060d7027 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
@@ -155,17 +155,6 @@
                 regulator-min-microvolt = <5000000>;
                 regulator-max-microvolt = <5000000>;
         };
-
-        vdd_log: vdd-log {
-                compatible = "pwm-regulator";
-                pwms = <&pwm2 0 25000 0>;
-                regulator-name = "vdd_log";
-                regulator-min-microvolt = <800000>;
-                regulator-max-microvolt = <1400000>;
-                regulator-always-on;
-                regulator-boot-on;
-                status = "okay";
-        };
 };
 
 &cpu_b0 {
diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld11-ref.dts b/arch/arm64/boot/dts/socionext/uniphier-ld11-ref.dts
index dd7193acc7df..6bdefb26b329 100644
--- a/arch/arm64/boot/dts/socionext/uniphier-ld11-ref.dts
+++ b/arch/arm64/boot/dts/socionext/uniphier-ld11-ref.dts
@@ -40,7 +40,6 @@
 };
 
 &ethsc {
-        interrupt-parent = <&gpio>;
         interrupts = <0 8>;
 };
 
diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld20-ref.dts b/arch/arm64/boot/dts/socionext/uniphier-ld20-ref.dts
index d99e3731358c..254d6795c67e 100644
--- a/arch/arm64/boot/dts/socionext/uniphier-ld20-ref.dts
+++ b/arch/arm64/boot/dts/socionext/uniphier-ld20-ref.dts
@@ -40,7 +40,6 @@
 };
 
 &ethsc {
-        interrupt-parent = <&gpio>;
         interrupts = <0 8>;
 };
 
diff --git a/arch/arm64/boot/dts/socionext/uniphier-pxs3-ref.dts b/arch/arm64/boot/dts/socionext/uniphier-pxs3-ref.dts
index 864feeb35180..f9f06fcfb94a 100644
--- a/arch/arm64/boot/dts/socionext/uniphier-pxs3-ref.dts
+++ b/arch/arm64/boot/dts/socionext/uniphier-pxs3-ref.dts
@@ -38,8 +38,7 @@
 };
 
 &ethsc {
-        interrupt-parent = <&gpio>;
-        interrupts = <0 8>;
+        interrupts = <4 8>;
 };
 
 &serial0 {
diff --git a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi
index 48e733136db4..0ac2ace82435 100644
--- a/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi
+++ b/arch/arm64/boot/dts/socionext/uniphier-pxs3.dtsi
@@ -198,8 +198,8 @@
                         gpio-controller;
                         #gpio-cells = <2>;
                         gpio-ranges = <&pinctrl 0 0 0>,
-                                      <&pinctrl 96 0 0>,
-                                      <&pinctrl 160 0 0>;
+                                      <&pinctrl 104 0 0>,
+                                      <&pinctrl 168 0 0>;
                         gpio-ranges-group-names = "gpio_range0",
                                                   "gpio_range1",
                                                   "gpio_range2";
diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
index aef72d886677..8b168280976f 100644
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -512,4 +512,14 @@ alternative_else_nop_endif
 #endif
         .endm
 
+/**
+ * Errata workaround prior to disable MMU. Insert an ISB immediately prior
+ * to executing the MSR that will change SCTLR_ELn[M] from a value of 1 to 0.
+ */
+        .macro pre_disable_mmu_workaround
+#ifdef CONFIG_QCOM_FALKOR_ERRATUM_E1041
+        isb
+#endif
+        .endm
+
 #endif  /* __ASM_ASSEMBLER_H */
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index ac67cfc2585a..060e3a4008ab 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -60,6 +60,9 @@ enum ftr_type {
 #define FTR_VISIBLE     true    /* Feature visible to the user space */
 #define FTR_HIDDEN      false   /* Feature is hidden from the user */
 
+#define FTR_VISIBLE_IF_IS_ENABLED(config)               \
+        (IS_ENABLED(config) ? FTR_VISIBLE : FTR_HIDDEN)
+
 struct arm64_ftr_bits {
         bool            sign;   /* Value is signed ? */
         bool            visible;
diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
index 235e77d98261..cbf08d7cbf30 100644
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@@ -91,6 +91,7 @@
 #define BRCM_CPU_PART_VULCAN            0x516
 
 #define QCOM_CPU_PART_FALKOR_V1         0x800
+#define QCOM_CPU_PART_FALKOR            0xC00
 
 #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53)
 #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57)
@@ -99,6 +100,7 @@
 #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)
 #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX)
 #define MIDR_QCOM_FALKOR_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR_V1)
+#define MIDR_QCOM_FALKOR MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR)
 
 #ifndef __ASSEMBLY__
 
diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h
index 650344d01124..c4cd5081d78b 100644
--- a/arch/arm64/include/asm/efi.h
+++ b/arch/arm64/include/asm/efi.h
@@ -132,11 +132,9 @@ static inline void efi_set_pgd(struct mm_struct *mm)
                          * Defer the switch to the current thread's TTBR0_EL1
                          * until uaccess_enable(). Restore the current
                          * thread's saved ttbr0 corresponding to its active_mm
-                         * (if different from init_mm).
                          */
                         cpu_set_reserved_ttbr0();
-                        if (current->active_mm != &init_mm)
-                                update_saved_ttbr0(current, current->active_mm);
+                        update_saved_ttbr0(current, current->active_mm);
                 }
         }
 }
diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
index 7f069ff37f06..715d395ef45b 100644
--- a/arch/arm64/include/asm/kvm_arm.h
+++ b/arch/arm64/include/asm/kvm_arm.h
@@ -170,8 +170,7 @@
 #define VTCR_EL2_FLAGS                  (VTCR_EL2_COMMON_BITS | VTCR_EL2_TGRAN_FLAGS)
 #define VTTBR_X                         (VTTBR_X_TGRAN_MAGIC - VTCR_EL2_T0SZ_IPA)
 
-#define VTTBR_BADDR_SHIFT (VTTBR_X - 1)
-#define VTTBR_BADDR_MASK  (((UL(1) << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT)
+#define VTTBR_BADDR_MASK  (((UL(1) << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_X)
 #define VTTBR_VMID_SHIFT  (UL(48))
 #define VTTBR_VMID_MASK(size) (_AT(u64, (1 << size) - 1) << VTTBR_VMID_SHIFT)
 
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 674912d7a571..ea6cb5b24258 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -370,6 +370,7 @@ void kvm_arm_init_debug(void);
 void kvm_arm_setup_debug(struct kvm_vcpu *vcpu);
 void kvm_arm_clear_debug(struct kvm_vcpu *vcpu);
 void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu);
+bool kvm_arm_handle_step_debug(struct kvm_vcpu *vcpu, struct kvm_run *run);
 int kvm_arm_vcpu_arch_set_attr(struct kvm_vcpu *vcpu,
                                struct kvm_device_attr *attr);
 int kvm_arm_vcpu_arch_get_attr(struct kvm_vcpu *vcpu,
diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
index 3257895a9b5e..9d155fa9a507 100644
--- a/arch/arm64/include/asm/mmu_context.h
+++ b/arch/arm64/include/asm/mmu_context.h
@@ -156,29 +156,21 @@ void check_and_switch_context(struct mm_struct *mm, unsigned int cpu);
 
 #define init_new_context(tsk,mm)        ({ atomic64_set(&(mm)->context.id, 0); 0; })
 
-/*
- * This is called when "tsk" is about to enter lazy TLB mode.
- *
- * mm:  describes the currently active mm context
- * tsk: task which is entering lazy tlb
- * cpu: cpu number which is entering lazy tlb
- *
- * tsk->mm will be NULL
- */
-static inline void
-enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
-{
-}
-
 #ifdef CONFIG_ARM64_SW_TTBR0_PAN
 static inline void update_saved_ttbr0(struct task_struct *tsk,
                                       struct mm_struct *mm)
 {
-        if (system_uses_ttbr0_pan()) {
-                BUG_ON(mm->pgd == swapper_pg_dir);
-                task_thread_info(tsk)->ttbr0 =
-                        virt_to_phys(mm->pgd) | ASID(mm) << 48;
-        }
+        u64 ttbr;
+
+        if (!system_uses_ttbr0_pan())
+                return;
+
+        if (mm == &init_mm)
+                ttbr = __pa_symbol(empty_zero_page);
+        else
+                ttbr = virt_to_phys(mm->pgd) | ASID(mm) << 48;
+
+        task_thread_info(tsk)->ttbr0 = ttbr;
 }
 #else
 static inline void update_saved_ttbr0(struct task_struct *tsk,
@@ -187,6 +179,16 @@ static inline void update_saved_ttbr0(struct task_struct *tsk,
 }
 #endif
 
+static inline void
+enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
+{
+        /*
+         * We don't actually care about the ttbr0 mapping, so point it at the
+         * zero page.
+         */
+        update_saved_ttbr0(tsk, &init_mm);
+}
+
 static inline void __switch_mm(struct mm_struct *next)
 {
         unsigned int cpu = smp_processor_id();
@@ -214,11 +216,9 @@ switch_mm(struct mm_struct *prev, struct mm_struct *next,
          * Update the saved TTBR0_EL1 of the scheduled-in task as the previous
          * value may have not been initialised yet (activate_mm caller) or the
          * ASID has changed since the last run (following the context switch
-         * of another thread of the same process). Avoid setting the reserved
-         * TTBR0_EL1 to swapper_pg_dir (init_mm; e.g. via idle_task_exit).
+         * of another thread of the same process).
          */
-        if (next != &init_mm)
-                update_saved_ttbr0(tsk, next);
+        update_saved_ttbr0(tsk, next);
 }
 
 #define deactivate_mm(tsk,mm)   do { } while (0)
diff --git a/arch/arm64/include/asm/perf_event.h b/arch/arm64/include/asm/perf_event.h
index 8d5cbec17d80..f9ccc36d3dc3 100644
--- a/arch/arm64/include/asm/perf_event.h
+++ b/arch/arm64/include/asm/perf_event.h
@@ -18,6 +18,7 @@
 #define __ASM_PERF_EVENT_H
 
 #include <asm/stack_pointer.h>
+#include <asm/ptrace.h>
 
 #define ARMV8_PMU_MAX_COUNTERS  32
 #define ARMV8_PMU_COUNTER_MASK  (ARMV8_PMU_MAX_COUNTERS - 1)
@@ -79,6 +80,7 @@ struct pt_regs;
 extern unsigned long perf_instruction_pointer(struct pt_regs *regs);
 extern unsigned long perf_misc_flags(struct pt_regs *regs);
 #define perf_misc_flags(regs)   perf_misc_flags(regs)
+#define perf_arch_bpf_user_pt_regs(regs) &regs->user_regs
 #endif
 
 #define perf_arch_fetch_caller_regs(regs, __ip) { \
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 149d05fb9421..bdcc7f1c9d06 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -42,6 +42,8 @@
 #include <asm/cmpxchg.h>
 #include <asm/fixmap.h>
 #include <linux/mmdebug.h>
+#include <linux/mm_types.h>
+#include <linux/sched.h>
 
 extern void __pte_error(const char *file, int line, unsigned long val);
 extern void __pmd_error(const char *file, int line, unsigned long val);
@@ -149,12 +151,20 @@ static inline pte_t pte_mkwrite(pte_t pte)
 
 static inline pte_t pte_mkclean(pte_t pte)
 {
-        return clear_pte_bit(pte, __pgprot(PTE_DIRTY));
+        pte = clear_pte_bit(pte, __pgprot(PTE_DIRTY));
+        pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
+
+        return pte;
 }
 
 static inline pte_t pte_mkdirty(pte_t pte)
 {
-        return set_pte_bit(pte, __pgprot(PTE_DIRTY));
+        pte = set_pte_bit(pte, __pgprot(PTE_DIRTY));
+
+        if (pte_write(pte))
+                pte = clear_pte_bit(pte, __pgprot(PTE_RDONLY));
+
+        return pte;
 }
 
 static inline pte_t pte_mkold(pte_t pte)
@@ -207,9 +217,6 @@ static inline void set_pte(pte_t *ptep, pte_t pte)
         }
 }
 
-struct mm_struct;
-struct vm_area_struct;
-
 extern void __sync_icache_dcache(pte_t pteval, unsigned long addr);
 
 /*
@@ -238,7 +245,8 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
          * hardware updates of the pte (ptep_set_access_flags safely changes
          * valid ptes without going through an invalid entry).
          */
-        if (pte_valid(*ptep) && pte_valid(pte)) {
+        if (IS_ENABLED(CONFIG_DEBUG_VM) && pte_valid(*ptep) && pte_valid(pte) &&
+           (mm == current->active_mm || atomic_read(&mm->mm_users) > 1)) {
                 VM_WARN_ONCE(!pte_young(pte),
                              "%s: racy access flag clearing: 0x%016llx -> 0x%016llx",
                              __func__, pte_val(*ptep), pte_val(pte));
@@ -641,28 +649,23 @@ static inline pmd_t pmdp_huge_get_and_clear(struct mm_struct *mm,
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
 /*
- * ptep_set_wrprotect - mark read-only while preserving the hardware update of
- * the Access Flag.
+ * ptep_set_wrprotect - mark read-only while trasferring potential hardware
+ * dirty status (PTE_DBM && !PTE_RDONLY) to the software PTE_DIRTY bit.
  */
 #define __HAVE_ARCH_PTEP_SET_WRPROTECT
 static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long address, pte_t *ptep)
 {
         pte_t old_pte, pte;
 
-        /*
-         * ptep_set_wrprotect() is only called on CoW mappings which are
-         * private (!VM_SHARED) with the pte either read-only (!PTE_WRITE &&
-         * PTE_RDONLY) or writable and software-dirty (PTE_WRITE &&
-         * !PTE_RDONLY && PTE_DIRTY); see is_cow_mapping() and
-         * protection_map[]. There is no race with the hardware update of the
-         * dirty state: clearing of PTE_RDONLY when PTE_WRITE (a.k.a. PTE_DBM)
-         * is set.
-         */
-        VM_WARN_ONCE(pte_write(*ptep) && !pte_dirty(*ptep),
-                     "%s: potential race with hardware DBM", __func__);
         pte = READ_ONCE(*ptep);
         do {
                 old_pte = pte;
+                /*
+                 * If hardware-dirty (PTE_WRITE/DBM bit set and PTE_RDONLY
+                 * clear), set the PTE_DIRTY bit.
+                 */
+                if (pte_hw_dirty(pte))
+                        pte = pte_mkdirty(pte);
                 pte = pte_wrprotect(pte);
                 pte_val(pte) = cmpxchg_relaxed(&pte_val(*ptep),
                                                pte_val(old_pte), pte_val(pte));
diff --git a/arch/arm64/include/uapi/asm/bpf_perf_event.h b/arch/arm64/include/uapi/asm/bpf_perf_event.h
new file mode 100644
index 000000000000..b551b741653d
--- /dev/null
+++ b/arch/arm64/include/uapi/asm/bpf_perf_event.h
@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _UAPI__ASM_BPF_PERF_EVENT_H__
+#define _UAPI__ASM_BPF_PERF_EVENT_H__
+
+#include <asm/ptrace.h>
+
+typedef struct user_pt_regs bpf_user_pt_regs_t;
+
+#endif /* _UAPI__ASM_BPF_PERF_EVENT_H__ */
diff --git a/arch/arm64/kernel/cpu-reset.S b/arch/arm64/kernel/cpu-reset.S
index 65f42d257414..2a752cb2a0f3 100644
--- a/arch/arm64/kernel/cpu-reset.S
+++ b/arch/arm64/kernel/cpu-reset.S
@@ -37,6 +37,7 @@ ENTRY(__cpu_soft_restart)
         mrs     x12, sctlr_el1
         ldr     x13, =SCTLR_ELx_FLAGS
         bic     x12, x12, x13
+        pre_disable_mmu_workaround
         msr     sctlr_el1, x12
         isb
 
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index c5ba0097887f..a73a5928f09b 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -145,7 +145,8 @@ static const struct arm64_ftr_bits ftr_id_aa64isar1[] = {
 };
 
 static const struct arm64_ftr_bits ftr_id_aa64pfr0[] = {
-        ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_SVE_SHIFT, 4, 0),
+        ARM64_FTR_BITS(FTR_VISIBLE_IF_IS_ENABLED(CONFIG_ARM64_SVE),
+                                   FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_SVE_SHIFT, 4, 0),
         ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_GIC_SHIFT, 4, 0),
         S_ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_ASIMD_SHIFT, 4, ID_AA64PFR0_ASIMD_NI),
         S_ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_FP_SHIFT, 4, ID_AA64PFR0_FP_NI),
diff --git a/arch/arm64/kernel/efi-entry.S b/arch/arm64/kernel/efi-entry.S
index 4e6ad355bd05..6b9736c3fb56 100644
--- a/arch/arm64/kernel/efi-entry.S
+++ b/arch/arm64/kernel/efi-entry.S
@@ -96,6 +96,7 @@ ENTRY(entry)
         mrs     x0, sctlr_el2
         bic     x0, x0, #1 << 0 // clear SCTLR.M
         bic     x0, x0, #1 << 2 // clear SCTLR.C
+        pre_disable_mmu_workaround
         msr     sctlr_el2, x0
         isb
         b       2f
@@ -103,6 +104,7 @@ ENTRY(entry)
         mrs     x0, sctlr_el1
         bic     x0, x0, #1 << 0 // clear SCTLR.M
         bic     x0, x0, #1 << 2 // clear SCTLR.C
+        pre_disable_mmu_workaround
         msr     sctlr_el1, x0
         isb
 2:
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index 5084e699447a..fae81f7964b4 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -114,7 +114,12 @@
  *   returned from the 2nd syscall yet, TIF_FOREIGN_FPSTATE is still set so
  *   whatever is in the FPSIMD registers is not saved to memory, but discarded.
  */
-static DEFINE_PER_CPU(struct fpsimd_state *, fpsimd_last_state);
+struct fpsimd_last_state_struct {
+        struct fpsimd_state *st;
+        bool sve_in_use;
+};
+
+static DEFINE_PER_CPU(struct fpsimd_last_state_struct, fpsimd_last_state);
 
 /* Default VL for tasks that don't set it explicitly: */
 static int sve_default_vl = -1;
@@ -905,7 +910,7 @@ void fpsimd_thread_switch(struct task_struct *next)
                  */
                 struct fpsimd_state *st = &next->thread.fpsimd_state;
 
-                if (__this_cpu_read(fpsimd_last_state) == st
+                if (__this_cpu_read(fpsimd_last_state.st) == st
                     && st->cpu == smp_processor_id())
                         clear_tsk_thread_flag(next, TIF_FOREIGN_FPSTATE);
                 else
@@ -992,6 +997,21 @@ void fpsimd_signal_preserve_current_state(void)
 }
 
 /*
+ * Associate current's FPSIMD context with this cpu
+ * Preemption must be disabled when calling this function.
+ */
+static void fpsimd_bind_to_cpu(void)
+{
+        struct fpsimd_last_state_struct *last =
+                this_cpu_ptr(&fpsimd_last_state);
+        struct fpsimd_state *st = &current->thread.fpsimd_state;
+
+        last->st = st;
+        last->sve_in_use = test_thread_flag(TIF_SVE);
+        st->cpu = smp_processor_id();
+}
+
+/*
  * Load the userland FPSIMD state of 'current' from memory, but only if the
  * FPSIMD state already held in the registers is /not/ the most recent FPSIMD
  * state of 'current'
@@ -1004,11 +1024,8 @@ void fpsimd_restore_current_state(void)
         local_bh_disable();
 
         if (test_and_clear_thread_flag(TIF_FOREIGN_FPSTATE)) {
-                struct fpsimd_state *st = &current->thread.fpsimd_state;
-
                 task_fpsimd_load();
-                __this_cpu_write(fpsimd_last_state, st);
-                st->cpu = smp_processor_id();
+                fpsimd_bind_to_cpu();
         }
 
         local_bh_enable();
@@ -1026,18 +1043,14 @@ void fpsimd_update_current_state(struct fpsimd_state *state)
 
         local_bh_disable();
 
-        current->thread.fpsimd_state = *state;
+        current->thread.fpsimd_state.user_fpsimd = state->user_fpsimd;
         if (system_supports_sve() && test_thread_flag(TIF_SVE))
                 fpsimd_to_sve(current);
 
         task_fpsimd_load();
 
-        if (test_and_clear_thread_flag(TIF_FOREIGN_FPSTATE)) {
-                struct fpsimd_state *st = &current->thread.fpsimd_state;
-
-                __this_cpu_write(fpsimd_last_state, st);
-                st->cpu = smp_processor_id();
-        }
+        if (test_and_clear_thread_flag(TIF_FOREIGN_FPSTATE))
+                fpsimd_bind_to_cpu();
 
         local_bh_enable();
 }
@@ -1052,7 +1065,7 @@ void fpsimd_flush_task_state(struct task_struct *t)
 
 static inline void fpsimd_flush_cpu_state(void)
 {
-        __this_cpu_write(fpsimd_last_state, NULL);
+        __this_cpu_write(fpsimd_last_state.st, NULL);
 }
 
 /*
@@ -1065,14 +1078,10 @@ static inline void fpsimd_flush_cpu_state(void)
 #ifdef CONFIG_ARM64_SVE
 void sve_flush_cpu_state(void)
 {
-        struct fpsimd_state *const fpstate = __this_cpu_read(fpsimd_last_state);
-        struct task_struct *tsk;
-
-        if (!fpstate)
-                return;
+        struct fpsimd_last_state_struct const *last =
+                this_cpu_ptr(&fpsimd_last_state);
 
-        tsk = container_of(fpstate, struct task_struct, thread.fpsimd_state);
-        if (test_tsk_thread_flag(tsk, TIF_SVE))
+        if (last->st && last->sve_in_use)
                 fpsimd_flush_cpu_state();
 }
 #endif /* CONFIG_ARM64_SVE */
@@ -1267,7 +1276,7 @@ static inline void fpsimd_pm_init(void) { }
 #ifdef CONFIG_HOTPLUG_CPU
 static int fpsimd_cpu_dead(unsigned int cpu)
 {
-        per_cpu(fpsimd_last_state, cpu) = NULL;
+        per_cpu(fpsimd_last_state.st, cpu) = NULL;
         return 0;
 }
 
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 67e86a0f57ac..e3cb9fbf96b6 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -750,6 +750,7 @@ __primary_switch:
          * to take into account by discarding the current kernel mapping and
          * creating a new one.
          */
+        pre_disable_mmu_workaround
         msr     sctlr_el1, x20                  // disable the MMU
         isb
         bl      __create_page_tables            // recreate kernel mapping
diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c
index 749f81779420..74bb56f656ef 100644
--- a/arch/arm64/kernel/hw_breakpoint.c
+++ b/arch/arm64/kernel/hw_breakpoint.c
@@ -28,6 +28,7 @@
 #include <linux/perf_event.h>
 #include <linux/ptrace.h>
 #include <linux/smp.h>
+#include <linux/uaccess.h>
 
 #include <asm/compat.h>
 #include <asm/current.h>
@@ -36,7 +37,6 @@
 #include <asm/traps.h>
 #include <asm/cputype.h>
 #include <asm/system_misc.h>
-#include <asm/uaccess.h>
 
 /* Breakpoint currently in use for each BRP. */
 static DEFINE_PER_CPU(struct perf_event *, bp_on_reg[ARM_MAX_BRP]);
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index b2adcce7bc18..6b7dcf4310ac 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -314,6 +314,15 @@ int copy_thread(unsigned long clone_flags, unsigned long stack_start,
         clear_tsk_thread_flag(p, TIF_SVE);
         p->thread.sve_state = NULL;
 
+        /*
+         * In case p was allocated the same task_struct pointer as some
+         * other recently-exited task, make sure p is disassociated from
+         * any cpu that may have run that now-exited task recently.
+         * Otherwise we could erroneously skip reloading the FPSIMD
+         * registers for p.
+         */
+        fpsimd_flush_task_state(p);
+
         if (likely(!(p->flags & PF_KTHREAD))) {
                 *childregs = *current_pt_regs();
                 childregs->regs[0] = 0;
diff --git a/arch/arm64/kernel/relocate_kernel.S b/arch/arm64/kernel/relocate_kernel.S
index ce704a4aeadd..f407e422a720 100644
--- a/arch/arm64/kernel/relocate_kernel.S
+++ b/arch/arm64/kernel/relocate_kernel.S
@@ -45,6 +45,7 @@ ENTRY(arm64_relocate_new_kernel)
         mrs     x0, sctlr_el2
         ldr     x1, =SCTLR_ELx_FLAGS
         bic     x0, x0, x1
+        pre_disable_mmu_workaround
         msr     sctlr_el2, x0
         isb
 1:
diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c
index dbadfaf850a7..fa63b28c65e0 100644
--- a/arch/arm64/kvm/debug.c
+++ b/arch/arm64/kvm/debug.c
@@ -221,3 +221,24 @@ void kvm_arm_clear_debug(struct kvm_vcpu *vcpu)
                 }
         }
 }
+
+
+/*
+ * After successfully emulating an instruction, we might want to
+ * return to user space with a KVM_EXIT_DEBUG. We can only do this
+ * once the emulation is complete, though, so for userspace emulations
+ * we have to wait until we have re-entered KVM before calling this
+ * helper.
+ *
+ * Return true (and set exit_reason) to return to userspace or false
+ * if no further action is required.
+ */
+bool kvm_arm_handle_step_debug(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+        if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) {
+                run->exit_reason = KVM_EXIT_DEBUG;
+                run->debug.arch.hsr = ESR_ELx_EC_SOFTSTP_LOW << ESR_ELx_EC_SHIFT;
+                return true;
+        }
+        return false;
+}
diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c
index b71247995469..e60494f1eef9 100644
--- a/arch/arm64/kvm/handle_exit.c
+++ b/arch/arm64/kvm/handle_exit.c
@@ -28,6 +28,7 @@
 #include <asm/kvm_emulate.h>
 #include <asm/kvm_mmu.h>
 #include <asm/kvm_psci.h>
+#include <asm/debug-monitors.h>
 
 #define CREATE_TRACE_POINTS
 #include "trace.h"
@@ -44,7 +45,7 @@ static int handle_hvc(struct kvm_vcpu *vcpu, struct kvm_run *run)
 
         ret = kvm_psci_call(vcpu);
         if (ret < 0) {
-                kvm_inject_undefined(vcpu);
+                vcpu_set_reg(vcpu, 0, ~0UL);
                 return 1;
         }
 
@@ -53,7 +54,7 @@ static int handle_hvc(struct kvm_vcpu *vcpu, struct kvm_run *run)
 
 static int handle_smc(struct kvm_vcpu *vcpu, struct kvm_run *run)
 {
-        kvm_inject_undefined(vcpu);
+        vcpu_set_reg(vcpu, 0, ~0UL);
         return 1;
 }
 
@@ -187,14 +188,46 @@ static exit_handle_fn kvm_get_exit_handler(struct kvm_vcpu *vcpu)
 }
 
 /*
+ * We may be single-stepping an emulated instruction. If the emulation
+ * has been completed in the kernel, we can return to userspace with a
+ * KVM_EXIT_DEBUG, otherwise userspace needs to complete its
+ * emulation first.
+ */
+static int handle_trap_exceptions(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+        int handled;
+
+        /*
+         * See ARM ARM B1.14.1: "Hyp traps on instructions
+         * that fail their condition code check"
+         */
+        if (!kvm_condition_valid(vcpu)) {
+                kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
+                handled = 1;
+        } else {
+                exit_handle_fn exit_handler;
+
+                exit_handler = kvm_get_exit_handler(vcpu);
+                handled = exit_handler(vcpu, run);
+        }
+
+        /*
+         * kvm_arm_handle_step_debug() sets the exit_reason on the kvm_run
+         * structure if we need to return to userspace.
+         */
+        if (handled > 0 && kvm_arm_handle_step_debug(vcpu, run))
+                handled = 0;
+
+        return handled;
+}
+
+/*
  * Return > 0 to return to guest, < 0 on error, 0 (and set exit_reason) on
  * proper exit to userspace.
  */
 int handle_exit(struct kvm_vcpu *vcpu, struct kvm_run *run,
                        int exception_index)
 {
-        exit_handle_fn exit_handler;
-
         if (ARM_SERROR_PENDING(exception_index)) {
                 u8 hsr_ec = ESR_ELx_EC(kvm_vcpu_get_hsr(vcpu));
 
@@ -220,20 +253,14 @@ int handle_exit(struct kvm_vcpu *vcpu, struct kvm_run *run,
                 return 1;
         case ARM_EXCEPTION_EL1_SERROR:
                 kvm_inject_vabt(vcpu);
-                return 1;
-        case ARM_EXCEPTION_TRAP:
-                /*
-                 * See ARM ARM B1.14.1: "Hyp traps on instructions
-                 * that fail their condition code check"
-                 */
-                if (!kvm_condition_valid(vcpu)) {
-                        kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
+                /* We may still need to return for single-step */
+                if (!(*vcpu_cpsr(vcpu) & DBG_SPSR_SS)
+                        && kvm_arm_handle_step_debug(vcpu, run))
+                        return 0;
+                else
                         return 1;
-                }
-
-                exit_handler = kvm_get_exit_handler(vcpu);
-
-                return exit_handler(vcpu, run);
+        case ARM_EXCEPTION_TRAP:
+                return handle_trap_exceptions(vcpu, run);
         case ARM_EXCEPTION_HYP_GONE:
                 /*
                  * EL2 has been reset to the hyp-stub. This happens when a guest
diff --git a/arch/arm64/kvm/hyp-init.S b/arch/arm64/kvm/hyp-init.S
index 3f9615582377..870828c364c5 100644
--- a/arch/arm64/kvm/hyp-init.S
+++ b/arch/arm64/kvm/hyp-init.S
@@ -151,6 +151,7 @@ reset:
         mrs     x5, sctlr_el2
         ldr     x6, =SCTLR_ELx_FLAGS
         bic     x5, x5, x6              // Clear SCTL_M and etc
+        pre_disable_mmu_workaround
         msr     sctlr_el2, x5
         isb
 
diff --git a/arch/arm64/kvm/hyp/debug-sr.c b/arch/arm64/kvm/hyp/debug-sr.c
index 321c9c05dd9e..f4363d40e2cd 100644
--- a/arch/arm64/kvm/hyp/debug-sr.c
+++ b/arch/arm64/kvm/hyp/debug-sr.c
@@ -74,6 +74,9 @@ static void __hyp_text __debug_save_spe_nvhe(u64 *pmscr_el1)
 {
         u64 reg;
 
+        /* Clear pmscr in case of early return */
+        *pmscr_el1 = 0;
+
         /* SPE present on this CPU? */
         if (!cpuid_feature_extract_unsigned_field(read_sysreg(id_aa64dfr0_el1),
                                                   ID_AA64DFR0_PMSVER_SHIFT))
diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index 525c01f48867..f7c651f3a8c0 100644
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -22,6 +22,7 @@
 #include <asm/kvm_emulate.h>
 #include <asm/kvm_hyp.h>
 #include <asm/fpsimd.h>
+#include <asm/debug-monitors.h>
 
 static bool __hyp_text __fpsimd_enabled_nvhe(void)
 {
@@ -269,7 +270,11 @@ static bool __hyp_text __populate_fault_info(struct kvm_vcpu *vcpu)
         return true;
 }
 
-static void __hyp_text __skip_instr(struct kvm_vcpu *vcpu)
+/* Skip an instruction which has been emulated. Returns true if
+ * execution can continue or false if we need to exit hyp mode because
+ * single-step was in effect.
+ */
+static bool __hyp_text __skip_instr(struct kvm_vcpu *vcpu)
 {
         *vcpu_pc(vcpu) = read_sysreg_el2(elr);
 
@@ -282,6 +287,14 @@ static void __hyp_text __skip_instr(struct kvm_vcpu *vcpu)
         }
 
         write_sysreg_el2(*vcpu_pc(vcpu), elr);
+
+        if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) {
+                vcpu->arch.fault.esr_el2 =
+                        (ESR_ELx_EC_SOFTSTP_LOW << ESR_ELx_EC_SHIFT) | 0x22;
+                return false;
+        } else {
+                return true;
+        }
 }
 
 int __hyp_text __kvm_vcpu_run(struct kvm_vcpu *vcpu)
@@ -342,13 +355,21 @@ again:
                         int ret = __vgic_v2_perform_cpuif_access(vcpu);
 
                         if (ret == 1) {
-                                __skip_instr(vcpu);
-                                goto again;
+                                if (__skip_instr(vcpu))
+                                        goto again;
+                                else
+                                        exit_code = ARM_EXCEPTION_TRAP;
                         }
 
                         if (ret == -1) {
-                                /* Promote an illegal access to an SError */
-                                __skip_instr(vcpu);
+                                /* Promote an illegal access to an
+                                 * SError. If we would be returning
+                                 * due to single-step clear the SS
+                                 * bit so handle_exit knows what to
+                                 * do after dealing with the error.
+                                 */
+                                if (!__skip_instr(vcpu))
+                                        *vcpu_cpsr(vcpu) &= ~DBG_SPSR_SS;
                                 exit_code = ARM_EXCEPTION_EL1_SERROR;
                         }
 
@@ -363,8 +384,10 @@ again:
                 int ret = __vgic_v3_perform_cpuif_access(vcpu);
 
                 if (ret == 1) {
-                        __skip_instr(vcpu);
-                        goto again;
+                        if (__skip_instr(vcpu))
+                                goto again;
+                        else
+                                exit_code = ARM_EXCEPTION_TRAP;
                 }
 
                 /* 0 falls through to be handled out of EL2 */
diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
index ca74a2aace42..7b60d62ac593 100644
--- a/arch/arm64/mm/dump.c
+++ b/arch/arm64/mm/dump.c
@@ -389,7 +389,7 @@ void ptdump_check_wx(void)
                 .check_wx = true,
         };
 
-        walk_pgd(&st, &init_mm, 0);
+        walk_pgd(&st, &init_mm, VA_START);
         note_page(&st, 0, 0, 0);
         if (st.wx_pages || st.uxn_pages)
                 pr_warn("Checked W+X mappings: FAILED, %lu W+X pages found, %lu non-UXN pages found\n",
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 22168cd0dde7..9b7f89df49db 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -574,7 +574,6 @@ static int do_sea(unsigned long addr, unsigned int esr, struct pt_regs *regs)
 {
         struct siginfo info;
         const struct fault_info *inf;
-        int ret = 0;
 
         inf = esr_to_fault_info(esr);
         pr_err("Synchronous External Abort: %s (0x%08x) at 0x%016lx\n",
@@ -589,7 +588,7 @@ static int do_sea(unsigned long addr, unsigned int esr, struct pt_regs *regs)
                 if (interrupts_enabled(regs))
                         nmi_enter();
 
-                ret = ghes_notify_sea();
+                ghes_notify_sea();
 
                 if (interrupts_enabled(regs))
                         nmi_exit();
@@ -604,7 +603,7 @@ static int do_sea(unsigned long addr, unsigned int esr, struct pt_regs *regs)
                 info.si_addr  = (void __user *)addr;
         arm64_notify_die("", regs, &info, esr);
 
-        return ret;
+        return 0;
 }
 
 static const struct fault_info fault_info[] = {
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 5960bef0170d..00e7b900ca41 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -476,6 +476,8 @@ void __init arm64_memblock_init(void)
 
         reserve_elfcorehdr();
 
+        high_memory = __va(memblock_end_of_DRAM() - 1) + 1;
+
         dma_contiguous_reserve(arm64_dma_phys_limit);
 
         memblock_allow_resize();
@@ -502,7 +504,6 @@ void __init bootmem_init(void)
         sparse_init();
         zone_sizes_init(min, max);
 
-        high_memory = __va((max << PAGE_SHIFT) - 1) + 1;
         memblock_dump_all();
 }
 
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index ba38d403abb2..bb32f7f6dd0f 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -148,7 +148,8 @@ static inline int epilogue_offset(const struct jit_ctx *ctx)
 /* Stack must be multiples of 16B */
 #define STACK_ALIGN(sz) (((sz) + 15) & ~15)
 
-#define PROLOGUE_OFFSET 8
+/* Tail call offset to jump into */
+#define PROLOGUE_OFFSET 7
 
 static int build_prologue(struct jit_ctx *ctx)
 {
@@ -200,19 +201,19 @@ static int build_prologue(struct jit_ctx *ctx)
         /* Initialize tail_call_cnt */
         emit(A64_MOVZ(1, tcc, 0, 0), ctx);
 
-        /* 4 byte extra for skb_copy_bits buffer */
-        ctx->stack_size = prog->aux->stack_depth + 4;
-        ctx->stack_size = STACK_ALIGN(ctx->stack_size);
-
-        /* Set up function call stack */
-        emit(A64_SUB_I(1, A64_SP, A64_SP, ctx->stack_size), ctx);
-
         cur_offset = ctx->idx - idx0;
         if (cur_offset != PROLOGUE_OFFSET) {
                 pr_err_once("PROLOGUE_OFFSET = %d, expected %d!\n",
                             cur_offset, PROLOGUE_OFFSET);
                 return -1;
         }
+
+        /* 4 byte extra for skb_copy_bits buffer */
+        ctx->stack_size = prog->aux->stack_depth + 4;
+        ctx->stack_size = STACK_ALIGN(ctx->stack_size);
+
+        /* Set up function call stack */
+        emit(A64_SUB_I(1, A64_SP, A64_SP, ctx->stack_size), ctx);
         return 0;
 }
 
@@ -260,11 +261,12 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx)
         emit(A64_LDR64(prg, tmp, prg), ctx);
         emit(A64_CBZ(1, prg, jmp_offset), ctx);
 
-        /* goto *(prog->bpf_func + prologue_size); */
+        /* goto *(prog->bpf_func + prologue_offset); */
         off = offsetof(struct bpf_prog, bpf_func);
         emit_a64_mov_i64(tmp, off, ctx);
         emit(A64_LDR64(tmp, prg, tmp), ctx);
         emit(A64_ADD_I(1, tmp, tmp, sizeof(u32) * PROLOGUE_OFFSET), ctx);
+        emit(A64_ADD_I(1, A64_SP, A64_SP, ctx->stack_size), ctx);
         emit(A64_BR(tmp), ctx);
 
         /* out: */
diff --git a/arch/blackfin/include/uapi/asm/Kbuild b/arch/blackfin/include/uapi/asm/Kbuild
index aa624b4ab655..2240b38c2915 100644
--- a/arch/blackfin/include/uapi/asm/Kbuild
+++ b/arch/blackfin/include/uapi/asm/Kbuild
@@ -3,6 +3,7 @@ include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += auxvec.h
 generic-y += bitsperlong.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += ioctl.h
 generic-y += ipcbuf.h
diff --git a/arch/c6x/include/uapi/asm/Kbuild b/arch/c6x/include/uapi/asm/Kbuild
index 67ee896a76a7..26644e15d854 100644
--- a/arch/c6x/include/uapi/asm/Kbuild
+++ b/arch/c6x/include/uapi/asm/Kbuild
@@ -3,6 +3,7 @@ include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += auxvec.h
 generic-y += bitsperlong.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += fcntl.h
 generic-y += ioctl.h
diff --git a/arch/cris/include/uapi/asm/Kbuild b/arch/cris/include/uapi/asm/Kbuild
index 3687b54bb18e..3470c6e9c7b9 100644
--- a/arch/cris/include/uapi/asm/Kbuild
+++ b/arch/cris/include/uapi/asm/Kbuild
@@ -3,6 +3,7 @@ include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += auxvec.h
 generic-y += bitsperlong.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += fcntl.h
 generic-y += ioctl.h
diff --git a/arch/frv/include/uapi/asm/Kbuild b/arch/frv/include/uapi/asm/Kbuild
index b15bf6bc0e94..14a2e9af97e9 100644
--- a/arch/frv/include/uapi/asm/Kbuild
+++ b/arch/frv/include/uapi/asm/Kbuild
@@ -1,2 +1,4 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
+
+generic-y += bpf_perf_event.h
diff --git a/arch/h8300/include/uapi/asm/Kbuild b/arch/h8300/include/uapi/asm/Kbuild
index 187aed820e71..2f65f78792cb 100644
--- a/arch/h8300/include/uapi/asm/Kbuild
+++ b/arch/h8300/include/uapi/asm/Kbuild
@@ -2,6 +2,7 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += auxvec.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += fcntl.h
 generic-y += ioctl.h
diff --git a/arch/hexagon/include/uapi/asm/Kbuild b/arch/hexagon/include/uapi/asm/Kbuild
index cb5df3aad3a8..41a176dbb53e 100644
--- a/arch/hexagon/include/uapi/asm/Kbuild
+++ b/arch/hexagon/include/uapi/asm/Kbuild
@@ -2,6 +2,7 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += auxvec.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += fcntl.h
 generic-y += ioctl.h
diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
index 28e02c99be6d..762eeb0fcc1d 100644
--- a/arch/ia64/include/asm/atomic.h
+++ b/arch/ia64/include/asm/atomic.h
@@ -65,29 +65,30 @@ ia64_atomic_fetch_##op (int i, atomic_t *v)				\
 ATOMIC_OPS(add, +)
 ATOMIC_OPS(sub, -)
 
-#define atomic_add_return(i,v)                                          \
+#ifdef __OPTIMIZE__
+#define __ia64_atomic_const(i)  __builtin_constant_p(i) ?               \
+                ((i) == 1 || (i) == 4 || (i) == 8 || (i) == 16 ||       \
+                 (i) == -1 || (i) == -4 || (i) == -8 || (i) == -16) : 0
+
+#define atomic_add_return(i, v)                                         \
 ({                                                                      \
-        int __ia64_aar_i = (i);                                         \
-        (__builtin_constant_p(i)                                        \
-         && (   (__ia64_aar_i ==  1) || (__ia64_aar_i ==   4)           \
-             || (__ia64_aar_i ==  8) || (__ia64_aar_i ==  16)           \
-             || (__ia64_aar_i == -1) || (__ia64_aar_i ==  -4)           \
-             || (__ia64_aar_i == -8) || (__ia64_aar_i == -16)))         \
-                ? ia64_fetch_and_add(__ia64_aar_i, &(v)->counter)       \
-                : ia64_atomic_add(__ia64_aar_i, v);                     \
+        int __i = (i);                                                  \
+        static const int __ia64_atomic_p = __ia64_atomic_const(i);      \
+        __ia64_atomic_p ? ia64_fetch_and_add(__i, &(v)->counter) :      \
+                                ia64_atomic_add(__i, v);                \
 })
 
-#define atomic_sub_return(i,v)                                          \
+#define atomic_sub_return(i, v)                                         \
 ({                                                                      \
-        int __ia64_asr_i = (i);                                         \
-        (__builtin_constant_p(i)                                        \
-         && (   (__ia64_asr_i ==   1) || (__ia64_asr_i ==   4)          \
-             || (__ia64_asr_i ==   8) || (__ia64_asr_i ==  16)          \
-             || (__ia64_asr_i ==  -1) || (__ia64_asr_i ==  -4)          \
-             || (__ia64_asr_i ==  -8) || (__ia64_asr_i == -16)))        \
-                ? ia64_fetch_and_add(-__ia64_asr_i, &(v)->counter)      \
-                : ia64_atomic_sub(__ia64_asr_i, v);                     \
+        int __i = (i);                                                  \
+        static const int __ia64_atomic_p = __ia64_atomic_const(i);      \
+        __ia64_atomic_p ? ia64_fetch_and_add(-__i, &(v)->counter) :     \
+                                ia64_atomic_sub(__i, v);                \
 })
+#else
+#define atomic_add_return(i, v) ia64_atomic_add(i, v)
+#define atomic_sub_return(i, v) ia64_atomic_sub(i, v)
+#endif
 
 #define atomic_fetch_add(i,v)                                           \
 ({                                                                      \
diff --git a/arch/ia64/include/uapi/asm/Kbuild b/arch/ia64/include/uapi/asm/Kbuild
index 13a97aa2285f..f5c6967a93bb 100644
--- a/arch/ia64/include/uapi/asm/Kbuild
+++ b/arch/ia64/include/uapi/asm/Kbuild
@@ -1,4 +1,5 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
 
+generic-y += bpf_perf_event.h
 generic-y += kvm_para.h
diff --git a/arch/ia64/kernel/time.c b/arch/ia64/kernel/time.c
index c6ecb97151a2..9025699049ca 100644
--- a/arch/ia64/kernel/time.c
+++ b/arch/ia64/kernel/time.c
@@ -88,7 +88,7 @@ void vtime_flush(struct task_struct *tsk)
         }
 
         if (ti->softirq_time) {
-                delta = cycle_to_nsec(ti->softirq_time));
+                delta = cycle_to_nsec(ti->softirq_time);
                 account_system_index_time(tsk, delta, CPUTIME_SOFTIRQ);
         }
 
diff --git a/arch/m32r/include/uapi/asm/Kbuild b/arch/m32r/include/uapi/asm/Kbuild
index 1c44d3b3eba0..451bf6071c6e 100644
--- a/arch/m32r/include/uapi/asm/Kbuild
+++ b/arch/m32r/include/uapi/asm/Kbuild
@@ -1,5 +1,6 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
 
+generic-y += bpf_perf_event.h
 generic-y += kvm_para.h
 generic-y += siginfo.h
diff --git a/arch/m32r/kernel/traps.c b/arch/m32r/kernel/traps.c
index cb79fba79d43..b88a8dd14933 100644
--- a/arch/m32r/kernel/traps.c
+++ b/arch/m32r/kernel/traps.c
@@ -122,7 +122,6 @@ void abort(void)
         /* if that doesn't kill us, halt */
         panic("Oops failed to kill thread");
 }
-EXPORT_SYMBOL(abort);
 
 void __init trap_init(void)
 {
diff --git a/arch/m68k/configs/stmark2_defconfig b/arch/m68k/configs/stmark2_defconfig
index 55e55dbc2fb6..3d07b1de7eb0 100644
--- a/arch/m68k/configs/stmark2_defconfig
+++ b/arch/m68k/configs/stmark2_defconfig
@@ -5,7 +5,6 @@ CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_NAMESPACES=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="../uClinux-dist/romfs"
 # CONFIG_RD_BZIP2 is not set
 # CONFIG_RD_LZMA is not set
 # CONFIG_RD_XZ is not set
diff --git a/arch/m68k/include/uapi/asm/Kbuild b/arch/m68k/include/uapi/asm/Kbuild
index 3717b64a620d..c2e26a44c482 100644
--- a/arch/m68k/include/uapi/asm/Kbuild
+++ b/arch/m68k/include/uapi/asm/Kbuild
@@ -3,6 +3,7 @@ include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += auxvec.h
 generic-y += bitsperlong.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += ioctl.h
 generic-y += ipcbuf.h
diff --git a/arch/m68k/kernel/vmlinux-nommu.lds b/arch/m68k/kernel/vmlinux-nommu.lds
index 3aa571a513b5..cf6edda38971 100644
--- a/arch/m68k/kernel/vmlinux-nommu.lds
+++ b/arch/m68k/kernel/vmlinux-nommu.lds
@@ -45,6 +45,8 @@ SECTIONS {
         .text : {
                 HEAD_TEXT
                 TEXT_TEXT
+                IRQENTRY_TEXT
+                SOFTIRQENTRY_TEXT
                 SCHED_TEXT
                 CPUIDLE_TEXT
                 LOCK_TEXT
diff --git a/arch/m68k/kernel/vmlinux-std.lds b/arch/m68k/kernel/vmlinux-std.lds
index 89172b8974b9..625a5785804f 100644
--- a/arch/m68k/kernel/vmlinux-std.lds
+++ b/arch/m68k/kernel/vmlinux-std.lds
@@ -16,6 +16,8 @@ SECTIONS
   .text : {
         HEAD_TEXT
         TEXT_TEXT
+        IRQENTRY_TEXT
+        SOFTIRQENTRY_TEXT
         SCHED_TEXT
         CPUIDLE_TEXT
         LOCK_TEXT
diff --git a/arch/m68k/kernel/vmlinux-sun3.lds b/arch/m68k/kernel/vmlinux-sun3.lds
index 293990efc917..9868270b0984 100644
--- a/arch/m68k/kernel/vmlinux-sun3.lds
+++ b/arch/m68k/kernel/vmlinux-sun3.lds
@@ -16,6 +16,8 @@ SECTIONS
   .text : {
         HEAD_TEXT
         TEXT_TEXT
+        IRQENTRY_TEXT
+        SOFTIRQENTRY_TEXT
         SCHED_TEXT
         CPUIDLE_TEXT
         LOCK_TEXT
diff --git a/arch/metag/include/uapi/asm/Kbuild b/arch/metag/include/uapi/asm/Kbuild
index 6ac763d9a3e3..f9eaf07d29f8 100644
--- a/arch/metag/include/uapi/asm/Kbuild
+++ b/arch/metag/include/uapi/asm/Kbuild
@@ -3,6 +3,7 @@ include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += auxvec.h
 generic-y += bitsperlong.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += fcntl.h
 generic-y += ioctl.h
diff --git a/arch/microblaze/include/uapi/asm/Kbuild b/arch/microblaze/include/uapi/asm/Kbuild
index 06609ca36115..2c6a6bffea32 100644
--- a/arch/microblaze/include/uapi/asm/Kbuild
+++ b/arch/microblaze/include/uapi/asm/Kbuild
@@ -2,6 +2,7 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += bitsperlong.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += fcntl.h
 generic-y += ioctl.h
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 350a990fc719..8e0b3702f1c0 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -259,6 +259,7 @@ config BCM47XX
         select LEDS_GPIO_REGISTER
         select BCM47XX_NVRAM
         select BCM47XX_SPROM
+        select BCM47XX_SSB if !BCM47XX_BCMA
         help
          Support for BCM47XX based boards
 
@@ -389,6 +390,7 @@ config LANTIQ
         select SYS_SUPPORTS_32BIT_KERNEL
         select SYS_SUPPORTS_MIPS16
         select SYS_SUPPORTS_MULTITHREADING
+        select SYS_SUPPORTS_VPE_LOADER
         select SYS_HAS_EARLY_PRINTK
         select GPIOLIB
         select SWAP_IO_SPACE
@@ -516,6 +518,7 @@ config MIPS_MALTA
         select SYS_SUPPORTS_MIPS16
         select SYS_SUPPORTS_MULTITHREADING
         select SYS_SUPPORTS_SMARTMIPS
+        select SYS_SUPPORTS_VPE_LOADER
         select SYS_SUPPORTS_ZBOOT
         select SYS_SUPPORTS_RELOCATABLE
         select USE_OF
@@ -2281,9 +2284,16 @@ config MIPSR2_TO_R6_EMULATOR
           The only reason this is a build-time option is to save ~14K from the
           final kernel image.
 
+config SYS_SUPPORTS_VPE_LOADER
+        bool
+        depends on SYS_SUPPORTS_MULTITHREADING
+        help
+          Indicates that the platform supports the VPE loader, and provides
+          physical_memsize.
+
 config MIPS_VPE_LOADER
         bool "VPE loader support."
-        depends on SYS_SUPPORTS_MULTITHREADING && MODULES
+        depends on SYS_SUPPORTS_VPE_LOADER && MODULES
         select CPU_MIPSR2_IRQ_VI
         select CPU_MIPSR2_IRQ_EI
         select MIPS_MT
diff --git a/arch/mips/Kconfig.debug b/arch/mips/Kconfig.debug
index 464af5e025d6..0749c3724543 100644
--- a/arch/mips/Kconfig.debug
+++ b/arch/mips/Kconfig.debug
@@ -124,30 +124,36 @@ config SCACHE_DEBUGFS
 
           If unsure, say N.
 
-menuconfig MIPS_CPS_NS16550
+menuconfig MIPS_CPS_NS16550_BOOL
         bool "CPS SMP NS16550 UART output"
         depends on MIPS_CPS
         help
           Output debug information via an ns16550 compatible UART if exceptions
           occur early in the boot process of a secondary core.
 
-if MIPS_CPS_NS16550
+if MIPS_CPS_NS16550_BOOL
+
+config MIPS_CPS_NS16550
+        def_bool MIPS_CPS_NS16550_BASE != 0
 
 config MIPS_CPS_NS16550_BASE
         hex "UART Base Address"
         default 0x1b0003f8 if MIPS_MALTA
+        default 0
         help
           The base address of the ns16550 compatible UART on which to output
           debug information from the early stages of core startup.
 
+          This is only used if non-zero.
+
 config MIPS_CPS_NS16550_SHIFT
         int "UART Register Shift"
-        default 0 if MIPS_MALTA
+        default 0
         help
           The number of bits to shift ns16550 register indices by in order to
           form their addresses. That is, log base 2 of the span between
           adjacent ns16550 registers in the system.
 
-endif # MIPS_CPS_NS16550
+endif # MIPS_CPS_NS16550_BOOL
 
 endmenu
diff --git a/arch/mips/ar7/platform.c b/arch/mips/ar7/platform.c
index 4674f1efbe7a..e1675c25d5d4 100644
--- a/arch/mips/ar7/platform.c
+++ b/arch/mips/ar7/platform.c
@@ -575,7 +575,7 @@ static int __init ar7_register_uarts(void)
         uart_port.type          = PORT_AR7;
         uart_port.uartclk       = clk_get_rate(bus_clk) / 2;
         uart_port.iotype        = UPIO_MEM32;
-        uart_port.flags         = UPF_FIXED_TYPE;
+        uart_port.flags         = UPF_FIXED_TYPE | UPF_BOOT_AUTOCONF;
         uart_port.regshift      = 2;
 
         uart_port.line          = 0;
diff --git a/arch/mips/ath25/devices.c b/arch/mips/ath25/devices.c
index e1156347da53..301a9028273c 100644
--- a/arch/mips/ath25/devices.c
+++ b/arch/mips/ath25/devices.c
@@ -73,6 +73,7 @@ const char *get_system_type(void)
 
 void __init ath25_serial_setup(u32 mapbase, int irq, unsigned int uartclk)
 {
+#ifdef CONFIG_SERIAL_8250_CONSOLE
         struct uart_port s;
 
         memset(&s, 0, sizeof(s));
@@ -85,6 +86,7 @@ void __init ath25_serial_setup(u32 mapbase, int irq, unsigned int uartclk)
         s.uartclk = uartclk;
 
         early_serial_setup(&s);
+#endif /* CONFIG_SERIAL_8250_CONSOLE */
 }
 
 int __init ath25_add_wmac(int nr, u32 base, int irq)
diff --git a/arch/mips/include/asm/Kbuild b/arch/mips/include/asm/Kbuild
index 7c8aab23bce8..b1f66699677d 100644
--- a/arch/mips/include/asm/Kbuild
+++ b/arch/mips/include/asm/Kbuild
@@ -16,7 +16,6 @@ generic-y += qrwlock.h
 generic-y += qspinlock.h
 generic-y += sections.h
 generic-y += segment.h
-generic-y += serial.h
 generic-y += trace_clock.h
 generic-y += unaligned.h
 generic-y += user.h
diff --git a/arch/mips/include/asm/serial.h b/arch/mips/include/asm/serial.h
new file mode 100644
index 000000000000..1d830c6666c2
--- /dev/null
+++ b/arch/mips/include/asm/serial.h
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2017 MIPS Tech, LLC
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+#ifndef __ASM__SERIAL_H
+#define __ASM__SERIAL_H
+
+#ifdef CONFIG_MIPS_GENERIC
+/*
+ * Generic kernels cannot know a correct value for all platforms at
+ * compile time. Set it to 0 to prevent 8250_early using it
+ */
+#define BASE_BAUD 0
+#else
+#include <asm-generic/serial.h>
+#endif
+
+#endif /* __ASM__SERIAL_H */
diff --git a/arch/mips/include/uapi/asm/Kbuild b/arch/mips/include/uapi/asm/Kbuild
index a0266feba9e6..7a4becd8963a 100644
--- a/arch/mips/include/uapi/asm/Kbuild
+++ b/arch/mips/include/uapi/asm/Kbuild
@@ -1,4 +1,5 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
 
+generic-y += bpf_perf_event.h
 generic-y += ipcbuf.h
diff --git a/arch/mips/kernel/cps-vec.S b/arch/mips/kernel/cps-vec.S
index c7ed26029cbb..e68e6e04063a 100644
--- a/arch/mips/kernel/cps-vec.S
+++ b/arch/mips/kernel/cps-vec.S
@@ -235,6 +235,7 @@ LEAF(mips_cps_core_init)
         has_mt  t0, 3f
 
         .set    push
+        .set    MIPS_ISA_LEVEL_RAW
         .set    mt
 
         /* Only allow 1 TC per VPE to execute... */
@@ -388,6 +389,7 @@ LEAF(mips_cps_boot_vpes)
 #elif defined(CONFIG_MIPS_MT)
 
         .set    push
+        .set    MIPS_ISA_LEVEL_RAW
         .set    mt
 
         /* If the core doesn't support MT then return */
diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c
index dd5567b1e305..8f5bd04f320a 100644
--- a/arch/mips/kernel/mips-cm.c
+++ b/arch/mips/kernel/mips-cm.c
@@ -292,7 +292,6 @@ void mips_cm_lock_other(unsigned int cluster, unsigned int core,
                                   *this_cpu_ptr(&cm_core_lock_flags));
         } else {
                 WARN_ON(cluster != 0);
-                WARN_ON(vp != 0);
                 WARN_ON(block != CM_GCR_Cx_OTHER_BLOCK_LOCAL);
 
                 /*
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 45d0b6b037ee..57028d49c202 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -705,6 +705,18 @@ int mips_set_process_fp_mode(struct task_struct *task, unsigned int value)
         struct task_struct *t;
         int max_users;
 
+        /* If nothing to change, return right away, successfully.  */
+        if (value == mips_get_process_fp_mode(task))
+                return 0;
+
+        /* Only accept a mode change if 64-bit FP enabled for o32.  */
+        if (!IS_ENABLED(CONFIG_MIPS_O32_FP64_SUPPORT))
+                return -EOPNOTSUPP;
+
+        /* And only for o32 tasks.  */
+        if (IS_ENABLED(CONFIG_64BIT) && !test_thread_flag(TIF_32BIT_REGS))
+                return -EOPNOTSUPP;
+
         /* Check the value is valid */
         if (value & ~known_bits)
                 return -EOPNOTSUPP;
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index efbd8df8b665..0b23b1ad99e6 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -419,63 +419,160 @@ static int gpr64_set(struct task_struct *target,
 
 #endif /* CONFIG_64BIT */
 
+/*
+ * Copy the floating-point context to the supplied NT_PRFPREG buffer,
+ * !CONFIG_CPU_HAS_MSA variant.  FP context's general register slots
+ * correspond 1:1 to buffer slots.  Only general registers are copied.
+ */
+static int fpr_get_fpa(struct task_struct *target,
+                       unsigned int *pos, unsigned int *count,
+                       void **kbuf, void __user **ubuf)
+{
+        return user_regset_copyout(pos, count, kbuf, ubuf,
+                                   &target->thread.fpu,
+                                   0, NUM_FPU_REGS * sizeof(elf_fpreg_t));
+}
+
+/*
+ * Copy the floating-point context to the supplied NT_PRFPREG buffer,
+ * CONFIG_CPU_HAS_MSA variant.  Only lower 64 bits of FP context's
+ * general register slots are copied to buffer slots.  Only general
+ * registers are copied.
+ */
+static int fpr_get_msa(struct task_struct *target,
+                       unsigned int *pos, unsigned int *count,
+                       void **kbuf, void __user **ubuf)
+{
+        unsigned int i;
+        u64 fpr_val;
+        int err;
+
+        BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t));
+        for (i = 0; i < NUM_FPU_REGS; i++) {
+                fpr_val = get_fpr64(&target->thread.fpu.fpr[i], 0);
+                err = user_regset_copyout(pos, count, kbuf, ubuf,
+                                          &fpr_val, i * sizeof(elf_fpreg_t),
+                                          (i + 1) * sizeof(elf_fpreg_t));
+                if (err)
+                        return err;
+        }
+
+        return 0;
+}
+
+/*
+ * Copy the floating-point context to the supplied NT_PRFPREG buffer.
+ * Choose the appropriate helper for general registers, and then copy
+ * the FCSR register separately.
+ */
 static int fpr_get(struct task_struct *target,
                    const struct user_regset *regset,
                    unsigned int pos, unsigned int count,
                    void *kbuf, void __user *ubuf)
 {
-        unsigned i;
+        const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t);
         int err;
-        u64 fpr_val;
 
-        /* XXX fcr31  */
+        if (sizeof(target->thread.fpu.fpr[0]) == sizeof(elf_fpreg_t))
+                err = fpr_get_fpa(target, &pos, &count, &kbuf, &ubuf);
+        else
+                err = fpr_get_msa(target, &pos, &count, &kbuf, &ubuf);
+        if (err)
+                return err;
 
-        if (sizeof(target->thread.fpu.fpr[i]) == sizeof(elf_fpreg_t))
-                return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
-                                           &target->thread.fpu,
-                                           0, sizeof(elf_fpregset_t));
+        err = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
+                                  &target->thread.fpu.fcr31,
+                                  fcr31_pos, fcr31_pos + sizeof(u32));
 
-        for (i = 0; i < NUM_FPU_REGS; i++) {
-                fpr_val = get_fpr64(&target->thread.fpu.fpr[i], 0);
-                err = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
-                                          &fpr_val, i * sizeof(elf_fpreg_t),
-                                          (i + 1) * sizeof(elf_fpreg_t));
+        return err;
+}
+
+/*
+ * Copy the supplied NT_PRFPREG buffer to the floating-point context,
+ * !CONFIG_CPU_HAS_MSA variant.   Buffer slots correspond 1:1 to FP
+ * context's general register slots.  Only general registers are copied.
+ */
+static int fpr_set_fpa(struct task_struct *target,
+                       unsigned int *pos, unsigned int *count,
+                       const void **kbuf, const void __user **ubuf)
+{
+        return user_regset_copyin(pos, count, kbuf, ubuf,
+                                  &target->thread.fpu,
+                                  0, NUM_FPU_REGS * sizeof(elf_fpreg_t));
+}
+
+/*
+ * Copy the supplied NT_PRFPREG buffer to the floating-point context,
+ * CONFIG_CPU_HAS_MSA variant.  Buffer slots are copied to lower 64
+ * bits only of FP context's general register slots.  Only general
+ * registers are copied.
+ */
+static int fpr_set_msa(struct task_struct *target,
+                       unsigned int *pos, unsigned int *count,
+                       const void **kbuf, const void __user **ubuf)
+{
+        unsigned int i;
+        u64 fpr_val;
+        int err;
+
+        BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t));
+        for (i = 0; i < NUM_FPU_REGS && *count > 0; i++) {
+                err = user_regset_copyin(pos, count, kbuf, ubuf,
+                                         &fpr_val, i * sizeof(elf_fpreg_t),
+                                         (i + 1) * sizeof(elf_fpreg_t));
                 if (err)
                         return err;
+                set_fpr64(&target->thread.fpu.fpr[i], 0, fpr_val);
         }
 
         return 0;
 }
 
+/*
+ * Copy the supplied NT_PRFPREG buffer to the floating-point context.
+ * Choose the appropriate helper for general registers, and then copy
+ * the FCSR register separately.
+ *
+ * We optimize for the case where `count % sizeof(elf_fpreg_t) == 0',
+ * which is supposed to have been guaranteed by the kernel before
+ * calling us, e.g. in `ptrace_regset'.  We enforce that requirement,
+ * so that we can safely avoid preinitializing temporaries for
+ * partial register writes.
+ */
 static int fpr_set(struct task_struct *target,
                    const struct user_regset *regset,
                    unsigned int pos, unsigned int count,
                    const void *kbuf, const void __user *ubuf)
 {
-        unsigned i;
+        const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t);
+        u32 fcr31;
         int err;
-        u64 fpr_val;
 
-        /* XXX fcr31  */
+        BUG_ON(count % sizeof(elf_fpreg_t));
+
+        if (pos + count > sizeof(elf_fpregset_t))
+                return -EIO;
 
         init_fp_ctx(target);
 
-        if (sizeof(target->thread.fpu.fpr[i]) == sizeof(elf_fpreg_t))
-                return user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                          &target->thread.fpu,
-                                          0, sizeof(elf_fpregset_t));
+        if (sizeof(target->thread.fpu.fpr[0]) == sizeof(elf_fpreg_t))
+                err = fpr_set_fpa(target, &pos, &count, &kbuf, &ubuf);
+        else
+                err = fpr_set_msa(target, &pos, &count, &kbuf, &ubuf);
+        if (err)
+                return err;
 
-        BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t));
-        for (i = 0; i < NUM_FPU_REGS && count >= sizeof(elf_fpreg_t); i++) {
+        if (count > 0) {
                 err = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                         &fpr_val, i * sizeof(elf_fpreg_t),
-                                         (i + 1) * sizeof(elf_fpreg_t));
+                                         &fcr31,
+                                         fcr31_pos, fcr31_pos + sizeof(u32));
                 if (err)
                         return err;
-                set_fpr64(&target->thread.fpu.fpr[i], 0, fpr_val);
+
+                ptrace_setfcr31(target, fcr31);
         }
 
-        return 0;
+        return err;
 }
 
 enum mips_regset {
diff --git a/arch/mips/lib/Makefile b/arch/mips/lib/Makefile
index 78c2affeabf8..e84e12655fa8 100644
--- a/arch/mips/lib/Makefile
+++ b/arch/mips/lib/Makefile
@@ -16,4 +16,5 @@ obj-$(CONFIG_CPU_R3000)		+= r3k_dump_tlb.o
 obj-$(CONFIG_CPU_TX39XX)        += r3k_dump_tlb.o
 
 # libgcc-style stuff needed in the kernel
-obj-y += ashldi3.o ashrdi3.o bswapsi.o bswapdi.o cmpdi2.o lshrdi3.o ucmpdi2.o
+obj-y += ashldi3.o ashrdi3.o bswapsi.o bswapdi.o cmpdi2.o lshrdi3.o multi3.o \
+         ucmpdi2.o
diff --git a/arch/mips/lib/libgcc.h b/arch/mips/lib/libgcc.h
index 28002ed90c2c..199a7f96282f 100644
--- a/arch/mips/lib/libgcc.h
+++ b/arch/mips/lib/libgcc.h
@@ -10,10 +10,18 @@ typedef int word_type __attribute__ ((mode (__word__)));
 struct DWstruct {
         int high, low;
 };
+
+struct TWstruct {
+        long long high, low;
+};
 #elif defined(__LITTLE_ENDIAN)
 struct DWstruct {
         int low, high;
 };
+
+struct TWstruct {
+        long long low, high;
+};
 #else
 #error I feel sick.
 #endif
@@ -23,4 +31,13 @@ typedef union {
         long long ll;
 } DWunion;
 
+#if defined(CONFIG_64BIT) && defined(CONFIG_CPU_MIPSR6)
+typedef int ti_type __attribute__((mode(TI)));
+
+typedef union {
+        struct TWstruct s;
+        ti_type ti;
+} TWunion;
+#endif
+
 #endif /* __ASM_LIBGCC_H */
diff --git a/arch/mips/lib/multi3.c b/arch/mips/lib/multi3.c
new file mode 100644
index 000000000000..111ad475aa0c
--- /dev/null
+++ b/arch/mips/lib/multi3.c
@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/export.h>
+
+#include "libgcc.h"
+
+/*
+ * GCC 7 suboptimally generates __multi3 calls for mips64r6, so for that
+ * specific case only we'll implement it here.
+ *
+ * See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82981
+ */
+#if defined(CONFIG_64BIT) && defined(CONFIG_CPU_MIPSR6) && (__GNUC__ == 7)
+
+/* multiply 64-bit values, low 64-bits returned */
+static inline long long notrace dmulu(long long a, long long b)
+{
+        long long res;
+
+        asm ("dmulu %0,%1,%2" : "=r" (res) : "r" (a), "r" (b));
+        return res;
+}
+
+/* multiply 64-bit unsigned values, high 64-bits of 128-bit result returned */
+static inline long long notrace dmuhu(long long a, long long b)
+{
+        long long res;
+
+        asm ("dmuhu %0,%1,%2" : "=r" (res) : "r" (a), "r" (b));
+        return res;
+}
+
+/* multiply 128-bit values, low 128-bits returned */
+ti_type notrace __multi3(ti_type a, ti_type b)
+{
+        TWunion res, aa, bb;
+
+        aa.ti = a;
+        bb.ti = b;
+
+        /*
+         * a * b =           (a.lo * b.lo)
+         *         + 2^64  * (a.hi * b.lo + a.lo * b.hi)
+         *        [+ 2^128 * (a.hi * b.hi)]
+         */
+        res.s.low = dmulu(aa.s.low, bb.s.low);
+        res.s.high = dmuhu(aa.s.low, bb.s.low);
+        res.s.high += dmulu(aa.s.high, bb.s.low);
+        res.s.high += dmulu(aa.s.low, bb.s.high);
+
+        return res.ti;
+}
+EXPORT_SYMBOL(__multi3);
+
+#endif /* 64BIT && CPU_MIPSR6 && GCC7 */
diff --git a/arch/mips/mm/uasm-micromips.c b/arch/mips/mm/uasm-micromips.c
index cdb5a191b9d5..9bb6baa45da3 100644
--- a/arch/mips/mm/uasm-micromips.c
+++ b/arch/mips/mm/uasm-micromips.c
@@ -40,7 +40,7 @@
 
 #include "uasm.c"
 
-static const struct insn const insn_table_MM[insn_invalid] = {
+static const struct insn insn_table_MM[insn_invalid] = {
         [insn_addu]     = {M(mm_pool32a_op, 0, 0, 0, 0, mm_addu32_op), RT | RS | RD},
         [insn_addiu]    = {M(mm_addiu32_op, 0, 0, 0, 0, 0), RT | RS | SIMM},
         [insn_and]      = {M(mm_pool32a_op, 0, 0, 0, 0, mm_and_op), RT | RS | RD},
diff --git a/arch/mips/ralink/timer.c b/arch/mips/ralink/timer.c
index d4469b20d176..4f46a4509f79 100644
--- a/arch/mips/ralink/timer.c
+++ b/arch/mips/ralink/timer.c
@@ -109,9 +109,9 @@ static int rt_timer_probe(struct platform_device *pdev)
         }
 
         rt->irq = platform_get_irq(pdev, 0);
-        if (!rt->irq) {
+        if (rt->irq < 0) {
                 dev_err(&pdev->dev, "failed to load irq\n");
-                return -ENOENT;
+                return rt->irq;
         }
 
         rt->membase = devm_ioremap_resource(&pdev->dev, res);
diff --git a/arch/mips/rb532/Makefile b/arch/mips/rb532/Makefile
index efdecdb6e3ea..8186afca2234 100644
--- a/arch/mips/rb532/Makefile
+++ b/arch/mips/rb532/Makefile
@@ -2,4 +2,6 @@
 # Makefile for the RB532 board specific parts of the kernel
 #
 
-obj-y    += irq.o time.o setup.o serial.o prom.o gpio.o devices.o
+obj-$(CONFIG_SERIAL_8250_CONSOLE) += serial.o
+
+obj-y    += irq.o time.o setup.o prom.o gpio.o devices.o
diff --git a/arch/mips/rb532/devices.c b/arch/mips/rb532/devices.c
index 32ea3e6731d6..354d258396ff 100644
--- a/arch/mips/rb532/devices.c
+++ b/arch/mips/rb532/devices.c
@@ -310,6 +310,8 @@ static int __init plat_setup_devices(void)
         return platform_add_devices(rb532_devs, ARRAY_SIZE(rb532_devs));
 }
 
+#ifdef CONFIG_NET
+
 static int __init setup_kmac(char *s)
 {
         printk(KERN_INFO "korina mac = %s\n", s);
@@ -322,4 +324,6 @@ static int __init setup_kmac(char *s)
 
 __setup("kmac=", setup_kmac);
 
+#endif /* CONFIG_NET */
+
 arch_initcall(plat_setup_devices);
diff --git a/arch/mn10300/include/uapi/asm/Kbuild b/arch/mn10300/include/uapi/asm/Kbuild
index c94ee54210bc..81271d3af47c 100644
--- a/arch/mn10300/include/uapi/asm/Kbuild
+++ b/arch/mn10300/include/uapi/asm/Kbuild
@@ -1,4 +1,5 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
 
+generic-y       += bpf_perf_event.h
 generic-y       += siginfo.h
diff --git a/arch/nios2/include/uapi/asm/Kbuild b/arch/nios2/include/uapi/asm/Kbuild
index ffca24da7647..13a3d77b4d7b 100644
--- a/arch/nios2/include/uapi/asm/Kbuild
+++ b/arch/nios2/include/uapi/asm/Kbuild
@@ -3,6 +3,7 @@ include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += auxvec.h
 generic-y += bitsperlong.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += fcntl.h
 generic-y += ioctl.h
diff --git a/arch/openrisc/include/uapi/asm/Kbuild b/arch/openrisc/include/uapi/asm/Kbuild
index 62286dbeb904..130c16ccba0a 100644
--- a/arch/openrisc/include/uapi/asm/Kbuild
+++ b/arch/openrisc/include/uapi/asm/Kbuild
@@ -3,6 +3,7 @@ include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += auxvec.h
 generic-y += bitsperlong.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += fcntl.h
 generic-y += ioctl.h
diff --git a/arch/parisc/boot/compressed/misc.c b/arch/parisc/boot/compressed/misc.c
index 9345b44b86f0..f57118e1f6b4 100644
--- a/arch/parisc/boot/compressed/misc.c
+++ b/arch/parisc/boot/compressed/misc.c
@@ -123,8 +123,8 @@ int puts(const char *s)
         while ((nuline = strchr(s, '\n')) != NULL) {
                 if (nuline != s)
                         pdc_iodc_print(s, nuline - s);
-                        pdc_iodc_print("\r\n", 2);
-                        s = nuline + 1;
+                pdc_iodc_print("\r\n", 2);
+                s = nuline + 1;
         }
         if (*s != '\0')
                 pdc_iodc_print(s, strlen(s));
diff --git a/arch/parisc/include/asm/ldcw.h b/arch/parisc/include/asm/ldcw.h
index dd5a08aaa4da..3eb4bfc1fb36 100644
--- a/arch/parisc/include/asm/ldcw.h
+++ b/arch/parisc/include/asm/ldcw.h
@@ -12,6 +12,7 @@
    for the semaphore.  */
 
 #define __PA_LDCW_ALIGNMENT     16
+#define __PA_LDCW_ALIGN_ORDER   4
 #define __ldcw_align(a) ({                                      \
         unsigned long __ret = (unsigned long) &(a)->lock[0];    \
         __ret = (__ret + __PA_LDCW_ALIGNMENT - 1)               \
@@ -29,6 +30,7 @@
    ldcd). */
 
 #define __PA_LDCW_ALIGNMENT     4
+#define __PA_LDCW_ALIGN_ORDER   2
 #define __ldcw_align(a) (&(a)->slock)
 #define __LDCW  "ldcw,co"
 
diff --git a/arch/parisc/include/asm/thread_info.h b/arch/parisc/include/asm/thread_info.h
index c980a02a52bc..598c8d60fa5e 100644
--- a/arch/parisc/include/asm/thread_info.h
+++ b/arch/parisc/include/asm/thread_info.h
@@ -35,7 +35,12 @@ struct thread_info {
 
 /* thread information allocation */
 
+#ifdef CONFIG_IRQSTACKS
+#define THREAD_SIZE_ORDER       2 /* PA-RISC requires at least 16k stack */
+#else
 #define THREAD_SIZE_ORDER       3 /* PA-RISC requires at least 32k stack */
+#endif
+
 /* Be sure to hunt all references to this down when you change the size of
  * the kernel stack */
 #define THREAD_SIZE             (PAGE_SIZE << THREAD_SIZE_ORDER)
diff --git a/arch/parisc/include/uapi/asm/Kbuild b/arch/parisc/include/uapi/asm/Kbuild
index 196d2a4efb31..286ef5a5904b 100644
--- a/arch/parisc/include/uapi/asm/Kbuild
+++ b/arch/parisc/include/uapi/asm/Kbuild
@@ -2,6 +2,7 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += auxvec.h
+generic-y += bpf_perf_event.h
 generic-y += kvm_para.h
 generic-y += param.h
 generic-y += poll.h
diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
index d8f77358e2ba..29b99b8964aa 100644
--- a/arch/parisc/kernel/drivers.c
+++ b/arch/parisc/kernel/drivers.c
@@ -870,7 +870,7 @@ static void print_parisc_device(struct parisc_device *dev)
         static int count;
 
         print_pa_hwpath(dev, hw_path);
-        printk(KERN_INFO "%d. %s at 0x%p [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }",
+        printk(KERN_INFO "%d. %s at 0x%px [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }",
                 ++count, dev->name, (void*) dev->hpa.start, hw_path, dev->id.hw_type,
                 dev->id.hversion_rev, dev->id.hversion, dev->id.sversion);
 
diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index a4fd296c958e..e95207c0565e 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -35,6 +35,7 @@
 #include <asm/pgtable.h>
 #include <asm/signal.h>
 #include <asm/unistd.h>
+#include <asm/ldcw.h>
 #include <asm/thread_info.h>
 
 #include <linux/linkage.h>
@@ -46,6 +47,14 @@
 #endif
 
         .import         pa_tlb_lock,data
+        .macro  load_pa_tlb_lock reg
+#if __PA_LDCW_ALIGNMENT > 4
+        load32  PA(pa_tlb_lock) + __PA_LDCW_ALIGNMENT-1, \reg
+        depi    0,31,__PA_LDCW_ALIGN_ORDER, \reg
+#else
+        load32  PA(pa_tlb_lock), \reg
+#endif
+        .endm
 
         /* space_to_prot macro creates a prot id from a space id */
 
@@ -457,7 +466,7 @@
         .macro          tlb_lock        spc,ptp,pte,tmp,tmp1,fault
 #ifdef CONFIG_SMP
         cmpib,COND(=),n 0,\spc,2f
-        load32          PA(pa_tlb_lock),\tmp
+        load_pa_tlb_lock \tmp
 1:      LDCW            0(\tmp),\tmp1
         cmpib,COND(=)   0,\tmp1,1b
         nop
@@ -480,7 +489,7 @@
         /* Release pa_tlb_lock lock. */
         .macro          tlb_unlock1     spc,tmp
 #ifdef CONFIG_SMP
-        load32          PA(pa_tlb_lock),\tmp
+        load_pa_tlb_lock \tmp
         tlb_unlock0     \spc,\tmp
 #endif
         .endm
@@ -878,9 +887,6 @@ ENTRY_CFI(syscall_exit_rfi)
         STREG   %r19,PT_SR7(%r16)
 
 intr_return:
-        /* NOTE: Need to enable interrupts incase we schedule. */
-        ssm     PSW_SM_I, %r0
-
         /* check for reschedule */
         mfctl   %cr30,%r1
         LDREG   TI_FLAGS(%r1),%r19      /* sched.h: TIF_NEED_RESCHED */
@@ -907,6 +913,11 @@ intr_check_sig:
         LDREG   PT_IASQ1(%r16), %r20
         cmpib,COND(=),n 0,%r20,intr_restore /* backward */
 
+        /* NOTE: We need to enable interrupts if we have to deliver
+         * signals. We used to do this earlier but it caused kernel
+         * stack overflows. */
+        ssm     PSW_SM_I, %r0
+
         copy    %r0, %r25                       /* long in_syscall = 0 */
 #ifdef CONFIG_64BIT
         ldo     -16(%r30),%r29                  /* Reference param save area */
@@ -958,6 +969,10 @@ intr_do_resched:
         cmpib,COND(=)   0, %r20, intr_do_preempt
         nop
 
+        /* NOTE: We need to enable interrupts if we schedule.  We used
+         * to do this earlier but it caused kernel stack overflows. */
+        ssm     PSW_SM_I, %r0
+
 #ifdef CONFIG_64BIT
         ldo     -16(%r30),%r29          /* Reference param save area */
 #endif
diff --git a/arch/parisc/kernel/hpmc.S b/arch/parisc/kernel/hpmc.S
index e3a8e5e4d5de..8d072c44f300 100644
--- a/arch/parisc/kernel/hpmc.S
+++ b/arch/parisc/kernel/hpmc.S
@@ -305,6 +305,7 @@ ENDPROC_CFI(os_hpmc)
 
 
         __INITRODATA
+        .align 4
         .export os_hpmc_size
 os_hpmc_size:
         .word .os_hpmc_end-.os_hpmc
diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S
index adf7187f8951..2d40c4ff3f69 100644
--- a/arch/parisc/kernel/pacache.S
+++ b/arch/parisc/kernel/pacache.S
@@ -36,6 +36,7 @@
 #include <asm/assembly.h>
 #include <asm/pgtable.h>
 #include <asm/cache.h>
+#include <asm/ldcw.h>
 #include <linux/linkage.h>
 
         .text
@@ -333,8 +334,12 @@ ENDPROC_CFI(flush_data_cache_local)
 
         .macro  tlb_lock        la,flags,tmp
 #ifdef CONFIG_SMP
-        ldil            L%pa_tlb_lock,%r1
-        ldo             R%pa_tlb_lock(%r1),\la
+#if __PA_LDCW_ALIGNMENT > 4
+        load32          pa_tlb_lock + __PA_LDCW_ALIGNMENT-1, \la
+        depi            0,31,__PA_LDCW_ALIGN_ORDER, \la
+#else
+        load32          pa_tlb_lock, \la
+#endif
         rsm             PSW_SM_I,\flags
 1:      LDCW            0(\la),\tmp
         cmpib,<>,n      0,\tmp,3f
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index 30f92391a93e..cad3e8661cd6 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -39,6 +39,7 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/fs.h>
+#include <linux/cpu.h>
 #include <linux/module.h>
 #include <linux/personality.h>
 #include <linux/ptrace.h>
@@ -184,6 +185,44 @@ int dump_task_fpu (struct task_struct *tsk, elf_fpregset_t *r)
 }
 
 /*
+ * Idle thread support
+ *
+ * Detect when running on QEMU with SeaBIOS PDC Firmware and let
+ * QEMU idle the host too.
+ */
+
+int running_on_qemu __read_mostly;
+
+void __cpuidle arch_cpu_idle_dead(void)
+{
+        /* nop on real hardware, qemu will offline CPU. */
+        asm volatile("or %%r31,%%r31,%%r31\n":::);
+}
+
+void __cpuidle arch_cpu_idle(void)
+{
+        local_irq_enable();
+
+        /* nop on real hardware, qemu will idle sleep. */
+        asm volatile("or %%r10,%%r10,%%r10\n":::);
+}
+
+static int __init parisc_idle_init(void)
+{
+        const char *marker;
+
+        /* check QEMU/SeaBIOS marker in PAGE0 */
+        marker = (char *) &PAGE0->pad0;
+        running_on_qemu = (memcmp(marker, "SeaBIOS", 8) == 0);
+
+        if (!running_on_qemu)
+                cpu_idle_poll_ctrl(1);
+
+        return 0;
+}
+arch_initcall(parisc_idle_init);
+
+/*
  * Copy architecture-specific thread state
  */
 int
diff --git a/arch/parisc/kernel/unwind.c b/arch/parisc/kernel/unwind.c
index 5a657986ebbf..143f90e2f9f3 100644
--- a/arch/parisc/kernel/unwind.c
+++ b/arch/parisc/kernel/unwind.c
@@ -15,7 +15,6 @@
 #include <linux/slab.h>
 #include <linux/kallsyms.h>
 #include <linux/sort.h>
-#include <linux/sched.h>
 
 #include <linux/uaccess.h>
 #include <asm/assembly.h>
diff --git a/arch/parisc/lib/delay.c b/arch/parisc/lib/delay.c
index 7eab4bb8abe6..66e506520505 100644
--- a/arch/parisc/lib/delay.c
+++ b/arch/parisc/lib/delay.c
@@ -16,9 +16,7 @@
 #include <linux/preempt.h>
 #include <linux/init.h>
 
-#include <asm/processor.h>
 #include <asm/delay.h>
-
 #include <asm/special_insns.h>    /* for mfctl() */
 #include <asm/processor.h> /* for boot_cpu_data */
 
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index 13f7854e0d49..48f41399fc0b 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -631,11 +631,11 @@ void __init mem_init(void)
         mem_init_print_info(NULL);
 #ifdef CONFIG_DEBUG_KERNEL /* double-sanity-check paranoia */
         printk("virtual kernel memory layout:\n"
-               "    vmalloc : 0x%p - 0x%p   (%4ld MB)\n"
-               "    memory  : 0x%p - 0x%p   (%4ld MB)\n"
-               "      .init : 0x%p - 0x%p   (%4ld kB)\n"
-               "      .data : 0x%p - 0x%p   (%4ld kB)\n"
-               "      .text : 0x%p - 0x%p   (%4ld kB)\n",
+               "    vmalloc : 0x%px - 0x%px   (%4ld MB)\n"
+               "    memory  : 0x%px - 0x%px   (%4ld MB)\n"
+               "      .init : 0x%px - 0x%px   (%4ld kB)\n"
+               "      .data : 0x%px - 0x%px   (%4ld kB)\n"
+               "      .text : 0x%px - 0x%px   (%4ld kB)\n",
 
                (void*)VMALLOC_START, (void*)VMALLOC_END,
                (VMALLOC_END - VMALLOC_START) >> 20,
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index c51e6ce42e7a..2ed525a44734 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -166,6 +166,7 @@ config PPC
         select GENERIC_CLOCKEVENTS_BROADCAST    if SMP
         select GENERIC_CMOS_UPDATE
         select GENERIC_CPU_AUTOPROBE
+        select GENERIC_CPU_VULNERABILITIES      if PPC_BOOK3S_64
         select GENERIC_IRQ_SHOW
         select GENERIC_IRQ_SHOW_LEVEL
         select GENERIC_SMP_IDLE_THREAD
diff --git a/arch/powerpc/include/asm/exception-64e.h b/arch/powerpc/include/asm/exception-64e.h
index a703452d67b6..555e22d5e07f 100644
--- a/arch/powerpc/include/asm/exception-64e.h
+++ b/arch/powerpc/include/asm/exception-64e.h
@@ -209,5 +209,11 @@ exc_##label##_book3e:
         ori     r3,r3,vector_offset@l;          \
         mtspr   SPRN_IVOR##vector_number,r3;
 
+#define RFI_TO_KERNEL                                                   \
+        rfi
+
+#define RFI_TO_USER                                                     \
+        rfi
+
 #endif /* _ASM_POWERPC_EXCEPTION_64E_H */
 
diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
index b27205297e1d..7197b179c1b1 100644
--- a/arch/powerpc/include/asm/exception-64s.h
+++ b/arch/powerpc/include/asm/exception-64s.h
@@ -74,6 +74,59 @@
  */
 #define EX_R3           EX_DAR
 
+/*
+ * Macros for annotating the expected destination of (h)rfid
+ *
+ * The nop instructions allow us to insert one or more instructions to flush the
+ * L1-D cache when returning to userspace or a guest.
+ */
+#define RFI_FLUSH_SLOT                                                  \
+        RFI_FLUSH_FIXUP_SECTION;                                        \
+        nop;                                                            \
+        nop;                                                            \
+        nop
+
+#define RFI_TO_KERNEL                                                   \
+        rfid
+
+#define RFI_TO_USER                                                     \
+        RFI_FLUSH_SLOT;                                                 \
+        rfid;                                                           \
+        b       rfi_flush_fallback
+
+#define RFI_TO_USER_OR_KERNEL                                           \
+        RFI_FLUSH_SLOT;                                                 \
+        rfid;                                                           \
+        b       rfi_flush_fallback
+
+#define RFI_TO_GUEST                                                    \
+        RFI_FLUSH_SLOT;                                                 \
+        rfid;                                                           \
+        b       rfi_flush_fallback
+
+#define HRFI_TO_KERNEL                                                  \
+        hrfid
+
+#define HRFI_TO_USER                                                    \
+        RFI_FLUSH_SLOT;                                                 \
+        hrfid;                                                          \
+        b       hrfi_flush_fallback
+
+#define HRFI_TO_USER_OR_KERNEL                                          \
+        RFI_FLUSH_SLOT;                                                 \
+        hrfid;                                                          \
+        b       hrfi_flush_fallback
+
+#define HRFI_TO_GUEST                                                   \
+        RFI_FLUSH_SLOT;                                                 \
+        hrfid;                                                          \
+        b       hrfi_flush_fallback
+
+#define HRFI_TO_UNKNOWN                                                 \
+        RFI_FLUSH_SLOT;                                                 \
+        hrfid;                                                          \
+        b       hrfi_flush_fallback
+
 #ifdef CONFIG_RELOCATABLE
 #define __EXCEPTION_RELON_PROLOG_PSERIES_1(label, h)                    \
         mfspr   r11,SPRN_##h##SRR0;     /* save SRR0 */                 \
@@ -218,7 +271,7 @@ END_FTR_SECTION_NESTED(ftr,ftr,943)
         mtspr   SPRN_##h##SRR0,r12;                                     \
         mfspr   r12,SPRN_##h##SRR1;     /* and SRR1 */                  \
         mtspr   SPRN_##h##SRR1,r10;                                     \
-        h##rfid;                                                        \
+        h##RFI_TO_KERNEL;                                               \
         b       .       /* prevent speculative execution */
 #define EXCEPTION_PROLOG_PSERIES_1(label, h)                            \
         __EXCEPTION_PROLOG_PSERIES_1(label, h)
@@ -232,7 +285,7 @@ END_FTR_SECTION_NESTED(ftr,ftr,943)
         mtspr   SPRN_##h##SRR0,r12;                                     \
         mfspr   r12,SPRN_##h##SRR1;     /* and SRR1 */                  \
         mtspr   SPRN_##h##SRR1,r10;                                     \
-        h##rfid;                                                        \
+        h##RFI_TO_KERNEL;                                               \
         b       .       /* prevent speculative execution */
 
 #define EXCEPTION_PROLOG_PSERIES_1_NORI(label, h)                       \
diff --git a/arch/powerpc/include/asm/feature-fixups.h b/arch/powerpc/include/asm/feature-fixups.h
index 8f88f771cc55..1e82eb3caabd 100644
--- a/arch/powerpc/include/asm/feature-fixups.h
+++ b/arch/powerpc/include/asm/feature-fixups.h
@@ -187,7 +187,20 @@ label##3:					       	\
         FTR_ENTRY_OFFSET label##1b-label##3b;           \
         .popsection;
 
+#define RFI_FLUSH_FIXUP_SECTION                         \
+951:                                                    \
+        .pushsection __rfi_flush_fixup,"a";             \
+        .align 2;                                       \
+952:                                                    \
+        FTR_ENTRY_OFFSET 951b-952b;                     \
+        .popsection;
+
+
 #ifndef __ASSEMBLY__
+#include <linux/types.h>
+
+extern long __start___rfi_flush_fixup, __stop___rfi_flush_fixup;
+
 void apply_feature_fixups(void);
 void setup_feature_keys(void);
 #endif
diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h
index a409177be8bd..eca3f9c68907 100644
--- a/arch/powerpc/include/asm/hvcall.h
+++ b/arch/powerpc/include/asm/hvcall.h
@@ -241,6 +241,7 @@
 #define H_GET_HCA_INFO          0x1B8
 #define H_GET_PERF_COUNT        0x1BC
 #define H_MANAGE_TRACE          0x1C0
+#define H_GET_CPU_CHARACTERISTICS 0x1C8
 #define H_FREE_LOGICAL_LAN_BUFFER 0x1D4
 #define H_QUERY_INT_STATE       0x1E4
 #define H_POLL_PENDING          0x1D8
@@ -330,6 +331,17 @@
 #define H_SIGNAL_SYS_RESET_ALL_OTHERS           -2
 /* >= 0 values are CPU number */
 
+/* H_GET_CPU_CHARACTERISTICS return values */
+#define H_CPU_CHAR_SPEC_BAR_ORI31       (1ull << 63) // IBM bit 0
+#define H_CPU_CHAR_BCCTRL_SERIALISED    (1ull << 62) // IBM bit 1
+#define H_CPU_CHAR_L1D_FLUSH_ORI30      (1ull << 61) // IBM bit 2
+#define H_CPU_CHAR_L1D_FLUSH_TRIG2      (1ull << 60) // IBM bit 3
+#define H_CPU_CHAR_L1D_THREAD_PRIV      (1ull << 59) // IBM bit 4
+
+#define H_CPU_BEHAV_FAVOUR_SECURITY     (1ull << 63) // IBM bit 0
+#define H_CPU_BEHAV_L1D_FLUSH_PR        (1ull << 62) // IBM bit 1
+#define H_CPU_BEHAV_BNDS_CHK_SPEC_BAR   (1ull << 61) // IBM bit 2
+
 /* Flag values used in H_REGISTER_PROC_TBL hcall */
 #define PROC_TABLE_OP_MASK      0x18
 #define PROC_TABLE_DEREG        0x10
@@ -341,6 +353,7 @@
 #define PROC_TABLE_GTSE         0x01
 
 #ifndef __ASSEMBLY__
+#include <linux/types.h>
 
 /**
  * plpar_hcall_norets: - Make a pseries hypervisor call with no return arguments
@@ -436,6 +449,11 @@ static inline unsigned int get_longbusy_msecs(int longbusy_rc)
         }
 }
 
+struct h_cpu_char_result {
+        u64 character;
+        u64 behaviour;
+};
+
 #endif /* __ASSEMBLY__ */
 #endif /* __KERNEL__ */
 #endif /* _ASM_POWERPC_HVCALL_H */
diff --git a/arch/powerpc/include/asm/machdep.h b/arch/powerpc/include/asm/machdep.h
index 73b92017b6d7..cd2fc1cc1cc7 100644
--- a/arch/powerpc/include/asm/machdep.h
+++ b/arch/powerpc/include/asm/machdep.h
@@ -76,6 +76,7 @@ struct machdep_calls {
 
         void __noreturn (*restart)(char *cmd);
         void __noreturn (*halt)(void);
+        void            (*panic)(char *str);
         void            (*cpu_die)(void);
 
         long            (*time_init)(void); /* Optional, may be NULL */
diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
index 6177d43f0ce8..e2a2b8400490 100644
--- a/arch/powerpc/include/asm/mmu_context.h
+++ b/arch/powerpc/include/asm/mmu_context.h
@@ -160,9 +160,10 @@ static inline void enter_lazy_tlb(struct mm_struct *mm,
 #endif
 }
 
-static inline void arch_dup_mmap(struct mm_struct *oldmm,
-                                 struct mm_struct *mm)
+static inline int arch_dup_mmap(struct mm_struct *oldmm,
+                                struct mm_struct *mm)
 {
+        return 0;
 }
 
 #ifndef CONFIG_PPC_BOOK3S_64
diff --git a/arch/powerpc/include/asm/paca.h b/arch/powerpc/include/asm/paca.h
index 3892db93b837..23ac7fc0af23 100644
--- a/arch/powerpc/include/asm/paca.h
+++ b/arch/powerpc/include/asm/paca.h
@@ -232,6 +232,16 @@ struct paca_struct {
         struct sibling_subcore_state *sibling_subcore_state;
 #endif
 #endif
+#ifdef CONFIG_PPC_BOOK3S_64
+        /*
+         * rfi fallback flush must be in its own cacheline to prevent
+         * other paca data leaking into the L1d
+         */
+        u64 exrfi[EX_SIZE] __aligned(0x80);
+        void *rfi_flush_fallback_area;
+        u64 l1d_flush_congruence;
+        u64 l1d_flush_sets;
+#endif
 };
 
 extern void copy_mm_to_paca(struct mm_struct *mm);
diff --git a/arch/powerpc/include/asm/plpar_wrappers.h b/arch/powerpc/include/asm/plpar_wrappers.h
index 7f01b22fa6cb..55eddf50d149 100644
--- a/arch/powerpc/include/asm/plpar_wrappers.h
+++ b/arch/powerpc/include/asm/plpar_wrappers.h
@@ -326,4 +326,18 @@ static inline long plapr_signal_sys_reset(long cpu)
         return plpar_hcall_norets(H_SIGNAL_SYS_RESET, cpu);
 }
 
+static inline long plpar_get_cpu_characteristics(struct h_cpu_char_result *p)
+{
+        unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
+        long rc;
+
+        rc = plpar_hcall(H_GET_CPU_CHARACTERISTICS, retbuf);
+        if (rc == H_SUCCESS) {
+                p->character = retbuf[0];
+                p->behaviour = retbuf[1];
+        }
+
+        return rc;
+}
+
 #endif /* _ASM_POWERPC_PLPAR_WRAPPERS_H */
diff --git a/arch/powerpc/include/asm/setup.h b/arch/powerpc/include/asm/setup.h
index 257d23dbf55d..469b7fdc9be4 100644
--- a/arch/powerpc/include/asm/setup.h
+++ b/arch/powerpc/include/asm/setup.h
@@ -24,6 +24,7 @@ extern void reloc_got2(unsigned long);
 
 void check_for_initrd(void);
 void initmem_init(void);
+void setup_panic(void);
 #define ARCH_PANIC_TIMEOUT 180
 
 #ifdef CONFIG_PPC_PSERIES
@@ -38,6 +39,19 @@ static inline void pseries_big_endian_exceptions(void) {}
 static inline void pseries_little_endian_exceptions(void) {}
 #endif /* CONFIG_PPC_PSERIES */
 
+void rfi_flush_enable(bool enable);
+
+/* These are bit flags */
+enum l1d_flush_type {
+        L1D_FLUSH_NONE          = 0x1,
+        L1D_FLUSH_FALLBACK      = 0x2,
+        L1D_FLUSH_ORI           = 0x4,
+        L1D_FLUSH_MTTRIG        = 0x8,
+};
+
+void __init setup_rfi_flush(enum l1d_flush_type, bool enable);
+void do_rfi_flush_fixups(enum l1d_flush_type types);
+
 #endif /* !__ASSEMBLY__ */
 
 #endif  /* _ASM_POWERPC_SETUP_H */
diff --git a/arch/powerpc/include/uapi/asm/Kbuild b/arch/powerpc/include/uapi/asm/Kbuild
index 0d960ef78a9a..1a6ed5919ffd 100644
--- a/arch/powerpc/include/uapi/asm/Kbuild
+++ b/arch/powerpc/include/uapi/asm/Kbuild
@@ -1,6 +1,7 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
 
+generic-y += bpf_perf_event.h
 generic-y += param.h
 generic-y += poll.h
 generic-y += resource.h
diff --git a/arch/powerpc/include/uapi/asm/kvm.h b/arch/powerpc/include/uapi/asm/kvm.h
index 61d6049f4c1e..637b7263cb86 100644
--- a/arch/powerpc/include/uapi/asm/kvm.h
+++ b/arch/powerpc/include/uapi/asm/kvm.h
@@ -443,6 +443,31 @@ struct kvm_ppc_rmmu_info {
         __u32   ap_encodings[8];
 };
 
+/* For KVM_PPC_GET_CPU_CHAR */
+struct kvm_ppc_cpu_char {
+        __u64   character;              /* characteristics of the CPU */
+        __u64   behaviour;              /* recommended software behaviour */
+        __u64   character_mask;         /* valid bits in character */
+        __u64   behaviour_mask;         /* valid bits in behaviour */
+};
+
+/*
+ * Values for character and character_mask.
+ * These are identical to the values used by H_GET_CPU_CHARACTERISTICS.
+ */
+#define KVM_PPC_CPU_CHAR_SPEC_BAR_ORI31         (1ULL << 63)
+#define KVM_PPC_CPU_CHAR_BCCTRL_SERIALISED      (1ULL << 62)
+#define KVM_PPC_CPU_CHAR_L1D_FLUSH_ORI30        (1ULL << 61)
+#define KVM_PPC_CPU_CHAR_L1D_FLUSH_TRIG2        (1ULL << 60)
+#define KVM_PPC_CPU_CHAR_L1D_THREAD_PRIV        (1ULL << 59)
+#define KVM_PPC_CPU_CHAR_BR_HINT_HONOURED       (1ULL << 58)
+#define KVM_PPC_CPU_CHAR_MTTRIG_THR_RECONF      (1ULL << 57)
+#define KVM_PPC_CPU_CHAR_COUNT_CACHE_DIS        (1ULL << 56)
+
+#define KVM_PPC_CPU_BEHAV_FAVOUR_SECURITY       (1ULL << 63)
+#define KVM_PPC_CPU_BEHAV_L1D_FLUSH_PR          (1ULL << 62)
+#define KVM_PPC_CPU_BEHAV_BNDS_CHK_SPEC_BAR     (1ULL << 61)
+
 /* Per-vcpu XICS interrupt controller state */
 #define KVM_REG_PPC_ICP_STATE   (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0x8c)
 
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index 6b958414b4e0..f390d57cf2e1 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -237,6 +237,11 @@ int main(void)
         OFFSET(PACA_NMI_EMERG_SP, paca_struct, nmi_emergency_sp);
         OFFSET(PACA_IN_MCE, paca_struct, in_mce);
         OFFSET(PACA_IN_NMI, paca_struct, in_nmi);
+        OFFSET(PACA_RFI_FLUSH_FALLBACK_AREA, paca_struct, rfi_flush_fallback_area);
+        OFFSET(PACA_EXRFI, paca_struct, exrfi);
+        OFFSET(PACA_L1D_FLUSH_CONGRUENCE, paca_struct, l1d_flush_congruence);
+        OFFSET(PACA_L1D_FLUSH_SETS, paca_struct, l1d_flush_sets);
+
 #endif
         OFFSET(PACAHWCPUID, paca_struct, hw_cpu_id);
         OFFSET(PACAKEXECSTATE, paca_struct, kexec_state);
diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S
index 610955fe8b81..679bbe714e85 100644
--- a/arch/powerpc/kernel/cpu_setup_power.S
+++ b/arch/powerpc/kernel/cpu_setup_power.S
@@ -102,6 +102,7 @@ _GLOBAL(__setup_cpu_power9)
         li      r0,0
         mtspr   SPRN_PSSCR,r0
         mtspr   SPRN_LPID,r0
+        mtspr   SPRN_PID,r0
         mfspr   r3,SPRN_LPCR
         LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE  | LPCR_HEIC)
         or      r3, r3, r4
@@ -126,6 +127,7 @@ _GLOBAL(__restore_cpu_power9)
         li      r0,0
         mtspr   SPRN_PSSCR,r0
         mtspr   SPRN_LPID,r0
+        mtspr   SPRN_PID,r0
         mfspr   r3,SPRN_LPCR
         LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE | LPCR_HEIC)
         or      r3, r3, r4
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 3320bcac7192..2748584b767d 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -37,6 +37,11 @@
 #include <asm/tm.h>
 #include <asm/ppc-opcode.h>
 #include <asm/export.h>
+#ifdef CONFIG_PPC_BOOK3S
+#include <asm/exception-64s.h>
+#else
+#include <asm/exception-64e.h>
+#endif
 
 /*
  * System calls.
@@ -262,13 +267,23 @@ BEGIN_FTR_SECTION
 END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
 
         ld      r13,GPR13(r1)   /* only restore r13 if returning to usermode */
+        ld      r2,GPR2(r1)
+        ld      r1,GPR1(r1)
+        mtlr    r4
+        mtcr    r5
+        mtspr   SPRN_SRR0,r7
+        mtspr   SPRN_SRR1,r8
+        RFI_TO_USER
+        b       .       /* prevent speculative execution */
+
+        /* exit to kernel */
 1:      ld      r2,GPR2(r1)
         ld      r1,GPR1(r1)
         mtlr    r4
         mtcr    r5
         mtspr   SPRN_SRR0,r7
         mtspr   SPRN_SRR1,r8
-        RFI
+        RFI_TO_KERNEL
         b       .       /* prevent speculative execution */
 
 .Lsyscall_error:
@@ -397,8 +412,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
         mtmsrd  r10, 1
         mtspr   SPRN_SRR0, r11
         mtspr   SPRN_SRR1, r12
-
-        rfid
+        RFI_TO_USER
         b       .       /* prevent speculative execution */
 #endif
 _ASM_NOKPROBE_SYMBOL(system_call_common);
@@ -878,7 +892,7 @@ BEGIN_FTR_SECTION
 END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
         ACCOUNT_CPU_USER_EXIT(r13, r2, r4)
         REST_GPR(13, r1)
-1:
+
         mtspr   SPRN_SRR1,r3
 
         ld      r2,_CCR(r1)
@@ -891,8 +905,22 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
         ld      r3,GPR3(r1)
         ld      r4,GPR4(r1)
         ld      r1,GPR1(r1)
+        RFI_TO_USER
+        b       .       /* prevent speculative execution */
 
-        rfid
+1:      mtspr   SPRN_SRR1,r3
+
+        ld      r2,_CCR(r1)
+        mtcrf   0xFF,r2
+        ld      r2,_NIP(r1)
+        mtspr   SPRN_SRR0,r2
+
+        ld      r0,GPR0(r1)
+        ld      r2,GPR2(r1)
+        ld      r3,GPR3(r1)
+        ld      r4,GPR4(r1)
+        ld      r1,GPR1(r1)
+        RFI_TO_KERNEL
         b       .       /* prevent speculative execution */
 
 #endif /* CONFIG_PPC_BOOK3E */
@@ -1073,7 +1101,7 @@ __enter_rtas:
         
         mtspr   SPRN_SRR0,r5
         mtspr   SPRN_SRR1,r6
-        rfid
+        RFI_TO_KERNEL
         b       .       /* prevent speculative execution */
 
 rtas_return_loc:
@@ -1098,7 +1126,7 @@ rtas_return_loc:
 
         mtspr   SPRN_SRR0,r3
         mtspr   SPRN_SRR1,r4
-        rfid
+        RFI_TO_KERNEL
         b       .       /* prevent speculative execution */
 _ASM_NOKPROBE_SYMBOL(__enter_rtas)
 _ASM_NOKPROBE_SYMBOL(rtas_return_loc)
@@ -1171,7 +1199,7 @@ _GLOBAL(enter_prom)
         LOAD_REG_IMMEDIATE(r12, MSR_SF | MSR_ISF | MSR_LE)
         andc    r11,r11,r12
         mtsrr1  r11
-        rfid
+        RFI_TO_KERNEL
 #endif /* CONFIG_PPC_BOOK3E */
 
 1:      /* Return from OF */
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index e441b469dc8f..2dc10bf646b8 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -256,7 +256,7 @@ BEGIN_FTR_SECTION
         LOAD_HANDLER(r12, machine_check_handle_early)
 1:      mtspr   SPRN_SRR0,r12
         mtspr   SPRN_SRR1,r11
-        rfid
+        RFI_TO_KERNEL
         b       .       /* prevent speculative execution */
 2:
         /* Stack overflow. Stay on emergency stack and panic.
@@ -445,7 +445,7 @@ EXC_COMMON_BEGIN(machine_check_handle_early)
         li      r3,MSR_ME
         andc    r10,r10,r3              /* Turn off MSR_ME */
         mtspr   SPRN_SRR1,r10
-        rfid
+        RFI_TO_KERNEL
         b       .
 2:
         /*
@@ -463,7 +463,7 @@ EXC_COMMON_BEGIN(machine_check_handle_early)
          */
         bl      machine_check_queue_event
         MACHINE_CHECK_HANDLER_WINDUP
-        rfid
+        RFI_TO_USER_OR_KERNEL
 9:
         /* Deliver the machine check to host kernel in V mode. */
         MACHINE_CHECK_HANDLER_WINDUP
@@ -598,6 +598,9 @@ EXC_COMMON_BEGIN(slb_miss_common)
         stw     r9,PACA_EXSLB+EX_CCR(r13)       /* save CR in exc. frame */
         std     r10,PACA_EXSLB+EX_LR(r13)       /* save LR */
 
+        andi.   r9,r11,MSR_PR   // Check for exception from userspace
+        cmpdi   cr4,r9,MSR_PR   // And save the result in CR4 for later
+
         /*
          * Test MSR_RI before calling slb_allocate_realmode, because the
          * MSR in r11 gets clobbered. However we still want to allocate
@@ -624,9 +627,12 @@ END_MMU_FTR_SECTION_IFCLR(MMU_FTR_TYPE_RADIX)
 
         /* All done -- return from exception. */
 
+        bne     cr4,1f          /* returning to kernel */
+
 .machine        push
 .machine        "power4"
         mtcrf   0x80,r9
+        mtcrf   0x08,r9         /* MSR[PR] indication is in cr4 */
         mtcrf   0x04,r9         /* MSR[RI] indication is in cr5 */
         mtcrf   0x02,r9         /* I/D indication is in cr6 */
         mtcrf   0x01,r9         /* slb_allocate uses cr0 and cr7 */
@@ -640,9 +646,30 @@ END_MMU_FTR_SECTION_IFCLR(MMU_FTR_TYPE_RADIX)
         ld      r11,PACA_EXSLB+EX_R11(r13)
         ld      r12,PACA_EXSLB+EX_R12(r13)
         ld      r13,PACA_EXSLB+EX_R13(r13)
-        rfid
+        RFI_TO_USER
+        b       .       /* prevent speculative execution */
+1:
+.machine        push
+.machine        "power4"
+        mtcrf   0x80,r9
+        mtcrf   0x08,r9         /* MSR[PR] indication is in cr4 */
+        mtcrf   0x04,r9         /* MSR[RI] indication is in cr5 */
+        mtcrf   0x02,r9         /* I/D indication is in cr6 */
+        mtcrf   0x01,r9         /* slb_allocate uses cr0 and cr7 */
+.machine        pop
+
+        RESTORE_CTR(r9, PACA_EXSLB)
+        RESTORE_PPR_PACA(PACA_EXSLB, r9)
+        mr      r3,r12
+        ld      r9,PACA_EXSLB+EX_R9(r13)
+        ld      r10,PACA_EXSLB+EX_R10(r13)
+        ld      r11,PACA_EXSLB+EX_R11(r13)
+        ld      r12,PACA_EXSLB+EX_R12(r13)
+        ld      r13,PACA_EXSLB+EX_R13(r13)
+        RFI_TO_KERNEL
         b       .       /* prevent speculative execution */
 
+
 2:      std     r3,PACA_EXSLB+EX_DAR(r13)
         mr      r3,r12
         mfspr   r11,SPRN_SRR0
@@ -651,7 +678,7 @@ END_MMU_FTR_SECTION_IFCLR(MMU_FTR_TYPE_RADIX)
         mtspr   SPRN_SRR0,r10
         ld      r10,PACAKMSR(r13)
         mtspr   SPRN_SRR1,r10
-        rfid
+        RFI_TO_KERNEL
         b       .
 
 8:      std     r3,PACA_EXSLB+EX_DAR(r13)
@@ -662,7 +689,7 @@ END_MMU_FTR_SECTION_IFCLR(MMU_FTR_TYPE_RADIX)
         mtspr   SPRN_SRR0,r10
         ld      r10,PACAKMSR(r13)
         mtspr   SPRN_SRR1,r10
-        rfid
+        RFI_TO_KERNEL
         b       .
 
 EXC_COMMON_BEGIN(unrecov_slb)
@@ -901,7 +928,7 @@ EXC_COMMON(trap_0b_common, 0xb00, unknown_exception)
         mtspr   SPRN_SRR0,r10 ;                                 \
         ld      r10,PACAKMSR(r13) ;                             \
         mtspr   SPRN_SRR1,r10 ;                                 \
-        rfid ;                                                  \
+        RFI_TO_KERNEL ;                                         \
         b       . ;     /* prevent speculative execution */
 
 #ifdef CONFIG_PPC_FAST_ENDIAN_SWITCH
@@ -917,7 +944,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_REAL_LE)				\
         xori    r12,r12,MSR_LE ;                                \
         mtspr   SPRN_SRR1,r12 ;                                 \
         mr      r13,r9 ;                                        \
-        rfid ;          /* return to userspace */               \
+        RFI_TO_USER ;   /* return to userspace */               \
         b       . ;     /* prevent speculative execution */
 #else
 #define SYSCALL_FASTENDIAN_TEST
@@ -1063,7 +1090,7 @@ TRAMP_REAL_BEGIN(hmi_exception_early)
         mtcr    r11
         REST_GPR(11, r1)
         ld      r1,GPR1(r1)
-        hrfid
+        HRFI_TO_USER_OR_KERNEL
 
 1:      mtcr    r11
         REST_GPR(11, r1)
@@ -1314,7 +1341,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_CFAR)
         ld      r11,PACA_EXGEN+EX_R11(r13)
         ld      r12,PACA_EXGEN+EX_R12(r13)
         ld      r13,PACA_EXGEN+EX_R13(r13)
-        HRFID
+        HRFI_TO_UNKNOWN
         b       .
 #endif
 
@@ -1418,10 +1445,94 @@ masked_##_H##interrupt:					\
         ld      r10,PACA_EXGEN+EX_R10(r13);             \
         ld      r11,PACA_EXGEN+EX_R11(r13);             \
         /* returns to kernel where r13 must be set up, so don't restore it */ \
-        ##_H##rfid;                                     \
+        ##_H##RFI_TO_KERNEL;                            \
         b       .;                                      \
         MASKED_DEC_HANDLER(_H)
 
+TRAMP_REAL_BEGIN(rfi_flush_fallback)
+        SET_SCRATCH0(r13);
+        GET_PACA(r13);
+        std     r9,PACA_EXRFI+EX_R9(r13)
+        std     r10,PACA_EXRFI+EX_R10(r13)
+        std     r11,PACA_EXRFI+EX_R11(r13)
+        std     r12,PACA_EXRFI+EX_R12(r13)
+        std     r8,PACA_EXRFI+EX_R13(r13)
+        mfctr   r9
+        ld      r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13)
+        ld      r11,PACA_L1D_FLUSH_SETS(r13)
+        ld      r12,PACA_L1D_FLUSH_CONGRUENCE(r13)
+        /*
+         * The load adresses are at staggered offsets within cachelines,
+         * which suits some pipelines better (on others it should not
+         * hurt).
+         */
+        addi    r12,r12,8
+        mtctr   r11
+        DCBT_STOP_ALL_STREAM_IDS(r11) /* Stop prefetch streams */
+
+        /* order ld/st prior to dcbt stop all streams with flushing */
+        sync
+1:      li      r8,0
+        .rept   8 /* 8-way set associative */
+        ldx     r11,r10,r8
+        add     r8,r8,r12
+        xor     r11,r11,r11     // Ensure r11 is 0 even if fallback area is not
+        add     r8,r8,r11       // Add 0, this creates a dependency on the ldx
+        .endr
+        addi    r10,r10,128 /* 128 byte cache line */
+        bdnz    1b
+
+        mtctr   r9
+        ld      r9,PACA_EXRFI+EX_R9(r13)
+        ld      r10,PACA_EXRFI+EX_R10(r13)
+        ld      r11,PACA_EXRFI+EX_R11(r13)
+        ld      r12,PACA_EXRFI+EX_R12(r13)
+        ld      r8,PACA_EXRFI+EX_R13(r13)
+        GET_SCRATCH0(r13);
+        rfid
+
+TRAMP_REAL_BEGIN(hrfi_flush_fallback)
+        SET_SCRATCH0(r13);
+        GET_PACA(r13);
+        std     r9,PACA_EXRFI+EX_R9(r13)
+        std     r10,PACA_EXRFI+EX_R10(r13)
+        std     r11,PACA_EXRFI+EX_R11(r13)
+        std     r12,PACA_EXRFI+EX_R12(r13)
+        std     r8,PACA_EXRFI+EX_R13(r13)
+        mfctr   r9
+        ld      r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13)
+        ld      r11,PACA_L1D_FLUSH_SETS(r13)
+        ld      r12,PACA_L1D_FLUSH_CONGRUENCE(r13)
+        /*
+         * The load adresses are at staggered offsets within cachelines,
+         * which suits some pipelines better (on others it should not
+         * hurt).
+         */
+        addi    r12,r12,8
+        mtctr   r11
+        DCBT_STOP_ALL_STREAM_IDS(r11) /* Stop prefetch streams */
+
+        /* order ld/st prior to dcbt stop all streams with flushing */
+        sync
+1:      li      r8,0
+        .rept   8 /* 8-way set associative */
+        ldx     r11,r10,r8
+        add     r8,r8,r12
+        xor     r11,r11,r11     // Ensure r11 is 0 even if fallback area is not
+        add     r8,r8,r11       // Add 0, this creates a dependency on the ldx
+        .endr
+        addi    r10,r10,128 /* 128 byte cache line */
+        bdnz    1b
+
+        mtctr   r9
+        ld      r9,PACA_EXRFI+EX_R9(r13)
+        ld      r10,PACA_EXRFI+EX_R10(r13)
+        ld      r11,PACA_EXRFI+EX_R11(r13)
+        ld      r12,PACA_EXRFI+EX_R12(r13)
+        ld      r8,PACA_EXRFI+EX_R13(r13)
+        GET_SCRATCH0(r13);
+        hrfid
+
 /*
  * Real mode exceptions actually use this too, but alternate
  * instruction code patches (which end up in the common .text area)
@@ -1441,7 +1552,7 @@ TRAMP_REAL_BEGIN(kvmppc_skip_interrupt)
         addi    r13, r13, 4
         mtspr   SPRN_SRR0, r13
         GET_SCRATCH0(r13)
-        rfid
+        RFI_TO_KERNEL
         b       .
 
 TRAMP_REAL_BEGIN(kvmppc_skip_Hinterrupt)
@@ -1453,7 +1564,7 @@ TRAMP_REAL_BEGIN(kvmppc_skip_Hinterrupt)
         addi    r13, r13, 4
         mtspr   SPRN_HSRR0, r13
         GET_SCRATCH0(r13)
-        hrfid
+        HRFI_TO_KERNEL
         b       .
 #endif
 
diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
index 04ea5c04fd24..3c2c2688918f 100644
--- a/arch/powerpc/kernel/fadump.c
+++ b/arch/powerpc/kernel/fadump.c
@@ -1462,25 +1462,6 @@ static void fadump_init_files(void)
         return;
 }
 
-static int fadump_panic_event(struct notifier_block *this,
-                              unsigned long event, void *ptr)
-{
-        /*
-         * If firmware-assisted dump has been registered then trigger
-         * firmware-assisted dump and let firmware handle everything
-         * else. If this returns, then fadump was not registered, so
-         * go through the rest of the panic path.
-         */
-        crash_fadump(NULL, ptr);
-
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block fadump_panic_block = {
-        .notifier_call = fadump_panic_event,
-        .priority = INT_MIN /* may not return; must be done last */
-};
-
 /*
  * Prepare for firmware-assisted dump.
  */
@@ -1513,9 +1494,6 @@ int __init setup_fadump(void)
                 init_fadump_mem_struct(&fdm, fw_dump.reserve_dump_area_start);
         fadump_init_files();
 
-        atomic_notifier_chain_register(&panic_notifier_list,
-                                        &fadump_panic_block);
-
         return 1;
 }
 subsys_initcall(setup_fadump);
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 5acb5a176dbe..72be0c32e902 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1403,7 +1403,7 @@ void show_regs(struct pt_regs * regs)
 
         printk("NIP:  "REG" LR: "REG" CTR: "REG"\n",
                regs->nip, regs->link, regs->ctr);
-        printk("REGS: %p TRAP: %04lx   %s  (%s)\n",
+        printk("REGS: %px TRAP: %04lx   %s  (%s)\n",
                regs, regs->trap, print_tainted(), init_utsname()->release);
         printk("MSR:  "REG" ", regs->msr);
         print_msr_bits(regs->msr);
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index 2075322cd225..8fd3a70047f1 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -242,14 +242,6 @@ static int show_cpuinfo(struct seq_file *m, void *v)
         unsigned short maj;
         unsigned short min;
 
-        /* We only show online cpus: disable preempt (overzealous, I
-         * knew) to prevent cpu going down. */
-        preempt_disable();
-        if (!cpu_online(cpu_id)) {
-                preempt_enable();
-                return 0;
-        }
-
 #ifdef CONFIG_SMP
         pvr = per_cpu(cpu_pvr, cpu_id);
 #else
@@ -358,9 +350,6 @@ static int show_cpuinfo(struct seq_file *m, void *v)
 #ifdef CONFIG_SMP
         seq_printf(m, "\n");
 #endif
-
-        preempt_enable();
-
         /* If this is the last cpu, print the summary */
         if (cpumask_next(cpu_id, cpu_online_mask) >= nr_cpu_ids)
                 show_cpuinfo_summary(m);
@@ -704,6 +693,30 @@ int check_legacy_ioport(unsigned long base_port)
 }
 EXPORT_SYMBOL(check_legacy_ioport);
 
+static int ppc_panic_event(struct notifier_block *this,
+                             unsigned long event, void *ptr)
+{
+        /*
+         * If firmware-assisted dump has been registered then trigger
+         * firmware-assisted dump and let firmware handle everything else.
+         */
+        crash_fadump(NULL, ptr);
+        ppc_md.panic(ptr);  /* May not return */
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block ppc_panic_block = {
+        .notifier_call = ppc_panic_event,
+        .priority = INT_MIN /* may not return; must be done last */
+};
+
+void __init setup_panic(void)
+{
+        if (!ppc_md.panic)
+                return;
+        atomic_notifier_chain_register(&panic_notifier_list, &ppc_panic_block);
+}
+
 #ifdef CONFIG_CHECK_CACHE_COHERENCY
 /*
  * For platforms that have configurable cache-coherency.  This function
@@ -848,6 +861,9 @@ void __init setup_arch(char **cmdline_p)
         /* Probe the machine type, establish ppc_md. */
         probe_machine();
 
+        /* Setup panic notifier if requested by the platform. */
+        setup_panic();
+
         /*
          * Configure ppc_md.power_save (ppc32 only, 64-bit machines do
          * it from their respective probe() function.
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 8956a9856604..e67413f4a8f0 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -38,6 +38,7 @@
 #include <linux/memory.h>
 #include <linux/nmi.h>
 
+#include <asm/debugfs.h>
 #include <asm/io.h>
 #include <asm/kdump.h>
 #include <asm/prom.h>
@@ -801,3 +802,141 @@ static int __init disable_hardlockup_detector(void)
         return 0;
 }
 early_initcall(disable_hardlockup_detector);
+
+#ifdef CONFIG_PPC_BOOK3S_64
+static enum l1d_flush_type enabled_flush_types;
+static void *l1d_flush_fallback_area;
+static bool no_rfi_flush;
+bool rfi_flush;
+
+static int __init handle_no_rfi_flush(char *p)
+{
+        pr_info("rfi-flush: disabled on command line.");
+        no_rfi_flush = true;
+        return 0;
+}
+early_param("no_rfi_flush", handle_no_rfi_flush);
+
+/*
+ * The RFI flush is not KPTI, but because users will see doco that says to use
+ * nopti we hijack that option here to also disable the RFI flush.
+ */
+static int __init handle_no_pti(char *p)
+{
+        pr_info("rfi-flush: disabling due to 'nopti' on command line.\n");
+        handle_no_rfi_flush(NULL);
+        return 0;
+}
+early_param("nopti", handle_no_pti);
+
+static void do_nothing(void *unused)
+{
+        /*
+         * We don't need to do the flush explicitly, just enter+exit kernel is
+         * sufficient, the RFI exit handlers will do the right thing.
+         */
+}
+
+void rfi_flush_enable(bool enable)
+{
+        if (rfi_flush == enable)
+                return;
+
+        if (enable) {
+                do_rfi_flush_fixups(enabled_flush_types);
+                on_each_cpu(do_nothing, NULL, 1);
+        } else
+                do_rfi_flush_fixups(L1D_FLUSH_NONE);
+
+        rfi_flush = enable;
+}
+
+static void init_fallback_flush(void)
+{
+        u64 l1d_size, limit;
+        int cpu;
+
+        l1d_size = ppc64_caches.l1d.size;
+        limit = min(safe_stack_limit(), ppc64_rma_size);
+
+        /*
+         * Align to L1d size, and size it at 2x L1d size, to catch possible
+         * hardware prefetch runoff. We don't have a recipe for load patterns to
+         * reliably avoid the prefetcher.
+         */
+        l1d_flush_fallback_area = __va(memblock_alloc_base(l1d_size * 2, l1d_size, limit));
+        memset(l1d_flush_fallback_area, 0, l1d_size * 2);
+
+        for_each_possible_cpu(cpu) {
+                /*
+                 * The fallback flush is currently coded for 8-way
+                 * associativity. Different associativity is possible, but it
+                 * will be treated as 8-way and may not evict the lines as
+                 * effectively.
+                 *
+                 * 128 byte lines are mandatory.
+                 */
+                u64 c = l1d_size / 8;
+
+                paca[cpu].rfi_flush_fallback_area = l1d_flush_fallback_area;
+                paca[cpu].l1d_flush_congruence = c;
+                paca[cpu].l1d_flush_sets = c / 128;
+        }
+}
+
+void __init setup_rfi_flush(enum l1d_flush_type types, bool enable)
+{
+        if (types & L1D_FLUSH_FALLBACK) {
+                pr_info("rfi-flush: Using fallback displacement flush\n");
+                init_fallback_flush();
+        }
+
+        if (types & L1D_FLUSH_ORI)
+                pr_info("rfi-flush: Using ori type flush\n");
+
+        if (types & L1D_FLUSH_MTTRIG)
+                pr_info("rfi-flush: Using mttrig type flush\n");
+
+        enabled_flush_types = types;
+
+        if (!no_rfi_flush)
+                rfi_flush_enable(enable);
+}
+
+#ifdef CONFIG_DEBUG_FS
+static int rfi_flush_set(void *data, u64 val)
+{
+        if (val == 1)
+                rfi_flush_enable(true);
+        else if (val == 0)
+                rfi_flush_enable(false);
+        else
+                return -EINVAL;
+
+        return 0;
+}
+
+static int rfi_flush_get(void *data, u64 *val)
+{
+        *val = rfi_flush ? 1 : 0;
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(fops_rfi_flush, rfi_flush_get, rfi_flush_set, "%llu\n");
+
+static __init int rfi_flush_debugfs_init(void)
+{
+        debugfs_create_file("rfi_flush", 0600, powerpc_debugfs_root, NULL, &fops_rfi_flush);
+        return 0;
+}
+device_initcall(rfi_flush_debugfs_init);
+#endif
+
+ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        if (rfi_flush)
+                return sprintf(buf, "Mitigation: RFI Flush\n");
+
+        return sprintf(buf, "Vulnerable\n");
+}
+#endif /* CONFIG_PPC_BOOK3S_64 */
diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
index 0494e1566ee2..307843d23682 100644
--- a/arch/powerpc/kernel/vmlinux.lds.S
+++ b/arch/powerpc/kernel/vmlinux.lds.S
@@ -132,6 +132,15 @@ SECTIONS
         /* Read-only data */
         RO_DATA(PAGE_SIZE)
 
+#ifdef CONFIG_PPC64
+        . = ALIGN(8);
+        __rfi_flush_fixup : AT(ADDR(__rfi_flush_fixup) - LOAD_OFFSET) {
+                __start___rfi_flush_fixup = .;
+                *(__rfi_flush_fixup)
+                __stop___rfi_flush_fixup = .;
+        }
+#endif
+
         EXCEPTION_TABLE(0)
 
         NOTES :kernel :notes
diff --git a/arch/powerpc/kvm/book3s_64_mmu.c b/arch/powerpc/kvm/book3s_64_mmu.c
index 29ebe2fd5867..a93d719edc90 100644
--- a/arch/powerpc/kvm/book3s_64_mmu.c
+++ b/arch/powerpc/kvm/book3s_64_mmu.c
@@ -235,6 +235,7 @@ static int kvmppc_mmu_book3s_64_xlate(struct kvm_vcpu *vcpu, gva_t eaddr,
                 gpte->may_read = true;
                 gpte->may_write = true;
                 gpte->page_size = MMU_PAGE_4K;
+                gpte->wimg = HPTE_R_M;
 
                 return 0;
         }
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index 966097232d21..b73dbc9e797d 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -65,11 +65,17 @@ struct kvm_resize_hpt {
         u32 order;
 
         /* These fields protected by kvm->lock */
+
+        /* Possible values and their usage:
+         *  <0     an error occurred during allocation,
+         *  -EBUSY allocation is in the progress,
+         *  0      allocation made successfuly.
+         */
         int error;
-        bool prepare_done;
 
-        /* Private to the work thread, until prepare_done is true,
-         * then protected by kvm->resize_hpt_sem */
+        /* Private to the work thread, until error != -EBUSY,
+         * then protected by kvm->lock.
+         */
         struct kvm_hpt_info hpt;
 };
 
@@ -159,8 +165,6 @@ long kvmppc_alloc_reset_hpt(struct kvm *kvm, int order)
                  * Reset all the reverse-mapping chains for all memslots
                  */
                 kvmppc_rmap_reset(kvm);
-                /* Ensure that each vcpu will flush its TLB on next entry. */
-                cpumask_setall(&kvm->arch.need_tlb_flush);
                 err = 0;
                 goto out;
         }
@@ -176,6 +180,10 @@ long kvmppc_alloc_reset_hpt(struct kvm *kvm, int order)
         kvmppc_set_hpt(kvm, &info);
 
 out:
+        if (err == 0)
+                /* Ensure that each vcpu will flush its TLB on next entry. */
+                cpumask_setall(&kvm->arch.need_tlb_flush);
+
         mutex_unlock(&kvm->lock);
         return err;
 }
@@ -1413,16 +1421,20 @@ static void resize_hpt_pivot(struct kvm_resize_hpt *resize)
 
 static void resize_hpt_release(struct kvm *kvm, struct kvm_resize_hpt *resize)
 {
-        BUG_ON(kvm->arch.resize_hpt != resize);
+        if (WARN_ON(!mutex_is_locked(&kvm->lock)))
+                return;
 
         if (!resize)
                 return;
 
-        if (resize->hpt.virt)
-                kvmppc_free_hpt(&resize->hpt);
+        if (resize->error != -EBUSY) {
+                if (resize->hpt.virt)
+                        kvmppc_free_hpt(&resize->hpt);
+                kfree(resize);
+        }
 
-        kvm->arch.resize_hpt = NULL;
-        kfree(resize);
+        if (kvm->arch.resize_hpt == resize)
+                kvm->arch.resize_hpt = NULL;
 }
 
 static void resize_hpt_prepare_work(struct work_struct *work)
@@ -1431,17 +1443,41 @@ static void resize_hpt_prepare_work(struct work_struct *work)
                                                      struct kvm_resize_hpt,
                                                      work);
         struct kvm *kvm = resize->kvm;
-        int err;
+        int err = 0;
 
-        resize_hpt_debug(resize, "resize_hpt_prepare_work(): order = %d\n",
-                         resize->order);
-
-        err = resize_hpt_allocate(resize);
+        if (WARN_ON(resize->error != -EBUSY))
+                return;
 
         mutex_lock(&kvm->lock);
 
+        /* Request is still current? */
+        if (kvm->arch.resize_hpt == resize) {
+                /* We may request large allocations here:
+                 * do not sleep with kvm->lock held for a while.
+                 */
+                mutex_unlock(&kvm->lock);
+
+                resize_hpt_debug(resize, "resize_hpt_prepare_work(): order = %d\n",
+                                 resize->order);
+
+                err = resize_hpt_allocate(resize);
+
+                /* We have strict assumption about -EBUSY
+                 * when preparing for HPT resize.
+                 */
+                if (WARN_ON(err == -EBUSY))
+                        err = -EINPROGRESS;
+
+                mutex_lock(&kvm->lock);
+                /* It is possible that kvm->arch.resize_hpt != resize
+                 * after we grab kvm->lock again.
+                 */
+        }
+
         resize->error = err;
-        resize->prepare_done = true;
+
+        if (kvm->arch.resize_hpt != resize)
+                resize_hpt_release(kvm, resize);
 
         mutex_unlock(&kvm->lock);
 }
@@ -1466,14 +1502,12 @@ long kvm_vm_ioctl_resize_hpt_prepare(struct kvm *kvm,
 
         if (resize) {
                 if (resize->order == shift) {
-                        /* Suitable resize in progress */
-                        if (resize->prepare_done) {
-                                ret = resize->error;
-                                if (ret != 0)
-                                        resize_hpt_release(kvm, resize);
-                        } else {
+                        /* Suitable resize in progress? */
+                        ret = resize->error;
+                        if (ret == -EBUSY)
                                 ret = 100; /* estimated time in ms */
-                        }
+                        else if (ret)
+                                resize_hpt_release(kvm, resize);
 
                         goto out;
                 }
@@ -1493,6 +1527,8 @@ long kvm_vm_ioctl_resize_hpt_prepare(struct kvm *kvm,
                 ret = -ENOMEM;
                 goto out;
         }
+
+        resize->error = -EBUSY;
         resize->order = shift;
         resize->kvm = kvm;
         INIT_WORK(&resize->work, resize_hpt_prepare_work);
@@ -1547,16 +1583,12 @@ long kvm_vm_ioctl_resize_hpt_commit(struct kvm *kvm,
         if (!resize || (resize->order != shift))
                 goto out;
 
-        ret = -EBUSY;
-        if (!resize->prepare_done)
-                goto out;
-
         ret = resize->error;
-        if (ret != 0)
+        if (ret)
                 goto out;
 
         ret = resize_hpt_rehash(resize);
-        if (ret != 0)
+        if (ret)
                 goto out;
 
         resize_hpt_pivot(resize);
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 2659844784b8..9c61f736c75b 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -79,7 +79,7 @@ _GLOBAL_TOC(kvmppc_hv_entry_trampoline)
         mtmsrd  r0,1            /* clear RI in MSR */
         mtsrr0  r5
         mtsrr1  r6
-        RFI
+        RFI_TO_KERNEL
 
 kvmppc_call_hv_entry:
 BEGIN_FTR_SECTION
@@ -199,7 +199,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
         mtmsrd  r6, 1                   /* Clear RI in MSR */
         mtsrr0  r8
         mtsrr1  r7
-        RFI
+        RFI_TO_KERNEL
 
         /* Virtual-mode return */
 .Lvirt_return:
@@ -1167,8 +1167,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
 
         ld      r0, VCPU_GPR(R0)(r4)
         ld      r4, VCPU_GPR(R4)(r4)
-
-        hrfid
+        HRFI_TO_GUEST
         b       .
 
 secondary_too_late:
@@ -3320,7 +3319,7 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_TYPE_RADIX)
         ld      r4, PACAKMSR(r13)
         mtspr   SPRN_SRR0, r3
         mtspr   SPRN_SRR1, r4
-        rfid
+        RFI_TO_KERNEL
 9:      addi    r3, r1, STACK_FRAME_OVERHEAD
         bl      kvmppc_bad_interrupt
         b       9b
diff --git a/arch/powerpc/kvm/book3s_pr.c b/arch/powerpc/kvm/book3s_pr.c
index d0dc8624198f..7deaeeb14b93 100644
--- a/arch/powerpc/kvm/book3s_pr.c
+++ b/arch/powerpc/kvm/book3s_pr.c
@@ -60,6 +60,7 @@ static void kvmppc_giveup_fac(struct kvm_vcpu *vcpu, ulong fac);
 #define MSR_USER32 MSR_USER
 #define MSR_USER64 MSR_USER
 #define HW_PAGE_SIZE PAGE_SIZE
+#define HPTE_R_M   _PAGE_COHERENT
 #endif
 
 static bool kvmppc_is_split_real(struct kvm_vcpu *vcpu)
@@ -557,6 +558,7 @@ int kvmppc_handle_pagefault(struct kvm_run *run, struct kvm_vcpu *vcpu,
                 pte.eaddr = eaddr;
                 pte.vpage = eaddr >> 12;
                 pte.page_size = MMU_PAGE_64K;
+                pte.wimg = HPTE_R_M;
         }
 
         switch (kvmppc_get_msr(vcpu) & (MSR_DR|MSR_IR)) {
diff --git a/arch/powerpc/kvm/book3s_rmhandlers.S b/arch/powerpc/kvm/book3s_rmhandlers.S
index 42a4b237df5f..34a5adeff084 100644
--- a/arch/powerpc/kvm/book3s_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_rmhandlers.S
@@ -46,6 +46,9 @@
 
 #define FUNC(name)              name
 
+#define RFI_TO_KERNEL   RFI
+#define RFI_TO_GUEST    RFI
+
 .macro INTERRUPT_TRAMPOLINE intno
 
 .global kvmppc_trampoline_\intno
@@ -141,7 +144,7 @@ kvmppc_handler_skip_ins:
         GET_SCRATCH0(r13)
 
         /* And get back into the code */
-        RFI
+        RFI_TO_KERNEL
 #endif
 
 /*
@@ -164,6 +167,6 @@ _GLOBAL_TOC(kvmppc_entry_trampoline)
         ori     r5, r5, MSR_EE
         mtsrr0  r7
         mtsrr1  r6
-        RFI
+        RFI_TO_KERNEL
 
 #include "book3s_segment.S"
diff --git a/arch/powerpc/kvm/book3s_segment.S b/arch/powerpc/kvm/book3s_segment.S
index 2a2b96d53999..93a180ceefad 100644
--- a/arch/powerpc/kvm/book3s_segment.S
+++ b/arch/powerpc/kvm/book3s_segment.S
@@ -156,7 +156,7 @@ no_dcbz32_on:
         PPC_LL  r9, SVCPU_R9(r3)
         PPC_LL  r3, (SVCPU_R3)(r3)
 
-        RFI
+        RFI_TO_GUEST
 kvmppc_handler_trampoline_enter_end:
 
 
@@ -407,5 +407,5 @@ END_FTR_SECTION_IFSET(CPU_FTR_HVMODE)
         cmpwi   r12, BOOK3S_INTERRUPT_DOORBELL
         beqa    BOOK3S_INTERRUPT_DOORBELL
 
-        RFI
+        RFI_TO_KERNEL
 kvmppc_handler_trampoline_exit_end:
diff --git a/arch/powerpc/kvm/book3s_xive.c b/arch/powerpc/kvm/book3s_xive.c
index bf457843e032..0d750d274c4e 100644
--- a/arch/powerpc/kvm/book3s_xive.c
+++ b/arch/powerpc/kvm/book3s_xive.c
@@ -725,7 +725,8 @@ u64 kvmppc_xive_get_icp(struct kvm_vcpu *vcpu)
 
         /* Return the per-cpu state for state saving/migration */
         return (u64)xc->cppr << KVM_REG_PPC_ICP_CPPR_SHIFT |
-               (u64)xc->mfrr << KVM_REG_PPC_ICP_MFRR_SHIFT;
+               (u64)xc->mfrr << KVM_REG_PPC_ICP_MFRR_SHIFT |
+               (u64)0xff << KVM_REG_PPC_ICP_PPRI_SHIFT;
 }
 
 int kvmppc_xive_set_icp(struct kvm_vcpu *vcpu, u64 icpval)
@@ -1558,7 +1559,7 @@ static int xive_set_source(struct kvmppc_xive *xive, long irq, u64 addr)
 
         /*
          * Restore P and Q. If the interrupt was pending, we
-         * force both P and Q, which will trigger a resend.
+         * force Q and !P, which will trigger a resend.
          *
          * That means that a guest that had both an interrupt
          * pending (queued) and Q set will restore with only
@@ -1566,7 +1567,7 @@ static int xive_set_source(struct kvmppc_xive *xive, long irq, u64 addr)
          * is perfectly fine as coalescing interrupts that haven't
          * been presented yet is always allowed.
          */
-        if (val & KVM_XICS_PRESENTED || val & KVM_XICS_PENDING)
+        if (val & KVM_XICS_PRESENTED && !(val & KVM_XICS_PENDING))
                 state->old_p = true;
         if (val & KVM_XICS_QUEUED || val & KVM_XICS_PENDING)
                 state->old_q = true;
diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
index 1915e86cef6f..0a7c88786ec0 100644
--- a/arch/powerpc/kvm/powerpc.c
+++ b/arch/powerpc/kvm/powerpc.c
@@ -39,6 +39,10 @@
 #include <asm/iommu.h>
 #include <asm/switch_to.h>
 #include <asm/xive.h>
+#ifdef CONFIG_PPC_PSERIES
+#include <asm/hvcall.h>
+#include <asm/plpar_wrappers.h>
+#endif
 
 #include "timing.h"
 #include "irq.h"
@@ -548,6 +552,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
 #ifdef CONFIG_KVM_XICS
         case KVM_CAP_IRQ_XICS:
 #endif
+        case KVM_CAP_PPC_GET_CPU_CHAR:
                 r = 1;
                 break;
 
@@ -1759,6 +1764,124 @@ static int kvm_vm_ioctl_enable_cap(struct kvm *kvm,
         return r;
 }
 
+#ifdef CONFIG_PPC_BOOK3S_64
+/*
+ * These functions check whether the underlying hardware is safe
+ * against attacks based on observing the effects of speculatively
+ * executed instructions, and whether it supplies instructions for
+ * use in workarounds.  The information comes from firmware, either
+ * via the device tree on powernv platforms or from an hcall on
+ * pseries platforms.
+ */
+#ifdef CONFIG_PPC_PSERIES
+static int pseries_get_cpu_char(struct kvm_ppc_cpu_char *cp)
+{
+        struct h_cpu_char_result c;
+        unsigned long rc;
+
+        if (!machine_is(pseries))
+                return -ENOTTY;
+
+        rc = plpar_get_cpu_characteristics(&c);
+        if (rc == H_SUCCESS) {
+                cp->character = c.character;
+                cp->behaviour = c.behaviour;
+                cp->character_mask = KVM_PPC_CPU_CHAR_SPEC_BAR_ORI31 |
+                        KVM_PPC_CPU_CHAR_BCCTRL_SERIALISED |
+                        KVM_PPC_CPU_CHAR_L1D_FLUSH_ORI30 |
+                        KVM_PPC_CPU_CHAR_L1D_FLUSH_TRIG2 |
+                        KVM_PPC_CPU_CHAR_L1D_THREAD_PRIV |
+                        KVM_PPC_CPU_CHAR_BR_HINT_HONOURED |
+                        KVM_PPC_CPU_CHAR_MTTRIG_THR_RECONF |
+                        KVM_PPC_CPU_CHAR_COUNT_CACHE_DIS;
+                cp->behaviour_mask = KVM_PPC_CPU_BEHAV_FAVOUR_SECURITY |
+                        KVM_PPC_CPU_BEHAV_L1D_FLUSH_PR |
+                        KVM_PPC_CPU_BEHAV_BNDS_CHK_SPEC_BAR;
+        }
+        return 0;
+}
+#else
+static int pseries_get_cpu_char(struct kvm_ppc_cpu_char *cp)
+{
+        return -ENOTTY;
+}
+#endif
+
+static inline bool have_fw_feat(struct device_node *fw_features,
+                                const char *state, const char *name)
+{
+        struct device_node *np;
+        bool r = false;
+
+        np = of_get_child_by_name(fw_features, name);
+        if (np) {
+                r = of_property_read_bool(np, state);
+                of_node_put(np);
+        }
+        return r;
+}
+
+static int kvmppc_get_cpu_char(struct kvm_ppc_cpu_char *cp)
+{
+        struct device_node *np, *fw_features;
+        int r;
+
+        memset(cp, 0, sizeof(*cp));
+        r = pseries_get_cpu_char(cp);
+        if (r != -ENOTTY)
+                return r;
+
+        np = of_find_node_by_name(NULL, "ibm,opal");
+        if (np) {
+                fw_features = of_get_child_by_name(np, "fw-features");
+                of_node_put(np);
+                if (!fw_features)
+                        return 0;
+                if (have_fw_feat(fw_features, "enabled",
+                                 "inst-spec-barrier-ori31,31,0"))
+                        cp->character |= KVM_PPC_CPU_CHAR_SPEC_BAR_ORI31;
+                if (have_fw_feat(fw_features, "enabled",
+                                 "fw-bcctrl-serialized"))
+                        cp->character |= KVM_PPC_CPU_CHAR_BCCTRL_SERIALISED;
+                if (have_fw_feat(fw_features, "enabled",
+                                 "inst-l1d-flush-ori30,30,0"))
+                        cp->character |= KVM_PPC_CPU_CHAR_L1D_FLUSH_ORI30;
+                if (have_fw_feat(fw_features, "enabled",
+                                 "inst-l1d-flush-trig2"))
+                        cp->character |= KVM_PPC_CPU_CHAR_L1D_FLUSH_TRIG2;
+                if (have_fw_feat(fw_features, "enabled",
+                                 "fw-l1d-thread-split"))
+                        cp->character |= KVM_PPC_CPU_CHAR_L1D_THREAD_PRIV;
+                if (have_fw_feat(fw_features, "enabled",
+                                 "fw-count-cache-disabled"))
+                        cp->character |= KVM_PPC_CPU_CHAR_COUNT_CACHE_DIS;
+                cp->character_mask = KVM_PPC_CPU_CHAR_SPEC_BAR_ORI31 |
+                        KVM_PPC_CPU_CHAR_BCCTRL_SERIALISED |
+                        KVM_PPC_CPU_CHAR_L1D_FLUSH_ORI30 |
+                        KVM_PPC_CPU_CHAR_L1D_FLUSH_TRIG2 |
+                        KVM_PPC_CPU_CHAR_L1D_THREAD_PRIV |
+                        KVM_PPC_CPU_CHAR_COUNT_CACHE_DIS;
+
+                if (have_fw_feat(fw_features, "enabled",
+                                 "speculation-policy-favor-security"))
+                        cp->behaviour |= KVM_PPC_CPU_BEHAV_FAVOUR_SECURITY;
+                if (!have_fw_feat(fw_features, "disabled",
+                                  "needs-l1d-flush-msr-pr-0-to-1"))
+                        cp->behaviour |= KVM_PPC_CPU_BEHAV_L1D_FLUSH_PR;
+                if (!have_fw_feat(fw_features, "disabled",
+                                  "needs-spec-barrier-for-bound-checks"))
+                        cp->behaviour |= KVM_PPC_CPU_BEHAV_BNDS_CHK_SPEC_BAR;
+                cp->behaviour_mask = KVM_PPC_CPU_BEHAV_FAVOUR_SECURITY |
+                        KVM_PPC_CPU_BEHAV_L1D_FLUSH_PR |
+                        KVM_PPC_CPU_BEHAV_BNDS_CHK_SPEC_BAR;
+
+                of_node_put(fw_features);
+        }
+
+        return 0;
+}
+#endif
+
 long kvm_arch_vm_ioctl(struct file *filp,
                        unsigned int ioctl, unsigned long arg)
 {
@@ -1861,6 +1984,14 @@ long kvm_arch_vm_ioctl(struct file *filp,
                         r = -EFAULT;
                 break;
         }
+        case KVM_PPC_GET_CPU_CHAR: {
+                struct kvm_ppc_cpu_char cpuchar;
+
+                r = kvmppc_get_cpu_char(&cpuchar);
+                if (r >= 0 && copy_to_user(argp, &cpuchar, sizeof(cpuchar)))
+                        r = -EFAULT;
+                break;
+        }
         default: {
                 struct kvm *kvm = filp->private_data;
                 r = kvm->arch.kvm_ops->arch_vm_ioctl(filp, ioctl, arg);
diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c
index 41cf5ae273cf..a95ea007d654 100644
--- a/arch/powerpc/lib/feature-fixups.c
+++ b/arch/powerpc/lib/feature-fixups.c
@@ -116,6 +116,47 @@ void do_feature_fixups(unsigned long value, void *fixup_start, void *fixup_end)
         }
 }
 
+#ifdef CONFIG_PPC_BOOK3S_64
+void do_rfi_flush_fixups(enum l1d_flush_type types)
+{
+        unsigned int instrs[3], *dest;
+        long *start, *end;
+        int i;
+
+        start = PTRRELOC(&__start___rfi_flush_fixup),
+        end = PTRRELOC(&__stop___rfi_flush_fixup);
+
+        instrs[0] = 0x60000000; /* nop */
+        instrs[1] = 0x60000000; /* nop */
+        instrs[2] = 0x60000000; /* nop */
+
+        if (types & L1D_FLUSH_FALLBACK)
+                /* b .+16 to fallback flush */
+                instrs[0] = 0x48000010;
+
+        i = 0;
+        if (types & L1D_FLUSH_ORI) {
+                instrs[i++] = 0x63ff0000; /* ori 31,31,0 speculation barrier */
+                instrs[i++] = 0x63de0000; /* ori 30,30,0 L1d flush*/
+        }
+
+        if (types & L1D_FLUSH_MTTRIG)
+                instrs[i++] = 0x7c12dba6; /* mtspr TRIG2,r0 (SPR #882) */
+
+        for (i = 0; start < end; start++, i++) {
+                dest = (void *)start + *start;
+
+                pr_devel("patching dest %lx\n", (unsigned long)dest);
+
+                patch_instruction(dest, instrs[0]);
+                patch_instruction(dest + 1, instrs[1]);
+                patch_instruction(dest + 2, instrs[2]);
+        }
+
+        printk(KERN_DEBUG "rfi-flush: patched %d locations\n", i);
+}
+#endif /* CONFIG_PPC_BOOK3S_64 */
+
 void do_lwsync_fixups(unsigned long value, void *fixup_start, void *fixup_end)
 {
         long *start, *end;
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 4797d08581ce..6e1e39035380 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -145,6 +145,11 @@ static noinline int bad_area(struct pt_regs *regs, unsigned long address)
         return __bad_area(regs, address, SEGV_MAPERR);
 }
 
+static noinline int bad_access(struct pt_regs *regs, unsigned long address)
+{
+        return __bad_area(regs, address, SEGV_ACCERR);
+}
+
 static int do_sigbus(struct pt_regs *regs, unsigned long address,
                      unsigned int fault)
 {
@@ -490,7 +495,7 @@ retry:
 
 good_area:
         if (unlikely(access_error(is_write, is_exec, vma)))
-                return bad_area(regs, address);
+                return bad_access(regs, address);
 
         /*
          * If for any reason at all we couldn't handle the fault,
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index 46d74e81aff1..d183b4801bdb 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -763,7 +763,8 @@ emit_clear:
                         func = (u8 *) __bpf_call_base + imm;
 
                         /* Save skb pointer if we need to re-cache skb data */
-                        if (bpf_helper_changes_pkt_data(func))
+                        if ((ctx->seen & SEEN_SKB) &&
+                            bpf_helper_changes_pkt_data(func))
                                 PPC_BPF_STL(3, 1, bpf_jit_stack_local(ctx));
 
                         bpf_jit_emit_func_call(image, ctx, (u64)func);
@@ -772,7 +773,8 @@ emit_clear:
                         PPC_MR(b2p[BPF_REG_0], 3);
 
                         /* refresh skb cache */
-                        if (bpf_helper_changes_pkt_data(func)) {
+                        if ((ctx->seen & SEEN_SKB) &&
+                            bpf_helper_changes_pkt_data(func)) {
                                 /* reload skb pointer to r3 */
                                 PPC_BPF_LL(3, 1, bpf_jit_stack_local(ctx));
                                 bpf_jit_emit_skb_loads(image, ctx);
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 9e3da168d54c..fce545774d50 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -410,8 +410,12 @@ static __u64 power_pmu_bhrb_to(u64 addr)
         int ret;
         __u64 target;
 
-        if (is_kernel_addr(addr))
-                return branch_target((unsigned int *)addr);
+        if (is_kernel_addr(addr)) {
+                if (probe_kernel_read(&instr, (void *)addr, sizeof(instr)))
+                        return 0;
+
+                return branch_target(&instr);
+        }
 
         /* Userspace: need copy instruction here then translate it */
         pagefault_disable();
@@ -1415,7 +1419,7 @@ static int collect_events(struct perf_event *group, int max_count,
         int n = 0;
         struct perf_event *event;
 
-        if (!is_software_event(group)) {
+        if (group->pmu->task_ctx_nr == perf_hw_context) {
                 if (n >= max_count)
                         return -1;
                 ctrs[n] = group;
@@ -1423,7 +1427,7 @@ static int collect_events(struct perf_event *group, int max_count,
                 events[n++] = group->hw.config;
         }
         list_for_each_entry(event, &group->sibling_list, group_entry) {
-                if (!is_software_event(event) &&
+                if (event->pmu->task_ctx_nr == perf_hw_context &&
                     event->state != PERF_EVENT_STATE_OFF) {
                         if (n >= max_count)
                                 return -1;
diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
index 0ead3cd73caa..be4e7f84f70a 100644
--- a/arch/powerpc/perf/imc-pmu.c
+++ b/arch/powerpc/perf/imc-pmu.c
@@ -310,6 +310,19 @@ static int ppc_nest_imc_cpu_offline(unsigned int cpu)
                 return 0;
 
         /*
+         * Check whether nest_imc is registered. We could end up here if the
+         * cpuhotplug callback registration fails. i.e, callback invokes the
+         * offline path for all successfully registered nodes. At this stage,
+         * nest_imc pmu will not be registered and we should return here.
+         *
+         * We return with a zero since this is not an offline failure. And
+         * cpuhp_setup_state() returns the actual failure reason to the caller,
+         * which in turn will call the cleanup routine.
+         */
+        if (!nest_pmus)
+                return 0;
+
+        /*
          * Now that this cpu is one of the designated,
          * find a next cpu a) which is online and b) in same chip.
          */
@@ -1171,6 +1184,7 @@ static void imc_common_cpuhp_mem_free(struct imc_pmu *pmu_ptr)
                 if (nest_pmus == 1) {
                         cpuhp_remove_state(CPUHP_AP_PERF_POWERPC_NEST_IMC_ONLINE);
                         kfree(nest_imc_refc);
+                        kfree(per_nest_pmu_arr);
                 }
 
                 if (nest_pmus > 0)
@@ -1195,7 +1209,6 @@ static void imc_common_cpuhp_mem_free(struct imc_pmu *pmu_ptr)
                 kfree(pmu_ptr->attr_groups[IMC_EVENT_ATTR]->attrs);
         kfree(pmu_ptr->attr_groups[IMC_EVENT_ATTR]);
         kfree(pmu_ptr);
-        kfree(per_nest_pmu_arr);
         return;
 }
 
@@ -1309,6 +1322,8 @@ int init_imc_pmu(struct device_node *parent, struct imc_pmu *pmu_ptr, int pmu_id
                         ret = nest_pmu_cpumask_init();
                         if (ret) {
                                 mutex_unlock(&nest_init_lock);
+                                kfree(nest_imc_refc);
+                                kfree(per_nest_pmu_arr);
                                 goto err_free;
                         }
                 }
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index 1edfbc1e40f4..4fb21e17504a 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -37,13 +37,62 @@
 #include <asm/kexec.h>
 #include <asm/smp.h>
 #include <asm/tm.h>
+#include <asm/setup.h>
 
 #include "powernv.h"
 
+static void pnv_setup_rfi_flush(void)
+{
+        struct device_node *np, *fw_features;
+        enum l1d_flush_type type;
+        int enable;
+
+        /* Default to fallback in case fw-features are not available */
+        type = L1D_FLUSH_FALLBACK;
+        enable = 1;
+
+        np = of_find_node_by_name(NULL, "ibm,opal");
+        fw_features = of_get_child_by_name(np, "fw-features");
+        of_node_put(np);
+
+        if (fw_features) {
+                np = of_get_child_by_name(fw_features, "inst-l1d-flush-trig2");
+                if (np && of_property_read_bool(np, "enabled"))
+                        type = L1D_FLUSH_MTTRIG;
+
+                of_node_put(np);
+
+                np = of_get_child_by_name(fw_features, "inst-l1d-flush-ori30,30,0");
+                if (np && of_property_read_bool(np, "enabled"))
+                        type = L1D_FLUSH_ORI;
+
+                of_node_put(np);
+
+                /* Enable unless firmware says NOT to */
+                enable = 2;
+                np = of_get_child_by_name(fw_features, "needs-l1d-flush-msr-hv-1-to-0");
+                if (np && of_property_read_bool(np, "disabled"))
+                        enable--;
+
+                of_node_put(np);
+
+                np = of_get_child_by_name(fw_features, "needs-l1d-flush-msr-pr-0-to-1");
+                if (np && of_property_read_bool(np, "disabled"))
+                        enable--;
+
+                of_node_put(np);
+                of_node_put(fw_features);
+        }
+
+        setup_rfi_flush(type, enable > 0);
+}
+
 static void __init pnv_setup_arch(void)
 {
         set_arch_panic_timeout(10, ARCH_PANIC_TIMEOUT);
 
+        pnv_setup_rfi_flush();
+
         /* Initialize SMP */
         pnv_smp_init();
 
diff --git a/arch/powerpc/platforms/ps3/setup.c b/arch/powerpc/platforms/ps3/setup.c
index 9dabea6e1443..6244bc849469 100644
--- a/arch/powerpc/platforms/ps3/setup.c
+++ b/arch/powerpc/platforms/ps3/setup.c
@@ -104,6 +104,20 @@ static void __noreturn ps3_halt(void)
         ps3_sys_manager_halt(); /* never returns */
 }
 
+static void ps3_panic(char *str)
+{
+        DBG("%s:%d %s\n", __func__, __LINE__, str);
+
+        smp_send_stop();
+        printk("\n");
+        printk("   System does not reboot automatically.\n");
+        printk("   Please press POWER button.\n");
+        printk("\n");
+
+        while(1)
+                lv1_pause(1);
+}
+
 #if defined(CONFIG_FB_PS3) || defined(CONFIG_FB_PS3_MODULE) || \
     defined(CONFIG_PS3_FLASH) || defined(CONFIG_PS3_FLASH_MODULE)
 static void __init prealloc(struct ps3_prealloc *p)
@@ -255,6 +269,7 @@ define_machine(ps3) {
         .probe                          = ps3_probe,
         .setup_arch                     = ps3_setup_arch,
         .init_IRQ                       = ps3_init_IRQ,
+        .panic                          = ps3_panic,
         .get_boot_time                  = ps3_get_boot_time,
         .set_dabr                       = ps3_set_dabr,
         .calibrate_decr                 = ps3_calibrate_decr,
diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
index 6e35780c5962..a0b20c03f078 100644
--- a/arch/powerpc/platforms/pseries/dlpar.c
+++ b/arch/powerpc/platforms/pseries/dlpar.c
@@ -574,11 +574,26 @@ static ssize_t dlpar_show(struct class *class, struct class_attribute *attr,
 
 static CLASS_ATTR_RW(dlpar);
 
-static int __init pseries_dlpar_init(void)
+int __init dlpar_workqueue_init(void)
 {
+        if (pseries_hp_wq)
+                return 0;
+
         pseries_hp_wq = alloc_workqueue("pseries hotplug workqueue",
-                                        WQ_UNBOUND, 1);
+                        WQ_UNBOUND, 1);
+
+        return pseries_hp_wq ? 0 : -ENOMEM;
+}
+
+static int __init dlpar_sysfs_init(void)
+{
+        int rc;
+
+        rc = dlpar_workqueue_init();
+        if (rc)
+                return rc;
+
         return sysfs_create_file(kernel_kobj, &class_attr_dlpar.attr);
 }
-machine_device_initcall(pseries, pseries_dlpar_init);
+machine_device_initcall(pseries, dlpar_sysfs_init);
 
diff --git a/arch/powerpc/platforms/pseries/pseries.h b/arch/powerpc/platforms/pseries/pseries.h
index 4470a3194311..1ae1d9f4dbe9 100644
--- a/arch/powerpc/platforms/pseries/pseries.h
+++ b/arch/powerpc/platforms/pseries/pseries.h
@@ -98,4 +98,6 @@ static inline unsigned long cmo_get_page_size(void)
         return CMO_PageSize;
 }
 
+int dlpar_workqueue_init(void);
+
 #endif /* _PSERIES_PSERIES_H */
diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
index 4923ffe230cf..81d8614e7379 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -69,7 +69,8 @@ static int __init init_ras_IRQ(void)
         /* Hotplug Events */
         np = of_find_node_by_path("/event-sources/hot-plug-events");
         if (np != NULL) {
-                request_event_sources_irqs(np, ras_hotplug_interrupt,
+                if (dlpar_workqueue_init() == 0)
+                        request_event_sources_irqs(np, ras_hotplug_interrupt,
                                            "RAS_HOTPLUG");
                 of_node_put(np);
         }
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 5f1beb8367ac..ae4f596273b5 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -459,6 +459,39 @@ static void __init find_and_init_phbs(void)
         of_pci_check_probe_only();
 }
 
+static void pseries_setup_rfi_flush(void)
+{
+        struct h_cpu_char_result result;
+        enum l1d_flush_type types;
+        bool enable;
+        long rc;
+
+        /* Enable by default */
+        enable = true;
+
+        rc = plpar_get_cpu_characteristics(&result);
+        if (rc == H_SUCCESS) {
+                types = L1D_FLUSH_NONE;
+
+                if (result.character & H_CPU_CHAR_L1D_FLUSH_TRIG2)
+                        types |= L1D_FLUSH_MTTRIG;
+                if (result.character & H_CPU_CHAR_L1D_FLUSH_ORI30)
+                        types |= L1D_FLUSH_ORI;
+
+                /* Use fallback if nothing set in hcall */
+                if (types == L1D_FLUSH_NONE)
+                        types = L1D_FLUSH_FALLBACK;
+
+                if (!(result.behaviour & H_CPU_BEHAV_L1D_FLUSH_PR))
+                        enable = false;
+        } else {
+                /* Default to fallback if case hcall is not available */
+                types = L1D_FLUSH_FALLBACK;
+        }
+
+        setup_rfi_flush(types, enable);
+}
+
 static void __init pSeries_setup_arch(void)
 {
         set_arch_panic_timeout(10, ARCH_PANIC_TIMEOUT);
@@ -476,6 +509,8 @@ static void __init pSeries_setup_arch(void)
 
         fwnmi_init();
 
+        pseries_setup_rfi_flush();
+
         /* By default, only probe PCI (can be overridden by rtas_pci) */
         pci_add_flags(PCI_PROBE_ONLY);
 
@@ -726,6 +761,7 @@ define_machine(pseries) {
         .pcibios_fixup          = pSeries_final_fixup,
         .restart                = rtas_restart,
         .halt                   = rtas_halt,
+        .panic                  = rtas_os_term,
         .get_boot_time          = rtas_get_boot_time,
         .get_rtc_time           = rtas_get_rtc_time,
         .set_rtc_time           = rtas_set_rtc_time,
diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c
index 44cbf4c12ea1..df95102e732c 100644
--- a/arch/powerpc/sysdev/fsl_msi.c
+++ b/arch/powerpc/sysdev/fsl_msi.c
@@ -354,6 +354,7 @@ static int fsl_of_msi_remove(struct platform_device *ofdev)
 }
 
 static struct lock_class_key fsl_msi_irq_class;
+static struct lock_class_key fsl_msi_irq_request_class;
 
 static int fsl_msi_setup_hwirq(struct fsl_msi *msi, struct platform_device *dev,
                                int offset, int irq_index)
@@ -373,7 +374,8 @@ static int fsl_msi_setup_hwirq(struct fsl_msi *msi, struct platform_device *dev,
                 dev_err(&dev->dev, "No memory for MSI cascade data\n");
                 return -ENOMEM;
         }
-        irq_set_lockdep_class(virt_msir, &fsl_msi_irq_class);
+        irq_set_lockdep_class(virt_msir, &fsl_msi_irq_class,
+                              &fsl_msi_irq_request_class);
         cascade_data->index = offset;
         cascade_data->msi_data = msi;
         cascade_data->virq = virt_msir;
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index 1b2d8cb49abb..0ddc7ac6c5f1 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -1590,7 +1590,7 @@ static void print_bug_trap(struct pt_regs *regs)
         printf("kernel BUG at %s:%u!\n",
                bug->file, bug->line);
 #else
-        printf("kernel BUG at %p!\n", (void *)bug->bug_addr);
+        printf("kernel BUG at %px!\n", (void *)bug->bug_addr);
 #endif
 #endif /* CONFIG_BUG */
 }
@@ -2329,7 +2329,7 @@ static void dump_one_paca(int cpu)
 
         p = &paca[cpu];
 
-        printf("paca for cpu 0x%x @ %p:\n", cpu, p);
+        printf("paca for cpu 0x%x @ %px:\n", cpu, p);
 
         printf(" %-*s = %s\n", 20, "possible", cpu_possible(cpu) ? "yes" : "no");
         printf(" %-*s = %s\n", 20, "present", cpu_present(cpu) ? "yes" : "no");
@@ -2344,10 +2344,10 @@ static void dump_one_paca(int cpu)
         DUMP(p, kernel_toc, "lx");
         DUMP(p, kernelbase, "lx");
         DUMP(p, kernel_msr, "lx");
-        DUMP(p, emergency_sp, "p");
+        DUMP(p, emergency_sp, "px");
 #ifdef CONFIG_PPC_BOOK3S_64
-        DUMP(p, nmi_emergency_sp, "p");
-        DUMP(p, mc_emergency_sp, "p");
+        DUMP(p, nmi_emergency_sp, "px");
+        DUMP(p, mc_emergency_sp, "px");
         DUMP(p, in_nmi, "x");
         DUMP(p, in_mce, "x");
         DUMP(p, hmi_event_available, "x");
@@ -2375,17 +2375,21 @@ static void dump_one_paca(int cpu)
         DUMP(p, slb_cache_ptr, "x");
         for (i = 0; i < SLB_CACHE_ENTRIES; i++)
                 printf(" slb_cache[%d]:        = 0x%016lx\n", i, p->slb_cache[i]);
+
+        DUMP(p, rfi_flush_fallback_area, "px");
+        DUMP(p, l1d_flush_congruence, "llx");
+        DUMP(p, l1d_flush_sets, "llx");
 #endif
         DUMP(p, dscr_default, "llx");
 #ifdef CONFIG_PPC_BOOK3E
-        DUMP(p, pgd, "p");
-        DUMP(p, kernel_pgd, "p");
-        DUMP(p, tcd_ptr, "p");
-        DUMP(p, mc_kstack, "p");
-        DUMP(p, crit_kstack, "p");
-        DUMP(p, dbg_kstack, "p");
+        DUMP(p, pgd, "px");
+        DUMP(p, kernel_pgd, "px");
+        DUMP(p, tcd_ptr, "px");
+        DUMP(p, mc_kstack, "px");
+        DUMP(p, crit_kstack, "px");
+        DUMP(p, dbg_kstack, "px");
 #endif
-        DUMP(p, __current, "p");
+        DUMP(p, __current, "px");
         DUMP(p, kstack, "lx");
         printf(" kstack_base          = 0x%016lx\n", p->kstack & ~(THREAD_SIZE - 1));
         DUMP(p, stab_rr, "lx");
@@ -2403,7 +2407,7 @@ static void dump_one_paca(int cpu)
 #endif
 
 #ifdef CONFIG_PPC_POWERNV
-        DUMP(p, core_idle_state_ptr, "p");
+        DUMP(p, core_idle_state_ptr, "px");
         DUMP(p, thread_idle_state, "x");
         DUMP(p, thread_mask, "x");
         DUMP(p, subcore_sibling_mask, "x");
@@ -2945,7 +2949,7 @@ static void show_task(struct task_struct *tsk)
                 (tsk->exit_state & EXIT_DEAD) ? 'E' :
                 (tsk->state & TASK_INTERRUPTIBLE) ? 'S' : '?';
 
-        printf("%p %016lx %6d %6d %c %2d %s\n", tsk,
+        printf("%px %016lx %6d %6d %c %2d %s\n", tsk,
                 tsk->thread.ksp,
                 tsk->pid, tsk->parent->pid,
                 state, task_thread_info(tsk)->cpu,
@@ -2988,7 +2992,7 @@ static void show_pte(unsigned long addr)
 
         if (setjmp(bus_error_jmp) != 0) {
                 catch_memory_errors = 0;
-                printf("*** Error dumping pte for task %p\n", tsk);
+                printf("*** Error dumping pte for task %px\n", tsk);
                 return;
         }
 
@@ -3074,7 +3078,7 @@ static void show_tasks(void)
 
         if (setjmp(bus_error_jmp) != 0) {
                 catch_memory_errors = 0;
-                printf("*** Error dumping task %p\n", tsk);
+                printf("*** Error dumping task %px\n", tsk);
                 return;
         }
 
diff --git a/arch/riscv/configs/defconfig b/arch/riscv/configs/defconfig
index e69de29bb2d1..47dacf06c679 100644
--- a/arch/riscv/configs/defconfig
+++ b/arch/riscv/configs/defconfig
@@ -0,0 +1,75 @@
+CONFIG_SMP=y
+CONFIG_PCI=y
+CONFIG_PCIE_XILINX=y
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_CGROUPS=y
+CONFIG_CGROUP_SCHED=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_CGROUP_BPF=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EXPERT=y
+CONFIG_CHECKPOINT_RESTORE=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_NETLINK_DIAG=y
+CONFIG_DEVTMPFS=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_DEV_SR=y
+CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_NETDEVICES=y
+CONFIG_VIRTIO_NET=y
+CONFIG_MACB=y
+CONFIG_E1000E=y
+CONFIG_R8169=y
+CONFIG_MICROSEMI_PHY=y
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_OF_PLATFORM=y
+# CONFIG_PTP_1588_CLOCK is not set
+CONFIG_DRM=y
+CONFIG_DRM_RADEON=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PLATFORM=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_HCD_PLATFORM=y
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_UAS=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_RAS=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_AUTOFS4_FS=y
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_V4_1=y
+CONFIG_NFS_V4_2=y
+CONFIG_ROOT_NFS=y
+# CONFIG_RCU_TRACE is not set
+CONFIG_CRYPTO_USER_API_HASH=y
diff --git a/arch/riscv/include/asm/barrier.h b/arch/riscv/include/asm/barrier.h
index 773c4e039cd7..c0319cbf1eec 100644
--- a/arch/riscv/include/asm/barrier.h
+++ b/arch/riscv/include/asm/barrier.h
@@ -38,6 +38,25 @@
 #define smp_rmb()       RISCV_FENCE(r,r)
 #define smp_wmb()       RISCV_FENCE(w,w)
 
+/*
+ * This is a very specific barrier: it's currently only used in two places in
+ * the kernel, both in the scheduler.  See include/linux/spinlock.h for the two
+ * orderings it guarantees, but the "critical section is RCsc" guarantee
+ * mandates a barrier on RISC-V.  The sequence looks like:
+ *
+ *    lr.aq lock
+ *    sc    lock <= LOCKED
+ *    smp_mb__after_spinlock()
+ *    // critical section
+ *    lr    lock
+ *    sc.rl lock <= UNLOCKED
+ *
+ * The AQ/RL pair provides a RCpc critical section, but there's not really any
+ * way we can take advantage of that here because the ordering is only enforced
+ * on that one lock.  Thus, we're just doing a full fence.
+ */
+#define smp_mb__after_spinlock()        RISCV_FENCE(rw,rw)
+
 #include <asm-generic/barrier.h>
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/riscv/include/asm/csr.h b/arch/riscv/include/asm/csr.h
index 0d64bc9f4f91..3c7a2c97e377 100644
--- a/arch/riscv/include/asm/csr.h
+++ b/arch/riscv/include/asm/csr.h
@@ -17,10 +17,10 @@
 #include <linux/const.h>
 
 /* Status register flags */
-#define SR_IE   _AC(0x00000002, UL) /* Interrupt Enable */
-#define SR_PIE  _AC(0x00000020, UL) /* Previous IE */
-#define SR_PS   _AC(0x00000100, UL) /* Previously Supervisor */
-#define SR_SUM  _AC(0x00040000, UL) /* Supervisor may access User Memory */
+#define SR_SIE  _AC(0x00000002, UL) /* Supervisor Interrupt Enable */
+#define SR_SPIE _AC(0x00000020, UL) /* Previous Supervisor IE */
+#define SR_SPP  _AC(0x00000100, UL) /* Previously Supervisor */
+#define SR_SUM  _AC(0x00040000, UL) /* Supervisor may access User Memory */
 
 #define SR_FS           _AC(0x00006000, UL) /* Floating-point Status */
 #define SR_FS_OFF       _AC(0x00000000, UL)
diff --git a/arch/riscv/include/asm/io.h b/arch/riscv/include/asm/io.h
index a82ce599b639..b269451e7e85 100644
--- a/arch/riscv/include/asm/io.h
+++ b/arch/riscv/include/asm/io.h
@@ -21,8 +21,6 @@
 
 #include <linux/types.h>
 
-#ifdef CONFIG_MMU
-
 extern void __iomem *ioremap(phys_addr_t offset, unsigned long size);
 
 /*
@@ -36,8 +34,6 @@ extern void __iomem *ioremap(phys_addr_t offset, unsigned long size);
 
 extern void iounmap(volatile void __iomem *addr);
 
-#endif /* CONFIG_MMU */
-
 /* Generic IO read/write.  These perform native-endian accesses. */
 #define __raw_writeb __raw_writeb
 static inline void __raw_writeb(u8 val, volatile void __iomem *addr)
diff --git a/arch/riscv/include/asm/irqflags.h b/arch/riscv/include/asm/irqflags.h
index 6fdc860d7f84..07a3c6d5706f 100644
--- a/arch/riscv/include/asm/irqflags.h
+++ b/arch/riscv/include/asm/irqflags.h
@@ -27,25 +27,25 @@ static inline unsigned long arch_local_save_flags(void)
 /* unconditionally enable interrupts */
 static inline void arch_local_irq_enable(void)
 {
-        csr_set(sstatus, SR_IE);
+        csr_set(sstatus, SR_SIE);
 }
 
 /* unconditionally disable interrupts */
 static inline void arch_local_irq_disable(void)
 {
-        csr_clear(sstatus, SR_IE);
+        csr_clear(sstatus, SR_SIE);
 }
 
 /* get status and disable interrupts */
 static inline unsigned long arch_local_irq_save(void)
 {
-        return csr_read_clear(sstatus, SR_IE);
+        return csr_read_clear(sstatus, SR_SIE);
 }
 
 /* test flags */
 static inline int arch_irqs_disabled_flags(unsigned long flags)
 {
-        return !(flags & SR_IE);
+        return !(flags & SR_SIE);
 }
 
 /* test hardware interrupt enable bit */
@@ -57,7 +57,7 @@ static inline int arch_irqs_disabled(void)
 /* set interrupt enabled status */
 static inline void arch_local_irq_restore(unsigned long flags)
 {
-        csr_set(sstatus, flags & SR_IE);
+        csr_set(sstatus, flags & SR_SIE);
 }
 
 #endif /* _ASM_RISCV_IRQFLAGS_H */
diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
index 2cbd92ed1629..16301966d65b 100644
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -20,8 +20,6 @@
 
 #ifndef __ASSEMBLY__
 
-#ifdef CONFIG_MMU
-
 /* Page Upper Directory not used in RISC-V */
 #include <asm-generic/pgtable-nopud.h>
 #include <asm/page.h>
@@ -413,8 +411,6 @@ static inline void pgtable_cache_init(void)
         /* No page table caches to initialize */
 }
 
-#endif /* CONFIG_MMU */
-
 #define VMALLOC_SIZE     (KERN_VIRT_SIZE >> 1)
 #define VMALLOC_END      (PAGE_OFFSET - 1)
 #define VMALLOC_START    (PAGE_OFFSET - VMALLOC_SIZE)
diff --git a/arch/riscv/include/asm/ptrace.h b/arch/riscv/include/asm/ptrace.h
index 93b8956e25e4..2c5df945d43c 100644
--- a/arch/riscv/include/asm/ptrace.h
+++ b/arch/riscv/include/asm/ptrace.h
@@ -66,7 +66,7 @@ struct pt_regs {
 #define REG_FMT "%08lx"
 #endif
 
-#define user_mode(regs) (((regs)->sstatus & SR_PS) == 0)
+#define user_mode(regs) (((regs)->sstatus & SR_SPP) == 0)
 
 
 /* Helpers for working with the instruction pointer */
diff --git a/arch/riscv/include/asm/tlbflush.h b/arch/riscv/include/asm/tlbflush.h
index 715b0f10af58..7b9c24ebdf52 100644
--- a/arch/riscv/include/asm/tlbflush.h
+++ b/arch/riscv/include/asm/tlbflush.h
@@ -15,8 +15,6 @@
 #ifndef _ASM_RISCV_TLBFLUSH_H
 #define _ASM_RISCV_TLBFLUSH_H
 
-#ifdef CONFIG_MMU
-
 #include <linux/mm_types.h>
 
 /*
@@ -64,6 +62,4 @@ static inline void flush_tlb_kernel_range(unsigned long start,
         flush_tlb_all();
 }
 
-#endif /* CONFIG_MMU */
-
 #endif /* _ASM_RISCV_TLBFLUSH_H */
diff --git a/arch/riscv/include/asm/uaccess.h b/arch/riscv/include/asm/uaccess.h
index 27b90d64814b..14b0b22fb578 100644
--- a/arch/riscv/include/asm/uaccess.h
+++ b/arch/riscv/include/asm/uaccess.h
@@ -127,7 +127,6 @@ extern int fixup_exception(struct pt_regs *state);
  * call.
  */
 
-#ifdef CONFIG_MMU
 #define __get_user_asm(insn, x, ptr, err)                       \
 do {                                                            \
         uintptr_t __tmp;                                        \
@@ -153,13 +152,11 @@ do {								\
         __disable_user_access();                                \
         (x) = __x;                                              \
 } while (0)
-#endif /* CONFIG_MMU */
 
 #ifdef CONFIG_64BIT
 #define __get_user_8(x, ptr, err) \
         __get_user_asm("ld", x, ptr, err)
 #else /* !CONFIG_64BIT */
-#ifdef CONFIG_MMU
 #define __get_user_8(x, ptr, err)                               \
 do {                                                            \
         u32 __user *__ptr = (u32 __user *)(ptr);                \
@@ -193,7 +190,6 @@ do {								\
         (x) = (__typeof__(x))((__typeof__((x)-(x)))(            \
                 (((u64)__hi << 32) | __lo)));                   \
 } while (0)
-#endif /* CONFIG_MMU */
 #endif /* CONFIG_64BIT */
 
 
@@ -267,8 +263,6 @@ do {								\
                 ((x) = 0, -EFAULT);                             \
 })
 
-
-#ifdef CONFIG_MMU
 #define __put_user_asm(insn, x, ptr, err)                       \
 do {                                                            \
         uintptr_t __tmp;                                        \
@@ -292,14 +286,11 @@ do {								\
                 : "rJ" (__x), "i" (-EFAULT));                   \
         __disable_user_access();                                \
 } while (0)
-#endif /* CONFIG_MMU */
-
 
 #ifdef CONFIG_64BIT
 #define __put_user_8(x, ptr, err) \
         __put_user_asm("sd", x, ptr, err)
 #else /* !CONFIG_64BIT */
-#ifdef CONFIG_MMU
 #define __put_user_8(x, ptr, err)                               \
 do {                                                            \
         u32 __user *__ptr = (u32 __user *)(ptr);                \
@@ -329,7 +320,6 @@ do {								\
                 : "rJ" (__x), "rJ" (__x >> 32), "i" (-EFAULT)); \
         __disable_user_access();                                \
 } while (0)
-#endif /* CONFIG_MMU */
 #endif /* CONFIG_64BIT */
 
 
@@ -438,7 +428,6 @@ unsigned long __must_check clear_user(void __user *to, unsigned long n)
  * will set "err" to -EFAULT, while successful accesses return the previous
  * value.
  */
-#ifdef CONFIG_MMU
 #define __cmpxchg_user(ptr, old, new, err, size, lrb, scb)      \
 ({                                                              \
         __typeof__(ptr) __ptr = (ptr);                          \
@@ -508,6 +497,5 @@ unsigned long __must_check clear_user(void __user *to, unsigned long n)
         (err) = __err;                                          \
         __ret;                                                  \
 })
-#endif /* CONFIG_MMU */
 
 #endif /* _ASM_RISCV_UACCESS_H */
diff --git a/arch/riscv/include/asm/unistd.h b/arch/riscv/include/asm/unistd.h
index 9f250ed007cd..2f704a5c4196 100644
--- a/arch/riscv/include/asm/unistd.h
+++ b/arch/riscv/include/asm/unistd.h
@@ -14,3 +14,4 @@
 #define __ARCH_HAVE_MMU
 #define __ARCH_WANT_SYS_CLONE
 #include <uapi/asm/unistd.h>
+#include <uapi/asm/syscalls.h>
diff --git a/arch/riscv/include/asm/vdso-syscalls.h b/arch/riscv/include/asm/vdso-syscalls.h
deleted file mode 100644
index a2ccf1894929..000000000000
--- a/arch/riscv/include/asm/vdso-syscalls.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright (C) 2017 SiFive
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#ifndef _ASM_RISCV_VDSO_SYSCALLS_H
-#define _ASM_RISCV_VDSO_SYSCALLS_H
-
-#ifdef CONFIG_SMP
-
-/* These syscalls are only used by the vDSO and are not in the uapi. */
-#define __NR_riscv_flush_icache (__NR_arch_specific_syscall + 15)
-__SYSCALL(__NR_riscv_flush_icache, sys_riscv_flush_icache)
-
-#endif
-
-#endif /* _ASM_RISCV_VDSO_H */
diff --git a/arch/riscv/include/uapi/asm/Kbuild b/arch/riscv/include/uapi/asm/Kbuild
index 5ded96b06352..7e91f4850475 100644
--- a/arch/riscv/include/uapi/asm/Kbuild
+++ b/arch/riscv/include/uapi/asm/Kbuild
@@ -3,6 +3,7 @@ include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += setup.h
 generic-y += unistd.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += fcntl.h
 generic-y += ioctl.h
diff --git a/arch/riscv/include/uapi/asm/syscalls.h b/arch/riscv/include/uapi/asm/syscalls.h
new file mode 100644
index 000000000000..818655b0d535
--- /dev/null
+++ b/arch/riscv/include/uapi/asm/syscalls.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2017 SiFive
+ */
+
+#ifndef _ASM__UAPI__SYSCALLS_H
+#define _ASM__UAPI__SYSCALLS_H
+
+/*
+ * Allows the instruction cache to be flushed from userspace.  Despite RISC-V
+ * having a direct 'fence.i' instruction available to userspace (which we
+ * can't trap!), that's not actually viable when running on Linux because the
+ * kernel might schedule a process on another hart.  There is no way for
+ * userspace to handle this without invoking the kernel (as it doesn't know the
+ * thread->hart mappings), so we've defined a RISC-V specific system call to
+ * flush the instruction cache.
+ *
+ * __NR_riscv_flush_icache is defined to flush the instruction cache over an
+ * address range, with the flush applying to either all threads or just the
+ * caller.  We don't currently do anything with the address range, that's just
+ * in there for forwards compatibility.
+ */
+#define __NR_riscv_flush_icache (__NR_arch_specific_syscall + 15)
+__SYSCALL(__NR_riscv_flush_icache, sys_riscv_flush_icache)
+
+#endif
diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
index 20ee86f782a9..7404ec222406 100644
--- a/arch/riscv/kernel/entry.S
+++ b/arch/riscv/kernel/entry.S
@@ -196,7 +196,7 @@ handle_syscall:
         addi s2, s2, 0x4
         REG_S s2, PT_SEPC(sp)
         /* System calls run with interrupts enabled */
-        csrs sstatus, SR_IE
+        csrs sstatus, SR_SIE
         /* Trace syscalls, but only if requested by the user. */
         REG_L t0, TASK_TI_FLAGS(tp)
         andi t0, t0, _TIF_SYSCALL_TRACE
@@ -224,8 +224,8 @@ ret_from_syscall:
 
 ret_from_exception:
         REG_L s0, PT_SSTATUS(sp)
-        csrc sstatus, SR_IE
-        andi s0, s0, SR_PS
+        csrc sstatus, SR_SIE
+        andi s0, s0, SR_SPP
         bnez s0, restore_all
 
 resume_userspace:
@@ -255,7 +255,7 @@ work_pending:
         bnez s1, work_resched
 work_notifysig:
         /* Handle pending signals and notify-resume requests */
-        csrs sstatus, SR_IE /* Enable interrupts for do_notify_resume() */
+        csrs sstatus, SR_SIE /* Enable interrupts for do_notify_resume() */
         move a0, sp /* pt_regs */
         move a1, s0 /* current_thread_info->flags */
         tail do_notify_resume
diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
index 0d90dcc1fbd3..d74d4adf2d54 100644
--- a/arch/riscv/kernel/process.c
+++ b/arch/riscv/kernel/process.c
@@ -76,7 +76,7 @@ void show_regs(struct pt_regs *regs)
 void start_thread(struct pt_regs *regs, unsigned long pc,
         unsigned long sp)
 {
-        regs->sstatus = SR_PIE /* User mode, irqs on */ | SR_FS_INITIAL;
+        regs->sstatus = SR_SPIE /* User mode, irqs on */ | SR_FS_INITIAL;
         regs->sepc = pc;
         regs->sp = sp;
         set_fs(USER_DS);
@@ -110,7 +110,7 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
                 const register unsigned long gp __asm__ ("gp");
                 memset(childregs, 0, sizeof(struct pt_regs));
                 childregs->gp = gp;
-                childregs->sstatus = SR_PS | SR_PIE; /* Supervisor, irqs on */
+                childregs->sstatus = SR_SPP | SR_SPIE; /* Supervisor, irqs on */
 
                 p->thread.ra = (unsigned long)ret_from_kernel_thread;
                 p->thread.s[0] = usp; /* fn */
diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
index 8fbb6749910d..cb7b0c63014e 100644
--- a/arch/riscv/kernel/setup.c
+++ b/arch/riscv/kernel/setup.c
@@ -38,10 +38,6 @@
 #include <asm/tlbflush.h>
 #include <asm/thread_info.h>
 
-#ifdef CONFIG_HVC_RISCV_SBI
-#include <asm/hvc_riscv_sbi.h>
-#endif
-
 #ifdef CONFIG_DUMMY_CONSOLE
 struct screen_info screen_info = {
         .orig_video_lines       = 30,
@@ -212,13 +208,6 @@ static void __init setup_bootmem(void)
 
 void __init setup_arch(char **cmdline_p)
 {
-#if defined(CONFIG_HVC_RISCV_SBI)
-        if (likely(early_console == NULL)) {
-                early_console = &riscv_sbi_early_console_dev;
-                register_console(early_console);
-        }
-#endif
-
 #ifdef CONFIG_CMDLINE_BOOL
 #ifdef CONFIG_CMDLINE_OVERRIDE
         strlcpy(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);
diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c
index a2ae936a093e..79c78668258e 100644
--- a/arch/riscv/kernel/sys_riscv.c
+++ b/arch/riscv/kernel/sys_riscv.c
@@ -70,7 +70,7 @@ SYSCALL_DEFINE3(riscv_flush_icache, uintptr_t, start, uintptr_t, end,
         bool local = (flags & SYS_RISCV_FLUSH_ICACHE_LOCAL) != 0;
 
         /* Check the reserved flags. */
-        if (unlikely(flags & !SYS_RISCV_FLUSH_ICACHE_ALL))
+        if (unlikely(flags & ~SYS_RISCV_FLUSH_ICACHE_ALL))
                 return -EINVAL;
 
         flush_icache_mm(mm, local);
diff --git a/arch/riscv/kernel/syscall_table.c b/arch/riscv/kernel/syscall_table.c
index a5bd6401f95e..ade52b903a43 100644
--- a/arch/riscv/kernel/syscall_table.c
+++ b/arch/riscv/kernel/syscall_table.c
@@ -23,5 +23,4 @@
 void *sys_call_table[__NR_syscalls] = {
         [0 ... __NR_syscalls - 1] = sys_ni_syscall,
 #include <asm/unistd.h>
-#include <asm/vdso-syscalls.h>
 };
diff --git a/arch/riscv/kernel/vdso/flush_icache.S b/arch/riscv/kernel/vdso/flush_icache.S
index b0fbad74e873..023e4d4aef58 100644
--- a/arch/riscv/kernel/vdso/flush_icache.S
+++ b/arch/riscv/kernel/vdso/flush_icache.S
@@ -13,7 +13,6 @@
 
 #include <linux/linkage.h>
 #include <asm/unistd.h>
-#include <asm/vdso-syscalls.h>
 
         .text
 /* int __vdso_flush_icache(void *start, void *end, unsigned long flags); */
diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c
index df2ca3c65048..0713f3c67ab4 100644
--- a/arch/riscv/mm/fault.c
+++ b/arch/riscv/mm/fault.c
@@ -63,7 +63,7 @@ asmlinkage void do_page_fault(struct pt_regs *regs)
                 goto vmalloc_fault;
 
         /* Enable interrupts if they were enabled in the parent context. */
-        if (likely(regs->sstatus & SR_PIE))
+        if (likely(regs->sstatus & SR_SPIE))
                 local_irq_enable();
 
         /*
diff --git a/arch/s390/Kbuild b/arch/s390/Kbuild
index eae2c64cf69d..9fdff3fe1a42 100644
--- a/arch/s390/Kbuild
+++ b/arch/s390/Kbuild
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 obj-y                           += kernel/
 obj-y                           += mm/
 obj-$(CONFIG_KVM)               += kvm/
diff --git a/arch/s390/appldata/Makefile b/arch/s390/appldata/Makefile
index 99f1cf071304..b06def4a4f2f 100644
--- a/arch/s390/appldata/Makefile
+++ b/arch/s390/appldata/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Makefile for the Linux - z/VM Monitor Stream.
 #
diff --git a/arch/s390/boot/compressed/vmlinux.scr b/arch/s390/boot/compressed/vmlinux.scr
index f02382ae5c48..42a242597f34 100644
--- a/arch/s390/boot/compressed/vmlinux.scr
+++ b/arch/s390/boot/compressed/vmlinux.scr
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 SECTIONS
 {
   .rodata.compressed : {
diff --git a/arch/s390/crypto/sha1_s390.c b/arch/s390/crypto/sha1_s390.c
index c7de53d8da75..a00c17f761c1 100644
--- a/arch/s390/crypto/sha1_s390.c
+++ b/arch/s390/crypto/sha1_s390.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0+
 /*
  * Cryptographic API.
  *
@@ -16,12 +17,6 @@
  *   Copyright (c) Alan Smithee.
  *   Copyright (c) Andrew McDonald <andrew@mcdonald.org.uk>
  *   Copyright (c) Jean-Francois Dive <jef@linuxbe.org>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation; either version 2 of the License, or (at your option)
- * any later version.
- *
  */
 #include <crypto/internal/hash.h>
 #include <linux/init.h>
diff --git a/arch/s390/hypfs/Makefile b/arch/s390/hypfs/Makefile
index 2ee25ba252d6..06f601509ce9 100644
--- a/arch/s390/hypfs/Makefile
+++ b/arch/s390/hypfs/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Makefile for the linux hypfs filesystem routines.
 #
diff --git a/arch/s390/include/asm/Kbuild b/arch/s390/include/asm/Kbuild
index 41c211a4d8b1..048450869328 100644
--- a/arch/s390/include/asm/Kbuild
+++ b/arch/s390/include/asm/Kbuild
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 generic-y += asm-offsets.h
 generic-y += cacheflush.h
 generic-y += clkdev.h
diff --git a/arch/s390/include/asm/alternative.h b/arch/s390/include/asm/alternative.h
index a72002056b54..c2cf7bcdef9b 100644
--- a/arch/s390/include/asm/alternative.h
+++ b/arch/s390/include/asm/alternative.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 #ifndef _ASM_S390_ALTERNATIVE_H
 #define _ASM_S390_ALTERNATIVE_H
 
diff --git a/arch/s390/include/asm/ap.h b/arch/s390/include/asm/ap.h
index c02f4aba88a6..cfce6835b109 100644
--- a/arch/s390/include/asm/ap.h
+++ b/arch/s390/include/asm/ap.h
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Adjunct processor (AP) interfaces
  *
  * Copyright IBM Corp. 2017
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
- *
  * Author(s): Tony Krowiak <akrowia@linux.vnet.ibm.com>
  *            Martin Schwidefsky <schwidefsky@de.ibm.com>
  *            Harald Freudenberger <freude@de.ibm.com>
diff --git a/arch/s390/include/asm/bugs.h b/arch/s390/include/asm/bugs.h
index 0f5bd894f4dc..aa42a179be33 100644
--- a/arch/s390/include/asm/bugs.h
+++ b/arch/s390/include/asm/bugs.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  *  S390 version
  *    Copyright IBM Corp. 1999
diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index e14f381757f6..c1b0a9ac1dc8 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -207,7 +207,8 @@ struct kvm_s390_sie_block {
         __u16   ipa;                    /* 0x0056 */
         __u32   ipb;                    /* 0x0058 */
         __u32   scaoh;                  /* 0x005c */
-        __u8    reserved60;             /* 0x0060 */
+#define FPF_BPBC        0x20
+        __u8    fpf;                    /* 0x0060 */
 #define ECB_GS          0x40
 #define ECB_TE          0x10
 #define ECB_SRSI        0x04
diff --git a/arch/s390/include/asm/perf_event.h b/arch/s390/include/asm/perf_event.h
index d6c9d1e0dc2d..b9c0e361748b 100644
--- a/arch/s390/include/asm/perf_event.h
+++ b/arch/s390/include/asm/perf_event.h
@@ -40,6 +40,7 @@ struct pt_regs;
 extern unsigned long perf_instruction_pointer(struct pt_regs *regs);
 extern unsigned long perf_misc_flags(struct pt_regs *regs);
 #define perf_misc_flags(regs) perf_misc_flags(regs)
+#define perf_arch_bpf_user_pt_regs(regs) &regs->user_regs
 
 /* Perf pt_regs extension for sample-data-entry indicators */
 struct perf_sf_sde_regs {
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 57d7bc92e0b8..0a6b0286c32e 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -1264,12 +1264,6 @@ static inline pud_t pud_mkwrite(pud_t pud)
         return pud;
 }
 
-#define pud_write pud_write
-static inline int pud_write(pud_t pud)
-{
-        return (pud_val(pud) & _REGION3_ENTRY_WRITE) != 0;
-}
-
 static inline pud_t pud_mkclean(pud_t pud)
 {
         if (pud_large(pud)) {
diff --git a/arch/s390/include/asm/ptrace.h b/arch/s390/include/asm/ptrace.h
index a3788dafc0e1..6f70d81c40f2 100644
--- a/arch/s390/include/asm/ptrace.h
+++ b/arch/s390/include/asm/ptrace.h
@@ -74,9 +74,14 @@ enum {
  */
 struct pt_regs 
 {
-        unsigned long args[1];
-        psw_t psw;
-        unsigned long gprs[NUM_GPRS];
+        union {
+                user_pt_regs user_regs;
+                struct {
+                        unsigned long args[1];
+                        psw_t psw;
+                        unsigned long gprs[NUM_GPRS];
+                };
+        };
         unsigned long orig_gpr2;
         unsigned int int_code;
         unsigned int int_parm;
diff --git a/arch/s390/include/asm/segment.h b/arch/s390/include/asm/segment.h
index 8bfce3475b1c..97a0582b8d0f 100644
--- a/arch/s390/include/asm/segment.h
+++ b/arch/s390/include/asm/segment.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 #ifndef _ASM_SEGMENT_H
 #define _ASM_SEGMENT_H
 
diff --git a/arch/s390/include/asm/switch_to.h b/arch/s390/include/asm/switch_to.h
index ec7b476c1ac5..c61b2cc1a8a8 100644
--- a/arch/s390/include/asm/switch_to.h
+++ b/arch/s390/include/asm/switch_to.h
@@ -30,21 +30,20 @@ static inline void restore_access_regs(unsigned int *acrs)
         asm volatile("lam 0,15,%0" : : "Q" (*(acrstype *)acrs));
 }
 
-#define switch_to(prev,next,last) do {                                  \
-        if (prev->mm) {                                                 \
-                save_fpu_regs();                                        \
-                save_access_regs(&prev->thread.acrs[0]);                \
-                save_ri_cb(prev->thread.ri_cb);                         \
-                save_gs_cb(prev->thread.gs_cb);                         \
-        }                                                               \
+#define switch_to(prev, next, last) do {                                \
+        /* save_fpu_regs() sets the CIF_FPU flag, which enforces        \
+         * a restore of the floating point / vector registers as        \
+         * soon as the next task returns to user space                  \
+         */                                                             \
+        save_fpu_regs();                                                \
+        save_access_regs(&prev->thread.acrs[0]);                        \
+        save_ri_cb(prev->thread.ri_cb);                                 \
+        save_gs_cb(prev->thread.gs_cb);                                 \
         update_cr_regs(next);                                           \
-        if (next->mm) {                                                 \
-                set_cpu_flag(CIF_FPU);                                  \
-                restore_access_regs(&next->thread.acrs[0]);             \
-                restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb);  \
-                restore_gs_cb(next->thread.gs_cb);                      \
-        }                                                               \
-        prev = __switch_to(prev,next);                                  \
+        restore_access_regs(&next->thread.acrs[0]);                     \
+        restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb);          \
+        restore_gs_cb(next->thread.gs_cb);                              \
+        prev = __switch_to(prev, next);                                 \
 } while (0)
 
 #endif /* __ASM_SWITCH_TO_H */
diff --git a/arch/s390/include/asm/vga.h b/arch/s390/include/asm/vga.h
index d375526c261f..605dc46bac5e 100644
--- a/arch/s390/include/asm/vga.h
+++ b/arch/s390/include/asm/vga.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 #ifndef _ASM_S390_VGA_H
 #define _ASM_S390_VGA_H
 
diff --git a/arch/s390/include/uapi/asm/Kbuild b/arch/s390/include/uapi/asm/Kbuild
index 098f28778a13..92b7c9b3e641 100644
--- a/arch/s390/include/uapi/asm/Kbuild
+++ b/arch/s390/include/uapi/asm/Kbuild
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
 
diff --git a/arch/s390/include/uapi/asm/bpf_perf_event.h b/arch/s390/include/uapi/asm/bpf_perf_event.h
new file mode 100644
index 000000000000..cefe7c7cd4f6
--- /dev/null
+++ b/arch/s390/include/uapi/asm/bpf_perf_event.h
@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _UAPI__ASM_BPF_PERF_EVENT_H__
+#define _UAPI__ASM_BPF_PERF_EVENT_H__
+
+#include <asm/ptrace.h>
+
+typedef user_pt_regs bpf_user_pt_regs_t;
+
+#endif /* _UAPI__ASM_BPF_PERF_EVENT_H__ */
diff --git a/arch/s390/include/uapi/asm/kvm.h b/arch/s390/include/uapi/asm/kvm.h
index 38535a57fef8..4cdaa55fabfe 100644
--- a/arch/s390/include/uapi/asm/kvm.h
+++ b/arch/s390/include/uapi/asm/kvm.h
@@ -224,6 +224,7 @@ struct kvm_guest_debug_arch {
 #define KVM_SYNC_RICCB  (1UL << 7)
 #define KVM_SYNC_FPRS   (1UL << 8)
 #define KVM_SYNC_GSCB   (1UL << 9)
+#define KVM_SYNC_BPBC   (1UL << 10)
 /* length and alignment of the sdnx as a power of two */
 #define SDNXC 8
 #define SDNXL (1UL << SDNXC)
@@ -247,7 +248,9 @@ struct kvm_sync_regs {
         };
         __u8  reserved[512];    /* for future vector expansion */
         __u32 fpc;              /* valid on KVM_SYNC_VRS or KVM_SYNC_FPRS */
-        __u8 padding1[52];      /* riccb needs to be 64byte aligned */
+        __u8 bpbc : 1;          /* bp mode */
+        __u8 reserved2 : 7;
+        __u8 padding1[51];      /* riccb needs to be 64byte aligned */
         __u8 riccb[64];         /* runtime instrumentation controls block */
         __u8 padding2[192];     /* sdnx needs to be 256byte aligned */
         union {
diff --git a/arch/s390/include/uapi/asm/perf_regs.h b/arch/s390/include/uapi/asm/perf_regs.h
index 7c8564f98205..d17dd9e5d516 100644
--- a/arch/s390/include/uapi/asm/perf_regs.h
+++ b/arch/s390/include/uapi/asm/perf_regs.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 #ifndef _ASM_S390_PERF_REGS_H
 #define _ASM_S390_PERF_REGS_H
 
diff --git a/arch/s390/include/uapi/asm/ptrace.h b/arch/s390/include/uapi/asm/ptrace.h
index 0d23c8ff2900..543dd70e12c8 100644
--- a/arch/s390/include/uapi/asm/ptrace.h
+++ b/arch/s390/include/uapi/asm/ptrace.h
@@ -162,7 +162,7 @@
 #define GPR_SIZE        8
 #define CR_SIZE         8
 
-#define STACK_FRAME_OVERHEAD    160      /* size of minimum stack frame */
+#define STACK_FRAME_OVERHEAD    160      /* size of minimum stack frame */
 
 #endif /* __s390x__ */
 
@@ -179,17 +179,16 @@
 #define ACR_SIZE        4
 
 
-#define PTRACE_OLDSETOPTIONS         21
+#define PTRACE_OLDSETOPTIONS         21
 
 #ifndef __ASSEMBLY__
 #include <linux/stddef.h>
 #include <linux/types.h>
 
-typedef union
-{
-        float   f;
-        double  d;
-        __u64   ui;
+typedef union {
+        float   f;
+        double  d;
+        __u64   ui;
         struct
         {
                 __u32 hi;
@@ -197,23 +196,21 @@ typedef union
         } fp;
 } freg_t;
 
-typedef struct
-{
-        __u32   fpc;
+typedef struct {
+        __u32   fpc;
         __u32   pad;
-        freg_t  fprs[NUM_FPRS];              
+        freg_t  fprs[NUM_FPRS];
 } s390_fp_regs;
 
-#define FPC_EXCEPTION_MASK      0xF8000000
-#define FPC_FLAGS_MASK          0x00F80000
-#define FPC_DXC_MASK            0x0000FF00
-#define FPC_RM_MASK             0x00000003
+#define FPC_EXCEPTION_MASK      0xF8000000
+#define FPC_FLAGS_MASK          0x00F80000
+#define FPC_DXC_MASK            0x0000FF00
+#define FPC_RM_MASK             0x00000003
 
 /* this typedef defines how a Program Status Word looks like */
-typedef struct 
-{
-        unsigned long mask;
-        unsigned long addr;
+typedef struct {
+        unsigned long mask;
+        unsigned long addr;
 } __attribute__ ((aligned(8))) psw_t;
 
 #ifndef __s390x__
@@ -282,8 +279,7 @@ typedef struct
 /*
  * The s390_regs structure is used to define the elf_gregset_t.
  */
-typedef struct
-{
+typedef struct {
         psw_t psw;
         unsigned long gprs[NUM_GPRS];
         unsigned int  acrs[NUM_ACRS];
@@ -291,24 +287,32 @@ typedef struct
 } s390_regs;
 
 /*
+ * The user_pt_regs structure exports the beginning of
+ * the in-kernel pt_regs structure to user space.
+ */
+typedef struct {
+        unsigned long args[1];
+        psw_t psw;
+        unsigned long gprs[NUM_GPRS];
+} user_pt_regs;
+
+/*
  * Now for the user space program event recording (trace) definitions.
  * The following structures are used only for the ptrace interface, don't
  * touch or even look at it if you don't want to modify the user-space
  * ptrace interface. In particular stay away from it for in-kernel PER.
  */
-typedef struct
-{
+typedef struct {
         unsigned long cr[NUM_CR_WORDS];
 } per_cr_words;
 
 #define PER_EM_MASK 0xE8000000UL
 
-typedef struct
-{
+typedef struct {
 #ifdef __s390x__
-        unsigned                       : 32;
+        unsigned                       : 32;
 #endif /* __s390x__ */
-        unsigned em_branching          : 1;
+        unsigned em_branching          : 1;
         unsigned em_instruction_fetch  : 1;
         /*
          * Switching on storage alteration automatically fixes
@@ -317,44 +321,41 @@ typedef	struct
         unsigned em_storage_alteration : 1;
         unsigned em_gpr_alt_unused     : 1;
         unsigned em_store_real_address : 1;
-        unsigned                       : 3;
+        unsigned                       : 3;
         unsigned branch_addr_ctl       : 1;
-        unsigned                       : 1;
+        unsigned                       : 1;
         unsigned storage_alt_space_ctl : 1;
-        unsigned                       : 21;
+        unsigned                       : 21;
         unsigned long starting_addr;
         unsigned long ending_addr;
 } per_cr_bits;
 
-typedef struct
-{
+typedef struct {
         unsigned short perc_atmid;
         unsigned long address;
         unsigned char access_id;
 } per_lowcore_words;
 
-typedef struct
-{
-        unsigned perc_branching          : 1;
+typedef struct {
+        unsigned perc_branching          : 1;
         unsigned perc_instruction_fetch  : 1;
         unsigned perc_storage_alteration : 1;
-        unsigned perc_gpr_alt_unused     : 1;
+        unsigned perc_gpr_alt_unused     : 1;
         unsigned perc_store_real_address : 1;
-        unsigned                         : 3;
-        unsigned atmid_psw_bit_31        : 1;
-        unsigned atmid_validity_bit      : 1;
-        unsigned atmid_psw_bit_32        : 1;
-        unsigned atmid_psw_bit_5         : 1;
-        unsigned atmid_psw_bit_16        : 1;
-        unsigned atmid_psw_bit_17        : 1;
-        unsigned si                      : 2;
+        unsigned                         : 3;
+        unsigned atmid_psw_bit_31        : 1;
+        unsigned atmid_validity_bit      : 1;
+        unsigned atmid_psw_bit_32        : 1;
+        unsigned atmid_psw_bit_5         : 1;
+        unsigned atmid_psw_bit_16        : 1;
+        unsigned atmid_psw_bit_17        : 1;
+        unsigned si                      : 2;
         unsigned long address;
-        unsigned                         : 4;
-        unsigned access_id               : 4;
+        unsigned                         : 4;
+        unsigned access_id               : 4;
 } per_lowcore_bits;
 
-typedef struct
-{
+typedef struct {
         union {
                 per_cr_words   words;
                 per_cr_bits    bits;
@@ -364,9 +365,9 @@ typedef struct
          * the kernel always sets them to zero. To enable single
          * stepping use ptrace(PTRACE_SINGLESTEP) instead.
          */
-        unsigned  single_step       : 1;
+        unsigned  single_step       : 1;
         unsigned  instruction_fetch : 1;
-        unsigned                    : 30;
+        unsigned                    : 30;
         /*
          * These addresses are copied into cr10 & cr11 if single
          * stepping is switched off
@@ -376,11 +377,10 @@ typedef struct
         union {
                 per_lowcore_words words;
                 per_lowcore_bits  bits;
-        } lowcore; 
+        } lowcore;
 } per_struct;
 
-typedef struct
-{
+typedef struct {
         unsigned int  len;
         unsigned long kernel_addr;
         unsigned long process_addr;
@@ -390,12 +390,12 @@ typedef struct
  * S/390 specific non posix ptrace requests. I chose unusual values so
  * they are unlikely to clash with future ptrace definitions.
  */
-#define PTRACE_PEEKUSR_AREA           0x5000
-#define PTRACE_POKEUSR_AREA           0x5001
+#define PTRACE_PEEKUSR_AREA           0x5000
+#define PTRACE_POKEUSR_AREA           0x5001
 #define PTRACE_PEEKTEXT_AREA          0x5002
 #define PTRACE_PEEKDATA_AREA          0x5003
 #define PTRACE_POKETEXT_AREA          0x5004
-#define PTRACE_POKEDATA_AREA          0x5005
+#define PTRACE_POKEDATA_AREA          0x5005
 #define PTRACE_GET_LAST_BREAK         0x5006
 #define PTRACE_PEEK_SYSTEM_CALL       0x5007
 #define PTRACE_POKE_SYSTEM_CALL       0x5008
@@ -413,21 +413,19 @@ typedef struct
  * PT_PROT definition is loosely based on hppa bsd definition in
  * gdb/hppab-nat.c
  */
-#define PTRACE_PROT                       21
+#define PTRACE_PROT                       21
 
-typedef enum
-{
+typedef enum {
         ptprot_set_access_watchpoint,
         ptprot_set_write_watchpoint,
         ptprot_disable_watchpoint
 } ptprot_flags;
 
-typedef struct
-{
+typedef struct {
         unsigned long lowaddr;
         unsigned long hiaddr;
         ptprot_flags prot;
-} ptprot_area;                     
+} ptprot_area;
 
 /* Sequence of bytes for breakpoint illegal instruction.  */
 #define S390_BREAKPOINT     {0x0,0x1}
@@ -439,8 +437,7 @@ typedef struct
  * The user_regs_struct defines the way the user registers are
  * store on the stack for signal handling.
  */
-struct user_regs_struct
-{
+struct user_regs_struct {
         psw_t psw;
         unsigned long gprs[NUM_GPRS];
         unsigned int  acrs[NUM_ACRS];
diff --git a/arch/s390/include/uapi/asm/sthyi.h b/arch/s390/include/uapi/asm/sthyi.h
index ec113db4eb7e..b1b022316983 100644
--- a/arch/s390/include/uapi/asm/sthyi.h
+++ b/arch/s390/include/uapi/asm/sthyi.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 #ifndef _UAPI_ASM_STHYI_H
 #define _UAPI_ASM_STHYI_H
 
diff --git a/arch/s390/include/uapi/asm/virtio-ccw.h b/arch/s390/include/uapi/asm/virtio-ccw.h
index 3a77833c74dc..2b605f7e8483 100644
--- a/arch/s390/include/uapi/asm/virtio-ccw.h
+++ b/arch/s390/include/uapi/asm/virtio-ccw.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
 /*
  * Definitions for virtio-ccw devices.
  *
diff --git a/arch/s390/include/uapi/asm/vmcp.h b/arch/s390/include/uapi/asm/vmcp.h
index 4caf71714a55..aeaaa030030e 100644
--- a/arch/s390/include/uapi/asm/vmcp.h
+++ b/arch/s390/include/uapi/asm/vmcp.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 /*
  * Copyright IBM Corp. 2004, 2005
  * Interface implementation for communication with the z/VM control program
diff --git a/arch/s390/kernel/alternative.c b/arch/s390/kernel/alternative.c
index 315986a06cf5..574e77622c04 100644
--- a/arch/s390/kernel/alternative.c
+++ b/arch/s390/kernel/alternative.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 #include <linux/module.h>
 #include <asm/alternative.h>
 #include <asm/facility.h>
diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c
index f04db3779b34..59eea9c65d3e 100644
--- a/arch/s390/kernel/compat_linux.c
+++ b/arch/s390/kernel/compat_linux.c
@@ -263,6 +263,7 @@ COMPAT_SYSCALL_DEFINE2(s390_setgroups16, int, gidsetsize, u16 __user *, grouplis
                 return retval;
         }
 
+        groups_sort(group_info);
         retval = set_current_groups(group_info);
         put_group_info(group_info);
 
diff --git a/arch/s390/kernel/perf_regs.c b/arch/s390/kernel/perf_regs.c
index f8603ebed669..54e2d634b849 100644
--- a/arch/s390/kernel/perf_regs.c
+++ b/arch/s390/kernel/perf_regs.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 #include <linux/perf_event.h>
 #include <linux/perf_regs.h>
 #include <linux/kernel.h>
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index 308a7b63348b..f7fc63385553 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -370,10 +370,10 @@ SYSCALL(sys_recvmmsg,compat_sys_recvmmsg)
 SYSCALL(sys_sendmmsg,compat_sys_sendmmsg)
 SYSCALL(sys_socket,sys_socket)
 SYSCALL(sys_socketpair,compat_sys_socketpair)           /* 360 */
-SYSCALL(sys_bind,sys_bind)
-SYSCALL(sys_connect,sys_connect)
+SYSCALL(sys_bind,compat_sys_bind)
+SYSCALL(sys_connect,compat_sys_connect)
 SYSCALL(sys_listen,sys_listen)
-SYSCALL(sys_accept4,sys_accept4)
+SYSCALL(sys_accept4,compat_sys_accept4)
 SYSCALL(sys_getsockopt,compat_sys_getsockopt)           /* 365 */
 SYSCALL(sys_setsockopt,compat_sys_setsockopt)
 SYSCALL(sys_getsockname,compat_sys_getsockname)
diff --git a/arch/s390/kernel/vdso64/note.S b/arch/s390/kernel/vdso64/note.S
index 79a071e4357e..db19d0680a0a 100644
--- a/arch/s390/kernel/vdso64/note.S
+++ b/arch/s390/kernel/vdso64/note.S
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * This supplies .note.* sections to go into the PT_NOTE inside the vDSO text.
  * Here we can supply some information useful to userland.
diff --git a/arch/s390/kvm/Makefile b/arch/s390/kvm/Makefile
index 6048b1c6e580..05ee90a5ea08 100644
--- a/arch/s390/kvm/Makefile
+++ b/arch/s390/kvm/Makefile
@@ -1,10 +1,7 @@
+# SPDX-License-Identifier: GPL-2.0
 # Makefile for kernel virtual machines on s390
 #
 # Copyright IBM Corp. 2008
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License (version 2 only)
-# as published by the Free Software Foundation.
 
 KVM := ../../../virt/kvm
 common-objs = $(KVM)/kvm_main.o $(KVM)/eventfd.o  $(KVM)/async_pf.o $(KVM)/irqchip.o $(KVM)/vfio.o
diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c
index d93a2c0474bf..89aa114a2cba 100644
--- a/arch/s390/kvm/diag.c
+++ b/arch/s390/kvm/diag.c
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * handling diagnose instructions
  *
  * Copyright IBM Corp. 2008, 2011
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
- *
  *    Author(s): Carsten Otte <cotte@de.ibm.com>
  *               Christian Borntraeger <borntraeger@de.ibm.com>
  */
diff --git a/arch/s390/kvm/gaccess.h b/arch/s390/kvm/gaccess.h
index bec42b852246..f4c51756c462 100644
--- a/arch/s390/kvm/gaccess.h
+++ b/arch/s390/kvm/gaccess.h
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * access guest memory
  *
  * Copyright IBM Corp. 2008, 2014
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
- *
  *    Author(s): Carsten Otte <cotte@de.ibm.com>
  */
 
diff --git a/arch/s390/kvm/guestdbg.c b/arch/s390/kvm/guestdbg.c
index bcbd86621d01..b5f3e82006d0 100644
--- a/arch/s390/kvm/guestdbg.c
+++ b/arch/s390/kvm/guestdbg.c
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * kvm guest debug support
  *
  * Copyright IBM Corp. 2014
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
- *
  *    Author(s): David Hildenbrand <dahi@linux.vnet.ibm.com>
  */
 #include <linux/kvm_host.h>
diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c
index 8fe034beb623..9c7d70715862 100644
--- a/arch/s390/kvm/intercept.c
+++ b/arch/s390/kvm/intercept.c
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * in-kernel handling for sie intercepts
  *
  * Copyright IBM Corp. 2008, 2014
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
- *
  *    Author(s): Carsten Otte <cotte@de.ibm.com>
  *               Christian Borntraeger <borntraeger@de.ibm.com>
  */
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index fa557372d600..024ad8bcc516 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * handling kvm guest interrupts
  *
  * Copyright IBM Corp. 2008, 2015
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
- *
  *    Author(s): Carsten Otte <cotte@de.ibm.com>
  */
 
diff --git a/arch/s390/kvm/irq.h b/arch/s390/kvm/irq.h
index d98e4159643d..484608c71dd0 100644
--- a/arch/s390/kvm/irq.h
+++ b/arch/s390/kvm/irq.h
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * s390 irqchip routines
  *
  * Copyright IBM Corp. 2014
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
- *
  *    Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
  */
 #ifndef __KVM_IRQ_H
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 9614aea5839b..1371dff2b90d 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -1,11 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
- * hosting zSeries kernel virtual machines
+ * hosting IBM Z kernel virtual machines (s390x)
  *
- * Copyright IBM Corp. 2008, 2009
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
+ * Copyright IBM Corp. 2008, 2017
  *
  *    Author(s): Carsten Otte <cotte@de.ibm.com>
  *               Christian Borntraeger <borntraeger@de.ibm.com>
@@ -424,6 +421,9 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
         case KVM_CAP_S390_GS:
                 r = test_facility(133);
                 break;
+        case KVM_CAP_S390_BPB:
+                r = test_facility(82);
+                break;
         default:
                 r = 0;
         }
@@ -769,7 +769,7 @@ static void kvm_s390_sync_request_broadcast(struct kvm *kvm, int req)
 
 /*
  * Must be called with kvm->srcu held to avoid races on memslots, and with
- * kvm->lock to avoid races with ourselves and kvm_s390_vm_stop_migration.
+ * kvm->slots_lock to avoid races with ourselves and kvm_s390_vm_stop_migration.
  */
 static int kvm_s390_vm_start_migration(struct kvm *kvm)
 {
@@ -795,11 +795,12 @@ static int kvm_s390_vm_start_migration(struct kvm *kvm)
 
         if (kvm->arch.use_cmma) {
                 /*
-                 * Get the last slot. They should be sorted by base_gfn, so the
-                 * last slot is also the one at the end of the address space.
-                 * We have verified above that at least one slot is present.
+                 * Get the first slot. They are reverse sorted by base_gfn, so
+                 * the first slot is also the one at the end of the address
+                 * space. We have verified above that at least one slot is
+                 * present.
                  */
-                ms = slots->memslots + slots->used_slots - 1;
+                ms = slots->memslots;
                 /* round up so we only use full longs */
                 ram_pages = roundup(ms->base_gfn + ms->npages, BITS_PER_LONG);
                 /* allocate enough bytes to store all the bits */
@@ -824,7 +825,7 @@ static int kvm_s390_vm_start_migration(struct kvm *kvm)
 }
 
 /*
- * Must be called with kvm->lock to avoid races with ourselves and
+ * Must be called with kvm->slots_lock to avoid races with ourselves and
  * kvm_s390_vm_start_migration.
  */
 static int kvm_s390_vm_stop_migration(struct kvm *kvm)
@@ -839,6 +840,8 @@ static int kvm_s390_vm_stop_migration(struct kvm *kvm)
 
         if (kvm->arch.use_cmma) {
                 kvm_s390_sync_request_broadcast(kvm, KVM_REQ_STOP_MIGRATION);
+                /* We have to wait for the essa emulation to finish */
+                synchronize_srcu(&kvm->srcu);
                 vfree(mgs->pgste_bitmap);
         }
         kfree(mgs);
@@ -848,14 +851,12 @@ static int kvm_s390_vm_stop_migration(struct kvm *kvm)
 static int kvm_s390_vm_set_migration(struct kvm *kvm,
                                      struct kvm_device_attr *attr)
 {
-        int idx, res = -ENXIO;
+        int res = -ENXIO;
 
-        mutex_lock(&kvm->lock);
+        mutex_lock(&kvm->slots_lock);
         switch (attr->attr) {
         case KVM_S390_VM_MIGRATION_START:
-                idx = srcu_read_lock(&kvm->srcu);
                 res = kvm_s390_vm_start_migration(kvm);
-                srcu_read_unlock(&kvm->srcu, idx);
                 break;
         case KVM_S390_VM_MIGRATION_STOP:
                 res = kvm_s390_vm_stop_migration(kvm);
@@ -863,7 +864,7 @@ static int kvm_s390_vm_set_migration(struct kvm *kvm,
         default:
                 break;
         }
-        mutex_unlock(&kvm->lock);
+        mutex_unlock(&kvm->slots_lock);
 
         return res;
 }
@@ -1753,7 +1754,9 @@ long kvm_arch_vm_ioctl(struct file *filp,
                 r = -EFAULT;
                 if (copy_from_user(&args, argp, sizeof(args)))
                         break;
+                mutex_lock(&kvm->slots_lock);
                 r = kvm_s390_get_cmma_bits(kvm, &args);
+                mutex_unlock(&kvm->slots_lock);
                 if (!r) {
                         r = copy_to_user(argp, &args, sizeof(args));
                         if (r)
@@ -1767,7 +1770,9 @@ long kvm_arch_vm_ioctl(struct file *filp,
                 r = -EFAULT;
                 if (copy_from_user(&args, argp, sizeof(args)))
                         break;
+                mutex_lock(&kvm->slots_lock);
                 r = kvm_s390_set_cmma_bits(kvm, &args);
+                mutex_unlock(&kvm->slots_lock);
                 break;
         }
         default:
@@ -2200,6 +2205,8 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
         kvm_s390_set_prefix(vcpu, 0);
         if (test_kvm_facility(vcpu->kvm, 64))
                 vcpu->run->kvm_valid_regs |= KVM_SYNC_RICCB;
+        if (test_kvm_facility(vcpu->kvm, 82))
+                vcpu->run->kvm_valid_regs |= KVM_SYNC_BPBC;
         if (test_kvm_facility(vcpu->kvm, 133))
                 vcpu->run->kvm_valid_regs |= KVM_SYNC_GSCB;
         /* fprs can be synchronized via vrs, even if the guest has no vx. With
@@ -2341,6 +2348,7 @@ static void kvm_s390_vcpu_initial_reset(struct kvm_vcpu *vcpu)
         current->thread.fpu.fpc = 0;
         vcpu->arch.sie_block->gbea = 1;
         vcpu->arch.sie_block->pp = 0;
+        vcpu->arch.sie_block->fpf &= ~FPF_BPBC;
         vcpu->arch.pfault_token = KVM_S390_PFAULT_TOKEN_INVALID;
         kvm_clear_async_pf_completion_queue(vcpu);
         if (!kvm_s390_user_cpu_state_ctrl(vcpu->kvm))
@@ -3300,6 +3308,11 @@ static void sync_regs(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
                 vcpu->arch.sie_block->ecd |= ECD_HOSTREGMGMT;
                 vcpu->arch.gs_enabled = 1;
         }
+        if ((kvm_run->kvm_dirty_regs & KVM_SYNC_BPBC) &&
+            test_kvm_facility(vcpu->kvm, 82)) {
+                vcpu->arch.sie_block->fpf &= ~FPF_BPBC;
+                vcpu->arch.sie_block->fpf |= kvm_run->s.regs.bpbc ? FPF_BPBC : 0;
+        }
         save_access_regs(vcpu->arch.host_acrs);
         restore_access_regs(vcpu->run->s.regs.acrs);
         /* save host (userspace) fprs/vrs */
@@ -3346,6 +3359,7 @@ static void store_regs(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
         kvm_run->s.regs.pft = vcpu->arch.pfault_token;
         kvm_run->s.regs.pfs = vcpu->arch.pfault_select;
         kvm_run->s.regs.pfc = vcpu->arch.pfault_compare;
+        kvm_run->s.regs.bpbc = (vcpu->arch.sie_block->fpf & FPF_BPBC) == FPF_BPBC;
         save_access_regs(vcpu->run->s.regs.acrs);
         restore_access_regs(vcpu->arch.host_acrs);
         /* Save guest register state */
@@ -3808,6 +3822,7 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
                         r = -EINVAL;
                         break;
                 }
+                /* do not use irq_state.flags, it will break old QEMUs */
                 r = kvm_s390_set_irq_state(vcpu,
                                            (void __user *) irq_state.buf,
                                            irq_state.len);
@@ -3823,6 +3838,7 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
                         r = -EINVAL;
                         break;
                 }
+                /* do not use irq_state.flags, it will break old QEMUs */
                 r = kvm_s390_get_irq_state(vcpu,
                                            (__u8 __user *)  irq_state.buf,
                                            irq_state.len);
diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h
index 10d65dfbc306..5e46ba429bcb 100644
--- a/arch/s390/kvm/kvm-s390.h
+++ b/arch/s390/kvm/kvm-s390.h
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * definition for kvm on s390
  *
  * Copyright IBM Corp. 2008, 2009
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
- *
  *    Author(s): Carsten Otte <cotte@de.ibm.com>
  *               Christian Borntraeger <borntraeger@de.ibm.com>
  *               Christian Ehrhardt <ehrhardt@de.ibm.com>
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index c954ac49eee4..0714bfa56da0 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * handling privileged instructions
  *
  * Copyright IBM Corp. 2008, 2013
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
- *
  *    Author(s): Carsten Otte <cotte@de.ibm.com>
  *               Christian Borntraeger <borntraeger@de.ibm.com>
  */
@@ -235,8 +232,6 @@ static int try_handle_skey(struct kvm_vcpu *vcpu)
                 VCPU_EVENT(vcpu, 4, "%s", "retrying storage key operation");
                 return -EAGAIN;
         }
-        if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
-                return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
         return 0;
 }
 
@@ -247,6 +242,9 @@ static int handle_iske(struct kvm_vcpu *vcpu)
         int reg1, reg2;
         int rc;
 
+        if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
+                return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
+
         rc = try_handle_skey(vcpu);
         if (rc)
                 return rc != -EAGAIN ? rc : 0;
@@ -276,6 +274,9 @@ static int handle_rrbe(struct kvm_vcpu *vcpu)
         int reg1, reg2;
         int rc;
 
+        if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
+                return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
+
         rc = try_handle_skey(vcpu);
         if (rc)
                 return rc != -EAGAIN ? rc : 0;
@@ -311,6 +312,9 @@ static int handle_sske(struct kvm_vcpu *vcpu)
         int reg1, reg2;
         int rc;
 
+        if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
+                return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
+
         rc = try_handle_skey(vcpu);
         if (rc)
                 return rc != -EAGAIN ? rc : 0;
@@ -1002,7 +1006,7 @@ static inline int do_essa(struct kvm_vcpu *vcpu, const int orc)
                 cbrlo[entries] = gfn << PAGE_SHIFT;
         }
 
-        if (orc) {
+        if (orc && gfn < ms->bitmap_size) {
                 /* increment only if we are really flipping the bit to 1 */
                 if (!test_and_set_bit(gfn, ms->pgste_bitmap))
                         atomic64_inc(&ms->dirty_pages);
diff --git a/arch/s390/kvm/sigp.c b/arch/s390/kvm/sigp.c
index 9d592ef4104b..c1f5cde2c878 100644
--- a/arch/s390/kvm/sigp.c
+++ b/arch/s390/kvm/sigp.c
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * handling interprocessor communication
  *
  * Copyright IBM Corp. 2008, 2013
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
- *
  *    Author(s): Carsten Otte <cotte@de.ibm.com>
  *               Christian Borntraeger <borntraeger@de.ibm.com>
  *               Christian Ehrhardt <ehrhardt@de.ibm.com>
diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index a311938b63b3..751348348477 100644
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * kvm nested virtualization support for s390x
  *
  * Copyright IBM Corp. 2016
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
- *
  *    Author(s): David Hildenbrand <dahi@linux.vnet.ibm.com>
  */
 #include <linux/vmalloc.h>
@@ -226,6 +223,12 @@ static void unshadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
         memcpy(scb_o->gcr, scb_s->gcr, 128);
         scb_o->pp = scb_s->pp;
 
+        /* branch prediction */
+        if (test_kvm_facility(vcpu->kvm, 82)) {
+                scb_o->fpf &= ~FPF_BPBC;
+                scb_o->fpf |= scb_s->fpf & FPF_BPBC;
+        }
+
         /* interrupt intercept */
         switch (scb_s->icptcode) {
         case ICPT_PROGI:
@@ -268,6 +271,7 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
         scb_s->ecb3 = 0;
         scb_s->ecd = 0;
         scb_s->fac = 0;
+        scb_s->fpf = 0;
 
         rc = prepare_cpuflags(vcpu, vsie_page);
         if (rc)
@@ -327,6 +331,9 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
                         prefix_unmapped(vsie_page);
                 scb_s->ecb |= scb_o->ecb & ECB_TE;
         }
+        /* branch prediction */
+        if (test_kvm_facility(vcpu->kvm, 82))
+                scb_s->fpf |= scb_o->fpf & FPF_BPBC;
         /* SIMD */
         if (test_kvm_facility(vcpu->kvm, 129)) {
                 scb_s->eca |= scb_o->eca & ECA_VX;
diff --git a/arch/s390/lib/uaccess.c b/arch/s390/lib/uaccess.c
index cae5a1e16cbd..c4f8039a35e8 100644
--- a/arch/s390/lib/uaccess.c
+++ b/arch/s390/lib/uaccess.c
@@ -89,11 +89,11 @@ EXPORT_SYMBOL(enable_sacf_uaccess);
 
 void disable_sacf_uaccess(mm_segment_t old_fs)
 {
+        current->thread.mm_segment = old_fs;
         if (old_fs == USER_DS && test_facility(27)) {
                 __ctl_load(S390_lowcore.user_asce, 1, 1);
                 clear_cpu_flag(CIF_ASCE_PRIMARY);
         }
-        current->thread.mm_segment = old_fs;
 }
 EXPORT_SYMBOL(disable_sacf_uaccess);
 
diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c
index 434a9564917b..cb364153c43c 100644
--- a/arch/s390/mm/pgalloc.c
+++ b/arch/s390/mm/pgalloc.c
@@ -83,8 +83,6 @@ int crst_table_upgrade(struct mm_struct *mm, unsigned long end)
 
         /* upgrade should only happen from 3 to 4, 3 to 5, or 4 to 5 levels */
         VM_BUG_ON(mm->context.asce_limit < _REGION2_SIZE);
-        if (end >= TASK_SIZE_MAX)
-                return -ENOMEM;
         rc = 0;
         notify = 0;
         while (mm->context.asce_limit < end) {
diff --git a/arch/s390/net/Makefile b/arch/s390/net/Makefile
index 90568c33ddb0..e0d5f245e42b 100644
--- a/arch/s390/net/Makefile
+++ b/arch/s390/net/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Arch-specific network modules
 #
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index e81c16838b90..9557d8b516df 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -55,8 +55,7 @@ struct bpf_jit {
 #define SEEN_LITERAL    8       /* code uses literals */
 #define SEEN_FUNC       16      /* calls C functions */
 #define SEEN_TAIL_CALL  32      /* code uses tail calls */
-#define SEEN_SKB_CHANGE 64      /* code changes skb data */
-#define SEEN_REG_AX     128     /* code uses constant blinding */
+#define SEEN_REG_AX     64      /* code uses constant blinding */
 #define SEEN_STACK      (SEEN_FUNC | SEEN_MEM | SEEN_SKB)
 
 /*
@@ -448,12 +447,12 @@ static void bpf_jit_prologue(struct bpf_jit *jit, u32 stack_depth)
                         EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W1, REG_0,
                                       REG_15, 152);
         }
-        if (jit->seen & SEEN_SKB)
+        if (jit->seen & SEEN_SKB) {
                 emit_load_skb_data_hlen(jit);
-        if (jit->seen & SEEN_SKB_CHANGE)
                 /* stg %b1,ST_OFF_SKBP(%r0,%r15) */
                 EMIT6_DISP_LH(0xe3000000, 0x0024, BPF_REG_1, REG_0, REG_15,
                               STK_OFF_SKBP);
+        }
 }
 
 /*
@@ -983,8 +982,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
                 EMIT2(0x0d00, REG_14, REG_W1);
                 /* lgr %b0,%r2: load return value into %b0 */
                 EMIT4(0xb9040000, BPF_REG_0, REG_2);
-                if (bpf_helper_changes_pkt_data((void *)func)) {
-                        jit->seen |= SEEN_SKB_CHANGE;
+                if ((jit->seen & SEEN_SKB) &&
+                    bpf_helper_changes_pkt_data((void *)func)) {
                         /* lg %b1,ST_OFF_SKBP(%r15) */
                         EMIT6_DISP_LH(0xe3000000, 0x0004, BPF_REG_1, REG_0,
                                       REG_15, STK_OFF_SKBP);
diff --git a/arch/s390/numa/Makefile b/arch/s390/numa/Makefile
index f94ecaffa71b..66c2dff74895 100644
--- a/arch/s390/numa/Makefile
+++ b/arch/s390/numa/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 obj-y                   += numa.o
 obj-y                   += toptree.o
 obj-$(CONFIG_NUMA_EMU)  += mode_emu.o
diff --git a/arch/s390/pci/Makefile b/arch/s390/pci/Makefile
index 805d8b29193a..22d0871291ee 100644
--- a/arch/s390/pci/Makefile
+++ b/arch/s390/pci/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Makefile for the s390 PCI subsystem.
 #
diff --git a/arch/s390/pci/pci_dma.c b/arch/s390/pci/pci_dma.c
index f7aa5a77827e..2d15d84c20ed 100644
--- a/arch/s390/pci/pci_dma.c
+++ b/arch/s390/pci/pci_dma.c
@@ -181,6 +181,9 @@ out_unlock:
 static int __dma_purge_tlb(struct zpci_dev *zdev, dma_addr_t dma_addr,
                            size_t size, int flags)
 {
+        unsigned long irqflags;
+        int ret;
+
         /*
          * With zdev->tlb_refresh == 0, rpcit is not required to establish new
          * translations when previously invalid translation-table entries are
@@ -196,8 +199,22 @@ static int __dma_purge_tlb(struct zpci_dev *zdev, dma_addr_t dma_addr,
                         return 0;
         }
 
-        return zpci_refresh_trans((u64) zdev->fh << 32, dma_addr,
-                                  PAGE_ALIGN(size));
+        ret = zpci_refresh_trans((u64) zdev->fh << 32, dma_addr,
+                                 PAGE_ALIGN(size));
+        if (ret == -ENOMEM && !s390_iommu_strict) {
+                /* enable the hypervisor to free some resources */
+                if (zpci_refresh_global(zdev))
+                        goto out;
+
+                spin_lock_irqsave(&zdev->iommu_bitmap_lock, irqflags);
+                bitmap_andnot(zdev->iommu_bitmap, zdev->iommu_bitmap,
+                              zdev->lazy_bitmap, zdev->iommu_pages);
+                bitmap_zero(zdev->lazy_bitmap, zdev->iommu_pages);
+                spin_unlock_irqrestore(&zdev->iommu_bitmap_lock, irqflags);
+                ret = 0;
+        }
+out:
+        return ret;
 }
 
 static int dma_update_trans(struct zpci_dev *zdev, unsigned long pa,
diff --git a/arch/s390/pci/pci_insn.c b/arch/s390/pci/pci_insn.c
index 19bcb3b45a70..f069929e8211 100644
--- a/arch/s390/pci/pci_insn.c
+++ b/arch/s390/pci/pci_insn.c
@@ -89,6 +89,9 @@ int zpci_refresh_trans(u64 fn, u64 addr, u64 range)
         if (cc)
                 zpci_err_insn(cc, status, addr, range);
 
+        if (cc == 1 && (status == 4 || status == 16))
+                return -ENOMEM;
+
         return (cc) ? -EIO : 0;
 }
 
diff --git a/arch/s390/tools/gen_opcode_table.c b/arch/s390/tools/gen_opcode_table.c
index 01d4c5a4bfe9..357d42681cef 100644
--- a/arch/s390/tools/gen_opcode_table.c
+++ b/arch/s390/tools/gen_opcode_table.c
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Generate opcode table initializers for the in-kernel disassembler.
  *
diff --git a/arch/score/include/uapi/asm/Kbuild b/arch/score/include/uapi/asm/Kbuild
index c94ee54210bc..81271d3af47c 100644
--- a/arch/score/include/uapi/asm/Kbuild
+++ b/arch/score/include/uapi/asm/Kbuild
@@ -1,4 +1,5 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
 
+generic-y       += bpf_perf_event.h
 generic-y       += siginfo.h
diff --git a/arch/sh/boards/mach-se/770x/setup.c b/arch/sh/boards/mach-se/770x/setup.c
index 77c35350ee77..412326d59e6f 100644
--- a/arch/sh/boards/mach-se/770x/setup.c
+++ b/arch/sh/boards/mach-se/770x/setup.c
@@ -9,6 +9,7 @@
  */
 #include <linux/init.h>
 #include <linux/platform_device.h>
+#include <linux/sh_eth.h>
 #include <mach-se/mach/se.h>
 #include <mach-se/mach/mrshpc.h>
 #include <asm/machvec.h>
@@ -115,13 +116,23 @@ static struct platform_device heartbeat_device = {
 #if defined(CONFIG_CPU_SUBTYPE_SH7710) ||\
         defined(CONFIG_CPU_SUBTYPE_SH7712)
 /* SH771X Ethernet driver */
+static struct sh_eth_plat_data sh_eth_plat = {
+        .phy = PHY_ID,
+        .phy_interface = PHY_INTERFACE_MODE_MII,
+};
+
 static struct resource sh_eth0_resources[] = {
         [0] = {
                 .start = SH_ETH0_BASE,
-                .end = SH_ETH0_BASE + 0x1B8,
+                .end = SH_ETH0_BASE + 0x1B8 - 1,
                 .flags = IORESOURCE_MEM,
         },
         [1] = {
+                .start = SH_TSU_BASE,
+                .end = SH_TSU_BASE + 0x200 - 1,
+                .flags = IORESOURCE_MEM,
+        },
+        [2] = {
                 .start = SH_ETH0_IRQ,
                 .end = SH_ETH0_IRQ,
                 .flags = IORESOURCE_IRQ,
@@ -132,7 +143,7 @@ static struct platform_device sh_eth0_device = {
         .name = "sh771x-ether",
         .id = 0,
         .dev = {
-                .platform_data = PHY_ID,
+                .platform_data = &sh_eth_plat,
         },
         .num_resources = ARRAY_SIZE(sh_eth0_resources),
         .resource = sh_eth0_resources,
@@ -141,10 +152,15 @@ static struct platform_device sh_eth0_device = {
 static struct resource sh_eth1_resources[] = {
         [0] = {
                 .start = SH_ETH1_BASE,
-                .end = SH_ETH1_BASE + 0x1B8,
+                .end = SH_ETH1_BASE + 0x1B8 - 1,
                 .flags = IORESOURCE_MEM,
         },
         [1] = {
+                .start = SH_TSU_BASE,
+                .end = SH_TSU_BASE + 0x200 - 1,
+                .flags = IORESOURCE_MEM,
+        },
+        [2] = {
                 .start = SH_ETH1_IRQ,
                 .end = SH_ETH1_IRQ,
                 .flags = IORESOURCE_IRQ,
@@ -155,7 +171,7 @@ static struct platform_device sh_eth1_device = {
         .name = "sh771x-ether",
         .id = 1,
         .dev = {
-                .platform_data = PHY_ID,
+                .platform_data = &sh_eth_plat,
         },
         .num_resources = ARRAY_SIZE(sh_eth1_resources),
         .resource = sh_eth1_resources,
diff --git a/arch/sh/include/mach-se/mach/se.h b/arch/sh/include/mach-se/mach/se.h
index 4246ef9b07a3..aa83fe1ff0b1 100644
--- a/arch/sh/include/mach-se/mach/se.h
+++ b/arch/sh/include/mach-se/mach/se.h
@@ -100,6 +100,7 @@
 /* Base address */
 #define SH_ETH0_BASE 0xA7000000
 #define SH_ETH1_BASE 0xA7000400
+#define SH_TSU_BASE  0xA7000800
 /* PHY ID */
 #if defined(CONFIG_CPU_SUBTYPE_SH7710)
 # define PHY_ID 0x00
diff --git a/arch/sh/include/uapi/asm/Kbuild b/arch/sh/include/uapi/asm/Kbuild
index e28531333efa..ba4d39cb321d 100644
--- a/arch/sh/include/uapi/asm/Kbuild
+++ b/arch/sh/include/uapi/asm/Kbuild
@@ -2,6 +2,7 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += bitsperlong.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += fcntl.h
 generic-y += ioctl.h
diff --git a/arch/sparc/crypto/Makefile b/arch/sparc/crypto/Makefile
index 818d3aa5172e..d257186c27d1 100644
--- a/arch/sparc/crypto/Makefile
+++ b/arch/sparc/crypto/Makefile
@@ -10,7 +10,7 @@ obj-$(CONFIG_CRYPTO_MD5_SPARC64) += md5-sparc64.o
 
 obj-$(CONFIG_CRYPTO_AES_SPARC64) += aes-sparc64.o
 obj-$(CONFIG_CRYPTO_DES_SPARC64) += des-sparc64.o
-obj-$(CONFIG_CRYPTO_DES_SPARC64) += camellia-sparc64.o
+obj-$(CONFIG_CRYPTO_CAMELLIA_SPARC64) += camellia-sparc64.o
 
 obj-$(CONFIG_CRYPTO_CRC32C_SPARC64) += crc32c-sparc64.o
 
diff --git a/arch/sparc/include/uapi/asm/Kbuild b/arch/sparc/include/uapi/asm/Kbuild
index 2178c78c7c1a..4680ba246b55 100644
--- a/arch/sparc/include/uapi/asm/Kbuild
+++ b/arch/sparc/include/uapi/asm/Kbuild
@@ -1,4 +1,5 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
 
+generic-y += bpf_perf_event.h
 generic-y += types.h
diff --git a/arch/sparc/lib/hweight.S b/arch/sparc/lib/hweight.S
index e5547b22cd18..0ddbbb031822 100644
--- a/arch/sparc/lib/hweight.S
+++ b/arch/sparc/lib/hweight.S
@@ -44,8 +44,8 @@ EXPORT_SYMBOL(__arch_hweight32)
         .previous
 
 ENTRY(__arch_hweight64)
-        sethi   %hi(__sw_hweight16), %g1
-        jmpl    %g1 + %lo(__sw_hweight16), %g0
+        sethi   %hi(__sw_hweight64), %g1
+        jmpl    %g1 + %lo(__sw_hweight64), %g0
          nop
 ENDPROC(__arch_hweight64)
 EXPORT_SYMBOL(__arch_hweight64)
diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
index be3136f142a9..a8103a84b4ac 100644
--- a/arch/sparc/mm/fault_32.c
+++ b/arch/sparc/mm/fault_32.c
@@ -113,7 +113,7 @@ show_signal_msg(struct pt_regs *regs, int sig, int code,
         if (!printk_ratelimit())
                 return;
 
-        printk("%s%s[%d]: segfault at %lx ip %p (rpc %p) sp %p error %x",
+        printk("%s%s[%d]: segfault at %lx ip %px (rpc %px) sp %px error %x",
                task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,
                tsk->comm, task_pid_nr(tsk), address,
                (void *)regs->pc, (void *)regs->u_regs[UREG_I7],
diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
index 815c03d7a765..41363f46797b 100644
--- a/arch/sparc/mm/fault_64.c
+++ b/arch/sparc/mm/fault_64.c
@@ -154,7 +154,7 @@ show_signal_msg(struct pt_regs *regs, int sig, int code,
         if (!printk_ratelimit())
                 return;
 
-        printk("%s%s[%d]: segfault at %lx ip %p (rpc %p) sp %p error %x",
+        printk("%s%s[%d]: segfault at %lx ip %px (rpc %px) sp %px error %x",
                task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,
                tsk->comm, task_pid_nr(tsk), address,
                (void *)regs->tpc, (void *)regs->u_regs[UREG_I7],
diff --git a/arch/sparc/mm/gup.c b/arch/sparc/mm/gup.c
index 33c0f8bb0f33..5335ba3c850e 100644
--- a/arch/sparc/mm/gup.c
+++ b/arch/sparc/mm/gup.c
@@ -75,7 +75,7 @@ static int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
         if (!(pmd_val(pmd) & _PAGE_VALID))
                 return 0;
 
-        if (!pmd_access_permitted(pmd, write))
+        if (write && !pmd_write(pmd))
                 return 0;
 
         refs = 0;
@@ -114,7 +114,7 @@ static int gup_huge_pud(pud_t *pudp, pud_t pud, unsigned long addr,
         if (!(pud_val(pud) & _PAGE_VALID))
                 return 0;
 
-        if (!pud_access_permitted(pud, write))
+        if (write && !pud_write(pud))
                 return 0;
 
         refs = 0;
diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c
index 5765e7e711f7..ff5f9cb3039a 100644
--- a/arch/sparc/net/bpf_jit_comp_64.c
+++ b/arch/sparc/net/bpf_jit_comp_64.c
@@ -1245,14 +1245,16 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
                 u8 *func = ((u8 *)__bpf_call_base) + imm;
 
                 ctx->saw_call = true;
+                if (ctx->saw_ld_abs_ind && bpf_helper_changes_pkt_data(func))
+                        emit_reg_move(bpf2sparc[BPF_REG_1], L7, ctx);
 
                 emit_call((u32 *)func, ctx);
                 emit_nop(ctx);
 
                 emit_reg_move(O0, bpf2sparc[BPF_REG_0], ctx);
 
-                if (bpf_helper_changes_pkt_data(func) && ctx->saw_ld_abs_ind)
-                        load_skb_regs(ctx, bpf2sparc[BPF_REG_6]);
+                if (ctx->saw_ld_abs_ind && bpf_helper_changes_pkt_data(func))
+                        load_skb_regs(ctx, L7);
                 break;
         }
 
diff --git a/arch/tile/include/uapi/asm/Kbuild b/arch/tile/include/uapi/asm/Kbuild
index 5711de0a1b5e..cc439612bcd5 100644
--- a/arch/tile/include/uapi/asm/Kbuild
+++ b/arch/tile/include/uapi/asm/Kbuild
@@ -1,6 +1,7 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
 
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += fcntl.h
 generic-y += ioctl.h
diff --git a/arch/um/include/asm/Kbuild b/arch/um/include/asm/Kbuild
index 50a32c33d729..73c57f614c9e 100644
--- a/arch/um/include/asm/Kbuild
+++ b/arch/um/include/asm/Kbuild
@@ -1,4 +1,5 @@
 generic-y += barrier.h
+generic-y += bpf_perf_event.h
 generic-y += bug.h
 generic-y += clkdev.h
 generic-y += current.h
diff --git a/arch/um/include/asm/mmu_context.h b/arch/um/include/asm/mmu_context.h
index b668e351fd6c..fca34b2177e2 100644
--- a/arch/um/include/asm/mmu_context.h
+++ b/arch/um/include/asm/mmu_context.h
@@ -15,9 +15,10 @@ extern void uml_setup_stubs(struct mm_struct *mm);
 /*
  * Needed since we do not use the asm-generic/mm_hooks.h:
  */
-static inline void arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm)
+static inline int arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm)
 {
         uml_setup_stubs(mm);
+        return 0;
 }
 extern void arch_exit_mmap(struct mm_struct *mm);
 static inline void arch_unmap(struct mm_struct *mm,
diff --git a/arch/um/kernel/trap.c b/arch/um/kernel/trap.c
index 4e6fcb32620f..428644175956 100644
--- a/arch/um/kernel/trap.c
+++ b/arch/um/kernel/trap.c
@@ -150,7 +150,7 @@ static void show_segv_info(struct uml_pt_regs *regs)
         if (!printk_ratelimit())
                 return;
 
-        printk("%s%s[%d]: segfault at %lx ip %p sp %p error %x",
+        printk("%s%s[%d]: segfault at %lx ip %px sp %px error %x",
                 task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,
                 tsk->comm, task_pid_nr(tsk), FAULT_ADDRESS(*fi),
                 (void *)UPT_IP(regs), (void *)UPT_SP(regs),
diff --git a/arch/unicore32/include/asm/mmu_context.h b/arch/unicore32/include/asm/mmu_context.h
index 59b06b48f27d..5c205a9cb5a6 100644
--- a/arch/unicore32/include/asm/mmu_context.h
+++ b/arch/unicore32/include/asm/mmu_context.h
@@ -81,9 +81,10 @@ do { \
         } \
 } while (0)
 
-static inline void arch_dup_mmap(struct mm_struct *oldmm,
-                                 struct mm_struct *mm)
+static inline int arch_dup_mmap(struct mm_struct *oldmm,
+                                struct mm_struct *mm)
 {
+        return 0;
 }
 
 static inline void arch_unmap(struct mm_struct *mm,
diff --git a/arch/unicore32/include/uapi/asm/Kbuild b/arch/unicore32/include/uapi/asm/Kbuild
index 759a71411169..8611ef980554 100644
--- a/arch/unicore32/include/uapi/asm/Kbuild
+++ b/arch/unicore32/include/uapi/asm/Kbuild
@@ -3,6 +3,7 @@ include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += auxvec.h
 generic-y += bitsperlong.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += fcntl.h
 generic-y += ioctl.h
diff --git a/arch/unicore32/kernel/traps.c b/arch/unicore32/kernel/traps.c
index 5f25b39f04d4..c4ac6043ebb0 100644
--- a/arch/unicore32/kernel/traps.c
+++ b/arch/unicore32/kernel/traps.c
@@ -298,7 +298,6 @@ void abort(void)
         /* if that doesn't kill us, halt */
         panic("Oops failed to kill thread");
 }
-EXPORT_SYMBOL(abort);
 
 void __init trap_init(void)
 {
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 8eed3f94bfc7..20da391b5f32 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -55,7 +55,6 @@ config X86
         select ARCH_HAS_GCOV_PROFILE_ALL
         select ARCH_HAS_KCOV                    if X86_64
         select ARCH_HAS_PMEM_API                if X86_64
-        # Causing hangs/crashes, see the commit that added this change for details.
         select ARCH_HAS_REFCOUNT
         select ARCH_HAS_UACCESS_FLUSHCACHE      if X86_64
         select ARCH_HAS_SET_MEMORY
@@ -89,6 +88,7 @@ config X86
         select GENERIC_CLOCKEVENTS_MIN_ADJUST
         select GENERIC_CMOS_UPDATE
         select GENERIC_CPU_AUTOPROBE
+        select GENERIC_CPU_VULNERABILITIES
         select GENERIC_EARLY_IOREMAP
         select GENERIC_FIND_FIRST_BIT
         select GENERIC_IOMAP
@@ -429,6 +429,19 @@ config GOLDFISH
        def_bool y
        depends on X86_GOLDFISH
 
+config RETPOLINE
+        bool "Avoid speculative indirect branches in kernel"
+        default y
+        help
+          Compile kernel with the retpoline compiler options to guard against
+          kernel-to-user data leaks by avoiding speculative indirect
+          branches. Requires a compiler with -mindirect-branch=thunk-extern
+          support for full protection. The kernel may run slower.
+
+          Without compiler support, at least indirect branches in assembler
+          code are eliminated. Since this includes the syscall entry path,
+          it is not entirely pointless.
+
 config INTEL_RDT
         bool "Intel Resource Director Technology support"
         default n
@@ -926,7 +939,8 @@ config MAXSMP
 config NR_CPUS
         int "Maximum number of CPUs" if SMP && !MAXSMP
         range 2 8 if SMP && X86_32 && !X86_BIGSMP
-        range 2 512 if SMP && !MAXSMP && !CPUMASK_OFFSTACK
+        range 2 64 if SMP && X86_32 && X86_BIGSMP
+        range 2 512 if SMP && !MAXSMP && !CPUMASK_OFFSTACK && X86_64
         range 2 8192 if SMP && !MAXSMP && CPUMASK_OFFSTACK && X86_64
         default "1" if !SMP
         default "8192" if MAXSMP
diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index 6293a8768a91..672441c008c7 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -400,6 +400,7 @@ config UNWINDER_FRAME_POINTER
 config UNWINDER_GUESS
         bool "Guess unwinder"
         depends on EXPERT
+        depends on !STACKDEPOT
         ---help---
           This option enables the "guess" unwinder for unwinding kernel stack
           traces.  It scans the stack and reports every kernel text address it
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 3e73bc255e4e..fad55160dcb9 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -230,6 +230,14 @@ KBUILD_CFLAGS += -Wno-sign-compare
 #
 KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
 
+# Avoid indirect branches in kernel to deal with Spectre
+ifdef CONFIG_RETPOLINE
+    RETPOLINE_CFLAGS += $(call cc-option,-mindirect-branch=thunk-extern -mindirect-branch-register)
+    ifneq ($(RETPOLINE_CFLAGS),)
+        KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE
+    endif
+endif
+
 archscripts: scripts_basic
         $(Q)$(MAKE) $(build)=arch/x86/tools relocs
 
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index 1e9c322e973a..f25e1530e064 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -80,6 +80,7 @@ vmlinux-objs-$(CONFIG_RANDOMIZE_BASE) += $(obj)/kaslr.o
 ifdef CONFIG_X86_64
         vmlinux-objs-$(CONFIG_RANDOMIZE_BASE) += $(obj)/pagetable.o
         vmlinux-objs-y += $(obj)/mem_encrypt.o
+        vmlinux-objs-y += $(obj)/pgtable_64.o
 endif
 
 $(obj)/eboot.o: KBUILD_CFLAGS += -fshort-wchar -mno-red-zone
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
index 20919b4f3133..fc313e29fe2c 100644
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -305,10 +305,18 @@ ENTRY(startup_64)
         leaq    boot_stack_end(%rbx), %rsp
 
 #ifdef CONFIG_X86_5LEVEL
-        /* Check if 5-level paging has already enabled */
-        movq    %cr4, %rax
-        testl   $X86_CR4_LA57, %eax
-        jnz     lvl5
+        /*
+         * Check if we need to enable 5-level paging.
+         * RSI holds real mode data and need to be preserved across
+         * a function call.
+         */
+        pushq   %rsi
+        call    l5_paging_required
+        popq    %rsi
+
+        /* If l5_paging_required() returned zero, we're done here. */
+        cmpq    $0, %rax
+        je      lvl5
 
         /*
          * At this point we are in long mode with 4-level paging enabled,
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index b50c42455e25..98761a1576ce 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -169,6 +169,16 @@ void __puthex(unsigned long value)
         }
 }
 
+static bool l5_supported(void)
+{
+        /* Check if leaf 7 is supported. */
+        if (native_cpuid_eax(0) < 7)
+                return 0;
+
+        /* Check if la57 is supported. */
+        return native_cpuid_ecx(7) & (1 << (X86_FEATURE_LA57 & 31));
+}
+
 #if CONFIG_X86_NEED_RELOCS
 static void handle_relocations(void *output, unsigned long output_len,
                                unsigned long virt_addr)
@@ -362,6 +372,12 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap,
         console_init();
         debug_putstr("early console in extract_kernel\n");
 
+        if (IS_ENABLED(CONFIG_X86_5LEVEL) && !l5_supported()) {
+                error("This linux kernel as configured requires 5-level paging\n"
+                        "This CPU does not support the required 'cr4.la57' feature\n"
+                        "Unable to boot - please use a kernel appropriate for your CPU\n");
+        }
+
         free_mem_ptr     = heap;        /* Heap */
         free_mem_end_ptr = heap + BOOT_HEAP_SIZE;
 
diff --git a/arch/x86/boot/compressed/pagetable.c b/arch/x86/boot/compressed/pagetable.c
index d5364ca2e3f9..b5e5e02f8cde 100644
--- a/arch/x86/boot/compressed/pagetable.c
+++ b/arch/x86/boot/compressed/pagetable.c
@@ -23,6 +23,9 @@
  */
 #undef CONFIG_AMD_MEM_ENCRYPT
 
+/* No PAGE_TABLE_ISOLATION support needed either: */
+#undef CONFIG_PAGE_TABLE_ISOLATION
+
 #include "misc.h"
 
 /* These actually do the work of building the kernel identity maps. */
diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c
new file mode 100644
index 000000000000..b4469a37e9a1
--- /dev/null
+++ b/arch/x86/boot/compressed/pgtable_64.c
@@ -0,0 +1,28 @@
+#include <asm/processor.h>
+
+/*
+ * __force_order is used by special_insns.h asm code to force instruction
+ * serialization.
+ *
+ * It is not referenced from the code, but GCC < 5 with -fPIE would fail
+ * due to an undefined symbol. Define it to make these ancient GCCs work.
+ */
+unsigned long __force_order;
+
+int l5_paging_required(void)
+{
+        /* Check if leaf 7 is supported. */
+
+        if (native_cpuid_eax(0) < 7)
+                return 0;
+
+        /* Check if la57 is supported. */
+        if (!(native_cpuid_ecx(7) & (1 << (X86_FEATURE_LA57 & 31))))
+                return 0;
+
+        /* Check if 5-level paging has already been enabled. */
+        if (native_read_cr4() & X86_CR4_LA57)
+                return 0;
+
+        return 1;
+}
diff --git a/arch/x86/boot/genimage.sh b/arch/x86/boot/genimage.sh
index 49f4970f693b..6a10d52a4145 100644
--- a/arch/x86/boot/genimage.sh
+++ b/arch/x86/boot/genimage.sh
@@ -44,9 +44,9 @@ FDINITRD=$6
 
 # Make sure the files actually exist
 verify "$FBZIMAGE"
-verify "$MTOOLSRC"
 
 genbzdisk() {
+        verify "$MTOOLSRC"
         mformat a:
         syslinux $FIMAGE
         echo "$KCMDLINE" | mcopy - a:syslinux.cfg
@@ -57,6 +57,7 @@ genbzdisk() {
 }
 
 genfdimage144() {
+        verify "$MTOOLSRC"
         dd if=/dev/zero of=$FIMAGE bs=1024 count=1440 2> /dev/null
         mformat v:
         syslinux $FIMAGE
@@ -68,6 +69,7 @@ genfdimage144() {
 }
 
 genfdimage288() {
+        verify "$MTOOLSRC"
         dd if=/dev/zero of=$FIMAGE bs=1024 count=2880 2> /dev/null
         mformat w:
         syslinux $FIMAGE
@@ -78,39 +80,43 @@ genfdimage288() {
         mcopy $FBZIMAGE w:linux
 }
 
-genisoimage() {
+geniso() {
         tmp_dir=`dirname $FIMAGE`/isoimage
         rm -rf $tmp_dir
         mkdir $tmp_dir
-        for i in lib lib64 share end ; do
+        for i in lib lib64 share ; do
                 for j in syslinux ISOLINUX ; do
                         if [ -f /usr/$i/$j/isolinux.bin ] ; then
                                 isolinux=/usr/$i/$j/isolinux.bin
-                                cp $isolinux $tmp_dir
                         fi
                 done
                 for j in syslinux syslinux/modules/bios ; do
                         if [ -f /usr/$i/$j/ldlinux.c32 ]; then
                                 ldlinux=/usr/$i/$j/ldlinux.c32
-                                cp $ldlinux $tmp_dir
                         fi
                 done
                 if [ -n "$isolinux" -a -n "$ldlinux" ] ; then
                         break
                 fi
-                if [ $i = end -a -z "$isolinux" ] ; then
-                        echo 'Need an isolinux.bin file, please install syslinux/isolinux.'
-                        exit 1
-                fi
         done
+        if [ -z "$isolinux" ] ; then
+                echo 'Need an isolinux.bin file, please install syslinux/isolinux.'
+                exit 1
+        fi
+        if [ -z "$ldlinux" ] ; then
+                echo 'Need an ldlinux.c32 file, please install syslinux/isolinux.'
+                exit 1
+        fi
+        cp $isolinux $tmp_dir
+        cp $ldlinux $tmp_dir
         cp $FBZIMAGE $tmp_dir/linux
         echo "$KCMDLINE" > $tmp_dir/isolinux.cfg
         if [ -f "$FDINITRD" ] ; then
                 cp "$FDINITRD" $tmp_dir/initrd.img
         fi
-        mkisofs -J -r -input-charset=utf-8 -quiet -o $FIMAGE -b isolinux.bin \
-                -c boot.cat -no-emul-boot -boot-load-size 4 -boot-info-table \
-                $tmp_dir
+        genisoimage -J -r -input-charset=utf-8 -quiet -o $FIMAGE \
+                -b isolinux.bin -c boot.cat -no-emul-boot -boot-load-size 4 \
+                -boot-info-table $tmp_dir
         isohybrid $FIMAGE 2>/dev/null || true
         rm -rf $tmp_dir
 }
@@ -119,6 +125,6 @@ case $1 in
         bzdisk)     genbzdisk;;
         fdimage144) genfdimage144;;
         fdimage288) genfdimage288;;
-        isoimage)   genisoimage;;
+        isoimage)   geniso;;
         *)          echo 'Unknown image format'; exit 1;
 esac
diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
index 16627fec80b2..3d09e3aca18d 100644
--- a/arch/x86/crypto/aesni-intel_asm.S
+++ b/arch/x86/crypto/aesni-intel_asm.S
@@ -32,6 +32,7 @@
 #include <linux/linkage.h>
 #include <asm/inst.h>
 #include <asm/frame.h>
+#include <asm/nospec-branch.h>
 
 /*
  * The following macros are used to move an (un)aligned 16 byte value to/from
@@ -2884,7 +2885,7 @@ ENTRY(aesni_xts_crypt8)
         pxor INC, STATE4
         movdqu IV, 0x30(OUTP)
 
-        call *%r11
+        CALL_NOSPEC %r11
 
         movdqu 0x00(OUTP), INC
         pxor INC, STATE1
@@ -2929,7 +2930,7 @@ ENTRY(aesni_xts_crypt8)
         _aesni_gf128mul_x_ble()
         movups IV, (IVP)
 
-        call *%r11
+        CALL_NOSPEC %r11
 
         movdqu 0x40(OUTP), INC
         pxor INC, STATE1
diff --git a/arch/x86/crypto/camellia-aesni-avx-asm_64.S b/arch/x86/crypto/camellia-aesni-avx-asm_64.S
index f7c495e2863c..a14af6eb09cb 100644
--- a/arch/x86/crypto/camellia-aesni-avx-asm_64.S
+++ b/arch/x86/crypto/camellia-aesni-avx-asm_64.S
@@ -17,6 +17,7 @@
 
 #include <linux/linkage.h>
 #include <asm/frame.h>
+#include <asm/nospec-branch.h>
 
 #define CAMELLIA_TABLE_BYTE_LEN 272
 
@@ -1227,7 +1228,7 @@ camellia_xts_crypt_16way:
         vpxor 14 * 16(%rax), %xmm15, %xmm14;
         vpxor 15 * 16(%rax), %xmm15, %xmm15;
 
-        call *%r9;
+        CALL_NOSPEC %r9;
 
         addq $(16 * 16), %rsp;
 
diff --git a/arch/x86/crypto/camellia-aesni-avx2-asm_64.S b/arch/x86/crypto/camellia-aesni-avx2-asm_64.S
index eee5b3982cfd..b66bbfa62f50 100644
--- a/arch/x86/crypto/camellia-aesni-avx2-asm_64.S
+++ b/arch/x86/crypto/camellia-aesni-avx2-asm_64.S
@@ -12,6 +12,7 @@
 
 #include <linux/linkage.h>
 #include <asm/frame.h>
+#include <asm/nospec-branch.h>
 
 #define CAMELLIA_TABLE_BYTE_LEN 272
 
@@ -1343,7 +1344,7 @@ camellia_xts_crypt_32way:
         vpxor 14 * 32(%rax), %ymm15, %ymm14;
         vpxor 15 * 32(%rax), %ymm15, %ymm15;
 
-        call *%r9;
+        CALL_NOSPEC %r9;
 
         addq $(16 * 32), %rsp;
 
diff --git a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
index 7a7de27c6f41..d9b734d0c8cc 100644
--- a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
+++ b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
@@ -45,6 +45,7 @@
 
 #include <asm/inst.h>
 #include <linux/linkage.h>
+#include <asm/nospec-branch.h>
 
 ## ISCSI CRC 32 Implementation with crc32 and pclmulqdq Instruction
 
@@ -172,7 +173,7 @@ continue_block:
         movzxw  (bufp, %rax, 2), len
         lea     crc_array(%rip), bufp
         lea     (bufp, len, 1), bufp
-        jmp     *bufp
+        JMP_NOSPEC bufp
 
         ################################################################
         ## 2a) PROCESS FULL BLOCKS:
diff --git a/arch/x86/crypto/salsa20_glue.c b/arch/x86/crypto/salsa20_glue.c
index 399a29d067d6..cb91a64a99e7 100644
--- a/arch/x86/crypto/salsa20_glue.c
+++ b/arch/x86/crypto/salsa20_glue.c
@@ -59,13 +59,6 @@ static int encrypt(struct blkcipher_desc *desc,
 
         salsa20_ivsetup(ctx, walk.iv);
 
-        if (likely(walk.nbytes == nbytes))
-        {
-                salsa20_encrypt_bytes(ctx, walk.src.virt.addr,
-                                      walk.dst.virt.addr, nbytes);
-                return blkcipher_walk_done(desc, &walk, 0);
-        }
-
         while (walk.nbytes >= 64) {
                 salsa20_encrypt_bytes(ctx, walk.src.virt.addr,
                                       walk.dst.virt.addr,
diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
index 3fd8bc560fae..3f48f695d5e6 100644
--- a/arch/x86/entry/calling.h
+++ b/arch/x86/entry/calling.h
@@ -1,6 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 #include <linux/jump_label.h>
 #include <asm/unwind_hints.h>
+#include <asm/cpufeatures.h>
+#include <asm/page_types.h>
+#include <asm/percpu.h>
+#include <asm/asm-offsets.h>
+#include <asm/processor-flags.h>
 
 /*
 
@@ -187,6 +192,148 @@ For 32-bit we have the following conventions - kernel is built with
 #endif
 .endm
 
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+
+/*
+ * PAGE_TABLE_ISOLATION PGDs are 8k.  Flip bit 12 to switch between the two
+ * halves:
+ */
+#define PTI_USER_PGTABLE_BIT            PAGE_SHIFT
+#define PTI_USER_PGTABLE_MASK           (1 << PTI_USER_PGTABLE_BIT)
+#define PTI_USER_PCID_BIT               X86_CR3_PTI_PCID_USER_BIT
+#define PTI_USER_PCID_MASK              (1 << PTI_USER_PCID_BIT)
+#define PTI_USER_PGTABLE_AND_PCID_MASK  (PTI_USER_PCID_MASK | PTI_USER_PGTABLE_MASK)
+
+.macro SET_NOFLUSH_BIT  reg:req
+        bts     $X86_CR3_PCID_NOFLUSH_BIT, \reg
+.endm
+
+.macro ADJUST_KERNEL_CR3 reg:req
+        ALTERNATIVE "", "SET_NOFLUSH_BIT \reg", X86_FEATURE_PCID
+        /* Clear PCID and "PAGE_TABLE_ISOLATION bit", point CR3 at kernel pagetables: */
+        andq    $(~PTI_USER_PGTABLE_AND_PCID_MASK), \reg
+.endm
+
+.macro SWITCH_TO_KERNEL_CR3 scratch_reg:req
+        ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_PTI
+        mov     %cr3, \scratch_reg
+        ADJUST_KERNEL_CR3 \scratch_reg
+        mov     \scratch_reg, %cr3
+.Lend_\@:
+.endm
+
+#define THIS_CPU_user_pcid_flush_mask   \
+        PER_CPU_VAR(cpu_tlbstate) + TLB_STATE_user_pcid_flush_mask
+
+.macro SWITCH_TO_USER_CR3_NOSTACK scratch_reg:req scratch_reg2:req
+        ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_PTI
+        mov     %cr3, \scratch_reg
+
+        ALTERNATIVE "jmp .Lwrcr3_\@", "", X86_FEATURE_PCID
+
+        /*
+         * Test if the ASID needs a flush.
+         */
+        movq    \scratch_reg, \scratch_reg2
+        andq    $(0x7FF), \scratch_reg          /* mask ASID */
+        bt      \scratch_reg, THIS_CPU_user_pcid_flush_mask
+        jnc     .Lnoflush_\@
+
+        /* Flush needed, clear the bit */
+        btr     \scratch_reg, THIS_CPU_user_pcid_flush_mask
+        movq    \scratch_reg2, \scratch_reg
+        jmp     .Lwrcr3_pcid_\@
+
+.Lnoflush_\@:
+        movq    \scratch_reg2, \scratch_reg
+        SET_NOFLUSH_BIT \scratch_reg
+
+.Lwrcr3_pcid_\@:
+        /* Flip the ASID to the user version */
+        orq     $(PTI_USER_PCID_MASK), \scratch_reg
+
+.Lwrcr3_\@:
+        /* Flip the PGD to the user version */
+        orq     $(PTI_USER_PGTABLE_MASK), \scratch_reg
+        mov     \scratch_reg, %cr3
+.Lend_\@:
+.endm
+
+.macro SWITCH_TO_USER_CR3_STACK scratch_reg:req
+        pushq   %rax
+        SWITCH_TO_USER_CR3_NOSTACK scratch_reg=\scratch_reg scratch_reg2=%rax
+        popq    %rax
+.endm
+
+.macro SAVE_AND_SWITCH_TO_KERNEL_CR3 scratch_reg:req save_reg:req
+        ALTERNATIVE "jmp .Ldone_\@", "", X86_FEATURE_PTI
+        movq    %cr3, \scratch_reg
+        movq    \scratch_reg, \save_reg
+        /*
+         * Test the user pagetable bit. If set, then the user page tables
+         * are active. If clear CR3 already has the kernel page table
+         * active.
+         */
+        bt      $PTI_USER_PGTABLE_BIT, \scratch_reg
+        jnc     .Ldone_\@
+
+        ADJUST_KERNEL_CR3 \scratch_reg
+        movq    \scratch_reg, %cr3
+
+.Ldone_\@:
+.endm
+
+.macro RESTORE_CR3 scratch_reg:req save_reg:req
+        ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_PTI
+
+        ALTERNATIVE "jmp .Lwrcr3_\@", "", X86_FEATURE_PCID
+
+        /*
+         * KERNEL pages can always resume with NOFLUSH as we do
+         * explicit flushes.
+         */
+        bt      $PTI_USER_PGTABLE_BIT, \save_reg
+        jnc     .Lnoflush_\@
+
+        /*
+         * Check if there's a pending flush for the user ASID we're
+         * about to set.
+         */
+        movq    \save_reg, \scratch_reg
+        andq    $(0x7FF), \scratch_reg
+        bt      \scratch_reg, THIS_CPU_user_pcid_flush_mask
+        jnc     .Lnoflush_\@
+
+        btr     \scratch_reg, THIS_CPU_user_pcid_flush_mask
+        jmp     .Lwrcr3_\@
+
+.Lnoflush_\@:
+        SET_NOFLUSH_BIT \save_reg
+
+.Lwrcr3_\@:
+        /*
+         * The CR3 write could be avoided when not changing its value,
+         * but would require a CR3 read *and* a scratch register.
+         */
+        movq    \save_reg, %cr3
+.Lend_\@:
+.endm
+
+#else /* CONFIG_PAGE_TABLE_ISOLATION=n: */
+
+.macro SWITCH_TO_KERNEL_CR3 scratch_reg:req
+.endm
+.macro SWITCH_TO_USER_CR3_NOSTACK scratch_reg:req scratch_reg2:req
+.endm
+.macro SWITCH_TO_USER_CR3_STACK scratch_reg:req
+.endm
+.macro SAVE_AND_SWITCH_TO_KERNEL_CR3 scratch_reg:req save_reg:req
+.endm
+.macro RESTORE_CR3 scratch_reg:req save_reg:req
+.endm
+
+#endif
+
 #endif /* CONFIG_X86_64 */
 
 /*
diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index 4838037f97f6..60c4c342316c 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -44,6 +44,7 @@
 #include <asm/asm.h>
 #include <asm/smap.h>
 #include <asm/frame.h>
+#include <asm/nospec-branch.h>
 
         .section .entry.text, "ax"
 
@@ -243,6 +244,17 @@ ENTRY(__switch_to_asm)
         movl    %ebx, PER_CPU_VAR(stack_canary)+stack_canary_offset
 #endif
 
+#ifdef CONFIG_RETPOLINE
+        /*
+         * When switching from a shallower to a deeper call stack
+         * the RSB may either underflow or use entries populated
+         * with userspace addresses. On CPUs where those concerns
+         * exist, overwrite the RSB with entries which capture
+         * speculative execution to prevent attack.
+         */
+        FILL_RETURN_BUFFER %ebx, RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW
+#endif
+
         /* restore callee-saved registers */
         popl    %esi
         popl    %edi
@@ -290,7 +302,7 @@ ENTRY(ret_from_fork)
 
         /* kernel thread */
 1:      movl    %edi, %eax
-        call    *%ebx
+        CALL_NOSPEC %ebx
         /*
          * A kernel thread is allowed to return here after successfully
          * calling do_execve().  Exit to userspace to complete the execve()
@@ -919,7 +931,7 @@ common_exception:
         movl    %ecx, %es
         TRACE_IRQS_OFF
         movl    %esp, %eax                      # pt_regs pointer
-        call    *%edi
+        CALL_NOSPEC %edi
         jmp     ret_from_exception
 END(common_exception)
 
@@ -941,9 +953,10 @@ ENTRY(debug)
         movl    %esp, %eax                      # pt_regs pointer
 
         /* Are we currently on the SYSENTER stack? */
-        PER_CPU(cpu_tss + CPU_TSS_SYSENTER_stack + SIZEOF_SYSENTER_stack, %ecx)
-        subl    %eax, %ecx      /* ecx = (end of SYSENTER_stack) - esp */
-        cmpl    $SIZEOF_SYSENTER_stack, %ecx
+        movl    PER_CPU_VAR(cpu_entry_area), %ecx
+        addl    $CPU_ENTRY_AREA_entry_stack + SIZEOF_entry_stack, %ecx
+        subl    %eax, %ecx      /* ecx = (end of entry_stack) - esp */
+        cmpl    $SIZEOF_entry_stack, %ecx
         jb      .Ldebug_from_sysenter_stack
 
         TRACE_IRQS_OFF
@@ -984,9 +997,10 @@ ENTRY(nmi)
         movl    %esp, %eax                      # pt_regs pointer
 
         /* Are we currently on the SYSENTER stack? */
-        PER_CPU(cpu_tss + CPU_TSS_SYSENTER_stack + SIZEOF_SYSENTER_stack, %ecx)
-        subl    %eax, %ecx      /* ecx = (end of SYSENTER_stack) - esp */
-        cmpl    $SIZEOF_SYSENTER_stack, %ecx
+        movl    PER_CPU_VAR(cpu_entry_area), %ecx
+        addl    $CPU_ENTRY_AREA_entry_stack + SIZEOF_entry_stack, %ecx
+        subl    %eax, %ecx      /* ecx = (end of entry_stack) - esp */
+        cmpl    $SIZEOF_entry_stack, %ecx
         jb      .Lnmi_from_sysenter_stack
 
         /* Not on SYSENTER stack. */
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index f81d50d7ceac..ff6f8022612c 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -23,7 +23,6 @@
 #include <asm/segment.h>
 #include <asm/cache.h>
 #include <asm/errno.h>
-#include "calling.h"
 #include <asm/asm-offsets.h>
 #include <asm/msr.h>
 #include <asm/unistd.h>
@@ -38,8 +37,11 @@
 #include <asm/pgtable_types.h>
 #include <asm/export.h>
 #include <asm/frame.h>
+#include <asm/nospec-branch.h>
 #include <linux/err.h>
 
+#include "calling.h"
+
 .code64
 .section .entry.text, "ax"
 
@@ -140,6 +142,67 @@ END(native_usergs_sysret64)
  * with them due to bugs in both AMD and Intel CPUs.
  */
 
+        .pushsection .entry_trampoline, "ax"
+
+/*
+ * The code in here gets remapped into cpu_entry_area's trampoline.  This means
+ * that the assembler and linker have the wrong idea as to where this code
+ * lives (and, in fact, it's mapped more than once, so it's not even at a
+ * fixed address).  So we can't reference any symbols outside the entry
+ * trampoline and expect it to work.
+ *
+ * Instead, we carefully abuse %rip-relative addressing.
+ * _entry_trampoline(%rip) refers to the start of the remapped) entry
+ * trampoline.  We can thus find cpu_entry_area with this macro:
+ */
+
+#define CPU_ENTRY_AREA \
+        _entry_trampoline - CPU_ENTRY_AREA_entry_trampoline(%rip)
+
+/* The top word of the SYSENTER stack is hot and is usable as scratch space. */
+#define RSP_SCRATCH     CPU_ENTRY_AREA_entry_stack + \
+                        SIZEOF_entry_stack - 8 + CPU_ENTRY_AREA
+
+ENTRY(entry_SYSCALL_64_trampoline)
+        UNWIND_HINT_EMPTY
+        swapgs
+
+        /* Stash the user RSP. */
+        movq    %rsp, RSP_SCRATCH
+
+        /* Note: using %rsp as a scratch reg. */
+        SWITCH_TO_KERNEL_CR3 scratch_reg=%rsp
+
+        /* Load the top of the task stack into RSP */
+        movq    CPU_ENTRY_AREA_tss + TSS_sp1 + CPU_ENTRY_AREA, %rsp
+
+        /* Start building the simulated IRET frame. */
+        pushq   $__USER_DS                      /* pt_regs->ss */
+        pushq   RSP_SCRATCH                     /* pt_regs->sp */
+        pushq   %r11                            /* pt_regs->flags */
+        pushq   $__USER_CS                      /* pt_regs->cs */
+        pushq   %rcx                            /* pt_regs->ip */
+
+        /*
+         * x86 lacks a near absolute jump, and we can't jump to the real
+         * entry text with a relative jump.  We could push the target
+         * address and then use retq, but this destroys the pipeline on
+         * many CPUs (wasting over 20 cycles on Sandy Bridge).  Instead,
+         * spill RDI and restore it in a second-stage trampoline.
+         */
+        pushq   %rdi
+        movq    $entry_SYSCALL_64_stage2, %rdi
+        JMP_NOSPEC %rdi
+END(entry_SYSCALL_64_trampoline)
+
+        .popsection
+
+ENTRY(entry_SYSCALL_64_stage2)
+        UNWIND_HINT_EMPTY
+        popq    %rdi
+        jmp     entry_SYSCALL_64_after_hwframe
+END(entry_SYSCALL_64_stage2)
+
 ENTRY(entry_SYSCALL_64)
         UNWIND_HINT_EMPTY
         /*
@@ -149,6 +212,10 @@ ENTRY(entry_SYSCALL_64)
          */
 
         swapgs
+        /*
+         * This path is not taken when PAGE_TABLE_ISOLATION is disabled so it
+         * is not required to switch CR3.
+         */
         movq    %rsp, PER_CPU_VAR(rsp_scratch)
         movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp
 
@@ -204,7 +271,12 @@ entry_SYSCALL_64_fastpath:
          * It might end up jumping to the slow path.  If it jumps, RAX
          * and all argument registers are clobbered.
          */
+#ifdef CONFIG_RETPOLINE
+        movq    sys_call_table(, %rax, 8), %rax
+        call    __x86_indirect_thunk_rax
+#else
         call    *sys_call_table(, %rax, 8)
+#endif
 .Lentry_SYSCALL_64_after_fastpath_call:
 
         movq    %rax, RAX(%rsp)
@@ -330,8 +402,25 @@ syscall_return_via_sysret:
         popq    %rsi    /* skip rcx */
         popq    %rdx
         popq    %rsi
+
+        /*
+         * Now all regs are restored except RSP and RDI.
+         * Save old stack pointer and switch to trampoline stack.
+         */
+        movq    %rsp, %rdi
+        movq    PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %rsp
+
+        pushq   RSP-RDI(%rdi)   /* RSP */
+        pushq   (%rdi)          /* RDI */
+
+        /*
+         * We are on the trampoline stack.  All regs except RDI are live.
+         * We can do future final exit work right here.
+         */
+        SWITCH_TO_USER_CR3_STACK scratch_reg=%rdi
+
         popq    %rdi
-        movq    RSP-ORIG_RAX(%rsp), %rsp
+        popq    %rsp
         USERGS_SYSRET64
 END(entry_SYSCALL_64)
 
@@ -359,7 +448,7 @@ ENTRY(stub_ptregs_64)
         jmp     entry_SYSCALL64_slow_path
 
 1:
-        jmp     *%rax                           /* Called from C */
+        JMP_NOSPEC %rax                         /* Called from C */
 END(stub_ptregs_64)
 
 .macro ptregs_stub func
@@ -402,6 +491,17 @@ ENTRY(__switch_to_asm)
         movq    %rbx, PER_CPU_VAR(irq_stack_union)+stack_canary_offset
 #endif
 
+#ifdef CONFIG_RETPOLINE
+        /*
+         * When switching from a shallower to a deeper call stack
+         * the RSB may either underflow or use entries populated
+         * with userspace addresses. On CPUs where those concerns
+         * exist, overwrite the RSB with entries which capture
+         * speculative execution to prevent attack.
+         */
+        FILL_RETURN_BUFFER %r12, RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW
+#endif
+
         /* restore callee-saved registers */
         popq    %r15
         popq    %r14
@@ -438,7 +538,7 @@ ENTRY(ret_from_fork)
 1:
         /* kernel thread */
         movq    %r12, %rdi
-        call    *%rbx
+        CALL_NOSPEC %rbx
         /*
          * A kernel thread is allowed to return here after successfully
          * calling do_execve().  Exit to userspace to complete the execve()
@@ -466,12 +566,13 @@ END(irq_entries_start)
 
 .macro DEBUG_ENTRY_ASSERT_IRQS_OFF
 #ifdef CONFIG_DEBUG_ENTRY
-        pushfq
-        testl $X86_EFLAGS_IF, (%rsp)
+        pushq %rax
+        SAVE_FLAGS(CLBR_RAX)
+        testl $X86_EFLAGS_IF, %eax
         jz .Lokay_\@
         ud2
 .Lokay_\@:
-        addq $8, %rsp
+        popq %rax
 #endif
 .endm
 
@@ -563,6 +664,13 @@ END(irq_entries_start)
 /* 0(%rsp): ~(interrupt number) */
         .macro interrupt func
         cld
+
+        testb   $3, CS-ORIG_RAX(%rsp)
+        jz      1f
+        SWAPGS
+        call    switch_to_thread_stack
+1:
+
         ALLOC_PT_GPREGS_ON_STACK
         SAVE_C_REGS
         SAVE_EXTRA_REGS
@@ -572,12 +680,8 @@ END(irq_entries_start)
         jz      1f
 
         /*
-         * IRQ from user mode.  Switch to kernel gsbase and inform context
-         * tracking that we're in kernel mode.
-         */
-        SWAPGS
-
-        /*
+         * IRQ from user mode.
+         *
          * We need to tell lockdep that IRQs are off.  We can't do this until
          * we fix gsbase, and we should do it before enter_from_user_mode
          * (which can take locks).  Since TRACE_IRQS_OFF idempotent,
@@ -630,10 +734,43 @@ GLOBAL(swapgs_restore_regs_and_return_to_usermode)
         ud2
 1:
 #endif
-        SWAPGS
         POP_EXTRA_REGS
-        POP_C_REGS
-        addq    $8, %rsp        /* skip regs->orig_ax */
+        popq    %r11
+        popq    %r10
+        popq    %r9
+        popq    %r8
+        popq    %rax
+        popq    %rcx
+        popq    %rdx
+        popq    %rsi
+
+        /*
+         * The stack is now user RDI, orig_ax, RIP, CS, EFLAGS, RSP, SS.
+         * Save old stack pointer and switch to trampoline stack.
+         */
+        movq    %rsp, %rdi
+        movq    PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %rsp
+
+        /* Copy the IRET frame to the trampoline stack. */
+        pushq   6*8(%rdi)       /* SS */
+        pushq   5*8(%rdi)       /* RSP */
+        pushq   4*8(%rdi)       /* EFLAGS */
+        pushq   3*8(%rdi)       /* CS */
+        pushq   2*8(%rdi)       /* RIP */
+
+        /* Push user RDI on the trampoline stack. */
+        pushq   (%rdi)
+
+        /*
+         * We are on the trampoline stack.  All regs except RDI are live.
+         * We can do future final exit work right here.
+         */
+
+        SWITCH_TO_USER_CR3_STACK scratch_reg=%rdi
+
+        /* Restore RDI. */
+        popq    %rdi
+        SWAPGS
         INTERRUPT_RETURN
 
 
@@ -713,7 +850,9 @@ native_irq_return_ldt:
          */
 
         pushq   %rdi                            /* Stash user RDI */
-        SWAPGS
+        SWAPGS                                  /* to kernel GS */
+        SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi   /* to kernel CR3 */
+
         movq    PER_CPU_VAR(espfix_waddr), %rdi
         movq    %rax, (0*8)(%rdi)               /* user RAX */
         movq    (1*8)(%rsp), %rax               /* user RIP */
@@ -729,7 +868,6 @@ native_irq_return_ldt:
         /* Now RAX == RSP. */
 
         andl    $0xffff0000, %eax               /* RAX = (RSP & 0xffff0000) */
-        popq    %rdi                            /* Restore user RDI */
 
         /*
          * espfix_stack[31:16] == 0.  The page tables are set up such that
@@ -740,7 +878,11 @@ native_irq_return_ldt:
          * still points to an RO alias of the ESPFIX stack.
          */
         orq     PER_CPU_VAR(espfix_stack), %rax
-        SWAPGS
+
+        SWITCH_TO_USER_CR3_STACK scratch_reg=%rdi
+        SWAPGS                                  /* to user GS */
+        popq    %rdi                            /* Restore user RDI */
+
         movq    %rax, %rsp
         UNWIND_HINT_IRET_REGS offset=8
 
@@ -829,7 +971,35 @@ apicinterrupt IRQ_WORK_VECTOR			irq_work_interrupt		smp_irq_work_interrupt
 /*
  * Exception entry points.
  */
-#define CPU_TSS_IST(x) PER_CPU_VAR(cpu_tss) + (TSS_ist + ((x) - 1) * 8)
+#define CPU_TSS_IST(x) PER_CPU_VAR(cpu_tss_rw) + (TSS_ist + ((x) - 1) * 8)
+
+/*
+ * Switch to the thread stack.  This is called with the IRET frame and
+ * orig_ax on the stack.  (That is, RDI..R12 are not on the stack and
+ * space has not been allocated for them.)
+ */
+ENTRY(switch_to_thread_stack)
+        UNWIND_HINT_FUNC
+
+        pushq   %rdi
+        /* Need to switch before accessing the thread stack. */
+        SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi
+        movq    %rsp, %rdi
+        movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp
+        UNWIND_HINT sp_offset=16 sp_reg=ORC_REG_DI
+
+        pushq   7*8(%rdi)               /* regs->ss */
+        pushq   6*8(%rdi)               /* regs->rsp */
+        pushq   5*8(%rdi)               /* regs->eflags */
+        pushq   4*8(%rdi)               /* regs->cs */
+        pushq   3*8(%rdi)               /* regs->ip */
+        pushq   2*8(%rdi)               /* regs->orig_ax */
+        pushq   8(%rdi)                 /* return address */
+        UNWIND_HINT_FUNC
+
+        movq    (%rdi), %rdi
+        ret
+END(switch_to_thread_stack)
 
 .macro idtentry sym do_sym has_error_code:req paranoid=0 shift_ist=-1
 ENTRY(\sym)
@@ -848,11 +1018,12 @@ ENTRY(\sym)
 
         ALLOC_PT_GPREGS_ON_STACK
 
-        .if \paranoid
-        .if \paranoid == 1
+        .if \paranoid < 2
         testb   $3, CS(%rsp)                    /* If coming from userspace, switch stacks */
-        jnz     1f
+        jnz     .Lfrom_usermode_switch_stack_\@
         .endif
+
+        .if \paranoid
         call    paranoid_entry
         .else
         call    error_entry
@@ -894,20 +1065,15 @@ ENTRY(\sym)
         jmp     error_exit
         .endif
 
-        .if \paranoid == 1
+        .if \paranoid < 2
         /*
-         * Paranoid entry from userspace.  Switch stacks and treat it
+         * Entry from userspace.  Switch stacks and treat it
          * as a normal entry.  This means that paranoid handlers
          * run in real process context if user_mode(regs).
          */
-1:
+.Lfrom_usermode_switch_stack_\@:
         call    error_entry
 
-
-        movq    %rsp, %rdi                      /* pt_regs pointer */
-        call    sync_regs
-        movq    %rax, %rsp                      /* switch stack */
-
         movq    %rsp, %rdi                      /* pt_regs pointer */
 
         .if \has_error_code
@@ -1098,7 +1264,7 @@ idtentry async_page_fault	do_async_page_fault	has_error_code=1
 #endif
 
 #ifdef CONFIG_X86_MCE
-idtentry machine_check                                  has_error_code=0        paranoid=1 do_sym=*machine_check_vector(%rip)
+idtentry machine_check          do_mce                  has_error_code=0        paranoid=1
 #endif
 
 /*
@@ -1119,7 +1285,11 @@ ENTRY(paranoid_entry)
         js      1f                              /* negative -> in kernel */
         SWAPGS
         xorl    %ebx, %ebx
-1:      ret
+
+1:
+        SAVE_AND_SWITCH_TO_KERNEL_CR3 scratch_reg=%rax save_reg=%r14
+
+        ret
 END(paranoid_entry)
 
 /*
@@ -1141,6 +1311,7 @@ ENTRY(paranoid_exit)
         testl   %ebx, %ebx                      /* swapgs needed? */
         jnz     .Lparanoid_exit_no_swapgs
         TRACE_IRQS_IRETQ
+        RESTORE_CR3     scratch_reg=%rbx save_reg=%r14
         SWAPGS_UNSAFE_STACK
         jmp     .Lparanoid_exit_restore
 .Lparanoid_exit_no_swapgs:
@@ -1168,8 +1339,18 @@ ENTRY(error_entry)
          * from user mode due to an IRET fault.
          */
         SWAPGS
+        /* We have user CR3.  Change to kernel CR3. */
+        SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
 
 .Lerror_entry_from_usermode_after_swapgs:
+        /* Put us onto the real thread stack. */
+        popq    %r12                            /* save return addr in %12 */
+        movq    %rsp, %rdi                      /* arg0 = pt_regs pointer */
+        call    sync_regs
+        movq    %rax, %rsp                      /* switch stack */
+        ENCODE_FRAME_POINTER
+        pushq   %r12
+
         /*
          * We need to tell lockdep that IRQs are off.  We can't do this until
          * we fix gsbase, and we should do it before enter_from_user_mode
@@ -1206,6 +1387,7 @@ ENTRY(error_entry)
          * .Lgs_change's error handler with kernel gsbase.
          */
         SWAPGS
+        SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
         jmp .Lerror_entry_done
 
 .Lbstep_iret:
@@ -1215,10 +1397,11 @@ ENTRY(error_entry)
 
 .Lerror_bad_iret:
         /*
-         * We came from an IRET to user mode, so we have user gsbase.
-         * Switch to kernel gsbase:
+         * We came from an IRET to user mode, so we have user
+         * gsbase and CR3.  Switch to kernel gsbase and CR3:
          */
         SWAPGS
+        SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
 
         /*
          * Pretend that the exception came from user mode: set up pt_regs
@@ -1250,6 +1433,10 @@ END(error_exit)
 /*
  * Runs on exception stack.  Xen PV does not go through this path at all,
  * so we can use real assembly here.
+ *
+ * Registers:
+ *      %r14: Used to save/restore the CR3 of the interrupted context
+ *            when PAGE_TABLE_ISOLATION is in use.  Do not clobber.
  */
 ENTRY(nmi)
         UNWIND_HINT_IRET_REGS
@@ -1313,6 +1500,7 @@ ENTRY(nmi)
 
         swapgs
         cld
+        SWITCH_TO_KERNEL_CR3 scratch_reg=%rdx
         movq    %rsp, %rdx
         movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp
         UNWIND_HINT_IRET_REGS base=%rdx offset=8
@@ -1565,6 +1753,8 @@ end_repeat_nmi:
         movq    $-1, %rsi
         call    do_nmi
 
+        RESTORE_CR3 scratch_reg=%r15 save_reg=%r14
+
         testl   %ebx, %ebx                      /* swapgs needed? */
         jnz     nmi_restore
 nmi_swapgs:
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index 568e130d932c..98d5358e4041 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -48,7 +48,11 @@
  */
 ENTRY(entry_SYSENTER_compat)
         /* Interrupts are off on entry. */
-        SWAPGS_UNSAFE_STACK
+        SWAPGS
+
+        /* We are about to clobber %rsp anyway, clobbering here is OK */
+        SWITCH_TO_KERNEL_CR3 scratch_reg=%rsp
+
         movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp
 
         /*
@@ -186,8 +190,13 @@ ENTRY(entry_SYSCALL_compat)
         /* Interrupts are off on entry. */
         swapgs
 
-        /* Stash user ESP and switch to the kernel stack. */
+        /* Stash user ESP */
         movl    %esp, %r8d
+
+        /* Use %rsp as scratch reg. User ESP is stashed in r8 */
+        SWITCH_TO_KERNEL_CR3 scratch_reg=%rsp
+
+        /* Switch to the kernel stack */
         movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp
 
         /* Construct struct pt_regs on stack */
@@ -256,10 +265,22 @@ sysret32_from_system_call:
          * when the system call started, which is already known to user
          * code.  We zero R8-R10 to avoid info leaks.
          */
+        movq    RSP-ORIG_RAX(%rsp), %rsp
+
+        /*
+         * The original userspace %rsp (RSP-ORIG_RAX(%rsp)) is stored
+         * on the process stack which is not mapped to userspace and
+         * not readable after we SWITCH_TO_USER_CR3.  Delay the CR3
+         * switch until after after the last reference to the process
+         * stack.
+         *
+         * %r8/%r9 are zeroed before the sysret, thus safe to clobber.
+         */
+        SWITCH_TO_USER_CR3_NOSTACK scratch_reg=%r8 scratch_reg2=%r9
+
         xorq    %r8, %r8
         xorq    %r9, %r9
         xorq    %r10, %r10
-        movq    RSP-ORIG_RAX(%rsp), %rsp
         swapgs
         sysretl
 END(entry_SYSCALL_compat)
@@ -306,8 +327,11 @@ ENTRY(entry_INT80_compat)
          */
         movl    %eax, %eax
 
-        /* Construct struct pt_regs on stack (iret frame is already on stack) */
         pushq   %rax                    /* pt_regs->orig_ax */
+
+        /* switch to thread stack expects orig_ax to be pushed */
+        call    switch_to_thread_stack
+
         pushq   %rdi                    /* pt_regs->di */
         pushq   %rsi                    /* pt_regs->si */
         pushq   %rdx                    /* pt_regs->dx */
diff --git a/arch/x86/entry/vdso/vclock_gettime.c b/arch/x86/entry/vdso/vclock_gettime.c
index 11b13c4b43d5..f19856d95c60 100644
--- a/arch/x86/entry/vdso/vclock_gettime.c
+++ b/arch/x86/entry/vdso/vclock_gettime.c
@@ -324,5 +324,5 @@ notrace time_t __vdso_time(time_t *t)
                 *t = result;
         return result;
 }
-int time(time_t *t)
+time_t time(time_t *t)
         __attribute__((weak, alias("__vdso_time")));
diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
index f279ba2643dc..577fa8adb785 100644
--- a/arch/x86/entry/vsyscall/vsyscall_64.c
+++ b/arch/x86/entry/vsyscall/vsyscall_64.c
@@ -37,6 +37,7 @@
 #include <asm/unistd.h>
 #include <asm/fixmap.h>
 #include <asm/traps.h>
+#include <asm/paravirt.h>
 
 #define CREATE_TRACE_POINTS
 #include "vsyscall_trace.h"
@@ -138,6 +139,10 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
 
         WARN_ON_ONCE(address != regs->ip);
 
+        /* This should be unreachable in NATIVE mode. */
+        if (WARN_ON(vsyscall_mode == NATIVE))
+                return false;
+
         if (vsyscall_mode == NONE) {
                 warn_bad_vsyscall(KERN_INFO, regs,
                                   "vsyscall attempted with vsyscall=none");
@@ -329,16 +334,47 @@ int in_gate_area_no_mm(unsigned long addr)
         return vsyscall_mode != NONE && (addr & PAGE_MASK) == VSYSCALL_ADDR;
 }
 
+/*
+ * The VSYSCALL page is the only user-accessible page in the kernel address
+ * range.  Normally, the kernel page tables can have _PAGE_USER clear, but
+ * the tables covering VSYSCALL_ADDR need _PAGE_USER set if vsyscalls
+ * are enabled.
+ *
+ * Some day we may create a "minimal" vsyscall mode in which we emulate
+ * vsyscalls but leave the page not present.  If so, we skip calling
+ * this.
+ */
+void __init set_vsyscall_pgtable_user_bits(pgd_t *root)
+{
+        pgd_t *pgd;
+        p4d_t *p4d;
+        pud_t *pud;
+        pmd_t *pmd;
+
+        pgd = pgd_offset_pgd(root, VSYSCALL_ADDR);
+        set_pgd(pgd, __pgd(pgd_val(*pgd) | _PAGE_USER));
+        p4d = p4d_offset(pgd, VSYSCALL_ADDR);
+#if CONFIG_PGTABLE_LEVELS >= 5
+        p4d->p4d |= _PAGE_USER;
+#endif
+        pud = pud_offset(p4d, VSYSCALL_ADDR);
+        set_pud(pud, __pud(pud_val(*pud) | _PAGE_USER));
+        pmd = pmd_offset(pud, VSYSCALL_ADDR);
+        set_pmd(pmd, __pmd(pmd_val(*pmd) | _PAGE_USER));
+}
+
 void __init map_vsyscall(void)
 {
         extern char __vsyscall_page;
         unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page);
 
-        if (vsyscall_mode != NONE)
+        if (vsyscall_mode != NONE) {
                 __set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall,
                              vsyscall_mode == NATIVE
                              ? PAGE_KERNEL_VSYSCALL
                              : PAGE_KERNEL_VVAR);
+                set_vsyscall_pgtable_user_bits(swapper_pg_dir);
+        }
 
         BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) !=
                      (unsigned long)VSYSCALL_ADDR);
diff --git a/arch/x86/events/amd/power.c b/arch/x86/events/amd/power.c
index a6eee5ac4f58..2aefacf5c5b2 100644
--- a/arch/x86/events/amd/power.c
+++ b/arch/x86/events/amd/power.c
@@ -277,7 +277,7 @@ static int __init amd_power_pmu_init(void)
         int ret;
 
         if (!x86_match_cpu(cpu_match))
-                return 0;
+                return -ENODEV;
 
         if (!boot_cpu_has(X86_FEATURE_ACC_POWER))
                 return -ENODEV;
diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
index 141e07b06216..24ffa1e88cf9 100644
--- a/arch/x86/events/intel/bts.c
+++ b/arch/x86/events/intel/bts.c
@@ -582,6 +582,24 @@ static __init int bts_init(void)
         if (!boot_cpu_has(X86_FEATURE_DTES64) || !x86_pmu.bts)
                 return -ENODEV;
 
+        if (boot_cpu_has(X86_FEATURE_PTI)) {
+                /*
+                 * BTS hardware writes through a virtual memory map we must
+                 * either use the kernel physical map, or the user mapping of
+                 * the AUX buffer.
+                 *
+                 * However, since this driver supports per-CPU and per-task inherit
+                 * we cannot use the user mapping since it will not be availble
+                 * if we're not running the owning process.
+                 *
+                 * With PTI we can't use the kernal map either, because its not
+                 * there when we run userspace.
+                 *
+                 * For now, disable this driver when using PTI.
+                 */
+                return -ENODEV;
+        }
+
         bts_pmu.capabilities    = PERF_PMU_CAP_AUX_NO_SG | PERF_PMU_CAP_ITRACE |
                                   PERF_PMU_CAP_EXCLUSIVE;
         bts_pmu.task_ctx_nr     = perf_sw_context;
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 09c26a4f139c..731153a4681e 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3847,6 +3847,8 @@ static struct attribute *intel_pmu_attrs[] = {
 
 __init int intel_pmu_init(void)
 {
+        struct attribute **extra_attr = NULL;
+        struct attribute **to_free = NULL;
         union cpuid10_edx edx;
         union cpuid10_eax eax;
         union cpuid10_ebx ebx;
@@ -3854,7 +3856,6 @@ __init int intel_pmu_init(void)
         unsigned int unused;
         struct extra_reg *er;
         int version, i;
-        struct attribute **extra_attr = NULL;
         char *name;
 
         if (!cpu_has(&boot_cpu_data, X86_FEATURE_ARCH_PERFMON)) {
@@ -4294,6 +4295,7 @@ __init int intel_pmu_init(void)
                 extra_attr = boot_cpu_has(X86_FEATURE_RTM) ?
                         hsw_format_attr : nhm_format_attr;
                 extra_attr = merge_attr(extra_attr, skl_format_attr);
+                to_free = extra_attr;
                 x86_pmu.cpu_events = get_hsw_events_attrs();
                 intel_pmu_pebs_data_source_skl(
                         boot_cpu_data.x86_model == INTEL_FAM6_SKYLAKE_X);
@@ -4401,6 +4403,7 @@ __init int intel_pmu_init(void)
                 pr_cont("full-width counters, ");
         }
 
+        kfree(to_free);
         return 0;
 }
 
diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index 3674a4b6f8bd..18c25ab28557 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -3,16 +3,19 @@
 #include <linux/types.h>
 #include <linux/slab.h>
 
+#include <asm/cpu_entry_area.h>
 #include <asm/perf_event.h>
+#include <asm/tlbflush.h>
 #include <asm/insn.h>
 
 #include "../perf_event.h"
 
+/* Waste a full page so it can be mapped into the cpu_entry_area */
+DEFINE_PER_CPU_PAGE_ALIGNED(struct debug_store, cpu_debug_store);
+
 /* The size of a BTS record in bytes: */
 #define BTS_RECORD_SIZE         24
 
-#define BTS_BUFFER_SIZE         (PAGE_SIZE << 4)
-#define PEBS_BUFFER_SIZE        (PAGE_SIZE << 4)
 #define PEBS_FIXUP_SIZE         PAGE_SIZE
 
 /*
@@ -279,17 +282,67 @@ void fini_debug_store_on_cpu(int cpu)
 
 static DEFINE_PER_CPU(void *, insn_buffer);
 
-static int alloc_pebs_buffer(int cpu)
+static void ds_update_cea(void *cea, void *addr, size_t size, pgprot_t prot)
 {
-        struct debug_store *ds = per_cpu(cpu_hw_events, cpu).ds;
+        unsigned long start = (unsigned long)cea;
+        phys_addr_t pa;
+        size_t msz = 0;
+
+        pa = virt_to_phys(addr);
+
+        preempt_disable();
+        for (; msz < size; msz += PAGE_SIZE, pa += PAGE_SIZE, cea += PAGE_SIZE)
+                cea_set_pte(cea, pa, prot);
+
+        /*
+         * This is a cross-CPU update of the cpu_entry_area, we must shoot down
+         * all TLB entries for it.
+         */
+        flush_tlb_kernel_range(start, start + size);
+        preempt_enable();
+}
+
+static void ds_clear_cea(void *cea, size_t size)
+{
+        unsigned long start = (unsigned long)cea;
+        size_t msz = 0;
+
+        preempt_disable();
+        for (; msz < size; msz += PAGE_SIZE, cea += PAGE_SIZE)
+                cea_set_pte(cea, 0, PAGE_NONE);
+
+        flush_tlb_kernel_range(start, start + size);
+        preempt_enable();
+}
+
+static void *dsalloc_pages(size_t size, gfp_t flags, int cpu)
+{
+        unsigned int order = get_order(size);
         int node = cpu_to_node(cpu);
-        int max;
-        void *buffer, *ibuffer;
+        struct page *page;
+
+        page = __alloc_pages_node(node, flags | __GFP_ZERO, order);
+        return page ? page_address(page) : NULL;
+}
+
+static void dsfree_pages(const void *buffer, size_t size)
+{
+        if (buffer)
+                free_pages((unsigned long)buffer, get_order(size));
+}
+
+static int alloc_pebs_buffer(int cpu)
+{
+        struct cpu_hw_events *hwev = per_cpu_ptr(&cpu_hw_events, cpu);
+        struct debug_store *ds = hwev->ds;
+        size_t bsiz = x86_pmu.pebs_buffer_size;
+        int max, node = cpu_to_node(cpu);
+        void *buffer, *ibuffer, *cea;
 
         if (!x86_pmu.pebs)
                 return 0;
 
-        buffer = kzalloc_node(x86_pmu.pebs_buffer_size, GFP_KERNEL, node);
+        buffer = dsalloc_pages(bsiz, GFP_KERNEL, cpu);
         if (unlikely(!buffer))
                 return -ENOMEM;
 
@@ -300,99 +353,94 @@ static int alloc_pebs_buffer(int cpu)
         if (x86_pmu.intel_cap.pebs_format < 2) {
                 ibuffer = kzalloc_node(PEBS_FIXUP_SIZE, GFP_KERNEL, node);
                 if (!ibuffer) {
-                        kfree(buffer);
+                        dsfree_pages(buffer, bsiz);
                         return -ENOMEM;
                 }
                 per_cpu(insn_buffer, cpu) = ibuffer;
         }
-
-        max = x86_pmu.pebs_buffer_size / x86_pmu.pebs_record_size;
-
-        ds->pebs_buffer_base = (u64)(unsigned long)buffer;
+        hwev->ds_pebs_vaddr = buffer;
+        /* Update the cpu entry area mapping */
+        cea = &get_cpu_entry_area(cpu)->cpu_debug_buffers.pebs_buffer;
+        ds->pebs_buffer_base = (unsigned long) cea;
+        ds_update_cea(cea, buffer, bsiz, PAGE_KERNEL);
         ds->pebs_index = ds->pebs_buffer_base;
-        ds->pebs_absolute_maximum = ds->pebs_buffer_base +
-                max * x86_pmu.pebs_record_size;
-
+        max = x86_pmu.pebs_record_size * (bsiz / x86_pmu.pebs_record_size);
+        ds->pebs_absolute_maximum = ds->pebs_buffer_base + max;
         return 0;
 }
 
 static void release_pebs_buffer(int cpu)
 {
-        struct debug_store *ds = per_cpu(cpu_hw_events, cpu).ds;
+        struct cpu_hw_events *hwev = per_cpu_ptr(&cpu_hw_events, cpu);
+        void *cea;
 
-        if (!ds || !x86_pmu.pebs)
+        if (!x86_pmu.pebs)
                 return;
 
         kfree(per_cpu(insn_buffer, cpu));
         per_cpu(insn_buffer, cpu) = NULL;
 
-        kfree((void *)(unsigned long)ds->pebs_buffer_base);
-        ds->pebs_buffer_base = 0;
+        /* Clear the fixmap */
+        cea = &get_cpu_entry_area(cpu)->cpu_debug_buffers.pebs_buffer;
+        ds_clear_cea(cea, x86_pmu.pebs_buffer_size);
+        dsfree_pages(hwev->ds_pebs_vaddr, x86_pmu.pebs_buffer_size);
+        hwev->ds_pebs_vaddr = NULL;
 }
 
 static int alloc_bts_buffer(int cpu)
 {
-        struct debug_store *ds = per_cpu(cpu_hw_events, cpu).ds;
-        int node = cpu_to_node(cpu);
-        int max, thresh;
-        void *buffer;
+        struct cpu_hw_events *hwev = per_cpu_ptr(&cpu_hw_events, cpu);
+        struct debug_store *ds = hwev->ds;
+        void *buffer, *cea;
+        int max;
 
         if (!x86_pmu.bts)
                 return 0;
 
-        buffer = kzalloc_node(BTS_BUFFER_SIZE, GFP_KERNEL | __GFP_NOWARN, node);
+        buffer = dsalloc_pages(BTS_BUFFER_SIZE, GFP_KERNEL | __GFP_NOWARN, cpu);
         if (unlikely(!buffer)) {
                 WARN_ONCE(1, "%s: BTS buffer allocation failure\n", __func__);
                 return -ENOMEM;
         }
-
-        max = BTS_BUFFER_SIZE / BTS_RECORD_SIZE;
-        thresh = max / 16;
-
-        ds->bts_buffer_base = (u64)(unsigned long)buffer;
+        hwev->ds_bts_vaddr = buffer;
+        /* Update the fixmap */
+        cea = &get_cpu_entry_area(cpu)->cpu_debug_buffers.bts_buffer;
+        ds->bts_buffer_base = (unsigned long) cea;
+        ds_update_cea(cea, buffer, BTS_BUFFER_SIZE, PAGE_KERNEL);
         ds->bts_index = ds->bts_buffer_base;
-        ds->bts_absolute_maximum = ds->bts_buffer_base +
-                max * BTS_RECORD_SIZE;
-        ds->bts_interrupt_threshold = ds->bts_absolute_maximum -
-                thresh * BTS_RECORD_SIZE;
-
+        max = BTS_RECORD_SIZE * (BTS_BUFFER_SIZE / BTS_RECORD_SIZE);
+        ds->bts_absolute_maximum = ds->bts_buffer_base + max;
+        ds->bts_interrupt_threshold = ds->bts_absolute_maximum - (max / 16);
         return 0;
 }
 
 static void release_bts_buffer(int cpu)
 {
-        struct debug_store *ds = per_cpu(cpu_hw_events, cpu).ds;
+        struct cpu_hw_events *hwev = per_cpu_ptr(&cpu_hw_events, cpu);
+        void *cea;
 
-        if (!ds || !x86_pmu.bts)
+        if (!x86_pmu.bts)
                 return;
 
-        kfree((void *)(unsigned long)ds->bts_buffer_base);
-        ds->bts_buffer_base = 0;
+        /* Clear the fixmap */
+        cea = &get_cpu_entry_area(cpu)->cpu_debug_buffers.bts_buffer;
+        ds_clear_cea(cea, BTS_BUFFER_SIZE);
+        dsfree_pages(hwev->ds_bts_vaddr, BTS_BUFFER_SIZE);
+        hwev->ds_bts_vaddr = NULL;
 }
 
 static int alloc_ds_buffer(int cpu)
 {
-        int node = cpu_to_node(cpu);
-        struct debug_store *ds;
-
-        ds = kzalloc_node(sizeof(*ds), GFP_KERNEL, node);
-        if (unlikely(!ds))
-                return -ENOMEM;
+        struct debug_store *ds = &get_cpu_entry_area(cpu)->cpu_debug_store;
 
+        memset(ds, 0, sizeof(*ds));
         per_cpu(cpu_hw_events, cpu).ds = ds;
-
         return 0;
 }
 
 static void release_ds_buffer(int cpu)
 {
-        struct debug_store *ds = per_cpu(cpu_hw_events, cpu).ds;
-
-        if (!ds)
-                return;
-
         per_cpu(cpu_hw_events, cpu).ds = NULL;
-        kfree(ds);
 }
 
 void release_ds_buffers(void)
@@ -402,16 +450,22 @@ void release_ds_buffers(void)
         if (!x86_pmu.bts && !x86_pmu.pebs)
                 return;
 
-        get_online_cpus();
-        for_each_online_cpu(cpu)
+        for_each_possible_cpu(cpu)
+                release_ds_buffer(cpu);
+
+        for_each_possible_cpu(cpu) {
+                /*
+                 * Again, ignore errors from offline CPUs, they will no longer
+                 * observe cpu_hw_events.ds and not program the DS_AREA when
+                 * they come up.
+                 */
                 fini_debug_store_on_cpu(cpu);
+        }
 
         for_each_possible_cpu(cpu) {
                 release_pebs_buffer(cpu);
                 release_bts_buffer(cpu);
-                release_ds_buffer(cpu);
         }
-        put_online_cpus();
 }
 
 void reserve_ds_buffers(void)
@@ -431,8 +485,6 @@ void reserve_ds_buffers(void)
         if (!x86_pmu.pebs)
                 pebs_err = 1;
 
-        get_online_cpus();
-
         for_each_possible_cpu(cpu) {
                 if (alloc_ds_buffer(cpu)) {
                         bts_err = 1;
@@ -469,11 +521,14 @@ void reserve_ds_buffers(void)
                 if (x86_pmu.pebs && !pebs_err)
                         x86_pmu.pebs_active = 1;
 
-                for_each_online_cpu(cpu)
+                for_each_possible_cpu(cpu) {
+                        /*
+                         * Ignores wrmsr_on_cpu() errors for offline CPUs they
+                         * will get this call through intel_pmu_cpu_starting().
+                         */
                         init_debug_store_on_cpu(cpu);
+                }
         }
-
-        put_online_cpus();
 }
 
 /*
diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
index 005908ee9333..a2efb490f743 100644
--- a/arch/x86/events/intel/rapl.c
+++ b/arch/x86/events/intel/rapl.c
@@ -755,14 +755,14 @@ static const struct x86_cpu_id rapl_cpu_match[] __initconst = {
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_IVYBRIDGE_X, snbep_rapl_init),
 
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_HASWELL_CORE, hsw_rapl_init),
-        X86_RAPL_MODEL_MATCH(INTEL_FAM6_HASWELL_X,    hsw_rapl_init),
+        X86_RAPL_MODEL_MATCH(INTEL_FAM6_HASWELL_X,    hsx_rapl_init),
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_HASWELL_ULT,  hsw_rapl_init),
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_HASWELL_GT3E, hsw_rapl_init),
 
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_CORE,   hsw_rapl_init),
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_GT3E,   hsw_rapl_init),
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_X,      hsx_rapl_init),
-        X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_XEON_D, hsw_rapl_init),
+        X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_XEON_D, hsx_rapl_init),
 
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_XEON_PHI_KNL, knl_rapl_init),
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_XEON_PHI_KNM, knl_rapl_init),
diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
index f7aaadf9331f..8e4ea143ed96 100644
--- a/arch/x86/events/perf_event.h
+++ b/arch/x86/events/perf_event.h
@@ -14,6 +14,8 @@
 
 #include <linux/perf_event.h>
 
+#include <asm/intel_ds.h>
+
 /* To enable MSR tracing please use the generic trace points. */
 
 /*
@@ -77,8 +79,6 @@ struct amd_nb {
         struct event_constraint event_constraints[X86_PMC_IDX_MAX];
 };
 
-/* The maximal number of PEBS events: */
-#define MAX_PEBS_EVENTS         8
 #define PEBS_COUNTER_MASK       ((1ULL << MAX_PEBS_EVENTS) - 1)
 
 /*
@@ -95,23 +95,6 @@ struct amd_nb {
         PERF_SAMPLE_TRANSACTION | PERF_SAMPLE_PHYS_ADDR | \
         PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_REGS_USER)
 
-/*
- * A debug store configuration.
- *
- * We only support architectures that use 64bit fields.
- */
-struct debug_store {
-        u64     bts_buffer_base;
-        u64     bts_index;
-        u64     bts_absolute_maximum;
-        u64     bts_interrupt_threshold;
-        u64     pebs_buffer_base;
-        u64     pebs_index;
-        u64     pebs_absolute_maximum;
-        u64     pebs_interrupt_threshold;
-        u64     pebs_event_reset[MAX_PEBS_EVENTS];
-};
-
 #define PEBS_REGS \
         (PERF_REG_X86_AX | \
          PERF_REG_X86_BX | \
@@ -216,6 +199,8 @@ struct cpu_hw_events {
          * Intel DebugStore bits
          */
         struct debug_store      *ds;
+        void                    *ds_pebs_vaddr;
+        void                    *ds_bts_vaddr;
         u64                     pebs_enabled;
         int                     n_pebs;
         int                     n_large_pebs;
diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
index dbfd0854651f..cf5961ca8677 100644
--- a/arch/x86/include/asm/alternative.h
+++ b/arch/x86/include/asm/alternative.h
@@ -140,7 +140,7 @@ static inline int alternatives_text_reserved(void *start, void *end)
         ".popsection\n"                                                 \
         ".pushsection .altinstr_replacement, \"ax\"\n"                  \
         ALTINSTR_REPLACEMENT(newinstr, feature, 1)                      \
-        ".popsection"
+        ".popsection\n"
 
 #define ALTERNATIVE_2(oldinstr, newinstr1, feature1, newinstr2, feature2)\
         OLDINSTR_2(oldinstr, 1, 2)                                      \
@@ -151,7 +151,7 @@ static inline int alternatives_text_reserved(void *start, void *end)
         ".pushsection .altinstr_replacement, \"ax\"\n"                  \
         ALTINSTR_REPLACEMENT(newinstr1, feature1, 1)                    \
         ALTINSTR_REPLACEMENT(newinstr2, feature2, 2)                    \
-        ".popsection"
+        ".popsection\n"
 
 /*
  * Alternative instructions for different CPU types or capabilities.
diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
index a9e57f08bfa6..98722773391d 100644
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -136,6 +136,7 @@ extern void disconnect_bsp_APIC(int virt_wire_setup);
 extern void disable_local_APIC(void);
 extern void lapic_shutdown(void);
 extern void sync_Arb_IDs(void);
+extern void init_bsp_APIC(void);
 extern void apic_intr_mode_init(void);
 extern void setup_local_APIC(void);
 extern void init_apic_mappings(void);
diff --git a/arch/x86/include/asm/asm-prototypes.h b/arch/x86/include/asm/asm-prototypes.h
index ff700d81e91e..1908214b9125 100644
--- a/arch/x86/include/asm/asm-prototypes.h
+++ b/arch/x86/include/asm/asm-prototypes.h
@@ -11,7 +11,31 @@
 #include <asm/pgtable.h>
 #include <asm/special_insns.h>
 #include <asm/preempt.h>
+#include <asm/asm.h>
 
 #ifndef CONFIG_X86_CMPXCHG64
 extern void cmpxchg8b_emu(void);
 #endif
+
+#ifdef CONFIG_RETPOLINE
+#ifdef CONFIG_X86_32
+#define INDIRECT_THUNK(reg) extern asmlinkage void __x86_indirect_thunk_e ## reg(void);
+#else
+#define INDIRECT_THUNK(reg) extern asmlinkage void __x86_indirect_thunk_r ## reg(void);
+INDIRECT_THUNK(8)
+INDIRECT_THUNK(9)
+INDIRECT_THUNK(10)
+INDIRECT_THUNK(11)
+INDIRECT_THUNK(12)
+INDIRECT_THUNK(13)
+INDIRECT_THUNK(14)
+INDIRECT_THUNK(15)
+#endif
+INDIRECT_THUNK(ax)
+INDIRECT_THUNK(bx)
+INDIRECT_THUNK(cx)
+INDIRECT_THUNK(dx)
+INDIRECT_THUNK(si)
+INDIRECT_THUNK(di)
+INDIRECT_THUNK(bp)
+#endif /* CONFIG_RETPOLINE */
diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h
index 219faaec51df..386a6900e206 100644
--- a/arch/x86/include/asm/asm.h
+++ b/arch/x86/include/asm/asm.h
@@ -136,6 +136,7 @@
 #endif
 
 #ifndef __ASSEMBLY__
+#ifndef __BPF__
 /*
  * This output constraint should be used for any inline asm which has a "call"
  * instruction.  Otherwise the asm may be inserted before the frame pointer
@@ -145,5 +146,6 @@
 register unsigned long current_stack_pointer asm(_ASM_SP);
 #define ASM_CALL_CONSTRAINT "+r" (current_stack_pointer)
 #endif
+#endif
 
 #endif /* _ASM_X86_ASM_H */
diff --git a/arch/x86/include/asm/cpu_entry_area.h b/arch/x86/include/asm/cpu_entry_area.h
new file mode 100644
index 000000000000..4a7884b8dca5
--- /dev/null
+++ b/arch/x86/include/asm/cpu_entry_area.h
@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#ifndef _ASM_X86_CPU_ENTRY_AREA_H
+#define _ASM_X86_CPU_ENTRY_AREA_H
+
+#include <linux/percpu-defs.h>
+#include <asm/processor.h>
+#include <asm/intel_ds.h>
+
+/*
+ * cpu_entry_area is a percpu region that contains things needed by the CPU
+ * and early entry/exit code.  Real types aren't used for all fields here
+ * to avoid circular header dependencies.
+ *
+ * Every field is a virtual alias of some other allocated backing store.
+ * There is no direct allocation of a struct cpu_entry_area.
+ */
+struct cpu_entry_area {
+        char gdt[PAGE_SIZE];
+
+        /*
+         * The GDT is just below entry_stack and thus serves (on x86_64) as
+         * a a read-only guard page.
+         */
+        struct entry_stack_page entry_stack_page;
+
+        /*
+         * On x86_64, the TSS is mapped RO.  On x86_32, it's mapped RW because
+         * we need task switches to work, and task switches write to the TSS.
+         */
+        struct tss_struct tss;
+
+        char entry_trampoline[PAGE_SIZE];
+
+#ifdef CONFIG_X86_64
+        /*
+         * Exception stacks used for IST entries.
+         *
+         * In the future, this should have a separate slot for each stack
+         * with guard pages between them.
+         */
+        char exception_stacks[(N_EXCEPTION_STACKS - 1) * EXCEPTION_STKSZ + DEBUG_STKSZ];
+#endif
+#ifdef CONFIG_CPU_SUP_INTEL
+        /*
+         * Per CPU debug store for Intel performance monitoring. Wastes a
+         * full page at the moment.
+         */
+        struct debug_store cpu_debug_store;
+        /*
+         * The actual PEBS/BTS buffers must be mapped to user space
+         * Reserve enough fixmap PTEs.
+         */
+        struct debug_store_buffers cpu_debug_buffers;
+#endif
+};
+
+#define CPU_ENTRY_AREA_SIZE     (sizeof(struct cpu_entry_area))
+#define CPU_ENTRY_AREA_TOT_SIZE (CPU_ENTRY_AREA_SIZE * NR_CPUS)
+
+DECLARE_PER_CPU(struct cpu_entry_area *, cpu_entry_area);
+
+extern void setup_cpu_entry_areas(void);
+extern void cea_set_pte(void *cea_vaddr, phys_addr_t pa, pgprot_t flags);
+
+#define CPU_ENTRY_AREA_RO_IDT           CPU_ENTRY_AREA_BASE
+#define CPU_ENTRY_AREA_PER_CPU          (CPU_ENTRY_AREA_RO_IDT + PAGE_SIZE)
+
+#define CPU_ENTRY_AREA_RO_IDT_VADDR     ((void *)CPU_ENTRY_AREA_RO_IDT)
+
+#define CPU_ENTRY_AREA_MAP_SIZE                 \
+        (CPU_ENTRY_AREA_PER_CPU + CPU_ENTRY_AREA_TOT_SIZE - CPU_ENTRY_AREA_BASE)
+
+extern struct cpu_entry_area *get_cpu_entry_area(int cpu);
+
+static inline struct entry_stack *cpu_entry_stack(int cpu)
+{
+        return &get_cpu_entry_area(cpu)->entry_stack_page.stack;
+}
+
+#endif
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index bf6a76202a77..ea9a7dde62e5 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -135,6 +135,8 @@ extern void clear_cpu_cap(struct cpuinfo_x86 *c, unsigned int bit);
         set_bit(bit, (unsigned long *)cpu_caps_set);    \
 } while (0)
 
+#define setup_force_cpu_bug(bit) setup_force_cpu_cap(bit)
+
 #if defined(CC_HAVE_ASM_GOTO) && defined(CONFIG_X86_FAST_FEATURE_TESTS)
 /*
  * Static testing of CPU features.  Used the same as boot_cpu_has().
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index c0b0e9e8aa66..25b9375c1484 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -197,17 +197,20 @@
 #define X86_FEATURE_CAT_L3              ( 7*32+ 4) /* Cache Allocation Technology L3 */
 #define X86_FEATURE_CAT_L2              ( 7*32+ 5) /* Cache Allocation Technology L2 */
 #define X86_FEATURE_CDP_L3              ( 7*32+ 6) /* Code and Data Prioritization L3 */
+#define X86_FEATURE_INVPCID_SINGLE      ( 7*32+ 7) /* Effectively INVPCID && CR4.PCIDE=1 */
 
 #define X86_FEATURE_HW_PSTATE           ( 7*32+ 8) /* AMD HW-PState */
 #define X86_FEATURE_PROC_FEEDBACK       ( 7*32+ 9) /* AMD ProcFeedbackInterface */
 #define X86_FEATURE_SME                 ( 7*32+10) /* AMD Secure Memory Encryption */
-
+#define X86_FEATURE_PTI                 ( 7*32+11) /* Kernel Page Table Isolation enabled */
+#define X86_FEATURE_RETPOLINE           ( 7*32+12) /* Generic Retpoline mitigation for Spectre variant 2 */
+#define X86_FEATURE_RETPOLINE_AMD       ( 7*32+13) /* AMD Retpoline mitigation for Spectre variant 2 */
 #define X86_FEATURE_INTEL_PPIN          ( 7*32+14) /* Intel Processor Inventory Number */
-#define X86_FEATURE_INTEL_PT            ( 7*32+15) /* Intel Processor Trace */
 #define X86_FEATURE_AVX512_4VNNIW       ( 7*32+16) /* AVX-512 Neural Network Instructions */
 #define X86_FEATURE_AVX512_4FMAPS       ( 7*32+17) /* AVX-512 Multiply Accumulation Single precision */
 
 #define X86_FEATURE_MBA                 ( 7*32+18) /* Memory Bandwidth Allocation */
+#define X86_FEATURE_RSB_CTXSW           ( 7*32+19) /* Fill RSB on context switches */
 
 /* Virtualization flags: Linux defined, word 8 */
 #define X86_FEATURE_TPR_SHADOW          ( 8*32+ 0) /* Intel TPR Shadow */
@@ -242,6 +245,7 @@
 #define X86_FEATURE_AVX512IFMA          ( 9*32+21) /* AVX-512 Integer Fused Multiply-Add instructions */
 #define X86_FEATURE_CLFLUSHOPT          ( 9*32+23) /* CLFLUSHOPT instruction */
 #define X86_FEATURE_CLWB                ( 9*32+24) /* CLWB instruction */
+#define X86_FEATURE_INTEL_PT            ( 9*32+25) /* Intel Processor Trace */
 #define X86_FEATURE_AVX512PF            ( 9*32+26) /* AVX-512 Prefetch */
 #define X86_FEATURE_AVX512ER            ( 9*32+27) /* AVX-512 Exponential and Reciprocal */
 #define X86_FEATURE_AVX512CD            ( 9*32+28) /* AVX-512 Conflict Detection */
@@ -266,6 +270,7 @@
 /* AMD-defined CPU features, CPUID level 0x80000008 (EBX), word 13 */
 #define X86_FEATURE_CLZERO              (13*32+ 0) /* CLZERO instruction */
 #define X86_FEATURE_IRPERF              (13*32+ 1) /* Instructions Retired Count */
+#define X86_FEATURE_XSAVEERPTR          (13*32+ 2) /* Always save/restore FP error pointers */
 
 /* Thermal and Power Management Leaf, CPUID level 0x00000006 (EAX), word 14 */
 #define X86_FEATURE_DTHERM              (14*32+ 0) /* Digital Thermal Sensor */
@@ -339,5 +344,8 @@
 #define X86_BUG_SWAPGS_FENCE            X86_BUG(11) /* SWAPGS without input dep on GS */
 #define X86_BUG_MONITOR                 X86_BUG(12) /* IPI required to wake up remote CPU */
 #define X86_BUG_AMD_E400                X86_BUG(13) /* CPU is among the affected by Erratum 400 */
+#define X86_BUG_CPU_MELTDOWN            X86_BUG(14) /* CPU is affected by meltdown attack and needs kernel page table isolation */
+#define X86_BUG_SPECTRE_V1              X86_BUG(15) /* CPU is affected by Spectre variant 1 attack with conditional branches */
+#define X86_BUG_SPECTRE_V2              X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */
 
 #endif /* _ASM_X86_CPUFEATURES_H */
diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
index 4011cb03ef08..13c5ee878a47 100644
--- a/arch/x86/include/asm/desc.h
+++ b/arch/x86/include/asm/desc.h
@@ -7,6 +7,7 @@
 #include <asm/mmu.h>
 #include <asm/fixmap.h>
 #include <asm/irq_vectors.h>
+#include <asm/cpu_entry_area.h>
 
 #include <linux/smp.h>
 #include <linux/percpu.h>
@@ -20,6 +21,8 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
 
         desc->type              = (info->read_exec_only ^ 1) << 1;
         desc->type             |= info->contents << 2;
+        /* Set the ACCESS bit so it can be mapped RO */
+        desc->type             |= 1;
 
         desc->s                 = 1;
         desc->dpl               = 0x3;
@@ -60,17 +63,10 @@ static inline struct desc_struct *get_current_gdt_rw(void)
         return this_cpu_ptr(&gdt_page)->gdt;
 }
 
-/* Get the fixmap index for a specific processor */
-static inline unsigned int get_cpu_gdt_ro_index(int cpu)
-{
-        return FIX_GDT_REMAP_BEGIN + cpu;
-}
-
 /* Provide the fixmap address of the remapped GDT */
 static inline struct desc_struct *get_cpu_gdt_ro(int cpu)
 {
-        unsigned int idx = get_cpu_gdt_ro_index(cpu);
-        return (struct desc_struct *)__fix_to_virt(idx);
+        return (struct desc_struct *)&get_cpu_entry_area(cpu)->gdt;
 }
 
 /* Provide the current read-only GDT */
@@ -185,7 +181,7 @@ static inline void set_tssldt_descriptor(void *d, unsigned long addr,
 #endif
 }
 
-static inline void __set_tss_desc(unsigned cpu, unsigned int entry, void *addr)
+static inline void __set_tss_desc(unsigned cpu, unsigned int entry, struct x86_hw_tss *addr)
 {
         struct desc_struct *d = get_cpu_gdt_rw(cpu);
         tss_desc tss;
diff --git a/arch/x86/include/asm/disabled-features.h b/arch/x86/include/asm/disabled-features.h
index 14d6d5007314..b027633e7300 100644
--- a/arch/x86/include/asm/disabled-features.h
+++ b/arch/x86/include/asm/disabled-features.h
@@ -50,6 +50,12 @@
 # define DISABLE_LA57   (1<<(X86_FEATURE_LA57 & 31))
 #endif
 
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+# define DISABLE_PTI            0
+#else
+# define DISABLE_PTI            (1 << (X86_FEATURE_PTI & 31))
+#endif
+
 /*
  * Make sure to add features to the correct mask
  */
@@ -60,7 +66,7 @@
 #define DISABLED_MASK4  (DISABLE_PCID)
 #define DISABLED_MASK5  0
 #define DISABLED_MASK6  0
-#define DISABLED_MASK7  0
+#define DISABLED_MASK7  (DISABLE_PTI)
 #define DISABLED_MASK8  0
 #define DISABLED_MASK9  (DISABLE_MPX)
 #define DISABLED_MASK10 0
diff --git a/arch/x86/include/asm/espfix.h b/arch/x86/include/asm/espfix.h
index 0211029076ea..6777480d8a42 100644
--- a/arch/x86/include/asm/espfix.h
+++ b/arch/x86/include/asm/espfix.h
@@ -2,7 +2,7 @@
 #ifndef _ASM_X86_ESPFIX_H
 #define _ASM_X86_ESPFIX_H
 
-#ifdef CONFIG_X86_64
+#ifdef CONFIG_X86_ESPFIX64
 
 #include <asm/percpu.h>
 
@@ -11,7 +11,8 @@ DECLARE_PER_CPU_READ_MOSTLY(unsigned long, espfix_waddr);
 
 extern void init_espfix_bsp(void);
 extern void init_espfix_ap(int cpu);
-
-#endif /* CONFIG_X86_64 */
+#else
+static inline void init_espfix_ap(int cpu) { }
+#endif
 
 #endif /* _ASM_X86_ESPFIX_H */
diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
index b0c505fe9a95..64c4a30e0d39 100644
--- a/arch/x86/include/asm/fixmap.h
+++ b/arch/x86/include/asm/fixmap.h
@@ -44,7 +44,6 @@ extern unsigned long __FIXADDR_TOP;
                          PAGE_SIZE)
 #endif
 
-
 /*
  * Here we define all the compile-time 'special' virtual
  * addresses. The point is to have a constant address at
@@ -84,7 +83,6 @@ enum fixed_addresses {
         FIX_IO_APIC_BASE_0,
         FIX_IO_APIC_BASE_END = FIX_IO_APIC_BASE_0 + MAX_IO_APICS - 1,
 #endif
-        FIX_RO_IDT,     /* Virtual mapping for read-only IDT */
 #ifdef CONFIG_X86_32
         FIX_KMAP_BEGIN, /* reserved pte's for temporary kernel mappings */
         FIX_KMAP_END = FIX_KMAP_BEGIN+(KM_TYPE_NR*NR_CPUS)-1,
@@ -100,9 +98,6 @@ enum fixed_addresses {
 #ifdef  CONFIG_X86_INTEL_MID
         FIX_LNW_VRTC,
 #endif
-        /* Fixmap entries to remap the GDTs, one per processor. */
-        FIX_GDT_REMAP_BEGIN,
-        FIX_GDT_REMAP_END = FIX_GDT_REMAP_BEGIN + NR_CPUS - 1,
 
 #ifdef CONFIG_ACPI_APEI_GHES
         /* Used for GHES mapping from assorted contexts */
@@ -143,7 +138,7 @@ enum fixed_addresses {
 extern void reserve_top_address(unsigned long reserve);
 
 #define FIXADDR_SIZE    (__end_of_permanent_fixed_addresses << PAGE_SHIFT)
-#define FIXADDR_START           (FIXADDR_TOP - FIXADDR_SIZE)
+#define FIXADDR_START   (FIXADDR_TOP - FIXADDR_SIZE)
 
 extern int fixmaps_set;
 
diff --git a/arch/x86/include/asm/hypervisor.h b/arch/x86/include/asm/hypervisor.h
index 1b0a5abcd8ae..96aa6b9884dc 100644
--- a/arch/x86/include/asm/hypervisor.h
+++ b/arch/x86/include/asm/hypervisor.h
@@ -20,16 +20,7 @@
 #ifndef _ASM_X86_HYPERVISOR_H
 #define _ASM_X86_HYPERVISOR_H
 
-#ifdef CONFIG_HYPERVISOR_GUEST
-
-#include <asm/kvm_para.h>
-#include <asm/x86_init.h>
-#include <asm/xen/hypervisor.h>
-
-/*
- * x86 hypervisor information
- */
-
+/* x86 hypervisor types  */
 enum x86_hypervisor_type {
         X86_HYPER_NATIVE = 0,
         X86_HYPER_VMWARE,
@@ -39,6 +30,12 @@ enum x86_hypervisor_type {
         X86_HYPER_KVM,
 };
 
+#ifdef CONFIG_HYPERVISOR_GUEST
+
+#include <asm/kvm_para.h>
+#include <asm/x86_init.h>
+#include <asm/xen/hypervisor.h>
+
 struct hypervisor_x86 {
         /* Hypervisor name */
         const char      *name;
@@ -58,7 +55,15 @@ struct hypervisor_x86 {
 
 extern enum x86_hypervisor_type x86_hyper_type;
 extern void init_hypervisor_platform(void);
+static inline bool hypervisor_is_type(enum x86_hypervisor_type type)
+{
+        return x86_hyper_type == type;
+}
 #else
 static inline void init_hypervisor_platform(void) { }
+static inline bool hypervisor_is_type(enum x86_hypervisor_type type)
+{
+        return type == X86_HYPER_NATIVE;
+}
 #endif /* CONFIG_HYPERVISOR_GUEST */
 #endif /* _ASM_X86_HYPERVISOR_H */
diff --git a/arch/x86/include/asm/intel_ds.h b/arch/x86/include/asm/intel_ds.h
new file mode 100644
index 000000000000..62a9f4966b42
--- /dev/null
+++ b/arch/x86/include/asm/intel_ds.h
@@ -0,0 +1,36 @@
+#ifndef _ASM_INTEL_DS_H
+#define _ASM_INTEL_DS_H
+
+#include <linux/percpu-defs.h>
+
+#define BTS_BUFFER_SIZE         (PAGE_SIZE << 4)
+#define PEBS_BUFFER_SIZE        (PAGE_SIZE << 4)
+
+/* The maximal number of PEBS events: */
+#define MAX_PEBS_EVENTS         8
+
+/*
+ * A debug store configuration.
+ *
+ * We only support architectures that use 64bit fields.
+ */
+struct debug_store {
+        u64     bts_buffer_base;
+        u64     bts_index;
+        u64     bts_absolute_maximum;
+        u64     bts_interrupt_threshold;
+        u64     pebs_buffer_base;
+        u64     pebs_index;
+        u64     pebs_absolute_maximum;
+        u64     pebs_interrupt_threshold;
+        u64     pebs_event_reset[MAX_PEBS_EVENTS];
+} __aligned(PAGE_SIZE);
+
+DECLARE_PER_CPU_PAGE_ALIGNED(struct debug_store, cpu_debug_store);
+
+struct debug_store_buffers {
+        char    bts_buffer[BTS_BUFFER_SIZE];
+        char    pebs_buffer[PEBS_BUFFER_SIZE];
+};
+
+#endif
diff --git a/arch/x86/include/asm/invpcid.h b/arch/x86/include/asm/invpcid.h
new file mode 100644
index 000000000000..989cfa86de85
--- /dev/null
+++ b/arch/x86/include/asm/invpcid.h
@@ -0,0 +1,53 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_X86_INVPCID
+#define _ASM_X86_INVPCID
+
+static inline void __invpcid(unsigned long pcid, unsigned long addr,
+                             unsigned long type)
+{
+        struct { u64 d[2]; } desc = { { pcid, addr } };
+
+        /*
+         * The memory clobber is because the whole point is to invalidate
+         * stale TLB entries and, especially if we're flushing global
+         * mappings, we don't want the compiler to reorder any subsequent
+         * memory accesses before the TLB flush.
+         *
+         * The hex opcode is invpcid (%ecx), %eax in 32-bit mode and
+         * invpcid (%rcx), %rax in long mode.
+         */
+        asm volatile (".byte 0x66, 0x0f, 0x38, 0x82, 0x01"
+                      : : "m" (desc), "a" (type), "c" (&desc) : "memory");
+}
+
+#define INVPCID_TYPE_INDIV_ADDR         0
+#define INVPCID_TYPE_SINGLE_CTXT        1
+#define INVPCID_TYPE_ALL_INCL_GLOBAL    2
+#define INVPCID_TYPE_ALL_NON_GLOBAL     3
+
+/* Flush all mappings for a given pcid and addr, not including globals. */
+static inline void invpcid_flush_one(unsigned long pcid,
+                                     unsigned long addr)
+{
+        __invpcid(pcid, addr, INVPCID_TYPE_INDIV_ADDR);
+}
+
+/* Flush all mappings for a given PCID, not including globals. */
+static inline void invpcid_flush_single_context(unsigned long pcid)
+{
+        __invpcid(pcid, 0, INVPCID_TYPE_SINGLE_CTXT);
+}
+
+/* Flush all mappings, including globals, for all PCIDs. */
+static inline void invpcid_flush_all(void)
+{
+        __invpcid(0, 0, INVPCID_TYPE_ALL_INCL_GLOBAL);
+}
+
+/* Flush all mappings for all PCIDs except globals. */
+static inline void invpcid_flush_all_nonglobals(void)
+{
+        __invpcid(0, 0, INVPCID_TYPE_ALL_NON_GLOBAL);
+}
+
+#endif /* _ASM_X86_INVPCID */
diff --git a/arch/x86/include/asm/irqdomain.h b/arch/x86/include/asm/irqdomain.h
index 139feef467f7..c066ffae222b 100644
--- a/arch/x86/include/asm/irqdomain.h
+++ b/arch/x86/include/asm/irqdomain.h
@@ -44,7 +44,7 @@ extern int mp_irqdomain_alloc(struct irq_domain *domain, unsigned int virq,
 extern void mp_irqdomain_free(struct irq_domain *domain, unsigned int virq,
                               unsigned int nr_irqs);
 extern int mp_irqdomain_activate(struct irq_domain *domain,
-                                 struct irq_data *irq_data, bool early);
+                                 struct irq_data *irq_data, bool reserve);
 extern void mp_irqdomain_deactivate(struct irq_domain *domain,
                                     struct irq_data *irq_data);
 extern int mp_irqdomain_ioapic_idx(struct irq_domain *domain);
diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
index c8ef23f2c28f..89f08955fff7 100644
--- a/arch/x86/include/asm/irqflags.h
+++ b/arch/x86/include/asm/irqflags.h
@@ -142,6 +142,9 @@ static inline notrace unsigned long arch_local_irq_save(void)
         swapgs;                                 \
         sysretl
 
+#ifdef CONFIG_DEBUG_ENTRY
+#define SAVE_FLAGS(x)           pushfq; popq %rax
+#endif
 #else
 #define INTERRUPT_RETURN                iret
 #define ENABLE_INTERRUPTS_SYSEXIT       sti; sysexit
diff --git a/arch/x86/include/asm/kdebug.h b/arch/x86/include/asm/kdebug.h
index f86a8caa561e..395c9631e000 100644
--- a/arch/x86/include/asm/kdebug.h
+++ b/arch/x86/include/asm/kdebug.h
@@ -26,6 +26,7 @@ extern void die(const char *, struct pt_regs *,long);
 extern int __must_check __die(const char *, struct pt_regs *, long);
 extern void show_stack_regs(struct pt_regs *regs);
 extern void __show_regs(struct pt_regs *regs, int all);
+extern void show_iret_regs(struct pt_regs *regs);
 extern unsigned long oops_begin(void);
 extern void oops_end(unsigned long, struct pt_regs *, int signr);
 
diff --git a/arch/x86/include/asm/kmemcheck.h b/arch/x86/include/asm/kmemcheck.h
deleted file mode 100644
index ea32a7d3cf1b..000000000000
--- a/arch/x86/include/asm/kmemcheck.h
+++ /dev/null
@@ -1 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h
index 034caa1a084e..b24b1c8b3979 100644
--- a/arch/x86/include/asm/kvm_emulate.h
+++ b/arch/x86/include/asm/kvm_emulate.h
@@ -214,8 +214,6 @@ struct x86_emulate_ops {
         void (*halt)(struct x86_emulate_ctxt *ctxt);
         void (*wbinvd)(struct x86_emulate_ctxt *ctxt);
         int (*fix_hypercall)(struct x86_emulate_ctxt *ctxt);
-        void (*get_fpu)(struct x86_emulate_ctxt *ctxt); /* disables preempt */
-        void (*put_fpu)(struct x86_emulate_ctxt *ctxt); /* reenables preempt */
         int (*intercept)(struct x86_emulate_ctxt *ctxt,
                          struct x86_instruction_info *info,
                          enum x86_intercept_stage stage);
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 977de5fb968b..516798431328 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -536,7 +536,20 @@ struct kvm_vcpu_arch {
         struct kvm_mmu_memory_cache mmu_page_cache;
         struct kvm_mmu_memory_cache mmu_page_header_cache;
 
+        /*
+         * QEMU userspace and the guest each have their own FPU state.
+         * In vcpu_run, we switch between the user and guest FPU contexts.
+         * While running a VCPU, the VCPU thread will have the guest FPU
+         * context.
+         *
+         * Note that while the PKRU state lives inside the fpu registers,
+         * it is switched out separately at VMENTER and VMEXIT time. The
+         * "guest_fpu" state here contains the guest FPU context, with the
+         * host PRKU bits.
+         */
+        struct fpu user_fpu;
         struct fpu guest_fpu;
+
         u64 xcr0;
         u64 guest_supported_xcr0;
         u32 guest_xstate_size;
@@ -1435,4 +1448,7 @@ static inline int kvm_cpu_get_apicid(int mps_cpu)
 #define put_smstate(type, buf, offset, val)                      \
         *(type *)((buf) + (offset) - 0x7e00) = val
 
+void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
+                unsigned long start, unsigned long end);
+
 #endif /* _ASM_X86_KVM_HOST_H */
diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h
index c9459a4c3c68..22c5f3e6f820 100644
--- a/arch/x86/include/asm/mem_encrypt.h
+++ b/arch/x86/include/asm/mem_encrypt.h
@@ -39,7 +39,7 @@ void __init sme_unmap_bootdata(char *real_mode_data);
 
 void __init sme_early_init(void);
 
-void __init sme_encrypt_kernel(void);
+void __init sme_encrypt_kernel(struct boot_params *bp);
 void __init sme_enable(struct boot_params *bp);
 
 int __init early_set_memory_decrypted(unsigned long vaddr, unsigned long size);
@@ -67,7 +67,7 @@ static inline void __init sme_unmap_bootdata(char *real_mode_data) { }
 
 static inline void __init sme_early_init(void) { }
 
-static inline void __init sme_encrypt_kernel(void) { }
+static inline void __init sme_encrypt_kernel(struct boot_params *bp) { }
 static inline void __init sme_enable(struct boot_params *bp) { }
 
 static inline bool sme_active(void) { return false; }
diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h
index 9ea26f167497..5ff3e8af2c20 100644
--- a/arch/x86/include/asm/mmu.h
+++ b/arch/x86/include/asm/mmu.h
@@ -3,6 +3,7 @@
 #define _ASM_X86_MMU_H
 
 #include <linux/spinlock.h>
+#include <linux/rwsem.h>
 #include <linux/mutex.h>
 #include <linux/atomic.h>
 
@@ -27,7 +28,8 @@ typedef struct {
         atomic64_t tlb_gen;
 
 #ifdef CONFIG_MODIFY_LDT_SYSCALL
-        struct ldt_struct *ldt;
+        struct rw_semaphore     ldt_usr_sem;
+        struct ldt_struct       *ldt;
 #endif
 
 #ifdef CONFIG_X86_64
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index 6d16d15d09a0..c931b88982a0 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -50,22 +50,53 @@ struct ldt_struct {
          * call gates.  On native, we could merge the ldt_struct and LDT
          * allocations, but it's not worth trying to optimize.
          */
-        struct desc_struct *entries;
-        unsigned int nr_entries;
+        struct desc_struct      *entries;
+        unsigned int            nr_entries;
+
+        /*
+         * If PTI is in use, then the entries array is not mapped while we're
+         * in user mode.  The whole array will be aliased at the addressed
+         * given by ldt_slot_va(slot).  We use two slots so that we can allocate
+         * and map, and enable a new LDT without invalidating the mapping
+         * of an older, still-in-use LDT.
+         *
+         * slot will be -1 if this LDT doesn't have an alias mapping.
+         */
+        int                     slot;
 };
 
+/* This is a multiple of PAGE_SIZE. */
+#define LDT_SLOT_STRIDE (LDT_ENTRIES * LDT_ENTRY_SIZE)
+
+static inline void *ldt_slot_va(int slot)
+{
+#ifdef CONFIG_X86_64
+        return (void *)(LDT_BASE_ADDR + LDT_SLOT_STRIDE * slot);
+#else
+        BUG();
+#endif
+}
+
 /*
  * Used for LDT copy/destruction.
  */
-int init_new_context_ldt(struct task_struct *tsk, struct mm_struct *mm);
+static inline void init_new_context_ldt(struct mm_struct *mm)
+{
+        mm->context.ldt = NULL;
+        init_rwsem(&mm->context.ldt_usr_sem);
+}
+int ldt_dup_context(struct mm_struct *oldmm, struct mm_struct *mm);
 void destroy_context_ldt(struct mm_struct *mm);
+void ldt_arch_exit_mmap(struct mm_struct *mm);
 #else   /* CONFIG_MODIFY_LDT_SYSCALL */
-static inline int init_new_context_ldt(struct task_struct *tsk,
-                                       struct mm_struct *mm)
+static inline void init_new_context_ldt(struct mm_struct *mm) { }
+static inline int ldt_dup_context(struct mm_struct *oldmm,
+                                  struct mm_struct *mm)
 {
         return 0;
 }
-static inline void destroy_context_ldt(struct mm_struct *mm) {}
+static inline void destroy_context_ldt(struct mm_struct *mm) { }
+static inline void ldt_arch_exit_mmap(struct mm_struct *mm) { }
 #endif
 
 static inline void load_mm_ldt(struct mm_struct *mm)
@@ -90,10 +121,31 @@ static inline void load_mm_ldt(struct mm_struct *mm)
          * that we can see.
          */
 
-        if (unlikely(ldt))
-                set_ldt(ldt->entries, ldt->nr_entries);
-        else
+        if (unlikely(ldt)) {
+                if (static_cpu_has(X86_FEATURE_PTI)) {
+                        if (WARN_ON_ONCE((unsigned long)ldt->slot > 1)) {
+                                /*
+                                 * Whoops -- either the new LDT isn't mapped
+                                 * (if slot == -1) or is mapped into a bogus
+                                 * slot (if slot > 1).
+                                 */
+                                clear_LDT();
+                                return;
+                        }
+
+                        /*
+                         * If page table isolation is enabled, ldt->entries
+                         * will not be mapped in the userspace pagetables.
+                         * Tell the CPU to access the LDT through the alias
+                         * at ldt_slot_va(ldt->slot).
+                         */
+                        set_ldt(ldt_slot_va(ldt->slot), ldt->nr_entries);
+                } else {
+                        set_ldt(ldt->entries, ldt->nr_entries);
+                }
+        } else {
                 clear_LDT();
+        }
 #else
         clear_LDT();
 #endif
@@ -132,18 +184,21 @@ void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk);
 static inline int init_new_context(struct task_struct *tsk,
                                    struct mm_struct *mm)
 {
+        mutex_init(&mm->context.lock);
+
         mm->context.ctx_id = atomic64_inc_return(&last_mm_ctx_id);
         atomic64_set(&mm->context.tlb_gen, 0);
 
-        #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
+#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
         if (cpu_feature_enabled(X86_FEATURE_OSPKE)) {
                 /* pkey 0 is the default and always allocated */
                 mm->context.pkey_allocation_map = 0x1;
                 /* -1 means unallocated or invalid */
                 mm->context.execute_only_pkey = -1;
         }
-        #endif
-        return init_new_context_ldt(tsk, mm);
+#endif
+        init_new_context_ldt(mm);
+        return 0;
 }
 static inline void destroy_context(struct mm_struct *mm)
 {
@@ -176,15 +231,16 @@ do {						\
 } while (0)
 #endif
 
-static inline void arch_dup_mmap(struct mm_struct *oldmm,
-                                 struct mm_struct *mm)
+static inline int arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm)
 {
         paravirt_arch_dup_mmap(oldmm, mm);
+        return ldt_dup_context(oldmm, mm);
 }
 
 static inline void arch_exit_mmap(struct mm_struct *mm)
 {
         paravirt_arch_exit_mmap(mm);
+        ldt_arch_exit_mmap(mm);
 }
 
 #ifdef CONFIG_X86_64
@@ -282,33 +338,6 @@ static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
 }
 
 /*
- * If PCID is on, ASID-aware code paths put the ASID+1 into the PCID
- * bits.  This serves two purposes.  It prevents a nasty situation in
- * which PCID-unaware code saves CR3, loads some other value (with PCID
- * == 0), and then restores CR3, thus corrupting the TLB for ASID 0 if
- * the saved ASID was nonzero.  It also means that any bugs involving
- * loading a PCID-enabled CR3 with CR4.PCIDE off will trigger
- * deterministically.
- */
-
-static inline unsigned long build_cr3(struct mm_struct *mm, u16 asid)
-{
-        if (static_cpu_has(X86_FEATURE_PCID)) {
-                VM_WARN_ON_ONCE(asid > 4094);
-                return __sme_pa(mm->pgd) | (asid + 1);
-        } else {
-                VM_WARN_ON_ONCE(asid != 0);
-                return __sme_pa(mm->pgd);
-        }
-}
-
-static inline unsigned long build_cr3_noflush(struct mm_struct *mm, u16 asid)
-{
-        VM_WARN_ON_ONCE(asid > 4094);
-        return __sme_pa(mm->pgd) | (asid + 1) | CR3_NOFLUSH;
-}
-
-/*
  * This can be used from process context to figure out what the value of
  * CR3 is without needing to do a (slow) __read_cr3().
  *
@@ -317,7 +346,7 @@ static inline unsigned long build_cr3_noflush(struct mm_struct *mm, u16 asid)
  */
 static inline unsigned long __get_current_cr3_fast(void)
 {
-        unsigned long cr3 = build_cr3(this_cpu_read(cpu_tlbstate.loaded_mm),
+        unsigned long cr3 = build_cr3(this_cpu_read(cpu_tlbstate.loaded_mm)->pgd,
                 this_cpu_read(cpu_tlbstate.loaded_mm_asid));
 
         /* For now, be very restrictive about when this can be called. */
diff --git a/arch/x86/include/asm/mshyperv.h b/arch/x86/include/asm/mshyperv.h
index 5400add2885b..8bf450b13d9f 100644
--- a/arch/x86/include/asm/mshyperv.h
+++ b/arch/x86/include/asm/mshyperv.h
@@ -7,6 +7,7 @@
 #include <linux/nmi.h>
 #include <asm/io.h>
 #include <asm/hyperv.h>
+#include <asm/nospec-branch.h>
 
 /*
  * The below CPUID leaves are present if VersionAndFeatures.HypervisorPresent
@@ -186,10 +187,11 @@ static inline u64 hv_do_hypercall(u64 control, void *input, void *output)
                 return U64_MAX;
 
         __asm__ __volatile__("mov %4, %%r8\n"
-                             "call *%5"
+                             CALL_NOSPEC
                              : "=a" (hv_status), ASM_CALL_CONSTRAINT,
                                "+c" (control), "+d" (input_address)
-                             :  "r" (output_address), "m" (hv_hypercall_pg)
+                             :  "r" (output_address),
+                                THUNK_TARGET(hv_hypercall_pg)
                              : "cc", "memory", "r8", "r9", "r10", "r11");
 #else
         u32 input_address_hi = upper_32_bits(input_address);
@@ -200,13 +202,13 @@ static inline u64 hv_do_hypercall(u64 control, void *input, void *output)
         if (!hv_hypercall_pg)
                 return U64_MAX;
 
-        __asm__ __volatile__("call *%7"
+        __asm__ __volatile__(CALL_NOSPEC
                              : "=A" (hv_status),
                                "+c" (input_address_lo), ASM_CALL_CONSTRAINT
                              : "A" (control),
                                "b" (input_address_hi),
                                "D"(output_address_hi), "S"(output_address_lo),
-                               "m" (hv_hypercall_pg)
+                               THUNK_TARGET(hv_hypercall_pg)
                              : "cc", "memory");
 #endif /* !x86_64 */
         return hv_status;
@@ -227,10 +229,10 @@ static inline u64 hv_do_fast_hypercall8(u16 code, u64 input1)
 
 #ifdef CONFIG_X86_64
         {
-                __asm__ __volatile__("call *%4"
+                __asm__ __volatile__(CALL_NOSPEC
                                      : "=a" (hv_status), ASM_CALL_CONSTRAINT,
                                        "+c" (control), "+d" (input1)
-                                     : "m" (hv_hypercall_pg)
+                                     : THUNK_TARGET(hv_hypercall_pg)
                                      : "cc", "r8", "r9", "r10", "r11");
         }
 #else
@@ -238,13 +240,13 @@ static inline u64 hv_do_fast_hypercall8(u16 code, u64 input1)
                 u32 input1_hi = upper_32_bits(input1);
                 u32 input1_lo = lower_32_bits(input1);
 
-                __asm__ __volatile__ ("call *%5"
+                __asm__ __volatile__ (CALL_NOSPEC
                                       : "=A"(hv_status),
                                         "+c"(input1_lo),
                                         ASM_CALL_CONSTRAINT
                                       : "A" (control),
                                         "b" (input1_hi),
-                                        "m" (hv_hypercall_pg)
+                                        THUNK_TARGET(hv_hypercall_pg)
                                       : "cc", "edi", "esi");
         }
 #endif
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 34c4922bbc3f..e7b983a35506 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -355,6 +355,9 @@
 #define FAM10H_MMIO_CONF_BASE_MASK      0xfffffffULL
 #define FAM10H_MMIO_CONF_BASE_SHIFT     20
 #define MSR_FAM10H_NODE_ID              0xc001100c
+#define MSR_F10H_DECFG                  0xc0011029
+#define MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT     1
+#define MSR_F10H_DECFG_LFENCE_SERIALIZE         BIT_ULL(MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT)
 
 /* K8 MSRs */
 #define MSR_K8_TOP_MEM1                 0xc001001a
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
new file mode 100644
index 000000000000..4ad41087ce0e
--- /dev/null
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -0,0 +1,222 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifndef __NOSPEC_BRANCH_H__
+#define __NOSPEC_BRANCH_H__
+
+#include <asm/alternative.h>
+#include <asm/alternative-asm.h>
+#include <asm/cpufeatures.h>
+
+/*
+ * Fill the CPU return stack buffer.
+ *
+ * Each entry in the RSB, if used for a speculative 'ret', contains an
+ * infinite 'pause; lfence; jmp' loop to capture speculative execution.
+ *
+ * This is required in various cases for retpoline and IBRS-based
+ * mitigations for the Spectre variant 2 vulnerability. Sometimes to
+ * eliminate potentially bogus entries from the RSB, and sometimes
+ * purely to ensure that it doesn't get empty, which on some CPUs would
+ * allow predictions from other (unwanted!) sources to be used.
+ *
+ * We define a CPP macro such that it can be used from both .S files and
+ * inline assembly. It's possible to do a .macro and then include that
+ * from C via asm(".include <asm/nospec-branch.h>") but let's not go there.
+ */
+
+#define RSB_CLEAR_LOOPS         32      /* To forcibly overwrite all entries */
+#define RSB_FILL_LOOPS          16      /* To avoid underflow */
+
+/*
+ * Google experimented with loop-unrolling and this turned out to be
+ * the optimal version — two calls, each with their own speculation
+ * trap should their return address end up getting used, in a loop.
+ */
+#define __FILL_RETURN_BUFFER(reg, nr, sp)       \
+        mov     $(nr/2), reg;                   \
+771:                                            \
+        call    772f;                           \
+773:    /* speculation trap */                  \
+        pause;                                  \
+        lfence;                                 \
+        jmp     773b;                           \
+772:                                            \
+        call    774f;                           \
+775:    /* speculation trap */                  \
+        pause;                                  \
+        lfence;                                 \
+        jmp     775b;                           \
+774:                                            \
+        dec     reg;                            \
+        jnz     771b;                           \
+        add     $(BITS_PER_LONG/8) * nr, sp;
+
+#ifdef __ASSEMBLY__
+
+/*
+ * This should be used immediately before a retpoline alternative.  It tells
+ * objtool where the retpolines are so that it can make sense of the control
+ * flow by just reading the original instruction(s) and ignoring the
+ * alternatives.
+ */
+.macro ANNOTATE_NOSPEC_ALTERNATIVE
+        .Lannotate_\@:
+        .pushsection .discard.nospec
+        .long .Lannotate_\@ - .
+        .popsection
+.endm
+
+/*
+ * These are the bare retpoline primitives for indirect jmp and call.
+ * Do not use these directly; they only exist to make the ALTERNATIVE
+ * invocation below less ugly.
+ */
+.macro RETPOLINE_JMP reg:req
+        call    .Ldo_rop_\@
+.Lspec_trap_\@:
+        pause
+        lfence
+        jmp     .Lspec_trap_\@
+.Ldo_rop_\@:
+        mov     \reg, (%_ASM_SP)
+        ret
+.endm
+
+/*
+ * This is a wrapper around RETPOLINE_JMP so the called function in reg
+ * returns to the instruction after the macro.
+ */
+.macro RETPOLINE_CALL reg:req
+        jmp     .Ldo_call_\@
+.Ldo_retpoline_jmp_\@:
+        RETPOLINE_JMP \reg
+.Ldo_call_\@:
+        call    .Ldo_retpoline_jmp_\@
+.endm
+
+/*
+ * JMP_NOSPEC and CALL_NOSPEC macros can be used instead of a simple
+ * indirect jmp/call which may be susceptible to the Spectre variant 2
+ * attack.
+ */
+.macro JMP_NOSPEC reg:req
+#ifdef CONFIG_RETPOLINE
+        ANNOTATE_NOSPEC_ALTERNATIVE
+        ALTERNATIVE_2 __stringify(jmp *\reg),                           \
+                __stringify(RETPOLINE_JMP \reg), X86_FEATURE_RETPOLINE, \
+                __stringify(lfence; jmp *\reg), X86_FEATURE_RETPOLINE_AMD
+#else
+        jmp     *\reg
+#endif
+.endm
+
+.macro CALL_NOSPEC reg:req
+#ifdef CONFIG_RETPOLINE
+        ANNOTATE_NOSPEC_ALTERNATIVE
+        ALTERNATIVE_2 __stringify(call *\reg),                          \
+                __stringify(RETPOLINE_CALL \reg), X86_FEATURE_RETPOLINE,\
+                __stringify(lfence; call *\reg), X86_FEATURE_RETPOLINE_AMD
+#else
+        call    *\reg
+#endif
+.endm
+
+ /*
+  * A simpler FILL_RETURN_BUFFER macro. Don't make people use the CPP
+  * monstrosity above, manually.
+  */
+.macro FILL_RETURN_BUFFER reg:req nr:req ftr:req
+#ifdef CONFIG_RETPOLINE
+        ANNOTATE_NOSPEC_ALTERNATIVE
+        ALTERNATIVE "jmp .Lskip_rsb_\@",                                \
+                __stringify(__FILL_RETURN_BUFFER(\reg,\nr,%_ASM_SP))    \
+                \ftr
+.Lskip_rsb_\@:
+#endif
+.endm
+
+#else /* __ASSEMBLY__ */
+
+#define ANNOTATE_NOSPEC_ALTERNATIVE                             \
+        "999:\n\t"                                              \
+        ".pushsection .discard.nospec\n\t"                      \
+        ".long 999b - .\n\t"                                    \
+        ".popsection\n\t"
+
+#if defined(CONFIG_X86_64) && defined(RETPOLINE)
+
+/*
+ * Since the inline asm uses the %V modifier which is only in newer GCC,
+ * the 64-bit one is dependent on RETPOLINE not CONFIG_RETPOLINE.
+ */
+# define CALL_NOSPEC                                            \
+        ANNOTATE_NOSPEC_ALTERNATIVE                             \
+        ALTERNATIVE(                                            \
+        "call *%[thunk_target]\n",                              \
+        "call __x86_indirect_thunk_%V[thunk_target]\n",         \
+        X86_FEATURE_RETPOLINE)
+# define THUNK_TARGET(addr) [thunk_target] "r" (addr)
+
+#elif defined(CONFIG_X86_32) && defined(CONFIG_RETPOLINE)
+/*
+ * For i386 we use the original ret-equivalent retpoline, because
+ * otherwise we'll run out of registers. We don't care about CET
+ * here, anyway.
+ */
+# define CALL_NOSPEC ALTERNATIVE("call *%[thunk_target]\n",     \
+        "       jmp    904f;\n"                                 \
+        "       .align 16\n"                                    \
+        "901:   call   903f;\n"                                 \
+        "902:   pause;\n"                                       \
+        "       lfence;\n"                                      \
+        "       jmp    902b;\n"                                 \
+        "       .align 16\n"                                    \
+        "903:   addl   $4, %%esp;\n"                            \
+        "       pushl  %[thunk_target];\n"                      \
+        "       ret;\n"                                         \
+        "       .align 16\n"                                    \
+        "904:   call   901b;\n",                                \
+        X86_FEATURE_RETPOLINE)
+
+# define THUNK_TARGET(addr) [thunk_target] "rm" (addr)
+#else /* No retpoline for C / inline asm */
+# define CALL_NOSPEC "call *%[thunk_target]\n"
+# define THUNK_TARGET(addr) [thunk_target] "rm" (addr)
+#endif
+
+/* The Spectre V2 mitigation variants */
+enum spectre_v2_mitigation {
+        SPECTRE_V2_NONE,
+        SPECTRE_V2_RETPOLINE_MINIMAL,
+        SPECTRE_V2_RETPOLINE_MINIMAL_AMD,
+        SPECTRE_V2_RETPOLINE_GENERIC,
+        SPECTRE_V2_RETPOLINE_AMD,
+        SPECTRE_V2_IBRS,
+};
+
+extern char __indirect_thunk_start[];
+extern char __indirect_thunk_end[];
+
+/*
+ * On VMEXIT we must ensure that no RSB predictions learned in the guest
+ * can be followed in the host, by overwriting the RSB completely. Both
+ * retpoline and IBRS mitigations for Spectre v2 need this; only on future
+ * CPUs with IBRS_ATT *might* it be avoided.
+ */
+static inline void vmexit_fill_RSB(void)
+{
+#ifdef CONFIG_RETPOLINE
+        unsigned long loops;
+
+        asm volatile (ANNOTATE_NOSPEC_ALTERNATIVE
+                      ALTERNATIVE("jmp 910f",
+                                  __stringify(__FILL_RETURN_BUFFER(%0, RSB_CLEAR_LOOPS, %1)),
+                                  X86_FEATURE_RETPOLINE)
+                      "910:"
+                      : "=r" (loops), ASM_CALL_CONSTRAINT
+                      : : "memory" );
+#endif
+}
+
+#endif /* __ASSEMBLY__ */
+#endif /* __NOSPEC_BRANCH_H__ */
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index 283efcaac8af..892df375b615 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -927,6 +927,15 @@ extern void default_banner(void);
         PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_usergs_sysret64),       \
                   CLBR_NONE,                                            \
                   jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_usergs_sysret64))
+
+#ifdef CONFIG_DEBUG_ENTRY
+#define SAVE_FLAGS(clobbers)                                        \
+        PARA_SITE(PARA_PATCH(pv_irq_ops, PV_IRQ_save_fl), clobbers, \
+                  PV_SAVE_REGS(clobbers | CLBR_CALLEE_SAVE);        \
+                  call PARA_INDIRECT(pv_irq_ops+PV_IRQ_save_fl);    \
+                  PV_RESTORE_REGS(clobbers | CLBR_CALLEE_SAVE);)
+#endif
+
 #endif  /* CONFIG_X86_32 */
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/x86/include/asm/pci_x86.h b/arch/x86/include/asm/pci_x86.h
index 7a5d6695abd3..eb66fa9cd0fc 100644
--- a/arch/x86/include/asm/pci_x86.h
+++ b/arch/x86/include/asm/pci_x86.h
@@ -38,6 +38,7 @@ do {						\
 #define PCI_NOASSIGN_ROMS       0x80000
 #define PCI_ROOT_NO_CRS         0x100000
 #define PCI_NOASSIGN_BARS       0x200000
+#define PCI_BIG_ROOT_WINDOW     0x400000
 
 extern unsigned int pci_probe;
 extern unsigned long pirq_table_addr;
diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
index 4b5e1eafada7..aff42e1da6ee 100644
--- a/arch/x86/include/asm/pgalloc.h
+++ b/arch/x86/include/asm/pgalloc.h
@@ -30,6 +30,17 @@ static inline void paravirt_release_p4d(unsigned long pfn) {}
  */
 extern gfp_t __userpte_alloc_gfp;
 
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+/*
+ * Instead of one PGD, we acquire two PGDs.  Being order-1, it is
+ * both 8k in size and 8k-aligned.  That lets us just flip bit 12
+ * in a pointer to swap between the two 4k halves.
+ */
+#define PGD_ALLOCATION_ORDER 1
+#else
+#define PGD_ALLOCATION_ORDER 0
+#endif
+
 /*
  * Allocate and free page tables.
  */
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 95e2dfd75521..e42b8943cb1a 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -28,6 +28,7 @@ extern pgd_t early_top_pgt[PTRS_PER_PGD];
 int __init __early_make_pgtable(unsigned long address, pmdval_t pmd);
 
 void ptdump_walk_pgd_level(struct seq_file *m, pgd_t *pgd);
+void ptdump_walk_pgd_level_debugfs(struct seq_file *m, pgd_t *pgd, bool user);
 void ptdump_walk_pgd_level_checkwx(void);
 
 #ifdef CONFIG_DEBUG_WX
@@ -841,7 +842,12 @@ static inline pud_t *pud_offset(p4d_t *p4d, unsigned long address)
 
 static inline int p4d_bad(p4d_t p4d)
 {
-        return (p4d_flags(p4d) & ~(_KERNPG_TABLE | _PAGE_USER)) != 0;
+        unsigned long ignore_flags = _KERNPG_TABLE | _PAGE_USER;
+
+        if (IS_ENABLED(CONFIG_PAGE_TABLE_ISOLATION))
+                ignore_flags |= _PAGE_NX;
+
+        return (p4d_flags(p4d) & ~ignore_flags) != 0;
 }
 #endif  /* CONFIG_PGTABLE_LEVELS > 3 */
 
@@ -875,7 +881,12 @@ static inline p4d_t *p4d_offset(pgd_t *pgd, unsigned long address)
 
 static inline int pgd_bad(pgd_t pgd)
 {
-        return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
+        unsigned long ignore_flags = _PAGE_USER;
+
+        if (IS_ENABLED(CONFIG_PAGE_TABLE_ISOLATION))
+                ignore_flags |= _PAGE_NX;
+
+        return (pgd_flags(pgd) & ~ignore_flags) != _KERNPG_TABLE;
 }
 
 static inline int pgd_none(pgd_t pgd)
@@ -904,7 +915,11 @@ static inline int pgd_none(pgd_t pgd)
  * pgd_offset() returns a (pgd_t *)
  * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
  */
-#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
+#define pgd_offset_pgd(pgd, address) (pgd + pgd_index((address)))
+/*
+ * a shortcut to get a pgd_t in a given mm
+ */
+#define pgd_offset(mm, address) pgd_offset_pgd((mm)->pgd, (address))
 /*
  * a shortcut which implies the use of the kernel's pgd, instead
  * of a process's
@@ -1106,7 +1121,14 @@ static inline int pud_write(pud_t pud)
  */
 static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
 {
-       memcpy(dst, src, count * sizeof(pgd_t));
+        memcpy(dst, src, count * sizeof(pgd_t));
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+        if (!static_cpu_has(X86_FEATURE_PTI))
+                return;
+        /* Clone the user space pgd as well */
+        memcpy(kernel_to_user_pgdp(dst), kernel_to_user_pgdp(src),
+               count * sizeof(pgd_t));
+#endif
 }
 
 #define PTE_SHIFT ilog2(PTRS_PER_PTE)
diff --git a/arch/x86/include/asm/pgtable_32_types.h b/arch/x86/include/asm/pgtable_32_types.h
index f2ca9b28fd68..ce245b0cdfca 100644
--- a/arch/x86/include/asm/pgtable_32_types.h
+++ b/arch/x86/include/asm/pgtable_32_types.h
@@ -38,13 +38,22 @@ extern bool __vmalloc_start_set; /* set once high_memory is set */
 #define LAST_PKMAP 1024
 #endif
 
-#define PKMAP_BASE ((FIXADDR_START - PAGE_SIZE * (LAST_PKMAP + 1))      \
-                    & PMD_MASK)
+/*
+ * Define this here and validate with BUILD_BUG_ON() in pgtable_32.c
+ * to avoid include recursion hell
+ */
+#define CPU_ENTRY_AREA_PAGES    (NR_CPUS * 40)
+
+#define CPU_ENTRY_AREA_BASE                             \
+        ((FIXADDR_START - PAGE_SIZE * (CPU_ENTRY_AREA_PAGES + 1)) & PMD_MASK)
+
+#define PKMAP_BASE              \
+        ((CPU_ENTRY_AREA_BASE - PAGE_SIZE) & PMD_MASK)
 
 #ifdef CONFIG_HIGHMEM
 # define VMALLOC_END    (PKMAP_BASE - 2 * PAGE_SIZE)
 #else
-# define VMALLOC_END    (FIXADDR_START - 2 * PAGE_SIZE)
+# define VMALLOC_END    (CPU_ENTRY_AREA_BASE - 2 * PAGE_SIZE)
 #endif
 
 #define MODULES_VADDR   VMALLOC_START
diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
index e9f05331e732..81462e9a34f6 100644
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -131,9 +131,97 @@ static inline pud_t native_pudp_get_and_clear(pud_t *xp)
 #endif
 }
 
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+/*
+ * All top-level PAGE_TABLE_ISOLATION page tables are order-1 pages
+ * (8k-aligned and 8k in size).  The kernel one is at the beginning 4k and
+ * the user one is in the last 4k.  To switch between them, you
+ * just need to flip the 12th bit in their addresses.
+ */
+#define PTI_PGTABLE_SWITCH_BIT  PAGE_SHIFT
+
+/*
+ * This generates better code than the inline assembly in
+ * __set_bit().
+ */
+static inline void *ptr_set_bit(void *ptr, int bit)
+{
+        unsigned long __ptr = (unsigned long)ptr;
+
+        __ptr |= BIT(bit);
+        return (void *)__ptr;
+}
+static inline void *ptr_clear_bit(void *ptr, int bit)
+{
+        unsigned long __ptr = (unsigned long)ptr;
+
+        __ptr &= ~BIT(bit);
+        return (void *)__ptr;
+}
+
+static inline pgd_t *kernel_to_user_pgdp(pgd_t *pgdp)
+{
+        return ptr_set_bit(pgdp, PTI_PGTABLE_SWITCH_BIT);
+}
+
+static inline pgd_t *user_to_kernel_pgdp(pgd_t *pgdp)
+{
+        return ptr_clear_bit(pgdp, PTI_PGTABLE_SWITCH_BIT);
+}
+
+static inline p4d_t *kernel_to_user_p4dp(p4d_t *p4dp)
+{
+        return ptr_set_bit(p4dp, PTI_PGTABLE_SWITCH_BIT);
+}
+
+static inline p4d_t *user_to_kernel_p4dp(p4d_t *p4dp)
+{
+        return ptr_clear_bit(p4dp, PTI_PGTABLE_SWITCH_BIT);
+}
+#endif /* CONFIG_PAGE_TABLE_ISOLATION */
+
+/*
+ * Page table pages are page-aligned.  The lower half of the top
+ * level is used for userspace and the top half for the kernel.
+ *
+ * Returns true for parts of the PGD that map userspace and
+ * false for the parts that map the kernel.
+ */
+static inline bool pgdp_maps_userspace(void *__ptr)
+{
+        unsigned long ptr = (unsigned long)__ptr;
+
+        return (ptr & ~PAGE_MASK) < (PAGE_SIZE / 2);
+}
+
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+pgd_t __pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd);
+
+/*
+ * Take a PGD location (pgdp) and a pgd value that needs to be set there.
+ * Populates the user and returns the resulting PGD that must be set in
+ * the kernel copy of the page tables.
+ */
+static inline pgd_t pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd)
+{
+        if (!static_cpu_has(X86_FEATURE_PTI))
+                return pgd;
+        return __pti_set_user_pgd(pgdp, pgd);
+}
+#else
+static inline pgd_t pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd)
+{
+        return pgd;
+}
+#endif
+
 static inline void native_set_p4d(p4d_t *p4dp, p4d_t p4d)
 {
+#if defined(CONFIG_PAGE_TABLE_ISOLATION) && !defined(CONFIG_X86_5LEVEL)
+        p4dp->pgd = pti_set_user_pgd(&p4dp->pgd, p4d.pgd);
+#else
         *p4dp = p4d;
+#endif
 }
 
 static inline void native_p4d_clear(p4d_t *p4d)
@@ -147,7 +235,11 @@ static inline void native_p4d_clear(p4d_t *p4d)
 
 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
 {
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+        *pgdp = pti_set_user_pgd(pgdp, pgd);
+#else
         *pgdp = pgd;
+#endif
 }
 
 static inline void native_pgd_clear(pgd_t *pgd)
diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
index 6d5f45dcd4a1..6b8f73dcbc2c 100644
--- a/arch/x86/include/asm/pgtable_64_types.h
+++ b/arch/x86/include/asm/pgtable_64_types.h
@@ -75,33 +75,52 @@ typedef struct { pteval_t pte; } pte_t;
 #define PGDIR_SIZE      (_AC(1, UL) << PGDIR_SHIFT)
 #define PGDIR_MASK      (~(PGDIR_SIZE - 1))
 
-/* See Documentation/x86/x86_64/mm.txt for a description of the memory map. */
-#define MAXMEM          _AC(__AC(1, UL) << MAX_PHYSMEM_BITS, UL)
+/*
+ * See Documentation/x86/x86_64/mm.txt for a description of the memory map.
+ *
+ * Be very careful vs. KASLR when changing anything here. The KASLR address
+ * range must not overlap with anything except the KASAN shadow area, which
+ * is correct as KASAN disables KASLR.
+ */
+#define MAXMEM                  _AC(__AC(1, UL) << MAX_PHYSMEM_BITS, UL)
+
 #ifdef CONFIG_X86_5LEVEL
-#define VMALLOC_SIZE_TB _AC(16384, UL)
-#define __VMALLOC_BASE  _AC(0xff92000000000000, UL)
-#define __VMEMMAP_BASE  _AC(0xffd4000000000000, UL)
+# define VMALLOC_SIZE_TB        _AC(12800, UL)
+# define __VMALLOC_BASE         _AC(0xffa0000000000000, UL)
+# define __VMEMMAP_BASE         _AC(0xffd4000000000000, UL)
+# define LDT_PGD_ENTRY          _AC(-112, UL)
+# define LDT_BASE_ADDR          (LDT_PGD_ENTRY << PGDIR_SHIFT)
 #else
-#define VMALLOC_SIZE_TB _AC(32, UL)
-#define __VMALLOC_BASE  _AC(0xffffc90000000000, UL)
-#define __VMEMMAP_BASE  _AC(0xffffea0000000000, UL)
+# define VMALLOC_SIZE_TB        _AC(32, UL)
+# define __VMALLOC_BASE         _AC(0xffffc90000000000, UL)
+# define __VMEMMAP_BASE         _AC(0xffffea0000000000, UL)
+# define LDT_PGD_ENTRY          _AC(-3, UL)
+# define LDT_BASE_ADDR          (LDT_PGD_ENTRY << PGDIR_SHIFT)
 #endif
+
 #ifdef CONFIG_RANDOMIZE_MEMORY
-#define VMALLOC_START   vmalloc_base
-#define VMEMMAP_START   vmemmap_base
+# define VMALLOC_START          vmalloc_base
+# define VMEMMAP_START          vmemmap_base
 #else
-#define VMALLOC_START   __VMALLOC_BASE
-#define VMEMMAP_START   __VMEMMAP_BASE
+# define VMALLOC_START          __VMALLOC_BASE
+# define VMEMMAP_START          __VMEMMAP_BASE
 #endif /* CONFIG_RANDOMIZE_MEMORY */
-#define VMALLOC_END     (VMALLOC_START + _AC((VMALLOC_SIZE_TB << 40) - 1, UL))
-#define MODULES_VADDR    (__START_KERNEL_map + KERNEL_IMAGE_SIZE)
+
+#define VMALLOC_END             (VMALLOC_START + _AC((VMALLOC_SIZE_TB << 40) - 1, UL))
+
+#define MODULES_VADDR           (__START_KERNEL_map + KERNEL_IMAGE_SIZE)
 /* The module sections ends with the start of the fixmap */
-#define MODULES_END   __fix_to_virt(__end_of_fixed_addresses + 1)
-#define MODULES_LEN   (MODULES_END - MODULES_VADDR)
-#define ESPFIX_PGD_ENTRY _AC(-2, UL)
-#define ESPFIX_BASE_ADDR (ESPFIX_PGD_ENTRY << P4D_SHIFT)
-#define EFI_VA_START     ( -4 * (_AC(1, UL) << 30))
-#define EFI_VA_END       (-68 * (_AC(1, UL) << 30))
+#define MODULES_END             _AC(0xffffffffff000000, UL)
+#define MODULES_LEN             (MODULES_END - MODULES_VADDR)
+
+#define ESPFIX_PGD_ENTRY        _AC(-2, UL)
+#define ESPFIX_BASE_ADDR        (ESPFIX_PGD_ENTRY << P4D_SHIFT)
+
+#define CPU_ENTRY_AREA_PGD      _AC(-4, UL)
+#define CPU_ENTRY_AREA_BASE     (CPU_ENTRY_AREA_PGD << P4D_SHIFT)
+
+#define EFI_VA_START            ( -4 * (_AC(1, UL) << 30))
+#define EFI_VA_END              (-68 * (_AC(1, UL) << 30))
 
 #define EARLY_DYNAMIC_PAGE_TABLES       64
 
diff --git a/arch/x86/include/asm/processor-flags.h b/arch/x86/include/asm/processor-flags.h
index 43212a43ee69..625a52a5594f 100644
--- a/arch/x86/include/asm/processor-flags.h
+++ b/arch/x86/include/asm/processor-flags.h
@@ -38,6 +38,11 @@
 #define CR3_ADDR_MASK   __sme_clr(0x7FFFFFFFFFFFF000ull)
 #define CR3_PCID_MASK   0xFFFull
 #define CR3_NOFLUSH     BIT_ULL(63)
+
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+# define X86_CR3_PTI_PCID_USER_BIT      11
+#endif
+
 #else
 /*
  * CR3_ADDR_MASK needs at least bits 31:5 set on PAE systems, and we save
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index cc16fa882e3e..d3a67fba200a 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -163,9 +163,9 @@ enum cpuid_regs_idx {
 extern struct cpuinfo_x86       boot_cpu_data;
 extern struct cpuinfo_x86       new_cpu_data;
 
-extern struct tss_struct        doublefault_tss;
-extern __u32                    cpu_caps_cleared[NCAPINTS];
-extern __u32                    cpu_caps_set[NCAPINTS];
+extern struct x86_hw_tss        doublefault_tss;
+extern __u32                    cpu_caps_cleared[NCAPINTS + NBUGINTS];
+extern __u32                    cpu_caps_set[NCAPINTS + NBUGINTS];
 
 #ifdef CONFIG_SMP
 DECLARE_PER_CPU_READ_MOSTLY(struct cpuinfo_x86, cpu_info);
@@ -253,6 +253,11 @@ static inline void load_cr3(pgd_t *pgdir)
         write_cr3(__sme_pa(pgdir));
 }
 
+/*
+ * Note that while the legacy 'TSS' name comes from 'Task State Segment',
+ * on modern x86 CPUs the TSS also holds information important to 64-bit mode,
+ * unrelated to the task-switch mechanism:
+ */
 #ifdef CONFIG_X86_32
 /* This is the TSS defined by the hardware. */
 struct x86_hw_tss {
@@ -305,7 +310,13 @@ struct x86_hw_tss {
 struct x86_hw_tss {
         u32                     reserved1;
         u64                     sp0;
+
+        /*
+         * We store cpu_current_top_of_stack in sp1 so it's always accessible.
+         * Linux does not use ring 1, so sp1 is not otherwise needed.
+         */
         u64                     sp1;
+
         u64                     sp2;
         u64                     reserved2;
         u64                     ist[7];
@@ -323,12 +334,22 @@ struct x86_hw_tss {
 #define IO_BITMAP_BITS                  65536
 #define IO_BITMAP_BYTES                 (IO_BITMAP_BITS/8)
 #define IO_BITMAP_LONGS                 (IO_BITMAP_BYTES/sizeof(long))
-#define IO_BITMAP_OFFSET                offsetof(struct tss_struct, io_bitmap)
+#define IO_BITMAP_OFFSET                (offsetof(struct tss_struct, io_bitmap) - offsetof(struct tss_struct, x86_tss))
 #define INVALID_IO_BITMAP_OFFSET        0x8000
 
+struct entry_stack {
+        unsigned long           words[64];
+};
+
+struct entry_stack_page {
+        struct entry_stack stack;
+} __aligned(PAGE_SIZE);
+
 struct tss_struct {
         /*
-         * The hardware state:
+         * The fixed hardware portion.  This must not cross a page boundary
+         * at risk of violating the SDM's advice and potentially triggering
+         * errata.
          */
         struct x86_hw_tss       x86_tss;
 
@@ -339,18 +360,9 @@ struct tss_struct {
          * be within the limit.
          */
         unsigned long           io_bitmap[IO_BITMAP_LONGS + 1];
+} __aligned(PAGE_SIZE);
 
-#ifdef CONFIG_X86_32
-        /*
-         * Space for the temporary SYSENTER stack.
-         */
-        unsigned long           SYSENTER_stack_canary;
-        unsigned long           SYSENTER_stack[64];
-#endif
-
-} ____cacheline_aligned;
-
-DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, cpu_tss);
+DECLARE_PER_CPU_PAGE_ALIGNED(struct tss_struct, cpu_tss_rw);
 
 /*
  * sizeof(unsigned long) coming from an extra "long" at the end
@@ -364,6 +376,9 @@ DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, cpu_tss);
 
 #ifdef CONFIG_X86_32
 DECLARE_PER_CPU(unsigned long, cpu_current_top_of_stack);
+#else
+/* The RO copy can't be accessed with this_cpu_xyz(), so use the RW copy. */
+#define cpu_current_top_of_stack cpu_tss_rw.x86_tss.sp1
 #endif
 
 /*
@@ -523,7 +538,7 @@ static inline void native_set_iopl_mask(unsigned mask)
 static inline void
 native_load_sp0(unsigned long sp0)
 {
-        this_cpu_write(cpu_tss.x86_tss.sp0, sp0);
+        this_cpu_write(cpu_tss_rw.x86_tss.sp0, sp0);
 }
 
 static inline void native_swapgs(void)
@@ -535,12 +550,12 @@ static inline void native_swapgs(void)
 
 static inline unsigned long current_top_of_stack(void)
 {
-#ifdef CONFIG_X86_64
-        return this_cpu_read_stable(cpu_tss.x86_tss.sp0);
-#else
-        /* sp0 on x86_32 is special in and around vm86 mode. */
+        /*
+         *  We can't read directly from tss.sp0: sp0 on x86_32 is special in
+         *  and around vm86 mode and sp0 on x86_64 is special because of the
+         *  entry trampoline.
+         */
         return this_cpu_read_stable(cpu_current_top_of_stack);
-#endif
 }
 
 static inline bool on_thread_stack(void)
@@ -837,13 +852,22 @@ static inline void spin_lock_prefetch(const void *x)
 
 #else
 /*
- * User space process size. 47bits minus one guard page.  The guard
- * page is necessary on Intel CPUs: if a SYSCALL instruction is at
- * the highest possible canonical userspace address, then that
- * syscall will enter the kernel with a non-canonical return
- * address, and SYSRET will explode dangerously.  We avoid this
- * particular problem by preventing anything from being mapped
- * at the maximum canonical address.
+ * User space process size.  This is the first address outside the user range.
+ * There are a few constraints that determine this:
+ *
+ * On Intel CPUs, if a SYSCALL instruction is at the highest canonical
+ * address, then that syscall will enter the kernel with a
+ * non-canonical return address, and SYSRET will explode dangerously.
+ * We avoid this particular problem by preventing anything executable
+ * from being mapped at the maximum canonical address.
+ *
+ * On AMD CPUs in the Ryzen family, there's a nasty bug in which the
+ * CPUs malfunction if they execute code from the highest canonical page.
+ * They'll speculate right off the end of the canonical space, and
+ * bad things happen.  This is worked around in the same way as the
+ * Intel problem.
+ *
+ * With page table isolation enabled, we map the LDT in ... [stay tuned]
  */
 #define TASK_SIZE_MAX   ((1UL << __VIRTUAL_MASK_SHIFT) - PAGE_SIZE)
 
diff --git a/arch/x86/include/asm/pti.h b/arch/x86/include/asm/pti.h
new file mode 100644
index 000000000000..0b5ef05b2d2d
--- /dev/null
+++ b/arch/x86/include/asm/pti.h
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: GPL-2.0
+#ifndef _ASM_X86_PTI_H
+#define _ASM_X86_PTI_H
+#ifndef __ASSEMBLY__
+
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+extern void pti_init(void);
+extern void pti_check_boottime_disable(void);
+#else
+static inline void pti_check_boottime_disable(void) { }
+#endif
+
+#endif /* __ASSEMBLY__ */
+#endif /* _ASM_X86_PTI_H */
diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
index b20f9d623f9c..8f09012b92e7 100644
--- a/arch/x86/include/asm/segment.h
+++ b/arch/x86/include/asm/segment.h
@@ -236,11 +236,23 @@
  */
 #define EARLY_IDT_HANDLER_SIZE 9
 
+/*
+ * xen_early_idt_handler_array is for Xen pv guests: for each entry in
+ * early_idt_handler_array it contains a prequel in the form of
+ * pop %rcx; pop %r11; jmp early_idt_handler_array[i]; summing up to
+ * max 8 bytes.
+ */
+#define XEN_EARLY_IDT_HANDLER_SIZE 8
+
 #ifndef __ASSEMBLY__
 
 extern const char early_idt_handler_array[NUM_EXCEPTION_VECTORS][EARLY_IDT_HANDLER_SIZE];
 extern void early_ignore_irq(void);
 
+#if defined(CONFIG_X86_64) && defined(CONFIG_XEN_PV)
+extern const char xen_early_idt_handler_array[NUM_EXCEPTION_VECTORS][XEN_EARLY_IDT_HANDLER_SIZE];
+#endif
+
 /*
  * Load a segment. Fall back on loading the zero segment if something goes
  * wrong.  This variant assumes that loading zero fully clears the segment.
diff --git a/arch/x86/include/asm/stacktrace.h b/arch/x86/include/asm/stacktrace.h
index 8da111b3c342..f73706878772 100644
--- a/arch/x86/include/asm/stacktrace.h
+++ b/arch/x86/include/asm/stacktrace.h
@@ -16,6 +16,7 @@ enum stack_type {
         STACK_TYPE_TASK,
         STACK_TYPE_IRQ,
         STACK_TYPE_SOFTIRQ,
+        STACK_TYPE_ENTRY,
         STACK_TYPE_EXCEPTION,
         STACK_TYPE_EXCEPTION_LAST = STACK_TYPE_EXCEPTION + N_EXCEPTION_STACKS-1,
 };
@@ -28,6 +29,8 @@ struct stack_info {
 bool in_task_stack(unsigned long *stack, struct task_struct *task,
                    struct stack_info *info);
 
+bool in_entry_stack(unsigned long *stack, struct stack_info *info);
+
 int get_stack_info(unsigned long *stack, struct task_struct *task,
                    struct stack_info *info, unsigned long *visit_mask);
 
diff --git a/arch/x86/include/asm/suspend_32.h b/arch/x86/include/asm/suspend_32.h
index 982c325dad33..8be6afb58471 100644
--- a/arch/x86/include/asm/suspend_32.h
+++ b/arch/x86/include/asm/suspend_32.h
@@ -12,7 +12,13 @@
 
 /* image of the saved processor state */
 struct saved_context {
-        u16 es, fs, gs, ss;
+        /*
+         * On x86_32, all segment registers, with the possible exception of
+         * gs, are saved at kernel entry in pt_regs.
+         */
+#ifdef CONFIG_X86_32_LAZY_GS
+        u16 gs;
+#endif
         unsigned long cr0, cr2, cr3, cr4;
         u64 misc_enable;
         bool misc_enable_saved;
diff --git a/arch/x86/include/asm/suspend_64.h b/arch/x86/include/asm/suspend_64.h
index 7306e911faee..a7af9f53c0cb 100644
--- a/arch/x86/include/asm/suspend_64.h
+++ b/arch/x86/include/asm/suspend_64.h
@@ -20,8 +20,20 @@
  */
 struct saved_context {
         struct pt_regs regs;
-        u16 ds, es, fs, gs, ss;
-        unsigned long gs_base, gs_kernel_base, fs_base;
+
+        /*
+         * User CS and SS are saved in current_pt_regs().  The rest of the
+         * segment selectors need to be saved and restored here.
+         */
+        u16 ds, es, fs, gs;
+
+        /*
+         * Usermode FSBASE and GSBASE may not match the fs and gs selectors,
+         * so we save them separately.  We save the kernelmode GSBASE to
+         * restore percpu access after resume.
+         */
+        unsigned long kernelmode_gs_base, usermode_gs_base, fs_base;
+
         unsigned long cr0, cr2, cr3, cr4, cr8;
         u64 misc_enable;
         bool misc_enable_saved;
@@ -30,8 +42,7 @@ struct saved_context {
         u16 gdt_pad; /* Unused */
         struct desc_ptr gdt_desc;
         u16 idt_pad;
-        u16 idt_limit;
-        unsigned long idt_base;
+        struct desc_ptr idt;
         u16 ldt;
         u16 tss;
         unsigned long tr;
diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
index 8c6bd6863db9..eb5f7999a893 100644
--- a/arch/x86/include/asm/switch_to.h
+++ b/arch/x86/include/asm/switch_to.h
@@ -16,8 +16,7 @@ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
                       struct tss_struct *tss);
 
 /* This runs runs on the previous thread's stack. */
-static inline void prepare_switch_to(struct task_struct *prev,
-                                     struct task_struct *next)
+static inline void prepare_switch_to(struct task_struct *next)
 {
 #ifdef CONFIG_VMAP_STACK
         /*
@@ -70,7 +69,7 @@ struct fork_frame {
 
 #define switch_to(prev, next, last)                                     \
 do {                                                                    \
-        prepare_switch_to(prev, next);                                  \
+        prepare_switch_to(next);                                        \
                                                                         \
         ((last) = __switch_to_asm((prev), (next)));                     \
 } while (0)
@@ -79,10 +78,10 @@ do {									\
 static inline void refresh_sysenter_cs(struct thread_struct *thread)
 {
         /* Only happens when SEP is enabled, no need to test "SEP"arately: */
-        if (unlikely(this_cpu_read(cpu_tss.x86_tss.ss1) == thread->sysenter_cs))
+        if (unlikely(this_cpu_read(cpu_tss_rw.x86_tss.ss1) == thread->sysenter_cs))
                 return;
 
-        this_cpu_write(cpu_tss.x86_tss.ss1, thread->sysenter_cs);
+        this_cpu_write(cpu_tss_rw.x86_tss.ss1, thread->sysenter_cs);
         wrmsr(MSR_IA32_SYSENTER_CS, thread->sysenter_cs, 0);
 }
 #endif
@@ -90,10 +89,12 @@ static inline void refresh_sysenter_cs(struct thread_struct *thread)
 /* This is used when switching tasks or entering/exiting vm86 mode. */
 static inline void update_sp0(struct task_struct *task)
 {
+        /* On x86_64, sp0 always points to the entry trampoline stack, which is constant: */
 #ifdef CONFIG_X86_32
         load_sp0(task->thread.sp0);
 #else
-        load_sp0(task_top_of_stack(task));
+        if (static_cpu_has(X86_FEATURE_XENPV))
+                load_sp0(task_top_of_stack(task));
 #endif
 }
 
diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
index 70f425947dc5..00223333821a 100644
--- a/arch/x86/include/asm/thread_info.h
+++ b/arch/x86/include/asm/thread_info.h
@@ -207,7 +207,7 @@ static inline int arch_within_stack_frames(const void * const stack,
 #else /* !__ASSEMBLY__ */
 
 #ifdef CONFIG_X86_64
-# define cpu_current_top_of_stack (cpu_tss + TSS_sp0)
+# define cpu_current_top_of_stack (cpu_tss_rw + TSS_sp1)
 #endif
 
 #endif
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index 509046cfa5ce..d33e4a26dc7e 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -9,70 +9,130 @@
 #include <asm/cpufeature.h>
 #include <asm/special_insns.h>
 #include <asm/smp.h>
+#include <asm/invpcid.h>
+#include <asm/pti.h>
+#include <asm/processor-flags.h>
 
-static inline void __invpcid(unsigned long pcid, unsigned long addr,
-                             unsigned long type)
-{
-        struct { u64 d[2]; } desc = { { pcid, addr } };
+/*
+ * The x86 feature is called PCID (Process Context IDentifier). It is similar
+ * to what is traditionally called ASID on the RISC processors.
+ *
+ * We don't use the traditional ASID implementation, where each process/mm gets
+ * its own ASID and flush/restart when we run out of ASID space.
+ *
+ * Instead we have a small per-cpu array of ASIDs and cache the last few mm's
+ * that came by on this CPU, allowing cheaper switch_mm between processes on
+ * this CPU.
+ *
+ * We end up with different spaces for different things. To avoid confusion we
+ * use different names for each of them:
+ *
+ * ASID  - [0, TLB_NR_DYN_ASIDS-1]
+ *         the canonical identifier for an mm
+ *
+ * kPCID - [1, TLB_NR_DYN_ASIDS]
+ *         the value we write into the PCID part of CR3; corresponds to the
+ *         ASID+1, because PCID 0 is special.
+ *
+ * uPCID - [2048 + 1, 2048 + TLB_NR_DYN_ASIDS]
+ *         for KPTI each mm has two address spaces and thus needs two
+ *         PCID values, but we can still do with a single ASID denomination
+ *         for each mm. Corresponds to kPCID + 2048.
+ *
+ */
 
-        /*
-         * The memory clobber is because the whole point is to invalidate
-         * stale TLB entries and, especially if we're flushing global
-         * mappings, we don't want the compiler to reorder any subsequent
-         * memory accesses before the TLB flush.
-         *
-         * The hex opcode is invpcid (%ecx), %eax in 32-bit mode and
-         * invpcid (%rcx), %rax in long mode.
-         */
-        asm volatile (".byte 0x66, 0x0f, 0x38, 0x82, 0x01"
-                      : : "m" (desc), "a" (type), "c" (&desc) : "memory");
-}
+/* There are 12 bits of space for ASIDS in CR3 */
+#define CR3_HW_ASID_BITS                12
 
-#define INVPCID_TYPE_INDIV_ADDR         0
-#define INVPCID_TYPE_SINGLE_CTXT        1
-#define INVPCID_TYPE_ALL_INCL_GLOBAL    2
-#define INVPCID_TYPE_ALL_NON_GLOBAL     3
+/*
+ * When enabled, PAGE_TABLE_ISOLATION consumes a single bit for
+ * user/kernel switches
+ */
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+# define PTI_CONSUMED_PCID_BITS 1
+#else
+# define PTI_CONSUMED_PCID_BITS 0
+#endif
 
-/* Flush all mappings for a given pcid and addr, not including globals. */
-static inline void invpcid_flush_one(unsigned long pcid,
-                                     unsigned long addr)
-{
-        __invpcid(pcid, addr, INVPCID_TYPE_INDIV_ADDR);
-}
+#define CR3_AVAIL_PCID_BITS (X86_CR3_PCID_BITS - PTI_CONSUMED_PCID_BITS)
+
+/*
+ * ASIDs are zero-based: 0->MAX_AVAIL_ASID are valid.  -1 below to account
+ * for them being zero-based.  Another -1 is because PCID 0 is reserved for
+ * use by non-PCID-aware users.
+ */
+#define MAX_ASID_AVAILABLE ((1 << CR3_AVAIL_PCID_BITS) - 2)
 
-/* Flush all mappings for a given PCID, not including globals. */
-static inline void invpcid_flush_single_context(unsigned long pcid)
+/*
+ * 6 because 6 should be plenty and struct tlb_state will fit in two cache
+ * lines.
+ */
+#define TLB_NR_DYN_ASIDS        6
+
+/*
+ * Given @asid, compute kPCID
+ */
+static inline u16 kern_pcid(u16 asid)
 {
-        __invpcid(pcid, 0, INVPCID_TYPE_SINGLE_CTXT);
+        VM_WARN_ON_ONCE(asid > MAX_ASID_AVAILABLE);
+
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+        /*
+         * Make sure that the dynamic ASID space does not confict with the
+         * bit we are using to switch between user and kernel ASIDs.
+         */
+        BUILD_BUG_ON(TLB_NR_DYN_ASIDS >= (1 << X86_CR3_PTI_PCID_USER_BIT));
+
+        /*
+         * The ASID being passed in here should have respected the
+         * MAX_ASID_AVAILABLE and thus never have the switch bit set.
+         */
+        VM_WARN_ON_ONCE(asid & (1 << X86_CR3_PTI_PCID_USER_BIT));
+#endif
+        /*
+         * The dynamically-assigned ASIDs that get passed in are small
+         * (<TLB_NR_DYN_ASIDS).  They never have the high switch bit set,
+         * so do not bother to clear it.
+         *
+         * If PCID is on, ASID-aware code paths put the ASID+1 into the
+         * PCID bits.  This serves two purposes.  It prevents a nasty
+         * situation in which PCID-unaware code saves CR3, loads some other
+         * value (with PCID == 0), and then restores CR3, thus corrupting
+         * the TLB for ASID 0 if the saved ASID was nonzero.  It also means
+         * that any bugs involving loading a PCID-enabled CR3 with
+         * CR4.PCIDE off will trigger deterministically.
+         */
+        return asid + 1;
 }
 
-/* Flush all mappings, including globals, for all PCIDs. */
-static inline void invpcid_flush_all(void)
+/*
+ * Given @asid, compute uPCID
+ */
+static inline u16 user_pcid(u16 asid)
 {
-        __invpcid(0, 0, INVPCID_TYPE_ALL_INCL_GLOBAL);
+        u16 ret = kern_pcid(asid);
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+        ret |= 1 << X86_CR3_PTI_PCID_USER_BIT;
+#endif
+        return ret;
 }
 
-/* Flush all mappings for all PCIDs except globals. */
-static inline void invpcid_flush_all_nonglobals(void)
+struct pgd_t;
+static inline unsigned long build_cr3(pgd_t *pgd, u16 asid)
 {
-        __invpcid(0, 0, INVPCID_TYPE_ALL_NON_GLOBAL);
+        if (static_cpu_has(X86_FEATURE_PCID)) {
+                return __sme_pa(pgd) | kern_pcid(asid);
+        } else {
+                VM_WARN_ON_ONCE(asid != 0);
+                return __sme_pa(pgd);
+        }
 }
 
-static inline u64 inc_mm_tlb_gen(struct mm_struct *mm)
+static inline unsigned long build_cr3_noflush(pgd_t *pgd, u16 asid)
 {
-        u64 new_tlb_gen;
-
-        /*
-         * Bump the generation count.  This also serves as a full barrier
-         * that synchronizes with switch_mm(): callers are required to order
-         * their read of mm_cpumask after their writes to the paging
-         * structures.
-         */
-        smp_mb__before_atomic();
-        new_tlb_gen = atomic64_inc_return(&mm->context.tlb_gen);
-        smp_mb__after_atomic();
-
-        return new_tlb_gen;
+        VM_WARN_ON_ONCE(asid > MAX_ASID_AVAILABLE);
+        VM_WARN_ON_ONCE(!this_cpu_has(X86_FEATURE_PCID));
+        return __sme_pa(pgd) | kern_pcid(asid) | CR3_NOFLUSH;
 }
 
 #ifdef CONFIG_PARAVIRT
@@ -99,12 +159,6 @@ static inline bool tlb_defer_switch_to_init_mm(void)
         return !static_cpu_has(X86_FEATURE_PCID);
 }
 
-/*
- * 6 because 6 should be plenty and struct tlb_state will fit in
- * two cache lines.
- */
-#define TLB_NR_DYN_ASIDS 6
-
 struct tlb_context {
         u64 ctx_id;
         u64 tlb_gen;
@@ -139,6 +193,24 @@ struct tlb_state {
         bool is_lazy;
 
         /*
+         * If set we changed the page tables in such a way that we
+         * needed an invalidation of all contexts (aka. PCIDs / ASIDs).
+         * This tells us to go invalidate all the non-loaded ctxs[]
+         * on the next context switch.
+         *
+         * The current ctx was kept up-to-date as it ran and does not
+         * need to be invalidated.
+         */
+        bool invalidate_other;
+
+        /*
+         * Mask that contains TLB_NR_DYN_ASIDS+1 bits to indicate
+         * the corresponding user PCID needs a flush next time we
+         * switch to it; see SWITCH_TO_USER_CR3.
+         */
+        unsigned short user_pcid_flush_mask;
+
+        /*
          * Access to this CR4 shadow and to H/W CR4 is protected by
          * disabling interrupts when modifying either one.
          */
@@ -173,40 +245,43 @@ static inline void cr4_init_shadow(void)
         this_cpu_write(cpu_tlbstate.cr4, __read_cr4());
 }
 
+static inline void __cr4_set(unsigned long cr4)
+{
+        lockdep_assert_irqs_disabled();
+        this_cpu_write(cpu_tlbstate.cr4, cr4);
+        __write_cr4(cr4);
+}
+
 /* Set in this cpu's CR4. */
 static inline void cr4_set_bits(unsigned long mask)
 {
-        unsigned long cr4;
+        unsigned long cr4, flags;
 
+        local_irq_save(flags);
         cr4 = this_cpu_read(cpu_tlbstate.cr4);
-        if ((cr4 | mask) != cr4) {
-                cr4 |= mask;
-                this_cpu_write(cpu_tlbstate.cr4, cr4);
-                __write_cr4(cr4);
-        }
+        if ((cr4 | mask) != cr4)
+                __cr4_set(cr4 | mask);
+        local_irq_restore(flags);
 }
 
 /* Clear in this cpu's CR4. */
 static inline void cr4_clear_bits(unsigned long mask)
 {
-        unsigned long cr4;
+        unsigned long cr4, flags;
 
+        local_irq_save(flags);
         cr4 = this_cpu_read(cpu_tlbstate.cr4);
-        if ((cr4 & ~mask) != cr4) {
-                cr4 &= ~mask;
-                this_cpu_write(cpu_tlbstate.cr4, cr4);
-                __write_cr4(cr4);
-        }
+        if ((cr4 & ~mask) != cr4)
+                __cr4_set(cr4 & ~mask);
+        local_irq_restore(flags);
 }
 
-static inline void cr4_toggle_bits(unsigned long mask)
+static inline void cr4_toggle_bits_irqsoff(unsigned long mask)
 {
         unsigned long cr4;
 
         cr4 = this_cpu_read(cpu_tlbstate.cr4);
-        cr4 ^= mask;
-        this_cpu_write(cpu_tlbstate.cr4, cr4);
-        __write_cr4(cr4);
+        __cr4_set(cr4 ^ mask);
 }
 
 /* Read the CR4 shadow. */
@@ -216,6 +291,14 @@ static inline unsigned long cr4_read_shadow(void)
 }
 
 /*
+ * Mark all other ASIDs as invalid, preserves the current.
+ */
+static inline void invalidate_other_asid(void)
+{
+        this_cpu_write(cpu_tlbstate.invalidate_other, true);
+}
+
+/*
  * Save some of cr4 feature set we're using (e.g.  Pentium 4MB
  * enable and PPro Global page enable), so that any CPU's that boot
  * up after us can get the correct flags.  This should only be used
@@ -234,37 +317,63 @@ static inline void cr4_set_bits_and_update_boot(unsigned long mask)
 
 extern void initialize_tlbstate_and_flush(void);
 
-static inline void __native_flush_tlb(void)
+/*
+ * Given an ASID, flush the corresponding user ASID.  We can delay this
+ * until the next time we switch to it.
+ *
+ * See SWITCH_TO_USER_CR3.
+ */
+static inline void invalidate_user_asid(u16 asid)
 {
+        /* There is no user ASID if address space separation is off */
+        if (!IS_ENABLED(CONFIG_PAGE_TABLE_ISOLATION))
+                return;
+
         /*
-         * If current->mm == NULL then we borrow a mm which may change during a
-         * task switch and therefore we must not be preempted while we write CR3
-         * back:
+         * We only have a single ASID if PCID is off and the CR3
+         * write will have flushed it.
          */
-        preempt_disable();
-        native_write_cr3(__native_read_cr3());
-        preempt_enable();
+        if (!cpu_feature_enabled(X86_FEATURE_PCID))
+                return;
+
+        if (!static_cpu_has(X86_FEATURE_PTI))
+                return;
+
+        __set_bit(kern_pcid(asid),
+                  (unsigned long *)this_cpu_ptr(&cpu_tlbstate.user_pcid_flush_mask));
 }
 
-static inline void __native_flush_tlb_global_irq_disabled(void)
+/*
+ * flush the entire current user mapping
+ */
+static inline void __native_flush_tlb(void)
 {
-        unsigned long cr4;
+        /*
+         * Preemption or interrupts must be disabled to protect the access
+         * to the per CPU variable and to prevent being preempted between
+         * read_cr3() and write_cr3().
+         */
+        WARN_ON_ONCE(preemptible());
 
-        cr4 = this_cpu_read(cpu_tlbstate.cr4);
-        /* clear PGE */
-        native_write_cr4(cr4 & ~X86_CR4_PGE);
-        /* write old PGE again and flush TLBs */
-        native_write_cr4(cr4);
+        invalidate_user_asid(this_cpu_read(cpu_tlbstate.loaded_mm_asid));
+
+        /* If current->mm == NULL then the read_cr3() "borrows" an mm */
+        native_write_cr3(__native_read_cr3());
 }
 
+/*
+ * flush everything
+ */
 static inline void __native_flush_tlb_global(void)
 {
-        unsigned long flags;
+        unsigned long cr4, flags;
 
         if (static_cpu_has(X86_FEATURE_INVPCID)) {
                 /*
                  * Using INVPCID is considerably faster than a pair of writes
                  * to CR4 sandwiched inside an IRQ flag save/restore.
+                 *
+                 * Note, this works with CR4.PCIDE=0 or 1.
                  */
                 invpcid_flush_all();
                 return;
@@ -277,36 +386,69 @@ static inline void __native_flush_tlb_global(void)
          */
         raw_local_irq_save(flags);
 
-        __native_flush_tlb_global_irq_disabled();
+        cr4 = this_cpu_read(cpu_tlbstate.cr4);
+        /* toggle PGE */
+        native_write_cr4(cr4 ^ X86_CR4_PGE);
+        /* write old PGE again and flush TLBs */
+        native_write_cr4(cr4);
 
         raw_local_irq_restore(flags);
 }
 
+/*
+ * flush one page in the user mapping
+ */
 static inline void __native_flush_tlb_single(unsigned long addr)
 {
+        u32 loaded_mm_asid = this_cpu_read(cpu_tlbstate.loaded_mm_asid);
+
         asm volatile("invlpg (%0)" ::"r" (addr) : "memory");
+
+        if (!static_cpu_has(X86_FEATURE_PTI))
+                return;
+
+        /*
+         * Some platforms #GP if we call invpcid(type=1/2) before CR4.PCIDE=1.
+         * Just use invalidate_user_asid() in case we are called early.
+         */
+        if (!this_cpu_has(X86_FEATURE_INVPCID_SINGLE))
+                invalidate_user_asid(loaded_mm_asid);
+        else
+                invpcid_flush_one(user_pcid(loaded_mm_asid), addr);
 }
 
+/*
+ * flush everything
+ */
 static inline void __flush_tlb_all(void)
 {
-        if (boot_cpu_has(X86_FEATURE_PGE))
+        if (boot_cpu_has(X86_FEATURE_PGE)) {
                 __flush_tlb_global();
-        else
+        } else {
+                /*
+                 * !PGE -> !PCID (setup_pcid()), thus every flush is total.
+                 */
                 __flush_tlb();
-
-        /*
-         * Note: if we somehow had PCID but not PGE, then this wouldn't work --
-         * we'd end up flushing kernel translations for the current ASID but
-         * we might fail to flush kernel translations for other cached ASIDs.
-         *
-         * To avoid this issue, we force PCID off if PGE is off.
-         */
+        }
 }
 
+/*
+ * flush one page in the kernel mapping
+ */
 static inline void __flush_tlb_one(unsigned long addr)
 {
         count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ONE);
         __flush_tlb_single(addr);
+
+        if (!static_cpu_has(X86_FEATURE_PTI))
+                return;
+
+        /*
+         * __flush_tlb_single() will have cleared the TLB entry for this ASID,
+         * but since kernel space is replicated across all, we must also
+         * invalidate all others.
+         */
+        invalidate_other_asid();
 }
 
 #define TLB_FLUSH_ALL   -1UL
@@ -367,6 +509,17 @@ static inline void flush_tlb_page(struct vm_area_struct *vma, unsigned long a)
 void native_flush_tlb_others(const struct cpumask *cpumask,
                              const struct flush_tlb_info *info);
 
+static inline u64 inc_mm_tlb_gen(struct mm_struct *mm)
+{
+        /*
+         * Bump the generation count.  This also serves as a full barrier
+         * that synchronizes with switch_mm(): callers are required to order
+         * their read of mm_cpumask after their writes to the paging
+         * structures.
+         */
+        return atomic64_inc_return(&mm->context.tlb_gen);
+}
+
 static inline void arch_tlbbatch_add_mm(struct arch_tlbflush_unmap_batch *batch,
                                         struct mm_struct *mm)
 {
diff --git a/arch/x86/include/asm/trace/irq_vectors.h b/arch/x86/include/asm/trace/irq_vectors.h
index 84b9ec0c1bc0..22647a642e98 100644
--- a/arch/x86/include/asm/trace/irq_vectors.h
+++ b/arch/x86/include/asm/trace/irq_vectors.h
@@ -283,34 +283,34 @@ TRACE_EVENT(vector_alloc_managed,
 DECLARE_EVENT_CLASS(vector_activate,
 
         TP_PROTO(unsigned int irq, bool is_managed, bool can_reserve,
-                 bool early),
+                 bool reserve),
 
-        TP_ARGS(irq, is_managed, can_reserve, early),
+        TP_ARGS(irq, is_managed, can_reserve, reserve),
 
         TP_STRUCT__entry(
                 __field(        unsigned int,   irq             )
                 __field(        bool,           is_managed      )
                 __field(        bool,           can_reserve     )
-                __field(        bool,           early           )
+                __field(        bool,           reserve         )
         ),
 
         TP_fast_assign(
                 __entry->irq            = irq;
                 __entry->is_managed     = is_managed;
                 __entry->can_reserve    = can_reserve;
-                __entry->early          = early;
+                __entry->reserve        = reserve;
         ),
 
-        TP_printk("irq=%u is_managed=%d can_reserve=%d early=%d",
+        TP_printk("irq=%u is_managed=%d can_reserve=%d reserve=%d",
                   __entry->irq, __entry->is_managed, __entry->can_reserve,
-                  __entry->early)
+                  __entry->reserve)
 );
 
 #define DEFINE_IRQ_VECTOR_ACTIVATE_EVENT(name)                          \
 DEFINE_EVENT_FN(vector_activate, name,                                  \
         TP_PROTO(unsigned int irq, bool is_managed,                     \
-                 bool can_reserve, bool early),                         \
-        TP_ARGS(irq, is_managed, can_reserve, early), NULL, NULL);      \
+                 bool can_reserve, bool reserve),                       \
+        TP_ARGS(irq, is_managed, can_reserve, reserve), NULL, NULL);    \
 
 DEFINE_IRQ_VECTOR_ACTIVATE_EVENT(vector_activate);
 DEFINE_IRQ_VECTOR_ACTIVATE_EVENT(vector_deactivate);
diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
index 1fadd310ff68..3de69330e6c5 100644
--- a/arch/x86/include/asm/traps.h
+++ b/arch/x86/include/asm/traps.h
@@ -75,7 +75,6 @@ dotraplinkage void do_segment_not_present(struct pt_regs *, long);
 dotraplinkage void do_stack_segment(struct pt_regs *, long);
 #ifdef CONFIG_X86_64
 dotraplinkage void do_double_fault(struct pt_regs *, long);
-asmlinkage struct pt_regs *sync_regs(struct pt_regs *);
 #endif
 dotraplinkage void do_general_protection(struct pt_regs *, long);
 dotraplinkage void do_page_fault(struct pt_regs *, unsigned long);
@@ -89,6 +88,7 @@ dotraplinkage void do_simd_coprocessor_error(struct pt_regs *, long);
 #ifdef CONFIG_X86_32
 dotraplinkage void do_iret_error(struct pt_regs *, long);
 #endif
+dotraplinkage void do_mce(struct pt_regs *, long);
 
 static inline int get_si_code(unsigned long condition)
 {
diff --git a/arch/x86/include/asm/unwind.h b/arch/x86/include/asm/unwind.h
index e9cc6fe1fc6f..1f86e1b0a5cd 100644
--- a/arch/x86/include/asm/unwind.h
+++ b/arch/x86/include/asm/unwind.h
@@ -7,6 +7,9 @@
 #include <asm/ptrace.h>
 #include <asm/stacktrace.h>
 
+#define IRET_FRAME_OFFSET (offsetof(struct pt_regs, ip))
+#define IRET_FRAME_SIZE   (sizeof(struct pt_regs) - IRET_FRAME_OFFSET)
+
 struct unwind_state {
         struct stack_info stack_info;
         unsigned long stack_mask;
@@ -52,15 +55,28 @@ void unwind_start(struct unwind_state *state, struct task_struct *task,
 }
 
 #if defined(CONFIG_UNWINDER_ORC) || defined(CONFIG_UNWINDER_FRAME_POINTER)
-static inline struct pt_regs *unwind_get_entry_regs(struct unwind_state *state)
+/*
+ * If 'partial' returns true, only the iret frame registers are valid.
+ */
+static inline struct pt_regs *unwind_get_entry_regs(struct unwind_state *state,
+                                                    bool *partial)
 {
         if (unwind_done(state))
                 return NULL;
 
+        if (partial) {
+#ifdef CONFIG_UNWINDER_ORC
+                *partial = !state->full_regs;
+#else
+                *partial = false;
+#endif
+        }
+
         return state->regs;
 }
 #else
-static inline struct pt_regs *unwind_get_entry_regs(struct unwind_state *state)
+static inline struct pt_regs *unwind_get_entry_regs(struct unwind_state *state,
+                                                    bool *partial)
 {
         return NULL;
 }
diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h
index d9a7c659009c..b986b2ca688a 100644
--- a/arch/x86/include/asm/vsyscall.h
+++ b/arch/x86/include/asm/vsyscall.h
@@ -7,6 +7,7 @@
 
 #ifdef CONFIG_X86_VSYSCALL_EMULATION
 extern void map_vsyscall(void);
+extern void set_vsyscall_pgtable_user_bits(pgd_t *root);
 
 /*
  * Called on instruction fetch fault in vsyscall page.
diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
index 7cb282e9e587..bfd882617613 100644
--- a/arch/x86/include/asm/xen/hypercall.h
+++ b/arch/x86/include/asm/xen/hypercall.h
@@ -44,6 +44,7 @@
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/smap.h>
+#include <asm/nospec-branch.h>
 
 #include <xen/interface/xen.h>
 #include <xen/interface/sched.h>
@@ -217,9 +218,9 @@ privcmd_call(unsigned call,
         __HYPERCALL_5ARG(a1, a2, a3, a4, a5);
 
         stac();
-        asm volatile("call *%[call]"
+        asm volatile(CALL_NOSPEC
                      : __HYPERCALL_5PARAM
-                     : [call] "a" (&hypercall_page[call])
+                     : [thunk_target] "a" (&hypercall_page[call])
                      : __HYPERCALL_CLOBBER5);
         clac();
 
diff --git a/arch/x86/include/uapi/asm/Kbuild b/arch/x86/include/uapi/asm/Kbuild
index da1489cb64dc..1e901e421f2d 100644
--- a/arch/x86/include/uapi/asm/Kbuild
+++ b/arch/x86/include/uapi/asm/Kbuild
@@ -1,6 +1,7 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
 
+generic-y += bpf_perf_event.h
 generated-y += unistd_32.h
 generated-y += unistd_64.h
 generated-y += unistd_x32.h
diff --git a/arch/x86/include/uapi/asm/processor-flags.h b/arch/x86/include/uapi/asm/processor-flags.h
index 7e1e730396ae..bcba3c643e63 100644
--- a/arch/x86/include/uapi/asm/processor-flags.h
+++ b/arch/x86/include/uapi/asm/processor-flags.h
@@ -78,7 +78,12 @@
 #define X86_CR3_PWT             _BITUL(X86_CR3_PWT_BIT)
 #define X86_CR3_PCD_BIT         4 /* Page Cache Disable */
 #define X86_CR3_PCD             _BITUL(X86_CR3_PCD_BIT)
-#define X86_CR3_PCID_MASK       _AC(0x00000fff,UL) /* PCID Mask */
+
+#define X86_CR3_PCID_BITS       12
+#define X86_CR3_PCID_MASK       (_AC((1UL << X86_CR3_PCID_BITS) - 1, UL))
+
+#define X86_CR3_PCID_NOFLUSH_BIT 63 /* Preserve old PCID */
+#define X86_CR3_PCID_NOFLUSH    _BITULL(X86_CR3_PCID_NOFLUSH_BIT)
 
 /*
  * Intel CPU features in CR4
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index 81bb565f4497..7e2baf7304ae 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -29,10 +29,13 @@ KASAN_SANITIZE_stacktrace.o				:= n
 KASAN_SANITIZE_paravirt.o                               := n
 
 OBJECT_FILES_NON_STANDARD_relocate_kernel_$(BITS).o     := y
-OBJECT_FILES_NON_STANDARD_ftrace_$(BITS).o              := y
 OBJECT_FILES_NON_STANDARD_test_nx.o                     := y
 OBJECT_FILES_NON_STANDARD_paravirt_patch_$(BITS).o      := y
 
+ifdef CONFIG_FRAME_POINTER
+OBJECT_FILES_NON_STANDARD_ftrace_$(BITS).o              := y
+endif
+
 # If instrumentation of this dir is enabled, boot hangs during first second.
 # Probably could be more selective here, but note that files related to irqs,
 # boot, dumpstack/stacktrace, etc are either non-interesting or can lead to
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index dbaf14d69ebd..4817d743c263 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -344,9 +344,12 @@ done:
 static void __init_or_module noinline optimize_nops(struct alt_instr *a, u8 *instr)
 {
         unsigned long flags;
+        int i;
 
-        if (instr[0] != 0x90)
-                return;
+        for (i = 0; i < a->padlen; i++) {
+                if (instr[i] != 0x90)
+                        return;
+        }
 
         local_irq_save(flags);
         add_nops(instr + (a->instrlen - a->padlen), a->padlen);
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 6e272f3ea984..25ddf02598d2 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1286,6 +1286,55 @@ static int __init apic_intr_mode_select(void)
         return APIC_SYMMETRIC_IO;
 }
 
+/*
+ * An initial setup of the virtual wire mode.
+ */
+void __init init_bsp_APIC(void)
+{
+        unsigned int value;
+
+        /*
+         * Don't do the setup now if we have a SMP BIOS as the
+         * through-I/O-APIC virtual wire mode might be active.
+         */
+        if (smp_found_config || !boot_cpu_has(X86_FEATURE_APIC))
+                return;
+
+        /*
+         * Do not trust the local APIC being empty at bootup.
+         */
+        clear_local_APIC();
+
+        /*
+         * Enable APIC.
+         */
+        value = apic_read(APIC_SPIV);
+        value &= ~APIC_VECTOR_MASK;
+        value |= APIC_SPIV_APIC_ENABLED;
+
+#ifdef CONFIG_X86_32
+        /* This bit is reserved on P4/Xeon and should be cleared */
+        if ((boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) &&
+            (boot_cpu_data.x86 == 15))
+                value &= ~APIC_SPIV_FOCUS_DISABLED;
+        else
+#endif
+                value |= APIC_SPIV_FOCUS_DISABLED;
+        value |= SPURIOUS_APIC_VECTOR;
+        apic_write(APIC_SPIV, value);
+
+        /*
+         * Set up the virtual wire mode.
+         */
+        apic_write(APIC_LVT0, APIC_DM_EXTINT);
+        value = APIC_DM_NMI;
+        if (!lapic_is_integrated())             /* 82489DX */
+                value |= APIC_LVT_LEVEL_TRIGGER;
+        if (apic_extnmi == APIC_EXTNMI_NONE)
+                value |= APIC_LVT_MASKED;
+        apic_write(APIC_LVT1, value);
+}
+
 /* Init the interrupt delivery mode for the BSP */
 void __init apic_intr_mode_init(void)
 {
@@ -2626,11 +2675,13 @@ static int __init apic_set_verbosity(char *arg)
                 apic_verbosity = APIC_DEBUG;
         else if (strcmp("verbose", arg) == 0)
                 apic_verbosity = APIC_VERBOSE;
+#ifdef CONFIG_X86_64
         else {
                 pr_warning("APIC Verbosity level %s not recognised"
                         " use apic=verbose or apic=debug\n", arg);
                 return -EINVAL;
         }
+#endif
 
         return 0;
 }
diff --git a/arch/x86/kernel/apic/apic_flat_64.c b/arch/x86/kernel/apic/apic_flat_64.c
index aa85690e9b64..25a87028cb3f 100644
--- a/arch/x86/kernel/apic/apic_flat_64.c
+++ b/arch/x86/kernel/apic/apic_flat_64.c
@@ -151,7 +151,7 @@ static struct apic apic_flat __ro_after_init = {
         .apic_id_valid                  = default_apic_id_valid,
         .apic_id_registered             = flat_apic_id_registered,
 
-        .irq_delivery_mode              = dest_LowestPrio,
+        .irq_delivery_mode              = dest_Fixed,
         .irq_dest_mode                  = 1, /* logical */
 
         .disable_esr                    = 0,
diff --git a/arch/x86/kernel/apic/apic_noop.c b/arch/x86/kernel/apic/apic_noop.c
index 7b659c4480c9..5078b5ce63a7 100644
--- a/arch/x86/kernel/apic/apic_noop.c
+++ b/arch/x86/kernel/apic/apic_noop.c
@@ -110,7 +110,7 @@ struct apic apic_noop __ro_after_init = {
         .apic_id_valid                  = default_apic_id_valid,
         .apic_id_registered             = noop_apic_id_registered,
 
-        .irq_delivery_mode              = dest_LowestPrio,
+        .irq_delivery_mode              = dest_Fixed,
         /* logical delivery broadcast to all CPUs: */
         .irq_dest_mode                  = 1,
 
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 201579dc5242..8a7963421460 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -2988,7 +2988,7 @@ void mp_irqdomain_free(struct irq_domain *domain, unsigned int virq,
 }
 
 int mp_irqdomain_activate(struct irq_domain *domain,
-                          struct irq_data *irq_data, bool early)
+                          struct irq_data *irq_data, bool reserve)
 {
         unsigned long flags;
 
diff --git a/arch/x86/kernel/apic/msi.c b/arch/x86/kernel/apic/msi.c
index 9b18be764422..ce503c99f5c4 100644
--- a/arch/x86/kernel/apic/msi.c
+++ b/arch/x86/kernel/apic/msi.c
@@ -39,17 +39,13 @@ static void irq_msi_compose_msg(struct irq_data *data, struct msi_msg *msg)
                 ((apic->irq_dest_mode == 0) ?
                         MSI_ADDR_DEST_MODE_PHYSICAL :
                         MSI_ADDR_DEST_MODE_LOGICAL) |
-                ((apic->irq_delivery_mode != dest_LowestPrio) ?
-                        MSI_ADDR_REDIRECTION_CPU :
-                        MSI_ADDR_REDIRECTION_LOWPRI) |
+                MSI_ADDR_REDIRECTION_CPU |
                 MSI_ADDR_DEST_ID(cfg->dest_apicid);
 
         msg->data =
                 MSI_DATA_TRIGGER_EDGE |
                 MSI_DATA_LEVEL_ASSERT |
-                ((apic->irq_delivery_mode != dest_LowestPrio) ?
-                        MSI_DATA_DELIVERY_FIXED :
-                        MSI_DATA_DELIVERY_LOWPRI) |
+                MSI_DATA_DELIVERY_FIXED |
                 MSI_DATA_VECTOR(cfg->vector);
 }
 
diff --git a/arch/x86/kernel/apic/probe_32.c b/arch/x86/kernel/apic/probe_32.c
index fa22017de806..02e8acb134f8 100644
--- a/arch/x86/kernel/apic/probe_32.c
+++ b/arch/x86/kernel/apic/probe_32.c
@@ -105,7 +105,7 @@ static struct apic apic_default __ro_after_init = {
         .apic_id_valid                  = default_apic_id_valid,
         .apic_id_registered             = default_apic_id_registered,
 
-        .irq_delivery_mode              = dest_LowestPrio,
+        .irq_delivery_mode              = dest_Fixed,
         /* logical delivery broadcast to all CPUs: */
         .irq_dest_mode                  = 1,
 
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
index 6a823a25eaff..3cc471beb50b 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -184,6 +184,7 @@ static void reserve_irq_vector_locked(struct irq_data *irqd)
         irq_matrix_reserve(vector_matrix);
         apicd->can_reserve = true;
         apicd->has_reserved = true;
+        irqd_set_can_reserve(irqd);
         trace_vector_reserve(irqd->irq, 0);
         vector_assign_managed_shutdown(irqd);
 }
@@ -368,8 +369,18 @@ static int activate_reserved(struct irq_data *irqd)
         int ret;
 
         ret = assign_irq_vector_any_locked(irqd);
-        if (!ret)
+        if (!ret) {
                 apicd->has_reserved = false;
+                /*
+                 * Core might have disabled reservation mode after
+                 * allocating the irq descriptor. Ideally this should
+                 * happen before allocation time, but that would require
+                 * completely convoluted ways of transporting that
+                 * information.
+                 */
+                if (!irqd_can_reserve(irqd))
+                        apicd->can_reserve = false;
+        }
         return ret;
 }
 
@@ -398,21 +409,21 @@ static int activate_managed(struct irq_data *irqd)
 }
 
 static int x86_vector_activate(struct irq_domain *dom, struct irq_data *irqd,
-                               bool early)
+                               bool reserve)
 {
         struct apic_chip_data *apicd = apic_chip_data(irqd);
         unsigned long flags;
         int ret = 0;
 
         trace_vector_activate(irqd->irq, apicd->is_managed,
-                              apicd->can_reserve, early);
+                              apicd->can_reserve, reserve);
 
         /* Nothing to do for fixed assigned vectors */
         if (!apicd->can_reserve && !apicd->is_managed)
                 return 0;
 
         raw_spin_lock_irqsave(&vector_lock, flags);
-        if (early || irqd_is_managed_and_shutdown(irqd))
+        if (reserve || irqd_is_managed_and_shutdown(irqd))
                 vector_assign_managed_shutdown(irqd);
         else if (apicd->is_managed)
                 ret = activate_managed(irqd);
@@ -478,6 +489,7 @@ static bool vector_configure_legacy(unsigned int virq, struct irq_data *irqd,
         } else {
                 /* Release the vector */
                 apicd->can_reserve = true;
+                irqd_set_can_reserve(irqd);
                 clear_irq_vector(irqd);
                 realloc = true;
         }
@@ -530,20 +542,23 @@ static int x86_vector_alloc_irqs(struct irq_domain *domain, unsigned int virq,
 
                 err = assign_irq_vector_policy(irqd, info);
                 trace_vector_setup(virq + i, false, err);
-                if (err)
+                if (err) {
+                        irqd->chip_data = NULL;
+                        free_apic_chip_data(apicd);
                         goto error;
+                }
         }
 
         return 0;
 
 error:
-        x86_vector_free_irqs(domain, virq, i + 1);
+        x86_vector_free_irqs(domain, virq, i);
         return err;
 }
 
 #ifdef CONFIG_GENERIC_IRQ_DEBUGFS
-void x86_vector_debug_show(struct seq_file *m, struct irq_domain *d,
-                           struct irq_data *irqd, int ind)
+static void x86_vector_debug_show(struct seq_file *m, struct irq_domain *d,
+                                  struct irq_data *irqd, int ind)
 {
         unsigned int cpu, vector, prev_cpu, prev_vector;
         struct apic_chip_data *apicd;
diff --git a/arch/x86/kernel/apic/x2apic_cluster.c b/arch/x86/kernel/apic/x2apic_cluster.c
index 622f13ca8a94..8b04234e010b 100644
--- a/arch/x86/kernel/apic/x2apic_cluster.c
+++ b/arch/x86/kernel/apic/x2apic_cluster.c
@@ -184,7 +184,7 @@ static struct apic apic_x2apic_cluster __ro_after_init = {
         .apic_id_valid                  = x2apic_apic_id_valid,
         .apic_id_registered             = x2apic_apic_id_registered,
 
-        .irq_delivery_mode              = dest_LowestPrio,
+        .irq_delivery_mode              = dest_Fixed,
         .irq_dest_mode                  = 1, /* logical */
 
         .disable_esr                    = 0,
diff --git a/arch/x86/kernel/asm-offsets.c b/arch/x86/kernel/asm-offsets.c
index 8ea78275480d..76417a9aab73 100644
--- a/arch/x86/kernel/asm-offsets.c
+++ b/arch/x86/kernel/asm-offsets.c
@@ -17,6 +17,7 @@
 #include <asm/sigframe.h>
 #include <asm/bootparam.h>
 #include <asm/suspend.h>
+#include <asm/tlbflush.h>
 
 #ifdef CONFIG_XEN
 #include <xen/interface/xen.h>
@@ -93,4 +94,13 @@ void common(void) {
 
         BLANK();
         DEFINE(PTREGS_SIZE, sizeof(struct pt_regs));
+
+        /* TLB state for the entry code */
+        OFFSET(TLB_STATE_user_pcid_flush_mask, tlb_state, user_pcid_flush_mask);
+
+        /* Layout info for cpu_entry_area */
+        OFFSET(CPU_ENTRY_AREA_tss, cpu_entry_area, tss);
+        OFFSET(CPU_ENTRY_AREA_entry_trampoline, cpu_entry_area, entry_trampoline);
+        OFFSET(CPU_ENTRY_AREA_entry_stack, cpu_entry_area, entry_stack_page);
+        DEFINE(SIZEOF_entry_stack, sizeof(struct entry_stack));
 }
diff --git a/arch/x86/kernel/asm-offsets_32.c b/arch/x86/kernel/asm-offsets_32.c
index dedf428b20b6..fa1261eefa16 100644
--- a/arch/x86/kernel/asm-offsets_32.c
+++ b/arch/x86/kernel/asm-offsets_32.c
@@ -47,13 +47,8 @@ void foo(void)
         BLANK();
 
         /* Offset from the sysenter stack to tss.sp0 */
-        DEFINE(TSS_sysenter_sp0, offsetof(struct tss_struct, x86_tss.sp0) -
-               offsetofend(struct tss_struct, SYSENTER_stack));
-
-        /* Offset from cpu_tss to SYSENTER_stack */
-        OFFSET(CPU_TSS_SYSENTER_stack, tss_struct, SYSENTER_stack);
-        /* Size of SYSENTER_stack */
-        DEFINE(SIZEOF_SYSENTER_stack, sizeof(((struct tss_struct *)0)->SYSENTER_stack));
+        DEFINE(TSS_sysenter_sp0, offsetof(struct cpu_entry_area, tss.x86_tss.sp0) -
+               offsetofend(struct cpu_entry_area, entry_stack_page.stack));
 
 #ifdef CONFIG_CC_STACKPROTECTOR
         BLANK();
diff --git a/arch/x86/kernel/asm-offsets_64.c b/arch/x86/kernel/asm-offsets_64.c
index 630212fa9b9d..bf51e51d808d 100644
--- a/arch/x86/kernel/asm-offsets_64.c
+++ b/arch/x86/kernel/asm-offsets_64.c
@@ -23,6 +23,9 @@ int main(void)
 #ifdef CONFIG_PARAVIRT
         OFFSET(PV_CPU_usergs_sysret64, pv_cpu_ops, usergs_sysret64);
         OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
+#ifdef CONFIG_DEBUG_ENTRY
+        OFFSET(PV_IRQ_save_fl, pv_irq_ops, save_fl);
+#endif
         BLANK();
 #endif
 
@@ -63,6 +66,7 @@ int main(void)
 
         OFFSET(TSS_ist, tss_struct, x86_tss.ist);
         OFFSET(TSS_sp0, tss_struct, x86_tss.sp0);
+        OFFSET(TSS_sp1, tss_struct, x86_tss.sp1);
         BLANK();
 
 #ifdef CONFIG_CC_STACKPROTECTOR
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index d58184b7cd44..ea831c858195 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -804,8 +804,11 @@ static void init_amd(struct cpuinfo_x86 *c)
         case 0x17: init_amd_zn(c); break;
         }
 
-        /* Enable workaround for FXSAVE leak */
-        if (c->x86 >= 6)
+        /*
+         * Enable workaround for FXSAVE leak on CPUs
+         * without a XSaveErPtr feature
+         */
+        if ((c->x86 >= 6) && (!cpu_has(c, X86_FEATURE_XSAVEERPTR)))
                 set_cpu_bug(c, X86_BUG_FXSAVE_LEAK);
 
         cpu_detect_cache_sizes(c);
@@ -826,8 +829,32 @@ static void init_amd(struct cpuinfo_x86 *c)
                 set_cpu_cap(c, X86_FEATURE_K8);
 
         if (cpu_has(c, X86_FEATURE_XMM2)) {
-                /* MFENCE stops RDTSC speculation */
-                set_cpu_cap(c, X86_FEATURE_MFENCE_RDTSC);
+                unsigned long long val;
+                int ret;
+
+                /*
+                 * A serializing LFENCE has less overhead than MFENCE, so
+                 * use it for execution serialization.  On families which
+                 * don't have that MSR, LFENCE is already serializing.
+                 * msr_set_bit() uses the safe accessors, too, even if the MSR
+                 * is not present.
+                 */
+                msr_set_bit(MSR_F10H_DECFG,
+                            MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT);
+
+                /*
+                 * Verify that the MSR write was successful (could be running
+                 * under a hypervisor) and only then assume that LFENCE is
+                 * serializing.
+                 */
+                ret = rdmsrl_safe(MSR_F10H_DECFG, &val);
+                if (!ret && (val & MSR_F10H_DECFG_LFENCE_SERIALIZE)) {
+                        /* A serializing LFENCE stops RDTSC speculation */
+                        set_cpu_cap(c, X86_FEATURE_LFENCE_RDTSC);
+                } else {
+                        /* MFENCE stops RDTSC speculation */
+                        set_cpu_cap(c, X86_FEATURE_MFENCE_RDTSC);
+                }
         }
 
         /*
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index ba0b2424c9b0..390b3dc3d438 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -10,6 +10,10 @@
  */
 #include <linux/init.h>
 #include <linux/utsname.h>
+#include <linux/cpu.h>
+
+#include <asm/nospec-branch.h>
+#include <asm/cmdline.h>
 #include <asm/bugs.h>
 #include <asm/processor.h>
 #include <asm/processor-flags.h>
@@ -19,6 +23,9 @@
 #include <asm/alternative.h>
 #include <asm/pgtable.h>
 #include <asm/set_memory.h>
+#include <asm/intel-family.h>
+
+static void __init spectre_v2_select_mitigation(void);
 
 void __init check_bugs(void)
 {
@@ -29,6 +36,9 @@ void __init check_bugs(void)
                 print_cpu_info(&boot_cpu_data);
         }
 
+        /* Select the proper spectre mitigation before patching alternatives */
+        spectre_v2_select_mitigation();
+
 #ifdef CONFIG_X86_32
         /*
          * Check whether we are able to run this kernel safely on SMP.
@@ -60,3 +70,214 @@ void __init check_bugs(void)
                 set_memory_4k((unsigned long)__va(0), 1);
 #endif
 }
+
+/* The kernel command line selection */
+enum spectre_v2_mitigation_cmd {
+        SPECTRE_V2_CMD_NONE,
+        SPECTRE_V2_CMD_AUTO,
+        SPECTRE_V2_CMD_FORCE,
+        SPECTRE_V2_CMD_RETPOLINE,
+        SPECTRE_V2_CMD_RETPOLINE_GENERIC,
+        SPECTRE_V2_CMD_RETPOLINE_AMD,
+};
+
+static const char *spectre_v2_strings[] = {
+        [SPECTRE_V2_NONE]                       = "Vulnerable",
+        [SPECTRE_V2_RETPOLINE_MINIMAL]          = "Vulnerable: Minimal generic ASM retpoline",
+        [SPECTRE_V2_RETPOLINE_MINIMAL_AMD]      = "Vulnerable: Minimal AMD ASM retpoline",
+        [SPECTRE_V2_RETPOLINE_GENERIC]          = "Mitigation: Full generic retpoline",
+        [SPECTRE_V2_RETPOLINE_AMD]              = "Mitigation: Full AMD retpoline",
+};
+
+#undef pr_fmt
+#define pr_fmt(fmt)     "Spectre V2 mitigation: " fmt
+
+static enum spectre_v2_mitigation spectre_v2_enabled = SPECTRE_V2_NONE;
+
+static void __init spec2_print_if_insecure(const char *reason)
+{
+        if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
+                pr_info("%s\n", reason);
+}
+
+static void __init spec2_print_if_secure(const char *reason)
+{
+        if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
+                pr_info("%s\n", reason);
+}
+
+static inline bool retp_compiler(void)
+{
+        return __is_defined(RETPOLINE);
+}
+
+static inline bool match_option(const char *arg, int arglen, const char *opt)
+{
+        int len = strlen(opt);
+
+        return len == arglen && !strncmp(arg, opt, len);
+}
+
+static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+{
+        char arg[20];
+        int ret;
+
+        ret = cmdline_find_option(boot_command_line, "spectre_v2", arg,
+                                  sizeof(arg));
+        if (ret > 0)  {
+                if (match_option(arg, ret, "off")) {
+                        goto disable;
+                } else if (match_option(arg, ret, "on")) {
+                        spec2_print_if_secure("force enabled on command line.");
+                        return SPECTRE_V2_CMD_FORCE;
+                } else if (match_option(arg, ret, "retpoline")) {
+                        spec2_print_if_insecure("retpoline selected on command line.");
+                        return SPECTRE_V2_CMD_RETPOLINE;
+                } else if (match_option(arg, ret, "retpoline,amd")) {
+                        if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD) {
+                                pr_err("retpoline,amd selected but CPU is not AMD. Switching to AUTO select\n");
+                                return SPECTRE_V2_CMD_AUTO;
+                        }
+                        spec2_print_if_insecure("AMD retpoline selected on command line.");
+                        return SPECTRE_V2_CMD_RETPOLINE_AMD;
+                } else if (match_option(arg, ret, "retpoline,generic")) {
+                        spec2_print_if_insecure("generic retpoline selected on command line.");
+                        return SPECTRE_V2_CMD_RETPOLINE_GENERIC;
+                } else if (match_option(arg, ret, "auto")) {
+                        return SPECTRE_V2_CMD_AUTO;
+                }
+        }
+
+        if (!cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
+                return SPECTRE_V2_CMD_AUTO;
+disable:
+        spec2_print_if_insecure("disabled on command line.");
+        return SPECTRE_V2_CMD_NONE;
+}
+
+/* Check for Skylake-like CPUs (for RSB handling) */
+static bool __init is_skylake_era(void)
+{
+        if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+            boot_cpu_data.x86 == 6) {
+                switch (boot_cpu_data.x86_model) {
+                case INTEL_FAM6_SKYLAKE_MOBILE:
+                case INTEL_FAM6_SKYLAKE_DESKTOP:
+                case INTEL_FAM6_SKYLAKE_X:
+                case INTEL_FAM6_KABYLAKE_MOBILE:
+                case INTEL_FAM6_KABYLAKE_DESKTOP:
+                        return true;
+                }
+        }
+        return false;
+}
+
+static void __init spectre_v2_select_mitigation(void)
+{
+        enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
+        enum spectre_v2_mitigation mode = SPECTRE_V2_NONE;
+
+        /*
+         * If the CPU is not affected and the command line mode is NONE or AUTO
+         * then nothing to do.
+         */
+        if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2) &&
+            (cmd == SPECTRE_V2_CMD_NONE || cmd == SPECTRE_V2_CMD_AUTO))
+                return;
+
+        switch (cmd) {
+        case SPECTRE_V2_CMD_NONE:
+                return;
+
+        case SPECTRE_V2_CMD_FORCE:
+                /* FALLTRHU */
+        case SPECTRE_V2_CMD_AUTO:
+                goto retpoline_auto;
+
+        case SPECTRE_V2_CMD_RETPOLINE_AMD:
+                if (IS_ENABLED(CONFIG_RETPOLINE))
+                        goto retpoline_amd;
+                break;
+        case SPECTRE_V2_CMD_RETPOLINE_GENERIC:
+                if (IS_ENABLED(CONFIG_RETPOLINE))
+                        goto retpoline_generic;
+                break;
+        case SPECTRE_V2_CMD_RETPOLINE:
+                if (IS_ENABLED(CONFIG_RETPOLINE))
+                        goto retpoline_auto;
+                break;
+        }
+        pr_err("kernel not compiled with retpoline; no mitigation available!");
+        return;
+
+retpoline_auto:
+        if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) {
+        retpoline_amd:
+                if (!boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) {
+                        pr_err("LFENCE not serializing. Switching to generic retpoline\n");
+                        goto retpoline_generic;
+                }
+                mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_AMD :
+                                         SPECTRE_V2_RETPOLINE_MINIMAL_AMD;
+                setup_force_cpu_cap(X86_FEATURE_RETPOLINE_AMD);
+                setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
+        } else {
+        retpoline_generic:
+                mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_GENERIC :
+                                         SPECTRE_V2_RETPOLINE_MINIMAL;
+                setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
+        }
+
+        spectre_v2_enabled = mode;
+        pr_info("%s\n", spectre_v2_strings[mode]);
+
+        /*
+         * If neither SMEP or KPTI are available, there is a risk of
+         * hitting userspace addresses in the RSB after a context switch
+         * from a shallow call stack to a deeper one. To prevent this fill
+         * the entire RSB, even when using IBRS.
+         *
+         * Skylake era CPUs have a separate issue with *underflow* of the
+         * RSB, when they will predict 'ret' targets from the generic BTB.
+         * The proper mitigation for this is IBRS. If IBRS is not supported
+         * or deactivated in favour of retpolines the RSB fill on context
+         * switch is required.
+         */
+        if ((!boot_cpu_has(X86_FEATURE_PTI) &&
+             !boot_cpu_has(X86_FEATURE_SMEP)) || is_skylake_era()) {
+                setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
+                pr_info("Filling RSB on context switch\n");
+        }
+}
+
+#undef pr_fmt
+
+#ifdef CONFIG_SYSFS
+ssize_t cpu_show_meltdown(struct device *dev,
+                          struct device_attribute *attr, char *buf)
+{
+        if (!boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN))
+                return sprintf(buf, "Not affected\n");
+        if (boot_cpu_has(X86_FEATURE_PTI))
+                return sprintf(buf, "Mitigation: PTI\n");
+        return sprintf(buf, "Vulnerable\n");
+}
+
+ssize_t cpu_show_spectre_v1(struct device *dev,
+                            struct device_attribute *attr, char *buf)
+{
+        if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V1))
+                return sprintf(buf, "Not affected\n");
+        return sprintf(buf, "Vulnerable\n");
+}
+
+ssize_t cpu_show_spectre_v2(struct device *dev,
+                            struct device_attribute *attr, char *buf)
+{
+        if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
+                return sprintf(buf, "Not affected\n");
+
+        return sprintf(buf, "%s\n", spectre_v2_strings[spectre_v2_enabled]);
+}
+#endif
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index fa998ca8aa5a..ef29ad001991 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -476,8 +476,8 @@ static const char *table_lookup_model(struct cpuinfo_x86 *c)
         return NULL;            /* Not found */
 }
 
-__u32 cpu_caps_cleared[NCAPINTS];
-__u32 cpu_caps_set[NCAPINTS];
+__u32 cpu_caps_cleared[NCAPINTS + NBUGINTS];
+__u32 cpu_caps_set[NCAPINTS + NBUGINTS];
 
 void load_percpu_segment(int cpu)
 {
@@ -490,28 +490,23 @@ void load_percpu_segment(int cpu)
         load_stack_canary_segment();
 }
 
-/* Setup the fixmap mapping only once per-processor */
-static inline void setup_fixmap_gdt(int cpu)
-{
-#ifdef CONFIG_X86_64
-        /* On 64-bit systems, we use a read-only fixmap GDT. */
-        pgprot_t prot = PAGE_KERNEL_RO;
-#else
-        /*
-         * On native 32-bit systems, the GDT cannot be read-only because
-         * our double fault handler uses a task gate, and entering through
-         * a task gate needs to change an available TSS to busy.  If the GDT
-         * is read-only, that will triple fault.
-         *
-         * On Xen PV, the GDT must be read-only because the hypervisor requires
-         * it.
-         */
-        pgprot_t prot = boot_cpu_has(X86_FEATURE_XENPV) ?
-                PAGE_KERNEL_RO : PAGE_KERNEL;
+#ifdef CONFIG_X86_32
+/* The 32-bit entry code needs to find cpu_entry_area. */
+DEFINE_PER_CPU(struct cpu_entry_area *, cpu_entry_area);
 #endif
 
-        __set_fixmap(get_cpu_gdt_ro_index(cpu), get_cpu_gdt_paddr(cpu), prot);
-}
+#ifdef CONFIG_X86_64
+/*
+ * Special IST stacks which the CPU switches to when it calls
+ * an IST-marked descriptor entry. Up to 7 stacks (hardware
+ * limit), all of them are 4K, except the debug stack which
+ * is 8K.
+ */
+static const unsigned int exception_stack_sizes[N_EXCEPTION_STACKS] = {
+          [0 ... N_EXCEPTION_STACKS - 1]        = EXCEPTION_STKSZ,
+          [DEBUG_STACK - 1]                     = DEBUG_STKSZ
+};
+#endif
 
 /* Load the original GDT from the per-cpu structure */
 void load_direct_gdt(int cpu)
@@ -747,7 +742,7 @@ static void apply_forced_caps(struct cpuinfo_x86 *c)
 {
         int i;
 
-        for (i = 0; i < NCAPINTS; i++) {
+        for (i = 0; i < NCAPINTS + NBUGINTS; i++) {
                 c->x86_capability[i] &= ~cpu_caps_cleared[i];
                 c->x86_capability[i] |= cpu_caps_set[i];
         }
@@ -927,6 +922,13 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
         }
 
         setup_force_cpu_cap(X86_FEATURE_ALWAYS);
+
+        if (c->x86_vendor != X86_VENDOR_AMD)
+                setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN);
+
+        setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
+        setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
+
         fpu__init_system(c);
 
 #ifdef CONFIG_X86_32
@@ -1250,7 +1252,7 @@ void enable_sep_cpu(void)
                 return;
 
         cpu = get_cpu();
-        tss = &per_cpu(cpu_tss, cpu);
+        tss = &per_cpu(cpu_tss_rw, cpu);
 
         /*
          * We cache MSR_IA32_SYSENTER_CS's value in the TSS's ss1 field --
@@ -1259,11 +1261,7 @@ void enable_sep_cpu(void)
 
         tss->x86_tss.ss1 = __KERNEL_CS;
         wrmsr(MSR_IA32_SYSENTER_CS, tss->x86_tss.ss1, 0);
-
-        wrmsr(MSR_IA32_SYSENTER_ESP,
-              (unsigned long)tss + offsetofend(struct tss_struct, SYSENTER_stack),
-              0);
-
+        wrmsr(MSR_IA32_SYSENTER_ESP, (unsigned long)(cpu_entry_stack(cpu) + 1), 0);
         wrmsr(MSR_IA32_SYSENTER_EIP, (unsigned long)entry_SYSENTER_32, 0);
 
         put_cpu();
@@ -1357,25 +1355,22 @@ DEFINE_PER_CPU(unsigned int, irq_count) __visible = -1;
 DEFINE_PER_CPU(int, __preempt_count) = INIT_PREEMPT_COUNT;
 EXPORT_PER_CPU_SYMBOL(__preempt_count);
 
-/*
- * Special IST stacks which the CPU switches to when it calls
- * an IST-marked descriptor entry. Up to 7 stacks (hardware
- * limit), all of them are 4K, except the debug stack which
- * is 8K.
- */
-static const unsigned int exception_stack_sizes[N_EXCEPTION_STACKS] = {
-          [0 ... N_EXCEPTION_STACKS - 1]        = EXCEPTION_STKSZ,
-          [DEBUG_STACK - 1]                     = DEBUG_STKSZ
-};
-
-static DEFINE_PER_CPU_PAGE_ALIGNED(char, exception_stacks
-        [(N_EXCEPTION_STACKS - 1) * EXCEPTION_STKSZ + DEBUG_STKSZ]);
-
 /* May not be marked __init: used by software suspend */
 void syscall_init(void)
 {
+        extern char _entry_trampoline[];
+        extern char entry_SYSCALL_64_trampoline[];
+
+        int cpu = smp_processor_id();
+        unsigned long SYSCALL64_entry_trampoline =
+                (unsigned long)get_cpu_entry_area(cpu)->entry_trampoline +
+                (entry_SYSCALL_64_trampoline - _entry_trampoline);
+
         wrmsr(MSR_STAR, 0, (__USER32_CS << 16) | __KERNEL_CS);
-        wrmsrl(MSR_LSTAR, (unsigned long)entry_SYSCALL_64);
+        if (static_cpu_has(X86_FEATURE_PTI))
+                wrmsrl(MSR_LSTAR, SYSCALL64_entry_trampoline);
+        else
+                wrmsrl(MSR_LSTAR, (unsigned long)entry_SYSCALL_64);
 
 #ifdef CONFIG_IA32_EMULATION
         wrmsrl(MSR_CSTAR, (unsigned long)entry_SYSCALL_compat);
@@ -1386,7 +1381,7 @@ void syscall_init(void)
          * AMD doesn't allow SYSENTER in long mode (either 32- or 64-bit).
          */
         wrmsrl_safe(MSR_IA32_SYSENTER_CS, (u64)__KERNEL_CS);
-        wrmsrl_safe(MSR_IA32_SYSENTER_ESP, 0ULL);
+        wrmsrl_safe(MSR_IA32_SYSENTER_ESP, (unsigned long)(cpu_entry_stack(cpu) + 1));
         wrmsrl_safe(MSR_IA32_SYSENTER_EIP, (u64)entry_SYSENTER_compat);
 #else
         wrmsrl(MSR_CSTAR, (unsigned long)ignore_sysret);
@@ -1530,7 +1525,7 @@ void cpu_init(void)
         if (cpu)
                 load_ucode_ap();
 
-        t = &per_cpu(cpu_tss, cpu);
+        t = &per_cpu(cpu_tss_rw, cpu);
         oist = &per_cpu(orig_ist, cpu);
 
 #ifdef CONFIG_NUMA
@@ -1569,7 +1564,7 @@ void cpu_init(void)
          * set up and load the per-CPU TSS
          */
         if (!oist->ist[0]) {
-                char *estacks = per_cpu(exception_stacks, cpu);
+                char *estacks = get_cpu_entry_area(cpu)->exception_stacks;
 
                 for (v = 0; v < N_EXCEPTION_STACKS; v++) {
                         estacks += exception_stack_sizes[v];
@@ -1580,7 +1575,7 @@ void cpu_init(void)
                 }
         }
 
-        t->x86_tss.io_bitmap_base = offsetof(struct tss_struct, io_bitmap);
+        t->x86_tss.io_bitmap_base = IO_BITMAP_OFFSET;
 
         /*
          * <= is required because the CPU will access up to
@@ -1596,11 +1591,12 @@ void cpu_init(void)
         enter_lazy_tlb(&init_mm, me);
 
         /*
-         * Initialize the TSS.  Don't bother initializing sp0, as the initial
-         * task never enters user mode.
+         * Initialize the TSS.  sp0 points to the entry trampoline stack
+         * regardless of what task is running.
          */
-        set_tss_desc(cpu, t);
+        set_tss_desc(cpu, &get_cpu_entry_area(cpu)->tss.x86_tss);
         load_TR_desc();
+        load_sp0((unsigned long)(cpu_entry_stack(cpu) + 1));
 
         load_mm_ldt(&init_mm);
 
@@ -1612,7 +1608,6 @@ void cpu_init(void)
         if (is_uv_system())
                 uv_cpu_init();
 
-        setup_fixmap_gdt(cpu);
         load_fixmap_gdt(cpu);
 }
 
@@ -1622,7 +1617,7 @@ void cpu_init(void)
 {
         int cpu = smp_processor_id();
         struct task_struct *curr = current;
-        struct tss_struct *t = &per_cpu(cpu_tss, cpu);
+        struct tss_struct *t = &per_cpu(cpu_tss_rw, cpu);
 
         wait_for_master_cpu(cpu);
 
@@ -1657,12 +1652,12 @@ void cpu_init(void)
          * Initialize the TSS.  Don't bother initializing sp0, as the initial
          * task never enters user mode.
          */
-        set_tss_desc(cpu, t);
+        set_tss_desc(cpu, &get_cpu_entry_area(cpu)->tss.x86_tss);
         load_TR_desc();
 
         load_mm_ldt(&init_mm);
 
-        t->x86_tss.io_bitmap_base = offsetof(struct tss_struct, io_bitmap);
+        t->x86_tss.io_bitmap_base = IO_BITMAP_OFFSET;
 
 #ifdef CONFIG_DOUBLEFAULT
         /* Set up doublefault TSS pointer in the GDT */
@@ -1674,7 +1669,6 @@ void cpu_init(void)
 
         fpu__init_cpu();
 
-        setup_fixmap_gdt(cpu);
         load_fixmap_gdt(cpu);
 }
 #endif
diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c
index 88dcf8479013..99442370de40 100644
--- a/arch/x86/kernel/cpu/intel_rdt.c
+++ b/arch/x86/kernel/cpu/intel_rdt.c
@@ -525,10 +525,6 @@ static void domain_remove_cpu(int cpu, struct rdt_resource *r)
                  */
                 if (static_branch_unlikely(&rdt_mon_enable_key))
                         rmdir_mondata_subdir_allrdtgrp(r, d->id);
-                kfree(d->ctrl_val);
-                kfree(d->rmid_busy_llc);
-                kfree(d->mbm_total);
-                kfree(d->mbm_local);
                 list_del(&d->list);
                 if (is_mbm_enabled())
                         cancel_delayed_work(&d->mbm_over);
@@ -545,6 +541,10 @@ static void domain_remove_cpu(int cpu, struct rdt_resource *r)
                         cancel_delayed_work(&d->cqm_limbo);
                 }
 
+                kfree(d->ctrl_val);
+                kfree(d->rmid_busy_llc);
+                kfree(d->mbm_total);
+                kfree(d->mbm_local);
                 kfree(d);
                 return;
         }
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index b1d616d08eee..868e412b4f0c 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1785,6 +1785,11 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
 void (*machine_check_vector)(struct pt_regs *, long error_code) =
                                                 unexpected_machine_check;
 
+dotraplinkage void do_mce(struct pt_regs *regs, long error_code)
+{
+        machine_check_vector(regs, error_code);
+}
+
 /*
  * Called for each booted CPU to set up machine checks.
  * Must be called with preempt off:
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index c6daec4bdba5..330b8462d426 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -470,6 +470,7 @@ static unsigned int verify_patch_size(u8 family, u32 patch_size,
 #define F14H_MPB_MAX_SIZE 1824
 #define F15H_MPB_MAX_SIZE 4096
 #define F16H_MPB_MAX_SIZE 3458
+#define F17H_MPB_MAX_SIZE 3200
 
         switch (family) {
         case 0x14:
@@ -481,6 +482,9 @@ static unsigned int verify_patch_size(u8 family, u32 patch_size,
         case 0x16:
                 max_size = F16H_MPB_MAX_SIZE;
                 break;
+        case 0x17:
+                max_size = F17H_MPB_MAX_SIZE;
+                break;
         default:
                 max_size = F1XH_MPB_MAX_SIZE;
                 break;
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index c4fa4a85d4cb..e4fc595cd6ea 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -239,7 +239,7 @@ static int __init save_microcode_in_initrd(void)
                 break;
         case X86_VENDOR_AMD:
                 if (c->x86 >= 0x10)
-                        return save_microcode_in_initrd_amd(cpuid_eax(1));
+                        ret = save_microcode_in_initrd_amd(cpuid_eax(1));
                 break;
         default:
                 break;
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index 7dbcb7adf797..f7c55b0e753a 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -45,6 +45,9 @@ static const char ucode_path[] = "kernel/x86/microcode/GenuineIntel.bin";
 /* Current microcode patch used in early patching on the APs. */
 static struct microcode_intel *intel_ucode_patch;
 
+/* last level cache size per core */
+static int llc_size_per_core;
+
 static inline bool cpu_signatures_match(unsigned int s1, unsigned int p1,
                                         unsigned int s2, unsigned int p2)
 {
@@ -565,15 +568,6 @@ static void print_ucode(struct ucode_cpu_info *uci)
 }
 #else
 
-/*
- * Flush global tlb. We only do this in x86_64 where paging has been enabled
- * already and PGE should be enabled as well.
- */
-static inline void flush_tlb_early(void)
-{
-        __native_flush_tlb_global_irq_disabled();
-}
-
 static inline void print_ucode(struct ucode_cpu_info *uci)
 {
         struct microcode_intel *mc;
@@ -602,10 +596,6 @@ static int apply_microcode_early(struct ucode_cpu_info *uci, bool early)
         if (rev != mc->hdr.rev)
                 return -1;
 
-#ifdef CONFIG_X86_64
-        /* Flush global tlb. This is precaution. */
-        flush_tlb_early();
-#endif
         uci->cpu_sig.rev = rev;
 
         if (early)
@@ -923,8 +913,19 @@ static bool is_blacklisted(unsigned int cpu)
 {
         struct cpuinfo_x86 *c = &cpu_data(cpu);
 
-        if (c->x86 == 6 && c->x86_model == INTEL_FAM6_BROADWELL_X) {
-                pr_err_once("late loading on model 79 is disabled.\n");
+        /*
+         * Late loading on model 79 with microcode revision less than 0x0b000021
+         * and LLC size per core bigger than 2.5MB may result in a system hang.
+         * This behavior is documented in item BDF90, #334165 (Intel Xeon
+         * Processor E7-8800/4800 v4 Product Family).
+         */
+        if (c->x86 == 6 &&
+            c->x86_model == INTEL_FAM6_BROADWELL_X &&
+            c->x86_mask == 0x01 &&
+            llc_size_per_core > 2621440 &&
+            c->microcode < 0x0b000021) {
+                pr_err_once("Erratum BDF90: late loading with revision < 0x0b000021 (0x%x) disabled.\n", c->microcode);
+                pr_err_once("Please consider either early loading through initrd/built-in or a potential BIOS update.\n");
                 return true;
         }
 
@@ -979,6 +980,15 @@ static struct microcode_ops microcode_intel_ops = {
         .apply_microcode                  = apply_microcode_intel,
 };
 
+static int __init calc_llc_size_per_core(struct cpuinfo_x86 *c)
+{
+        u64 llc_size = c->x86_cache_size * 1024;
+
+        do_div(llc_size, c->x86_max_cores);
+
+        return (int)llc_size;
+}
+
 struct microcode_ops * __init init_intel_microcode(void)
 {
         struct cpuinfo_x86 *c = &boot_cpu_data;
@@ -989,5 +999,7 @@ struct microcode_ops * __init init_intel_microcode(void)
                 return NULL;
         }
 
+        llc_size_per_core = calc_llc_size_per_core(c);
+
         return &microcode_intel_ops;
 }
diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c
index 05459ad3db46..d0e69769abfd 100644
--- a/arch/x86/kernel/cpu/scattered.c
+++ b/arch/x86/kernel/cpu/scattered.c
@@ -21,7 +21,6 @@ struct cpuid_bit {
 static const struct cpuid_bit cpuid_bits[] = {
         { X86_FEATURE_APERFMPERF,       CPUID_ECX,  0, 0x00000006, 0 },
         { X86_FEATURE_EPB,              CPUID_ECX,  3, 0x00000006, 0 },
-        { X86_FEATURE_INTEL_PT,         CPUID_EBX, 25, 0x00000007, 0 },
         { X86_FEATURE_AVX512_4VNNIW,    CPUID_EDX,  2, 0x00000007, 0 },
         { X86_FEATURE_AVX512_4FMAPS,    CPUID_EDX,  3, 0x00000007, 0 },
         { X86_FEATURE_CAT_L3,           CPUID_EBX,  1, 0x00000010, 0 },
diff --git a/arch/x86/kernel/doublefault.c b/arch/x86/kernel/doublefault.c
index 0e662c55ae90..0b8cedb20d6d 100644
--- a/arch/x86/kernel/doublefault.c
+++ b/arch/x86/kernel/doublefault.c
@@ -50,25 +50,23 @@ static void doublefault_fn(void)
                 cpu_relax();
 }
 
-struct tss_struct doublefault_tss __cacheline_aligned = {
-        .x86_tss = {
-                .sp0            = STACK_START,
-                .ss0            = __KERNEL_DS,
-                .ldt            = 0,
-                .io_bitmap_base = INVALID_IO_BITMAP_OFFSET,
-
-                .ip             = (unsigned long) doublefault_fn,
-                /* 0x2 bit is always set */
-                .flags          = X86_EFLAGS_SF | 0x2,
-                .sp             = STACK_START,
-                .es             = __USER_DS,
-                .cs             = __KERNEL_CS,
-                .ss             = __KERNEL_DS,
-                .ds             = __USER_DS,
-                .fs             = __KERNEL_PERCPU,
-
-                .__cr3          = __pa_nodebug(swapper_pg_dir),
-        }
+struct x86_hw_tss doublefault_tss __cacheline_aligned = {
+        .sp0            = STACK_START,
+        .ss0            = __KERNEL_DS,
+        .ldt            = 0,
+        .io_bitmap_base = INVALID_IO_BITMAP_OFFSET,
+
+        .ip             = (unsigned long) doublefault_fn,
+        /* 0x2 bit is always set */
+        .flags          = X86_EFLAGS_SF | 0x2,
+        .sp             = STACK_START,
+        .es             = __USER_DS,
+        .cs             = __KERNEL_CS,
+        .ss             = __KERNEL_DS,
+        .ds             = __USER_DS,
+        .fs             = __KERNEL_PERCPU,
+
+        .__cr3          = __pa_nodebug(swapper_pg_dir),
 };
 
 /* dummy for do_double_fault() call */
diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
index f13b4c00a5de..afbecff161d1 100644
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -18,6 +18,7 @@
 #include <linux/nmi.h>
 #include <linux/sysfs.h>
 
+#include <asm/cpu_entry_area.h>
 #include <asm/stacktrace.h>
 #include <asm/unwind.h>
 
@@ -43,6 +44,24 @@ bool in_task_stack(unsigned long *stack, struct task_struct *task,
         return true;
 }
 
+bool in_entry_stack(unsigned long *stack, struct stack_info *info)
+{
+        struct entry_stack *ss = cpu_entry_stack(smp_processor_id());
+
+        void *begin = ss;
+        void *end = ss + 1;
+
+        if ((void *)stack < begin || (void *)stack >= end)
+                return false;
+
+        info->type      = STACK_TYPE_ENTRY;
+        info->begin     = begin;
+        info->end       = end;
+        info->next_sp   = NULL;
+
+        return true;
+}
+
 static void printk_stack_address(unsigned long address, int reliable,
                                  char *log_lvl)
 {
@@ -50,6 +69,39 @@ static void printk_stack_address(unsigned long address, int reliable,
         printk("%s %s%pB\n", log_lvl, reliable ? "" : "? ", (void *)address);
 }
 
+void show_iret_regs(struct pt_regs *regs)
+{
+        printk(KERN_DEFAULT "RIP: %04x:%pS\n", (int)regs->cs, (void *)regs->ip);
+        printk(KERN_DEFAULT "RSP: %04x:%016lx EFLAGS: %08lx", (int)regs->ss,
+                regs->sp, regs->flags);
+}
+
+static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs,
+                                  bool partial)
+{
+        /*
+         * These on_stack() checks aren't strictly necessary: the unwind code
+         * has already validated the 'regs' pointer.  The checks are done for
+         * ordering reasons: if the registers are on the next stack, we don't
+         * want to print them out yet.  Otherwise they'll be shown as part of
+         * the wrong stack.  Later, when show_trace_log_lvl() switches to the
+         * next stack, this function will be called again with the same regs so
+         * they can be printed in the right context.
+         */
+        if (!partial && on_stack(info, regs, sizeof(*regs))) {
+                __show_regs(regs, 0);
+
+        } else if (partial && on_stack(info, (void *)regs + IRET_FRAME_OFFSET,
+                                       IRET_FRAME_SIZE)) {
+                /*
+                 * When an interrupt or exception occurs in entry code, the
+                 * full pt_regs might not have been saved yet.  In that case
+                 * just print the iret frame.
+                 */
+                show_iret_regs(regs);
+        }
+}
+
 void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
                         unsigned long *stack, char *log_lvl)
 {
@@ -57,11 +109,13 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
         struct stack_info stack_info = {0};
         unsigned long visit_mask = 0;
         int graph_idx = 0;
+        bool partial;
 
         printk("%sCall Trace:\n", log_lvl);
 
         unwind_start(&state, task, regs, stack);
         stack = stack ? : get_stack_pointer(task, regs);
+        regs = unwind_get_entry_regs(&state, &partial);
 
         /*
          * Iterate through the stacks, starting with the current stack pointer.
@@ -71,31 +125,35 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
          * - task stack
          * - interrupt stack
          * - HW exception stacks (double fault, nmi, debug, mce)
+         * - entry stack
          *
-         * x86-32 can have up to three stacks:
+         * x86-32 can have up to four stacks:
          * - task stack
          * - softirq stack
          * - hardirq stack
+         * - entry stack
          */
-        for (regs = NULL; stack; stack = PTR_ALIGN(stack_info.next_sp, sizeof(long))) {
+        for ( ; stack; stack = PTR_ALIGN(stack_info.next_sp, sizeof(long))) {
                 const char *stack_name;
 
-                /*
-                 * If we overflowed the task stack into a guard page, jump back
-                 * to the bottom of the usable stack.
-                 */
-                if (task_stack_page(task) - (void *)stack < PAGE_SIZE)
-                        stack = task_stack_page(task);
-
-                if (get_stack_info(stack, task, &stack_info, &visit_mask))
-                        break;
+                if (get_stack_info(stack, task, &stack_info, &visit_mask)) {
+                        /*
+                         * We weren't on a valid stack.  It's possible that
+                         * we overflowed a valid stack into a guard page.
+                         * See if the next page up is valid so that we can
+                         * generate some kind of backtrace if this happens.
+                         */
+                        stack = (unsigned long *)PAGE_ALIGN((unsigned long)stack);
+                        if (get_stack_info(stack, task, &stack_info, &visit_mask))
+                                break;
+                }
 
                 stack_name = stack_type_name(stack_info.type);
                 if (stack_name)
                         printk("%s <%s>\n", log_lvl, stack_name);
 
-                if (regs && on_stack(&stack_info, regs, sizeof(*regs)))
-                        __show_regs(regs, 0);
+                if (regs)
+                        show_regs_if_on_stack(&stack_info, regs, partial);
 
                 /*
                  * Scan the stack, printing any text addresses we find.  At the
@@ -119,7 +177,7 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
 
                         /*
                          * Don't print regs->ip again if it was already printed
-                         * by __show_regs() below.
+                         * by show_regs_if_on_stack().
                          */
                         if (regs && stack == &regs->ip)
                                 goto next;
@@ -154,9 +212,9 @@ next:
                         unwind_next_frame(&state);
 
                         /* if the frame has entry regs, print them */
-                        regs = unwind_get_entry_regs(&state);
-                        if (regs && on_stack(&stack_info, regs, sizeof(*regs)))
-                                __show_regs(regs, 0);
+                        regs = unwind_get_entry_regs(&state, &partial);
+                        if (regs)
+                                show_regs_if_on_stack(&stack_info, regs, partial);
                 }
 
                 if (stack_name)
@@ -252,11 +310,13 @@ int __die(const char *str, struct pt_regs *regs, long err)
         unsigned long sp;
 #endif
         printk(KERN_DEFAULT
-               "%s: %04lx [#%d]%s%s%s%s\n", str, err & 0xffff, ++die_counter,
+               "%s: %04lx [#%d]%s%s%s%s%s\n", str, err & 0xffff, ++die_counter,
                IS_ENABLED(CONFIG_PREEMPT) ? " PREEMPT"         : "",
                IS_ENABLED(CONFIG_SMP)     ? " SMP"             : "",
                debug_pagealloc_enabled()  ? " DEBUG_PAGEALLOC" : "",
-               IS_ENABLED(CONFIG_KASAN)   ? " KASAN"           : "");
+               IS_ENABLED(CONFIG_KASAN)   ? " KASAN"           : "",
+               IS_ENABLED(CONFIG_PAGE_TABLE_ISOLATION) ?
+               (boot_cpu_has(X86_FEATURE_PTI) ? " PTI" : " NOPTI") : "");
 
         if (notify_die(DIE_OOPS, str, regs, err,
                         current->thread.trap_nr, SIGSEGV) == NOTIFY_STOP)
diff --git a/arch/x86/kernel/dumpstack_32.c b/arch/x86/kernel/dumpstack_32.c
index daefae83a3aa..04170f63e3a1 100644
--- a/arch/x86/kernel/dumpstack_32.c
+++ b/arch/x86/kernel/dumpstack_32.c
@@ -26,6 +26,9 @@ const char *stack_type_name(enum stack_type type)
         if (type == STACK_TYPE_SOFTIRQ)
                 return "SOFTIRQ";
 
+        if (type == STACK_TYPE_ENTRY)
+                return "ENTRY_TRAMPOLINE";
+
         return NULL;
 }
 
@@ -93,6 +96,9 @@ int get_stack_info(unsigned long *stack, struct task_struct *task,
         if (task != current)
                 goto unknown;
 
+        if (in_entry_stack(stack, info))
+                goto recursion_check;
+
         if (in_hardirq_stack(stack, info))
                 goto recursion_check;
 
diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
index 88ce2ffdb110..563e28d14f2c 100644
--- a/arch/x86/kernel/dumpstack_64.c
+++ b/arch/x86/kernel/dumpstack_64.c
@@ -37,6 +37,15 @@ const char *stack_type_name(enum stack_type type)
         if (type == STACK_TYPE_IRQ)
                 return "IRQ";
 
+        if (type == STACK_TYPE_ENTRY) {
+                /*
+                 * On 64-bit, we have a generic entry stack that we
+                 * use for all the kernel entry points, including
+                 * SYSENTER.
+                 */
+                return "ENTRY_TRAMPOLINE";
+        }
+
         if (type >= STACK_TYPE_EXCEPTION && type <= STACK_TYPE_EXCEPTION_LAST)
                 return exception_stack_names[type - STACK_TYPE_EXCEPTION];
 
@@ -115,6 +124,9 @@ int get_stack_info(unsigned long *stack, struct task_struct *task,
         if (in_irq_stack(stack, info))
                 goto recursion_check;
 
+        if (in_entry_stack(stack, info))
+                goto recursion_check;
+
         goto unknown;
 
 recursion_check:
diff --git a/arch/x86/kernel/ftrace_32.S b/arch/x86/kernel/ftrace_32.S
index b6c6468e10bc..4c8440de3355 100644
--- a/arch/x86/kernel/ftrace_32.S
+++ b/arch/x86/kernel/ftrace_32.S
@@ -8,6 +8,7 @@
 #include <asm/segment.h>
 #include <asm/export.h>
 #include <asm/ftrace.h>
+#include <asm/nospec-branch.h>
 
 #ifdef CC_USING_FENTRY
 # define function_hook  __fentry__
@@ -197,7 +198,8 @@ ftrace_stub:
         movl    0x4(%ebp), %edx
         subl    $MCOUNT_INSN_SIZE, %eax
 
-        call    *ftrace_trace_function
+        movl    ftrace_trace_function, %ecx
+        CALL_NOSPEC %ecx
 
         popl    %edx
         popl    %ecx
@@ -241,5 +243,5 @@ return_to_handler:
         movl    %eax, %ecx
         popl    %edx
         popl    %eax
-        jmp     *%ecx
+        JMP_NOSPEC %ecx
 #endif
diff --git a/arch/x86/kernel/ftrace_64.S b/arch/x86/kernel/ftrace_64.S
index c832291d948a..91b2cff4b79a 100644
--- a/arch/x86/kernel/ftrace_64.S
+++ b/arch/x86/kernel/ftrace_64.S
@@ -7,7 +7,8 @@
 #include <asm/ptrace.h>
 #include <asm/ftrace.h>
 #include <asm/export.h>
-
+#include <asm/nospec-branch.h>
+#include <asm/unwind_hints.h>
 
         .code64
         .section .entry.text, "ax"
@@ -20,7 +21,6 @@ EXPORT_SYMBOL(__fentry__)
 EXPORT_SYMBOL(mcount)
 #endif
 
-/* All cases save the original rbp (8 bytes) */
 #ifdef CONFIG_FRAME_POINTER
 # ifdef CC_USING_FENTRY
 /* Save parent and function stack frames (rip and rbp) */
@@ -31,7 +31,7 @@ EXPORT_SYMBOL(mcount)
 # endif
 #else
 /* No need to save a stack frame */
-# define MCOUNT_FRAME_SIZE      8
+# define MCOUNT_FRAME_SIZE      0
 #endif /* CONFIG_FRAME_POINTER */
 
 /* Size of stack used to save mcount regs in save_mcount_regs */
@@ -64,10 +64,10 @@ EXPORT_SYMBOL(mcount)
  */
 .macro save_mcount_regs added=0
 
-        /* Always save the original rbp */
+#ifdef CONFIG_FRAME_POINTER
+        /* Save the original rbp */
         pushq %rbp
 
-#ifdef CONFIG_FRAME_POINTER
         /*
          * Stack traces will stop at the ftrace trampoline if the frame pointer
          * is not set up properly. If fentry is used, we need to save a frame
@@ -105,7 +105,11 @@ EXPORT_SYMBOL(mcount)
          * Save the original RBP. Even though the mcount ABI does not
          * require this, it helps out callers.
          */
+#ifdef CONFIG_FRAME_POINTER
         movq MCOUNT_REG_SIZE-8(%rsp), %rdx
+#else
+        movq %rbp, %rdx
+#endif
         movq %rdx, RBP(%rsp)
 
         /* Copy the parent address into %rsi (second parameter) */
@@ -148,7 +152,7 @@ EXPORT_SYMBOL(mcount)
 
 ENTRY(function_hook)
         retq
-END(function_hook)
+ENDPROC(function_hook)
 
 ENTRY(ftrace_caller)
         /* save_mcount_regs fills in first two parameters */
@@ -184,7 +188,7 @@ GLOBAL(ftrace_graph_call)
 /* This is weak to keep gas from relaxing the jumps */
 WEAK(ftrace_stub)
         retq
-END(ftrace_caller)
+ENDPROC(ftrace_caller)
 
 ENTRY(ftrace_regs_caller)
         /* Save the current flags before any operations that can change them */
@@ -255,7 +259,7 @@ GLOBAL(ftrace_regs_caller_end)
 
         jmp ftrace_epilogue
 
-END(ftrace_regs_caller)
+ENDPROC(ftrace_regs_caller)
 
 
 #else /* ! CONFIG_DYNAMIC_FTRACE */
@@ -286,12 +290,12 @@ trace:
          * ip and parent ip are used and the list function is called when
          * function tracing is enabled.
          */
-        call   *ftrace_trace_function
-
+        movq ftrace_trace_function, %r8
+        CALL_NOSPEC %r8
         restore_mcount_regs
 
         jmp fgraph_trace
-END(function_hook)
+ENDPROC(function_hook)
 #endif /* CONFIG_DYNAMIC_FTRACE */
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
@@ -313,9 +317,10 @@ ENTRY(ftrace_graph_caller)
         restore_mcount_regs
 
         retq
-END(ftrace_graph_caller)
+ENDPROC(ftrace_graph_caller)
 
-GLOBAL(return_to_handler)
+ENTRY(return_to_handler)
+        UNWIND_HINT_EMPTY
         subq  $24, %rsp
 
         /* Save the return values */
@@ -329,5 +334,6 @@ GLOBAL(return_to_handler)
         movq 8(%rsp), %rdx
         movq (%rsp), %rax
         addq $24, %rsp
-        jmp *%rdi
+        JMP_NOSPEC %rdi
+END(return_to_handler)
 #endif
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 6a5d757b9cfd..7ba5d819ebe3 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -157,8 +157,8 @@ unsigned long __head __startup_64(unsigned long physaddr,
         p = fixup_pointer(&phys_base, physaddr);
         *p += load_delta - sme_get_me_mask();
 
-        /* Encrypt the kernel (if SME is active) */
-        sme_encrypt_kernel();
+        /* Encrypt the kernel and related (if SME is active) */
+        sme_encrypt_kernel(bp);
 
         /*
          * Return the SME encryption mask (if SME is active) to be used as a
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index 7dca675fe78d..04a625f0fcda 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -341,6 +341,27 @@ GLOBAL(early_recursion_flag)
         .balign PAGE_SIZE; \
 GLOBAL(name)
 
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+/*
+ * Each PGD needs to be 8k long and 8k aligned.  We do not
+ * ever go out to userspace with these, so we do not
+ * strictly *need* the second page, but this allows us to
+ * have a single set_pgd() implementation that does not
+ * need to worry about whether it has 4k or 8k to work
+ * with.
+ *
+ * This ensures PGDs are 8k long:
+ */
+#define PTI_USER_PGD_FILL       512
+/* This ensures they are 8k-aligned: */
+#define NEXT_PGD_PAGE(name) \
+        .balign 2 * PAGE_SIZE; \
+GLOBAL(name)
+#else
+#define NEXT_PGD_PAGE(name) NEXT_PAGE(name)
+#define PTI_USER_PGD_FILL       0
+#endif
+
 /* Automate the creation of 1 to 1 mapping pmd entries */
 #define PMDS(START, PERM, COUNT)                        \
         i = 0 ;                                         \
@@ -350,13 +371,14 @@ GLOBAL(name)
         .endr
 
         __INITDATA
-NEXT_PAGE(early_top_pgt)
+NEXT_PGD_PAGE(early_top_pgt)
         .fill   511,8,0
 #ifdef CONFIG_X86_5LEVEL
         .quad   level4_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE_NOENC
 #else
         .quad   level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE_NOENC
 #endif
+        .fill   PTI_USER_PGD_FILL,8,0
 
 NEXT_PAGE(early_dynamic_pgts)
         .fill   512*EARLY_DYNAMIC_PAGE_TABLES,8,0
@@ -364,13 +386,14 @@ NEXT_PAGE(early_dynamic_pgts)
         .data
 
 #if defined(CONFIG_XEN_PV) || defined(CONFIG_XEN_PVH)
-NEXT_PAGE(init_top_pgt)
+NEXT_PGD_PAGE(init_top_pgt)
         .quad   level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE_NOENC
         .org    init_top_pgt + PGD_PAGE_OFFSET*8, 0
         .quad   level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE_NOENC
         .org    init_top_pgt + PGD_START_KERNEL*8, 0
         /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
         .quad   level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE_NOENC
+        .fill   PTI_USER_PGD_FILL,8,0
 
 NEXT_PAGE(level3_ident_pgt)
         .quad   level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE_NOENC
@@ -381,8 +404,9 @@ NEXT_PAGE(level2_ident_pgt)
          */
         PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
 #else
-NEXT_PAGE(init_top_pgt)
+NEXT_PGD_PAGE(init_top_pgt)
         .fill   512,8,0
+        .fill   PTI_USER_PGD_FILL,8,0
 #endif
 
 #ifdef CONFIG_X86_5LEVEL
diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c
index d985cef3984f..56d99be3706a 100644
--- a/arch/x86/kernel/idt.c
+++ b/arch/x86/kernel/idt.c
@@ -56,7 +56,7 @@ struct idt_data {
  * Early traps running on the DEFAULT_STACK because the other interrupt
  * stacks work only after cpu_init().
  */
-static const __initdata struct idt_data early_idts[] = {
+static const __initconst struct idt_data early_idts[] = {
         INTG(X86_TRAP_DB,               debug),
         SYSG(X86_TRAP_BP,               int3),
 #ifdef CONFIG_X86_32
@@ -70,7 +70,7 @@ static const __initdata struct idt_data early_idts[] = {
  * the traps which use them are reinitialized with IST after cpu_init() has
  * set up TSS.
  */
-static const __initdata struct idt_data def_idts[] = {
+static const __initconst struct idt_data def_idts[] = {
         INTG(X86_TRAP_DE,               divide_error),
         INTG(X86_TRAP_NMI,              nmi),
         INTG(X86_TRAP_BR,               bounds),
@@ -108,7 +108,7 @@ static const __initdata struct idt_data def_idts[] = {
 /*
  * The APIC and SMP idt entries
  */
-static const __initdata struct idt_data apic_idts[] = {
+static const __initconst struct idt_data apic_idts[] = {
 #ifdef CONFIG_SMP
         INTG(RESCHEDULE_VECTOR,         reschedule_interrupt),
         INTG(CALL_FUNCTION_VECTOR,      call_function_interrupt),
@@ -150,7 +150,7 @@ static const __initdata struct idt_data apic_idts[] = {
  * Early traps running on the DEFAULT_STACK because the other interrupt
  * stacks work only after cpu_init().
  */
-static const __initdata struct idt_data early_pf_idts[] = {
+static const __initconst struct idt_data early_pf_idts[] = {
         INTG(X86_TRAP_PF,               page_fault),
 };
 
@@ -158,7 +158,7 @@ static const __initdata struct idt_data early_pf_idts[] = {
  * Override for the debug_idt. Same as the default, but with interrupt
  * stack set to DEFAULT_STACK (0). Required for NMI trap handling.
  */
-static const __initdata struct idt_data dbg_idts[] = {
+static const __initconst struct idt_data dbg_idts[] = {
         INTG(X86_TRAP_DB,       debug),
         INTG(X86_TRAP_BP,       int3),
 };
@@ -180,7 +180,7 @@ gate_desc debug_idt_table[IDT_ENTRIES] __page_aligned_bss;
  * The exceptions which use Interrupt stacks. They are setup after
  * cpu_init() when the TSS has been initialized.
  */
-static const __initdata struct idt_data ist_idts[] = {
+static const __initconst struct idt_data ist_idts[] = {
         ISTG(X86_TRAP_DB,       debug,          DEBUG_STACK),
         ISTG(X86_TRAP_NMI,      nmi,            NMI_STACK),
         SISTG(X86_TRAP_BP,      int3,           DEBUG_STACK),
diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
index 3feb648781c4..2f723301eb58 100644
--- a/arch/x86/kernel/ioport.c
+++ b/arch/x86/kernel/ioport.c
@@ -67,7 +67,7 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
          * because the ->io_bitmap_max value must match the bitmap
          * contents:
          */
-        tss = &per_cpu(cpu_tss, get_cpu());
+        tss = &per_cpu(cpu_tss_rw, get_cpu());
 
         if (turn_on)
                 bitmap_clear(t->io_bitmap_ptr, from, num);
diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index 49cfd9fe7589..68e1867cca80 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -219,18 +219,6 @@ __visible unsigned int __irq_entry do_IRQ(struct pt_regs *regs)
         /* high bit used in ret_from_ code  */
         unsigned vector = ~regs->orig_ax;
 
-        /*
-         * NB: Unlike exception entries, IRQ entries do not reliably
-         * handle context tracking in the low-level entry code.  This is
-         * because syscall entries execute briefly with IRQs on before
-         * updating context tracking state, so we can take an IRQ from
-         * kernel mode with CONTEXT_USER.  The low-level entry code only
-         * updates the context if we came from user mode, so we won't
-         * switch to CONTEXT_KERNEL.  We'll fix that once the syscall
-         * code is cleaned up enough that we can cleanly defer enabling
-         * IRQs.
-         */
-
         entering_irq();
 
         /* entering_irq() tells RCU that we're not quiescent.  Check it. */
diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
index a83b3346a0e1..c1bdbd3d3232 100644
--- a/arch/x86/kernel/irq_32.c
+++ b/arch/x86/kernel/irq_32.c
@@ -20,6 +20,7 @@
 #include <linux/mm.h>
 
 #include <asm/apic.h>
+#include <asm/nospec-branch.h>
 
 #ifdef CONFIG_DEBUG_STACKOVERFLOW
 
@@ -55,11 +56,11 @@ DEFINE_PER_CPU(struct irq_stack *, softirq_stack);
 static void call_on_stack(void *func, void *stack)
 {
         asm volatile("xchgl     %%ebx,%%esp     \n"
-                     "call      *%%edi          \n"
+                     CALL_NOSPEC
                      "movl      %%ebx,%%esp     \n"
                      : "=b" (stack)
                      : "0" (stack),
-                       "D"(func)
+                       [thunk_target] "D"(func)
                      : "memory", "cc", "edx", "ecx", "eax");
 }
 
@@ -95,11 +96,11 @@ static inline int execute_on_irq_stack(int overflow, struct irq_desc *desc)
                 call_on_stack(print_stack_overflow, isp);
 
         asm volatile("xchgl     %%ebx,%%esp     \n"
-                     "call      *%%edi          \n"
+                     CALL_NOSPEC
                      "movl      %%ebx,%%esp     \n"
                      : "=a" (arg1), "=b" (isp)
                      :  "0" (desc),   "1" (isp),
-                        "D" (desc->handle_irq)
+                        [thunk_target] "D" (desc->handle_irq)
                      : "memory", "cc", "ecx");
         return 1;
 }
diff --git a/arch/x86/kernel/irq_64.c b/arch/x86/kernel/irq_64.c
index 020efbf5786b..d86e344f5b3d 100644
--- a/arch/x86/kernel/irq_64.c
+++ b/arch/x86/kernel/irq_64.c
@@ -57,10 +57,10 @@ static inline void stack_overflow_check(struct pt_regs *regs)
         if (regs->sp >= estack_top && regs->sp <= estack_bottom)
                 return;
 
-        WARN_ONCE(1, "do_IRQ(): %s has overflown the kernel stack (cur:%Lx,sp:%lx,irq stk top-bottom:%Lx-%Lx,exception stk top-bottom:%Lx-%Lx)\n",
+        WARN_ONCE(1, "do_IRQ(): %s has overflown the kernel stack (cur:%Lx,sp:%lx,irq stk top-bottom:%Lx-%Lx,exception stk top-bottom:%Lx-%Lx,ip:%pF)\n",
                 current->comm, curbase, regs->sp,
                 irq_stack_top, irq_stack_bottom,
-                estack_top, estack_bottom);
+                estack_top, estack_bottom, (void *)regs->ip);
 
         if (sysctl_panic_on_stackoverflow)
                 panic("low stack detected by irq handler - check messages\n");
diff --git a/arch/x86/kernel/irqinit.c b/arch/x86/kernel/irqinit.c
index 8da3e909e967..a539410c4ea9 100644
--- a/arch/x86/kernel/irqinit.c
+++ b/arch/x86/kernel/irqinit.c
@@ -61,6 +61,9 @@ void __init init_ISA_irqs(void)
         struct irq_chip *chip = legacy_pic->chip;
         int i;
 
+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_LOCAL_APIC)
+        init_bsp_APIC();
+#endif
         legacy_pic->init(0);
 
         for (i = 0; i < nr_legacy_irqs(); i++)
diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
index e941136e24d8..203d398802a3 100644
--- a/arch/x86/kernel/kprobes/opt.c
+++ b/arch/x86/kernel/kprobes/opt.c
@@ -40,6 +40,7 @@
 #include <asm/debugreg.h>
 #include <asm/set_memory.h>
 #include <asm/sections.h>
+#include <asm/nospec-branch.h>
 
 #include "common.h"
 
@@ -203,7 +204,7 @@ static int copy_optimized_instructions(u8 *dest, u8 *src, u8 *real)
 }
 
 /* Check whether insn is indirect jump */
-static int insn_is_indirect_jump(struct insn *insn)
+static int __insn_is_indirect_jump(struct insn *insn)
 {
         return ((insn->opcode.bytes[0] == 0xff &&
                 (X86_MODRM_REG(insn->modrm.value) & 6) == 4) || /* Jump */
@@ -237,6 +238,26 @@ static int insn_jump_into_range(struct insn *insn, unsigned long start, int len)
         return (start <= target && target <= start + len);
 }
 
+static int insn_is_indirect_jump(struct insn *insn)
+{
+        int ret = __insn_is_indirect_jump(insn);
+
+#ifdef CONFIG_RETPOLINE
+        /*
+         * Jump to x86_indirect_thunk_* is treated as an indirect jump.
+         * Note that even with CONFIG_RETPOLINE=y, the kernel compiled with
+         * older gcc may use indirect jump. So we add this check instead of
+         * replace indirect-jump check.
+         */
+        if (!ret)
+                ret = insn_jump_into_range(insn,
+                                (unsigned long)__indirect_thunk_start,
+                                (unsigned long)__indirect_thunk_end -
+                                (unsigned long)__indirect_thunk_start);
+#endif
+        return ret;
+}
+
 /* Decode whole function to ensure any instructions don't jump into target */
 static int can_optimize(unsigned long paddr)
 {
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index 1c1eae961340..26d713ecad34 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -5,6 +5,11 @@
  * Copyright (C) 2002 Andi Kleen
  *
  * This handles calls from both 32bit and 64bit mode.
+ *
+ * Lock order:
+ *      contex.ldt_usr_sem
+ *        mmap_sem
+ *          context.lock
  */
 
 #include <linux/errno.h>
@@ -19,6 +24,7 @@
 #include <linux/uaccess.h>
 
 #include <asm/ldt.h>
+#include <asm/tlb.h>
 #include <asm/desc.h>
 #include <asm/mmu_context.h>
 #include <asm/syscalls.h>
@@ -42,17 +48,15 @@ static void refresh_ldt_segments(void)
 #endif
 }
 
-/* context.lock is held for us, so we don't need any locking. */
+/* context.lock is held by the task which issued the smp function call */
 static void flush_ldt(void *__mm)
 {
         struct mm_struct *mm = __mm;
-        mm_context_t *pc;
 
         if (this_cpu_read(cpu_tlbstate.loaded_mm) != mm)
                 return;
 
-        pc = &mm->context;
-        set_ldt(pc->ldt->entries, pc->ldt->nr_entries);
+        load_mm_ldt(mm);
 
         refresh_ldt_segments();
 }
@@ -89,25 +93,143 @@ static struct ldt_struct *alloc_ldt_struct(unsigned int num_entries)
                 return NULL;
         }
 
+        /* The new LDT isn't aliased for PTI yet. */
+        new_ldt->slot = -1;
+
         new_ldt->nr_entries = num_entries;
         return new_ldt;
 }
 
+/*
+ * If PTI is enabled, this maps the LDT into the kernelmode and
+ * usermode tables for the given mm.
+ *
+ * There is no corresponding unmap function.  Even if the LDT is freed, we
+ * leave the PTEs around until the slot is reused or the mm is destroyed.
+ * This is harmless: the LDT is always in ordinary memory, and no one will
+ * access the freed slot.
+ *
+ * If we wanted to unmap freed LDTs, we'd also need to do a flush to make
+ * it useful, and the flush would slow down modify_ldt().
+ */
+static int
+map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
+{
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+        bool is_vmalloc, had_top_level_entry;
+        unsigned long va;
+        spinlock_t *ptl;
+        pgd_t *pgd;
+        int i;
+
+        if (!static_cpu_has(X86_FEATURE_PTI))
+                return 0;
+
+        /*
+         * Any given ldt_struct should have map_ldt_struct() called at most
+         * once.
+         */
+        WARN_ON(ldt->slot != -1);
+
+        /*
+         * Did we already have the top level entry allocated?  We can't
+         * use pgd_none() for this because it doens't do anything on
+         * 4-level page table kernels.
+         */
+        pgd = pgd_offset(mm, LDT_BASE_ADDR);
+        had_top_level_entry = (pgd->pgd != 0);
+
+        is_vmalloc = is_vmalloc_addr(ldt->entries);
+
+        for (i = 0; i * PAGE_SIZE < ldt->nr_entries * LDT_ENTRY_SIZE; i++) {
+                unsigned long offset = i << PAGE_SHIFT;
+                const void *src = (char *)ldt->entries + offset;
+                unsigned long pfn;
+                pte_t pte, *ptep;
+
+                va = (unsigned long)ldt_slot_va(slot) + offset;
+                pfn = is_vmalloc ? vmalloc_to_pfn(src) :
+                        page_to_pfn(virt_to_page(src));
+                /*
+                 * Treat the PTI LDT range as a *userspace* range.
+                 * get_locked_pte() will allocate all needed pagetables
+                 * and account for them in this mm.
+                 */
+                ptep = get_locked_pte(mm, va, &ptl);
+                if (!ptep)
+                        return -ENOMEM;
+                /*
+                 * Map it RO so the easy to find address is not a primary
+                 * target via some kernel interface which misses a
+                 * permission check.
+                 */
+                pte = pfn_pte(pfn, __pgprot(__PAGE_KERNEL_RO & ~_PAGE_GLOBAL));
+                set_pte_at(mm, va, ptep, pte);
+                pte_unmap_unlock(ptep, ptl);
+        }
+
+        if (mm->context.ldt) {
+                /*
+                 * We already had an LDT.  The top-level entry should already
+                 * have been allocated and synchronized with the usermode
+                 * tables.
+                 */
+                WARN_ON(!had_top_level_entry);
+                if (static_cpu_has(X86_FEATURE_PTI))
+                        WARN_ON(!kernel_to_user_pgdp(pgd)->pgd);
+        } else {
+                /*
+                 * This is the first time we're mapping an LDT for this process.
+                 * Sync the pgd to the usermode tables.
+                 */
+                WARN_ON(had_top_level_entry);
+                if (static_cpu_has(X86_FEATURE_PTI)) {
+                        WARN_ON(kernel_to_user_pgdp(pgd)->pgd);
+                        set_pgd(kernel_to_user_pgdp(pgd), *pgd);
+                }
+        }
+
+        va = (unsigned long)ldt_slot_va(slot);
+        flush_tlb_mm_range(mm, va, va + LDT_SLOT_STRIDE, 0);
+
+        ldt->slot = slot;
+#endif
+        return 0;
+}
+
+static void free_ldt_pgtables(struct mm_struct *mm)
+{
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+        struct mmu_gather tlb;
+        unsigned long start = LDT_BASE_ADDR;
+        unsigned long end = start + (1UL << PGDIR_SHIFT);
+
+        if (!static_cpu_has(X86_FEATURE_PTI))
+                return;
+
+        tlb_gather_mmu(&tlb, mm, start, end);
+        free_pgd_range(&tlb, start, end, start, end);
+        tlb_finish_mmu(&tlb, start, end);
+#endif
+}
+
 /* After calling this, the LDT is immutable. */
 static void finalize_ldt_struct(struct ldt_struct *ldt)
 {
         paravirt_alloc_ldt(ldt->entries, ldt->nr_entries);
 }
 
-/* context.lock is held */
-static void install_ldt(struct mm_struct *current_mm,
-                        struct ldt_struct *ldt)
+static void install_ldt(struct mm_struct *mm, struct ldt_struct *ldt)
 {
+        mutex_lock(&mm->context.lock);
+
         /* Synchronizes with READ_ONCE in load_mm_ldt. */
-        smp_store_release(&current_mm->context.ldt, ldt);
+        smp_store_release(&mm->context.ldt, ldt);
 
-        /* Activate the LDT for all CPUs using current_mm. */
-        on_each_cpu_mask(mm_cpumask(current_mm), flush_ldt, current_mm, true);
+        /* Activate the LDT for all CPUs using currents mm. */
+        on_each_cpu_mask(mm_cpumask(mm), flush_ldt, mm, true);
+
+        mutex_unlock(&mm->context.lock);
 }
 
 static void free_ldt_struct(struct ldt_struct *ldt)
@@ -124,27 +246,20 @@ static void free_ldt_struct(struct ldt_struct *ldt)
 }
 
 /*
- * we do not have to muck with descriptors here, that is
- * done in switch_mm() as needed.
+ * Called on fork from arch_dup_mmap(). Just copy the current LDT state,
+ * the new task is not running, so nothing can be installed.
  */
-int init_new_context_ldt(struct task_struct *tsk, struct mm_struct *mm)
+int ldt_dup_context(struct mm_struct *old_mm, struct mm_struct *mm)
 {
         struct ldt_struct *new_ldt;
-        struct mm_struct *old_mm;
         int retval = 0;
 
-        mutex_init(&mm->context.lock);
-        old_mm = current->mm;
-        if (!old_mm) {
-                mm->context.ldt = NULL;
+        if (!old_mm)
                 return 0;
-        }
 
         mutex_lock(&old_mm->context.lock);
-        if (!old_mm->context.ldt) {
-                mm->context.ldt = NULL;
+        if (!old_mm->context.ldt)
                 goto out_unlock;
-        }
 
         new_ldt = alloc_ldt_struct(old_mm->context.ldt->nr_entries);
         if (!new_ldt) {
@@ -156,6 +271,12 @@ int init_new_context_ldt(struct task_struct *tsk, struct mm_struct *mm)
                new_ldt->nr_entries * LDT_ENTRY_SIZE);
         finalize_ldt_struct(new_ldt);
 
+        retval = map_ldt_struct(mm, new_ldt, 0);
+        if (retval) {
+                free_ldt_pgtables(mm);
+                free_ldt_struct(new_ldt);
+                goto out_unlock;
+        }
         mm->context.ldt = new_ldt;
 
 out_unlock:
@@ -174,13 +295,18 @@ void destroy_context_ldt(struct mm_struct *mm)
         mm->context.ldt = NULL;
 }
 
+void ldt_arch_exit_mmap(struct mm_struct *mm)
+{
+        free_ldt_pgtables(mm);
+}
+
 static int read_ldt(void __user *ptr, unsigned long bytecount)
 {
         struct mm_struct *mm = current->mm;
         unsigned long entries_size;
         int retval;
 
-        mutex_lock(&mm->context.lock);
+        down_read(&mm->context.ldt_usr_sem);
 
         if (!mm->context.ldt) {
                 retval = 0;
@@ -209,7 +335,7 @@ static int read_ldt(void __user *ptr, unsigned long bytecount)
         retval = bytecount;
 
 out_unlock:
-        mutex_unlock(&mm->context.lock);
+        up_read(&mm->context.ldt_usr_sem);
         return retval;
 }
 
@@ -269,7 +395,8 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
                         ldt.avl = 0;
         }
 
-        mutex_lock(&mm->context.lock);
+        if (down_write_killable(&mm->context.ldt_usr_sem))
+                return -EINTR;
 
         old_ldt       = mm->context.ldt;
         old_nr_entries = old_ldt ? old_ldt->nr_entries : 0;
@@ -286,12 +413,31 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
         new_ldt->entries[ldt_info.entry_number] = ldt;
         finalize_ldt_struct(new_ldt);
 
+        /*
+         * If we are using PTI, map the new LDT into the userspace pagetables.
+         * If there is already an LDT, use the other slot so that other CPUs
+         * will continue to use the old LDT until install_ldt() switches
+         * them over to the new LDT.
+         */
+        error = map_ldt_struct(mm, new_ldt, old_ldt ? !old_ldt->slot : 0);
+        if (error) {
+                /*
+                 * This only can fail for the first LDT setup. If an LDT is
+                 * already installed then the PTE page is already
+                 * populated. Mop up a half populated page table.
+                 */
+                if (!WARN_ON_ONCE(old_ldt))
+                        free_ldt_pgtables(mm);
+                free_ldt_struct(new_ldt);
+                goto out_unlock;
+        }
+
         install_ldt(mm, new_ldt);
         free_ldt_struct(old_ldt);
         error = 0;
 
 out_unlock:
-        mutex_unlock(&mm->context.lock);
+        up_write(&mm->context.ldt_usr_sem);
 out:
         return error;
 }
diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
index 00bc751c861c..edfede768688 100644
--- a/arch/x86/kernel/machine_kexec_32.c
+++ b/arch/x86/kernel/machine_kexec_32.c
@@ -48,8 +48,6 @@ static void load_segments(void)
                 "\tmovl $"STR(__KERNEL_DS)",%%eax\n"
                 "\tmovl %%eax,%%ds\n"
                 "\tmovl %%eax,%%es\n"
-                "\tmovl %%eax,%%fs\n"
-                "\tmovl %%eax,%%gs\n"
                 "\tmovl %%eax,%%ss\n"
                 : : : "eax", "memory");
 #undef STR
@@ -232,8 +230,8 @@ void machine_kexec(struct kimage *image)
          * The gdt & idt are now invalid.
          * If you want to load them you must set up your own idt & gdt.
          */
-        set_gdt(phys_to_virt(0), 0);
         idt_invalidate(phys_to_virt(0));
+        set_gdt(phys_to_virt(0), 0);
 
         /* now call it */
         image->start = relocate_kernel_ptr((unsigned long)image->head,
diff --git a/arch/x86/kernel/paravirt_patch_64.c b/arch/x86/kernel/paravirt_patch_64.c
index ac0be8283325..9edadabf04f6 100644
--- a/arch/x86/kernel/paravirt_patch_64.c
+++ b/arch/x86/kernel/paravirt_patch_64.c
@@ -10,7 +10,6 @@ DEF_NATIVE(pv_irq_ops, save_fl, "pushfq; popq %rax");
 DEF_NATIVE(pv_mmu_ops, read_cr2, "movq %cr2, %rax");
 DEF_NATIVE(pv_mmu_ops, read_cr3, "movq %cr3, %rax");
 DEF_NATIVE(pv_mmu_ops, write_cr3, "movq %rdi, %cr3");
-DEF_NATIVE(pv_mmu_ops, flush_tlb_single, "invlpg (%rdi)");
 DEF_NATIVE(pv_cpu_ops, wbinvd, "wbinvd");
 
 DEF_NATIVE(pv_cpu_ops, usergs_sysret64, "swapgs; sysretq");
@@ -60,7 +59,6 @@ unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
                 PATCH_SITE(pv_mmu_ops, read_cr2);
                 PATCH_SITE(pv_mmu_ops, read_cr3);
                 PATCH_SITE(pv_mmu_ops, write_cr3);
-                PATCH_SITE(pv_mmu_ops, flush_tlb_single);
                 PATCH_SITE(pv_cpu_ops, wbinvd);
 #if defined(CONFIG_PARAVIRT_SPINLOCKS)
                 case PARAVIRT_PATCH(pv_lock_ops.queued_spin_unlock):
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 97fb3e5737f5..cb368c2a22ab 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -47,7 +47,7 @@
  * section. Since TSS's are completely CPU-local, we want them
  * on exact cacheline boundaries, to eliminate cacheline ping-pong.
  */
-__visible DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, cpu_tss) = {
+__visible DEFINE_PER_CPU_PAGE_ALIGNED(struct tss_struct, cpu_tss_rw) = {
         .x86_tss = {
                 /*
                  * .sp0 is only used when entering ring 0 from a lower
@@ -56,6 +56,16 @@ __visible DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, cpu_tss) = {
                  * Poison it.
                  */
                 .sp0 = (1UL << (BITS_PER_LONG-1)) + 1,
+
+#ifdef CONFIG_X86_64
+                /*
+                 * .sp1 is cpu_current_top_of_stack.  The init task never
+                 * runs user code, but cpu_current_top_of_stack should still
+                 * be well defined before the first context switch.
+                 */
+                .sp1 = TOP_OF_INIT_STACK,
+#endif
+
 #ifdef CONFIG_X86_32
                 .ss0 = __KERNEL_DS,
                 .ss1 = __KERNEL_CS,
@@ -71,11 +81,8 @@ __visible DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, cpu_tss) = {
           */
         .io_bitmap              = { [0 ... IO_BITMAP_LONGS] = ~0 },
 #endif
-#ifdef CONFIG_X86_32
-        .SYSENTER_stack_canary  = STACK_END_MAGIC,
-#endif
 };
-EXPORT_PER_CPU_SYMBOL(cpu_tss);
+EXPORT_PER_CPU_SYMBOL(cpu_tss_rw);
 
 DEFINE_PER_CPU(bool, __tss_limit_invalid);
 EXPORT_PER_CPU_SYMBOL_GPL(__tss_limit_invalid);
@@ -104,7 +111,7 @@ void exit_thread(struct task_struct *tsk)
         struct fpu *fpu = &t->fpu;
 
         if (bp) {
-                struct tss_struct *tss = &per_cpu(cpu_tss, get_cpu());
+                struct tss_struct *tss = &per_cpu(cpu_tss_rw, get_cpu());
 
                 t->io_bitmap_ptr = NULL;
                 clear_thread_flag(TIF_IO_BITMAP);
@@ -299,7 +306,7 @@ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
         }
 
         if ((tifp ^ tifn) & _TIF_NOTSC)
-                cr4_toggle_bits(X86_CR4_TSD);
+                cr4_toggle_bits_irqsoff(X86_CR4_TSD);
 
         if ((tifp ^ tifn) & _TIF_NOCPUID)
                 set_cpuid_faulting(!!(tifn & _TIF_NOCPUID));
@@ -373,19 +380,24 @@ void stop_this_cpu(void *dummy)
         disable_local_APIC();
         mcheck_cpu_clear(this_cpu_ptr(&cpu_info));
 
+        /*
+         * Use wbinvd on processors that support SME. This provides support
+         * for performing a successful kexec when going from SME inactive
+         * to SME active (or vice-versa). The cache must be cleared so that
+         * if there are entries with the same physical address, both with and
+         * without the encryption bit, they don't race each other when flushed
+         * and potentially end up with the wrong entry being committed to
+         * memory.
+         */
+        if (boot_cpu_has(X86_FEATURE_SME))
+                native_wbinvd();
         for (;;) {
                 /*
-                 * Use wbinvd followed by hlt to stop the processor. This
-                 * provides support for kexec on a processor that supports
-                 * SME. With kexec, going from SME inactive to SME active
-                 * requires clearing cache entries so that addresses without
-                 * the encryption bit set don't corrupt the same physical
-                 * address that has the encryption bit set when caches are
-                 * flushed. To achieve this a wbinvd is performed followed by
-                 * a hlt. Even if the processor is not in the kexec/SME
-                 * scenario this only adds a wbinvd to a halting processor.
+                 * Use native_halt() so that memory contents don't change
+                 * (stack usage and variables) after possibly issuing the
+                 * native_wbinvd() above.
                  */
-                asm volatile("wbinvd; hlt" : : : "memory");
+                native_halt();
         }
 }
 
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 45bf0c5f93e1..5224c6099184 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -234,7 +234,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         struct fpu *prev_fpu = &prev->fpu;
         struct fpu *next_fpu = &next->fpu;
         int cpu = smp_processor_id();
-        struct tss_struct *tss = &per_cpu(cpu_tss, cpu);
+        struct tss_struct *tss = &per_cpu(cpu_tss_rw, cpu);
 
         /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
 
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index eeeb34f85c25..c75466232016 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -69,9 +69,8 @@ void __show_regs(struct pt_regs *regs, int all)
         unsigned int fsindex, gsindex;
         unsigned int ds, cs, es;
 
-        printk(KERN_DEFAULT "RIP: %04lx:%pS\n", regs->cs, (void *)regs->ip);
-        printk(KERN_DEFAULT "RSP: %04lx:%016lx EFLAGS: %08lx", regs->ss,
-                regs->sp, regs->flags);
+        show_iret_regs(regs);
+
         if (regs->orig_ax != -1)
                 pr_cont(" ORIG_RAX: %016lx\n", regs->orig_ax);
         else
@@ -88,6 +87,9 @@ void __show_regs(struct pt_regs *regs, int all)
         printk(KERN_DEFAULT "R13: %016lx R14: %016lx R15: %016lx\n",
                regs->r13, regs->r14, regs->r15);
 
+        if (!all)
+                return;
+
         asm("movl %%ds,%0" : "=r" (ds));
         asm("movl %%cs,%0" : "=r" (cs));
         asm("movl %%es,%0" : "=r" (es));
@@ -98,9 +100,6 @@ void __show_regs(struct pt_regs *regs, int all)
         rdmsrl(MSR_GS_BASE, gs);
         rdmsrl(MSR_KERNEL_GS_BASE, shadowgs);
 
-        if (!all)
-                return;
-
         cr0 = read_cr0();
         cr2 = read_cr2();
         cr3 = __read_cr3();
@@ -400,7 +399,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         struct fpu *prev_fpu = &prev->fpu;
         struct fpu *next_fpu = &next->fpu;
         int cpu = smp_processor_id();
-        struct tss_struct *tss = &per_cpu(cpu_tss, cpu);
+        struct tss_struct *tss = &per_cpu(cpu_tss_rw, cpu);
 
         WARN_ON_ONCE(IS_ENABLED(CONFIG_DEBUG_ENTRY) &&
                      this_cpu_read(irq_count) != -1);
@@ -462,6 +461,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
          * Switch the PDA and FPU contexts.
          */
         this_cpu_write(current_task, next_p);
+        this_cpu_write(cpu_current_top_of_stack, task_top_of_stack(next_p));
 
         /* Reload sp0. */
         update_sp0(next_p);
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 8af2e8d0c0a1..68d7ab81c62f 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -364,16 +364,6 @@ static void __init reserve_initrd(void)
             !ramdisk_image || !ramdisk_size)
                 return;         /* No initrd provided by bootloader */
 
-        /*
-         * If SME is active, this memory will be marked encrypted by the
-         * kernel when it is accessed (including relocation). However, the
-         * ramdisk image was loaded decrypted by the bootloader, so make
-         * sure that it is encrypted before accessing it. For SEV the
-         * ramdisk will already be encrypted, so only do this for SME.
-         */
-        if (sme_active())
-                sme_early_encrypt(ramdisk_image, ramdisk_end - ramdisk_image);
-
         initrd_start = 0;
 
         mapped_size = memblock_mem_size(max_pfn_mapped);
@@ -906,9 +896,6 @@ void __init setup_arch(char **cmdline_p)
                 set_bit(EFI_BOOT, &efi.flags);
                 set_bit(EFI_64BIT, &efi.flags);
         }
-
-        if (efi_enabled(EFI_BOOT))
-                efi_memblock_x86_reserve_range();
 #endif
 
         x86_init.oem.arch_setup();
@@ -962,6 +949,8 @@ void __init setup_arch(char **cmdline_p)
 
         parse_early_param();
 
+        if (efi_enabled(EFI_BOOT))
+                efi_memblock_x86_reserve_range();
 #ifdef CONFIG_MEMORY_HOTPLUG
         /*
          * Memory used by the kernel cannot be hot-removed because Linux
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 3d01df7d7cf6..ed556d50d7ed 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -106,7 +106,7 @@ EXPORT_SYMBOL(__max_logical_packages);
 static unsigned int logical_packages __read_mostly;
 
 /* Maximum number of SMT threads on any online core */
-int __max_smt_threads __read_mostly;
+int __read_mostly __max_smt_threads = 1;
 
 /* Flag to indicate if a complete sched domain rebuild is required */
 bool x86_topology_update;
@@ -126,14 +126,10 @@ static inline void smpboot_setup_warm_reset_vector(unsigned long start_eip)
         spin_lock_irqsave(&rtc_lock, flags);
         CMOS_WRITE(0xa, 0xf);
         spin_unlock_irqrestore(&rtc_lock, flags);
-        local_flush_tlb();
-        pr_debug("1.\n");
         *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_HIGH)) =
                                                         start_eip >> 4;
-        pr_debug("2.\n");
         *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_LOW)) =
                                                         start_eip & 0xf;
-        pr_debug("3.\n");
 }
 
 static inline void smpboot_restore_warm_reset_vector(void)
@@ -141,11 +137,6 @@ static inline void smpboot_restore_warm_reset_vector(void)
         unsigned long flags;
 
         /*
-         * Install writable page 0 entry to set BIOS data area.
-         */
-        local_flush_tlb();
-
-        /*
          * Paranoid:  Set warm reset code and vector here back
          * to default values.
          */
@@ -237,7 +228,7 @@ static void notrace start_secondary(void *unused)
         load_cr3(swapper_pg_dir);
         __flush_tlb_all();
 #endif
-
+        load_current_idt();
         cpu_init();
         x86_cpuinit.early_percpu_clock_init();
         preempt_disable();
@@ -932,12 +923,8 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle,
         initial_code = (unsigned long)start_secondary;
         initial_stack  = idle->thread.sp;
 
-        /*
-         * Enable the espfix hack for this CPU
-        */
-#ifdef CONFIG_X86_ESPFIX64
+        /* Enable the espfix hack for this CPU */
         init_espfix_ap(cpu);
-#endif
 
         /* So we see what's up */
         announce_cpu(cpu, apicid);
@@ -1304,7 +1291,7 @@ void __init native_smp_cpus_done(unsigned int max_cpus)
          * Today neither Intel nor AMD support heterogenous systems so
          * extrapolate the boot cpu's data to all packages.
          */
-        ncpus = cpu_data(0).booted_cores * smp_num_siblings;
+        ncpus = cpu_data(0).booted_cores * topology_max_smt_threads();
         __max_logical_packages = DIV_ROUND_UP(nr_cpu_ids, ncpus);
         pr_info("Max logical packages: %u\n", __max_logical_packages);
 
diff --git a/arch/x86/kernel/stacktrace.c b/arch/x86/kernel/stacktrace.c
index 77835bc021c7..093f2ea5dd56 100644
--- a/arch/x86/kernel/stacktrace.c
+++ b/arch/x86/kernel/stacktrace.c
@@ -102,7 +102,7 @@ __save_stack_trace_reliable(struct stack_trace *trace,
         for (unwind_start(&state, task, NULL, NULL); !unwind_done(&state);
              unwind_next_frame(&state)) {
 
-                regs = unwind_get_entry_regs(&state);
+                regs = unwind_get_entry_regs(&state, NULL);
                 if (regs) {
                         /*
                          * Kernel mode registers on the stack indicate an
@@ -164,8 +164,12 @@ int save_stack_trace_tsk_reliable(struct task_struct *tsk,
 {
         int ret;
 
+        /*
+         * If the task doesn't have a stack (e.g., a zombie), the stack is
+         * "reliably" empty.
+         */
         if (!try_get_task_stack(tsk))
-                return -EINVAL;
+                return 0;
 
         ret = __save_stack_trace_reliable(trace, tsk);
 
diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
index a4eb27918ceb..a2486f444073 100644
--- a/arch/x86/kernel/tboot.c
+++ b/arch/x86/kernel/tboot.c
@@ -138,6 +138,17 @@ static int map_tboot_page(unsigned long vaddr, unsigned long pfn,
                 return -1;
         set_pte_at(&tboot_mm, vaddr, pte, pfn_pte(pfn, prot));
         pte_unmap(pte);
+
+        /*
+         * PTI poisons low addresses in the kernel page tables in the
+         * name of making them unusable for userspace.  To execute
+         * code at such a low address, the poison must be cleared.
+         *
+         * Note: 'pgd' actually gets set in p4d_alloc() _or_
+         * pud_alloc() depending on 4/5-level paging.
+         */
+        pgd->pgd &= ~_PAGE_NX;
+
         return 0;
 }
 
diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
index 9a9c9b076955..a5b802a12212 100644
--- a/arch/x86/kernel/tls.c
+++ b/arch/x86/kernel/tls.c
@@ -93,17 +93,10 @@ static void set_tls_desc(struct task_struct *p, int idx,
         cpu = get_cpu();
 
         while (n-- > 0) {
-                if (LDT_empty(info) || LDT_zero(info)) {
+                if (LDT_empty(info) || LDT_zero(info))
                         memset(desc, 0, sizeof(*desc));
-                } else {
+                else
                         fill_ldt(desc, info);
-
-                        /*
-                         * Always set the accessed bit so that the CPU
-                         * doesn't try to write to the (read-only) GDT.
-                         */
-                        desc->type |= 1;
-                }
                 ++info;
                 ++desc;
         }
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 989514c94a55..446c9ef8cfc3 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -51,6 +51,7 @@
 #include <asm/traps.h>
 #include <asm/desc.h>
 #include <asm/fpu/internal.h>
+#include <asm/cpu_entry_area.h>
 #include <asm/mce.h>
 #include <asm/fixmap.h>
 #include <asm/mach_traps.h>
@@ -348,23 +349,42 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
 
         /*
          * If IRET takes a non-IST fault on the espfix64 stack, then we
-         * end up promoting it to a doublefault.  In that case, modify
-         * the stack to make it look like we just entered the #GP
-         * handler from user space, similar to bad_iret.
+         * end up promoting it to a doublefault.  In that case, take
+         * advantage of the fact that we're not using the normal (TSS.sp0)
+         * stack right now.  We can write a fake #GP(0) frame at TSS.sp0
+         * and then modify our own IRET frame so that, when we return,
+         * we land directly at the #GP(0) vector with the stack already
+         * set up according to its expectations.
+         *
+         * The net result is that our #GP handler will think that we
+         * entered from usermode with the bad user context.
          *
          * No need for ist_enter here because we don't use RCU.
          */
-        if (((long)regs->sp >> PGDIR_SHIFT) == ESPFIX_PGD_ENTRY &&
+        if (((long)regs->sp >> P4D_SHIFT) == ESPFIX_PGD_ENTRY &&
                 regs->cs == __KERNEL_CS &&
                 regs->ip == (unsigned long)native_irq_return_iret)
         {
-                struct pt_regs *normal_regs = task_pt_regs(current);
+                struct pt_regs *gpregs = (struct pt_regs *)this_cpu_read(cpu_tss_rw.x86_tss.sp0) - 1;
 
-                /* Fake a #GP(0) from userspace. */
-                memmove(&normal_regs->ip, (void *)regs->sp, 5*8);
-                normal_regs->orig_ax = 0;  /* Missing (lost) #GP error code */
+                /*
+                 * regs->sp points to the failing IRET frame on the
+                 * ESPFIX64 stack.  Copy it to the entry stack.  This fills
+                 * in gpregs->ss through gpregs->ip.
+                 *
+                 */
+                memmove(&gpregs->ip, (void *)regs->sp, 5*8);
+                gpregs->orig_ax = 0;  /* Missing (lost) #GP error code */
+
+                /*
+                 * Adjust our frame so that we return straight to the #GP
+                 * vector with the expected RSP value.  This is safe because
+                 * we won't enable interupts or schedule before we invoke
+                 * general_protection, so nothing will clobber the stack
+                 * frame we just set up.
+                 */
                 regs->ip = (unsigned long)general_protection;
-                regs->sp = (unsigned long)&normal_regs->orig_ax;
+                regs->sp = (unsigned long)&gpregs->orig_ax;
 
                 return;
         }
@@ -389,7 +409,7 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
          *
          *   Processors update CR2 whenever a page fault is detected. If a
          *   second page fault occurs while an earlier page fault is being
-         *   deliv- ered, the faulting linear address of the second fault will
+         *   delivered, the faulting linear address of the second fault will
          *   overwrite the contents of CR2 (replacing the previous
          *   address). These updates to CR2 occur even if the page fault
          *   results in a double fault or occurs during the delivery of a
@@ -605,14 +625,15 @@ NOKPROBE_SYMBOL(do_int3);
 
 #ifdef CONFIG_X86_64
 /*
- * Help handler running on IST stack to switch off the IST stack if the
- * interrupted code was in user mode. The actual stack switch is done in
- * entry_64.S
+ * Help handler running on a per-cpu (IST or entry trampoline) stack
+ * to switch to the normal thread stack if the interrupted code was in
+ * user mode. The actual stack switch is done in entry_64.S
  */
 asmlinkage __visible notrace struct pt_regs *sync_regs(struct pt_regs *eregs)
 {
-        struct pt_regs *regs = task_pt_regs(current);
-        *regs = *eregs;
+        struct pt_regs *regs = (struct pt_regs *)this_cpu_read(cpu_current_top_of_stack) - 1;
+        if (regs != eregs)
+                *regs = *eregs;
         return regs;
 }
 NOKPROBE_SYMBOL(sync_regs);
@@ -628,13 +649,13 @@ struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
         /*
          * This is called from entry_64.S early in handling a fault
          * caused by a bad iret to user mode.  To handle the fault
-         * correctly, we want move our stack frame to task_pt_regs
-         * and we want to pretend that the exception came from the
-         * iret target.
+         * correctly, we want to move our stack frame to where it would
+         * be had we entered directly on the entry stack (rather than
+         * just below the IRET frame) and we want to pretend that the
+         * exception came from the IRET target.
          */
         struct bad_iret_stack *new_stack =
-                container_of(task_pt_regs(current),
-                             struct bad_iret_stack, regs);
+                (struct bad_iret_stack *)this_cpu_read(cpu_tss_rw.x86_tss.sp0) - 1;
 
         /* Copy the IRET target to the new stack. */
         memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8);
@@ -795,14 +816,6 @@ dotraplinkage void do_debug(struct pt_regs *regs, long error_code)
         debug_stack_usage_dec();
 
 exit:
-#if defined(CONFIG_X86_32)
-        /*
-         * This is the most likely code path that involves non-trivial use
-         * of the SYSENTER stack.  Check that we haven't overrun it.
-         */
-        WARN(this_cpu_read(cpu_tss.SYSENTER_stack_canary) != STACK_END_MAGIC,
-             "Overran or corrupted SYSENTER stack\n");
-#endif
         ist_exit(regs);
 }
 NOKPROBE_SYMBOL(do_debug);
@@ -929,6 +942,9 @@ dotraplinkage void do_iret_error(struct pt_regs *regs, long error_code)
 
 void __init trap_init(void)
 {
+        /* Init cpu_entry_area before IST entries are set up */
+        setup_cpu_entry_areas();
+
         idt_setup_traps();
 
         /*
@@ -936,8 +952,9 @@ void __init trap_init(void)
          * "sidt" instruction will not leak the location of the kernel, and
          * to defend the IDT against arbitrary memory write vulnerabilities.
          * It will be reloaded in cpu_init() */
-        __set_fixmap(FIX_RO_IDT, __pa_symbol(idt_table), PAGE_KERNEL_RO);
-        idt_descr.address = fix_to_virt(FIX_RO_IDT);
+        cea_set_pte(CPU_ENTRY_AREA_RO_IDT_VADDR, __pa_symbol(idt_table),
+                    PAGE_KERNEL_RO);
+        idt_descr.address = CPU_ENTRY_AREA_RO_IDT;
 
         /*
          * Should be a barrier for any external CPU state:
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 8ea117f8142e..e169e85db434 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -602,7 +602,6 @@ unsigned long native_calibrate_tsc(void)
                 case INTEL_FAM6_KABYLAKE_DESKTOP:
                         crystal_khz = 24000;    /* 24.0 MHz */
                         break;
-                case INTEL_FAM6_SKYLAKE_X:
                 case INTEL_FAM6_ATOM_DENVERTON:
                         crystal_khz = 25000;    /* 25.0 MHz */
                         break;
@@ -612,6 +611,8 @@ unsigned long native_calibrate_tsc(void)
                 }
         }
 
+        if (crystal_khz == 0)
+                return 0;
         /*
          * TSC frequency determined by CPUID is a "hardware reported"
          * frequency and is the most accurate one so far we have. This
@@ -1315,6 +1316,12 @@ void __init tsc_init(void)
                 (unsigned long)cpu_khz / 1000,
                 (unsigned long)cpu_khz % 1000);
 
+        if (cpu_khz != tsc_khz) {
+                pr_info("Detected %lu.%03lu MHz TSC",
+                        (unsigned long)tsc_khz / 1000,
+                        (unsigned long)tsc_khz % 1000);
+        }
+
         /* Sanitize TSC ADJUST before cyc2ns gets initialized */
         tsc_store_and_check_tsc_adjust(true);
 
diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
index a3f973b2c97a..1f9188f5357c 100644
--- a/arch/x86/kernel/unwind_orc.c
+++ b/arch/x86/kernel/unwind_orc.c
@@ -74,8 +74,50 @@ static struct orc_entry *orc_module_find(unsigned long ip)
 }
 #endif
 
+#ifdef CONFIG_DYNAMIC_FTRACE
+static struct orc_entry *orc_find(unsigned long ip);
+
+/*
+ * Ftrace dynamic trampolines do not have orc entries of their own.
+ * But they are copies of the ftrace entries that are static and
+ * defined in ftrace_*.S, which do have orc entries.
+ *
+ * If the undwinder comes across a ftrace trampoline, then find the
+ * ftrace function that was used to create it, and use that ftrace
+ * function's orc entrie, as the placement of the return code in
+ * the stack will be identical.
+ */
+static struct orc_entry *orc_ftrace_find(unsigned long ip)
+{
+        struct ftrace_ops *ops;
+        unsigned long caller;
+
+        ops = ftrace_ops_trampoline(ip);
+        if (!ops)
+                return NULL;
+
+        if (ops->flags & FTRACE_OPS_FL_SAVE_REGS)
+                caller = (unsigned long)ftrace_regs_call;
+        else
+                caller = (unsigned long)ftrace_call;
+
+        /* Prevent unlikely recursion */
+        if (ip == caller)
+                return NULL;
+
+        return orc_find(caller);
+}
+#else
+static struct orc_entry *orc_ftrace_find(unsigned long ip)
+{
+        return NULL;
+}
+#endif
+
 static struct orc_entry *orc_find(unsigned long ip)
 {
+        static struct orc_entry *orc;
+
         if (!orc_init)
                 return NULL;
 
@@ -111,7 +153,11 @@ static struct orc_entry *orc_find(unsigned long ip)
                                   __stop_orc_unwind_ip - __start_orc_unwind_ip, ip);
 
         /* Module lookup: */
-        return orc_module_find(ip);
+        orc = orc_module_find(ip);
+        if (orc)
+                return orc;
+
+        return orc_ftrace_find(ip);
 }
 
 static void orc_sort_swap(void *_a, void *_b, int size)
@@ -253,22 +299,15 @@ unsigned long *unwind_get_return_address_ptr(struct unwind_state *state)
         return NULL;
 }
 
-static bool stack_access_ok(struct unwind_state *state, unsigned long addr,
+static bool stack_access_ok(struct unwind_state *state, unsigned long _addr,
                             size_t len)
 {
         struct stack_info *info = &state->stack_info;
+        void *addr = (void *)_addr;
 
-        /*
-         * If the address isn't on the current stack, switch to the next one.
-         *
-         * We may have to traverse multiple stacks to deal with the possibility
-         * that info->next_sp could point to an empty stack and the address
-         * could be on a subsequent stack.
-         */
-        while (!on_stack(info, (void *)addr, len))
-                if (get_stack_info(info->next_sp, state->task, info,
-                                   &state->stack_mask))
-                        return false;
+        if (!on_stack(info, addr, len) &&
+            (get_stack_info(addr, state->task, info, &state->stack_mask)))
+                return false;
 
         return true;
 }
@@ -283,42 +322,32 @@ static bool deref_stack_reg(struct unwind_state *state, unsigned long addr,
         return true;
 }
 
-#define REGS_SIZE (sizeof(struct pt_regs))
-#define SP_OFFSET (offsetof(struct pt_regs, sp))
-#define IRET_REGS_SIZE (REGS_SIZE - offsetof(struct pt_regs, ip))
-#define IRET_SP_OFFSET (SP_OFFSET - offsetof(struct pt_regs, ip))
-
 static bool deref_stack_regs(struct unwind_state *state, unsigned long addr,
-                             unsigned long *ip, unsigned long *sp, bool full)
+                             unsigned long *ip, unsigned long *sp)
 {
-        size_t regs_size = full ? REGS_SIZE : IRET_REGS_SIZE;
-        size_t sp_offset = full ? SP_OFFSET : IRET_SP_OFFSET;
-        struct pt_regs *regs = (struct pt_regs *)(addr + regs_size - REGS_SIZE);
-
-        if (IS_ENABLED(CONFIG_X86_64)) {
-                if (!stack_access_ok(state, addr, regs_size))
-                        return false;
+        struct pt_regs *regs = (struct pt_regs *)addr;
 
-                *ip = regs->ip;
-                *sp = regs->sp;
+        /* x86-32 support will be more complicated due to the &regs->sp hack */
+        BUILD_BUG_ON(IS_ENABLED(CONFIG_X86_32));
 
-                return true;
-        }
-
-        if (!stack_access_ok(state, addr, sp_offset))
+        if (!stack_access_ok(state, addr, sizeof(struct pt_regs)))
                 return false;
 
         *ip = regs->ip;
+        *sp = regs->sp;
+        return true;
+}
 
-        if (user_mode(regs)) {
-                if (!stack_access_ok(state, addr + sp_offset,
-                                     REGS_SIZE - SP_OFFSET))
-                        return false;
+static bool deref_stack_iret_regs(struct unwind_state *state, unsigned long addr,
+                                  unsigned long *ip, unsigned long *sp)
+{
+        struct pt_regs *regs = (void *)addr - IRET_FRAME_OFFSET;
 
-                *sp = regs->sp;
-        } else
-                *sp = (unsigned long)&regs->sp;
+        if (!stack_access_ok(state, addr, IRET_FRAME_SIZE))
+                return false;
 
+        *ip = regs->ip;
+        *sp = regs->sp;
         return true;
 }
 
@@ -327,7 +356,6 @@ bool unwind_next_frame(struct unwind_state *state)
         unsigned long ip_p, sp, orig_ip, prev_sp = state->sp;
         enum stack_type prev_type = state->stack_info.type;
         struct orc_entry *orc;
-        struct pt_regs *ptregs;
         bool indirect = false;
 
         if (unwind_done(state))
@@ -435,7 +463,7 @@ bool unwind_next_frame(struct unwind_state *state)
                 break;
 
         case ORC_TYPE_REGS:
-                if (!deref_stack_regs(state, sp, &state->ip, &state->sp, true)) {
+                if (!deref_stack_regs(state, sp, &state->ip, &state->sp)) {
                         orc_warn("can't dereference registers at %p for ip %pB\n",
                                  (void *)sp, (void *)orig_ip);
                         goto done;
@@ -447,20 +475,14 @@ bool unwind_next_frame(struct unwind_state *state)
                 break;
 
         case ORC_TYPE_REGS_IRET:
-                if (!deref_stack_regs(state, sp, &state->ip, &state->sp, false)) {
+                if (!deref_stack_iret_regs(state, sp, &state->ip, &state->sp)) {
                         orc_warn("can't dereference iret registers at %p for ip %pB\n",
                                  (void *)sp, (void *)orig_ip);
                         goto done;
                 }
 
-                ptregs = container_of((void *)sp, struct pt_regs, ip);
-                if ((unsigned long)ptregs >= prev_sp &&
-                    on_stack(&state->stack_info, ptregs, REGS_SIZE)) {
-                        state->regs = ptregs;
-                        state->full_regs = false;
-                } else
-                        state->regs = NULL;
-
+                state->regs = (void *)sp - IRET_FRAME_OFFSET;
+                state->full_regs = false;
                 state->signal = true;
                 break;
 
@@ -553,8 +575,18 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
         }
 
         if (get_stack_info((unsigned long *)state->sp, state->task,
-                           &state->stack_info, &state->stack_mask))
-                return;
+                           &state->stack_info, &state->stack_mask)) {
+                /*
+                 * We weren't on a valid stack.  It's possible that
+                 * we overflowed a valid stack into a guard page.
+                 * See if the next page up is valid so that we can
+                 * generate some kind of backtrace if this happens.
+                 */
+                void *next_page = (void *)PAGE_ALIGN((unsigned long)state->sp);
+                if (get_stack_info(next_page, state->task, &state->stack_info,
+                                   &state->stack_mask))
+                        return;
+        }
 
         /*
          * The caller can provide the address of the first frame directly
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index a4009fb9be87..9b138a06c1a4 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -61,11 +61,17 @@ jiffies_64 = jiffies;
                 . = ALIGN(HPAGE_SIZE);                          \
                 __end_rodata_hpage_align = .;
 
+#define ALIGN_ENTRY_TEXT_BEGIN  . = ALIGN(PMD_SIZE);
+#define ALIGN_ENTRY_TEXT_END    . = ALIGN(PMD_SIZE);
+
 #else
 
 #define X64_ALIGN_RODATA_BEGIN
 #define X64_ALIGN_RODATA_END
 
+#define ALIGN_ENTRY_TEXT_BEGIN
+#define ALIGN_ENTRY_TEXT_END
+
 #endif
 
 PHDRS {
@@ -102,11 +108,28 @@ SECTIONS
                 CPUIDLE_TEXT
                 LOCK_TEXT
                 KPROBES_TEXT
+                ALIGN_ENTRY_TEXT_BEGIN
                 ENTRY_TEXT
                 IRQENTRY_TEXT
+                ALIGN_ENTRY_TEXT_END
                 SOFTIRQENTRY_TEXT
                 *(.fixup)
                 *(.gnu.warning)
+
+#ifdef CONFIG_X86_64
+                . = ALIGN(PAGE_SIZE);
+                _entry_trampoline = .;
+                *(.entry_trampoline)
+                . = ALIGN(PAGE_SIZE);
+                ASSERT(. - _entry_trampoline == PAGE_SIZE, "entry trampoline is too big");
+#endif
+
+#ifdef CONFIG_RETPOLINE
+                __indirect_thunk_start = .;
+                *(.text.__x86.indirect_thunk)
+                __indirect_thunk_end = .;
+#endif
+
                 /* End of text section */
                 _etext = .;
         } :text = 0x9090
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index e7d04d0c8008..b514b2b2845a 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -1046,7 +1046,6 @@ static void fetch_register_operand(struct operand *op)
 
 static void read_sse_reg(struct x86_emulate_ctxt *ctxt, sse128_t *data, int reg)
 {
-        ctxt->ops->get_fpu(ctxt);
         switch (reg) {
         case 0: asm("movdqa %%xmm0, %0" : "=m"(*data)); break;
         case 1: asm("movdqa %%xmm1, %0" : "=m"(*data)); break;
@@ -1068,13 +1067,11 @@ static void read_sse_reg(struct x86_emulate_ctxt *ctxt, sse128_t *data, int reg)
 #endif
         default: BUG();
         }
-        ctxt->ops->put_fpu(ctxt);
 }
 
 static void write_sse_reg(struct x86_emulate_ctxt *ctxt, sse128_t *data,
                           int reg)
 {
-        ctxt->ops->get_fpu(ctxt);
         switch (reg) {
         case 0: asm("movdqa %0, %%xmm0" : : "m"(*data)); break;
         case 1: asm("movdqa %0, %%xmm1" : : "m"(*data)); break;
@@ -1096,12 +1093,10 @@ static void write_sse_reg(struct x86_emulate_ctxt *ctxt, sse128_t *data,
 #endif
         default: BUG();
         }
-        ctxt->ops->put_fpu(ctxt);
 }
 
 static void read_mmx_reg(struct x86_emulate_ctxt *ctxt, u64 *data, int reg)
 {
-        ctxt->ops->get_fpu(ctxt);
         switch (reg) {
         case 0: asm("movq %%mm0, %0" : "=m"(*data)); break;
         case 1: asm("movq %%mm1, %0" : "=m"(*data)); break;
@@ -1113,12 +1108,10 @@ static void read_mmx_reg(struct x86_emulate_ctxt *ctxt, u64 *data, int reg)
         case 7: asm("movq %%mm7, %0" : "=m"(*data)); break;
         default: BUG();
         }
-        ctxt->ops->put_fpu(ctxt);
 }
 
 static void write_mmx_reg(struct x86_emulate_ctxt *ctxt, u64 *data, int reg)
 {
-        ctxt->ops->get_fpu(ctxt);
         switch (reg) {
         case 0: asm("movq %0, %%mm0" : : "m"(*data)); break;
         case 1: asm("movq %0, %%mm1" : : "m"(*data)); break;
@@ -1130,7 +1123,6 @@ static void write_mmx_reg(struct x86_emulate_ctxt *ctxt, u64 *data, int reg)
         case 7: asm("movq %0, %%mm7" : : "m"(*data)); break;
         default: BUG();
         }
-        ctxt->ops->put_fpu(ctxt);
 }
 
 static int em_fninit(struct x86_emulate_ctxt *ctxt)
@@ -1138,9 +1130,7 @@ static int em_fninit(struct x86_emulate_ctxt *ctxt)
         if (ctxt->ops->get_cr(ctxt, 0) & (X86_CR0_TS | X86_CR0_EM))
                 return emulate_nm(ctxt);
 
-        ctxt->ops->get_fpu(ctxt);
         asm volatile("fninit");
-        ctxt->ops->put_fpu(ctxt);
         return X86EMUL_CONTINUE;
 }
 
@@ -1151,9 +1141,7 @@ static int em_fnstcw(struct x86_emulate_ctxt *ctxt)
         if (ctxt->ops->get_cr(ctxt, 0) & (X86_CR0_TS | X86_CR0_EM))
                 return emulate_nm(ctxt);
 
-        ctxt->ops->get_fpu(ctxt);
         asm volatile("fnstcw %0": "+m"(fcw));
-        ctxt->ops->put_fpu(ctxt);
 
         ctxt->dst.val = fcw;
 
@@ -1167,9 +1155,7 @@ static int em_fnstsw(struct x86_emulate_ctxt *ctxt)
         if (ctxt->ops->get_cr(ctxt, 0) & (X86_CR0_TS | X86_CR0_EM))
                 return emulate_nm(ctxt);
 
-        ctxt->ops->get_fpu(ctxt);
         asm volatile("fnstsw %0": "+m"(fsw));
-        ctxt->ops->put_fpu(ctxt);
 
         ctxt->dst.val = fsw;
 
@@ -2404,9 +2390,21 @@ static int rsm_load_seg_64(struct x86_emulate_ctxt *ctxt, u64 smbase, int n)
 }
 
 static int rsm_enter_protected_mode(struct x86_emulate_ctxt *ctxt,
-                                     u64 cr0, u64 cr4)
+                                    u64 cr0, u64 cr3, u64 cr4)
 {
         int bad;
+        u64 pcid;
+
+        /* In order to later set CR4.PCIDE, CR3[11:0] must be zero.  */
+        pcid = 0;
+        if (cr4 & X86_CR4_PCIDE) {
+                pcid = cr3 & 0xfff;
+                cr3 &= ~0xfff;
+        }
+
+        bad = ctxt->ops->set_cr(ctxt, 3, cr3);
+        if (bad)
+                return X86EMUL_UNHANDLEABLE;
 
         /*
          * First enable PAE, long mode needs it before CR0.PG = 1 is set.
@@ -2425,6 +2423,12 @@ static int rsm_enter_protected_mode(struct x86_emulate_ctxt *ctxt,
                 bad = ctxt->ops->set_cr(ctxt, 4, cr4);
                 if (bad)
                         return X86EMUL_UNHANDLEABLE;
+                if (pcid) {
+                        bad = ctxt->ops->set_cr(ctxt, 3, cr3 | pcid);
+                        if (bad)
+                                return X86EMUL_UNHANDLEABLE;
+                }
+
         }
 
         return X86EMUL_CONTINUE;
@@ -2435,11 +2439,11 @@ static int rsm_load_state_32(struct x86_emulate_ctxt *ctxt, u64 smbase)
         struct desc_struct desc;
         struct desc_ptr dt;
         u16 selector;
-        u32 val, cr0, cr4;
+        u32 val, cr0, cr3, cr4;
         int i;
 
         cr0 =                      GET_SMSTATE(u32, smbase, 0x7ffc);
-        ctxt->ops->set_cr(ctxt, 3, GET_SMSTATE(u32, smbase, 0x7ff8));
+        cr3 =                      GET_SMSTATE(u32, smbase, 0x7ff8);
         ctxt->eflags =             GET_SMSTATE(u32, smbase, 0x7ff4) | X86_EFLAGS_FIXED;
         ctxt->_eip =               GET_SMSTATE(u32, smbase, 0x7ff0);
 
@@ -2481,14 +2485,14 @@ static int rsm_load_state_32(struct x86_emulate_ctxt *ctxt, u64 smbase)
 
         ctxt->ops->set_smbase(ctxt, GET_SMSTATE(u32, smbase, 0x7ef8));
 
-        return rsm_enter_protected_mode(ctxt, cr0, cr4);
+        return rsm_enter_protected_mode(ctxt, cr0, cr3, cr4);
 }
 
 static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase)
 {
         struct desc_struct desc;
         struct desc_ptr dt;
-        u64 val, cr0, cr4;
+        u64 val, cr0, cr3, cr4;
         u32 base3;
         u16 selector;
         int i, r;
@@ -2505,7 +2509,7 @@ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase)
         ctxt->ops->set_dr(ctxt, 7, (val & DR7_VOLATILE) | DR7_FIXED_1);
 
         cr0 =                       GET_SMSTATE(u64, smbase, 0x7f58);
-        ctxt->ops->set_cr(ctxt, 3,  GET_SMSTATE(u64, smbase, 0x7f50));
+        cr3 =                       GET_SMSTATE(u64, smbase, 0x7f50);
         cr4 =                       GET_SMSTATE(u64, smbase, 0x7f48);
         ctxt->ops->set_smbase(ctxt, GET_SMSTATE(u32, smbase, 0x7f00));
         val =                       GET_SMSTATE(u64, smbase, 0x7ed0);
@@ -2533,7 +2537,7 @@ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase)
         dt.address =                GET_SMSTATE(u64, smbase, 0x7e68);
         ctxt->ops->set_gdt(ctxt, &dt);
 
-        r = rsm_enter_protected_mode(ctxt, cr0, cr4);
+        r = rsm_enter_protected_mode(ctxt, cr0, cr3, cr4);
         if (r != X86EMUL_CONTINUE)
                 return r;
 
@@ -4001,12 +4005,8 @@ static int em_fxsave(struct x86_emulate_ctxt *ctxt)
         if (rc != X86EMUL_CONTINUE)
                 return rc;
 
-        ctxt->ops->get_fpu(ctxt);
-
         rc = asm_safe("fxsave %[fx]", , [fx] "+m"(fx_state));
 
-        ctxt->ops->put_fpu(ctxt);
-
         if (rc != X86EMUL_CONTINUE)
                 return rc;
 
@@ -4049,8 +4049,6 @@ static int em_fxrstor(struct x86_emulate_ctxt *ctxt)
         if (rc != X86EMUL_CONTINUE)
                 return rc;
 
-        ctxt->ops->get_fpu(ctxt);
-
         if (size < __fxstate_size(16)) {
                 rc = fxregs_fixup(&fx_state, size);
                 if (rc != X86EMUL_CONTINUE)
@@ -4066,8 +4064,6 @@ static int em_fxrstor(struct x86_emulate_ctxt *ctxt)
                 rc = asm_safe("fxrstor %[fx]", : [fx] "m"(fx_state));
 
 out:
-        ctxt->ops->put_fpu(ctxt);
-
         return rc;
 }
 
@@ -5317,9 +5313,7 @@ static int flush_pending_x87_faults(struct x86_emulate_ctxt *ctxt)
 {
         int rc;
 
-        ctxt->ops->get_fpu(ctxt);
         rc = asm_safe("fwait");
-        ctxt->ops->put_fpu(ctxt);
 
         if (unlikely(rc != X86EMUL_CONTINUE))
                 return emulate_exception(ctxt, MF_VECTOR, 0, false);
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index e5e66e5c6640..2b8eb4da4d08 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3395,7 +3395,7 @@ static int mmu_alloc_direct_roots(struct kvm_vcpu *vcpu)
                 spin_lock(&vcpu->kvm->mmu_lock);
                 if(make_mmu_pages_available(vcpu) < 0) {
                         spin_unlock(&vcpu->kvm->mmu_lock);
-                        return 1;
+                        return -ENOSPC;
                 }
                 sp = kvm_mmu_get_page(vcpu, 0, 0,
                                 vcpu->arch.mmu.shadow_root_level, 1, ACC_ALL);
@@ -3410,7 +3410,7 @@ static int mmu_alloc_direct_roots(struct kvm_vcpu *vcpu)
                         spin_lock(&vcpu->kvm->mmu_lock);
                         if (make_mmu_pages_available(vcpu) < 0) {
                                 spin_unlock(&vcpu->kvm->mmu_lock);
-                                return 1;
+                                return -ENOSPC;
                         }
                         sp = kvm_mmu_get_page(vcpu, i << (30 - PAGE_SHIFT),
                                         i << 30, PT32_ROOT_LEVEL, 1, ACC_ALL);
@@ -3450,7 +3450,7 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu)
                 spin_lock(&vcpu->kvm->mmu_lock);
                 if (make_mmu_pages_available(vcpu) < 0) {
                         spin_unlock(&vcpu->kvm->mmu_lock);
-                        return 1;
+                        return -ENOSPC;
                 }
                 sp = kvm_mmu_get_page(vcpu, root_gfn, 0,
                                 vcpu->arch.mmu.shadow_root_level, 0, ACC_ALL);
@@ -3487,7 +3487,7 @@ static int mmu_alloc_shadow_roots(struct kvm_vcpu *vcpu)
                 spin_lock(&vcpu->kvm->mmu_lock);
                 if (make_mmu_pages_available(vcpu) < 0) {
                         spin_unlock(&vcpu->kvm->mmu_lock);
-                        return 1;
+                        return -ENOSPC;
                 }
                 sp = kvm_mmu_get_page(vcpu, root_gfn, i << 30, PT32_ROOT_LEVEL,
                                       0, ACC_ALL);
@@ -3781,7 +3781,8 @@ static int kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn)
 bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu)
 {
         if (unlikely(!lapic_in_kernel(vcpu) ||
-                     kvm_event_needs_reinjection(vcpu)))
+                     kvm_event_needs_reinjection(vcpu) ||
+                     vcpu->arch.exception.pending))
                 return false;
 
         if (!vcpu->arch.apf.delivery_as_pf_vmexit && is_guest_mode(vcpu))
@@ -5465,30 +5466,34 @@ static void mmu_destroy_caches(void)
 
 int kvm_mmu_module_init(void)
 {
+        int ret = -ENOMEM;
+
         kvm_mmu_clear_all_pte_masks();
 
         pte_list_desc_cache = kmem_cache_create("pte_list_desc",
                                             sizeof(struct pte_list_desc),
                                             0, SLAB_ACCOUNT, NULL);
         if (!pte_list_desc_cache)
-                goto nomem;
+                goto out;
 
         mmu_page_header_cache = kmem_cache_create("kvm_mmu_page_header",
                                                   sizeof(struct kvm_mmu_page),
                                                   0, SLAB_ACCOUNT, NULL);
         if (!mmu_page_header_cache)
-                goto nomem;
+                goto out;
 
         if (percpu_counter_init(&kvm_total_used_mmu_pages, 0, GFP_KERNEL))
-                goto nomem;
+                goto out;
 
-        register_shrinker(&mmu_shrinker);
+        ret = register_shrinker(&mmu_shrinker);
+        if (ret)
+                goto out;
 
         return 0;
 
-nomem:
+out:
         mmu_destroy_caches();
-        return -ENOMEM;
+        return ret;
 }
 
 /*
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index eb714f1cdf7e..f40d0da1f1d3 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -45,6 +45,7 @@
 #include <asm/debugreg.h>
 #include <asm/kvm_para.h>
 #include <asm/irq_remapping.h>
+#include <asm/nospec-branch.h>
 
 #include <asm/virtext.h>
 #include "trace.h"
@@ -361,7 +362,6 @@ static void recalc_intercepts(struct vcpu_svm *svm)
 {
         struct vmcb_control_area *c, *h;
         struct nested_state *g;
-        u32 h_intercept_exceptions;
 
         mark_dirty(svm->vmcb, VMCB_INTERCEPTS);
 
@@ -372,14 +372,9 @@ static void recalc_intercepts(struct vcpu_svm *svm)
         h = &svm->nested.hsave->control;
         g = &svm->nested;
 
-        /* No need to intercept #UD if L1 doesn't intercept it */
-        h_intercept_exceptions =
-                h->intercept_exceptions & ~(1U << UD_VECTOR);
-
         c->intercept_cr = h->intercept_cr | g->intercept_cr;
         c->intercept_dr = h->intercept_dr | g->intercept_dr;
-        c->intercept_exceptions =
-                h_intercept_exceptions | g->intercept_exceptions;
+        c->intercept_exceptions = h->intercept_exceptions | g->intercept_exceptions;
         c->intercept = h->intercept | g->intercept;
 }
 
@@ -2202,7 +2197,6 @@ static int ud_interception(struct vcpu_svm *svm)
 {
         int er;
 
-        WARN_ON_ONCE(is_guest_mode(&svm->vcpu));
         er = emulate_instruction(&svm->vcpu, EMULTYPE_TRAP_UD);
         if (er == EMULATE_USER_EXIT)
                 return 0;
@@ -4986,6 +4980,25 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
                 "mov %%r14, %c[r14](%[svm]) \n\t"
                 "mov %%r15, %c[r15](%[svm]) \n\t"
 #endif
+                /*
+                * Clear host registers marked as clobbered to prevent
+                * speculative use.
+                */
+                "xor %%" _ASM_BX ", %%" _ASM_BX " \n\t"
+                "xor %%" _ASM_CX ", %%" _ASM_CX " \n\t"
+                "xor %%" _ASM_DX ", %%" _ASM_DX " \n\t"
+                "xor %%" _ASM_SI ", %%" _ASM_SI " \n\t"
+                "xor %%" _ASM_DI ", %%" _ASM_DI " \n\t"
+#ifdef CONFIG_X86_64
+                "xor %%r8, %%r8 \n\t"
+                "xor %%r9, %%r9 \n\t"
+                "xor %%r10, %%r10 \n\t"
+                "xor %%r11, %%r11 \n\t"
+                "xor %%r12, %%r12 \n\t"
+                "xor %%r13, %%r13 \n\t"
+                "xor %%r14, %%r14 \n\t"
+                "xor %%r15, %%r15 \n\t"
+#endif
                 "pop %%" _ASM_BP
                 :
                 : [svm]"a"(svm),
@@ -5015,6 +5028,9 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
 #endif
                 );
 
+        /* Eliminate branch target predictions from guest mode */
+        vmexit_fill_RSB();
+
 #ifdef CONFIG_X86_64
         wrmsrl(MSR_GS_BASE, svm->host.gs_base);
 #else
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 4704aaf6d19e..c829d89e2e63 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -50,6 +50,7 @@
 #include <asm/apic.h>
 #include <asm/irq_remapping.h>
 #include <asm/mmu_context.h>
+#include <asm/nospec-branch.h>
 
 #include "trace.h"
 #include "pmu.h"
@@ -899,8 +900,16 @@ static inline short vmcs_field_to_offset(unsigned long field)
 {
         BUILD_BUG_ON(ARRAY_SIZE(vmcs_field_to_offset_table) > SHRT_MAX);
 
-        if (field >= ARRAY_SIZE(vmcs_field_to_offset_table) ||
-            vmcs_field_to_offset_table[field] == 0)
+        if (field >= ARRAY_SIZE(vmcs_field_to_offset_table))
+                return -ENOENT;
+
+        /*
+         * FIXME: Mitigation for CVE-2017-5753.  To be replaced with a
+         * generic mechanism.
+         */
+        asm("lfence");
+
+        if (vmcs_field_to_offset_table[field] == 0)
                 return -ENOENT;
 
         return vmcs_field_to_offset_table[field];
@@ -1887,7 +1896,7 @@ static void update_exception_bitmap(struct kvm_vcpu *vcpu)
 {
         u32 eb;
 
-        eb = (1u << PF_VECTOR) | (1u << MC_VECTOR) |
+        eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) |
              (1u << DB_VECTOR) | (1u << AC_VECTOR);
         if ((vcpu->guest_debug &
              (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) ==
@@ -1905,8 +1914,6 @@ static void update_exception_bitmap(struct kvm_vcpu *vcpu)
          */
         if (is_guest_mode(vcpu))
                 eb |= get_vmcs12(vcpu)->exception_bitmap;
-        else
-                eb |= 1u << UD_VECTOR;
 
         vmcs_write32(EXCEPTION_BITMAP, eb);
 }
@@ -2302,7 +2309,7 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
                  * processors.  See 22.2.4.
                  */
                 vmcs_writel(HOST_TR_BASE,
-                            (unsigned long)this_cpu_ptr(&cpu_tss));
+                            (unsigned long)&get_cpu_entry_area(cpu)->tss.x86_tss);
                 vmcs_writel(HOST_GDTR_BASE, (unsigned long)gdt);   /* 22.2.4 */
 
                 /*
@@ -5917,7 +5924,6 @@ static int handle_exception(struct kvm_vcpu *vcpu)
                 return 1;  /* already handled by vmx_vcpu_run() */
 
         if (is_invalid_opcode(intr_info)) {
-                WARN_ON_ONCE(is_guest_mode(vcpu));
                 er = emulate_instruction(vcpu, EMULTYPE_TRAP_UD);
                 if (er == EMULATE_USER_EXIT)
                         return 0;
@@ -6751,16 +6757,10 @@ static __init int hardware_setup(void)
                         goto out;
         }
 
-        vmx_io_bitmap_b = (unsigned long *)__get_free_page(GFP_KERNEL);
         memset(vmx_vmread_bitmap, 0xff, PAGE_SIZE);
         memset(vmx_vmwrite_bitmap, 0xff, PAGE_SIZE);
 
-        /*
-         * Allow direct access to the PC debug port (it is often used for I/O
-         * delays, but the vmexits simply slow things down).
-         */
         memset(vmx_io_bitmap_a, 0xff, PAGE_SIZE);
-        clear_bit(0x80, vmx_io_bitmap_a);
 
         memset(vmx_io_bitmap_b, 0xff, PAGE_SIZE);
 
@@ -9421,6 +9421,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
                 /* Save guest registers, load host registers, keep flags */
                 "mov %0, %c[wordsize](%%" _ASM_SP ") \n\t"
                 "pop %0 \n\t"
+                "setbe %c[fail](%0)\n\t"
                 "mov %%" _ASM_AX ", %c[rax](%0) \n\t"
                 "mov %%" _ASM_BX ", %c[rbx](%0) \n\t"
                 __ASM_SIZE(pop) " %c[rcx](%0) \n\t"
@@ -9437,12 +9438,23 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
                 "mov %%r13, %c[r13](%0) \n\t"
                 "mov %%r14, %c[r14](%0) \n\t"
                 "mov %%r15, %c[r15](%0) \n\t"
+                "xor %%r8d,  %%r8d \n\t"
+                "xor %%r9d,  %%r9d \n\t"
+                "xor %%r10d, %%r10d \n\t"
+                "xor %%r11d, %%r11d \n\t"
+                "xor %%r12d, %%r12d \n\t"
+                "xor %%r13d, %%r13d \n\t"
+                "xor %%r14d, %%r14d \n\t"
+                "xor %%r15d, %%r15d \n\t"
 #endif
                 "mov %%cr2, %%" _ASM_AX "   \n\t"
                 "mov %%" _ASM_AX ", %c[cr2](%0) \n\t"
 
+                "xor %%eax, %%eax \n\t"
+                "xor %%ebx, %%ebx \n\t"
+                "xor %%esi, %%esi \n\t"
+                "xor %%edi, %%edi \n\t"
                 "pop  %%" _ASM_BP "; pop  %%" _ASM_DX " \n\t"
-                "setbe %c[fail](%0) \n\t"
                 ".pushsection .rodata \n\t"
                 ".global vmx_return \n\t"
                 "vmx_return: " _ASM_PTR " 2b \n\t"
@@ -9479,6 +9491,9 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
 #endif
               );
 
+        /* Eliminate branch target predictions from guest mode */
+        vmexit_fill_RSB();
+
         /* MSR_IA32_DEBUGCTLMSR is zeroed on vmexit. Restore it if needed */
         if (debugctlmsr)
                 update_debugctlmsr(debugctlmsr);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index eee8e7faf1af..c53298dfbf50 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2937,7 +2937,6 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
         srcu_read_unlock(&vcpu->kvm->srcu, idx);
         pagefault_enable();
         kvm_x86_ops->vcpu_put(vcpu);
-        kvm_put_guest_fpu(vcpu);
         vcpu->arch.last_host_tsc = rdtsc();
 }
 
@@ -4385,7 +4384,7 @@ static int vcpu_mmio_read(struct kvm_vcpu *vcpu, gpa_t addr, int len, void *v)
                                          addr, n, v))
                     && kvm_io_bus_read(vcpu, KVM_MMIO_BUS, addr, n, v))
                         break;
-                trace_kvm_mmio(KVM_TRACE_MMIO_READ, n, addr, *(u64 *)v);
+                trace_kvm_mmio(KVM_TRACE_MMIO_READ, n, addr, v);
                 handled += n;
                 addr += n;
                 len -= n;
@@ -4644,7 +4643,7 @@ static int read_prepare(struct kvm_vcpu *vcpu, void *val, int bytes)
 {
         if (vcpu->mmio_read_completed) {
                 trace_kvm_mmio(KVM_TRACE_MMIO_READ, bytes,
-                               vcpu->mmio_fragments[0].gpa, *(u64 *)val);
+                               vcpu->mmio_fragments[0].gpa, val);
                 vcpu->mmio_read_completed = 0;
                 return 1;
         }
@@ -4666,14 +4665,14 @@ static int write_emulate(struct kvm_vcpu *vcpu, gpa_t gpa,
 
 static int write_mmio(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes, void *val)
 {
-        trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, bytes, gpa, *(u64 *)val);
+        trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, bytes, gpa, val);
         return vcpu_mmio_write(vcpu, gpa, bytes, val);
 }
 
 static int read_exit_mmio(struct kvm_vcpu *vcpu, gpa_t gpa,
                           void *val, int bytes)
 {
-        trace_kvm_mmio(KVM_TRACE_MMIO_READ_UNSATISFIED, bytes, gpa, 0);
+        trace_kvm_mmio(KVM_TRACE_MMIO_READ_UNSATISFIED, bytes, gpa, NULL);
         return X86EMUL_IO_NEEDED;
 }
 
@@ -5252,17 +5251,6 @@ static void emulator_halt(struct x86_emulate_ctxt *ctxt)
         emul_to_vcpu(ctxt)->arch.halt_request = 1;
 }
 
-static void emulator_get_fpu(struct x86_emulate_ctxt *ctxt)
-{
-        preempt_disable();
-        kvm_load_guest_fpu(emul_to_vcpu(ctxt));
-}
-
-static void emulator_put_fpu(struct x86_emulate_ctxt *ctxt)
-{
-        preempt_enable();
-}
-
 static int emulator_intercept(struct x86_emulate_ctxt *ctxt,
                               struct x86_instruction_info *info,
                               enum x86_intercept_stage stage)
@@ -5340,8 +5328,6 @@ static const struct x86_emulate_ops emulate_ops = {
         .halt                = emulator_halt,
         .wbinvd              = emulator_wbinvd,
         .fix_hypercall       = emulator_fix_hypercall,
-        .get_fpu             = emulator_get_fpu,
-        .put_fpu             = emulator_put_fpu,
         .intercept           = emulator_intercept,
         .get_cpuid           = emulator_get_cpuid,
         .set_nmi_mask        = emulator_set_nmi_mask,
@@ -6778,6 +6764,20 @@ static void kvm_vcpu_flush_tlb(struct kvm_vcpu *vcpu)
         kvm_x86_ops->tlb_flush(vcpu);
 }
 
+void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
+                unsigned long start, unsigned long end)
+{
+        unsigned long apic_address;
+
+        /*
+         * The physical address of apic access page is stored in the VMCS.
+         * Update it when it becomes invalid.
+         */
+        apic_address = gfn_to_hva(kvm, APIC_DEFAULT_PHYS_BASE >> PAGE_SHIFT);
+        if (start <= apic_address && apic_address < end)
+                kvm_make_all_cpus_request(kvm, KVM_REQ_APIC_PAGE_RELOAD);
+}
+
 void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu)
 {
         struct page *page = NULL;
@@ -6952,7 +6952,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
         preempt_disable();
 
         kvm_x86_ops->prepare_guest_switch(vcpu);
-        kvm_load_guest_fpu(vcpu);
 
         /*
          * Disable IRQs before setting IN_GUEST_MODE.  Posted interrupt
@@ -7265,13 +7264,12 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
 
 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 {
-        struct fpu *fpu = &current->thread.fpu;
         int r;
 
-        fpu__initialize(fpu);
-
         kvm_sigset_activate(vcpu);
 
+        kvm_load_guest_fpu(vcpu);
+
         if (unlikely(vcpu->arch.mp_state == KVM_MP_STATE_UNINITIALIZED)) {
                 if (kvm_run->immediate_exit) {
                         r = -EINTR;
@@ -7312,6 +7310,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
                 r = vcpu_run(vcpu);
 
 out:
+        kvm_put_guest_fpu(vcpu);
         post_kvm_run_save(vcpu);
         kvm_sigset_deactivate(vcpu);
 
@@ -7381,7 +7380,7 @@ int kvm_arch_vcpu_ioctl_set_regs(struct kvm_vcpu *vcpu, struct kvm_regs *regs)
 #endif
 
         kvm_rip_write(vcpu, regs->rip);
-        kvm_set_rflags(vcpu, regs->rflags);
+        kvm_set_rflags(vcpu, regs->rflags | X86_EFLAGS_FIXED);
 
         vcpu->arch.exception.pending = false;
 
@@ -7495,6 +7494,29 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int idt_index,
 }
 EXPORT_SYMBOL_GPL(kvm_task_switch);
 
+int kvm_valid_sregs(struct kvm_vcpu *vcpu, struct kvm_sregs *sregs)
+{
+        if ((sregs->efer & EFER_LME) && (sregs->cr0 & X86_CR0_PG)) {
+                /*
+                 * When EFER.LME and CR0.PG are set, the processor is in
+                 * 64-bit mode (though maybe in a 32-bit code segment).
+                 * CR4.PAE and EFER.LMA must be set.
+                 */
+                if (!(sregs->cr4 & X86_CR4_PAE)
+                    || !(sregs->efer & EFER_LMA))
+                        return -EINVAL;
+        } else {
+                /*
+                 * Not in 64-bit mode: EFER.LMA is clear and the code
+                 * segment cannot be 64-bit.
+                 */
+                if (sregs->efer & EFER_LMA || sregs->cs.l)
+                        return -EINVAL;
+        }
+
+        return 0;
+}
+
 int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
                                   struct kvm_sregs *sregs)
 {
@@ -7507,6 +7529,9 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
                         (sregs->cr4 & X86_CR4_OSXSAVE))
                 return -EINVAL;
 
+        if (kvm_valid_sregs(vcpu, sregs))
+                return -EINVAL;
+
         apic_base_msr.data = sregs->apic_base;
         apic_base_msr.host_initiated = true;
         if (kvm_set_apic_base(vcpu, &apic_base_msr))
@@ -7704,32 +7729,25 @@ static void fx_init(struct kvm_vcpu *vcpu)
         vcpu->arch.cr0 |= X86_CR0_ET;
 }
 
+/* Swap (qemu) user FPU context for the guest FPU context. */
 void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
 {
-        if (vcpu->guest_fpu_loaded)
-                return;
-
-        /*
-         * Restore all possible states in the guest,
-         * and assume host would use all available bits.
-         * Guest xcr0 would be loaded later.
-         */
-        vcpu->guest_fpu_loaded = 1;
-        __kernel_fpu_begin();
+        preempt_disable();
+        copy_fpregs_to_fpstate(&vcpu->arch.user_fpu);
         /* PKRU is separately restored in kvm_x86_ops->run.  */
         __copy_kernel_to_fpregs(&vcpu->arch.guest_fpu.state,
                                 ~XFEATURE_MASK_PKRU);
+        preempt_enable();
         trace_kvm_fpu(1);
 }
 
+/* When vcpu_run ends, restore user space FPU context. */
 void kvm_put_guest_fpu(struct kvm_vcpu *vcpu)
 {
-        if (!vcpu->guest_fpu_loaded)
-                return;
-
-        vcpu->guest_fpu_loaded = 0;
+        preempt_disable();
         copy_fpregs_to_fpstate(&vcpu->arch.guest_fpu);
-        __kernel_fpu_end();
+        copy_kernel_to_fpregs(&vcpu->arch.user_fpu.state);
+        preempt_enable();
         ++vcpu->stat.fpu_reload;
         trace_kvm_fpu(0);
 }
@@ -7846,7 +7864,8 @@ void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
                  * To avoid have the INIT path from kvm_apic_has_events() that be
                  * called with loaded FPU and does not let userspace fix the state.
                  */
-                kvm_put_guest_fpu(vcpu);
+                if (init_event)
+                        kvm_put_guest_fpu(vcpu);
                 mpx_state_buffer = get_xsave_addr(&vcpu->arch.guest_fpu.state.xsave,
                                         XFEATURE_MASK_BNDREGS);
                 if (mpx_state_buffer)
@@ -7855,6 +7874,8 @@ void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
                                         XFEATURE_MASK_BNDCSR);
                 if (mpx_state_buffer)
                         memset(mpx_state_buffer, 0, sizeof(struct mpx_bndcsr));
+                if (init_event)
+                        kvm_load_guest_fpu(vcpu);
         }
 
         if (!init_event) {
diff --git a/arch/x86/lib/Makefile b/arch/x86/lib/Makefile
index 7b181b61170e..f23934bbaf4e 100644
--- a/arch/x86/lib/Makefile
+++ b/arch/x86/lib/Makefile
@@ -26,6 +26,7 @@ lib-y += memcpy_$(BITS).o
 lib-$(CONFIG_RWSEM_XCHGADD_ALGORITHM) += rwsem.o
 lib-$(CONFIG_INSTRUCTION_DECODER) += insn.o inat.o insn-eval.o
 lib-$(CONFIG_RANDOMIZE_BASE) += kaslr.o
+lib-$(CONFIG_RETPOLINE) += retpoline.o
 
 obj-y += msr.o msr-reg.o msr-reg-export.o hweight.o
 
diff --git a/arch/x86/lib/checksum_32.S b/arch/x86/lib/checksum_32.S
index 4d34bb548b41..46e71a74e612 100644
--- a/arch/x86/lib/checksum_32.S
+++ b/arch/x86/lib/checksum_32.S
@@ -29,7 +29,8 @@
 #include <asm/errno.h>
 #include <asm/asm.h>
 #include <asm/export.h>
-                                
+#include <asm/nospec-branch.h>
+
 /*
  * computes a partial checksum, e.g. for TCP/UDP fragments
  */
@@ -156,7 +157,7 @@ ENTRY(csum_partial)
         negl %ebx
         lea 45f(%ebx,%ebx,2), %ebx
         testl %esi, %esi
-        jmp *%ebx
+        JMP_NOSPEC %ebx
 
         # Handle 2-byte-aligned regions
 20:     addw (%esi), %ax
@@ -439,7 +440,7 @@ ENTRY(csum_partial_copy_generic)
         andl $-32,%edx
         lea 3f(%ebx,%ebx), %ebx
         testl %esi, %esi 
-        jmp *%ebx
+        JMP_NOSPEC %ebx
 1:      addl $64,%esi
         addl $64,%edi 
         SRC(movb -32(%edx),%bl) ; SRC(movb (%edx),%bl)
diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c
index 553f8fd23cc4..4846eff7e4c8 100644
--- a/arch/x86/lib/delay.c
+++ b/arch/x86/lib/delay.c
@@ -107,10 +107,10 @@ static void delay_mwaitx(unsigned long __loops)
                 delay = min_t(u64, MWAITX_MAX_LOOPS, loops);
 
                 /*
-                 * Use cpu_tss as a cacheline-aligned, seldomly
+                 * Use cpu_tss_rw as a cacheline-aligned, seldomly
                  * accessed per-cpu variable as the monitor target.
                  */
-                __monitorx(raw_cpu_ptr(&cpu_tss), 0, 0);
+                __monitorx(raw_cpu_ptr(&cpu_tss_rw), 0, 0);
 
                 /*
                  * AMD, like Intel, supports the EAX hint and EAX=0xf
diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S
new file mode 100644
index 000000000000..c909961e678a
--- /dev/null
+++ b/arch/x86/lib/retpoline.S
@@ -0,0 +1,48 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#include <linux/stringify.h>
+#include <linux/linkage.h>
+#include <asm/dwarf2.h>
+#include <asm/cpufeatures.h>
+#include <asm/alternative-asm.h>
+#include <asm/export.h>
+#include <asm/nospec-branch.h>
+
+.macro THUNK reg
+        .section .text.__x86.indirect_thunk
+
+ENTRY(__x86_indirect_thunk_\reg)
+        CFI_STARTPROC
+        JMP_NOSPEC %\reg
+        CFI_ENDPROC
+ENDPROC(__x86_indirect_thunk_\reg)
+.endm
+
+/*
+ * Despite being an assembler file we can't just use .irp here
+ * because __KSYM_DEPS__ only uses the C preprocessor and would
+ * only see one instance of "__x86_indirect_thunk_\reg" rather
+ * than one per register with the correct names. So we do it
+ * the simple and nasty way...
+ */
+#define __EXPORT_THUNK(sym) _ASM_NOKPROBE(sym); EXPORT_SYMBOL(sym)
+#define EXPORT_THUNK(reg) __EXPORT_THUNK(__x86_indirect_thunk_ ## reg)
+#define GENERATE_THUNK(reg) THUNK reg ; EXPORT_THUNK(reg)
+
+GENERATE_THUNK(_ASM_AX)
+GENERATE_THUNK(_ASM_BX)
+GENERATE_THUNK(_ASM_CX)
+GENERATE_THUNK(_ASM_DX)
+GENERATE_THUNK(_ASM_SI)
+GENERATE_THUNK(_ASM_DI)
+GENERATE_THUNK(_ASM_BP)
+#ifdef CONFIG_64BIT
+GENERATE_THUNK(r8)
+GENERATE_THUNK(r9)
+GENERATE_THUNK(r10)
+GENERATE_THUNK(r11)
+GENERATE_THUNK(r12)
+GENERATE_THUNK(r13)
+GENERATE_THUNK(r14)
+GENERATE_THUNK(r15)
+#endif
diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
index c4d55919fac1..e0b85930dd77 100644
--- a/arch/x86/lib/x86-opcode-map.txt
+++ b/arch/x86/lib/x86-opcode-map.txt
@@ -607,7 +607,7 @@ fb: psubq Pq,Qq | vpsubq Vx,Hx,Wx (66),(v1)
 fc: paddb Pq,Qq | vpaddb Vx,Hx,Wx (66),(v1)
 fd: paddw Pq,Qq | vpaddw Vx,Hx,Wx (66),(v1)
 fe: paddd Pq,Qq | vpaddd Vx,Hx,Wx (66),(v1)
-ff:
+ff: UD0
 EndTable
 
 Table: 3-byte opcode 1 (0x0f 0x38)
@@ -717,7 +717,7 @@ AVXcode: 2
 7e: vpermt2d/q Vx,Hx,Wx (66),(ev)
 7f: vpermt2ps/d Vx,Hx,Wx (66),(ev)
 80: INVEPT Gy,Mdq (66)
-81: INVPID Gy,Mdq (66)
+81: INVVPID Gy,Mdq (66)
 82: INVPCID Gy,Mdq (66)
 83: vpmultishiftqb Vx,Hx,Wx (66),(ev)
 88: vexpandps/d Vpd,Wpd (66),(ev)
@@ -970,6 +970,15 @@ GrpTable: Grp9
 EndTable
 
 GrpTable: Grp10
+# all are UD1
+0: UD1
+1: UD1
+2: UD1
+3: UD1
+4: UD1
+5: UD1
+6: UD1
+7: UD1
 EndTable
 
 # Grp11A and Grp11B are expressed as Grp11 in Intel SDM
diff --git a/arch/x86/mm/Makefile b/arch/x86/mm/Makefile
index 8e13b8cc6bed..27e9e90a8d35 100644
--- a/arch/x86/mm/Makefile
+++ b/arch/x86/mm/Makefile
@@ -10,7 +10,7 @@ CFLAGS_REMOVE_mem_encrypt.o	= -pg
 endif
 
 obj-y   :=  init.o init_$(BITS).o fault.o ioremap.o extable.o pageattr.o mmap.o \
-            pat.o pgtable.o physaddr.o setup_nx.o tlb.o
+            pat.o pgtable.o physaddr.o setup_nx.o tlb.o cpu_entry_area.o
 
 # Make sure __phys_addr has no stackprotector
 nostackp := $(call cc-option, -fno-stack-protector)
@@ -41,9 +41,10 @@ obj-$(CONFIG_AMD_NUMA)		+= amdtopology.o
 obj-$(CONFIG_ACPI_NUMA)         += srat.o
 obj-$(CONFIG_NUMA_EMU)          += numa_emulation.o
 
-obj-$(CONFIG_X86_INTEL_MPX)     += mpx.o
-obj-$(CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS) += pkeys.o
-obj-$(CONFIG_RANDOMIZE_MEMORY) += kaslr.o
+obj-$(CONFIG_X86_INTEL_MPX)                     += mpx.o
+obj-$(CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS)  += pkeys.o
+obj-$(CONFIG_RANDOMIZE_MEMORY)                  += kaslr.o
+obj-$(CONFIG_PAGE_TABLE_ISOLATION)              += pti.o
 
 obj-$(CONFIG_AMD_MEM_ENCRYPT)   += mem_encrypt.o
 obj-$(CONFIG_AMD_MEM_ENCRYPT)   += mem_encrypt_boot.o
diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c
new file mode 100644
index 000000000000..b9283cc27622
--- /dev/null
+++ b/arch/x86/mm/cpu_entry_area.c
@@ -0,0 +1,166 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/spinlock.h>
+#include <linux/percpu.h>
+
+#include <asm/cpu_entry_area.h>
+#include <asm/pgtable.h>
+#include <asm/fixmap.h>
+#include <asm/desc.h>
+
+static DEFINE_PER_CPU_PAGE_ALIGNED(struct entry_stack_page, entry_stack_storage);
+
+#ifdef CONFIG_X86_64
+static DEFINE_PER_CPU_PAGE_ALIGNED(char, exception_stacks
+        [(N_EXCEPTION_STACKS - 1) * EXCEPTION_STKSZ + DEBUG_STKSZ]);
+#endif
+
+struct cpu_entry_area *get_cpu_entry_area(int cpu)
+{
+        unsigned long va = CPU_ENTRY_AREA_PER_CPU + cpu * CPU_ENTRY_AREA_SIZE;
+        BUILD_BUG_ON(sizeof(struct cpu_entry_area) % PAGE_SIZE != 0);
+
+        return (struct cpu_entry_area *) va;
+}
+EXPORT_SYMBOL(get_cpu_entry_area);
+
+void cea_set_pte(void *cea_vaddr, phys_addr_t pa, pgprot_t flags)
+{
+        unsigned long va = (unsigned long) cea_vaddr;
+
+        set_pte_vaddr(va, pfn_pte(pa >> PAGE_SHIFT, flags));
+}
+
+static void __init
+cea_map_percpu_pages(void *cea_vaddr, void *ptr, int pages, pgprot_t prot)
+{
+        for ( ; pages; pages--, cea_vaddr+= PAGE_SIZE, ptr += PAGE_SIZE)
+                cea_set_pte(cea_vaddr, per_cpu_ptr_to_phys(ptr), prot);
+}
+
+static void percpu_setup_debug_store(int cpu)
+{
+#ifdef CONFIG_CPU_SUP_INTEL
+        int npages;
+        void *cea;
+
+        if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
+                return;
+
+        cea = &get_cpu_entry_area(cpu)->cpu_debug_store;
+        npages = sizeof(struct debug_store) / PAGE_SIZE;
+        BUILD_BUG_ON(sizeof(struct debug_store) % PAGE_SIZE != 0);
+        cea_map_percpu_pages(cea, &per_cpu(cpu_debug_store, cpu), npages,
+                             PAGE_KERNEL);
+
+        cea = &get_cpu_entry_area(cpu)->cpu_debug_buffers;
+        /*
+         * Force the population of PMDs for not yet allocated per cpu
+         * memory like debug store buffers.
+         */
+        npages = sizeof(struct debug_store_buffers) / PAGE_SIZE;
+        for (; npages; npages--, cea += PAGE_SIZE)
+                cea_set_pte(cea, 0, PAGE_NONE);
+#endif
+}
+
+/* Setup the fixmap mappings only once per-processor */
+static void __init setup_cpu_entry_area(int cpu)
+{
+#ifdef CONFIG_X86_64
+        extern char _entry_trampoline[];
+
+        /* On 64-bit systems, we use a read-only fixmap GDT and TSS. */
+        pgprot_t gdt_prot = PAGE_KERNEL_RO;
+        pgprot_t tss_prot = PAGE_KERNEL_RO;
+#else
+        /*
+         * On native 32-bit systems, the GDT cannot be read-only because
+         * our double fault handler uses a task gate, and entering through
+         * a task gate needs to change an available TSS to busy.  If the
+         * GDT is read-only, that will triple fault.  The TSS cannot be
+         * read-only because the CPU writes to it on task switches.
+         *
+         * On Xen PV, the GDT must be read-only because the hypervisor
+         * requires it.
+         */
+        pgprot_t gdt_prot = boot_cpu_has(X86_FEATURE_XENPV) ?
+                PAGE_KERNEL_RO : PAGE_KERNEL;
+        pgprot_t tss_prot = PAGE_KERNEL;
+#endif
+
+        cea_set_pte(&get_cpu_entry_area(cpu)->gdt, get_cpu_gdt_paddr(cpu),
+                    gdt_prot);
+
+        cea_map_percpu_pages(&get_cpu_entry_area(cpu)->entry_stack_page,
+                             per_cpu_ptr(&entry_stack_storage, cpu), 1,
+                             PAGE_KERNEL);
+
+        /*
+         * The Intel SDM says (Volume 3, 7.2.1):
+         *
+         *  Avoid placing a page boundary in the part of the TSS that the
+         *  processor reads during a task switch (the first 104 bytes). The
+         *  processor may not correctly perform address translations if a
+         *  boundary occurs in this area. During a task switch, the processor
+         *  reads and writes into the first 104 bytes of each TSS (using
+         *  contiguous physical addresses beginning with the physical address
+         *  of the first byte of the TSS). So, after TSS access begins, if
+         *  part of the 104 bytes is not physically contiguous, the processor
+         *  will access incorrect information without generating a page-fault
+         *  exception.
+         *
+         * There are also a lot of errata involving the TSS spanning a page
+         * boundary.  Assert that we're not doing that.
+         */
+        BUILD_BUG_ON((offsetof(struct tss_struct, x86_tss) ^
+                      offsetofend(struct tss_struct, x86_tss)) & PAGE_MASK);
+        BUILD_BUG_ON(sizeof(struct tss_struct) % PAGE_SIZE != 0);
+        cea_map_percpu_pages(&get_cpu_entry_area(cpu)->tss,
+                             &per_cpu(cpu_tss_rw, cpu),
+                             sizeof(struct tss_struct) / PAGE_SIZE, tss_prot);
+
+#ifdef CONFIG_X86_32
+        per_cpu(cpu_entry_area, cpu) = get_cpu_entry_area(cpu);
+#endif
+
+#ifdef CONFIG_X86_64
+        BUILD_BUG_ON(sizeof(exception_stacks) % PAGE_SIZE != 0);
+        BUILD_BUG_ON(sizeof(exception_stacks) !=
+                     sizeof(((struct cpu_entry_area *)0)->exception_stacks));
+        cea_map_percpu_pages(&get_cpu_entry_area(cpu)->exception_stacks,
+                             &per_cpu(exception_stacks, cpu),
+                             sizeof(exception_stacks) / PAGE_SIZE, PAGE_KERNEL);
+
+        cea_set_pte(&get_cpu_entry_area(cpu)->entry_trampoline,
+                     __pa_symbol(_entry_trampoline), PAGE_KERNEL_RX);
+#endif
+        percpu_setup_debug_store(cpu);
+}
+
+static __init void setup_cpu_entry_area_ptes(void)
+{
+#ifdef CONFIG_X86_32
+        unsigned long start, end;
+
+        BUILD_BUG_ON(CPU_ENTRY_AREA_PAGES * PAGE_SIZE < CPU_ENTRY_AREA_MAP_SIZE);
+        BUG_ON(CPU_ENTRY_AREA_BASE & ~PMD_MASK);
+
+        start = CPU_ENTRY_AREA_BASE;
+        end = start + CPU_ENTRY_AREA_MAP_SIZE;
+
+        /* Careful here: start + PMD_SIZE might wrap around */
+        for (; start < end && start >= CPU_ENTRY_AREA_BASE; start += PMD_SIZE)
+                populate_extra_pte(start);
+#endif
+}
+
+void __init setup_cpu_entry_areas(void)
+{
+        unsigned int cpu;
+
+        setup_cpu_entry_area_ptes();
+
+        for_each_possible_cpu(cpu)
+                setup_cpu_entry_area(cpu);
+}
diff --git a/arch/x86/mm/debug_pagetables.c b/arch/x86/mm/debug_pagetables.c
index bfcffdf6c577..421f2664ffa0 100644
--- a/arch/x86/mm/debug_pagetables.c
+++ b/arch/x86/mm/debug_pagetables.c
@@ -5,7 +5,7 @@
 
 static int ptdump_show(struct seq_file *m, void *v)
 {
-        ptdump_walk_pgd_level(m, NULL);
+        ptdump_walk_pgd_level_debugfs(m, NULL, false);
         return 0;
 }
 
@@ -22,21 +22,89 @@ static const struct file_operations ptdump_fops = {
         .release        = single_release,
 };
 
-static struct dentry *pe;
+static int ptdump_show_curknl(struct seq_file *m, void *v)
+{
+        if (current->mm->pgd) {
+                down_read(&current->mm->mmap_sem);
+                ptdump_walk_pgd_level_debugfs(m, current->mm->pgd, false);
+                up_read(&current->mm->mmap_sem);
+        }
+        return 0;
+}
+
+static int ptdump_open_curknl(struct inode *inode, struct file *filp)
+{
+        return single_open(filp, ptdump_show_curknl, NULL);
+}
+
+static const struct file_operations ptdump_curknl_fops = {
+        .owner          = THIS_MODULE,
+        .open           = ptdump_open_curknl,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+static struct dentry *pe_curusr;
+
+static int ptdump_show_curusr(struct seq_file *m, void *v)
+{
+        if (current->mm->pgd) {
+                down_read(&current->mm->mmap_sem);
+                ptdump_walk_pgd_level_debugfs(m, current->mm->pgd, true);
+                up_read(&current->mm->mmap_sem);
+        }
+        return 0;
+}
+
+static int ptdump_open_curusr(struct inode *inode, struct file *filp)
+{
+        return single_open(filp, ptdump_show_curusr, NULL);
+}
+
+static const struct file_operations ptdump_curusr_fops = {
+        .owner          = THIS_MODULE,
+        .open           = ptdump_open_curusr,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+#endif
+
+static struct dentry *dir, *pe_knl, *pe_curknl;
 
 static int __init pt_dump_debug_init(void)
 {
-        pe = debugfs_create_file("kernel_page_tables", S_IRUSR, NULL, NULL,
-                                 &ptdump_fops);
-        if (!pe)
+        dir = debugfs_create_dir("page_tables", NULL);
+        if (!dir)
                 return -ENOMEM;
 
+        pe_knl = debugfs_create_file("kernel", 0400, dir, NULL,
+                                     &ptdump_fops);
+        if (!pe_knl)
+                goto err;
+
+        pe_curknl = debugfs_create_file("current_kernel", 0400,
+                                        dir, NULL, &ptdump_curknl_fops);
+        if (!pe_curknl)
+                goto err;
+
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+        pe_curusr = debugfs_create_file("current_user", 0400,
+                                        dir, NULL, &ptdump_curusr_fops);
+        if (!pe_curusr)
+                goto err;
+#endif
         return 0;
+err:
+        debugfs_remove_recursive(dir);
+        return -ENOMEM;
 }
 
 static void __exit pt_dump_debug_exit(void)
 {
-        debugfs_remove_recursive(pe);
+        debugfs_remove_recursive(dir);
 }
 
 module_init(pt_dump_debug_init);
diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
index 5e3ac6fe6c9e..2a4849e92831 100644
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
@@ -44,68 +44,97 @@ struct addr_marker {
         unsigned long max_lines;
 };
 
-/* indices for address_markers; keep sync'd w/ address_markers below */
+/* Address space markers hints */
+
+#ifdef CONFIG_X86_64
+
 enum address_markers_idx {
         USER_SPACE_NR = 0,
-#ifdef CONFIG_X86_64
         KERNEL_SPACE_NR,
         LOW_KERNEL_NR,
+#if defined(CONFIG_MODIFY_LDT_SYSCALL) && defined(CONFIG_X86_5LEVEL)
+        LDT_NR,
+#endif
         VMALLOC_START_NR,
         VMEMMAP_START_NR,
 #ifdef CONFIG_KASAN
         KASAN_SHADOW_START_NR,
         KASAN_SHADOW_END_NR,
 #endif
-# ifdef CONFIG_X86_ESPFIX64
+        CPU_ENTRY_AREA_NR,
+#if defined(CONFIG_MODIFY_LDT_SYSCALL) && !defined(CONFIG_X86_5LEVEL)
+        LDT_NR,
+#endif
+#ifdef CONFIG_X86_ESPFIX64
         ESPFIX_START_NR,
-# endif
+#endif
+#ifdef CONFIG_EFI
+        EFI_END_NR,
+#endif
         HIGH_KERNEL_NR,
         MODULES_VADDR_NR,
         MODULES_END_NR,
-#else
+        FIXADDR_START_NR,
+        END_OF_SPACE_NR,
+};
+
+static struct addr_marker address_markers[] = {
+        [USER_SPACE_NR]         = { 0,                  "User Space" },
+        [KERNEL_SPACE_NR]       = { (1UL << 63),        "Kernel Space" },
+        [LOW_KERNEL_NR]         = { 0UL,                "Low Kernel Mapping" },
+        [VMALLOC_START_NR]      = { 0UL,                "vmalloc() Area" },
+        [VMEMMAP_START_NR]      = { 0UL,                "Vmemmap" },
+#ifdef CONFIG_KASAN
+        [KASAN_SHADOW_START_NR] = { KASAN_SHADOW_START, "KASAN shadow" },
+        [KASAN_SHADOW_END_NR]   = { KASAN_SHADOW_END,   "KASAN shadow end" },
+#endif
+#ifdef CONFIG_MODIFY_LDT_SYSCALL
+        [LDT_NR]                = { LDT_BASE_ADDR,      "LDT remap" },
+#endif
+        [CPU_ENTRY_AREA_NR]     = { CPU_ENTRY_AREA_BASE,"CPU entry Area" },
+#ifdef CONFIG_X86_ESPFIX64
+        [ESPFIX_START_NR]       = { ESPFIX_BASE_ADDR,   "ESPfix Area", 16 },
+#endif
+#ifdef CONFIG_EFI
+        [EFI_END_NR]            = { EFI_VA_END,         "EFI Runtime Services" },
+#endif
+        [HIGH_KERNEL_NR]        = { __START_KERNEL_map, "High Kernel Mapping" },
+        [MODULES_VADDR_NR]      = { MODULES_VADDR,      "Modules" },
+        [MODULES_END_NR]        = { MODULES_END,        "End Modules" },
+        [FIXADDR_START_NR]      = { FIXADDR_START,      "Fixmap Area" },
+        [END_OF_SPACE_NR]       = { -1,                 NULL }
+};
+
+#else /* CONFIG_X86_64 */
+
+enum address_markers_idx {
+        USER_SPACE_NR = 0,
         KERNEL_SPACE_NR,
         VMALLOC_START_NR,
         VMALLOC_END_NR,
-# ifdef CONFIG_HIGHMEM
+#ifdef CONFIG_HIGHMEM
         PKMAP_BASE_NR,
-# endif
-        FIXADDR_START_NR,
 #endif
+        CPU_ENTRY_AREA_NR,
+        FIXADDR_START_NR,
+        END_OF_SPACE_NR,
 };
 
-/* Address space markers hints */
 static struct addr_marker address_markers[] = {
-        { 0, "User Space" },
-#ifdef CONFIG_X86_64
-        { 0x8000000000000000UL, "Kernel Space" },
-        { 0/* PAGE_OFFSET */,   "Low Kernel Mapping" },
-        { 0/* VMALLOC_START */, "vmalloc() Area" },
-        { 0/* VMEMMAP_START */, "Vmemmap" },
-#ifdef CONFIG_KASAN
-        { KASAN_SHADOW_START,   "KASAN shadow" },
-        { KASAN_SHADOW_END,     "KASAN shadow end" },
+        [USER_SPACE_NR]         = { 0,                  "User Space" },
+        [KERNEL_SPACE_NR]       = { PAGE_OFFSET,        "Kernel Mapping" },
+        [VMALLOC_START_NR]      = { 0UL,                "vmalloc() Area" },
+        [VMALLOC_END_NR]        = { 0UL,                "vmalloc() End" },
+#ifdef CONFIG_HIGHMEM
+        [PKMAP_BASE_NR]         = { 0UL,                "Persistent kmap() Area" },
 #endif
-# ifdef CONFIG_X86_ESPFIX64
-        { ESPFIX_BASE_ADDR,     "ESPfix Area", 16 },
-# endif
-# ifdef CONFIG_EFI
-        { EFI_VA_END,           "EFI Runtime Services" },
-# endif
-        { __START_KERNEL_map,   "High Kernel Mapping" },
-        { MODULES_VADDR,        "Modules" },
-        { MODULES_END,          "End Modules" },
-#else
-        { PAGE_OFFSET,          "Kernel Mapping" },
-        { 0/* VMALLOC_START */, "vmalloc() Area" },
-        { 0/*VMALLOC_END*/,     "vmalloc() End" },
-# ifdef CONFIG_HIGHMEM
-        { 0/*PKMAP_BASE*/,      "Persistent kmap() Area" },
-# endif
-        { 0/*FIXADDR_START*/,   "Fixmap Area" },
-#endif
-        { -1, NULL }            /* End of list */
+        [CPU_ENTRY_AREA_NR]     = { 0UL,                "CPU entry area" },
+        [FIXADDR_START_NR]      = { 0UL,                "Fixmap area" },
+        [END_OF_SPACE_NR]       = { -1,                 NULL }
 };
 
+#endif /* !CONFIG_X86_64 */
+
 /* Multipliers for offsets within the PTEs */
 #define PTE_LEVEL_MULT (PAGE_SIZE)
 #define PMD_LEVEL_MULT (PTRS_PER_PTE * PTE_LEVEL_MULT)
@@ -140,7 +169,7 @@ static void printk_prot(struct seq_file *m, pgprot_t prot, int level, bool dmsg)
         static const char * const level_name[] =
                 { "cr3", "pgd", "p4d", "pud", "pmd", "pte" };
 
-        if (!pgprot_val(prot)) {
+        if (!(pr & _PAGE_PRESENT)) {
                 /* Not present */
                 pt_dump_cont_printf(m, dmsg, "                              ");
         } else {
@@ -447,7 +476,7 @@ static inline bool is_hypervisor_range(int idx)
 }
 
 static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
-                                       bool checkwx)
+                                       bool checkwx, bool dmesg)
 {
 #ifdef CONFIG_X86_64
         pgd_t *start = (pgd_t *) &init_top_pgt;
@@ -460,7 +489,7 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
 
         if (pgd) {
                 start = pgd;
-                st.to_dmesg = true;
+                st.to_dmesg = dmesg;
         }
 
         st.check_wx = checkwx;
@@ -498,13 +527,37 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
 
 void ptdump_walk_pgd_level(struct seq_file *m, pgd_t *pgd)
 {
-        ptdump_walk_pgd_level_core(m, pgd, false);
+        ptdump_walk_pgd_level_core(m, pgd, false, true);
+}
+
+void ptdump_walk_pgd_level_debugfs(struct seq_file *m, pgd_t *pgd, bool user)
+{
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+        if (user && static_cpu_has(X86_FEATURE_PTI))
+                pgd = kernel_to_user_pgdp(pgd);
+#endif
+        ptdump_walk_pgd_level_core(m, pgd, false, false);
+}
+EXPORT_SYMBOL_GPL(ptdump_walk_pgd_level_debugfs);
+
+static void ptdump_walk_user_pgd_level_checkwx(void)
+{
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+        pgd_t *pgd = (pgd_t *) &init_top_pgt;
+
+        if (!static_cpu_has(X86_FEATURE_PTI))
+                return;
+
+        pr_info("x86/mm: Checking user space page tables\n");
+        pgd = kernel_to_user_pgdp(pgd);
+        ptdump_walk_pgd_level_core(NULL, pgd, true, false);
+#endif
 }
-EXPORT_SYMBOL_GPL(ptdump_walk_pgd_level);
 
 void ptdump_walk_pgd_level_checkwx(void)
 {
-        ptdump_walk_pgd_level_core(NULL, NULL, true);
+        ptdump_walk_pgd_level_core(NULL, NULL, true, false);
+        ptdump_walk_user_pgd_level_checkwx();
 }
 
 static int __init pt_dump_init(void)
@@ -525,8 +578,8 @@ static int __init pt_dump_init(void)
         address_markers[PKMAP_BASE_NR].start_address = PKMAP_BASE;
 # endif
         address_markers[FIXADDR_START_NR].start_address = FIXADDR_START;
+        address_markers[CPU_ENTRY_AREA_NR].start_address = CPU_ENTRY_AREA_BASE;
 #endif
-
         return 0;
 }
 __initcall(pt_dump_init);
diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
index 3321b446b66c..9fe656c42aa5 100644
--- a/arch/x86/mm/extable.c
+++ b/arch/x86/mm/extable.c
@@ -1,6 +1,7 @@
 #include <linux/extable.h>
 #include <linux/uaccess.h>
 #include <linux/sched/debug.h>
+#include <xen/xen.h>
 
 #include <asm/fpu/internal.h>
 #include <asm/traps.h>
@@ -82,7 +83,7 @@ bool ex_handler_refcount(const struct exception_table_entry *fixup,
 
         return true;
 }
-EXPORT_SYMBOL_GPL(ex_handler_refcount);
+EXPORT_SYMBOL(ex_handler_refcount);
 
 /*
  * Handler for when we fail to restore a task's FPU state.  We should never get
@@ -212,8 +213,9 @@ void __init early_fixup_exception(struct pt_regs *regs, int trapnr)
          * Old CPUs leave the high bits of CS on the stack
          * undefined.  I'm not sure which CPUs do this, but at least
          * the 486 DX works this way.
+         * Xen pv domains are not using the default __KERNEL_CS.
          */
-        if (regs->cs != __KERNEL_CS)
+        if (!xen_pv_domain() && regs->cs != __KERNEL_CS)
                 goto fail;
 
         /*
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 78ca9a8ee454..800de815519c 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -172,14 +172,15 @@ is_prefetch(struct pt_regs *regs, unsigned long error_code, unsigned long addr)
  * 6. T1   : reaches here, sees vma_pkey(vma)=5, when we really
  *           faulted on a pte with its pkey=4.
  */
-static void fill_sig_info_pkey(int si_code, siginfo_t *info, u32 *pkey)
+static void fill_sig_info_pkey(int si_signo, int si_code, siginfo_t *info,
+                u32 *pkey)
 {
         /* This is effectively an #ifdef */
         if (!boot_cpu_has(X86_FEATURE_OSPKE))
                 return;
 
         /* Fault not from Protection Keys: nothing to do */
-        if (si_code != SEGV_PKUERR)
+        if ((si_code != SEGV_PKUERR) || (si_signo != SIGSEGV))
                 return;
         /*
          * force_sig_info_fault() is called from a number of
@@ -218,7 +219,7 @@ force_sig_info_fault(int si_signo, int si_code, unsigned long address,
                 lsb = PAGE_SHIFT;
         info.si_addr_lsb = lsb;
 
-        fill_sig_info_pkey(si_code, &info, pkey);
+        fill_sig_info_pkey(si_signo, si_code, &info, pkey);
 
         force_sig_info(si_signo, &info, tsk);
 }
@@ -438,18 +439,13 @@ static noinline int vmalloc_fault(unsigned long address)
         if (pgd_none(*pgd_ref))
                 return -1;
 
-        if (pgd_none(*pgd)) {
-                set_pgd(pgd, *pgd_ref);
-                arch_flush_lazy_mmu_mode();
-        } else if (CONFIG_PGTABLE_LEVELS > 4) {
-                /*
-                 * With folded p4d, pgd_none() is always false, so the pgd may
-                 * point to an empty page table entry and pgd_page_vaddr()
-                 * will return garbage.
-                 *
-                 * We will do the correct sanity check on the p4d level.
-                 */
-                BUG_ON(pgd_page_vaddr(*pgd) != pgd_page_vaddr(*pgd_ref));
+        if (CONFIG_PGTABLE_LEVELS > 4) {
+                if (pgd_none(*pgd)) {
+                        set_pgd(pgd, *pgd_ref);
+                        arch_flush_lazy_mmu_mode();
+                } else {
+                        BUG_ON(pgd_page_vaddr(*pgd) != pgd_page_vaddr(*pgd_ref));
+                }
         }
 
         /* With 4-level paging, copying happens on the p4d level. */
@@ -458,7 +454,7 @@ static noinline int vmalloc_fault(unsigned long address)
         if (p4d_none(*p4d_ref))
                 return -1;
 
-        if (p4d_none(*p4d)) {
+        if (p4d_none(*p4d) && CONFIG_PGTABLE_LEVELS == 4) {
                 set_p4d(p4d, *p4d_ref);
                 arch_flush_lazy_mmu_mode();
         } else {
@@ -469,6 +465,7 @@ static noinline int vmalloc_fault(unsigned long address)
          * Below here mismatches are bugs because these lower tables
          * are shared:
          */
+        BUILD_BUG_ON(CONFIG_PGTABLE_LEVELS < 4);
 
         pud = pud_offset(p4d, address);
         pud_ref = pud_offset(p4d_ref, address);
@@ -701,7 +698,7 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
         else
                 printk(KERN_CONT "paging request");
 
-        printk(KERN_CONT " at %p\n", (void *) address);
+        printk(KERN_CONT " at %px\n", (void *) address);
         printk(KERN_ALERT "IP: %pS\n", (void *)regs->ip);
 
         dump_pagetable(address);
@@ -860,7 +857,7 @@ show_signal_msg(struct pt_regs *regs, unsigned long error_code,
         if (!printk_ratelimit())
                 return;
 
-        printk("%s%s[%d]: segfault at %lx ip %p sp %p error %lx",
+        printk("%s%s[%d]: segfault at %lx ip %px sp %px error %lx",
                 task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,
                 tsk->comm, task_pid_nr(tsk), address,
                 (void *)regs->ip, (void *)regs->sp, error_code);
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index 6fdf91ef130a..82f5252c723a 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -20,6 +20,7 @@
 #include <asm/kaslr.h>
 #include <asm/hypervisor.h>
 #include <asm/cpufeature.h>
+#include <asm/pti.h>
 
 /*
  * We need to define the tracepoints somewhere, and tlb.c
@@ -160,6 +161,12 @@ struct map_range {
 
 static int page_size_mask;
 
+static void enable_global_pages(void)
+{
+        if (!static_cpu_has(X86_FEATURE_PTI))
+                __supported_pte_mask |= _PAGE_GLOBAL;
+}
+
 static void __init probe_page_size_mask(void)
 {
         /*
@@ -177,11 +184,11 @@ static void __init probe_page_size_mask(void)
                 cr4_set_bits_and_update_boot(X86_CR4_PSE);
 
         /* Enable PGE if available */
+        __supported_pte_mask &= ~_PAGE_GLOBAL;
         if (boot_cpu_has(X86_FEATURE_PGE)) {
                 cr4_set_bits_and_update_boot(X86_CR4_PGE);
-                __supported_pte_mask |= _PAGE_GLOBAL;
-        } else
-                __supported_pte_mask &= ~_PAGE_GLOBAL;
+                enable_global_pages();
+        }
 
         /* Enable 1 GB linear kernel mappings if available: */
         if (direct_gbpages && boot_cpu_has(X86_FEATURE_GBPAGES)) {
@@ -194,34 +201,44 @@ static void __init probe_page_size_mask(void)
 
 static void setup_pcid(void)
 {
-#ifdef CONFIG_X86_64
-        if (boot_cpu_has(X86_FEATURE_PCID)) {
-                if (boot_cpu_has(X86_FEATURE_PGE)) {
-                        /*
-                         * This can't be cr4_set_bits_and_update_boot() --
-                         * the trampoline code can't handle CR4.PCIDE and
-                         * it wouldn't do any good anyway.  Despite the name,
-                         * cr4_set_bits_and_update_boot() doesn't actually
-                         * cause the bits in question to remain set all the
-                         * way through the secondary boot asm.
-                         *
-                         * Instead, we brute-force it and set CR4.PCIDE
-                         * manually in start_secondary().
-                         */
-                        cr4_set_bits(X86_CR4_PCIDE);
-                } else {
-                        /*
-                         * flush_tlb_all(), as currently implemented, won't
-                         * work if PCID is on but PGE is not.  Since that
-                         * combination doesn't exist on real hardware, there's
-                         * no reason to try to fully support it, but it's
-                         * polite to avoid corrupting data if we're on
-                         * an improperly configured VM.
-                         */
-                        setup_clear_cpu_cap(X86_FEATURE_PCID);
-                }
+        if (!IS_ENABLED(CONFIG_X86_64))
+                return;
+
+        if (!boot_cpu_has(X86_FEATURE_PCID))
+                return;
+
+        if (boot_cpu_has(X86_FEATURE_PGE)) {
+                /*
+                 * This can't be cr4_set_bits_and_update_boot() -- the
+                 * trampoline code can't handle CR4.PCIDE and it wouldn't
+                 * do any good anyway.  Despite the name,
+                 * cr4_set_bits_and_update_boot() doesn't actually cause
+                 * the bits in question to remain set all the way through
+                 * the secondary boot asm.
+                 *
+                 * Instead, we brute-force it and set CR4.PCIDE manually in
+                 * start_secondary().
+                 */
+                cr4_set_bits(X86_CR4_PCIDE);
+
+                /*
+                 * INVPCID's single-context modes (2/3) only work if we set
+                 * X86_CR4_PCIDE, *and* we INVPCID support.  It's unusable
+                 * on systems that have X86_CR4_PCIDE clear, or that have
+                 * no INVPCID support at all.
+                 */
+                if (boot_cpu_has(X86_FEATURE_INVPCID))
+                        setup_force_cpu_cap(X86_FEATURE_INVPCID_SINGLE);
+        } else {
+                /*
+                 * flush_tlb_all(), as currently implemented, won't work if
+                 * PCID is on but PGE is not.  Since that combination
+                 * doesn't exist on real hardware, there's no reason to try
+                 * to fully support it, but it's polite to avoid corrupting
+                 * data if we're on an improperly configured VM.
+                 */
+                setup_clear_cpu_cap(X86_FEATURE_PCID);
         }
-#endif
 }
 
 #ifdef CONFIG_X86_32
@@ -622,6 +639,7 @@ void __init init_mem_mapping(void)
 {
         unsigned long end;
 
+        pti_check_boottime_disable();
         probe_page_size_mask();
         setup_pcid();
 
@@ -845,12 +863,12 @@ void __init zone_sizes_init(void)
         free_area_init_nodes(max_zone_pfns);
 }
 
-DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate) = {
+__visible DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate) = {
         .loaded_mm = &init_mm,
         .next_asid = 1,
         .cr4 = ~0UL,    /* fail hard if we screw up cr4 shadow initialization */
 };
-EXPORT_SYMBOL_GPL(cpu_tlbstate);
+EXPORT_PER_CPU_SYMBOL(cpu_tlbstate);
 
 void update_cache_mode_entry(unsigned entry, enum page_cache_mode cache)
 {
diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
index 8a64a6f2848d..135c9a7898c7 100644
--- a/arch/x86/mm/init_32.c
+++ b/arch/x86/mm/init_32.c
@@ -50,6 +50,7 @@
 #include <asm/setup.h>
 #include <asm/set_memory.h>
 #include <asm/page_types.h>
+#include <asm/cpu_entry_area.h>
 #include <asm/init.h>
 
 #include "mm_internal.h"
@@ -766,6 +767,7 @@ void __init mem_init(void)
         mem_init_print_info(NULL);
         printk(KERN_INFO "virtual kernel memory layout:\n"
                 "    fixmap  : 0x%08lx - 0x%08lx   (%4ld kB)\n"
+                "  cpu_entry : 0x%08lx - 0x%08lx   (%4ld kB)\n"
 #ifdef CONFIG_HIGHMEM
                 "    pkmap   : 0x%08lx - 0x%08lx   (%4ld kB)\n"
 #endif
@@ -777,6 +779,10 @@ void __init mem_init(void)
                 FIXADDR_START, FIXADDR_TOP,
                 (FIXADDR_TOP - FIXADDR_START) >> 10,
 
+                CPU_ENTRY_AREA_BASE,
+                CPU_ENTRY_AREA_BASE + CPU_ENTRY_AREA_MAP_SIZE,
+                CPU_ENTRY_AREA_MAP_SIZE >> 10,
+
 #ifdef CONFIG_HIGHMEM
                 PKMAP_BASE, PKMAP_BASE+LAST_PKMAP*PAGE_SIZE,
                 (LAST_PKMAP*PAGE_SIZE) >> 10,
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 6e4573b1da34..c45b6ec5357b 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -404,11 +404,11 @@ void iounmap(volatile void __iomem *addr)
                 return;
         }
 
+        mmiotrace_iounmap(addr);
+
         addr = (volatile void __iomem *)
                 (PAGE_MASK & (unsigned long __force)addr);
 
-        mmiotrace_iounmap(addr);
-
         /* Use the vm area unlocked, assuming the caller
            ensures there isn't another iounmap for the same address
            in parallel. Reuse of the virtual address is prevented by
diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c
index 99dfed6dfef8..af6f2f9c6a26 100644
--- a/arch/x86/mm/kasan_init_64.c
+++ b/arch/x86/mm/kasan_init_64.c
@@ -15,15 +15,20 @@
 #include <asm/tlbflush.h>
 #include <asm/sections.h>
 #include <asm/pgtable.h>
+#include <asm/cpu_entry_area.h>
 
 extern struct range pfn_mapped[E820_MAX_ENTRIES];
 
 static p4d_t tmp_p4d_table[PTRS_PER_P4D] __initdata __aligned(PAGE_SIZE);
 
-static __init void *early_alloc(size_t size, int nid)
+static __init void *early_alloc(size_t size, int nid, bool panic)
 {
-        return memblock_virt_alloc_try_nid_nopanic(size, size,
-                __pa(MAX_DMA_ADDRESS), BOOTMEM_ALLOC_ACCESSIBLE, nid);
+        if (panic)
+                return memblock_virt_alloc_try_nid(size, size,
+                        __pa(MAX_DMA_ADDRESS), BOOTMEM_ALLOC_ACCESSIBLE, nid);
+        else
+                return memblock_virt_alloc_try_nid_nopanic(size, size,
+                        __pa(MAX_DMA_ADDRESS), BOOTMEM_ALLOC_ACCESSIBLE, nid);
 }
 
 static void __init kasan_populate_pmd(pmd_t *pmd, unsigned long addr,
@@ -37,14 +42,14 @@ static void __init kasan_populate_pmd(pmd_t *pmd, unsigned long addr,
                 if (boot_cpu_has(X86_FEATURE_PSE) &&
                     ((end - addr) == PMD_SIZE) &&
                     IS_ALIGNED(addr, PMD_SIZE)) {
-                        p = early_alloc(PMD_SIZE, nid);
+                        p = early_alloc(PMD_SIZE, nid, false);
                         if (p && pmd_set_huge(pmd, __pa(p), PAGE_KERNEL))
                                 return;
                         else if (p)
                                 memblock_free(__pa(p), PMD_SIZE);
                 }
 
-                p = early_alloc(PAGE_SIZE, nid);
+                p = early_alloc(PAGE_SIZE, nid, true);
                 pmd_populate_kernel(&init_mm, pmd, p);
         }
 
@@ -56,7 +61,7 @@ static void __init kasan_populate_pmd(pmd_t *pmd, unsigned long addr,
                 if (!pte_none(*pte))
                         continue;
 
-                p = early_alloc(PAGE_SIZE, nid);
+                p = early_alloc(PAGE_SIZE, nid, true);
                 entry = pfn_pte(PFN_DOWN(__pa(p)), PAGE_KERNEL);
                 set_pte_at(&init_mm, addr, pte, entry);
         } while (pte++, addr += PAGE_SIZE, addr != end);
@@ -74,14 +79,14 @@ static void __init kasan_populate_pud(pud_t *pud, unsigned long addr,
                 if (boot_cpu_has(X86_FEATURE_GBPAGES) &&
                     ((end - addr) == PUD_SIZE) &&
                     IS_ALIGNED(addr, PUD_SIZE)) {
-                        p = early_alloc(PUD_SIZE, nid);
+                        p = early_alloc(PUD_SIZE, nid, false);
                         if (p && pud_set_huge(pud, __pa(p), PAGE_KERNEL))
                                 return;
                         else if (p)
                                 memblock_free(__pa(p), PUD_SIZE);
                 }
 
-                p = early_alloc(PAGE_SIZE, nid);
+                p = early_alloc(PAGE_SIZE, nid, true);
                 pud_populate(&init_mm, pud, p);
         }
 
@@ -100,7 +105,7 @@ static void __init kasan_populate_p4d(p4d_t *p4d, unsigned long addr,
         unsigned long next;
 
         if (p4d_none(*p4d)) {
-                void *p = early_alloc(PAGE_SIZE, nid);
+                void *p = early_alloc(PAGE_SIZE, nid, true);
 
                 p4d_populate(&init_mm, p4d, p);
         }
@@ -121,7 +126,7 @@ static void __init kasan_populate_pgd(pgd_t *pgd, unsigned long addr,
         unsigned long next;
 
         if (pgd_none(*pgd)) {
-                p = early_alloc(PAGE_SIZE, nid);
+                p = early_alloc(PAGE_SIZE, nid, true);
                 pgd_populate(&init_mm, pgd, p);
         }
 
@@ -277,6 +282,7 @@ void __init kasan_early_init(void)
 void __init kasan_init(void)
 {
         int i;
+        void *shadow_cpu_entry_begin, *shadow_cpu_entry_end;
 
 #ifdef CONFIG_KASAN_INLINE
         register_die_notifier(&kasan_die_notifier);
@@ -321,16 +327,33 @@ void __init kasan_init(void)
                 map_range(&pfn_mapped[i]);
         }
 
+        shadow_cpu_entry_begin = (void *)CPU_ENTRY_AREA_BASE;
+        shadow_cpu_entry_begin = kasan_mem_to_shadow(shadow_cpu_entry_begin);
+        shadow_cpu_entry_begin = (void *)round_down((unsigned long)shadow_cpu_entry_begin,
+                                                PAGE_SIZE);
+
+        shadow_cpu_entry_end = (void *)(CPU_ENTRY_AREA_BASE +
+                                        CPU_ENTRY_AREA_MAP_SIZE);
+        shadow_cpu_entry_end = kasan_mem_to_shadow(shadow_cpu_entry_end);
+        shadow_cpu_entry_end = (void *)round_up((unsigned long)shadow_cpu_entry_end,
+                                        PAGE_SIZE);
+
         kasan_populate_zero_shadow(
                 kasan_mem_to_shadow((void *)PAGE_OFFSET + MAXMEM),
-                kasan_mem_to_shadow((void *)__START_KERNEL_map));
+                shadow_cpu_entry_begin);
+
+        kasan_populate_shadow((unsigned long)shadow_cpu_entry_begin,
+                              (unsigned long)shadow_cpu_entry_end, 0);
+
+        kasan_populate_zero_shadow(shadow_cpu_entry_end,
+                                kasan_mem_to_shadow((void *)__START_KERNEL_map));
 
         kasan_populate_shadow((unsigned long)kasan_mem_to_shadow(_stext),
                               (unsigned long)kasan_mem_to_shadow(_end),
                               early_pfn_to_nid(__pa(_stext)));
 
         kasan_populate_zero_shadow(kasan_mem_to_shadow((void *)MODULES_END),
-                        (void *)KASAN_SHADOW_END);
+                                (void *)KASAN_SHADOW_END);
 
         load_cr3(init_top_pgt);
         __flush_tlb_all();
diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c
index 879ef930e2c2..aedebd2ebf1e 100644
--- a/arch/x86/mm/kaslr.c
+++ b/arch/x86/mm/kaslr.c
@@ -34,25 +34,14 @@
 #define TB_SHIFT 40
 
 /*
- * Virtual address start and end range for randomization. The end changes base
- * on configuration to have the highest amount of space for randomization.
- * It increases the possible random position for each randomized region.
+ * Virtual address start and end range for randomization.
  *
- * You need to add an if/def entry if you introduce a new memory region
- * compatible with KASLR. Your entry must be in logical order with memory
- * layout. For example, ESPFIX is before EFI because its virtual address is
- * before. You also need to add a BUILD_BUG_ON() in kernel_randomize_memory() to
- * ensure that this order is correct and won't be changed.
+ * The end address could depend on more configuration options to make the
+ * highest amount of space for randomization available, but that's too hard
+ * to keep straight and caused issues already.
  */
 static const unsigned long vaddr_start = __PAGE_OFFSET_BASE;
-
-#if defined(CONFIG_X86_ESPFIX64)
-static const unsigned long vaddr_end = ESPFIX_BASE_ADDR;
-#elif defined(CONFIG_EFI)
-static const unsigned long vaddr_end = EFI_VA_END;
-#else
-static const unsigned long vaddr_end = __START_KERNEL_map;
-#endif
+static const unsigned long vaddr_end = CPU_ENTRY_AREA_BASE;
 
 /* Default values */
 unsigned long page_offset_base = __PAGE_OFFSET_BASE;
@@ -101,15 +90,12 @@ void __init kernel_randomize_memory(void)
         unsigned long remain_entropy;
 
         /*
-         * All these BUILD_BUG_ON checks ensures the memory layout is
-         * consistent with the vaddr_start/vaddr_end variables.
+         * These BUILD_BUG_ON checks ensure the memory layout is consistent
+         * with the vaddr_start/vaddr_end variables. These checks are very
+         * limited....
          */
         BUILD_BUG_ON(vaddr_start >= vaddr_end);
-        BUILD_BUG_ON(IS_ENABLED(CONFIG_X86_ESPFIX64) &&
-                     vaddr_end >= EFI_VA_END);
-        BUILD_BUG_ON((IS_ENABLED(CONFIG_X86_ESPFIX64) ||
-                      IS_ENABLED(CONFIG_EFI)) &&
-                     vaddr_end >= __START_KERNEL_map);
+        BUILD_BUG_ON(vaddr_end != CPU_ENTRY_AREA_BASE);
         BUILD_BUG_ON(vaddr_end > __START_KERNEL_map);
 
         if (!kaslr_memory_enabled())
diff --git a/arch/x86/mm/kmemcheck/error.c b/arch/x86/mm/kmemcheck/error.c
deleted file mode 100644
index cec594032515..000000000000
--- a/arch/x86/mm/kmemcheck/error.c
+++ /dev/null
@@ -1 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
diff --git a/arch/x86/mm/kmemcheck/error.h b/arch/x86/mm/kmemcheck/error.h
deleted file mode 100644
index ea32a7d3cf1b..000000000000
--- a/arch/x86/mm/kmemcheck/error.h
+++ /dev/null
@@ -1 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
diff --git a/arch/x86/mm/kmemcheck/opcode.c b/arch/x86/mm/kmemcheck/opcode.c
deleted file mode 100644
index cec594032515..000000000000
--- a/arch/x86/mm/kmemcheck/opcode.c
+++ /dev/null
@@ -1 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
diff --git a/arch/x86/mm/kmemcheck/opcode.h b/arch/x86/mm/kmemcheck/opcode.h
deleted file mode 100644
index ea32a7d3cf1b..000000000000
--- a/arch/x86/mm/kmemcheck/opcode.h
+++ /dev/null
@@ -1 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
diff --git a/arch/x86/mm/kmemcheck/pte.c b/arch/x86/mm/kmemcheck/pte.c
deleted file mode 100644
index cec594032515..000000000000
--- a/arch/x86/mm/kmemcheck/pte.c
+++ /dev/null
@@ -1 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
diff --git a/arch/x86/mm/kmemcheck/pte.h b/arch/x86/mm/kmemcheck/pte.h
deleted file mode 100644
index ea32a7d3cf1b..000000000000
--- a/arch/x86/mm/kmemcheck/pte.h
+++ /dev/null
@@ -1 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
diff --git a/arch/x86/mm/kmemcheck/selftest.c b/arch/x86/mm/kmemcheck/selftest.c
deleted file mode 100644
index cec594032515..000000000000
--- a/arch/x86/mm/kmemcheck/selftest.c
+++ /dev/null
@@ -1 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
diff --git a/arch/x86/mm/kmemcheck/selftest.h b/arch/x86/mm/kmemcheck/selftest.h
deleted file mode 100644
index ea32a7d3cf1b..000000000000
--- a/arch/x86/mm/kmemcheck/selftest.h
+++ /dev/null
@@ -1 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
diff --git a/arch/x86/mm/kmemcheck/shadow.h b/arch/x86/mm/kmemcheck/shadow.h
deleted file mode 100644
index ea32a7d3cf1b..000000000000
--- a/arch/x86/mm/kmemcheck/shadow.h
+++ /dev/null
@@ -1 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c
index c21c2ed04612..58477ec3d66d 100644
--- a/arch/x86/mm/kmmio.c
+++ b/arch/x86/mm/kmmio.c
@@ -435,17 +435,18 @@ int register_kmmio_probe(struct kmmio_probe *p)
         unsigned long flags;
         int ret = 0;
         unsigned long size = 0;
+        unsigned long addr = p->addr & PAGE_MASK;
         const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
         unsigned int l;
         pte_t *pte;
 
         spin_lock_irqsave(&kmmio_lock, flags);
-        if (get_kmmio_probe(p->addr)) {
+        if (get_kmmio_probe(addr)) {
                 ret = -EEXIST;
                 goto out;
         }
 
-        pte = lookup_address(p->addr, &l);
+        pte = lookup_address(addr, &l);
         if (!pte) {
                 ret = -EINVAL;
                 goto out;
@@ -454,7 +455,7 @@ int register_kmmio_probe(struct kmmio_probe *p)
         kmmio_count++;
         list_add_rcu(&p->list, &kmmio_probes);
         while (size < size_lim) {
-                if (add_kmmio_fault_page(p->addr + size))
+                if (add_kmmio_fault_page(addr + size))
                         pr_err("Unable to set page fault.\n");
                 size += page_level_size(l);
         }
@@ -528,19 +529,20 @@ void unregister_kmmio_probe(struct kmmio_probe *p)
 {
         unsigned long flags;
         unsigned long size = 0;
+        unsigned long addr = p->addr & PAGE_MASK;
         const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
         struct kmmio_fault_page *release_list = NULL;
         struct kmmio_delayed_release *drelease;
         unsigned int l;
         pte_t *pte;
 
-        pte = lookup_address(p->addr, &l);
+        pte = lookup_address(addr, &l);
         if (!pte)
                 return;
 
         spin_lock_irqsave(&kmmio_lock, flags);
         while (size < size_lim) {
-                release_kmmio_fault_page(p->addr + size, &release_list);
+                release_kmmio_fault_page(addr + size, &release_list);
                 size += page_level_size(l);
         }
         list_del_rcu(&p->list);
diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c
index d9a9e9fc75dd..e1d61e8500f9 100644
--- a/arch/x86/mm/mem_encrypt.c
+++ b/arch/x86/mm/mem_encrypt.c
@@ -405,13 +405,13 @@ bool sme_active(void)
 {
         return sme_me_mask && !sev_enabled;
 }
-EXPORT_SYMBOL_GPL(sme_active);
+EXPORT_SYMBOL(sme_active);
 
 bool sev_active(void)
 {
         return sme_me_mask && sev_enabled;
 }
-EXPORT_SYMBOL_GPL(sev_active);
+EXPORT_SYMBOL(sev_active);
 
 static const struct dma_map_ops sev_dma_ops = {
         .alloc                  = sev_alloc,
@@ -464,37 +464,62 @@ void swiotlb_set_mem_attributes(void *vaddr, unsigned long size)
         set_memory_decrypted((unsigned long)vaddr, size >> PAGE_SHIFT);
 }
 
-static void __init sme_clear_pgd(pgd_t *pgd_base, unsigned long start,
-                                 unsigned long end)
+struct sme_populate_pgd_data {
+        void    *pgtable_area;
+        pgd_t   *pgd;
+
+        pmdval_t pmd_flags;
+        pteval_t pte_flags;
+        unsigned long paddr;
+
+        unsigned long vaddr;
+        unsigned long vaddr_end;
+};
+
+static void __init sme_clear_pgd(struct sme_populate_pgd_data *ppd)
 {
         unsigned long pgd_start, pgd_end, pgd_size;
         pgd_t *pgd_p;
 
-        pgd_start = start & PGDIR_MASK;
-        pgd_end = end & PGDIR_MASK;
+        pgd_start = ppd->vaddr & PGDIR_MASK;
+        pgd_end = ppd->vaddr_end & PGDIR_MASK;
 
-        pgd_size = (((pgd_end - pgd_start) / PGDIR_SIZE) + 1);
-        pgd_size *= sizeof(pgd_t);
+        pgd_size = (((pgd_end - pgd_start) / PGDIR_SIZE) + 1) * sizeof(pgd_t);
 
-        pgd_p = pgd_base + pgd_index(start);
+        pgd_p = ppd->pgd + pgd_index(ppd->vaddr);
 
         memset(pgd_p, 0, pgd_size);
 }
 
-#define PGD_FLAGS       _KERNPG_TABLE_NOENC
-#define P4D_FLAGS       _KERNPG_TABLE_NOENC
-#define PUD_FLAGS       _KERNPG_TABLE_NOENC
-#define PMD_FLAGS       (__PAGE_KERNEL_LARGE_EXEC & ~_PAGE_GLOBAL)
+#define PGD_FLAGS               _KERNPG_TABLE_NOENC
+#define P4D_FLAGS               _KERNPG_TABLE_NOENC
+#define PUD_FLAGS               _KERNPG_TABLE_NOENC
+#define PMD_FLAGS               _KERNPG_TABLE_NOENC
+
+#define PMD_FLAGS_LARGE         (__PAGE_KERNEL_LARGE_EXEC & ~_PAGE_GLOBAL)
+
+#define PMD_FLAGS_DEC           PMD_FLAGS_LARGE
+#define PMD_FLAGS_DEC_WP        ((PMD_FLAGS_DEC & ~_PAGE_CACHE_MASK) | \
+                                 (_PAGE_PAT | _PAGE_PWT))
+
+#define PMD_FLAGS_ENC           (PMD_FLAGS_LARGE | _PAGE_ENC)
+
+#define PTE_FLAGS               (__PAGE_KERNEL_EXEC & ~_PAGE_GLOBAL)
+
+#define PTE_FLAGS_DEC           PTE_FLAGS
+#define PTE_FLAGS_DEC_WP        ((PTE_FLAGS_DEC & ~_PAGE_CACHE_MASK) | \
+                                 (_PAGE_PAT | _PAGE_PWT))
+
+#define PTE_FLAGS_ENC           (PTE_FLAGS | _PAGE_ENC)
 
-static void __init *sme_populate_pgd(pgd_t *pgd_base, void *pgtable_area,
-                                     unsigned long vaddr, pmdval_t pmd_val)
+static pmd_t __init *sme_prepare_pgd(struct sme_populate_pgd_data *ppd)
 {
         pgd_t *pgd_p;
         p4d_t *p4d_p;
         pud_t *pud_p;
         pmd_t *pmd_p;
 
-        pgd_p = pgd_base + pgd_index(vaddr);
+        pgd_p = ppd->pgd + pgd_index(ppd->vaddr);
         if (native_pgd_val(*pgd_p)) {
                 if (IS_ENABLED(CONFIG_X86_5LEVEL))
                         p4d_p = (p4d_t *)(native_pgd_val(*pgd_p) & ~PTE_FLAGS_MASK);
@@ -504,15 +529,15 @@ static void __init *sme_populate_pgd(pgd_t *pgd_base, void *pgtable_area,
                 pgd_t pgd;
 
                 if (IS_ENABLED(CONFIG_X86_5LEVEL)) {
-                        p4d_p = pgtable_area;
+                        p4d_p = ppd->pgtable_area;
                         memset(p4d_p, 0, sizeof(*p4d_p) * PTRS_PER_P4D);
-                        pgtable_area += sizeof(*p4d_p) * PTRS_PER_P4D;
+                        ppd->pgtable_area += sizeof(*p4d_p) * PTRS_PER_P4D;
 
                         pgd = native_make_pgd((pgdval_t)p4d_p + PGD_FLAGS);
                 } else {
-                        pud_p = pgtable_area;
+                        pud_p = ppd->pgtable_area;
                         memset(pud_p, 0, sizeof(*pud_p) * PTRS_PER_PUD);
-                        pgtable_area += sizeof(*pud_p) * PTRS_PER_PUD;
+                        ppd->pgtable_area += sizeof(*pud_p) * PTRS_PER_PUD;
 
                         pgd = native_make_pgd((pgdval_t)pud_p + PGD_FLAGS);
                 }
@@ -520,58 +545,160 @@ static void __init *sme_populate_pgd(pgd_t *pgd_base, void *pgtable_area,
         }
 
         if (IS_ENABLED(CONFIG_X86_5LEVEL)) {
-                p4d_p += p4d_index(vaddr);
+                p4d_p += p4d_index(ppd->vaddr);
                 if (native_p4d_val(*p4d_p)) {
                         pud_p = (pud_t *)(native_p4d_val(*p4d_p) & ~PTE_FLAGS_MASK);
                 } else {
                         p4d_t p4d;
 
-                        pud_p = pgtable_area;
+                        pud_p = ppd->pgtable_area;
                         memset(pud_p, 0, sizeof(*pud_p) * PTRS_PER_PUD);
-                        pgtable_area += sizeof(*pud_p) * PTRS_PER_PUD;
+                        ppd->pgtable_area += sizeof(*pud_p) * PTRS_PER_PUD;
 
                         p4d = native_make_p4d((pudval_t)pud_p + P4D_FLAGS);
                         native_set_p4d(p4d_p, p4d);
                 }
         }
 
-        pud_p += pud_index(vaddr);
+        pud_p += pud_index(ppd->vaddr);
         if (native_pud_val(*pud_p)) {
                 if (native_pud_val(*pud_p) & _PAGE_PSE)
-                        goto out;
+                        return NULL;
 
                 pmd_p = (pmd_t *)(native_pud_val(*pud_p) & ~PTE_FLAGS_MASK);
         } else {
                 pud_t pud;
 
-                pmd_p = pgtable_area;
+                pmd_p = ppd->pgtable_area;
                 memset(pmd_p, 0, sizeof(*pmd_p) * PTRS_PER_PMD);
-                pgtable_area += sizeof(*pmd_p) * PTRS_PER_PMD;
+                ppd->pgtable_area += sizeof(*pmd_p) * PTRS_PER_PMD;
 
                 pud = native_make_pud((pmdval_t)pmd_p + PUD_FLAGS);
                 native_set_pud(pud_p, pud);
         }
 
-        pmd_p += pmd_index(vaddr);
+        return pmd_p;
+}
+
+static void __init sme_populate_pgd_large(struct sme_populate_pgd_data *ppd)
+{
+        pmd_t *pmd_p;
+
+        pmd_p = sme_prepare_pgd(ppd);
+        if (!pmd_p)
+                return;
+
+        pmd_p += pmd_index(ppd->vaddr);
         if (!native_pmd_val(*pmd_p) || !(native_pmd_val(*pmd_p) & _PAGE_PSE))
-                native_set_pmd(pmd_p, native_make_pmd(pmd_val));
+                native_set_pmd(pmd_p, native_make_pmd(ppd->paddr | ppd->pmd_flags));
+}
 
-out:
-        return pgtable_area;
+static void __init sme_populate_pgd(struct sme_populate_pgd_data *ppd)
+{
+        pmd_t *pmd_p;
+        pte_t *pte_p;
+
+        pmd_p = sme_prepare_pgd(ppd);
+        if (!pmd_p)
+                return;
+
+        pmd_p += pmd_index(ppd->vaddr);
+        if (native_pmd_val(*pmd_p)) {
+                if (native_pmd_val(*pmd_p) & _PAGE_PSE)
+                        return;
+
+                pte_p = (pte_t *)(native_pmd_val(*pmd_p) & ~PTE_FLAGS_MASK);
+        } else {
+                pmd_t pmd;
+
+                pte_p = ppd->pgtable_area;
+                memset(pte_p, 0, sizeof(*pte_p) * PTRS_PER_PTE);
+                ppd->pgtable_area += sizeof(*pte_p) * PTRS_PER_PTE;
+
+                pmd = native_make_pmd((pteval_t)pte_p + PMD_FLAGS);
+                native_set_pmd(pmd_p, pmd);
+        }
+
+        pte_p += pte_index(ppd->vaddr);
+        if (!native_pte_val(*pte_p))
+                native_set_pte(pte_p, native_make_pte(ppd->paddr | ppd->pte_flags));
+}
+
+static void __init __sme_map_range_pmd(struct sme_populate_pgd_data *ppd)
+{
+        while (ppd->vaddr < ppd->vaddr_end) {
+                sme_populate_pgd_large(ppd);
+
+                ppd->vaddr += PMD_PAGE_SIZE;
+                ppd->paddr += PMD_PAGE_SIZE;
+        }
+}
+
+static void __init __sme_map_range_pte(struct sme_populate_pgd_data *ppd)
+{
+        while (ppd->vaddr < ppd->vaddr_end) {
+                sme_populate_pgd(ppd);
+
+                ppd->vaddr += PAGE_SIZE;
+                ppd->paddr += PAGE_SIZE;
+        }
+}
+
+static void __init __sme_map_range(struct sme_populate_pgd_data *ppd,
+                                   pmdval_t pmd_flags, pteval_t pte_flags)
+{
+        unsigned long vaddr_end;
+
+        ppd->pmd_flags = pmd_flags;
+        ppd->pte_flags = pte_flags;
+
+        /* Save original end value since we modify the struct value */
+        vaddr_end = ppd->vaddr_end;
+
+        /* If start is not 2MB aligned, create PTE entries */
+        ppd->vaddr_end = ALIGN(ppd->vaddr, PMD_PAGE_SIZE);
+        __sme_map_range_pte(ppd);
+
+        /* Create PMD entries */
+        ppd->vaddr_end = vaddr_end & PMD_PAGE_MASK;
+        __sme_map_range_pmd(ppd);
+
+        /* If end is not 2MB aligned, create PTE entries */
+        ppd->vaddr_end = vaddr_end;
+        __sme_map_range_pte(ppd);
+}
+
+static void __init sme_map_range_encrypted(struct sme_populate_pgd_data *ppd)
+{
+        __sme_map_range(ppd, PMD_FLAGS_ENC, PTE_FLAGS_ENC);
+}
+
+static void __init sme_map_range_decrypted(struct sme_populate_pgd_data *ppd)
+{
+        __sme_map_range(ppd, PMD_FLAGS_DEC, PTE_FLAGS_DEC);
+}
+
+static void __init sme_map_range_decrypted_wp(struct sme_populate_pgd_data *ppd)
+{
+        __sme_map_range(ppd, PMD_FLAGS_DEC_WP, PTE_FLAGS_DEC_WP);
 }
 
 static unsigned long __init sme_pgtable_calc(unsigned long len)
 {
-        unsigned long p4d_size, pud_size, pmd_size;
+        unsigned long p4d_size, pud_size, pmd_size, pte_size;
         unsigned long total;
 
         /*
          * Perform a relatively simplistic calculation of the pagetable
-         * entries that are needed. That mappings will be covered by 2MB
-         * PMD entries so we can conservatively calculate the required
+         * entries that are needed. Those mappings will be covered mostly
+         * by 2MB PMD entries so we can conservatively calculate the required
          * number of P4D, PUD and PMD structures needed to perform the
-         * mappings. Incrementing the count for each covers the case where
-         * the addresses cross entries.
+         * mappings.  For mappings that are not 2MB aligned, PTE mappings
+         * would be needed for the start and end portion of the address range
+         * that fall outside of the 2MB alignment.  This results in, at most,
+         * two extra pages to hold PTE entries for each range that is mapped.
+         * Incrementing the count for each covers the case where the addresses
+         * cross entries.
          */
         if (IS_ENABLED(CONFIG_X86_5LEVEL)) {
                 p4d_size = (ALIGN(len, PGDIR_SIZE) / PGDIR_SIZE) + 1;
@@ -585,8 +712,9 @@ static unsigned long __init sme_pgtable_calc(unsigned long len)
         }
         pmd_size = (ALIGN(len, PUD_SIZE) / PUD_SIZE) + 1;
         pmd_size *= sizeof(pmd_t) * PTRS_PER_PMD;
+        pte_size = 2 * sizeof(pte_t) * PTRS_PER_PTE;
 
-        total = p4d_size + pud_size + pmd_size;
+        total = p4d_size + pud_size + pmd_size + pte_size;
 
         /*
          * Now calculate the added pagetable structures needed to populate
@@ -610,29 +738,29 @@ static unsigned long __init sme_pgtable_calc(unsigned long len)
         return total;
 }
 
-void __init sme_encrypt_kernel(void)
+void __init __nostackprotector sme_encrypt_kernel(struct boot_params *bp)
 {
         unsigned long workarea_start, workarea_end, workarea_len;
         unsigned long execute_start, execute_end, execute_len;
         unsigned long kernel_start, kernel_end, kernel_len;
+        unsigned long initrd_start, initrd_end, initrd_len;
+        struct sme_populate_pgd_data ppd;
         unsigned long pgtable_area_len;
-        unsigned long paddr, pmd_flags;
         unsigned long decrypted_base;
-        void *pgtable_area;
-        pgd_t *pgd;
 
         if (!sme_active())
                 return;
 
         /*
-         * Prepare for encrypting the kernel by building new pagetables with
-         * the necessary attributes needed to encrypt the kernel in place.
+         * Prepare for encrypting the kernel and initrd by building new
+         * pagetables with the necessary attributes needed to encrypt the
+         * kernel in place.
          *
          *   One range of virtual addresses will map the memory occupied
-         *   by the kernel as encrypted.
+         *   by the kernel and initrd as encrypted.
          *
          *   Another range of virtual addresses will map the memory occupied
-         *   by the kernel as decrypted and write-protected.
+         *   by the kernel and initrd as decrypted and write-protected.
          *
          *     The use of write-protect attribute will prevent any of the
          *     memory from being cached.
@@ -643,6 +771,20 @@ void __init sme_encrypt_kernel(void)
         kernel_end = ALIGN(__pa_symbol(_end), PMD_PAGE_SIZE);
         kernel_len = kernel_end - kernel_start;
 
+        initrd_start = 0;
+        initrd_end = 0;
+        initrd_len = 0;
+#ifdef CONFIG_BLK_DEV_INITRD
+        initrd_len = (unsigned long)bp->hdr.ramdisk_size |
+                     ((unsigned long)bp->ext_ramdisk_size << 32);
+        if (initrd_len) {
+                initrd_start = (unsigned long)bp->hdr.ramdisk_image |
+                               ((unsigned long)bp->ext_ramdisk_image << 32);
+                initrd_end = PAGE_ALIGN(initrd_start + initrd_len);
+                initrd_len = initrd_end - initrd_start;
+        }
+#endif
+
         /* Set the encryption workarea to be immediately after the kernel */
         workarea_start = kernel_end;
 
@@ -665,16 +807,21 @@ void __init sme_encrypt_kernel(void)
          */
         pgtable_area_len = sizeof(pgd_t) * PTRS_PER_PGD;
         pgtable_area_len += sme_pgtable_calc(execute_end - kernel_start) * 2;
+        if (initrd_len)
+                pgtable_area_len += sme_pgtable_calc(initrd_len) * 2;
 
         /* PUDs and PMDs needed in the current pagetables for the workarea */
         pgtable_area_len += sme_pgtable_calc(execute_len + pgtable_area_len);
 
         /*
          * The total workarea includes the executable encryption area and
-         * the pagetable area.
+         * the pagetable area. The start of the workarea is already 2MB
+         * aligned, align the end of the workarea on a 2MB boundary so that
+         * we don't try to create/allocate PTE entries from the workarea
+         * before it is mapped.
          */
         workarea_len = execute_len + pgtable_area_len;
-        workarea_end = workarea_start + workarea_len;
+        workarea_end = ALIGN(workarea_start + workarea_len, PMD_PAGE_SIZE);
 
         /*
          * Set the address to the start of where newly created pagetable
@@ -683,45 +830,30 @@ void __init sme_encrypt_kernel(void)
          * pagetables and when the new encrypted and decrypted kernel
          * mappings are populated.
          */
-        pgtable_area = (void *)execute_end;
+        ppd.pgtable_area = (void *)execute_end;
 
         /*
          * Make sure the current pagetable structure has entries for
          * addressing the workarea.
          */
-        pgd = (pgd_t *)native_read_cr3_pa();
-        paddr = workarea_start;
-        while (paddr < workarea_end) {
-                pgtable_area = sme_populate_pgd(pgd, pgtable_area,
-                                                paddr,
-                                                paddr + PMD_FLAGS);
-
-                paddr += PMD_PAGE_SIZE;
-        }
+        ppd.pgd = (pgd_t *)native_read_cr3_pa();
+        ppd.paddr = workarea_start;
+        ppd.vaddr = workarea_start;
+        ppd.vaddr_end = workarea_end;
+        sme_map_range_decrypted(&ppd);
 
         /* Flush the TLB - no globals so cr3 is enough */
         native_write_cr3(__native_read_cr3());
 
         /*
          * A new pagetable structure is being built to allow for the kernel
-         * to be encrypted. It starts with an empty PGD that will then be
-         * populated with new PUDs and PMDs as the encrypted and decrypted
-         * kernel mappings are created.
+         * and initrd to be encrypted. It starts with an empty PGD that will
+         * then be populated with new PUDs and PMDs as the encrypted and
+         * decrypted kernel mappings are created.
          */
-        pgd = pgtable_area;
-        memset(pgd, 0, sizeof(*pgd) * PTRS_PER_PGD);
-        pgtable_area += sizeof(*pgd) * PTRS_PER_PGD;
-
-        /* Add encrypted kernel (identity) mappings */
-        pmd_flags = PMD_FLAGS | _PAGE_ENC;
-        paddr = kernel_start;
-        while (paddr < kernel_end) {
-                pgtable_area = sme_populate_pgd(pgd, pgtable_area,
-                                                paddr,
-                                                paddr + pmd_flags);
-
-                paddr += PMD_PAGE_SIZE;
-        }
+        ppd.pgd = ppd.pgtable_area;
+        memset(ppd.pgd, 0, sizeof(pgd_t) * PTRS_PER_PGD);
+        ppd.pgtable_area += sizeof(pgd_t) * PTRS_PER_PGD;
 
         /*
          * A different PGD index/entry must be used to get different
@@ -730,47 +862,79 @@ void __init sme_encrypt_kernel(void)
          * the base of the mapping.
          */
         decrypted_base = (pgd_index(workarea_end) + 1) & (PTRS_PER_PGD - 1);
+        if (initrd_len) {
+                unsigned long check_base;
+
+                check_base = (pgd_index(initrd_end) + 1) & (PTRS_PER_PGD - 1);
+                decrypted_base = max(decrypted_base, check_base);
+        }
         decrypted_base <<= PGDIR_SHIFT;
 
+        /* Add encrypted kernel (identity) mappings */
+        ppd.paddr = kernel_start;
+        ppd.vaddr = kernel_start;
+        ppd.vaddr_end = kernel_end;
+        sme_map_range_encrypted(&ppd);
+
         /* Add decrypted, write-protected kernel (non-identity) mappings */
-        pmd_flags = (PMD_FLAGS & ~_PAGE_CACHE_MASK) | (_PAGE_PAT | _PAGE_PWT);
-        paddr = kernel_start;
-        while (paddr < kernel_end) {
-                pgtable_area = sme_populate_pgd(pgd, pgtable_area,
-                                                paddr + decrypted_base,
-                                                paddr + pmd_flags);
-
-                paddr += PMD_PAGE_SIZE;
+        ppd.paddr = kernel_start;
+        ppd.vaddr = kernel_start + decrypted_base;
+        ppd.vaddr_end = kernel_end + decrypted_base;
+        sme_map_range_decrypted_wp(&ppd);
+
+        if (initrd_len) {
+                /* Add encrypted initrd (identity) mappings */
+                ppd.paddr = initrd_start;
+                ppd.vaddr = initrd_start;
+                ppd.vaddr_end = initrd_end;
+                sme_map_range_encrypted(&ppd);
+                /*
+                 * Add decrypted, write-protected initrd (non-identity) mappings
+                 */
+                ppd.paddr = initrd_start;
+                ppd.vaddr = initrd_start + decrypted_base;
+                ppd.vaddr_end = initrd_end + decrypted_base;
+                sme_map_range_decrypted_wp(&ppd);
         }
 
         /* Add decrypted workarea mappings to both kernel mappings */
-        paddr = workarea_start;
-        while (paddr < workarea_end) {
-                pgtable_area = sme_populate_pgd(pgd, pgtable_area,
-                                                paddr,
-                                                paddr + PMD_FLAGS);
+        ppd.paddr = workarea_start;
+        ppd.vaddr = workarea_start;
+        ppd.vaddr_end = workarea_end;
+        sme_map_range_decrypted(&ppd);
 
-                pgtable_area = sme_populate_pgd(pgd, pgtable_area,
-                                                paddr + decrypted_base,
-                                                paddr + PMD_FLAGS);
-
-                paddr += PMD_PAGE_SIZE;
-        }
+        ppd.paddr = workarea_start;
+        ppd.vaddr = workarea_start + decrypted_base;
+        ppd.vaddr_end = workarea_end + decrypted_base;
+        sme_map_range_decrypted(&ppd);
 
         /* Perform the encryption */
         sme_encrypt_execute(kernel_start, kernel_start + decrypted_base,
-                            kernel_len, workarea_start, (unsigned long)pgd);
+                            kernel_len, workarea_start, (unsigned long)ppd.pgd);
+
+        if (initrd_len)
+                sme_encrypt_execute(initrd_start, initrd_start + decrypted_base,
+                                    initrd_len, workarea_start,
+                                    (unsigned long)ppd.pgd);
 
         /*
          * At this point we are running encrypted.  Remove the mappings for
          * the decrypted areas - all that is needed for this is to remove
          * the PGD entry/entries.
          */
-        sme_clear_pgd(pgd, kernel_start + decrypted_base,
-                      kernel_end + decrypted_base);
+        ppd.vaddr = kernel_start + decrypted_base;
+        ppd.vaddr_end = kernel_end + decrypted_base;
+        sme_clear_pgd(&ppd);
+
+        if (initrd_len) {
+                ppd.vaddr = initrd_start + decrypted_base;
+                ppd.vaddr_end = initrd_end + decrypted_base;
+                sme_clear_pgd(&ppd);
+        }
 
-        sme_clear_pgd(pgd, workarea_start + decrypted_base,
-                      workarea_end + decrypted_base);
+        ppd.vaddr = workarea_start + decrypted_base;
+        ppd.vaddr_end = workarea_end + decrypted_base;
+        sme_clear_pgd(&ppd);
 
         /* Flush the TLB - no globals so cr3 is enough */
         native_write_cr3(__native_read_cr3());
diff --git a/arch/x86/mm/mem_encrypt_boot.S b/arch/x86/mm/mem_encrypt_boot.S
index 730e6d541df1..01f682cf77a8 100644
--- a/arch/x86/mm/mem_encrypt_boot.S
+++ b/arch/x86/mm/mem_encrypt_boot.S
@@ -22,9 +22,9 @@ ENTRY(sme_encrypt_execute)
 
         /*
          * Entry parameters:
-         *   RDI - virtual address for the encrypted kernel mapping
-         *   RSI - virtual address for the decrypted kernel mapping
-         *   RDX - length of kernel
+         *   RDI - virtual address for the encrypted mapping
+         *   RSI - virtual address for the decrypted mapping
+         *   RDX - length to encrypt
          *   RCX - virtual address of the encryption workarea, including:
          *     - stack page (PAGE_SIZE)
          *     - encryption routine page (PAGE_SIZE)
@@ -41,9 +41,9 @@ ENTRY(sme_encrypt_execute)
         addq    $PAGE_SIZE, %rax        /* Workarea encryption routine */
 
         push    %r12
-        movq    %rdi, %r10              /* Encrypted kernel */
-        movq    %rsi, %r11              /* Decrypted kernel */
-        movq    %rdx, %r12              /* Kernel length */
+        movq    %rdi, %r10              /* Encrypted area */
+        movq    %rsi, %r11              /* Decrypted area */
+        movq    %rdx, %r12              /* Area length */
 
         /* Copy encryption routine into the workarea */
         movq    %rax, %rdi                              /* Workarea encryption routine */
@@ -52,10 +52,10 @@ ENTRY(sme_encrypt_execute)
         rep     movsb
 
         /* Setup registers for call */
-        movq    %r10, %rdi              /* Encrypted kernel */
-        movq    %r11, %rsi              /* Decrypted kernel */
+        movq    %r10, %rdi              /* Encrypted area */
+        movq    %r11, %rsi              /* Decrypted area */
         movq    %r8, %rdx               /* Pagetables used for encryption */
-        movq    %r12, %rcx              /* Kernel length */
+        movq    %r12, %rcx              /* Area length */
         movq    %rax, %r8               /* Workarea encryption routine */
         addq    $PAGE_SIZE, %r8         /* Workarea intermediate copy buffer */
 
@@ -71,7 +71,7 @@ ENDPROC(sme_encrypt_execute)
 
 ENTRY(__enc_copy)
 /*
- * Routine used to encrypt kernel.
+ * Routine used to encrypt memory in place.
  *   This routine must be run outside of the kernel proper since
  *   the kernel will be encrypted during the process. So this
  *   routine is defined here and then copied to an area outside
@@ -79,19 +79,19 @@ ENTRY(__enc_copy)
  *   during execution.
  *
  *   On entry the registers must be:
- *     RDI - virtual address for the encrypted kernel mapping
- *     RSI - virtual address for the decrypted kernel mapping
+ *     RDI - virtual address for the encrypted mapping
+ *     RSI - virtual address for the decrypted mapping
  *     RDX - address of the pagetables to use for encryption
- *     RCX - length of kernel
+ *     RCX - length of area
  *      R8 - intermediate copy buffer
  *
  *     RAX - points to this routine
  *
- * The kernel will be encrypted by copying from the non-encrypted
- * kernel space to an intermediate buffer and then copying from the
- * intermediate buffer back to the encrypted kernel space. The physical
- * addresses of the two kernel space mappings are the same which
- * results in the kernel being encrypted "in place".
+ * The area will be encrypted by copying from the non-encrypted
+ * memory space to an intermediate buffer and then copying from the
+ * intermediate buffer back to the encrypted memory space. The physical
+ * addresses of the two mappings are the same which results in the area
+ * being encrypted "in place".
  */
         /* Enable the new page tables */
         mov     %rdx, %cr3
@@ -103,47 +103,55 @@ ENTRY(__enc_copy)
         orq     $X86_CR4_PGE, %rdx
         mov     %rdx, %cr4
 
+        push    %r15
+        push    %r12
+
+        movq    %rcx, %r9               /* Save area length */
+        movq    %rdi, %r10              /* Save encrypted area address */
+        movq    %rsi, %r11              /* Save decrypted area address */
+
         /* Set the PAT register PA5 entry to write-protect */
-        push    %rcx
         movl    $MSR_IA32_CR_PAT, %ecx
         rdmsr
-        push    %rdx                    /* Save original PAT value */
+        mov     %rdx, %r15              /* Save original PAT value */
         andl    $0xffff00ff, %edx       /* Clear PA5 */
         orl     $0x00000500, %edx       /* Set PA5 to WP */
         wrmsr
-        pop     %rdx                    /* RDX contains original PAT value */
-        pop     %rcx
-
-        movq    %rcx, %r9               /* Save kernel length */
-        movq    %rdi, %r10              /* Save encrypted kernel address */
-        movq    %rsi, %r11              /* Save decrypted kernel address */
 
         wbinvd                          /* Invalidate any cache entries */
 
-        /* Copy/encrypt 2MB at a time */
+        /* Copy/encrypt up to 2MB at a time */
+        movq    $PMD_PAGE_SIZE, %r12
 1:
-        movq    %r11, %rsi              /* Source - decrypted kernel */
+        cmpq    %r12, %r9
+        jnb     2f
+        movq    %r9, %r12
+
+2:
+        movq    %r11, %rsi              /* Source - decrypted area */
         movq    %r8, %rdi               /* Dest   - intermediate copy buffer */
-        movq    $PMD_PAGE_SIZE, %rcx    /* 2MB length */
+        movq    %r12, %rcx
         rep     movsb
 
         movq    %r8, %rsi               /* Source - intermediate copy buffer */
-        movq    %r10, %rdi              /* Dest   - encrypted kernel */
-        movq    $PMD_PAGE_SIZE, %rcx    /* 2MB length */
+        movq    %r10, %rdi              /* Dest   - encrypted area */
+        movq    %r12, %rcx
         rep     movsb
 
-        addq    $PMD_PAGE_SIZE, %r11
-        addq    $PMD_PAGE_SIZE, %r10
-        subq    $PMD_PAGE_SIZE, %r9     /* Kernel length decrement */
+        addq    %r12, %r11
+        addq    %r12, %r10
+        subq    %r12, %r9               /* Kernel length decrement */
         jnz     1b                      /* Kernel length not zero? */
 
         /* Restore PAT register */
-        push    %rdx                    /* Save original PAT value */
         movl    $MSR_IA32_CR_PAT, %ecx
         rdmsr
-        pop     %rdx                    /* Restore original PAT value */
+        mov     %r15, %rdx              /* Restore original PAT value */
         wrmsr
 
+        pop     %r12
+        pop     %r15
+
         ret
 .L__enc_copy_end:
 ENDPROC(__enc_copy)
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 96d456a94b03..004abf9ebf12 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -355,14 +355,15 @@ static inline void _pgd_free(pgd_t *pgd)
                 kmem_cache_free(pgd_cache, pgd);
 }
 #else
+
 static inline pgd_t *_pgd_alloc(void)
 {
-        return (pgd_t *)__get_free_page(PGALLOC_GFP);
+        return (pgd_t *)__get_free_pages(PGALLOC_GFP, PGD_ALLOCATION_ORDER);
 }
 
 static inline void _pgd_free(pgd_t *pgd)
 {
-        free_page((unsigned long)pgd);
+        free_pages((unsigned long)pgd, PGD_ALLOCATION_ORDER);
 }
 #endif /* CONFIG_X86_PAE */
 
diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
index 6b9bf023a700..c3c5274410a9 100644
--- a/arch/x86/mm/pgtable_32.c
+++ b/arch/x86/mm/pgtable_32.c
@@ -10,6 +10,7 @@
 #include <linux/pagemap.h>
 #include <linux/spinlock.h>
 
+#include <asm/cpu_entry_area.h>
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
 #include <asm/fixmap.h>
diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
new file mode 100644
index 000000000000..ce38f165489b
--- /dev/null
+++ b/arch/x86/mm/pti.c
@@ -0,0 +1,368 @@
+/*
+ * Copyright(c) 2017 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * This code is based in part on work published here:
+ *
+ *      https://github.com/IAIK/KAISER
+ *
+ * The original work was written by and and signed off by for the Linux
+ * kernel by:
+ *
+ *   Signed-off-by: Richard Fellner <richard.fellner@student.tugraz.at>
+ *   Signed-off-by: Moritz Lipp <moritz.lipp@iaik.tugraz.at>
+ *   Signed-off-by: Daniel Gruss <daniel.gruss@iaik.tugraz.at>
+ *   Signed-off-by: Michael Schwarz <michael.schwarz@iaik.tugraz.at>
+ *
+ * Major changes to the original code by: Dave Hansen <dave.hansen@intel.com>
+ * Mostly rewritten by Thomas Gleixner <tglx@linutronix.de> and
+ *                     Andy Lutomirsky <luto@amacapital.net>
+ */
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/bug.h>
+#include <linux/init.h>
+#include <linux/spinlock.h>
+#include <linux/mm.h>
+#include <linux/uaccess.h>
+
+#include <asm/cpufeature.h>
+#include <asm/hypervisor.h>
+#include <asm/vsyscall.h>
+#include <asm/cmdline.h>
+#include <asm/pti.h>
+#include <asm/pgtable.h>
+#include <asm/pgalloc.h>
+#include <asm/tlbflush.h>
+#include <asm/desc.h>
+
+#undef pr_fmt
+#define pr_fmt(fmt)     "Kernel/User page tables isolation: " fmt
+
+/* Backporting helper */
+#ifndef __GFP_NOTRACK
+#define __GFP_NOTRACK   0
+#endif
+
+static void __init pti_print_if_insecure(const char *reason)
+{
+        if (boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN))
+                pr_info("%s\n", reason);
+}
+
+static void __init pti_print_if_secure(const char *reason)
+{
+        if (!boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN))
+                pr_info("%s\n", reason);
+}
+
+void __init pti_check_boottime_disable(void)
+{
+        char arg[5];
+        int ret;
+
+        if (hypervisor_is_type(X86_HYPER_XEN_PV)) {
+                pti_print_if_insecure("disabled on XEN PV.");
+                return;
+        }
+
+        ret = cmdline_find_option(boot_command_line, "pti", arg, sizeof(arg));
+        if (ret > 0)  {
+                if (ret == 3 && !strncmp(arg, "off", 3)) {
+                        pti_print_if_insecure("disabled on command line.");
+                        return;
+                }
+                if (ret == 2 && !strncmp(arg, "on", 2)) {
+                        pti_print_if_secure("force enabled on command line.");
+                        goto enable;
+                }
+                if (ret == 4 && !strncmp(arg, "auto", 4))
+                        goto autosel;
+        }
+
+        if (cmdline_find_option_bool(boot_command_line, "nopti")) {
+                pti_print_if_insecure("disabled on command line.");
+                return;
+        }
+
+autosel:
+        if (!boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN))
+                return;
+enable:
+        setup_force_cpu_cap(X86_FEATURE_PTI);
+}
+
+pgd_t __pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd)
+{
+        /*
+         * Changes to the high (kernel) portion of the kernelmode page
+         * tables are not automatically propagated to the usermode tables.
+         *
+         * Users should keep in mind that, unlike the kernelmode tables,
+         * there is no vmalloc_fault equivalent for the usermode tables.
+         * Top-level entries added to init_mm's usermode pgd after boot
+         * will not be automatically propagated to other mms.
+         */
+        if (!pgdp_maps_userspace(pgdp))
+                return pgd;
+
+        /*
+         * The user page tables get the full PGD, accessible from
+         * userspace:
+         */
+        kernel_to_user_pgdp(pgdp)->pgd = pgd.pgd;
+
+        /*
+         * If this is normal user memory, make it NX in the kernel
+         * pagetables so that, if we somehow screw up and return to
+         * usermode with the kernel CR3 loaded, we'll get a page fault
+         * instead of allowing user code to execute with the wrong CR3.
+         *
+         * As exceptions, we don't set NX if:
+         *  - _PAGE_USER is not set.  This could be an executable
+         *     EFI runtime mapping or something similar, and the kernel
+         *     may execute from it
+         *  - we don't have NX support
+         *  - we're clearing the PGD (i.e. the new pgd is not present).
+         */
+        if ((pgd.pgd & (_PAGE_USER|_PAGE_PRESENT)) == (_PAGE_USER|_PAGE_PRESENT) &&
+            (__supported_pte_mask & _PAGE_NX))
+                pgd.pgd |= _PAGE_NX;
+
+        /* return the copy of the PGD we want the kernel to use: */
+        return pgd;
+}
+
+/*
+ * Walk the user copy of the page tables (optionally) trying to allocate
+ * page table pages on the way down.
+ *
+ * Returns a pointer to a P4D on success, or NULL on failure.
+ */
+static __init p4d_t *pti_user_pagetable_walk_p4d(unsigned long address)
+{
+        pgd_t *pgd = kernel_to_user_pgdp(pgd_offset_k(address));
+        gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
+
+        if (address < PAGE_OFFSET) {
+                WARN_ONCE(1, "attempt to walk user address\n");
+                return NULL;
+        }
+
+        if (pgd_none(*pgd)) {
+                unsigned long new_p4d_page = __get_free_page(gfp);
+                if (!new_p4d_page)
+                        return NULL;
+
+                set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(new_p4d_page)));
+        }
+        BUILD_BUG_ON(pgd_large(*pgd) != 0);
+
+        return p4d_offset(pgd, address);
+}
+
+/*
+ * Walk the user copy of the page tables (optionally) trying to allocate
+ * page table pages on the way down.
+ *
+ * Returns a pointer to a PMD on success, or NULL on failure.
+ */
+static __init pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
+{
+        gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
+        p4d_t *p4d = pti_user_pagetable_walk_p4d(address);
+        pud_t *pud;
+
+        BUILD_BUG_ON(p4d_large(*p4d) != 0);
+        if (p4d_none(*p4d)) {
+                unsigned long new_pud_page = __get_free_page(gfp);
+                if (!new_pud_page)
+                        return NULL;
+
+                set_p4d(p4d, __p4d(_KERNPG_TABLE | __pa(new_pud_page)));
+        }
+
+        pud = pud_offset(p4d, address);
+        /* The user page tables do not use large mappings: */
+        if (pud_large(*pud)) {
+                WARN_ON(1);
+                return NULL;
+        }
+        if (pud_none(*pud)) {
+                unsigned long new_pmd_page = __get_free_page(gfp);
+                if (!new_pmd_page)
+                        return NULL;
+
+                set_pud(pud, __pud(_KERNPG_TABLE | __pa(new_pmd_page)));
+        }
+
+        return pmd_offset(pud, address);
+}
+
+#ifdef CONFIG_X86_VSYSCALL_EMULATION
+/*
+ * Walk the shadow copy of the page tables (optionally) trying to allocate
+ * page table pages on the way down.  Does not support large pages.
+ *
+ * Note: this is only used when mapping *new* kernel data into the
+ * user/shadow page tables.  It is never used for userspace data.
+ *
+ * Returns a pointer to a PTE on success, or NULL on failure.
+ */
+static __init pte_t *pti_user_pagetable_walk_pte(unsigned long address)
+{
+        gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
+        pmd_t *pmd = pti_user_pagetable_walk_pmd(address);
+        pte_t *pte;
+
+        /* We can't do anything sensible if we hit a large mapping. */
+        if (pmd_large(*pmd)) {
+                WARN_ON(1);
+                return NULL;
+        }
+
+        if (pmd_none(*pmd)) {
+                unsigned long new_pte_page = __get_free_page(gfp);
+                if (!new_pte_page)
+                        return NULL;
+
+                set_pmd(pmd, __pmd(_KERNPG_TABLE | __pa(new_pte_page)));
+        }
+
+        pte = pte_offset_kernel(pmd, address);
+        if (pte_flags(*pte) & _PAGE_USER) {
+                WARN_ONCE(1, "attempt to walk to user pte\n");
+                return NULL;
+        }
+        return pte;
+}
+
+static void __init pti_setup_vsyscall(void)
+{
+        pte_t *pte, *target_pte;
+        unsigned int level;
+
+        pte = lookup_address(VSYSCALL_ADDR, &level);
+        if (!pte || WARN_ON(level != PG_LEVEL_4K) || pte_none(*pte))
+                return;
+
+        target_pte = pti_user_pagetable_walk_pte(VSYSCALL_ADDR);
+        if (WARN_ON(!target_pte))
+                return;
+
+        *target_pte = *pte;
+        set_vsyscall_pgtable_user_bits(kernel_to_user_pgdp(swapper_pg_dir));
+}
+#else
+static void __init pti_setup_vsyscall(void) { }
+#endif
+
+static void __init
+pti_clone_pmds(unsigned long start, unsigned long end, pmdval_t clear)
+{
+        unsigned long addr;
+
+        /*
+         * Clone the populated PMDs which cover start to end. These PMD areas
+         * can have holes.
+         */
+        for (addr = start; addr < end; addr += PMD_SIZE) {
+                pmd_t *pmd, *target_pmd;
+                pgd_t *pgd;
+                p4d_t *p4d;
+                pud_t *pud;
+
+                pgd = pgd_offset_k(addr);
+                if (WARN_ON(pgd_none(*pgd)))
+                        return;
+                p4d = p4d_offset(pgd, addr);
+                if (WARN_ON(p4d_none(*p4d)))
+                        return;
+                pud = pud_offset(p4d, addr);
+                if (pud_none(*pud))
+                        continue;
+                pmd = pmd_offset(pud, addr);
+                if (pmd_none(*pmd))
+                        continue;
+
+                target_pmd = pti_user_pagetable_walk_pmd(addr);
+                if (WARN_ON(!target_pmd))
+                        return;
+
+                /*
+                 * Copy the PMD.  That is, the kernelmode and usermode
+                 * tables will share the last-level page tables of this
+                 * address range
+                 */
+                *target_pmd = pmd_clear_flags(*pmd, clear);
+        }
+}
+
+/*
+ * Clone a single p4d (i.e. a top-level entry on 4-level systems and a
+ * next-level entry on 5-level systems.
+ */
+static void __init pti_clone_p4d(unsigned long addr)
+{
+        p4d_t *kernel_p4d, *user_p4d;
+        pgd_t *kernel_pgd;
+
+        user_p4d = pti_user_pagetable_walk_p4d(addr);
+        kernel_pgd = pgd_offset_k(addr);
+        kernel_p4d = p4d_offset(kernel_pgd, addr);
+        *user_p4d = *kernel_p4d;
+}
+
+/*
+ * Clone the CPU_ENTRY_AREA into the user space visible page table.
+ */
+static void __init pti_clone_user_shared(void)
+{
+        pti_clone_p4d(CPU_ENTRY_AREA_BASE);
+}
+
+/*
+ * Clone the ESPFIX P4D into the user space visinble page table
+ */
+static void __init pti_setup_espfix64(void)
+{
+#ifdef CONFIG_X86_ESPFIX64
+        pti_clone_p4d(ESPFIX_BASE_ADDR);
+#endif
+}
+
+/*
+ * Clone the populated PMDs of the entry and irqentry text and force it RO.
+ */
+static void __init pti_clone_entry_text(void)
+{
+        pti_clone_pmds((unsigned long) __entry_text_start,
+                        (unsigned long) __irqentry_text_end,
+                       _PAGE_RW | _PAGE_GLOBAL);
+}
+
+/*
+ * Initialize kernel page table isolation
+ */
+void __init pti_init(void)
+{
+        if (!static_cpu_has(X86_FEATURE_PTI))
+                return;
+
+        pr_info("enabled\n");
+
+        pti_clone_user_shared();
+        pti_clone_entry_text();
+        pti_setup_espfix64();
+        pti_setup_vsyscall();
+}
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 3118392cdf75..5bfe61a5e8e3 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -28,6 +28,38 @@
  *      Implement flush IPI by CALL_FUNCTION_VECTOR, Alex Shi
  */
 
+/*
+ * We get here when we do something requiring a TLB invalidation
+ * but could not go invalidate all of the contexts.  We do the
+ * necessary invalidation by clearing out the 'ctx_id' which
+ * forces a TLB flush when the context is loaded.
+ */
+void clear_asid_other(void)
+{
+        u16 asid;
+
+        /*
+         * This is only expected to be set if we have disabled
+         * kernel _PAGE_GLOBAL pages.
+         */
+        if (!static_cpu_has(X86_FEATURE_PTI)) {
+                WARN_ON_ONCE(1);
+                return;
+        }
+
+        for (asid = 0; asid < TLB_NR_DYN_ASIDS; asid++) {
+                /* Do not need to flush the current asid */
+                if (asid == this_cpu_read(cpu_tlbstate.loaded_mm_asid))
+                        continue;
+                /*
+                 * Make sure the next time we go to switch to
+                 * this asid, we do a flush:
+                 */
+                this_cpu_write(cpu_tlbstate.ctxs[asid].ctx_id, 0);
+        }
+        this_cpu_write(cpu_tlbstate.invalidate_other, false);
+}
+
 atomic64_t last_mm_ctx_id = ATOMIC64_INIT(1);
 
 
@@ -42,6 +74,9 @@ static void choose_new_asid(struct mm_struct *next, u64 next_tlb_gen,
                 return;
         }
 
+        if (this_cpu_read(cpu_tlbstate.invalidate_other))
+                clear_asid_other();
+
         for (asid = 0; asid < TLB_NR_DYN_ASIDS; asid++) {
                 if (this_cpu_read(cpu_tlbstate.ctxs[asid].ctx_id) !=
                     next->context.ctx_id)
@@ -65,6 +100,25 @@ static void choose_new_asid(struct mm_struct *next, u64 next_tlb_gen,
         *need_flush = true;
 }
 
+static void load_new_mm_cr3(pgd_t *pgdir, u16 new_asid, bool need_flush)
+{
+        unsigned long new_mm_cr3;
+
+        if (need_flush) {
+                invalidate_user_asid(new_asid);
+                new_mm_cr3 = build_cr3(pgdir, new_asid);
+        } else {
+                new_mm_cr3 = build_cr3_noflush(pgdir, new_asid);
+        }
+
+        /*
+         * Caution: many callers of this function expect
+         * that load_cr3() is serializing and orders TLB
+         * fills with respect to the mm_cpumask writes.
+         */
+        write_cr3(new_mm_cr3);
+}
+
 void leave_mm(int cpu)
 {
         struct mm_struct *loaded_mm = this_cpu_read(cpu_tlbstate.loaded_mm);
@@ -97,6 +151,34 @@ void switch_mm(struct mm_struct *prev, struct mm_struct *next,
         local_irq_restore(flags);
 }
 
+static void sync_current_stack_to_mm(struct mm_struct *mm)
+{
+        unsigned long sp = current_stack_pointer;
+        pgd_t *pgd = pgd_offset(mm, sp);
+
+        if (CONFIG_PGTABLE_LEVELS > 4) {
+                if (unlikely(pgd_none(*pgd))) {
+                        pgd_t *pgd_ref = pgd_offset_k(sp);
+
+                        set_pgd(pgd, *pgd_ref);
+                }
+        } else {
+                /*
+                 * "pgd" is faked.  The top level entries are "p4d"s, so sync
+                 * the p4d.  This compiles to approximately the same code as
+                 * the 5-level case.
+                 */
+                p4d_t *p4d = p4d_offset(pgd, sp);
+
+                if (unlikely(p4d_none(*p4d))) {
+                        pgd_t *pgd_ref = pgd_offset_k(sp);
+                        p4d_t *p4d_ref = p4d_offset(pgd_ref, sp);
+
+                        set_p4d(p4d, *p4d_ref);
+                }
+        }
+}
+
 void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                         struct task_struct *tsk)
 {
@@ -128,7 +210,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
          * isn't free.
          */
 #ifdef CONFIG_DEBUG_VM
-        if (WARN_ON_ONCE(__read_cr3() != build_cr3(real_prev, prev_asid))) {
+        if (WARN_ON_ONCE(__read_cr3() != build_cr3(real_prev->pgd, prev_asid))) {
                 /*
                  * If we were to BUG here, we'd be very likely to kill
                  * the system so hard that we don't see the call trace.
@@ -172,11 +254,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                          * mapped in the new pgd, we'll double-fault.  Forcibly
                          * map it.
                          */
-                        unsigned int index = pgd_index(current_stack_pointer);
-                        pgd_t *pgd = next->pgd + index;
-
-                        if (unlikely(pgd_none(*pgd)))
-                                set_pgd(pgd, init_mm.pgd[index]);
+                        sync_current_stack_to_mm(next);
                 }
 
                 /* Stop remote flushes for the previous mm */
@@ -195,7 +273,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                 if (need_flush) {
                         this_cpu_write(cpu_tlbstate.ctxs[new_asid].ctx_id, next->context.ctx_id);
                         this_cpu_write(cpu_tlbstate.ctxs[new_asid].tlb_gen, next_tlb_gen);
-                        write_cr3(build_cr3(next, new_asid));
+                        load_new_mm_cr3(next->pgd, new_asid, true);
 
                         /*
                          * NB: This gets called via leave_mm() in the idle path
@@ -208,7 +286,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                         trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL);
                 } else {
                         /* The new ASID is already up to date. */
-                        write_cr3(build_cr3_noflush(next, new_asid));
+                        load_new_mm_cr3(next->pgd, new_asid, false);
 
                         /* See above wrt _rcuidle. */
                         trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, 0);
@@ -288,7 +366,7 @@ void initialize_tlbstate_and_flush(void)
                 !(cr4_read_shadow() & X86_CR4_PCIDE));
 
         /* Force ASID 0 and force a TLB flush. */
-        write_cr3(build_cr3(mm, 0));
+        write_cr3(build_cr3(mm->pgd, 0));
 
         /* Reinitialize tlbstate. */
         this_cpu_write(cpu_tlbstate.loaded_mm_asid, 0);
@@ -551,7 +629,7 @@ static void do_kernel_range_flush(void *info)
 
         /* flush range by one by one 'invlpg' */
         for (addr = f->start; addr < f->end; addr += PAGE_SIZE)
-                __flush_tlb_single(addr);
+                __flush_tlb_one(addr);
 }
 
 void flush_tlb_kernel_range(unsigned long start, unsigned long end)
diff --git a/arch/x86/pci/broadcom_bus.c b/arch/x86/pci/broadcom_bus.c
index bb461cfd01ab..526536c81ddc 100644
--- a/arch/x86/pci/broadcom_bus.c
+++ b/arch/x86/pci/broadcom_bus.c
@@ -97,7 +97,7 @@ static int __init broadcom_postcore_init(void)
          * We should get host bridge information from ACPI unless the BIOS
          * doesn't support it.
          */
-        if (acpi_os_get_root_pointer())
+        if (!acpi_disabled && acpi_os_get_root_pointer())
                 return 0;
 #endif
 
diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
index 7a5350d08cef..563049c483a1 100644
--- a/arch/x86/pci/common.c
+++ b/arch/x86/pci/common.c
@@ -594,6 +594,11 @@ char *__init pcibios_setup(char *str)
         } else if (!strcmp(str, "nocrs")) {
                 pci_probe |= PCI_ROOT_NO_CRS;
                 return NULL;
+#ifdef CONFIG_PHYS_ADDR_T_64BIT
+        } else if (!strcmp(str, "big_root_window")) {
+                pci_probe |= PCI_BIG_ROOT_WINDOW;
+                return NULL;
+#endif
         } else if (!strcmp(str, "earlydump")) {
                 pci_early_dump_regs = 1;
                 return NULL;
diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
index 1e996df687a3..54ef19e90705 100644
--- a/arch/x86/pci/fixup.c
+++ b/arch/x86/pci/fixup.c
@@ -662,9 +662,23 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2033, quirk_no_aersid);
  */
 static void pci_amd_enable_64bit_bar(struct pci_dev *dev)
 {
-        unsigned i;
-        u32 base, limit, high;
+        static const char *name = "PCI Bus 0000:00";
         struct resource *res, *conflict;
+        u32 base, limit, high;
+        struct pci_dev *other;
+        unsigned i;
+
+        if (!(pci_probe & PCI_BIG_ROOT_WINDOW))
+                return;
+
+        /* Check that we are the only device of that type */
+        other = pci_get_device(dev->vendor, dev->device, NULL);
+        if (other != dev ||
+            (other = pci_get_device(dev->vendor, dev->device, other))) {
+                /* This is a multi-socket system, don't touch it for now */
+                pci_dev_put(other);
+                return;
+        }
 
         for (i = 0; i < 8; i++) {
                 pci_read_config_dword(dev, AMD_141b_MMIO_BASE(i), &base);
@@ -689,17 +703,30 @@ static void pci_amd_enable_64bit_bar(struct pci_dev *dev)
         if (!res)
                 return;
 
-        res->name = "PCI Bus 0000:00";
+        /*
+         * Allocate a 256GB window directly below the 0xfd00000000 hardware
+         * limit (see AMD Family 15h Models 30h-3Fh BKDG, sec 2.4.6).
+         */
+        res->name = name;
         res->flags = IORESOURCE_PREFETCH | IORESOURCE_MEM |
                 IORESOURCE_MEM_64 | IORESOURCE_WINDOW;
-        res->start = 0x100000000ull;
+        res->start = 0xbd00000000ull;
         res->end = 0xfd00000000ull - 1;
 
-        /* Just grab the free area behind system memory for this */
-        while ((conflict = request_resource_conflict(&iomem_resource, res)))
-                res->start = conflict->end + 1;
+        conflict = request_resource_conflict(&iomem_resource, res);
+        if (conflict) {
+                kfree(res);
+                if (conflict->name != name)
+                        return;
 
-        dev_info(&dev->dev, "adding root bus resource %pR\n", res);
+                /* We are resuming from suspend; just reenable the window */
+                res = conflict;
+        } else {
+                dev_info(&dev->dev, "adding root bus resource %pR (tainting kernel)\n",
+                         res);
+                add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+                pci_bus_add_resource(dev->bus, res, 0);
+        }
 
         base = ((res->start >> 8) & AMD_141b_MMIO_BASE_MMIOBASE_MASK) |
                 AMD_141b_MMIO_BASE_RE_MASK | AMD_141b_MMIO_BASE_WE_MASK;
@@ -711,13 +738,16 @@ static void pci_amd_enable_64bit_bar(struct pci_dev *dev)
         pci_write_config_dword(dev, AMD_141b_MMIO_HIGH(i), high);
         pci_write_config_dword(dev, AMD_141b_MMIO_LIMIT(i), limit);
         pci_write_config_dword(dev, AMD_141b_MMIO_BASE(i), base);
-
-        pci_bus_add_resource(dev->bus, res, 0);
 }
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1401, pci_amd_enable_64bit_bar);
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x141b, pci_amd_enable_64bit_bar);
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1571, pci_amd_enable_64bit_bar);
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x15b1, pci_amd_enable_64bit_bar);
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1601, pci_amd_enable_64bit_bar);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1401, pci_amd_enable_64bit_bar);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x141b, pci_amd_enable_64bit_bar);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1571, pci_amd_enable_64bit_bar);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15b1, pci_amd_enable_64bit_bar);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1601, pci_amd_enable_64bit_bar);
+DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1401, pci_amd_enable_64bit_bar);
+DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x141b, pci_amd_enable_64bit_bar);
+DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1571, pci_amd_enable_64bit_bar);
+DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x15b1, pci_amd_enable_64bit_bar);
+DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1601, pci_amd_enable_64bit_bar);
 
 #endif
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 6a151ce70e86..2dd15e967c3f 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -135,7 +135,9 @@ pgd_t * __init efi_call_phys_prolog(void)
                                 pud[j] = *pud_offset(p4d_k, vaddr);
                         }
                 }
+                pgd_offset_k(pgd * PGDIR_SIZE)->pgd &= ~_PAGE_NX;
         }
+
 out:
         __flush_tlb_all();
 
@@ -196,6 +198,9 @@ static pgd_t *efi_pgd;
  * because we want to avoid inserting EFI region mappings (EFI_VA_END
  * to EFI_VA_START) into the standard kernel page tables. Everything
  * else can be shared, see efi_sync_low_kernel_mappings().
+ *
+ * We don't want the pgd on the pgd_list and cannot use pgd_alloc() for the
+ * allocation.
  */
 int __init efi_alloc_page_tables(void)
 {
@@ -208,7 +213,7 @@ int __init efi_alloc_page_tables(void)
                 return 0;
 
         gfp_mask = GFP_KERNEL | __GFP_ZERO;
-        efi_pgd = (pgd_t *)__get_free_page(gfp_mask);
+        efi_pgd = (pgd_t *)__get_free_pages(gfp_mask, PGD_ALLOCATION_ORDER);
         if (!efi_pgd)
                 return -ENOMEM;
 
diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
index 8a99a2e96537..5b513ccffde4 100644
--- a/arch/x86/platform/efi/quirks.c
+++ b/arch/x86/platform/efi/quirks.c
@@ -592,7 +592,18 @@ static int qrk_capsule_setup_info(struct capsule_info *cap_info, void **pkbuff,
         /*
          * Update the first page pointer to skip over the CSH header.
          */
-        cap_info->pages[0] += csh->headersize;
+        cap_info->phys[0] += csh->headersize;
+
+        /*
+         * cap_info->capsule should point at a virtual mapping of the entire
+         * capsule, starting at the capsule header. Our image has the Quark
+         * security header prepended, so we cannot rely on the default vmap()
+         * mapping created by the generic capsule code.
+         * Given that the Quark firmware does not appear to care about the
+         * virtual mapping, let's just point cap_info->capsule at our copy
+         * of the capsule header.
+         */
+        cap_info->capsule = &cap_info->header;
 
         return 1;
 }
diff --git a/arch/x86/platform/intel-mid/device_libs/platform_bt.c b/arch/x86/platform/intel-mid/device_libs/platform_bt.c
index dc036e511f48..5a0483e7bf66 100644
--- a/arch/x86/platform/intel-mid/device_libs/platform_bt.c
+++ b/arch/x86/platform/intel-mid/device_libs/platform_bt.c
@@ -60,7 +60,7 @@ static int __init tng_bt_sfi_setup(struct bt_sfi_data *ddata)
         return 0;
 }
 
-static const struct bt_sfi_data tng_bt_sfi_data __initdata = {
+static struct bt_sfi_data tng_bt_sfi_data __initdata = {
         .setup  = tng_bt_sfi_setup,
 };
 
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index f44c0bc95aa2..8538a6723171 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -299,7 +299,7 @@ static void bau_process_message(struct msg_desc *mdp, struct bau_control *bcp,
                 local_flush_tlb();
                 stat->d_alltlb++;
         } else {
-                __flush_tlb_one(msg->address);
+                __flush_tlb_single(msg->address);
                 stat->d_onetlb++;
         }
         stat->d_requestee++;
diff --git a/arch/x86/platform/uv/uv_irq.c b/arch/x86/platform/uv/uv_irq.c
index 5f6fd860820a..e4cb9f4cde8a 100644
--- a/arch/x86/platform/uv/uv_irq.c
+++ b/arch/x86/platform/uv/uv_irq.c
@@ -128,7 +128,7 @@ static void uv_domain_free(struct irq_domain *domain, unsigned int virq,
  * on the specified blade to allow the sending of MSIs to the specified CPU.
  */
 static int uv_domain_activate(struct irq_domain *domain,
-                              struct irq_data *irq_data, bool early)
+                              struct irq_data *irq_data, bool reserve)
 {
         uv_program_mmr(irqd_cfg(irq_data), irq_data->chip_data);
         return 0;
diff --git a/arch/x86/platform/uv/uv_nmi.c b/arch/x86/platform/uv/uv_nmi.c
index c34bd8233f7c..5f64f30873e2 100644
--- a/arch/x86/platform/uv/uv_nmi.c
+++ b/arch/x86/platform/uv/uv_nmi.c
@@ -905,7 +905,7 @@ static inline void uv_call_kgdb_kdb(int cpu, struct pt_regs *regs, int master)
 /*
  * UV NMI handler
  */
-int uv_handle_nmi(unsigned int reason, struct pt_regs *regs)
+static int uv_handle_nmi(unsigned int reason, struct pt_regs *regs)
 {
         struct uv_hub_nmi_s *hub_nmi = uv_hub_nmi;
         int cpu = smp_processor_id();
@@ -1013,7 +1013,7 @@ void uv_nmi_init(void)
 }
 
 /* Setup HUB NMI info */
-void __init uv_nmi_setup_common(bool hubbed)
+static void __init uv_nmi_setup_common(bool hubbed)
 {
         int size = sizeof(void *) * (1 << NODES_SHIFT);
         int cpu;
diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
index 84fcfde53f8f..a7d966964c6f 100644
--- a/arch/x86/power/cpu.c
+++ b/arch/x86/power/cpu.c
@@ -82,12 +82,8 @@ static void __save_processor_state(struct saved_context *ctxt)
         /*
          * descriptor tables
          */
-#ifdef CONFIG_X86_32
         store_idt(&ctxt->idt);
-#else
-/* CONFIG_X86_64 */
-        store_idt((struct desc_ptr *)&ctxt->idt_limit);
-#endif
+
         /*
          * We save it here, but restore it only in the hibernate case.
          * For ACPI S3 resume, this is loaded via 'early_gdt_desc' in 64-bit
@@ -103,22 +99,18 @@ static void __save_processor_state(struct saved_context *ctxt)
         /*
          * segment registers
          */
-#ifdef CONFIG_X86_32
-        savesegment(es, ctxt->es);
-        savesegment(fs, ctxt->fs);
+#ifdef CONFIG_X86_32_LAZY_GS
         savesegment(gs, ctxt->gs);
-        savesegment(ss, ctxt->ss);
-#else
-/* CONFIG_X86_64 */
-        asm volatile ("movw %%ds, %0" : "=m" (ctxt->ds));
-        asm volatile ("movw %%es, %0" : "=m" (ctxt->es));
-        asm volatile ("movw %%fs, %0" : "=m" (ctxt->fs));
-        asm volatile ("movw %%gs, %0" : "=m" (ctxt->gs));
-        asm volatile ("movw %%ss, %0" : "=m" (ctxt->ss));
+#endif
+#ifdef CONFIG_X86_64
+        savesegment(gs, ctxt->gs);
+        savesegment(fs, ctxt->fs);
+        savesegment(ds, ctxt->ds);
+        savesegment(es, ctxt->es);
 
         rdmsrl(MSR_FS_BASE, ctxt->fs_base);
-        rdmsrl(MSR_GS_BASE, ctxt->gs_base);
-        rdmsrl(MSR_KERNEL_GS_BASE, ctxt->gs_kernel_base);
+        rdmsrl(MSR_GS_BASE, ctxt->kernelmode_gs_base);
+        rdmsrl(MSR_KERNEL_GS_BASE, ctxt->usermode_gs_base);
         mtrr_save_fixed_ranges(NULL);
 
         rdmsrl(MSR_EFER, ctxt->efer);
@@ -160,17 +152,19 @@ static void do_fpu_end(void)
 static void fix_processor_context(void)
 {
         int cpu = smp_processor_id();
-        struct tss_struct *t = &per_cpu(cpu_tss, cpu);
 #ifdef CONFIG_X86_64
         struct desc_struct *desc = get_cpu_gdt_rw(cpu);
         tss_desc tss;
 #endif
-        set_tss_desc(cpu, t);   /*
-                                 * This just modifies memory; should not be
-                                 * necessary. But... This is necessary, because
-                                 * 386 hardware has concept of busy TSS or some
-                                 * similar stupidity.
-                                 */
+
+        /*
+         * We need to reload TR, which requires that we change the
+         * GDT entry to indicate "available" first.
+         *
+         * XXX: This could probably all be replaced by a call to
+         * force_reload_TR().
+         */
+        set_tss_desc(cpu, &get_cpu_entry_area(cpu)->tss.x86_tss);
 
 #ifdef CONFIG_X86_64
         memcpy(&tss, &desc[GDT_ENTRY_TSS], sizeof(tss_desc));
@@ -178,6 +172,9 @@ static void fix_processor_context(void)
         write_gdt_entry(desc, GDT_ENTRY_TSS, &tss, DESC_TSS);
 
         syscall_init();                         /* This sets MSR_*STAR and related */
+#else
+        if (boot_cpu_has(X86_FEATURE_SEP))
+                enable_sep_cpu();
 #endif
         load_TR_desc();                         /* This does ltr */
         load_mm_ldt(current->active_mm);        /* This does lldt */
@@ -190,9 +187,12 @@ static void fix_processor_context(void)
 }
 
 /**
- *      __restore_processor_state - restore the contents of CPU registers saved
- *              by __save_processor_state()
- *      @ctxt - structure to load the registers contents from
+ * __restore_processor_state - restore the contents of CPU registers saved
+ *                             by __save_processor_state()
+ * @ctxt - structure to load the registers contents from
+ *
+ * The asm code that gets us here will have restored a usable GDT, although
+ * it will be pointing to the wrong alias.
  */
 static void notrace __restore_processor_state(struct saved_context *ctxt)
 {
@@ -215,46 +215,52 @@ static void notrace __restore_processor_state(struct saved_context *ctxt)
         write_cr2(ctxt->cr2);
         write_cr0(ctxt->cr0);
 
+        /* Restore the IDT. */
+        load_idt(&ctxt->idt);
+
         /*
-         * now restore the descriptor tables to their proper values
-         * ltr is done i fix_processor_context().
+         * Just in case the asm code got us here with the SS, DS, or ES
+         * out of sync with the GDT, update them.
          */
-#ifdef CONFIG_X86_32
-        load_idt(&ctxt->idt);
+        loadsegment(ss, __KERNEL_DS);
+        loadsegment(ds, __USER_DS);
+        loadsegment(es, __USER_DS);
+
+        /*
+         * Restore percpu access.  Percpu access can happen in exception
+         * handlers or in complicated helpers like load_gs_index().
+         */
+#ifdef CONFIG_X86_64
+        wrmsrl(MSR_GS_BASE, ctxt->kernelmode_gs_base);
 #else
-/* CONFIG_X86_64 */
-        load_idt((const struct desc_ptr *)&ctxt->idt_limit);
+        loadsegment(fs, __KERNEL_PERCPU);
+        loadsegment(gs, __KERNEL_STACK_CANARY);
 #endif
 
+        /* Restore the TSS, RO GDT, LDT, and usermode-relevant MSRs. */
+        fix_processor_context();
+
         /*
-         * segment registers
+         * Now that we have descriptor tables fully restored and working
+         * exception handling, restore the usermode segments.
          */
-#ifdef CONFIG_X86_32
+#ifdef CONFIG_X86_64
+        loadsegment(ds, ctxt->es);
         loadsegment(es, ctxt->es);
         loadsegment(fs, ctxt->fs);
-        loadsegment(gs, ctxt->gs);
-        loadsegment(ss, ctxt->ss);
+        load_gs_index(ctxt->gs);
 
         /*
-         * sysenter MSRs
+         * Restore FSBASE and GSBASE after restoring the selectors, since
+         * restoring the selectors clobbers the bases.  Keep in mind
+         * that MSR_KERNEL_GS_BASE is horribly misnamed.
          */
-        if (boot_cpu_has(X86_FEATURE_SEP))
-                enable_sep_cpu();
-#else
-/* CONFIG_X86_64 */
-        asm volatile ("movw %0, %%ds" :: "r" (ctxt->ds));
-        asm volatile ("movw %0, %%es" :: "r" (ctxt->es));
-        asm volatile ("movw %0, %%fs" :: "r" (ctxt->fs));
-        load_gs_index(ctxt->gs);
-        asm volatile ("movw %0, %%ss" :: "r" (ctxt->ss));
-
         wrmsrl(MSR_FS_BASE, ctxt->fs_base);
-        wrmsrl(MSR_GS_BASE, ctxt->gs_base);
-        wrmsrl(MSR_KERNEL_GS_BASE, ctxt->gs_kernel_base);
+        wrmsrl(MSR_KERNEL_GS_BASE, ctxt->usermode_gs_base);
+#elif defined(CONFIG_X86_32_LAZY_GS)
+        loadsegment(gs, ctxt->gs);
 #endif
 
-        fix_processor_context();
-
         do_fpu_end();
         tsc_verify_tsc_adjust(true);
         x86_platform.restore_sched_clock_state();
diff --git a/arch/x86/xen/apic.c b/arch/x86/xen/apic.c
index 6b830d4cb4c8..de58533d3664 100644
--- a/arch/x86/xen/apic.c
+++ b/arch/x86/xen/apic.c
@@ -57,7 +57,7 @@ static u32 xen_apic_read(u32 reg)
                 return 0;
 
         if (reg == APIC_LVR)
-                return 0x10;
+                return 0x14;
 #ifdef CONFIG_X86_32
         if (reg == APIC_LDR)
                 return SET_APIC_LOGICAL_ID(1UL << smp_processor_id());
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index d669e9d89001..c9081c6671f0 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1,8 +1,12 @@
+#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+#include <linux/bootmem.h>
+#endif
 #include <linux/cpu.h>
 #include <linux/kexec.h>
 
 #include <xen/features.h>
 #include <xen/page.h>
+#include <xen/interface/memory.h>
 
 #include <asm/xen/hypercall.h>
 #include <asm/xen/hypervisor.h>
@@ -331,3 +335,80 @@ void xen_arch_unregister_cpu(int num)
 }
 EXPORT_SYMBOL(xen_arch_unregister_cpu);
 #endif
+
+#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+void __init arch_xen_balloon_init(struct resource *hostmem_resource)
+{
+        struct xen_memory_map memmap;
+        int rc;
+        unsigned int i, last_guest_ram;
+        phys_addr_t max_addr = PFN_PHYS(max_pfn);
+        struct e820_table *xen_e820_table;
+        const struct e820_entry *entry;
+        struct resource *res;
+
+        if (!xen_initial_domain())
+                return;
+
+        xen_e820_table = kmalloc(sizeof(*xen_e820_table), GFP_KERNEL);
+        if (!xen_e820_table)
+                return;
+
+        memmap.nr_entries = ARRAY_SIZE(xen_e820_table->entries);
+        set_xen_guest_handle(memmap.buffer, xen_e820_table->entries);
+        rc = HYPERVISOR_memory_op(XENMEM_machine_memory_map, &memmap);
+        if (rc) {
+                pr_warn("%s: Can't read host e820 (%d)\n", __func__, rc);
+                goto out;
+        }
+
+        last_guest_ram = 0;
+        for (i = 0; i < memmap.nr_entries; i++) {
+                if (xen_e820_table->entries[i].addr >= max_addr)
+                        break;
+                if (xen_e820_table->entries[i].type == E820_TYPE_RAM)
+                        last_guest_ram = i;
+        }
+
+        entry = &xen_e820_table->entries[last_guest_ram];
+        if (max_addr >= entry->addr + entry->size)
+                goto out; /* No unallocated host RAM. */
+
+        hostmem_resource->start = max_addr;
+        hostmem_resource->end = entry->addr + entry->size;
+
+        /*
+         * Mark non-RAM regions between the end of dom0 RAM and end of host RAM
+         * as unavailable. The rest of that region can be used for hotplug-based
+         * ballooning.
+         */
+        for (; i < memmap.nr_entries; i++) {
+                entry = &xen_e820_table->entries[i];
+
+                if (entry->type == E820_TYPE_RAM)
+                        continue;
+
+                if (entry->addr >= hostmem_resource->end)
+                        break;
+
+                res = kzalloc(sizeof(*res), GFP_KERNEL);
+                if (!res)
+                        goto out;
+
+                res->name = "Unavailable host RAM";
+                res->start = entry->addr;
+                res->end = (entry->addr + entry->size < hostmem_resource->end) ?
+                            entry->addr + entry->size : hostmem_resource->end;
+                rc = insert_resource(hostmem_resource, res);
+                if (rc) {
+                        pr_warn("%s: Can't insert [%llx - %llx) (%d)\n",
+                                __func__, res->start, res->end, rc);
+                        kfree(res);
+                        goto  out;
+                }
+        }
+
+ out:
+        kfree(xen_e820_table);
+}
+#endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index 5b2b3f3f6531..c047f42552e1 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -88,6 +88,8 @@
 #include "multicalls.h"
 #include "pmu.h"
 
+#include "../kernel/cpu/cpu.h" /* get_cpu_cap() */
+
 void *xen_initial_gdt;
 
 static int xen_cpu_up_prepare_pv(unsigned int cpu);
@@ -622,7 +624,7 @@ static struct trap_array_entry trap_array[] = {
         { simd_coprocessor_error,      xen_simd_coprocessor_error,      false },
 };
 
-static bool get_trap_addr(void **addr, unsigned int ist)
+static bool __ref get_trap_addr(void **addr, unsigned int ist)
 {
         unsigned int nr;
         bool ist_okay = false;
@@ -644,6 +646,14 @@ static bool get_trap_addr(void **addr, unsigned int ist)
                 }
         }
 
+        if (nr == ARRAY_SIZE(trap_array) &&
+            *addr >= (void *)early_idt_handler_array[0] &&
+            *addr < (void *)early_idt_handler_array[NUM_EXCEPTION_VECTORS]) {
+                nr = (*addr - (void *)early_idt_handler_array[0]) /
+                     EARLY_IDT_HANDLER_SIZE;
+                *addr = (void *)xen_early_idt_handler_array[nr];
+        }
+
         if (WARN_ON(ist != 0 && !ist_okay))
                 return false;
 
@@ -818,7 +828,7 @@ static void xen_load_sp0(unsigned long sp0)
         mcs = xen_mc_entry(0);
         MULTI_stack_switch(mcs.mc, __KERNEL_DS, sp0);
         xen_mc_issue(PARAVIRT_LAZY_CPU);
-        this_cpu_write(cpu_tss.x86_tss.sp0, sp0);
+        this_cpu_write(cpu_tss_rw.x86_tss.sp0, sp0);
 }
 
 void xen_set_iopl_mask(unsigned mask)
@@ -1250,6 +1260,7 @@ asmlinkage __visible void __init xen_start_kernel(void)
         __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
 
         /* Work out if we support NX */
+        get_cpu_cap(&boot_cpu_data);
         x86_configure_nx();
 
         /* Get mfn list */
@@ -1262,6 +1273,21 @@ asmlinkage __visible void __init xen_start_kernel(void)
         xen_setup_gdt(0);
 
         xen_init_irq_ops();
+
+        /* Let's presume PV guests always boot on vCPU with id 0. */
+        per_cpu(xen_vcpu_id, 0) = 0;
+
+        /*
+         * Setup xen_vcpu early because idt_setup_early_handler needs it for
+         * local_irq_disable(), irqs_disabled().
+         *
+         * Don't do the full vcpu_info placement stuff until we have
+         * the cpu_possible_mask and a non-dummy shared_info.
+         */
+        xen_vcpu_info_reset(0);
+
+        idt_setup_early_handler();
+
         xen_init_capabilities();
 
 #ifdef CONFIG_X86_LOCAL_APIC
@@ -1295,18 +1321,6 @@ asmlinkage __visible void __init xen_start_kernel(void)
          */
         acpi_numa = -1;
 #endif
-        /* Let's presume PV guests always boot on vCPU with id 0. */
-        per_cpu(xen_vcpu_id, 0) = 0;
-
-        /*
-         * Setup xen_vcpu early because start_kernel needs it for
-         * local_irq_disable(), irqs_disabled().
-         *
-         * Don't do the full vcpu_info placement stuff until we have
-         * the cpu_possible_mask and a non-dummy shared_info.
-         */
-        xen_vcpu_info_reset(0);
-
         WARN_ON(xen_cpuhp_setup(xen_cpu_up_prepare_pv, xen_cpu_dead_pv));
 
         local_irq_disable();
diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
index fc048ec686e7..d85076223a69 100644
--- a/arch/x86/xen/mmu_pv.c
+++ b/arch/x86/xen/mmu_pv.c
@@ -1325,20 +1325,18 @@ static void xen_flush_tlb_others(const struct cpumask *cpus,
 {
         struct {
                 struct mmuext_op op;
-#ifdef CONFIG_SMP
-                DECLARE_BITMAP(mask, num_processors);
-#else
                 DECLARE_BITMAP(mask, NR_CPUS);
-#endif
         } *args;
         struct multicall_space mcs;
+        const size_t mc_entry_size = sizeof(args->op) +
+                sizeof(args->mask[0]) * BITS_TO_LONGS(num_possible_cpus());
 
         trace_xen_mmu_flush_tlb_others(cpus, info->mm, info->start, info->end);
 
         if (cpumask_empty(cpus))
                 return;         /* nothing to do */
 
-        mcs = xen_mc_entry(sizeof(*args));
+        mcs = xen_mc_entry(mc_entry_size);
         args = mcs.args;
         args->op.arg2.vcpumask = to_cpumask(args->mask);
 
@@ -1902,6 +1900,18 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
         /* Graft it onto L4[511][510] */
         copy_page(level2_kernel_pgt, l2);
 
+        /*
+         * Zap execute permission from the ident map. Due to the sharing of
+         * L1 entries we need to do this in the L2.
+         */
+        if (__supported_pte_mask & _PAGE_NX) {
+                for (i = 0; i < PTRS_PER_PMD; ++i) {
+                        if (pmd_none(level2_ident_pgt[i]))
+                                continue;
+                        level2_ident_pgt[i] = pmd_set_flags(level2_ident_pgt[i], _PAGE_NX);
+                }
+        }
+
         /* Copy the initial P->M table mappings if necessary. */
         i = pgd_index(xen_start_info->mfn_list);
         if (i && i < pgd_index(__START_KERNEL_map))
@@ -2261,7 +2271,6 @@ static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot)
 
         switch (idx) {
         case FIX_BTMAP_END ... FIX_BTMAP_BEGIN:
-        case FIX_RO_IDT:
 #ifdef CONFIG_X86_32
         case FIX_WP_TEST:
 # ifdef CONFIG_HIGHMEM
@@ -2272,7 +2281,6 @@ static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot)
 #endif
         case FIX_TEXT_POKE0:
         case FIX_TEXT_POKE1:
-        case FIX_GDT_REMAP_BEGIN ... FIX_GDT_REMAP_END:
                 /* All local page mappings */
                 pte = pfn_pte(phys, prot);
                 break;
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index c114ca767b3b..6e0d2086eacb 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -808,7 +808,6 @@ char * __init xen_memory_setup(void)
         addr = xen_e820_table.entries[0].addr;
         size = xen_e820_table.entries[0].size;
         while (i < xen_e820_table.nr_entries) {
-                bool discard = false;
 
                 chunk_size = size;
                 type = xen_e820_table.entries[i].type;
@@ -824,11 +823,10 @@ char * __init xen_memory_setup(void)
                                 xen_add_extra_mem(pfn_s, n_pfns);
                                 xen_max_p2m_pfn = pfn_s + n_pfns;
                         } else
-                                discard = true;
+                                type = E820_TYPE_UNUSABLE;
                 }
 
-                if (!discard)
-                        xen_align_and_add_e820_region(addr, chunk_size, type);
+                xen_align_and_add_e820_region(addr, chunk_size, type);
 
                 addr += chunk_size;
                 size -= chunk_size;
diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S
index 8a10c9a9e2b5..417b339e5c8e 100644
--- a/arch/x86/xen/xen-asm_64.S
+++ b/arch/x86/xen/xen-asm_64.S
@@ -15,6 +15,7 @@
 
 #include <xen/interface/xen.h>
 
+#include <linux/init.h>
 #include <linux/linkage.h>
 
 .macro xen_pv_trap name
@@ -54,6 +55,19 @@ xen_pv_trap entry_INT80_compat
 #endif
 xen_pv_trap hypervisor_callback
 
+        __INIT
+ENTRY(xen_early_idt_handler_array)
+        i = 0
+        .rept NUM_EXCEPTION_VECTORS
+        pop %rcx
+        pop %r11
+        jmp early_idt_handler_array + i*EARLY_IDT_HANDLER_SIZE
+        i = i + 1
+        .fill xen_early_idt_handler_array + i*XEN_EARLY_IDT_HANDLER_SIZE - ., 1, 0xcc
+        .endr
+END(xen_early_idt_handler_array)
+        __FINIT
+
 hypercall_iret = hypercall_page + __HYPERVISOR_iret * 32
 /*
  * Xen64 iret frame:
diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
index 75011b80660f..3b34745d0a52 100644
--- a/arch/x86/xen/xen-ops.h
+++ b/arch/x86/xen/xen-ops.h
@@ -72,7 +72,7 @@ u64 xen_clocksource_read(void);
 void xen_setup_cpu_clockevents(void);
 void xen_save_time_memory_area(void);
 void xen_restore_time_memory_area(void);
-void __init xen_init_time_ops(void);
+void __ref xen_init_time_ops(void);
 void __init xen_hvm_init_time_ops(void);
 
 irqreturn_t xen_debug_interrupt(int irq, void *dev_id);
diff --git a/arch/xtensa/include/uapi/asm/Kbuild b/arch/xtensa/include/uapi/asm/Kbuild
index a5bcdfb890f1..837d4dd76785 100644
--- a/arch/xtensa/include/uapi/asm/Kbuild
+++ b/arch/xtensa/include/uapi/asm/Kbuild
@@ -2,6 +2,7 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 generic-y += bitsperlong.h
+generic-y += bpf_perf_event.h
 generic-y += errno.h
 generic-y += fcntl.h
 generic-y += ioctl.h
diff --git a/block/bio.c b/block/bio.c
index 8bfdea58159b..9ef6cf3addb3 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -599,6 +599,8 @@ void __bio_clone_fast(struct bio *bio, struct bio *bio_src)
         bio->bi_disk = bio_src->bi_disk;
         bio->bi_partno = bio_src->bi_partno;
         bio_set_flag(bio, BIO_CLONED);
+        if (bio_flagged(bio_src, BIO_THROTTLED))
+                bio_set_flag(bio, BIO_THROTTLED);
         bio->bi_opf = bio_src->bi_opf;
         bio->bi_write_hint = bio_src->bi_write_hint;
         bio->bi_iter = bio_src->bi_iter;
diff --git a/block/blk-core.c b/block/blk-core.c
index b8881750a3ac..3ba4326a63b5 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -562,6 +562,13 @@ static void __blk_drain_queue(struct request_queue *q, bool drain_all)
         }
 }
 
+void blk_drain_queue(struct request_queue *q)
+{
+        spin_lock_irq(q->queue_lock);
+        __blk_drain_queue(q, true);
+        spin_unlock_irq(q->queue_lock);
+}
+
 /**
  * blk_queue_bypass_start - enter queue bypass mode
  * @q: queue of interest
@@ -689,8 +696,6 @@ void blk_cleanup_queue(struct request_queue *q)
          */
         blk_freeze_queue(q);
         spin_lock_irq(lock);
-        if (!q->mq_ops)
-                __blk_drain_queue(q, true);
         queue_flag_set(QUEUE_FLAG_DEAD, q);
         spin_unlock_irq(lock);
 
diff --git a/block/blk-map.c b/block/blk-map.c
index b21f8e86f120..d3a94719f03f 100644
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -12,22 +12,29 @@
 #include "blk.h"
 
 /*
- * Append a bio to a passthrough request.  Only works can be merged into
- * the request based on the driver constraints.
+ * Append a bio to a passthrough request.  Only works if the bio can be merged
+ * into the request based on the driver constraints.
  */
-int blk_rq_append_bio(struct request *rq, struct bio *bio)
+int blk_rq_append_bio(struct request *rq, struct bio **bio)
 {
-        blk_queue_bounce(rq->q, &bio);
+        struct bio *orig_bio = *bio;
+
+        blk_queue_bounce(rq->q, bio);
 
         if (!rq->bio) {
-                blk_rq_bio_prep(rq->q, rq, bio);
+                blk_rq_bio_prep(rq->q, rq, *bio);
         } else {
-                if (!ll_back_merge_fn(rq->q, rq, bio))
+                if (!ll_back_merge_fn(rq->q, rq, *bio)) {
+                        if (orig_bio != *bio) {
+                                bio_put(*bio);
+                                *bio = orig_bio;
+                        }
                         return -EINVAL;
+                }
 
-                rq->biotail->bi_next = bio;
-                rq->biotail = bio;
-                rq->__data_len += bio->bi_iter.bi_size;
+                rq->biotail->bi_next = *bio;
+                rq->biotail = *bio;
+                rq->__data_len += (*bio)->bi_iter.bi_size;
         }
 
         return 0;
@@ -73,14 +80,12 @@ static int __blk_rq_map_user_iov(struct request *rq,
          * We link the bounce buffer in and could have to traverse it
          * later so we have to get a ref to prevent it from being freed
          */
-        ret = blk_rq_append_bio(rq, bio);
-        bio_get(bio);
+        ret = blk_rq_append_bio(rq, &bio);
         if (ret) {
-                bio_endio(bio);
                 __blk_rq_unmap_user(orig_bio);
-                bio_put(bio);
                 return ret;
         }
+        bio_get(bio);
 
         return 0;
 }
@@ -213,7 +218,7 @@ int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
         int reading = rq_data_dir(rq) == READ;
         unsigned long addr = (unsigned long) kbuf;
         int do_copy = 0;
-        struct bio *bio;
+        struct bio *bio, *orig_bio;
         int ret;
 
         if (len > (queue_max_hw_sectors(q) << 9))
@@ -236,10 +241,11 @@ int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
         if (do_copy)
                 rq->rq_flags |= RQF_COPY_USER;
 
-        ret = blk_rq_append_bio(rq, bio);
+        orig_bio = bio;
+        ret = blk_rq_append_bio(rq, &bio);
         if (unlikely(ret)) {
                 /* request is too big */
-                bio_put(bio);
+                bio_put(orig_bio);
                 return ret;
         }
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 11097477eeab..3d3797327491 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -161,6 +161,8 @@ void blk_freeze_queue(struct request_queue *q)
          * exported to drivers as the only user for unfreeze is blk_mq.
          */
         blk_freeze_queue_start(q);
+        if (!q->mq_ops)
+                blk_drain_queue(q);
         blk_mq_freeze_queue_wait(q);
 }
 
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index 825bc29767e6..d19f416d6101 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -2226,13 +2226,7 @@ again:
 out_unlock:
         spin_unlock_irq(q->queue_lock);
 out:
-        /*
-         * As multiple blk-throtls may stack in the same issue path, we
-         * don't want bios to leave with the flag set.  Clear the flag if
-         * being issued.
-         */
-        if (!throttled)
-                bio_clear_flag(bio, BIO_THROTTLED);
+        bio_set_flag(bio, BIO_THROTTLED);
 
 #ifdef CONFIG_BLK_DEV_THROTTLING_LOW
         if (throttled || !td->track_bio_latency)
diff --git a/block/blk.h b/block/blk.h
index 3f1446937aec..442098aa9463 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -330,4 +330,6 @@ static inline void blk_queue_bounce(struct request_queue *q, struct bio **bio)
 }
 #endif /* CONFIG_BOUNCE */
 
+extern void blk_drain_queue(struct request_queue *q);
+
 #endif /* BLK_INTERNAL_H */
diff --git a/block/bounce.c b/block/bounce.c
index fceb1a96480b..1d05c422c932 100644
--- a/block/bounce.c
+++ b/block/bounce.c
@@ -200,6 +200,7 @@ static void __blk_queue_bounce(struct request_queue *q, struct bio **bio_orig,
         unsigned i = 0;
         bool bounce = false;
         int sectors = 0;
+        bool passthrough = bio_is_passthrough(*bio_orig);
 
         bio_for_each_segment(from, *bio_orig, iter) {
                 if (i++ < BIO_MAX_PAGES)
@@ -210,13 +211,14 @@ static void __blk_queue_bounce(struct request_queue *q, struct bio **bio_orig,
         if (!bounce)
                 return;
 
-        if (sectors < bio_sectors(*bio_orig)) {
+        if (!passthrough && sectors < bio_sectors(*bio_orig)) {
                 bio = bio_split(*bio_orig, sectors, GFP_NOIO, bounce_bio_split);
                 bio_chain(bio, *bio_orig);
                 generic_make_request(*bio_orig);
                 *bio_orig = bio;
         }
-        bio = bio_clone_bioset(*bio_orig, GFP_NOIO, bounce_bio_set);
+        bio = bio_clone_bioset(*bio_orig, GFP_NOIO, passthrough ? NULL :
+                        bounce_bio_set);
 
         bio_for_each_segment_all(to, bio, i) {
                 struct page *page = to->bv_page;
diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c
index b4df317c2916..f95c60774ce8 100644
--- a/block/kyber-iosched.c
+++ b/block/kyber-iosched.c
@@ -100,9 +100,13 @@ struct kyber_hctx_data {
         unsigned int cur_domain;
         unsigned int batching;
         wait_queue_entry_t domain_wait[KYBER_NUM_DOMAINS];
+        struct sbq_wait_state *domain_ws[KYBER_NUM_DOMAINS];
         atomic_t wait_index[KYBER_NUM_DOMAINS];
 };
 
+static int kyber_domain_wake(wait_queue_entry_t *wait, unsigned mode, int flags,
+                             void *key);
+
 static int rq_sched_domain(const struct request *rq)
 {
         unsigned int op = rq->cmd_flags;
@@ -385,6 +389,9 @@ static int kyber_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx)
 
         for (i = 0; i < KYBER_NUM_DOMAINS; i++) {
                 INIT_LIST_HEAD(&khd->rqs[i]);
+                init_waitqueue_func_entry(&khd->domain_wait[i],
+                                          kyber_domain_wake);
+                khd->domain_wait[i].private = hctx;
                 INIT_LIST_HEAD(&khd->domain_wait[i].entry);
                 atomic_set(&khd->wait_index[i], 0);
         }
@@ -524,35 +531,39 @@ static int kyber_get_domain_token(struct kyber_queue_data *kqd,
         int nr;
 
         nr = __sbitmap_queue_get(domain_tokens);
-        if (nr >= 0)
-                return nr;
 
         /*
          * If we failed to get a domain token, make sure the hardware queue is
          * run when one becomes available. Note that this is serialized on
          * khd->lock, but we still need to be careful about the waker.
          */
-        if (list_empty_careful(&wait->entry)) {
-                init_waitqueue_func_entry(wait, kyber_domain_wake);
-                wait->private = hctx;
+        if (nr < 0 && list_empty_careful(&wait->entry)) {
                 ws = sbq_wait_ptr(domain_tokens,
                                   &khd->wait_index[sched_domain]);
+                khd->domain_ws[sched_domain] = ws;
                 add_wait_queue(&ws->wait, wait);
 
                 /*
                  * Try again in case a token was freed before we got on the wait
-                 * queue. The waker may have already removed the entry from the
-                 * wait queue, but list_del_init() is okay with that.
+                 * queue.
                  */
                 nr = __sbitmap_queue_get(domain_tokens);
-                if (nr >= 0) {
-                        unsigned long flags;
+        }
 
-                        spin_lock_irqsave(&ws->wait.lock, flags);
-                        list_del_init(&wait->entry);
-                        spin_unlock_irqrestore(&ws->wait.lock, flags);
-                }
+        /*
+         * If we got a token while we were on the wait queue, remove ourselves
+         * from the wait queue to ensure that all wake ups make forward
+         * progress. It's possible that the waker already deleted the entry
+         * between the !list_empty_careful() check and us grabbing the lock, but
+         * list_del_init() is okay with that.
+         */
+        if (nr >= 0 && !list_empty_careful(&wait->entry)) {
+                ws = khd->domain_ws[sched_domain];
+                spin_lock_irq(&ws->wait.lock);
+                list_del_init(&wait->entry);
+                spin_unlock_irq(&ws->wait.lock);
         }
+
         return nr;
 }
 
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 358749c38894..35d4dcea381f 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -664,7 +664,7 @@ void af_alg_free_areq_sgls(struct af_alg_async_req *areq)
         unsigned int i;
 
         list_for_each_entry_safe(rsgl, tmp, &areq->rsgl_list, list) {
-                ctx->rcvused -= rsgl->sg_num_bytes;
+                atomic_sub(rsgl->sg_num_bytes, &ctx->rcvused);
                 af_alg_free_sg(&rsgl->sgl);
                 list_del(&rsgl->list);
                 if (rsgl != &areq->first_rsgl)
@@ -672,14 +672,15 @@ void af_alg_free_areq_sgls(struct af_alg_async_req *areq)
         }
 
         tsgl = areq->tsgl;
-        for_each_sg(tsgl, sg, areq->tsgl_entries, i) {
-                if (!sg_page(sg))
-                        continue;
-                put_page(sg_page(sg));
-        }
+        if (tsgl) {
+                for_each_sg(tsgl, sg, areq->tsgl_entries, i) {
+                        if (!sg_page(sg))
+                                continue;
+                        put_page(sg_page(sg));
+                }
 
-        if (areq->tsgl && areq->tsgl_entries)
                 sock_kfree_s(sk, tsgl, areq->tsgl_entries * sizeof(*tsgl));
+        }
 }
 EXPORT_SYMBOL_GPL(af_alg_free_areq_sgls);
 
@@ -1137,12 +1138,6 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags,
                 if (!af_alg_readable(sk))
                         break;
 
-                if (!ctx->used) {
-                        err = af_alg_wait_for_data(sk, flags);
-                        if (err)
-                                return err;
-                }
-
                 seglen = min_t(size_t, (maxsize - len),
                                msg_data_left(msg));
 
@@ -1168,7 +1163,7 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags,
 
                 areq->last_rsgl = rsgl;
                 len += err;
-                ctx->rcvused += err;
+                atomic_add(err, &ctx->rcvused);
                 rsgl->sg_num_bytes = err;
                 iov_iter_advance(&msg->msg_iter, err);
         }
diff --git a/crypto/algapi.c b/crypto/algapi.c
index 60d7366ed343..9a636f961572 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c
@@ -167,6 +167,18 @@ void crypto_remove_spawns(struct crypto_alg *alg, struct list_head *list,
 
                         spawn->alg = NULL;
                         spawns = &inst->alg.cra_users;
+
+                        /*
+                         * We may encounter an unregistered instance here, since
+                         * an instance's spawns are set up prior to the instance
+                         * being registered.  An unregistered instance will have
+                         * NULL ->cra_users.next, since ->cra_users isn't
+                         * properly initialized until registration.  But an
+                         * unregistered instance cannot have any users, so treat
+                         * it the same as ->cra_users being empty.
+                         */
+                        if (spawns->next == NULL)
+                                break;
                 }
         } while ((spawns = crypto_more_spawns(alg, &stack, &top,
                                               &secondary_spawns)));
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index 805f485ddf1b..e9885a35ef6e 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -111,6 +111,12 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
         size_t usedpages = 0;           /* [in]  RX bufs to be used from user */
         size_t processed = 0;           /* [in]  TX bufs to be consumed */
 
+        if (!ctx->used) {
+                err = af_alg_wait_for_data(sk, flags);
+                if (err)
+                        return err;
+        }
+
         /*
          * Data length provided by caller via sendmsg/sendpage that has not
          * yet been processed.
@@ -285,6 +291,10 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
                 /* AIO operation */
                 sock_hold(sk);
                 areq->iocb = msg->msg_iocb;
+
+                /* Remember output size that will be generated. */
+                areq->outlen = outlen;
+
                 aead_request_set_callback(&areq->cra_u.aead_req,
                                           CRYPTO_TFM_REQ_MAY_BACKLOG,
                                           af_alg_async_cb, areq);
@@ -292,12 +302,8 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
                                  crypto_aead_decrypt(&areq->cra_u.aead_req);
 
                 /* AIO operation in progress */
-                if (err == -EINPROGRESS || err == -EBUSY) {
-                        /* Remember output size that will be generated. */
-                        areq->outlen = outlen;
-
+                if (err == -EINPROGRESS || err == -EBUSY)
                         return -EIOCBQUEUED;
-                }
 
                 sock_put(sk);
         } else {
@@ -503,6 +509,7 @@ static void aead_release(void *private)
         struct aead_tfm *tfm = private;
 
         crypto_free_aead(tfm->aead);
+        crypto_put_default_null_skcipher2();
         kfree(tfm);
 }
 
@@ -535,7 +542,6 @@ static void aead_sock_destruct(struct sock *sk)
         unsigned int ivlen = crypto_aead_ivsize(tfm);
 
         af_alg_pull_tsgl(sk, ctx->used, NULL, 0);
-        crypto_put_default_null_skcipher2();
         sock_kzfree_s(sk, ctx->iv, ivlen);
         sock_kfree_s(sk, ctx, ctx->len);
         af_alg_release_parent(sk);
@@ -565,7 +571,7 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk)
         INIT_LIST_HEAD(&ctx->tsgl_list);
         ctx->len = len;
         ctx->used = 0;
-        ctx->rcvused = 0;
+        atomic_set(&ctx->rcvused, 0);
         ctx->more = 0;
         ctx->merge = 0;
         ctx->enc = 0;
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 30cff827dd8f..c5c47b680152 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -72,6 +72,12 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
         int err = 0;
         size_t len = 0;
 
+        if (!ctx->used) {
+                err = af_alg_wait_for_data(sk, flags);
+                if (err)
+                        return err;
+        }
+
         /* Allocate cipher request for current operation. */
         areq = af_alg_alloc_areq(sk, sizeof(struct af_alg_async_req) +
                                      crypto_skcipher_reqsize(tfm));
@@ -119,6 +125,10 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
                 /* AIO operation */
                 sock_hold(sk);
                 areq->iocb = msg->msg_iocb;
+
+                /* Remember output size that will be generated. */
+                areq->outlen = len;
+
                 skcipher_request_set_callback(&areq->cra_u.skcipher_req,
                                               CRYPTO_TFM_REQ_MAY_SLEEP,
                                               af_alg_async_cb, areq);
@@ -127,12 +137,8 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
                         crypto_skcipher_decrypt(&areq->cra_u.skcipher_req);
 
                 /* AIO operation in progress */
-                if (err == -EINPROGRESS || err == -EBUSY) {
-                        /* Remember output size that will be generated. */
-                        areq->outlen = len;
-
+                if (err == -EINPROGRESS || err == -EBUSY)
                         return -EIOCBQUEUED;
-                }
 
                 sock_put(sk);
         } else {
@@ -384,7 +390,7 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk)
         INIT_LIST_HEAD(&ctx->tsgl_list);
         ctx->len = len;
         ctx->used = 0;
-        ctx->rcvused = 0;
+        atomic_set(&ctx->rcvused, 0);
         ctx->more = 0;
         ctx->merge = 0;
         ctx->enc = 0;
diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c
index c1ca1e86f5c4..a6dcaa659aa8 100644
--- a/crypto/asymmetric_keys/pkcs7_parser.c
+++ b/crypto/asymmetric_keys/pkcs7_parser.c
@@ -148,8 +148,10 @@ struct pkcs7_message *pkcs7_parse_message(const void *data, size_t datalen)
         }
 
         ret = pkcs7_check_authattrs(ctx->msg);
-        if (ret < 0)
+        if (ret < 0) {
+                msg = ERR_PTR(ret);
                 goto out;
+        }
 
         msg = ctx->msg;
         ctx->msg = NULL;
diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
index f6a009d88a33..1f4e25f10049 100644
--- a/crypto/asymmetric_keys/pkcs7_trust.c
+++ b/crypto/asymmetric_keys/pkcs7_trust.c
@@ -69,7 +69,7 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
                  /* Self-signed certificates form roots of their own, and if we
                   * don't know them, then we can't accept them.
                   */
-                if (x509->next == x509) {
+                if (x509->signer == x509) {
                         kleave(" = -ENOKEY [unknown self-signed]");
                         return -ENOKEY;
                 }
diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
index 2d93d9eccb4d..39e6de0c2761 100644
--- a/crypto/asymmetric_keys/pkcs7_verify.c
+++ b/crypto/asymmetric_keys/pkcs7_verify.c
@@ -59,11 +59,8 @@ static int pkcs7_digest(struct pkcs7_message *pkcs7,
         desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
 
         /* Digest the message [RFC2315 9.3] */
-        ret = crypto_shash_init(desc);
-        if (ret < 0)
-                goto error;
-        ret = crypto_shash_finup(desc, pkcs7->data, pkcs7->data_len,
-                                 sig->digest);
+        ret = crypto_shash_digest(desc, pkcs7->data, pkcs7->data_len,
+                                  sig->digest);
         if (ret < 0)
                 goto error;
         pr_devel("MsgDigest = [%*ph]\n", 8, sig->digest);
@@ -150,7 +147,7 @@ static int pkcs7_find_key(struct pkcs7_message *pkcs7,
                 pr_devel("Sig %u: Found cert serial match X.509[%u]\n",
                          sinfo->index, certix);
 
-                if (x509->pub->pkey_algo != sinfo->sig->pkey_algo) {
+                if (strcmp(x509->pub->pkey_algo, sinfo->sig->pkey_algo) != 0) {
                         pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n",
                                 sinfo->index);
                         continue;
diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
index bc3035ef27a2..de996586762a 100644
--- a/crypto/asymmetric_keys/public_key.c
+++ b/crypto/asymmetric_keys/public_key.c
@@ -73,7 +73,7 @@ int public_key_verify_signature(const struct public_key *pkey,
         char alg_name_buf[CRYPTO_MAX_ALG_NAME];
         void *output;
         unsigned int outlen;
-        int ret = -ENOMEM;
+        int ret;
 
         pr_devel("==>%s()\n", __func__);
 
@@ -99,6 +99,7 @@ int public_key_verify_signature(const struct public_key *pkey,
         if (IS_ERR(tfm))
                 return PTR_ERR(tfm);
 
+        ret = -ENOMEM;
         req = akcipher_request_alloc(tfm, GFP_KERNEL);
         if (!req)
                 goto error_free_tfm;
@@ -127,7 +128,7 @@ int public_key_verify_signature(const struct public_key *pkey,
          * signature and returns that to us.
          */
         ret = crypto_wait_req(crypto_akcipher_verify(req), &cwait);
-        if (ret < 0)
+        if (ret)
                 goto out_free_output;
 
         /* Do the actual verification step. */
@@ -142,6 +143,8 @@ error_free_req:
 error_free_tfm:
         crypto_free_akcipher(tfm);
         pr_devel("<==%s() = %d\n", __func__, ret);
+        if (WARN_ON_ONCE(ret > 0))
+                ret = -EINVAL;
         return ret;
 }
 EXPORT_SYMBOL_GPL(public_key_verify_signature);
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index dd03fead1ca3..ce2df8c9c583 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -409,6 +409,8 @@ int x509_extract_key_data(void *context, size_t hdrlen,
         ctx->cert->pub->pkey_algo = "rsa";
 
         /* Discard the BIT STRING metadata */
+        if (vlen < 1 || *(const u8 *)value != 0)
+                return -EBADMSG;
         ctx->key = value + 1;
         ctx->key_size = vlen - 1;
         return 0;
diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
index c9013582c026..9338b4558cdc 100644
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -79,11 +79,7 @@ int x509_get_sig_params(struct x509_certificate *cert)
         desc->tfm = tfm;
         desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
 
-        ret = crypto_shash_init(desc);
-        if (ret < 0)
-                goto error_2;
-        might_sleep();
-        ret = crypto_shash_finup(desc, cert->tbs, cert->tbs_size, sig->digest);
+        ret = crypto_shash_digest(desc, cert->tbs, cert->tbs_size, sig->digest);
         if (ret < 0)
                 goto error_2;
 
@@ -135,7 +131,7 @@ int x509_check_for_self_signed(struct x509_certificate *cert)
         }
 
         ret = -EKEYREJECTED;
-        if (cert->pub->pkey_algo != cert->sig->pkey_algo)
+        if (strcmp(cert->pub->pkey_algo, cert->sig->pkey_algo) != 0)
                 goto out;
 
         ret = public_key_verify_signature(cert->pub, cert->sig);
diff --git a/crypto/chacha20poly1305.c b/crypto/chacha20poly1305.c
index db1bc3147bc4..600afa99941f 100644
--- a/crypto/chacha20poly1305.c
+++ b/crypto/chacha20poly1305.c
@@ -610,6 +610,11 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb,
                                                     algt->mask));
         if (IS_ERR(poly))
                 return PTR_ERR(poly);
+        poly_hash = __crypto_hash_alg_common(poly);
+
+        err = -EINVAL;
+        if (poly_hash->digestsize != POLY1305_DIGEST_SIZE)
+                goto out_put_poly;
 
         err = -ENOMEM;
         inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
@@ -618,7 +623,6 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb,
 
         ctx = aead_instance_ctx(inst);
         ctx->saltlen = CHACHAPOLY_IV_SIZE - ivsize;
-        poly_hash = __crypto_hash_alg_common(poly);
         err = crypto_init_ahash_spawn(&ctx->poly, poly_hash,
                                       aead_crypto_instance(inst));
         if (err)
diff --git a/crypto/hmac.c b/crypto/hmac.c
index 92871dc2a63e..e74730224f0a 100644
--- a/crypto/hmac.c
+++ b/crypto/hmac.c
@@ -195,11 +195,15 @@ static int hmac_create(struct crypto_template *tmpl, struct rtattr **tb)
         salg = shash_attr_alg(tb[1], 0, 0);
         if (IS_ERR(salg))
                 return PTR_ERR(salg);
+        alg = &salg->base;
 
+        /* The underlying hash algorithm must be unkeyed */
         err = -EINVAL;
+        if (crypto_shash_alg_has_setkey(salg))
+                goto out_put_alg;
+
         ds = salg->digestsize;
         ss = salg->statesize;
-        alg = &salg->base;
         if (ds > alg->cra_blocksize ||
             ss < alg->cra_blocksize)
                 goto out_put_alg;
diff --git a/crypto/mcryptd.c b/crypto/mcryptd.c
index 4e6472658852..eca04d3729b3 100644
--- a/crypto/mcryptd.c
+++ b/crypto/mcryptd.c
@@ -81,6 +81,7 @@ static int mcryptd_init_queue(struct mcryptd_queue *queue,
                 pr_debug("cpu_queue #%d %p\n", cpu, queue->cpu_queue);
                 crypto_init_queue(&cpu_queue->queue, max_cpu_qlen);
                 INIT_WORK(&cpu_queue->work, mcryptd_queue_worker);
+                spin_lock_init(&cpu_queue->q_lock);
         }
         return 0;
 }
@@ -104,15 +105,16 @@ static int mcryptd_enqueue_request(struct mcryptd_queue *queue,
         int cpu, err;
         struct mcryptd_cpu_queue *cpu_queue;
 
-        cpu = get_cpu();
-        cpu_queue = this_cpu_ptr(queue->cpu_queue);
-        rctx->tag.cpu = cpu;
+        cpu_queue = raw_cpu_ptr(queue->cpu_queue);
+        spin_lock(&cpu_queue->q_lock);
+        cpu = smp_processor_id();
+        rctx->tag.cpu = smp_processor_id();
 
         err = crypto_enqueue_request(&cpu_queue->queue, request);
         pr_debug("enqueue request: cpu %d cpu_queue %p request %p\n",
                  cpu, cpu_queue, request);
+        spin_unlock(&cpu_queue->q_lock);
         queue_work_on(cpu, kcrypto_wq, &cpu_queue->work);
-        put_cpu();
 
         return err;
 }
@@ -161,16 +163,11 @@ static void mcryptd_queue_worker(struct work_struct *work)
         cpu_queue = container_of(work, struct mcryptd_cpu_queue, work);
         i = 0;
         while (i < MCRYPTD_BATCH || single_task_running()) {
-                /*
-                 * preempt_disable/enable is used to prevent
-                 * being preempted by mcryptd_enqueue_request()
-                 */
-                local_bh_disable();
-                preempt_disable();
+
+                spin_lock_bh(&cpu_queue->q_lock);
                 backlog = crypto_get_backlog(&cpu_queue->queue);
                 req = crypto_dequeue_request(&cpu_queue->queue);
-                preempt_enable();
-                local_bh_enable();
+                spin_unlock_bh(&cpu_queue->q_lock);
 
                 if (!req) {
                         mcryptd_opportunistic_flush();
@@ -185,7 +182,7 @@ static void mcryptd_queue_worker(struct work_struct *work)
                 ++i;
         }
         if (cpu_queue->queue.qlen)
-                queue_work(kcrypto_wq, &cpu_queue->work);
+                queue_work_on(smp_processor_id(), kcrypto_wq, &cpu_queue->work);
 }
 
 void mcryptd_flusher(struct work_struct *__work)
diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
index ee9cfb99fe25..f8ec3d4ba4a8 100644
--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@@ -254,6 +254,14 @@ static void pcrypt_aead_exit_tfm(struct crypto_aead *tfm)
         crypto_free_aead(ctx->child);
 }
 
+static void pcrypt_free(struct aead_instance *inst)
+{
+        struct pcrypt_instance_ctx *ctx = aead_instance_ctx(inst);
+
+        crypto_drop_aead(&ctx->spawn);
+        kfree(inst);
+}
+
 static int pcrypt_init_instance(struct crypto_instance *inst,
                                 struct crypto_alg *alg)
 {
@@ -319,6 +327,8 @@ static int pcrypt_create_aead(struct crypto_template *tmpl, struct rtattr **tb,
         inst->alg.encrypt = pcrypt_aead_encrypt;
         inst->alg.decrypt = pcrypt_aead_decrypt;
 
+        inst->free = pcrypt_free;
+
         err = aead_register_instance(tmpl, inst);
         if (err)
                 goto out_drop_aead;
@@ -349,14 +359,6 @@ static int pcrypt_create(struct crypto_template *tmpl, struct rtattr **tb)
         return -EINVAL;
 }
 
-static void pcrypt_free(struct crypto_instance *inst)
-{
-        struct pcrypt_instance_ctx *ctx = crypto_instance_ctx(inst);
-
-        crypto_drop_aead(&ctx->spawn);
-        kfree(inst);
-}
-
 static int pcrypt_cpumask_change_notify(struct notifier_block *self,
                                         unsigned long val, void *data)
 {
@@ -469,7 +471,6 @@ static void pcrypt_fini_padata(struct padata_pcrypt *pcrypt)
 static struct crypto_template pcrypt_tmpl = {
         .name = "pcrypt",
         .create = pcrypt_create,
-        .free = pcrypt_free,
         .module = THIS_MODULE,
 };
 
diff --git a/crypto/rsa_helper.c b/crypto/rsa_helper.c
index 0b66dc824606..cad395d70d78 100644
--- a/crypto/rsa_helper.c
+++ b/crypto/rsa_helper.c
@@ -30,7 +30,7 @@ int rsa_get_n(void *context, size_t hdrlen, unsigned char tag,
                 return -EINVAL;
 
         if (fips_enabled) {
-                while (!*ptr && n_sz) {
+                while (n_sz && !*ptr) {
                         ptr++;
                         n_sz--;
                 }
diff --git a/crypto/salsa20_generic.c b/crypto/salsa20_generic.c
index f550b5d94630..d7da0eea5622 100644
--- a/crypto/salsa20_generic.c
+++ b/crypto/salsa20_generic.c
@@ -188,13 +188,6 @@ static int encrypt(struct blkcipher_desc *desc,
 
         salsa20_ivsetup(ctx, walk.iv);
 
-        if (likely(walk.nbytes == nbytes))
-        {
-                salsa20_encrypt_bytes(ctx, walk.dst.virt.addr,
-                                      walk.src.virt.addr, nbytes);
-                return blkcipher_walk_done(desc, &walk, 0);
-        }
-
         while (walk.nbytes >= 64) {
                 salsa20_encrypt_bytes(ctx, walk.dst.virt.addr,
                                       walk.src.virt.addr,
diff --git a/crypto/shash.c b/crypto/shash.c
index 325a14da5827..e849d3ee2e27 100644
--- a/crypto/shash.c
+++ b/crypto/shash.c
@@ -25,11 +25,12 @@
 
 static const struct crypto_type crypto_shash_type;
 
-static int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
-                           unsigned int keylen)
+int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
+                    unsigned int keylen)
 {
         return -ENOSYS;
 }
+EXPORT_SYMBOL_GPL(shash_no_setkey);
 
 static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key,
                                   unsigned int keylen)
diff --git a/crypto/skcipher.c b/crypto/skcipher.c
index 778e0ff42bfa..11af5fd6a443 100644
--- a/crypto/skcipher.c
+++ b/crypto/skcipher.c
@@ -449,6 +449,8 @@ static int skcipher_walk_skcipher(struct skcipher_walk *walk,
 
         walk->total = req->cryptlen;
         walk->nbytes = 0;
+        walk->iv = req->iv;
+        walk->oiv = req->iv;
 
         if (unlikely(!walk->total))
                 return 0;
@@ -456,9 +458,6 @@ static int skcipher_walk_skcipher(struct skcipher_walk *walk,
         scatterwalk_start(&walk->in, req->src);
         scatterwalk_start(&walk->out, req->dst);
 
-        walk->iv = req->iv;
-        walk->oiv = req->iv;
-
         walk->flags &= ~SKCIPHER_WALK_SLEEP;
         walk->flags |= req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ?
                        SKCIPHER_WALK_SLEEP : 0;
@@ -510,6 +509,8 @@ static int skcipher_walk_aead_common(struct skcipher_walk *walk,
         int err;
 
         walk->nbytes = 0;
+        walk->iv = req->iv;
+        walk->oiv = req->iv;
 
         if (unlikely(!walk->total))
                 return 0;
@@ -525,9 +526,6 @@ static int skcipher_walk_aead_common(struct skcipher_walk *walk,
         scatterwalk_done(&walk->in, 0, walk->total);
         scatterwalk_done(&walk->out, 0, walk->total);
 
-        walk->iv = req->iv;
-        walk->oiv = req->iv;
-
         if (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP)
                 walk->flags |= SKCIPHER_WALK_SLEEP;
         else
diff --git a/drivers/Makefile b/drivers/Makefile
index 1d034b680431..e06f7f633f73 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -105,6 +105,7 @@ obj-$(CONFIG_TC)		+= tc/
 obj-$(CONFIG_UWB)               += uwb/
 obj-$(CONFIG_USB_PHY)           += usb/
 obj-$(CONFIG_USB)               += usb/
+obj-$(CONFIG_USB_SUPPORT)       += usb/
 obj-$(CONFIG_PCI)               += usb/
 obj-$(CONFIG_USB_GADGET)        += usb/
 obj-$(CONFIG_OF)                += usb/
diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index 6742f6c68034..9bff853e85f3 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -1007,7 +1007,7 @@ skip:
         /* The record may be cleared by others, try read next record */
         if (len == -ENOENT)
                 goto skip;
-        else if (len < sizeof(*rcd)) {
+        else if (len < 0 || len < sizeof(*rcd)) {
                 rc = -EIO;
                 goto out;
         }
diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index 21c28433c590..06ea4749ebd9 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -949,7 +949,7 @@ static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val)
         }
 
         *val = 0;
-        if (reg->space_id == ACPI_ADR_SPACE_PLATFORM_COMM)
+        if (reg->space_id == ACPI_ADR_SPACE_PLATFORM_COMM && pcc_ss_id >= 0)
                 vaddr = GET_PCC_VADDR(reg->address, pcc_ss_id);
         else if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
                 vaddr = reg_res->sys_mem_vaddr;
@@ -988,7 +988,7 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)
         int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
         struct cpc_reg *reg = &reg_res->cpc_entry.reg;
 
-        if (reg->space_id == ACPI_ADR_SPACE_PLATFORM_COMM)
+        if (reg->space_id == ACPI_ADR_SPACE_PLATFORM_COMM && pcc_ss_id >= 0)
                 vaddr = GET_PCC_VADDR(reg->address, pcc_ss_id);
         else if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
                 vaddr = reg_res->sys_mem_vaddr;
@@ -1035,14 +1035,15 @@ int cppc_get_perf_caps(int cpunum, struct cppc_perf_caps *perf_caps)
                 *lowest_non_linear_reg, *nominal_reg;
         u64 high, low, nom, min_nonlinear;
         int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpunum);
-        struct cppc_pcc_data *pcc_ss_data = pcc_data[pcc_ss_id];
+        struct cppc_pcc_data *pcc_ss_data;
         int ret = 0, regs_in_pcc = 0;
 
-        if (!cpc_desc) {
+        if (!cpc_desc || pcc_ss_id < 0) {
                 pr_debug("No CPC descriptor for CPU:%d\n", cpunum);
                 return -ENODEV;
         }
 
+        pcc_ss_data = pcc_data[pcc_ss_id];
         highest_reg = &cpc_desc->cpc_regs[HIGHEST_PERF];
         lowest_reg = &cpc_desc->cpc_regs[LOWEST_PERF];
         lowest_non_linear_reg = &cpc_desc->cpc_regs[LOW_NON_LINEAR_PERF];
@@ -1095,15 +1096,16 @@ int cppc_get_perf_ctrs(int cpunum, struct cppc_perf_fb_ctrs *perf_fb_ctrs)
         struct cpc_register_resource *delivered_reg, *reference_reg,
                 *ref_perf_reg, *ctr_wrap_reg;
         int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpunum);
-        struct cppc_pcc_data *pcc_ss_data = pcc_data[pcc_ss_id];
+        struct cppc_pcc_data *pcc_ss_data;
         u64 delivered, reference, ref_perf, ctr_wrap_time;
         int ret = 0, regs_in_pcc = 0;
 
-        if (!cpc_desc) {
+        if (!cpc_desc || pcc_ss_id < 0) {
                 pr_debug("No CPC descriptor for CPU:%d\n", cpunum);
                 return -ENODEV;
         }
 
+        pcc_ss_data = pcc_data[pcc_ss_id];
         delivered_reg = &cpc_desc->cpc_regs[DELIVERED_CTR];
         reference_reg = &cpc_desc->cpc_regs[REFERENCE_CTR];
         ref_perf_reg = &cpc_desc->cpc_regs[REFERENCE_PERF];
@@ -1169,14 +1171,15 @@ int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls)
         struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpu);
         struct cpc_register_resource *desired_reg;
         int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
-        struct cppc_pcc_data *pcc_ss_data = pcc_data[pcc_ss_id];
+        struct cppc_pcc_data *pcc_ss_data;
         int ret = 0;
 
-        if (!cpc_desc) {
+        if (!cpc_desc || pcc_ss_id < 0) {
                 pr_debug("No CPC descriptor for CPU:%d\n", cpu);
                 return -ENODEV;
         }
 
+        pcc_ss_data = pcc_data[pcc_ss_id];
         desired_reg = &cpc_desc->cpc_regs[DESIRED_PERF];
 
         /*
@@ -1301,7 +1304,7 @@ unsigned int cppc_get_transition_latency(int cpu_num)
         struct cpc_desc *cpc_desc;
         struct cpc_register_resource *desired_reg;
         int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu_num);
-        struct cppc_pcc_data *pcc_ss_data = pcc_data[pcc_ss_id];
+        struct cppc_pcc_data *pcc_ss_data;
 
         cpc_desc = per_cpu(cpc_desc_ptr, cpu_num);
         if (!cpc_desc)
@@ -1311,6 +1314,10 @@ unsigned int cppc_get_transition_latency(int cpu_num)
         if (!CPC_IN_PCC(desired_reg))
                 return CPUFREQ_ETERNAL;
 
+        if (pcc_ss_id < 0)
+                return CPUFREQ_ETERNAL;
+
+        pcc_ss_data = pcc_data[pcc_ss_id];
         if (pcc_ss_data->pcc_mpar)
                 latency_ns = 60 * (1000 * 1000 * 1000 / pcc_ss_data->pcc_mpar);
 
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index e4ffaeec9ec2..a4c8ad98560d 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -1138,7 +1138,7 @@ int acpi_subsys_thaw_noirq(struct device *dev)
          * skip all of the subsequent "thaw" callbacks for the device.
          */
         if (dev_pm_smart_suspend_and_suspended(dev)) {
-                dev->power.direct_complete = true;
+                dev_pm_skip_next_resume_phases(dev);
                 return 0;
         }
 
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index ff2580e7611d..abeb4df4f22e 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -1670,6 +1670,11 @@ static int acpi_nfit_add_dimm(struct acpi_nfit_desc *acpi_desc,
                                 dev_name(&adev_dimm->dev));
                 return -ENXIO;
         }
+        /*
+         * Record nfit_mem for the notification path to track back to
+         * the nfit sysfs attributes for this dimm device object.
+         */
+        dev_set_drvdata(&adev_dimm->dev, nfit_mem);
 
         /*
          * Until standardization materializes we need to consider 4
@@ -1752,9 +1757,11 @@ static void shutdown_dimm_notify(void *data)
                         sysfs_put(nfit_mem->flags_attr);
                         nfit_mem->flags_attr = NULL;
                 }
-                if (adev_dimm)
+                if (adev_dimm) {
                         acpi_remove_notify_handler(adev_dimm->handle,
                                         ACPI_DEVICE_NOTIFY, acpi_nvdimm_notify);
+                        dev_set_drvdata(&adev_dimm->dev, NULL);
+                }
         }
         mutex_unlock(&acpi_desc->init_mutex);
 }
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index a73596a4f804..a7ecfde66b7b 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -482,7 +482,8 @@ enum binder_deferred_state {
  * @tsk                   task_struct for group_leader of process
  *                        (invariant after initialized)
  * @files                 files_struct for process
- *                        (invariant after initialized)
+ *                        (protected by @files_lock)
+ * @files_lock            mutex to protect @files
  * @deferred_work_node:   element for binder_deferred_list
  *                        (protected by binder_deferred_lock)
  * @deferred_work:        bitmap of deferred work to perform
@@ -530,6 +531,7 @@ struct binder_proc {
         int pid;
         struct task_struct *tsk;
         struct files_struct *files;
+        struct mutex files_lock;
         struct hlist_node deferred_work_node;
         int deferred_work;
         bool is_dead;
@@ -877,20 +879,26 @@ static void binder_inc_node_tmpref_ilocked(struct binder_node *node);
 
 static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
 {
-        struct files_struct *files = proc->files;
         unsigned long rlim_cur;
         unsigned long irqs;
+        int ret;
 
-        if (files == NULL)
-                return -ESRCH;
-
-        if (!lock_task_sighand(proc->tsk, &irqs))
-                return -EMFILE;
-
+        mutex_lock(&proc->files_lock);
+        if (proc->files == NULL) {
+                ret = -ESRCH;
+                goto err;
+        }
+        if (!lock_task_sighand(proc->tsk, &irqs)) {
+                ret = -EMFILE;
+                goto err;
+        }
         rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE);
         unlock_task_sighand(proc->tsk, &irqs);
 
-        return __alloc_fd(files, 0, rlim_cur, flags);
+        ret = __alloc_fd(proc->files, 0, rlim_cur, flags);
+err:
+        mutex_unlock(&proc->files_lock);
+        return ret;
 }
 
 /*
@@ -899,8 +907,10 @@ static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
 static void task_fd_install(
         struct binder_proc *proc, unsigned int fd, struct file *file)
 {
+        mutex_lock(&proc->files_lock);
         if (proc->files)
                 __fd_install(proc->files, fd, file);
+        mutex_unlock(&proc->files_lock);
 }
 
 /*
@@ -910,9 +920,11 @@ static long task_close_fd(struct binder_proc *proc, unsigned int fd)
 {
         int retval;
 
-        if (proc->files == NULL)
-                return -ESRCH;
-
+        mutex_lock(&proc->files_lock);
+        if (proc->files == NULL) {
+                retval = -ESRCH;
+                goto err;
+        }
         retval = __close_fd(proc->files, fd);
         /* can't restart close syscall because file table entry was cleared */
         if (unlikely(retval == -ERESTARTSYS ||
@@ -920,7 +932,8 @@ static long task_close_fd(struct binder_proc *proc, unsigned int fd)
                      retval == -ERESTARTNOHAND ||
                      retval == -ERESTART_RESTARTBLOCK))
                 retval = -EINTR;
-
+err:
+        mutex_unlock(&proc->files_lock);
         return retval;
 }
 
@@ -1948,6 +1961,26 @@ static void binder_send_failed_reply(struct binder_transaction *t,
 }
 
 /**
+ * binder_cleanup_transaction() - cleans up undelivered transaction
+ * @t:          transaction that needs to be cleaned up
+ * @reason:     reason the transaction wasn't delivered
+ * @error_code: error to return to caller (if synchronous call)
+ */
+static void binder_cleanup_transaction(struct binder_transaction *t,
+                                       const char *reason,
+                                       uint32_t error_code)
+{
+        if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) {
+                binder_send_failed_reply(t, error_code);
+        } else {
+                binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
+                        "undelivered transaction %d, %s\n",
+                        t->debug_id, reason);
+                binder_free_transaction(t);
+        }
+}
+
+/**
  * binder_validate_object() - checks for a valid metadata object in a buffer.
  * @buffer:     binder_buffer that we're parsing.
  * @offset:     offset in the buffer at which to validate an object.
@@ -4015,12 +4048,20 @@ retry:
                 if (put_user(cmd, (uint32_t __user *)ptr)) {
                         if (t_from)
                                 binder_thread_dec_tmpref(t_from);
+
+                        binder_cleanup_transaction(t, "put_user failed",
+                                                   BR_FAILED_REPLY);
+
                         return -EFAULT;
                 }
                 ptr += sizeof(uint32_t);
                 if (copy_to_user(ptr, &tr, sizeof(tr))) {
                         if (t_from)
                                 binder_thread_dec_tmpref(t_from);
+
+                        binder_cleanup_transaction(t, "copy_to_user failed",
+                                                   BR_FAILED_REPLY);
+
                         return -EFAULT;
                 }
                 ptr += sizeof(tr);
@@ -4090,15 +4131,9 @@ static void binder_release_work(struct binder_proc *proc,
                         struct binder_transaction *t;
 
                         t = container_of(w, struct binder_transaction, work);
-                        if (t->buffer->target_node &&
-                            !(t->flags & TF_ONE_WAY)) {
-                                binder_send_failed_reply(t, BR_DEAD_REPLY);
-                        } else {
-                                binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
-                                        "undelivered transaction %d\n",
-                                        t->debug_id);
-                                binder_free_transaction(t);
-                        }
+
+                        binder_cleanup_transaction(t, "process died.",
+                                                   BR_DEAD_REPLY);
                 } break;
                 case BINDER_WORK_RETURN_ERROR: {
                         struct binder_error *e = container_of(
@@ -4605,7 +4640,9 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
         ret = binder_alloc_mmap_handler(&proc->alloc, vma);
         if (ret)
                 return ret;
+        mutex_lock(&proc->files_lock);
         proc->files = get_files_struct(current);
+        mutex_unlock(&proc->files_lock);
         return 0;
 
 err_bad_arg:
@@ -4629,6 +4666,7 @@ static int binder_open(struct inode *nodp, struct file *filp)
         spin_lock_init(&proc->outer_lock);
         get_task_struct(current->group_leader);
         proc->tsk = current->group_leader;
+        mutex_init(&proc->files_lock);
         INIT_LIST_HEAD(&proc->todo);
         proc->default_priority = task_nice(current);
         binder_dev = container_of(filp->private_data, struct binder_device,
@@ -4881,9 +4919,11 @@ static void binder_deferred_func(struct work_struct *work)
 
                 files = NULL;
                 if (defer & BINDER_DEFERRED_PUT_FILES) {
+                        mutex_lock(&proc->files_lock);
                         files = proc->files;
                         if (files)
                                 proc->files = NULL;
+                        mutex_unlock(&proc->files_lock);
                 }
 
                 if (defer & BINDER_DEFERRED_FLUSH)
diff --git a/drivers/ata/ahci_mtk.c b/drivers/ata/ahci_mtk.c
index 80854f71559a..0ae6971c2a4c 100644
--- a/drivers/ata/ahci_mtk.c
+++ b/drivers/ata/ahci_mtk.c
@@ -1,5 +1,5 @@
 /*
- * MeidaTek AHCI SATA driver
+ * MediaTek AHCI SATA driver
  *
  * Copyright (c) 2017 MediaTek Inc.
  * Author: Ryder Lee <ryder.lee@mediatek.com>
@@ -25,7 +25,7 @@
 #include <linux/reset.h>
 #include "ahci.h"
 
-#define DRV_NAME                "ahci"
+#define DRV_NAME                "ahci-mtk"
 
 #define SYS_CFG                 0x14
 #define SYS_CFG_SATA_MSK        GENMASK(31, 30)
@@ -192,5 +192,5 @@ static struct platform_driver mtk_ahci_driver = {
 };
 module_platform_driver(mtk_ahci_driver);
 
-MODULE_DESCRIPTION("MeidaTek SATA AHCI Driver");
+MODULE_DESCRIPTION("MediaTek SATA AHCI Driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/ata/ahci_qoriq.c b/drivers/ata/ahci_qoriq.c
index b6b0bf76dfc7..2685f28160f7 100644
--- a/drivers/ata/ahci_qoriq.c
+++ b/drivers/ata/ahci_qoriq.c
@@ -35,6 +35,8 @@
 
 /* port register default value */
 #define AHCI_PORT_PHY_1_CFG     0xa003fffe
+#define AHCI_PORT_PHY2_CFG      0x28184d1f
+#define AHCI_PORT_PHY3_CFG      0x0e081509
 #define AHCI_PORT_TRANS_CFG     0x08000029
 #define AHCI_PORT_AXICC_CFG     0x3fffffff
 
@@ -183,6 +185,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
                 writel(readl(qpriv->ecc_addr) | ECC_DIS_ARMV8_CH2,
                                 qpriv->ecc_addr);
                 writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+                writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+                writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
                 writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                 if (qpriv->is_dmacoherent)
                         writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
@@ -190,6 +194,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
 
         case AHCI_LS2080A:
                 writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+                writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+                writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
                 writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                 if (qpriv->is_dmacoherent)
                         writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
@@ -201,6 +207,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
                 writel(readl(qpriv->ecc_addr) | ECC_DIS_ARMV8_CH2,
                                 qpriv->ecc_addr);
                 writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+                writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+                writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
                 writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                 if (qpriv->is_dmacoherent)
                         writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
@@ -212,6 +220,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
                 writel(readl(qpriv->ecc_addr) | ECC_DIS_LS1088A,
                        qpriv->ecc_addr);
                 writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+                writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+                writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
                 writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                 if (qpriv->is_dmacoherent)
                         writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
@@ -219,6 +229,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
 
         case AHCI_LS2088A:
                 writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
+                writel(AHCI_PORT_PHY2_CFG, reg_base + PORT_PHY2);
+                writel(AHCI_PORT_PHY3_CFG, reg_base + PORT_PHY3);
                 writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                 if (qpriv->is_dmacoherent)
                         writel(AHCI_PORT_AXICC_CFG, reg_base + PORT_AXICC);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 2a882929de4a..3c09122bf038 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -3082,13 +3082,19 @@ int sata_down_spd_limit(struct ata_link *link, u32 spd_limit)
         bit = fls(mask) - 1;
         mask &= ~(1 << bit);
 
-        /* Mask off all speeds higher than or equal to the current
-         * one.  Force 1.5Gbps if current SPD is not available.
+        /*
+         * Mask off all speeds higher than or equal to the current one.  At
+         * this point, if current SPD is not available and we previously
+         * recorded the link speed from SStatus, the driver has already
+         * masked off the highest bit so mask should already be 1 or 0.
+         * Otherwise, we should not force 1.5Gbps on a link where we have
+         * not previously recorded speed from SStatus.  Just return in this
+         * case.
          */
         if (spd > 1)
                 mask &= (1 << (spd - 1)) - 1;
         else
-                mask &= 1;
+                return -EINVAL;
 
         /* were we already at the bottom? */
         if (!mask)
@@ -4443,6 +4449,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
          * https://bugzilla.kernel.org/show_bug.cgi?id=121671
          */
         { "LITEON CX1-JB*-HP",  NULL,           ATA_HORKAGE_MAX_SEC_1024 },
+        { "LITEON EP1-*",       NULL,           ATA_HORKAGE_MAX_SEC_1024 },
 
         /* Devices we expect to fail diagnostics */
 
diff --git a/drivers/ata/pata_pdc2027x.c b/drivers/ata/pata_pdc2027x.c
index ffd8d33c6e0f..6db2e34bd52f 100644
--- a/drivers/ata/pata_pdc2027x.c
+++ b/drivers/ata/pata_pdc2027x.c
@@ -82,7 +82,7 @@ static int pdc2027x_set_mode(struct ata_link *link, struct ata_device **r_failed
  * is issued to the device. However, if the controller clock is 133MHz,
  * the following tables must be used.
  */
-static struct pdc2027x_pio_timing {
+static const struct pdc2027x_pio_timing {
         u8 value0, value1, value2;
 } pdc2027x_pio_timing_tbl[] = {
         { 0xfb, 0x2b, 0xac }, /* PIO mode 0 */
@@ -92,7 +92,7 @@ static struct pdc2027x_pio_timing {
         { 0x23, 0x09, 0x25 }, /* PIO mode 4, IORDY on, Prefetch off */
 };
 
-static struct pdc2027x_mdma_timing {
+static const struct pdc2027x_mdma_timing {
         u8 value0, value1;
 } pdc2027x_mdma_timing_tbl[] = {
         { 0xdf, 0x5f }, /* MDMA mode 0 */
@@ -100,7 +100,7 @@ static struct pdc2027x_mdma_timing {
         { 0x69, 0x25 }, /* MDMA mode 2 */
 };
 
-static struct pdc2027x_udma_timing {
+static const struct pdc2027x_udma_timing {
         u8 value0, value1, value2;
 } pdc2027x_udma_timing_tbl[] = {
         { 0x4a, 0x0f, 0xd5 }, /* UDMA mode 0 */
@@ -649,7 +649,7 @@ static long pdc_detect_pll_input_clock(struct ata_host *host)
  * @host: target ATA host
  * @board_idx: board identifier
  */
-static int pdc_hardware_init(struct ata_host *host, unsigned int board_idx)
+static void pdc_hardware_init(struct ata_host *host, unsigned int board_idx)
 {
         long pll_clock;
 
@@ -665,8 +665,6 @@ static int pdc_hardware_init(struct ata_host *host, unsigned int board_idx)
 
         /* Adjust PLL control register */
         pdc_adjust_pll(host, pll_clock, board_idx);
-
-        return 0;
 }
 
 /**
@@ -753,8 +751,7 @@ static int pdc2027x_init_one(struct pci_dev *pdev,
         //pci_enable_intx(pdev);
 
         /* initialize adapter */
-        if (pdc_hardware_init(host, board_idx) != 0)
-                return -EIO;
+        pdc_hardware_init(host, board_idx);
 
         pci_set_master(pdev);
         return ata_host_activate(host, pdev->irq, ata_bmdma_interrupt,
@@ -778,8 +775,7 @@ static int pdc2027x_reinit_one(struct pci_dev *pdev)
         else
                 board_idx = PDC_UDMA_133;
 
-        if (pdc_hardware_init(host, board_idx))
-                return -EIO;
+        pdc_hardware_init(host, board_idx);
 
         ata_host_resume(host);
         return 0;
diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
index 2f6614c9a229..2415ad9f6dd4 100644
--- a/drivers/base/Kconfig
+++ b/drivers/base/Kconfig
@@ -91,22 +91,23 @@ config FIRMWARE_IN_KERNEL
         depends on FW_LOADER
         default y
         help
-          The kernel source tree includes a number of firmware 'blobs'
-          that are used by various drivers. The recommended way to
-          use these is to run "make firmware_install", which, after
-          converting ihex files to binary, copies all of the needed
-          binary files in firmware/ to /lib/firmware/ on your system so
-          that they can be loaded by userspace helpers on request.
+          Various drivers in the kernel source tree may require firmware,
+          which is generally available in your distribution's linux-firmware
+          package.
+
+          The linux-firmware package should install firmware into
+          /lib/firmware/ on your system, so they can be loaded by userspace
+          helpers on request.
 
           Enabling this option will build each required firmware blob
-          into the kernel directly, where request_firmware() will find
-          them without having to call out to userspace. This may be
-          useful if your root file system requires a device that uses
-          such firmware and do not wish to use an initrd.
+          specified by EXTRA_FIRMWARE into the kernel directly, where
+          request_firmware() will find them without having to call out to
+          userspace. This may be useful if your root file system requires a
+          device that uses such firmware and you do not wish to use an
+          initrd.
 
           This single option controls the inclusion of firmware for
-          every driver that uses request_firmware() and ships its
-          firmware in the kernel source tree, which avoids a
+          every driver that uses request_firmware(), which avoids a
           proliferation of 'Include firmware for xxx device' options.
 
           Say 'N' and let firmware be loaded from userspace.
@@ -235,6 +236,9 @@ config GENERIC_CPU_DEVICES
 config GENERIC_CPU_AUTOPROBE
         bool
 
+config GENERIC_CPU_VULNERABILITIES
+        bool
+
 config SOC_BUS
         bool
         select GLOB
diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
index eb3af2739537..07532d83be0b 100644
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -186,6 +186,11 @@ static void cache_associativity(struct cacheinfo *this_leaf)
                 this_leaf->ways_of_associativity = (size / nr_sets) / line_size;
 }
 
+static bool cache_node_is_unified(struct cacheinfo *this_leaf)
+{
+        return of_property_read_bool(this_leaf->of_node, "cache-unified");
+}
+
 static void cache_of_override_properties(unsigned int cpu)
 {
         int index;
@@ -194,6 +199,14 @@ static void cache_of_override_properties(unsigned int cpu)
 
         for (index = 0; index < cache_leaves(cpu); index++) {
                 this_leaf = this_cpu_ci->info_list + index;
+                /*
+                 * init_cache_level must setup the cache level correctly
+                 * overriding the architecturally specified levels, so
+                 * if type is NONE at this stage, it should be unified
+                 */
+                if (this_leaf->type == CACHE_TYPE_NOCACHE &&
+                    cache_node_is_unified(this_leaf))
+                        this_leaf->type = CACHE_TYPE_UNIFIED;
                 cache_size(this_leaf);
                 cache_get_line_size(this_leaf);
                 cache_nr_sets(this_leaf);
diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
index 58a9b608d821..d99038487a0d 100644
--- a/drivers/base/cpu.c
+++ b/drivers/base/cpu.c
@@ -511,10 +511,58 @@ static void __init cpu_dev_register_generic(void)
 #endif
 }
 
+#ifdef CONFIG_GENERIC_CPU_VULNERABILITIES
+
+ssize_t __weak cpu_show_meltdown(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "Not affected\n");
+}
+
+ssize_t __weak cpu_show_spectre_v1(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "Not affected\n");
+}
+
+ssize_t __weak cpu_show_spectre_v2(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "Not affected\n");
+}
+
+static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
+static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
+static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
+
+static struct attribute *cpu_root_vulnerabilities_attrs[] = {
+        &dev_attr_meltdown.attr,
+        &dev_attr_spectre_v1.attr,
+        &dev_attr_spectre_v2.attr,
+        NULL
+};
+
+static const struct attribute_group cpu_root_vulnerabilities_group = {
+        .name  = "vulnerabilities",
+        .attrs = cpu_root_vulnerabilities_attrs,
+};
+
+static void __init cpu_register_vulnerabilities(void)
+{
+        if (sysfs_create_group(&cpu_subsys.dev_root->kobj,
+                               &cpu_root_vulnerabilities_group))
+                pr_err("Unable to register CPU vulnerabilities\n");
+}
+
+#else
+static inline void cpu_register_vulnerabilities(void) { }
+#endif
+
 void __init cpu_dev_init(void)
 {
         if (subsys_system_register(&cpu_subsys, cpu_root_attr_groups))
                 panic("Failed to register CPU subsystem");
 
         cpu_dev_register_generic();
+        cpu_register_vulnerabilities();
 }
diff --git a/drivers/base/isa.c b/drivers/base/isa.c
index cd6ccdcf9df0..372d10af2600 100644
--- a/drivers/base/isa.c
+++ b/drivers/base/isa.c
@@ -39,7 +39,7 @@ static int isa_bus_probe(struct device *dev)
 {
         struct isa_driver *isa_driver = dev->platform_data;
 
-        if (isa_driver->probe)
+        if (isa_driver && isa_driver->probe)
                 return isa_driver->probe(dev, to_isa_dev(dev)->id);
 
         return 0;
@@ -49,7 +49,7 @@ static int isa_bus_remove(struct device *dev)
 {
         struct isa_driver *isa_driver = dev->platform_data;
 
-        if (isa_driver->remove)
+        if (isa_driver && isa_driver->remove)
                 return isa_driver->remove(dev, to_isa_dev(dev)->id);
 
         return 0;
@@ -59,7 +59,7 @@ static void isa_bus_shutdown(struct device *dev)
 {
         struct isa_driver *isa_driver = dev->platform_data;
 
-        if (isa_driver->shutdown)
+        if (isa_driver && isa_driver->shutdown)
                 isa_driver->shutdown(dev, to_isa_dev(dev)->id);
 }
 
@@ -67,7 +67,7 @@ static int isa_bus_suspend(struct device *dev, pm_message_t state)
 {
         struct isa_driver *isa_driver = dev->platform_data;
 
-        if (isa_driver->suspend)
+        if (isa_driver && isa_driver->suspend)
                 return isa_driver->suspend(dev, to_isa_dev(dev)->id, state);
 
         return 0;
@@ -77,7 +77,7 @@ static int isa_bus_resume(struct device *dev)
 {
         struct isa_driver *isa_driver = dev->platform_data;
 
-        if (isa_driver->resume)
+        if (isa_driver && isa_driver->resume)
                 return isa_driver->resume(dev, to_isa_dev(dev)->id);
 
         return 0;
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index db2f04415927..08744b572af6 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -526,6 +526,21 @@ static void dpm_watchdog_clear(struct dpm_watchdog *wd)
 /*------------------------- Resume routines -------------------------*/
 
 /**
+ * dev_pm_skip_next_resume_phases - Skip next system resume phases for device.
+ * @dev: Target device.
+ *
+ * Make the core skip the "early resume" and "resume" phases for @dev.
+ *
+ * This function can be called by middle-layer code during the "noirq" phase of
+ * system resume if necessary, but not by device drivers.
+ */
+void dev_pm_skip_next_resume_phases(struct device *dev)
+{
+        dev->power.is_late_suspended = false;
+        dev->power.is_suspended = false;
+}
+
+/**
  * device_resume_noirq - Execute a "noirq resume" callback for given device.
  * @dev: Device to handle.
  * @state: PM transition of the system being carried out.
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 027d159ac381..6e89b51ea3d9 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -276,7 +276,8 @@ static int rpm_get_suppliers(struct device *dev)
                         continue;
 
                 retval = pm_runtime_get_sync(link->supplier);
-                if (retval < 0) {
+                /* Ignore suppliers with disabled runtime PM. */
+                if (retval < 0 && retval != -EACCES) {
                         pm_runtime_put_noidle(link->supplier);
                         return retval;
                 }
diff --git a/drivers/bcma/Kconfig b/drivers/bcma/Kconfig
index 02d78f6cecbb..ba8acca036df 100644
--- a/drivers/bcma/Kconfig
+++ b/drivers/bcma/Kconfig
@@ -55,7 +55,7 @@ config BCMA_DRIVER_PCI
 
 config BCMA_DRIVER_PCI_HOSTMODE
         bool "Driver for PCI core working in hostmode"
-        depends on MIPS && BCMA_DRIVER_PCI
+        depends on MIPS && BCMA_DRIVER_PCI && PCI_DRIVERS_LEGACY
         help
           PCI core hostmode operation (external PCI bus).
 
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index bc8e61506968..d5fe720cf149 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1581,9 +1581,8 @@ out:
         return err;
 }
 
-static void lo_release(struct gendisk *disk, fmode_t mode)
+static void __lo_release(struct loop_device *lo)
 {
-        struct loop_device *lo = disk->private_data;
         int err;
 
         if (atomic_dec_return(&lo->lo_refcnt))
@@ -1610,6 +1609,13 @@ static void lo_release(struct gendisk *disk, fmode_t mode)
         mutex_unlock(&lo->lo_ctl_mutex);
 }
 
+static void lo_release(struct gendisk *disk, fmode_t mode)
+{
+        mutex_lock(&loop_index_mutex);
+        __lo_release(disk->private_data);
+        mutex_unlock(&loop_index_mutex);
+}
+
 static const struct block_device_operations lo_fops = {
         .owner =        THIS_MODULE,
         .open =         lo_open,
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index ccb9975a97fa..ad0477ae820f 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -35,13 +35,13 @@ static inline u64 mb_per_tick(int mbps)
 struct nullb_cmd {
         struct list_head list;
         struct llist_node ll_list;
-        call_single_data_t csd;
+        struct __call_single_data csd;
         struct request *rq;
         struct bio *bio;
         unsigned int tag;
+        blk_status_t error;
         struct nullb_queue *nq;
         struct hrtimer timer;
-        blk_status_t error;
 };
 
 struct nullb_queue {
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 38fc5f397fde..cc93522a6d41 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -3047,13 +3047,21 @@ static void format_lock_cookie(struct rbd_device *rbd_dev, char *buf)
         mutex_unlock(&rbd_dev->watch_mutex);
 }
 
+static void __rbd_lock(struct rbd_device *rbd_dev, const char *cookie)
+{
+        struct rbd_client_id cid = rbd_get_cid(rbd_dev);
+
+        strcpy(rbd_dev->lock_cookie, cookie);
+        rbd_set_owner_cid(rbd_dev, &cid);
+        queue_work(rbd_dev->task_wq, &rbd_dev->acquired_lock_work);
+}
+
 /*
  * lock_rwsem must be held for write
  */
 static int rbd_lock(struct rbd_device *rbd_dev)
 {
         struct ceph_osd_client *osdc = &rbd_dev->rbd_client->client->osdc;
-        struct rbd_client_id cid = rbd_get_cid(rbd_dev);
         char cookie[32];
         int ret;
 
@@ -3068,9 +3076,7 @@ static int rbd_lock(struct rbd_device *rbd_dev)
                 return ret;
 
         rbd_dev->lock_state = RBD_LOCK_STATE_LOCKED;
-        strcpy(rbd_dev->lock_cookie, cookie);
-        rbd_set_owner_cid(rbd_dev, &cid);
-        queue_work(rbd_dev->task_wq, &rbd_dev->acquired_lock_work);
+        __rbd_lock(rbd_dev, cookie);
         return 0;
 }
 
@@ -3856,7 +3862,7 @@ static void rbd_reacquire_lock(struct rbd_device *rbd_dev)
                         queue_delayed_work(rbd_dev->task_wq,
                                            &rbd_dev->lock_dwork, 0);
         } else {
-                strcpy(rbd_dev->lock_cookie, cookie);
+                __rbd_lock(rbd_dev, cookie);
         }
 }
 
@@ -4381,7 +4387,7 @@ static int rbd_init_disk(struct rbd_device *rbd_dev)
         segment_size = rbd_obj_bytes(&rbd_dev->header);
         blk_queue_max_hw_sectors(q, segment_size / SECTOR_SIZE);
         q->limits.max_sectors = queue_max_hw_sectors(q);
-        blk_queue_max_segments(q, segment_size / SECTOR_SIZE);
+        blk_queue_max_segments(q, USHRT_MAX);
         blk_queue_max_segment_size(q, segment_size);
         blk_queue_io_min(q, segment_size);
         blk_queue_io_opt(q, segment_size);
diff --git a/drivers/bus/arm-cci.c b/drivers/bus/arm-cci.c
index 3c29d36702a8..5426c04fe24b 100644
--- a/drivers/bus/arm-cci.c
+++ b/drivers/bus/arm-cci.c
@@ -1755,14 +1755,17 @@ static int cci_pmu_probe(struct platform_device *pdev)
         raw_spin_lock_init(&cci_pmu->hw_events.pmu_lock);
         mutex_init(&cci_pmu->reserve_mutex);
         atomic_set(&cci_pmu->active_events, 0);
-        cpumask_set_cpu(smp_processor_id(), &cci_pmu->cpus);
+        cpumask_set_cpu(get_cpu(), &cci_pmu->cpus);
 
         ret = cci_pmu_init(cci_pmu, pdev);
-        if (ret)
+        if (ret) {
+                put_cpu();
                 return ret;
+        }
 
         cpuhp_state_add_instance_nocalls(CPUHP_AP_PERF_ARM_CCI_ONLINE,
                                          &cci_pmu->node);
+        put_cpu();
         pr_info("ARM %s PMU driver probed", cci_pmu->model->name);
         return 0;
 }
diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
index 3063f5312397..b52332e52ca5 100644
--- a/drivers/bus/arm-ccn.c
+++ b/drivers/bus/arm-ccn.c
@@ -262,7 +262,7 @@ static struct attribute *arm_ccn_pmu_format_attrs[] = {
         NULL
 };
 
-static struct attribute_group arm_ccn_pmu_format_attr_group = {
+static const struct attribute_group arm_ccn_pmu_format_attr_group = {
         .name = "format",
         .attrs = arm_ccn_pmu_format_attrs,
 };
@@ -451,7 +451,7 @@ static struct arm_ccn_pmu_event arm_ccn_pmu_events[] = {
 static struct attribute
                 *arm_ccn_pmu_events_attrs[ARRAY_SIZE(arm_ccn_pmu_events) + 1];
 
-static struct attribute_group arm_ccn_pmu_events_attr_group = {
+static const struct attribute_group arm_ccn_pmu_events_attr_group = {
         .name = "events",
         .is_visible = arm_ccn_pmu_events_is_visible,
         .attrs = arm_ccn_pmu_events_attrs,
@@ -548,7 +548,7 @@ static struct attribute *arm_ccn_pmu_cmp_mask_attrs[] = {
         NULL
 };
 
-static struct attribute_group arm_ccn_pmu_cmp_mask_attr_group = {
+static const struct attribute_group arm_ccn_pmu_cmp_mask_attr_group = {
         .name = "cmp_mask",
         .attrs = arm_ccn_pmu_cmp_mask_attrs,
 };
@@ -569,7 +569,7 @@ static struct attribute *arm_ccn_pmu_cpumask_attrs[] = {
         NULL,
 };
 
-static struct attribute_group arm_ccn_pmu_cpumask_attr_group = {
+static const struct attribute_group arm_ccn_pmu_cpumask_attr_group = {
         .attrs = arm_ccn_pmu_cpumask_attrs,
 };
 
@@ -1268,10 +1268,12 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn)
         if (ccn->dt.id == 0) {
                 name = "ccn";
         } else {
-                int len = snprintf(NULL, 0, "ccn_%d", ccn->dt.id);
-
-                name = devm_kzalloc(ccn->dev, len + 1, GFP_KERNEL);
-                snprintf(name, len + 1, "ccn_%d", ccn->dt.id);
+                name = devm_kasprintf(ccn->dev, GFP_KERNEL, "ccn_%d",
+                                      ccn->dt.id);
+                if (!name) {
+                        err = -ENOMEM;
+                        goto error_choose_name;
+                }
         }
 
         /* Perf driver registration */
@@ -1298,7 +1300,7 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn)
         }
 
         /* Pick one CPU which we will use to collect data from CCN... */
-        cpumask_set_cpu(smp_processor_id(), &ccn->dt.cpu);
+        cpumask_set_cpu(get_cpu(), &ccn->dt.cpu);
 
         /* Also make sure that the overflow interrupt is handled by this CPU */
         if (ccn->irq) {
@@ -1315,10 +1317,13 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn)
 
         cpuhp_state_add_instance_nocalls(CPUHP_AP_PERF_ARM_CCN_ONLINE,
                                          &ccn->dt.node);
+        put_cpu();
         return 0;
 
 error_pmu_register:
 error_set_affinity:
+        put_cpu();
+error_choose_name:
         ida_simple_remove(&arm_ccn_pmu_ida, ccn->dt.id);
         for (i = 0; i < ccn->num_xps; i++)
                 writel(0, ccn->xp[i].base + CCN_XP_DT_CONTROL);
@@ -1581,8 +1586,8 @@ static int __init arm_ccn_init(void)
 
 static void __exit arm_ccn_exit(void)
 {
-        cpuhp_remove_multi_state(CPUHP_AP_PERF_ARM_CCN_ONLINE);
         platform_driver_unregister(&arm_ccn_driver);
+        cpuhp_remove_multi_state(CPUHP_AP_PERF_ARM_CCN_ONLINE);
 }
 
 module_init(arm_ccn_init);
diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c
index 328ca93781cf..1b76d9585902 100644
--- a/drivers/bus/sunxi-rsb.c
+++ b/drivers/bus/sunxi-rsb.c
@@ -178,6 +178,7 @@ static struct bus_type sunxi_rsb_bus = {
         .match          = sunxi_rsb_device_match,
         .probe          = sunxi_rsb_device_probe,
         .remove         = sunxi_rsb_device_remove,
+        .uevent         = of_device_uevent_modalias,
 };
 
 static void sunxi_rsb_dev_release(struct device *dev)
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 779869ed32b1..71fad747c0c7 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -199,6 +199,9 @@ struct smi_info {
         /* The timer for this si. */
         struct timer_list   si_timer;
 
+        /* This flag is set, if the timer can be set */
+        bool                timer_can_start;
+
         /* This flag is set, if the timer is running (timer_pending() isn't enough) */
         bool                timer_running;
 
@@ -355,6 +358,8 @@ out:
 
 static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
 {
+        if (!smi_info->timer_can_start)
+                return;
         smi_info->last_timeout_jiffies = jiffies;
         mod_timer(&smi_info->si_timer, new_val);
         smi_info->timer_running = true;
@@ -374,21 +379,18 @@ static void start_new_msg(struct smi_info *smi_info, unsigned char *msg,
         smi_info->handlers->start_transaction(smi_info->si_sm, msg, size);
 }
 
-static void start_check_enables(struct smi_info *smi_info, bool start_timer)
+static void start_check_enables(struct smi_info *smi_info)
 {
         unsigned char msg[2];
 
         msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
         msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
 
-        if (start_timer)
-                start_new_msg(smi_info, msg, 2);
-        else
-                smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
+        start_new_msg(smi_info, msg, 2);
         smi_info->si_state = SI_CHECKING_ENABLES;
 }
 
-static void start_clear_flags(struct smi_info *smi_info, bool start_timer)
+static void start_clear_flags(struct smi_info *smi_info)
 {
         unsigned char msg[3];
 
@@ -397,10 +399,7 @@ static void start_clear_flags(struct smi_info *smi_info, bool start_timer)
         msg[1] = IPMI_CLEAR_MSG_FLAGS_CMD;
         msg[2] = WDT_PRE_TIMEOUT_INT;
 
-        if (start_timer)
-                start_new_msg(smi_info, msg, 3);
-        else
-                smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
+        start_new_msg(smi_info, msg, 3);
         smi_info->si_state = SI_CLEARING_FLAGS;
 }
 
@@ -435,11 +434,11 @@ static void start_getting_events(struct smi_info *smi_info)
  * Note that we cannot just use disable_irq(), since the interrupt may
  * be shared.
  */
-static inline bool disable_si_irq(struct smi_info *smi_info, bool start_timer)
+static inline bool disable_si_irq(struct smi_info *smi_info)
 {
         if ((smi_info->io.irq) && (!smi_info->interrupt_disabled)) {
                 smi_info->interrupt_disabled = true;
-                start_check_enables(smi_info, start_timer);
+                start_check_enables(smi_info);
                 return true;
         }
         return false;
@@ -449,7 +448,7 @@ static inline bool enable_si_irq(struct smi_info *smi_info)
 {
         if ((smi_info->io.irq) && (smi_info->interrupt_disabled)) {
                 smi_info->interrupt_disabled = false;
-                start_check_enables(smi_info, true);
+                start_check_enables(smi_info);
                 return true;
         }
         return false;
@@ -467,7 +466,7 @@ static struct ipmi_smi_msg *alloc_msg_handle_irq(struct smi_info *smi_info)
 
         msg = ipmi_alloc_smi_msg();
         if (!msg) {
-                if (!disable_si_irq(smi_info, true))
+                if (!disable_si_irq(smi_info))
                         smi_info->si_state = SI_NORMAL;
         } else if (enable_si_irq(smi_info)) {
                 ipmi_free_smi_msg(msg);
@@ -483,7 +482,7 @@ retry:
                 /* Watchdog pre-timeout */
                 smi_inc_stat(smi_info, watchdog_pretimeouts);
 
-                start_clear_flags(smi_info, true);
+                start_clear_flags(smi_info);
                 smi_info->msg_flags &= ~WDT_PRE_TIMEOUT_INT;
                 if (smi_info->intf)
                         ipmi_smi_watchdog_pretimeout(smi_info->intf);
@@ -866,7 +865,7 @@ restart:
                  * disable and messages disabled.
                  */
                 if (smi_info->supports_event_msg_buff || smi_info->io.irq) {
-                        start_check_enables(smi_info, true);
+                        start_check_enables(smi_info);
                 } else {
                         smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
                         if (!smi_info->curr_msg)
@@ -1167,6 +1166,7 @@ static int smi_start_processing(void       *send_info,
 
         /* Set up the timer that drives the interface. */
         timer_setup(&new_smi->si_timer, smi_timeout, 0);
+        new_smi->timer_can_start = true;
         smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
 
         /* Try to claim any interrupts. */
@@ -1936,10 +1936,12 @@ static void check_for_broken_irqs(struct smi_info *smi_info)
         check_set_rcv_irq(smi_info);
 }
 
-static inline void wait_for_timer_and_thread(struct smi_info *smi_info)
+static inline void stop_timer_and_thread(struct smi_info *smi_info)
 {
         if (smi_info->thread != NULL)
                 kthread_stop(smi_info->thread);
+
+        smi_info->timer_can_start = false;
         if (smi_info->timer_running)
                 del_timer_sync(&smi_info->si_timer);
 }
@@ -2152,7 +2154,7 @@ static int try_smi_init(struct smi_info *new_smi)
          * Start clearing the flags before we enable interrupts or the
          * timer to avoid racing with the timer.
          */
-        start_clear_flags(new_smi, false);
+        start_clear_flags(new_smi);
 
         /*
          * IRQ is defined to be set when non-zero.  req_events will
@@ -2238,7 +2240,7 @@ out_err_remove_attrs:
         dev_set_drvdata(new_smi->io.dev, NULL);
 
 out_err_stop_timer:
-        wait_for_timer_and_thread(new_smi);
+        stop_timer_and_thread(new_smi);
 
 out_err:
         new_smi->interrupt_disabled = true;
@@ -2388,7 +2390,7 @@ static void cleanup_one_si(struct smi_info *to_clean)
          */
         if (to_clean->io.irq_cleanup)
                 to_clean->io.irq_cleanup(&to_clean->io);
-        wait_for_timer_and_thread(to_clean);
+        stop_timer_and_thread(to_clean);
 
         /*
          * Timeouts are stopped, now make sure the interrupts are off
@@ -2400,7 +2402,7 @@ static void cleanup_one_si(struct smi_info *to_clean)
                 schedule_timeout_uninterruptible(1);
         }
         if (to_clean->handlers)
-                disable_si_irq(to_clean, false);
+                disable_si_irq(to_clean);
         while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) {
                 poll(to_clean);
                 schedule_timeout_uninterruptible(1);
diff --git a/drivers/char/ipmi/ipmi_si_parisc.c b/drivers/char/ipmi/ipmi_si_parisc.c
index 090b073ab441..6b10f0e18a95 100644
--- a/drivers/char/ipmi/ipmi_si_parisc.c
+++ b/drivers/char/ipmi/ipmi_si_parisc.c
@@ -10,6 +10,8 @@ static int __init ipmi_parisc_probe(struct parisc_device *dev)
 {
         struct si_sm_io io;
 
+        memset(&io, 0, sizeof(io));
+
         io.si_type      = SI_KCS;
         io.addr_source  = SI_DEVICETREE;
         io.addr_type    = IPMI_MEM_ADDR_SPACE;
diff --git a/drivers/char/ipmi/ipmi_si_pci.c b/drivers/char/ipmi/ipmi_si_pci.c
index 99771f5cad07..27dd11c49d21 100644
--- a/drivers/char/ipmi/ipmi_si_pci.c
+++ b/drivers/char/ipmi/ipmi_si_pci.c
@@ -103,10 +103,13 @@ static int ipmi_pci_probe(struct pci_dev *pdev,
         io.addr_source_cleanup = ipmi_pci_cleanup;
         io.addr_source_data = pdev;
 
-        if (pci_resource_flags(pdev, 0) & IORESOURCE_IO)
+        if (pci_resource_flags(pdev, 0) & IORESOURCE_IO) {
                 io.addr_type = IPMI_IO_ADDR_SPACE;
-        else
+                io.io_setup = ipmi_si_port_setup;
+        } else {
                 io.addr_type = IPMI_MEM_ADDR_SPACE;
+                io.io_setup = ipmi_si_mem_setup;
+        }
         io.addr_data = pci_resource_start(pdev, 0);
 
         io.regspacing = ipmi_pci_probe_regspacing(&io);
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 647d056df88c..b56c11f51baf 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -220,7 +220,8 @@ static bool clk_core_is_enabled(struct clk_core *core)
 
         ret = core->ops->is_enabled(core->hw);
 done:
-        clk_pm_runtime_put(core);
+        if (core->dev)
+                pm_runtime_put(core->dev);
 
         return ret;
 }
@@ -1564,6 +1565,9 @@ static void clk_change_rate(struct clk_core *core)
                 best_parent_rate = core->parent->rate;
         }
 
+        if (clk_pm_runtime_get(core))
+                return;
+
         if (core->flags & CLK_SET_RATE_UNGATE) {
                 unsigned long flags;
 
@@ -1634,6 +1638,8 @@ static void clk_change_rate(struct clk_core *core)
         /* handle the new child who might not be in core->children yet */
         if (core->new_child)
                 clk_change_rate(core->new_child);
+
+        clk_pm_runtime_put(core);
 }
 
 static int clk_core_set_rate_nolock(struct clk_core *core,
diff --git a/drivers/clk/sunxi/clk-sun9i-mmc.c b/drivers/clk/sunxi/clk-sun9i-mmc.c
index a1a634253d6f..f00d8758ba24 100644
--- a/drivers/clk/sunxi/clk-sun9i-mmc.c
+++ b/drivers/clk/sunxi/clk-sun9i-mmc.c
@@ -16,6 +16,7 @@
 
 #include <linux/clk.h>
 #include <linux/clk-provider.h>
+#include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
@@ -83,9 +84,20 @@ static int sun9i_mmc_reset_deassert(struct reset_controller_dev *rcdev,
         return 0;
 }
 
+static int sun9i_mmc_reset_reset(struct reset_controller_dev *rcdev,
+                                 unsigned long id)
+{
+        sun9i_mmc_reset_assert(rcdev, id);
+        udelay(10);
+        sun9i_mmc_reset_deassert(rcdev, id);
+
+        return 0;
+}
+
 static const struct reset_control_ops sun9i_mmc_reset_ops = {
         .assert         = sun9i_mmc_reset_assert,
         .deassert       = sun9i_mmc_reset_deassert,
+        .reset          = sun9i_mmc_reset_reset,
 };
 
 static int sun9i_a80_mmc_config_clk_probe(struct platform_device *pdev)
diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
index 58d4f4e1ad6a..ca38229b045a 100644
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -22,6 +22,8 @@
 
 #include "cpufreq_governor.h"
 
+#define CPUFREQ_DBS_MIN_SAMPLING_INTERVAL       (2 * TICK_NSEC / NSEC_PER_USEC)
+
 static DEFINE_PER_CPU(struct cpu_dbs_info, cpu_dbs);
 
 static DEFINE_MUTEX(gov_dbs_data_mutex);
@@ -47,11 +49,15 @@ ssize_t store_sampling_rate(struct gov_attr_set *attr_set, const char *buf,
 {
         struct dbs_data *dbs_data = to_dbs_data(attr_set);
         struct policy_dbs_info *policy_dbs;
+        unsigned int sampling_interval;
         int ret;
-        ret = sscanf(buf, "%u", &dbs_data->sampling_rate);
-        if (ret != 1)
+
+        ret = sscanf(buf, "%u", &sampling_interval);
+        if (ret != 1 || sampling_interval < CPUFREQ_DBS_MIN_SAMPLING_INTERVAL)
                 return -EINVAL;
 
+        dbs_data->sampling_rate = sampling_interval;
+
         /*
          * We are operating under dbs_data->mutex and so the list and its
          * entries can't be freed concurrently.
@@ -430,7 +436,14 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy)
         if (ret)
                 goto free_policy_dbs_info;
 
-        dbs_data->sampling_rate = cpufreq_policy_transition_delay_us(policy);
+        /*
+         * The sampling interval should not be less than the transition latency
+         * of the CPU and it also cannot be too small for dbs_update() to work
+         * correctly.
+         */
+        dbs_data->sampling_rate = max_t(unsigned int,
+                                        CPUFREQ_DBS_MIN_SAMPLING_INTERVAL,
+                                        cpufreq_policy_transition_delay_us(policy));
 
         if (!have_governor_per_policy())
                 gov->gdbs_data = dbs_data;
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index 628fe899cb48..d9b2c2de49c4 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -226,17 +226,18 @@ static void imx6q_opp_check_speed_grading(struct device *dev)
         val >>= OCOTP_CFG3_SPEED_SHIFT;
         val &= 0x3;
 
-        if ((val != OCOTP_CFG3_SPEED_1P2GHZ) &&
-             of_machine_is_compatible("fsl,imx6q"))
-                if (dev_pm_opp_disable(dev, 1200000000))
-                        dev_warn(dev, "failed to disable 1.2GHz OPP\n");
         if (val < OCOTP_CFG3_SPEED_996MHZ)
                 if (dev_pm_opp_disable(dev, 996000000))
                         dev_warn(dev, "failed to disable 996MHz OPP\n");
-        if (of_machine_is_compatible("fsl,imx6q")) {
+
+        if (of_machine_is_compatible("fsl,imx6q") ||
+            of_machine_is_compatible("fsl,imx6qp")) {
                 if (val != OCOTP_CFG3_SPEED_852MHZ)
                         if (dev_pm_opp_disable(dev, 852000000))
                                 dev_warn(dev, "failed to disable 852MHz OPP\n");
+                if (val != OCOTP_CFG3_SPEED_1P2GHZ)
+                        if (dev_pm_opp_disable(dev, 1200000000))
+                                dev_warn(dev, "failed to disable 1.2GHz OPP\n");
         }
         iounmap(base);
 put_node:
diff --git a/drivers/crypto/chelsio/Kconfig b/drivers/crypto/chelsio/Kconfig
index 3e104f5aa0c2..b56b3f711d94 100644
--- a/drivers/crypto/chelsio/Kconfig
+++ b/drivers/crypto/chelsio/Kconfig
@@ -5,6 +5,7 @@ config CRYPTO_DEV_CHELSIO
         select CRYPTO_SHA256
         select CRYPTO_SHA512
         select CRYPTO_AUTHENC
+        select CRYPTO_GF128MUL
         ---help---
           The Chelsio Crypto Co-processor driver for T6 adapters.
 
diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c
index 89ba9e85c0f3..4bcef78a08aa 100644
--- a/drivers/crypto/inside-secure/safexcel.c
+++ b/drivers/crypto/inside-secure/safexcel.c
@@ -607,6 +607,7 @@ static inline void safexcel_handle_result_descriptor(struct safexcel_crypto_priv
                 ndesc = ctx->handle_result(priv, ring, sreq->req,
                                            &should_complete, &ret);
                 if (ndesc < 0) {
+                        kfree(sreq);
                         dev_err(priv->dev, "failed to handle result (%d)", ndesc);
                         return;
                 }
diff --git a/drivers/crypto/inside-secure/safexcel_cipher.c b/drivers/crypto/inside-secure/safexcel_cipher.c
index 5438552bc6d7..fcc0a606d748 100644
--- a/drivers/crypto/inside-secure/safexcel_cipher.c
+++ b/drivers/crypto/inside-secure/safexcel_cipher.c
@@ -14,6 +14,7 @@
 
 #include <crypto/aes.h>
 #include <crypto/skcipher.h>
+#include <crypto/internal/skcipher.h>
 
 #include "safexcel.h"
 
@@ -33,6 +34,10 @@ struct safexcel_cipher_ctx {
         unsigned int key_len;
 };
 
+struct safexcel_cipher_req {
+        bool needs_inv;
+};
+
 static void safexcel_cipher_token(struct safexcel_cipher_ctx *ctx,
                                   struct crypto_async_request *async,
                                   struct safexcel_command_desc *cdesc,
@@ -126,9 +131,9 @@ static int safexcel_context_control(struct safexcel_cipher_ctx *ctx,
         return 0;
 }
 
-static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring,
-                                  struct crypto_async_request *async,
-                                  bool *should_complete, int *ret)
+static int safexcel_handle_req_result(struct safexcel_crypto_priv *priv, int ring,
+                                      struct crypto_async_request *async,
+                                      bool *should_complete, int *ret)
 {
         struct skcipher_request *req = skcipher_request_cast(async);
         struct safexcel_result_desc *rdesc;
@@ -265,7 +270,6 @@ static int safexcel_aes_send(struct crypto_async_request *async,
         spin_unlock_bh(&priv->ring[ring].egress_lock);
 
         request->req = &req->base;
-        ctx->base.handle_result = safexcel_handle_result;
 
         *commands = n_cdesc;
         *results = n_rdesc;
@@ -341,8 +345,6 @@ static int safexcel_handle_inv_result(struct safexcel_crypto_priv *priv,
 
         ring = safexcel_select_ring(priv);
         ctx->base.ring = ring;
-        ctx->base.needs_inv = false;
-        ctx->base.send = safexcel_aes_send;
 
         spin_lock_bh(&priv->ring[ring].queue_lock);
         enq_ret = crypto_enqueue_request(&priv->ring[ring].queue, async);
@@ -359,6 +361,26 @@ static int safexcel_handle_inv_result(struct safexcel_crypto_priv *priv,
         return ndesc;
 }
 
+static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring,
+                                  struct crypto_async_request *async,
+                                  bool *should_complete, int *ret)
+{
+        struct skcipher_request *req = skcipher_request_cast(async);
+        struct safexcel_cipher_req *sreq = skcipher_request_ctx(req);
+        int err;
+
+        if (sreq->needs_inv) {
+                sreq->needs_inv = false;
+                err = safexcel_handle_inv_result(priv, ring, async,
+                                                 should_complete, ret);
+        } else {
+                err = safexcel_handle_req_result(priv, ring, async,
+                                                 should_complete, ret);
+        }
+
+        return err;
+}
+
 static int safexcel_cipher_send_inv(struct crypto_async_request *async,
                                     int ring, struct safexcel_request *request,
                                     int *commands, int *results)
@@ -368,8 +390,6 @@ static int safexcel_cipher_send_inv(struct crypto_async_request *async,
         struct safexcel_crypto_priv *priv = ctx->priv;
         int ret;
 
-        ctx->base.handle_result = safexcel_handle_inv_result;
-
         ret = safexcel_invalidate_cache(async, &ctx->base, priv,
                                         ctx->base.ctxr_dma, ring, request);
         if (unlikely(ret))
@@ -381,28 +401,46 @@ static int safexcel_cipher_send_inv(struct crypto_async_request *async,
         return 0;
 }
 
+static int safexcel_send(struct crypto_async_request *async,
+                         int ring, struct safexcel_request *request,
+                         int *commands, int *results)
+{
+        struct skcipher_request *req = skcipher_request_cast(async);
+        struct safexcel_cipher_req *sreq = skcipher_request_ctx(req);
+        int ret;
+
+        if (sreq->needs_inv)
+                ret = safexcel_cipher_send_inv(async, ring, request,
+                                               commands, results);
+        else
+                ret = safexcel_aes_send(async, ring, request,
+                                        commands, results);
+        return ret;
+}
+
 static int safexcel_cipher_exit_inv(struct crypto_tfm *tfm)
 {
         struct safexcel_cipher_ctx *ctx = crypto_tfm_ctx(tfm);
         struct safexcel_crypto_priv *priv = ctx->priv;
-        struct skcipher_request req;
+        SKCIPHER_REQUEST_ON_STACK(req, __crypto_skcipher_cast(tfm));
+        struct safexcel_cipher_req *sreq = skcipher_request_ctx(req);
         struct safexcel_inv_result result = {};
         int ring = ctx->base.ring;
 
-        memset(&req, 0, sizeof(struct skcipher_request));
+        memset(req, 0, sizeof(struct skcipher_request));
 
         /* create invalidation request */
         init_completion(&result.completion);
-        skcipher_request_set_callback(&req, CRYPTO_TFM_REQ_MAY_BACKLOG,
-                                        safexcel_inv_complete, &result);
+        skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+                                      safexcel_inv_complete, &result);
 
-        skcipher_request_set_tfm(&req, __crypto_skcipher_cast(tfm));
-        ctx = crypto_tfm_ctx(req.base.tfm);
+        skcipher_request_set_tfm(req, __crypto_skcipher_cast(tfm));
+        ctx = crypto_tfm_ctx(req->base.tfm);
         ctx->base.exit_inv = true;
-        ctx->base.send = safexcel_cipher_send_inv;
+        sreq->needs_inv = true;
 
         spin_lock_bh(&priv->ring[ring].queue_lock);
-        crypto_enqueue_request(&priv->ring[ring].queue, &req.base);
+        crypto_enqueue_request(&priv->ring[ring].queue, &req->base);
         spin_unlock_bh(&priv->ring[ring].queue_lock);
 
         if (!priv->ring[ring].need_dequeue)
@@ -424,19 +462,21 @@ static int safexcel_aes(struct skcipher_request *req,
                         enum safexcel_cipher_direction dir, u32 mode)
 {
         struct safexcel_cipher_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
+        struct safexcel_cipher_req *sreq = skcipher_request_ctx(req);
         struct safexcel_crypto_priv *priv = ctx->priv;
         int ret, ring;
 
+        sreq->needs_inv = false;
         ctx->direction = dir;
         ctx->mode = mode;
 
         if (ctx->base.ctxr) {
-                if (ctx->base.needs_inv)
-                        ctx->base.send = safexcel_cipher_send_inv;
+                if (ctx->base.needs_inv) {
+                        sreq->needs_inv = true;
+                        ctx->base.needs_inv = false;
+                }
         } else {
                 ctx->base.ring = safexcel_select_ring(priv);
-                ctx->base.send = safexcel_aes_send;
-
                 ctx->base.ctxr = dma_pool_zalloc(priv->context_pool,
                                                  EIP197_GFP_FLAGS(req->base),
                                                  &ctx->base.ctxr_dma);
@@ -476,6 +516,11 @@ static int safexcel_skcipher_cra_init(struct crypto_tfm *tfm)
                              alg.skcipher.base);
 
         ctx->priv = tmpl->priv;
+        ctx->base.send = safexcel_send;
+        ctx->base.handle_result = safexcel_handle_result;
+
+        crypto_skcipher_set_reqsize(__crypto_skcipher_cast(tfm),
+                                    sizeof(struct safexcel_cipher_req));
 
         return 0;
 }
diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c
index 74feb6227101..0c5a5820b06e 100644
--- a/drivers/crypto/inside-secure/safexcel_hash.c
+++ b/drivers/crypto/inside-secure/safexcel_hash.c
@@ -32,9 +32,10 @@ struct safexcel_ahash_req {
         bool last_req;
         bool finish;
         bool hmac;
+        bool needs_inv;
 
         u8 state_sz;    /* expected sate size, only set once */
-        u32 state[SHA256_DIGEST_SIZE / sizeof(u32)];
+        u32 state[SHA256_DIGEST_SIZE / sizeof(u32)] __aligned(sizeof(u32));
 
         u64 len;
         u64 processed;
@@ -119,15 +120,15 @@ static void safexcel_context_control(struct safexcel_ahash_ctx *ctx,
         }
 }
 
-static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring,
-                                  struct crypto_async_request *async,
-                                  bool *should_complete, int *ret)
+static int safexcel_handle_req_result(struct safexcel_crypto_priv *priv, int ring,
+                                      struct crypto_async_request *async,
+                                      bool *should_complete, int *ret)
 {
         struct safexcel_result_desc *rdesc;
         struct ahash_request *areq = ahash_request_cast(async);
         struct crypto_ahash *ahash = crypto_ahash_reqtfm(areq);
         struct safexcel_ahash_req *sreq = ahash_request_ctx(areq);
-        int cache_len, result_sz = sreq->state_sz;
+        int cache_len;
 
         *ret = 0;
 
@@ -148,8 +149,8 @@ static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring,
         spin_unlock_bh(&priv->ring[ring].egress_lock);
 
         if (sreq->finish)
-                result_sz = crypto_ahash_digestsize(ahash);
-        memcpy(sreq->state, areq->result, result_sz);
+                memcpy(areq->result, sreq->state,
+                       crypto_ahash_digestsize(ahash));
 
         dma_unmap_sg(priv->dev, areq->src,
                      sg_nents_for_len(areq->src, areq->nbytes), DMA_TO_DEVICE);
@@ -165,9 +166,9 @@ static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring,
         return 1;
 }
 
-static int safexcel_ahash_send(struct crypto_async_request *async, int ring,
-                               struct safexcel_request *request, int *commands,
-                               int *results)
+static int safexcel_ahash_send_req(struct crypto_async_request *async, int ring,
+                                   struct safexcel_request *request,
+                                   int *commands, int *results)
 {
         struct ahash_request *areq = ahash_request_cast(async);
         struct crypto_ahash *ahash = crypto_ahash_reqtfm(areq);
@@ -273,7 +274,7 @@ send_command:
         /* Add the token */
         safexcel_hash_token(first_cdesc, len, req->state_sz);
 
-        ctx->base.result_dma = dma_map_single(priv->dev, areq->result,
+        ctx->base.result_dma = dma_map_single(priv->dev, req->state,
                                               req->state_sz, DMA_FROM_DEVICE);
         if (dma_mapping_error(priv->dev, ctx->base.result_dma)) {
                 ret = -EINVAL;
@@ -292,7 +293,6 @@ send_command:
 
         req->processed += len;
         request->req = &areq->base;
-        ctx->base.handle_result = safexcel_handle_result;
 
         *commands = n_cdesc;
         *results = 1;
@@ -374,8 +374,6 @@ static int safexcel_handle_inv_result(struct safexcel_crypto_priv *priv,
 
         ring = safexcel_select_ring(priv);
         ctx->base.ring = ring;
-        ctx->base.needs_inv = false;
-        ctx->base.send = safexcel_ahash_send;
 
         spin_lock_bh(&priv->ring[ring].queue_lock);
         enq_ret = crypto_enqueue_request(&priv->ring[ring].queue, async);
@@ -392,6 +390,26 @@ static int safexcel_handle_inv_result(struct safexcel_crypto_priv *priv,
         return 1;
 }
 
+static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring,
+                                  struct crypto_async_request *async,
+                                  bool *should_complete, int *ret)
+{
+        struct ahash_request *areq = ahash_request_cast(async);
+        struct safexcel_ahash_req *req = ahash_request_ctx(areq);
+        int err;
+
+        if (req->needs_inv) {
+                req->needs_inv = false;
+                err = safexcel_handle_inv_result(priv, ring, async,
+                                                 should_complete, ret);
+        } else {
+                err = safexcel_handle_req_result(priv, ring, async,
+                                                 should_complete, ret);
+        }
+
+        return err;
+}
+
 static int safexcel_ahash_send_inv(struct crypto_async_request *async,
                                    int ring, struct safexcel_request *request,
                                    int *commands, int *results)
@@ -400,7 +418,6 @@ static int safexcel_ahash_send_inv(struct crypto_async_request *async,
         struct safexcel_ahash_ctx *ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(areq));
         int ret;
 
-        ctx->base.handle_result = safexcel_handle_inv_result;
         ret = safexcel_invalidate_cache(async, &ctx->base, ctx->priv,
                                         ctx->base.ctxr_dma, ring, request);
         if (unlikely(ret))
@@ -412,28 +429,46 @@ static int safexcel_ahash_send_inv(struct crypto_async_request *async,
         return 0;
 }
 
+static int safexcel_ahash_send(struct crypto_async_request *async,
+                               int ring, struct safexcel_request *request,
+                               int *commands, int *results)
+{
+        struct ahash_request *areq = ahash_request_cast(async);
+        struct safexcel_ahash_req *req = ahash_request_ctx(areq);
+        int ret;
+
+        if (req->needs_inv)
+                ret = safexcel_ahash_send_inv(async, ring, request,
+                                              commands, results);
+        else
+                ret = safexcel_ahash_send_req(async, ring, request,
+                                              commands, results);
+        return ret;
+}
+
 static int safexcel_ahash_exit_inv(struct crypto_tfm *tfm)
 {
         struct safexcel_ahash_ctx *ctx = crypto_tfm_ctx(tfm);
         struct safexcel_crypto_priv *priv = ctx->priv;
-        struct ahash_request req;
+        AHASH_REQUEST_ON_STACK(req, __crypto_ahash_cast(tfm));
+        struct safexcel_ahash_req *rctx = ahash_request_ctx(req);
         struct safexcel_inv_result result = {};
         int ring = ctx->base.ring;
 
-        memset(&req, 0, sizeof(struct ahash_request));
+        memset(req, 0, sizeof(struct ahash_request));
 
         /* create invalidation request */
         init_completion(&result.completion);
-        ahash_request_set_callback(&req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+        ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
                                    safexcel_inv_complete, &result);
 
-        ahash_request_set_tfm(&req, __crypto_ahash_cast(tfm));
-        ctx = crypto_tfm_ctx(req.base.tfm);
+        ahash_request_set_tfm(req, __crypto_ahash_cast(tfm));
+        ctx = crypto_tfm_ctx(req->base.tfm);
         ctx->base.exit_inv = true;
-        ctx->base.send = safexcel_ahash_send_inv;
+        rctx->needs_inv = true;
 
         spin_lock_bh(&priv->ring[ring].queue_lock);
-        crypto_enqueue_request(&priv->ring[ring].queue, &req.base);
+        crypto_enqueue_request(&priv->ring[ring].queue, &req->base);
         spin_unlock_bh(&priv->ring[ring].queue_lock);
 
         if (!priv->ring[ring].need_dequeue)
@@ -481,14 +516,16 @@ static int safexcel_ahash_enqueue(struct ahash_request *areq)
         struct safexcel_crypto_priv *priv = ctx->priv;
         int ret, ring;
 
-        ctx->base.send = safexcel_ahash_send;
+        req->needs_inv = false;
 
         if (req->processed && ctx->digest == CONTEXT_CONTROL_DIGEST_PRECOMPUTED)
                 ctx->base.needs_inv = safexcel_ahash_needs_inv_get(areq);
 
         if (ctx->base.ctxr) {
-                if (ctx->base.needs_inv)
-                        ctx->base.send = safexcel_ahash_send_inv;
+                if (ctx->base.needs_inv) {
+                        ctx->base.needs_inv = false;
+                        req->needs_inv = true;
+                }
         } else {
                 ctx->base.ring = safexcel_select_ring(priv);
                 ctx->base.ctxr = dma_pool_zalloc(priv->context_pool,
@@ -622,6 +659,8 @@ static int safexcel_ahash_cra_init(struct crypto_tfm *tfm)
                              struct safexcel_alg_template, alg.ahash);
 
         ctx->priv = tmpl->priv;
+        ctx->base.send = safexcel_ahash_send;
+        ctx->base.handle_result = safexcel_handle_result;
 
         crypto_ahash_set_reqsize(__crypto_ahash_cast(tfm),
                                  sizeof(struct safexcel_ahash_req));
diff --git a/drivers/crypto/n2_core.c b/drivers/crypto/n2_core.c
index 48de52cf2ecc..662e709812cc 100644
--- a/drivers/crypto/n2_core.c
+++ b/drivers/crypto/n2_core.c
@@ -1625,6 +1625,7 @@ static int queue_cache_init(void)
                                           CWQ_ENTRY_SIZE, 0, NULL);
         if (!queue_cache[HV_NCS_QTYPE_CWQ - 1]) {
                 kmem_cache_destroy(queue_cache[HV_NCS_QTYPE_MAU - 1]);
+                queue_cache[HV_NCS_QTYPE_MAU - 1] = NULL;
                 return -ENOMEM;
         }
         return 0;
@@ -1634,6 +1635,8 @@ static void queue_cache_destroy(void)
 {
         kmem_cache_destroy(queue_cache[HV_NCS_QTYPE_MAU - 1]);
         kmem_cache_destroy(queue_cache[HV_NCS_QTYPE_CWQ - 1]);
+        queue_cache[HV_NCS_QTYPE_MAU - 1] = NULL;
+        queue_cache[HV_NCS_QTYPE_CWQ - 1] = NULL;
 }
 
 static long spu_queue_register_workfn(void *arg)
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index fbab271b3bf9..a861b5b4d443 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -708,7 +708,7 @@ atc_prep_dma_interleaved(struct dma_chan *chan,
                          unsigned long flags)
 {
         struct at_dma_chan      *atchan = to_at_dma_chan(chan);
-        struct data_chunk       *first = xt->sgl;
+        struct data_chunk       *first;
         struct at_desc          *desc = NULL;
         size_t                  xfer_count;
         unsigned int            dwidth;
@@ -720,6 +720,8 @@ atc_prep_dma_interleaved(struct dma_chan *chan,
         if (unlikely(!xt || xt->numf != 1 || !xt->frame_size))
                 return NULL;
 
+        first = xt->sgl;
+
         dev_info(chan2dev(chan),
                  "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n",
                 __func__, &xt->src_start, &xt->dst_start, xt->numf,
diff --git a/drivers/dma/dma-jz4740.c b/drivers/dma/dma-jz4740.c
index d50273fed715..afd5e10f8927 100644
--- a/drivers/dma/dma-jz4740.c
+++ b/drivers/dma/dma-jz4740.c
@@ -555,7 +555,7 @@ static int jz4740_dma_probe(struct platform_device *pdev)
 
         ret = dma_async_device_register(dd);
         if (ret)
-                return ret;
+                goto err_clk;
 
         irq = platform_get_irq(pdev, 0);
         ret = request_irq(irq, jz4740_dma_irq, 0, dev_name(&pdev->dev), dmadev);
@@ -568,6 +568,8 @@ static int jz4740_dma_probe(struct platform_device *pdev)
 
 err_unregister:
         dma_async_device_unregister(dd);
+err_clk:
+        clk_disable_unprepare(dmadev->clk);
         return ret;
 }
 
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 47edc7fbf91f..ec5f9d2bc820 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -155,6 +155,12 @@ MODULE_PARM_DESC(run, "Run the test (default: false)");
 #define PATTERN_COUNT_MASK      0x1f
 #define PATTERN_MEMSET_IDX      0x01
 
+/* poor man's completion - we want to use wait_event_freezable() on it */
+struct dmatest_done {
+        bool                    done;
+        wait_queue_head_t       *wait;
+};
+
 struct dmatest_thread {
         struct list_head        node;
         struct dmatest_info     *info;
@@ -165,6 +171,8 @@ struct dmatest_thread {
         u8                      **dsts;
         u8                      **udsts;
         enum dma_transaction_type type;
+        wait_queue_head_t done_wait;
+        struct dmatest_done test_done;
         bool                    done;
 };
 
@@ -342,18 +350,25 @@ static unsigned int dmatest_verify(u8 **bufs, unsigned int start,
         return error_count;
 }
 
-/* poor man's completion - we want to use wait_event_freezable() on it */
-struct dmatest_done {
-        bool                    done;
-        wait_queue_head_t       *wait;
-};
 
 static void dmatest_callback(void *arg)
 {
         struct dmatest_done *done = arg;
-
-        done->done = true;
-        wake_up_all(done->wait);
+        struct dmatest_thread *thread =
+                container_of(arg, struct dmatest_thread, done_wait);
+        if (!thread->done) {
+                done->done = true;
+                wake_up_all(done->wait);
+        } else {
+                /*
+                 * If thread->done, it means that this callback occurred
+                 * after the parent thread has cleaned up. This can
+                 * happen in the case that driver doesn't implement
+                 * the terminate_all() functionality and a dma operation
+                 * did not occur within the timeout period
+                 */
+                WARN(1, "dmatest: Kernel memory may be corrupted!!\n");
+        }
 }
 
 static unsigned int min_odd(unsigned int x, unsigned int y)
@@ -424,9 +439,8 @@ static unsigned long long dmatest_KBs(s64 runtime, unsigned long long len)
  */
 static int dmatest_func(void *data)
 {
-        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(done_wait);
         struct dmatest_thread   *thread = data;
-        struct dmatest_done     done = { .wait = &done_wait };
+        struct dmatest_done     *done = &thread->test_done;
         struct dmatest_info     *info;
         struct dmatest_params   *params;
         struct dma_chan         *chan;
@@ -673,9 +687,9 @@ static int dmatest_func(void *data)
                         continue;
                 }
 
-                done.done = false;
+                done->done = false;
                 tx->callback = dmatest_callback;
-                tx->callback_param = &done;
+                tx->callback_param = done;
                 cookie = tx->tx_submit(tx);
 
                 if (dma_submit_error(cookie)) {
@@ -688,21 +702,12 @@ static int dmatest_func(void *data)
                 }
                 dma_async_issue_pending(chan);
 
-                wait_event_freezable_timeout(done_wait, done.done,
+                wait_event_freezable_timeout(thread->done_wait, done->done,
                                              msecs_to_jiffies(params->timeout));
 
                 status = dma_async_is_tx_complete(chan, cookie, NULL, NULL);
 
-                if (!done.done) {
-                        /*
-                         * We're leaving the timed out dma operation with
-                         * dangling pointer to done_wait.  To make this
-                         * correct, we'll need to allocate wait_done for
-                         * each test iteration and perform "who's gonna
-                         * free it this time?" dancing.  For now, just
-                         * leave it dangling.
-                         */
-                        WARN(1, "dmatest: Kernel stack may be corrupted!!\n");
+                if (!done->done) {
                         dmaengine_unmap_put(um);
                         result("test timed out", total_tests, src_off, dst_off,
                                len, 0);
@@ -789,7 +794,7 @@ err_thread_type:
                 dmatest_KBs(runtime, total_len), ret);
 
         /* terminate all transfers on specified channels */
-        if (ret)
+        if (ret || failed_tests)
                 dmaengine_terminate_all(chan);
 
         thread->done = true;
@@ -849,6 +854,8 @@ static int dmatest_add_threads(struct dmatest_info *info,
                 thread->info = info;
                 thread->chan = dtc->chan;
                 thread->type = type;
+                thread->test_done.wait = &thread->done_wait;
+                init_waitqueue_head(&thread->done_wait);
                 smp_wmb();
                 thread->task = kthread_create(dmatest_func, thread, "%s-%s%u",
                                 dma_chan_name(chan), op, i);
diff --git a/drivers/dma/fsl-edma.c b/drivers/dma/fsl-edma.c
index 6775f2c74e25..c7568869284e 100644
--- a/drivers/dma/fsl-edma.c
+++ b/drivers/dma/fsl-edma.c
@@ -863,11 +863,11 @@ static void fsl_edma_irq_exit(
         }
 }
 
-static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma)
+static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma, int nr_clocks)
 {
         int i;
 
-        for (i = 0; i < DMAMUX_NR; i++)
+        for (i = 0; i < nr_clocks; i++)
                 clk_disable_unprepare(fsl_edma->muxclk[i]);
 }
 
@@ -904,25 +904,25 @@ static int fsl_edma_probe(struct platform_device *pdev)
 
                 res = platform_get_resource(pdev, IORESOURCE_MEM, 1 + i);
                 fsl_edma->muxbase[i] = devm_ioremap_resource(&pdev->dev, res);
-                if (IS_ERR(fsl_edma->muxbase[i]))
+                if (IS_ERR(fsl_edma->muxbase[i])) {
+                        /* on error: disable all previously enabled clks */
+                        fsl_disable_clocks(fsl_edma, i);
                         return PTR_ERR(fsl_edma->muxbase[i]);
+                }
 
                 sprintf(clkname, "dmamux%d", i);
                 fsl_edma->muxclk[i] = devm_clk_get(&pdev->dev, clkname);
                 if (IS_ERR(fsl_edma->muxclk[i])) {
                         dev_err(&pdev->dev, "Missing DMAMUX block clock.\n");
+                        /* on error: disable all previously enabled clks */
+                        fsl_disable_clocks(fsl_edma, i);
                         return PTR_ERR(fsl_edma->muxclk[i]);
                 }
 
                 ret = clk_prepare_enable(fsl_edma->muxclk[i]);
-                if (ret) {
-                        /* disable only clks which were enabled on error */
-                        for (; i >= 0; i--)
-                                clk_disable_unprepare(fsl_edma->muxclk[i]);
-
-                        dev_err(&pdev->dev, "DMAMUX clk block failed.\n");
-                        return ret;
-                }
+                if (ret)
+                        /* on error: disable all previously enabled clks */
+                        fsl_disable_clocks(fsl_edma, i);
 
         }
 
@@ -976,7 +976,7 @@ static int fsl_edma_probe(struct platform_device *pdev)
         if (ret) {
                 dev_err(&pdev->dev,
                         "Can't register Freescale eDMA engine. (%d)\n", ret);
-                fsl_disable_clocks(fsl_edma);
+                fsl_disable_clocks(fsl_edma, DMAMUX_NR);
                 return ret;
         }
 
@@ -985,7 +985,7 @@ static int fsl_edma_probe(struct platform_device *pdev)
                 dev_err(&pdev->dev,
                         "Can't register Freescale eDMA of_dma. (%d)\n", ret);
                 dma_async_device_unregister(&fsl_edma->dma_dev);
-                fsl_disable_clocks(fsl_edma);
+                fsl_disable_clocks(fsl_edma, DMAMUX_NR);
                 return ret;
         }
 
@@ -1015,7 +1015,7 @@ static int fsl_edma_remove(struct platform_device *pdev)
         fsl_edma_cleanup_vchan(&fsl_edma->dma_dev);
         of_dma_controller_free(np);
         dma_async_device_unregister(&fsl_edma->dma_dev);
-        fsl_disable_clocks(fsl_edma);
+        fsl_disable_clocks(fsl_edma, DMAMUX_NR);
 
         return 0;
 }
diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
index 2f31d3d0caa6..7792a9186f9c 100644
--- a/drivers/dma/ioat/init.c
+++ b/drivers/dma/ioat/init.c
@@ -390,7 +390,7 @@ static int ioat_dma_self_test(struct ioatdma_device *ioat_dma)
         if (memcmp(src, dest, IOAT_TEST_SIZE)) {
                 dev_err(dev, "Self-test copy failed compare, disabling\n");
                 err = -ENODEV;
-                goto free_resources;
+                goto unmap_dma;
         }
 
 unmap_dma:
diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c
index dfb373c8ba2a..7da9f1b83ebe 100644
--- a/drivers/firmware/arm_scpi.c
+++ b/drivers/firmware/arm_scpi.c
@@ -28,7 +28,6 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/bitmap.h>
-#include <linux/bitfield.h>
 #include <linux/device.h>
 #include <linux/err.h>
 #include <linux/export.h>
@@ -73,13 +72,21 @@
 
 #define MAX_DVFS_DOMAINS        8
 #define MAX_DVFS_OPPS           16
-
-#define PROTO_REV_MAJOR_MASK    GENMASK(31, 16)
-#define PROTO_REV_MINOR_MASK    GENMASK(15, 0)
-
-#define FW_REV_MAJOR_MASK       GENMASK(31, 24)
-#define FW_REV_MINOR_MASK       GENMASK(23, 16)
-#define FW_REV_PATCH_MASK       GENMASK(15, 0)
+#define DVFS_LATENCY(hdr)       (le32_to_cpu(hdr) >> 16)
+#define DVFS_OPP_COUNT(hdr)     ((le32_to_cpu(hdr) >> 8) & 0xff)
+
+#define PROTOCOL_REV_MINOR_BITS 16
+#define PROTOCOL_REV_MINOR_MASK ((1U << PROTOCOL_REV_MINOR_BITS) - 1)
+#define PROTOCOL_REV_MAJOR(x)   ((x) >> PROTOCOL_REV_MINOR_BITS)
+#define PROTOCOL_REV_MINOR(x)   ((x) & PROTOCOL_REV_MINOR_MASK)
+
+#define FW_REV_MAJOR_BITS       24
+#define FW_REV_MINOR_BITS       16
+#define FW_REV_PATCH_MASK       ((1U << FW_REV_MINOR_BITS) - 1)
+#define FW_REV_MINOR_MASK       ((1U << FW_REV_MAJOR_BITS) - 1)
+#define FW_REV_MAJOR(x)         ((x) >> FW_REV_MAJOR_BITS)
+#define FW_REV_MINOR(x)         (((x) & FW_REV_MINOR_MASK) >> FW_REV_MINOR_BITS)
+#define FW_REV_PATCH(x)         ((x) & FW_REV_PATCH_MASK)
 
 #define MAX_RX_TIMEOUT          (msecs_to_jiffies(30))
 
@@ -304,6 +311,10 @@ struct clk_get_info {
         u8 name[20];
 } __packed;
 
+struct clk_get_value {
+        __le32 rate;
+} __packed;
+
 struct clk_set_value {
         __le16 id;
         __le16 reserved;
@@ -317,9 +328,7 @@ struct legacy_clk_set_value {
 } __packed;
 
 struct dvfs_info {
-        u8 domain;
-        u8 opp_count;
-        __le16 latency;
+        __le32 header;
         struct {
                 __le32 freq;
                 __le32 m_volt;
@@ -342,6 +351,11 @@ struct _scpi_sensor_info {
         char name[20];
 };
 
+struct sensor_value {
+        __le32 lo_val;
+        __le32 hi_val;
+} __packed;
+
 struct dev_pstate_set {
         __le16 dev_id;
         u8 pstate;
@@ -405,20 +419,19 @@ static void scpi_process_cmd(struct scpi_chan *ch, u32 cmd)
                 unsigned int len;
 
                 if (scpi_info->is_legacy) {
-                        struct legacy_scpi_shared_mem __iomem *mem =
-                                                        ch->rx_payload;
+                        struct legacy_scpi_shared_mem *mem = ch->rx_payload;
 
                         /* RX Length is not replied by the legacy Firmware */
                         len = match->rx_len;
 
-                        match->status = ioread32(&mem->status);
+                        match->status = le32_to_cpu(mem->status);
                         memcpy_fromio(match->rx_buf, mem->payload, len);
                 } else {
-                        struct scpi_shared_mem __iomem *mem = ch->rx_payload;
+                        struct scpi_shared_mem *mem = ch->rx_payload;
 
                         len = min(match->rx_len, CMD_SIZE(cmd));
 
-                        match->status = ioread32(&mem->status);
+                        match->status = le32_to_cpu(mem->status);
                         memcpy_fromio(match->rx_buf, mem->payload, len);
                 }
 
@@ -432,11 +445,11 @@ static void scpi_process_cmd(struct scpi_chan *ch, u32 cmd)
 static void scpi_handle_remote_msg(struct mbox_client *c, void *msg)
 {
         struct scpi_chan *ch = container_of(c, struct scpi_chan, cl);
-        struct scpi_shared_mem __iomem *mem = ch->rx_payload;
+        struct scpi_shared_mem *mem = ch->rx_payload;
         u32 cmd = 0;
 
         if (!scpi_info->is_legacy)
-                cmd = ioread32(&mem->command);
+                cmd = le32_to_cpu(mem->command);
 
         scpi_process_cmd(ch, cmd);
 }
@@ -446,7 +459,7 @@ static void scpi_tx_prepare(struct mbox_client *c, void *msg)
         unsigned long flags;
         struct scpi_xfer *t = msg;
         struct scpi_chan *ch = container_of(c, struct scpi_chan, cl);
-        struct scpi_shared_mem __iomem *mem = ch->tx_payload;
+        struct scpi_shared_mem *mem = (struct scpi_shared_mem *)ch->tx_payload;
 
         if (t->tx_buf) {
                 if (scpi_info->is_legacy)
@@ -465,7 +478,7 @@ static void scpi_tx_prepare(struct mbox_client *c, void *msg)
         }
 
         if (!scpi_info->is_legacy)
-                iowrite32(t->cmd, &mem->command);
+                mem->command = cpu_to_le32(t->cmd);
 }
 
 static struct scpi_xfer *get_scpi_xfer(struct scpi_chan *ch)
@@ -570,13 +583,13 @@ scpi_clk_get_range(u16 clk_id, unsigned long *min, unsigned long *max)
 static unsigned long scpi_clk_get_val(u16 clk_id)
 {
         int ret;
-        __le32 rate;
+        struct clk_get_value clk;
         __le16 le_clk_id = cpu_to_le16(clk_id);
 
         ret = scpi_send_message(CMD_GET_CLOCK_VALUE, &le_clk_id,
-                                sizeof(le_clk_id), &rate, sizeof(rate));
+                                sizeof(le_clk_id), &clk, sizeof(clk));
 
-        return ret ? ret : le32_to_cpu(rate);
+        return ret ? ret : le32_to_cpu(clk.rate);
 }
 
 static int scpi_clk_set_val(u16 clk_id, unsigned long rate)
@@ -632,34 +645,34 @@ static int opp_cmp_func(const void *opp1, const void *opp2)
 
 static struct scpi_dvfs_info *scpi_dvfs_get_info(u8 domain)
 {
-        if (domain >= MAX_DVFS_DOMAINS)
-                return ERR_PTR(-EINVAL);
-
-        return scpi_info->dvfs[domain] ?: ERR_PTR(-EINVAL);
-}
-
-static int scpi_dvfs_populate_info(struct device *dev, u8 domain)
-{
         struct scpi_dvfs_info *info;
         struct scpi_opp *opp;
         struct dvfs_info buf;
         int ret, i;
 
+        if (domain >= MAX_DVFS_DOMAINS)
+                return ERR_PTR(-EINVAL);
+
+        if (scpi_info->dvfs[domain])    /* data already populated */
+                return scpi_info->dvfs[domain];
+
         ret = scpi_send_message(CMD_GET_DVFS_INFO, &domain, sizeof(domain),
                                 &buf, sizeof(buf));
         if (ret)
-                return ret;
+                return ERR_PTR(ret);
 
-        info = devm_kmalloc(dev, sizeof(*info), GFP_KERNEL);
+        info = kmalloc(sizeof(*info), GFP_KERNEL);
         if (!info)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
-        info->count = buf.opp_count;
-        info->latency = le16_to_cpu(buf.latency) * 1000; /* uS to nS */
+        info->count = DVFS_OPP_COUNT(buf.header);
+        info->latency = DVFS_LATENCY(buf.header) * 1000; /* uS to nS */
 
-        info->opps = devm_kcalloc(dev, info->count, sizeof(*opp), GFP_KERNEL);
-        if (!info->opps)
-                return -ENOMEM;
+        info->opps = kcalloc(info->count, sizeof(*opp), GFP_KERNEL);
+        if (!info->opps) {
+                kfree(info);
+                return ERR_PTR(-ENOMEM);
+        }
 
         for (i = 0, opp = info->opps; i < info->count; i++, opp++) {
                 opp->freq = le32_to_cpu(buf.opps[i].freq);
@@ -669,15 +682,7 @@ static int scpi_dvfs_populate_info(struct device *dev, u8 domain)
         sort(info->opps, info->count, sizeof(*opp), opp_cmp_func, NULL);
 
         scpi_info->dvfs[domain] = info;
-        return 0;
-}
-
-static void scpi_dvfs_populate(struct device *dev)
-{
-        int domain;
-
-        for (domain = 0; domain < MAX_DVFS_DOMAINS; domain++)
-                scpi_dvfs_populate_info(dev, domain);
+        return info;
 }
 
 static int scpi_dev_domain_id(struct device *dev)
@@ -708,6 +713,9 @@ static int scpi_dvfs_get_transition_latency(struct device *dev)
         if (IS_ERR(info))
                 return PTR_ERR(info);
 
+        if (!info->latency)
+                return 0;
+
         return info->latency;
 }
 
@@ -768,19 +776,20 @@ static int scpi_sensor_get_info(u16 sensor_id, struct scpi_sensor_info *info)
 static int scpi_sensor_get_value(u16 sensor, u64 *val)
 {
         __le16 id = cpu_to_le16(sensor);
-        __le64 value;
+        struct sensor_value buf;
         int ret;
 
         ret = scpi_send_message(CMD_SENSOR_VALUE, &id, sizeof(id),
-                                &value, sizeof(value));
+                                &buf, sizeof(buf));
         if (ret)
                 return ret;
 
         if (scpi_info->is_legacy)
-                /* only 32-bits supported, upper 32 bits can be junk */
-                *val = le32_to_cpup((__le32 *)&value);
+                /* only 32-bits supported, hi_val can be junk */
+                *val = le32_to_cpu(buf.lo_val);
         else
-                *val = le64_to_cpu(value);
+                *val = (u64)le32_to_cpu(buf.hi_val) << 32 |
+                        le32_to_cpu(buf.lo_val);
 
         return 0;
 }
@@ -853,19 +862,23 @@ static int scpi_init_versions(struct scpi_drvinfo *info)
 static ssize_t protocol_version_show(struct device *dev,
                                      struct device_attribute *attr, char *buf)
 {
-        return sprintf(buf, "%lu.%lu\n",
-                FIELD_GET(PROTO_REV_MAJOR_MASK, scpi_info->protocol_version),
-                FIELD_GET(PROTO_REV_MINOR_MASK, scpi_info->protocol_version));
+        struct scpi_drvinfo *scpi_info = dev_get_drvdata(dev);
+
+        return sprintf(buf, "%d.%d\n",
+                       PROTOCOL_REV_MAJOR(scpi_info->protocol_version),
+                       PROTOCOL_REV_MINOR(scpi_info->protocol_version));
 }
 static DEVICE_ATTR_RO(protocol_version);
 
 static ssize_t firmware_version_show(struct device *dev,
                                      struct device_attribute *attr, char *buf)
 {
-        return sprintf(buf, "%lu.%lu.%lu\n",
-                     FIELD_GET(FW_REV_MAJOR_MASK, scpi_info->firmware_version),
-                     FIELD_GET(FW_REV_MINOR_MASK, scpi_info->firmware_version),
-                     FIELD_GET(FW_REV_PATCH_MASK, scpi_info->firmware_version));
+        struct scpi_drvinfo *scpi_info = dev_get_drvdata(dev);
+
+        return sprintf(buf, "%d.%d.%d\n",
+                       FW_REV_MAJOR(scpi_info->firmware_version),
+                       FW_REV_MINOR(scpi_info->firmware_version),
+                       FW_REV_PATCH(scpi_info->firmware_version));
 }
 static DEVICE_ATTR_RO(firmware_version);
 
@@ -876,13 +889,39 @@ static struct attribute *versions_attrs[] = {
 };
 ATTRIBUTE_GROUPS(versions);
 
-static void scpi_free_channels(void *data)
+static void
+scpi_free_channels(struct device *dev, struct scpi_chan *pchan, int count)
 {
-        struct scpi_drvinfo *info = data;
         int i;
 
-        for (i = 0; i < info->num_chans; i++)
-                mbox_free_channel(info->channels[i].chan);
+        for (i = 0; i < count && pchan->chan; i++, pchan++) {
+                mbox_free_channel(pchan->chan);
+                devm_kfree(dev, pchan->xfers);
+                devm_iounmap(dev, pchan->rx_payload);
+        }
+}
+
+static int scpi_remove(struct platform_device *pdev)
+{
+        int i;
+        struct device *dev = &pdev->dev;
+        struct scpi_drvinfo *info = platform_get_drvdata(pdev);
+
+        scpi_info = NULL; /* stop exporting SCPI ops through get_scpi_ops */
+
+        of_platform_depopulate(dev);
+        sysfs_remove_groups(&dev->kobj, versions_groups);
+        scpi_free_channels(dev, info->channels, info->num_chans);
+        platform_set_drvdata(pdev, NULL);
+
+        for (i = 0; i < MAX_DVFS_DOMAINS && info->dvfs[i]; i++) {
+                kfree(info->dvfs[i]->opps);
+                kfree(info->dvfs[i]);
+        }
+        devm_kfree(dev, info->channels);
+        devm_kfree(dev, info);
+
+        return 0;
 }
 
 #define MAX_SCPI_XFERS          10
@@ -913,6 +952,7 @@ static int scpi_probe(struct platform_device *pdev)
 {
         int count, idx, ret;
         struct resource res;
+        struct scpi_chan *scpi_chan;
         struct device *dev = &pdev->dev;
         struct device_node *np = dev->of_node;
 
@@ -929,19 +969,13 @@ static int scpi_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
-        scpi_info->channels = devm_kcalloc(dev, count, sizeof(struct scpi_chan),
-                                           GFP_KERNEL);
-        if (!scpi_info->channels)
+        scpi_chan = devm_kcalloc(dev, count, sizeof(*scpi_chan), GFP_KERNEL);
+        if (!scpi_chan)
                 return -ENOMEM;
 
-        ret = devm_add_action(dev, scpi_free_channels, scpi_info);
-        if (ret)
-                return ret;
-
-        for (; scpi_info->num_chans < count; scpi_info->num_chans++) {
+        for (idx = 0; idx < count; idx++) {
                 resource_size_t size;
-                int idx = scpi_info->num_chans;
-                struct scpi_chan *pchan = scpi_info->channels + idx;
+                struct scpi_chan *pchan = scpi_chan + idx;
                 struct mbox_client *cl = &pchan->cl;
                 struct device_node *shmem = of_parse_phandle(np, "shmem", idx);
 
@@ -949,14 +983,15 @@ static int scpi_probe(struct platform_device *pdev)
                 of_node_put(shmem);
                 if (ret) {
                         dev_err(dev, "failed to get SCPI payload mem resource\n");
-                        return ret;
+                        goto err;
                 }
 
                 size = resource_size(&res);
                 pchan->rx_payload = devm_ioremap(dev, res.start, size);
                 if (!pchan->rx_payload) {
                         dev_err(dev, "failed to ioremap SCPI payload\n");
-                        return -EADDRNOTAVAIL;
+                        ret = -EADDRNOTAVAIL;
+                        goto err;
                 }
                 pchan->tx_payload = pchan->rx_payload + (size >> 1);
 
@@ -982,11 +1017,17 @@ static int scpi_probe(struct platform_device *pdev)
                                 dev_err(dev, "failed to get channel%d err %d\n",
                                         idx, ret);
                 }
+err:
+                scpi_free_channels(dev, scpi_chan, idx);
+                scpi_info = NULL;
                 return ret;
         }
 
+        scpi_info->channels = scpi_chan;
+        scpi_info->num_chans = count;
         scpi_info->commands = scpi_std_commands;
-        scpi_info->scpi_ops = &scpi_ops;
+
+        platform_set_drvdata(pdev, scpi_info);
 
         if (scpi_info->is_legacy) {
                 /* Replace with legacy variants */
@@ -1002,23 +1043,23 @@ static int scpi_probe(struct platform_device *pdev)
         ret = scpi_init_versions(scpi_info);
         if (ret) {
                 dev_err(dev, "incorrect or no SCP firmware found\n");
+                scpi_remove(pdev);
                 return ret;
         }
 
-        scpi_dvfs_populate(dev);
-
-        _dev_info(dev, "SCP Protocol %lu.%lu Firmware %lu.%lu.%lu version\n",
-                  FIELD_GET(PROTO_REV_MAJOR_MASK, scpi_info->protocol_version),
-                  FIELD_GET(PROTO_REV_MINOR_MASK, scpi_info->protocol_version),
-                  FIELD_GET(FW_REV_MAJOR_MASK, scpi_info->firmware_version),
-                  FIELD_GET(FW_REV_MINOR_MASK, scpi_info->firmware_version),
-                  FIELD_GET(FW_REV_PATCH_MASK, scpi_info->firmware_version));
+        _dev_info(dev, "SCP Protocol %d.%d Firmware %d.%d.%d version\n",
+                  PROTOCOL_REV_MAJOR(scpi_info->protocol_version),
+                  PROTOCOL_REV_MINOR(scpi_info->protocol_version),
+                  FW_REV_MAJOR(scpi_info->firmware_version),
+                  FW_REV_MINOR(scpi_info->firmware_version),
+                  FW_REV_PATCH(scpi_info->firmware_version));
+        scpi_info->scpi_ops = &scpi_ops;
 
-        ret = devm_device_add_groups(dev, versions_groups);
+        ret = sysfs_create_groups(&dev->kobj, versions_groups);
         if (ret)
                 dev_err(dev, "unable to create sysfs version group\n");
 
-        return devm_of_platform_populate(dev);
+        return of_platform_populate(dev->of_node, NULL, NULL, dev);
 }
 
 static const struct of_device_id scpi_of_match[] = {
@@ -1035,6 +1076,7 @@ static struct platform_driver scpi_driver = {
                 .of_match_table = scpi_of_match,
         },
         .probe = scpi_probe,
+        .remove = scpi_remove,
 };
 module_platform_driver(scpi_driver);
 
diff --git a/drivers/firmware/efi/capsule-loader.c b/drivers/firmware/efi/capsule-loader.c
index ec8ac5c4dd84..055e2e8f985a 100644
--- a/drivers/firmware/efi/capsule-loader.c
+++ b/drivers/firmware/efi/capsule-loader.c
@@ -20,10 +20,6 @@
 
 #define NO_FURTHER_WRITE_ACTION -1
 
-#ifndef phys_to_page
-#define phys_to_page(x)         pfn_to_page((x) >> PAGE_SHIFT)
-#endif
-
 /**
  * efi_free_all_buff_pages - free all previous allocated buffer pages
  * @cap_info: pointer to current instance of capsule_info structure
@@ -35,7 +31,7 @@
 static void efi_free_all_buff_pages(struct capsule_info *cap_info)
 {
         while (cap_info->index > 0)
-                __free_page(phys_to_page(cap_info->pages[--cap_info->index]));
+                __free_page(cap_info->pages[--cap_info->index]);
 
         cap_info->index = NO_FURTHER_WRITE_ACTION;
 }
@@ -71,6 +67,14 @@ int __efi_capsule_setup_info(struct capsule_info *cap_info)
 
         cap_info->pages = temp_page;
 
+        temp_page = krealloc(cap_info->phys,
+                             pages_needed * sizeof(phys_addr_t *),
+                             GFP_KERNEL | __GFP_ZERO);
+        if (!temp_page)
+                return -ENOMEM;
+
+        cap_info->phys = temp_page;
+
         return 0;
 }
 
@@ -105,9 +109,24 @@ int __weak efi_capsule_setup_info(struct capsule_info *cap_info, void *kbuff,
  **/
 static ssize_t efi_capsule_submit_update(struct capsule_info *cap_info)
 {
+        bool do_vunmap = false;
         int ret;
 
-        ret = efi_capsule_update(&cap_info->header, cap_info->pages);
+        /*
+         * cap_info->capsule may have been assigned already by a quirk
+         * handler, so only overwrite it if it is NULL
+         */
+        if (!cap_info->capsule) {
+                cap_info->capsule = vmap(cap_info->pages, cap_info->index,
+                                         VM_MAP, PAGE_KERNEL);
+                if (!cap_info->capsule)
+                        return -ENOMEM;
+                do_vunmap = true;
+        }
+
+        ret = efi_capsule_update(cap_info->capsule, cap_info->phys);
+        if (do_vunmap)
+                vunmap(cap_info->capsule);
         if (ret) {
                 pr_err("capsule update failed\n");
                 return ret;
@@ -165,10 +184,12 @@ static ssize_t efi_capsule_write(struct file *file, const char __user *buff,
                         goto failed;
                 }
 
-                cap_info->pages[cap_info->index++] = page_to_phys(page);
+                cap_info->pages[cap_info->index] = page;
+                cap_info->phys[cap_info->index] = page_to_phys(page);
                 cap_info->page_bytes_remain = PAGE_SIZE;
+                cap_info->index++;
         } else {
-                page = phys_to_page(cap_info->pages[cap_info->index - 1]);
+                page = cap_info->pages[cap_info->index - 1];
         }
 
         kbuff = kmap(page);
@@ -252,6 +273,7 @@ static int efi_capsule_release(struct inode *inode, struct file *file)
         struct capsule_info *cap_info = file->private_data;
 
         kfree(cap_info->pages);
+        kfree(cap_info->phys);
         kfree(file->private_data);
         file->private_data = NULL;
         return 0;
@@ -281,6 +303,13 @@ static int efi_capsule_open(struct inode *inode, struct file *file)
                 return -ENOMEM;
         }
 
+        cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL);
+        if (!cap_info->phys) {
+                kfree(cap_info->pages);
+                kfree(cap_info);
+                return -ENOMEM;
+        }
+
         file->private_data = cap_info;
 
         return 0;
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index f70febf680c3..557a47829d03 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -109,6 +109,8 @@ struct kobject *efi_kobj;
 /*
  * Let's not leave out systab information that snuck into
  * the efivars driver
+ * Note, do not add more fields in systab sysfs file as it breaks sysfs
+ * one value per file rule!
  */
 static ssize_t systab_show(struct kobject *kobj,
                            struct kobj_attribute *attr, char *buf)
@@ -143,8 +145,7 @@ static ssize_t systab_show(struct kobject *kobj,
         return str - buf;
 }
 
-static struct kobj_attribute efi_attr_systab =
-                        __ATTR(systab, 0400, systab_show, NULL);
+static struct kobj_attribute efi_attr_systab = __ATTR_RO_MODE(systab, 0400);
 
 #define EFI_FIELD(var) efi.var
 
diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c
index bd7ed3c1148a..c47e0c6ec00f 100644
--- a/drivers/firmware/efi/esrt.c
+++ b/drivers/firmware/efi/esrt.c
@@ -106,7 +106,7 @@ static const struct sysfs_ops esre_attr_ops = {
 };
 
 /* Generic ESRT Entry ("ESRE") support. */
-static ssize_t esre_fw_class_show(struct esre_entry *entry, char *buf)
+static ssize_t fw_class_show(struct esre_entry *entry, char *buf)
 {
         char *str = buf;
 
@@ -117,18 +117,16 @@ static ssize_t esre_fw_class_show(struct esre_entry *entry, char *buf)
         return str - buf;
 }
 
-static struct esre_attribute esre_fw_class = __ATTR(fw_class, 0400,
-        esre_fw_class_show, NULL);
+static struct esre_attribute esre_fw_class = __ATTR_RO_MODE(fw_class, 0400);
 
 #define esre_attr_decl(name, size, fmt) \
-static ssize_t esre_##name##_show(struct esre_entry *entry, char *buf) \
+static ssize_t name##_show(struct esre_entry *entry, char *buf) \
 { \
         return sprintf(buf, fmt "\n", \
                        le##size##_to_cpu(entry->esre.esre1->name)); \
 } \
 \
-static struct esre_attribute esre_##name = __ATTR(name, 0400, \
-        esre_##name##_show, NULL)
+static struct esre_attribute esre_##name = __ATTR_RO_MODE(name, 0400)
 
 esre_attr_decl(fw_type, 32, "%u");
 esre_attr_decl(fw_version, 32, "%u");
@@ -193,14 +191,13 @@ static int esre_create_sysfs_entry(void *esre, int entry_num)
 
 /* support for displaying ESRT fields at the top level */
 #define esrt_attr_decl(name, size, fmt) \
-static ssize_t esrt_##name##_show(struct kobject *kobj, \
+static ssize_t name##_show(struct kobject *kobj, \
                                   struct kobj_attribute *attr, char *buf)\
 { \
         return sprintf(buf, fmt "\n", le##size##_to_cpu(esrt->name)); \
 } \
 \
-static struct kobj_attribute esrt_##name = __ATTR(name, 0400, \
-        esrt_##name##_show, NULL)
+static struct kobj_attribute esrt_##name = __ATTR_RO_MODE(name, 0400)
 
 esrt_attr_decl(fw_resource_count, 32, "%u");
 esrt_attr_decl(fw_resource_count_max, 32, "%u");
@@ -431,7 +428,7 @@ err_remove_group:
 err_remove_esrt:
         kobject_put(esrt_kobj);
 err:
-        kfree(esrt);
+        memunmap(esrt);
         esrt = NULL;
         return error;
 }
diff --git a/drivers/firmware/efi/runtime-map.c b/drivers/firmware/efi/runtime-map.c
index 8e64b77aeac9..f377609ff141 100644
--- a/drivers/firmware/efi/runtime-map.c
+++ b/drivers/firmware/efi/runtime-map.c
@@ -63,11 +63,11 @@ static ssize_t map_attr_show(struct kobject *kobj, struct attribute *attr,
         return map_attr->show(entry, buf);
 }
 
-static struct map_attribute map_type_attr = __ATTR_RO(type);
-static struct map_attribute map_phys_addr_attr   = __ATTR_RO(phys_addr);
-static struct map_attribute map_virt_addr_attr  = __ATTR_RO(virt_addr);
-static struct map_attribute map_num_pages_attr  = __ATTR_RO(num_pages);
-static struct map_attribute map_attribute_attr  = __ATTR_RO(attribute);
+static struct map_attribute map_type_attr = __ATTR_RO_MODE(type, 0400);
+static struct map_attribute map_phys_addr_attr = __ATTR_RO_MODE(phys_addr, 0400);
+static struct map_attribute map_virt_addr_attr = __ATTR_RO_MODE(virt_addr, 0400);
+static struct map_attribute map_num_pages_attr = __ATTR_RO_MODE(num_pages, 0400);
+static struct map_attribute map_attribute_attr = __ATTR_RO_MODE(attribute, 0400);
 
 /*
  * These are default attributes that are added for every memmap entry.
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 35e553b3b190..e4b40f2b4627 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -295,38 +295,60 @@ static int vpd_probe(struct platform_device *pdev)
         if (ret)
                 return ret;
 
-        return vpd_sections_init(entry.cbmem_addr);
+        vpd_kobj = kobject_create_and_add("vpd", firmware_kobj);
+        if (!vpd_kobj)
+                return -ENOMEM;
+
+        ret = vpd_sections_init(entry.cbmem_addr);
+        if (ret) {
+                kobject_put(vpd_kobj);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int vpd_remove(struct platform_device *pdev)
+{
+        vpd_section_destroy(&ro_vpd);
+        vpd_section_destroy(&rw_vpd);
+
+        kobject_put(vpd_kobj);
+
+        return 0;
 }
 
 static struct platform_driver vpd_driver = {
         .probe = vpd_probe,
+        .remove = vpd_remove,
         .driver = {
                 .name = "vpd",
         },
 };
 
+static struct platform_device *vpd_pdev;
+
 static int __init vpd_platform_init(void)
 {
-        struct platform_device *pdev;
-
-        pdev = platform_device_register_simple("vpd", -1, NULL, 0);
-        if (IS_ERR(pdev))
-                return PTR_ERR(pdev);
+        int ret;
 
-        vpd_kobj = kobject_create_and_add("vpd", firmware_kobj);
-        if (!vpd_kobj)
-                return -ENOMEM;
+        ret = platform_driver_register(&vpd_driver);
+        if (ret)
+                return ret;
 
-        platform_driver_register(&vpd_driver);
+        vpd_pdev = platform_device_register_simple("vpd", -1, NULL, 0);
+        if (IS_ERR(vpd_pdev)) {
+                platform_driver_unregister(&vpd_driver);
+                return PTR_ERR(vpd_pdev);
+        }
 
         return 0;
 }
 
 static void __exit vpd_platform_exit(void)
 {
-        vpd_section_destroy(&ro_vpd);
-        vpd_section_destroy(&rw_vpd);
-        kobject_put(vpd_kobj);
+        platform_device_unregister(vpd_pdev);
+        platform_driver_unregister(&vpd_driver);
 }
 
 module_init(vpd_platform_init);
diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
index 5cfe39f7a45f..deb483064f53 100644
--- a/drivers/firmware/qemu_fw_cfg.c
+++ b/drivers/firmware/qemu_fw_cfg.c
@@ -582,9 +582,10 @@ static int fw_cfg_sysfs_remove(struct platform_device *pdev)
 {
         pr_debug("fw_cfg: unloading.\n");
         fw_cfg_sysfs_cache_cleanup();
+        sysfs_remove_file(fw_cfg_top_ko, &fw_cfg_rev_attr.attr);
+        fw_cfg_io_cleanup();
         fw_cfg_kset_unregister_recursive(fw_cfg_fname_kset);
         fw_cfg_kobj_cleanup(fw_cfg_sel_ko);
-        fw_cfg_io_cleanup();
         return 0;
 }
 
diff --git a/drivers/gpio/gpio-74x164.c b/drivers/gpio/gpio-74x164.c
index 6b535ec858cc..15a1f4b348c4 100644
--- a/drivers/gpio/gpio-74x164.c
+++ b/drivers/gpio/gpio-74x164.c
@@ -23,6 +23,7 @@
 struct gen_74x164_chip {
         struct gpio_chip        gpio_chip;
         struct mutex            lock;
+        struct gpio_desc        *gpiod_oe;
         u32                     registers;
         /*
          * Since the registers are chained, every byte sent will make
@@ -31,8 +32,7 @@ struct gen_74x164_chip {
          * register at the end of the transfer. So, to have a logical
          * numbering, store the bytes in reverse order.
          */
-        u8                      buffer[0];
-        struct gpio_desc        *gpiod_oe;
+        u8                      buffer[];
 };
 
 static int __gen_74x164_write_config(struct gen_74x164_chip *chip)
diff --git a/drivers/gpio/gpio-bcm-kona.c b/drivers/gpio/gpio-bcm-kona.c
index dfcf56ee3c61..76861a00bb92 100644
--- a/drivers/gpio/gpio-bcm-kona.c
+++ b/drivers/gpio/gpio-bcm-kona.c
@@ -522,6 +522,7 @@ static struct of_device_id const bcm_kona_gpio_of_match[] = {
  * category than their parents, so it won't report false recursion.
  */
 static struct lock_class_key gpio_lock_class;
+static struct lock_class_key gpio_request_class;
 
 static int bcm_kona_gpio_irq_map(struct irq_domain *d, unsigned int irq,
                                  irq_hw_number_t hwirq)
@@ -531,7 +532,7 @@ static int bcm_kona_gpio_irq_map(struct irq_domain *d, unsigned int irq,
         ret = irq_set_chip_data(irq, d->host_data);
         if (ret < 0)
                 return ret;
-        irq_set_lockdep_class(irq, &gpio_lock_class);
+        irq_set_lockdep_class(irq, &gpio_lock_class, &gpio_request_class);
         irq_set_chip_and_handler(irq, &bcm_gpio_irq_chip, handle_simple_irq);
         irq_set_noprobe(irq);
 
diff --git a/drivers/gpio/gpio-brcmstb.c b/drivers/gpio/gpio-brcmstb.c
index 545d43a587b7..bb4f8cf18bd9 100644
--- a/drivers/gpio/gpio-brcmstb.c
+++ b/drivers/gpio/gpio-brcmstb.c
@@ -327,6 +327,7 @@ static struct brcmstb_gpio_bank *brcmstb_gpio_hwirq_to_bank(
  * category than their parents, so it won't report false recursion.
  */
 static struct lock_class_key brcmstb_gpio_irq_lock_class;
+static struct lock_class_key brcmstb_gpio_irq_request_class;
 
 
 static int brcmstb_gpio_irq_map(struct irq_domain *d, unsigned int irq,
@@ -346,7 +347,8 @@ static int brcmstb_gpio_irq_map(struct irq_domain *d, unsigned int irq,
         ret = irq_set_chip_data(irq, &bank->gc);
         if (ret < 0)
                 return ret;
-        irq_set_lockdep_class(irq, &brcmstb_gpio_irq_lock_class);
+        irq_set_lockdep_class(irq, &brcmstb_gpio_irq_lock_class,
+                              &brcmstb_gpio_irq_request_class);
         irq_set_chip_and_handler(irq, &priv->irq_chip, handle_level_irq);
         irq_set_noprobe(irq);
         return 0;
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index f75d8443ecaf..e4b3d7db68c9 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -383,7 +383,7 @@ static int gpio_irq_type_unbanked(struct irq_data *data, unsigned trigger)
         u32 mask;
 
         d = (struct davinci_gpio_controller *)irq_data_get_irq_handler_data(data);
-        g = (struct davinci_gpio_regs __iomem *)d->regs;
+        g = (struct davinci_gpio_regs __iomem *)d->regs[0];
         mask = __gpio_mask(data->irq - d->base_irq);
 
         if (trigger & ~(IRQ_TYPE_EDGE_FALLING | IRQ_TYPE_EDGE_RISING))
diff --git a/drivers/gpio/gpio-mmio.c b/drivers/gpio/gpio-mmio.c
index f9042bcc27a4..7b14d6280e44 100644
--- a/drivers/gpio/gpio-mmio.c
+++ b/drivers/gpio/gpio-mmio.c
@@ -152,14 +152,13 @@ static int bgpio_get_set_multiple(struct gpio_chip *gc, unsigned long *mask,
 {
         unsigned long get_mask = 0;
         unsigned long set_mask = 0;
-        int bit = 0;
 
-        while ((bit = find_next_bit(mask, gc->ngpio, bit)) != gc->ngpio) {
-                if (gc->bgpio_dir & BIT(bit))
-                        set_mask |= BIT(bit);
-                else
-                        get_mask |= BIT(bit);
-        }
+        /* Make sure we first clear any bits that are zero when we read the register */
+        *bits &= ~*mask;
+
+        /* Exploit the fact that we know which directions are set */
+        set_mask = *mask & gc->bgpio_dir;
+        get_mask = *mask & ~gc->bgpio_dir;
 
         if (set_mask)
                 *bits |= gc->read_reg(gc->reg_set) & set_mask;
@@ -176,13 +175,13 @@ static int bgpio_get(struct gpio_chip *gc, unsigned int gpio)
 
 /*
  * This only works if the bits in the GPIO register are in native endianness.
- * It is dirt simple and fast in this case. (Also the most common case.)
  */
 static int bgpio_get_multiple(struct gpio_chip *gc, unsigned long *mask,
                               unsigned long *bits)
 {
-
-        *bits = gc->read_reg(gc->reg_dat) & *mask;
+        /* Make sure we first clear any bits that are zero when we read the register */
+        *bits &= ~*mask;
+        *bits |= gc->read_reg(gc->reg_dat) & *mask;
         return 0;
 }
 
@@ -196,9 +195,12 @@ static int bgpio_get_multiple_be(struct gpio_chip *gc, unsigned long *mask,
         unsigned long val;
         int bit;
 
+        /* Make sure we first clear any bits that are zero when we read the register */
+        *bits &= ~*mask;
+
         /* Create a mirrored mask */
-        bit = 0;
-        while ((bit = find_next_bit(mask, gc->ngpio, bit)) != gc->ngpio)
+        bit = -1;
+        while ((bit = find_next_bit(mask, gc->ngpio, bit + 1)) < gc->ngpio)
                 readmask |= bgpio_line2mask(gc, bit);
 
         /* Read the register */
@@ -208,8 +210,8 @@ static int bgpio_get_multiple_be(struct gpio_chip *gc, unsigned long *mask,
          * Mirror the result into the "bits" result, this will give line 0
          * in bit 0 ... line 31 in bit 31 for a 32bit register.
          */
-        bit = 0;
-        while ((bit = find_next_bit(&val, gc->ngpio, bit)) != gc->ngpio)
+        bit = -1;
+        while ((bit = find_next_bit(&val, gc->ngpio, bit + 1)) < gc->ngpio)
                 *bits |= bgpio_line2mask(gc, bit);
 
         return 0;
diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index babb7bd2ba59..a0a5f9730aa7 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -947,7 +947,7 @@ static const struct of_device_id pca953x_dt_ids[] = {
         { .compatible = "ti,tca6416", .data = OF_953X(16, PCA_INT), },
         { .compatible = "ti,tca6424", .data = OF_953X(24, PCA_INT), },
 
-        { .compatible = "onsemi,pca9654", .data = OF_953X( 8, PCA_INT), },
+        { .compatible = "onnn,pca9654", .data = OF_953X( 8, PCA_INT), },
 
         { .compatible = "exar,xra1202", .data = OF_953X( 8, 0), },
         { }
diff --git a/drivers/gpio/gpio-reg.c b/drivers/gpio/gpio-reg.c
index 23e771dba4c1..e85903eddc68 100644
--- a/drivers/gpio/gpio-reg.c
+++ b/drivers/gpio/gpio-reg.c
@@ -103,8 +103,8 @@ static int gpio_reg_to_irq(struct gpio_chip *gc, unsigned offset)
         struct gpio_reg *r = to_gpio_reg(gc);
         int irq = r->irqs[offset];
 
-        if (irq >= 0 && r->irq.domain)
-                irq = irq_find_mapping(r->irq.domain, irq);
+        if (irq >= 0 && r->irqdomain)
+                irq = irq_find_mapping(r->irqdomain, irq);
 
         return irq;
 }
diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c
index 8db47f671708..02fa8fe2292a 100644
--- a/drivers/gpio/gpio-tegra.c
+++ b/drivers/gpio/gpio-tegra.c
@@ -565,6 +565,7 @@ static const struct dev_pm_ops tegra_gpio_pm_ops = {
  * than their parents, so it won't report false recursion.
  */
 static struct lock_class_key gpio_lock_class;
+static struct lock_class_key gpio_request_class;
 
 static int tegra_gpio_probe(struct platform_device *pdev)
 {
@@ -670,7 +671,8 @@ static int tegra_gpio_probe(struct platform_device *pdev)
 
                 bank = &tgi->bank_info[GPIO_BANK(gpio)];
 
-                irq_set_lockdep_class(irq, &gpio_lock_class);
+                irq_set_lockdep_class(irq, &gpio_lock_class,
+                                      &gpio_request_class);
                 irq_set_chip_data(irq, bank);
                 irq_set_chip_and_handler(irq, &tgi->ic, handle_simple_irq);
         }
diff --git a/drivers/gpio/gpio-xgene-sb.c b/drivers/gpio/gpio-xgene-sb.c
index 2313af82fad3..acd59113e08b 100644
--- a/drivers/gpio/gpio-xgene-sb.c
+++ b/drivers/gpio/gpio-xgene-sb.c
@@ -139,7 +139,7 @@ static int xgene_gpio_sb_to_irq(struct gpio_chip *gc, u32 gpio)
 
 static int xgene_gpio_sb_domain_activate(struct irq_domain *d,
                                          struct irq_data *irq_data,
-                                         bool early)
+                                         bool reserve)
 {
         struct xgene_gpio_sb *priv = d->host_data;
         u32 gpio = HWIRQ_TO_GPIO(priv, irq_data->hwirq);
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index eb4528c87c0b..d6f3d9ee1350 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -1074,7 +1074,7 @@ void acpi_gpiochip_add(struct gpio_chip *chip)
         }
 
         if (!chip->names)
-                devprop_gpiochip_set_names(chip);
+                devprop_gpiochip_set_names(chip, dev_fwnode(chip->parent));
 
         acpi_gpiochip_request_regions(acpi_gpio);
         acpi_gpiochip_scan_gpios(acpi_gpio);
diff --git a/drivers/gpio/gpiolib-devprop.c b/drivers/gpio/gpiolib-devprop.c
index 27f383bda7d9..f748aa3e77f7 100644
--- a/drivers/gpio/gpiolib-devprop.c
+++ b/drivers/gpio/gpiolib-devprop.c
@@ -19,30 +19,27 @@
 /**
  * devprop_gpiochip_set_names - Set GPIO line names using device properties
  * @chip: GPIO chip whose lines should be named, if possible
+ * @fwnode: Property Node containing the gpio-line-names property
  *
  * Looks for device property "gpio-line-names" and if it exists assigns
  * GPIO line names for the chip. The memory allocated for the assigned
  * names belong to the underlying firmware node and should not be released
  * by the caller.
  */
-void devprop_gpiochip_set_names(struct gpio_chip *chip)
+void devprop_gpiochip_set_names(struct gpio_chip *chip,
+                                const struct fwnode_handle *fwnode)
 {
         struct gpio_device *gdev = chip->gpiodev;
         const char **names;
         int ret, i;
 
-        if (!chip->parent) {
-                dev_warn(&gdev->dev, "GPIO chip parent is NULL\n");
-                return;
-        }
-
-        ret = device_property_read_string_array(chip->parent, "gpio-line-names",
+        ret = fwnode_property_read_string_array(fwnode, "gpio-line-names",
                                                 NULL, 0);
         if (ret < 0)
                 return;
 
         if (ret != gdev->ngpio) {
-                dev_warn(chip->parent,
+                dev_warn(&gdev->dev,
                          "names %d do not match number of GPIOs %d\n", ret,
                          gdev->ngpio);
                 return;
@@ -52,10 +49,10 @@ void devprop_gpiochip_set_names(struct gpio_chip *chip)
         if (!names)
                 return;
 
-        ret = device_property_read_string_array(chip->parent, "gpio-line-names",
+        ret = fwnode_property_read_string_array(fwnode, "gpio-line-names",
                                                 names, gdev->ngpio);
         if (ret < 0) {
-                dev_warn(chip->parent, "failed to read GPIO line names\n");
+                dev_warn(&gdev->dev, "failed to read GPIO line names\n");
                 kfree(names);
                 return;
         }
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index e0d59e61b52f..72a0695d2ac3 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -493,7 +493,8 @@ int of_gpiochip_add(struct gpio_chip *chip)
 
         /* If the chip defines names itself, these take precedence */
         if (!chip->names)
-                devprop_gpiochip_set_names(chip);
+                devprop_gpiochip_set_names(chip,
+                                           of_fwnode_handle(chip->of_node));
 
         of_node_get(chip->of_node);
 
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index aad84a6306c4..14532d9576e4 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -73,7 +73,8 @@ LIST_HEAD(gpio_devices);
 
 static void gpiochip_free_hogs(struct gpio_chip *chip);
 static int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
-                                struct lock_class_key *key);
+                                struct lock_class_key *lock_key,
+                                struct lock_class_key *request_key);
 static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip);
 static int gpiochip_irqchip_init_valid_mask(struct gpio_chip *gpiochip);
 static void gpiochip_irqchip_free_valid_mask(struct gpio_chip *gpiochip);
@@ -1100,7 +1101,8 @@ static void gpiochip_setup_devs(void)
 }
 
 int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
-                               struct lock_class_key *key)
+                               struct lock_class_key *lock_key,
+                               struct lock_class_key *request_key)
 {
         unsigned long   flags;
         int             status = 0;
@@ -1246,7 +1248,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
         if (status)
                 goto err_remove_from_list;
 
-        status = gpiochip_add_irqchip(chip, key);
+        status = gpiochip_add_irqchip(chip, lock_key, request_key);
         if (status)
                 goto err_remove_chip;
 
@@ -1632,7 +1634,7 @@ int gpiochip_irq_map(struct irq_domain *d, unsigned int irq,
          * This lock class tells lockdep that GPIO irqs are in a different
          * category than their parents, so it won't report false recursion.
          */
-        irq_set_lockdep_class(irq, chip->irq.lock_key);
+        irq_set_lockdep_class(irq, chip->irq.lock_key, chip->irq.request_key);
         irq_set_chip_and_handler(irq, chip->irq.chip, chip->irq.handler);
         /* Chips that use nested thread handlers have them marked */
         if (chip->irq.threaded)
@@ -1712,10 +1714,12 @@ static int gpiochip_to_irq(struct gpio_chip *chip, unsigned offset)
 /**
  * gpiochip_add_irqchip() - adds an IRQ chip to a GPIO chip
  * @gpiochip: the GPIO chip to add the IRQ chip to
- * @lock_key: lockdep class
+ * @lock_key: lockdep class for IRQ lock
+ * @request_key: lockdep class for IRQ request
  */
 static int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
-                                struct lock_class_key *lock_key)
+                                struct lock_class_key *lock_key,
+                                struct lock_class_key *request_key)
 {
         struct irq_chip *irqchip = gpiochip->irq.chip;
         const struct irq_domain_ops *ops;
@@ -1753,6 +1757,7 @@ static int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
         gpiochip->to_irq = gpiochip_to_irq;
         gpiochip->irq.default_type = type;
         gpiochip->irq.lock_key = lock_key;
+        gpiochip->irq.request_key = request_key;
 
         if (gpiochip->irq.domain_ops)
                 ops = gpiochip->irq.domain_ops;
@@ -1850,7 +1855,8 @@ static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip)
  * @type: the default type for IRQs on this irqchip, pass IRQ_TYPE_NONE
  * to have the core avoid setting up any default type in the hardware.
  * @threaded: whether this irqchip uses a nested thread handler
- * @lock_key: lockdep class
+ * @lock_key: lockdep class for IRQ lock
+ * @request_key: lockdep class for IRQ request
  *
  * This function closely associates a certain irqchip with a certain
  * gpiochip, providing an irq domain to translate the local IRQs to
@@ -1872,7 +1878,8 @@ int gpiochip_irqchip_add_key(struct gpio_chip *gpiochip,
                              irq_flow_handler_t handler,
                              unsigned int type,
                              bool threaded,
-                             struct lock_class_key *lock_key)
+                             struct lock_class_key *lock_key,
+                             struct lock_class_key *request_key)
 {
         struct device_node *of_node;
 
@@ -1913,6 +1920,7 @@ int gpiochip_irqchip_add_key(struct gpio_chip *gpiochip,
         gpiochip->irq.default_type = type;
         gpiochip->to_irq = gpiochip_to_irq;
         gpiochip->irq.lock_key = lock_key;
+        gpiochip->irq.request_key = request_key;
         gpiochip->irq.domain = irq_domain_add_simple(of_node,
                                         gpiochip->ngpio, first_irq,
                                         &gpiochip_domain_ops, gpiochip);
@@ -1940,7 +1948,8 @@ EXPORT_SYMBOL_GPL(gpiochip_irqchip_add_key);
 #else /* CONFIG_GPIOLIB_IRQCHIP */
 
 static inline int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
-                                       struct lock_class_key *key)
+                                       struct lock_class_key *lock_key,
+                                       struct lock_class_key *request_key)
 {
         return 0;
 }
@@ -2884,6 +2893,27 @@ void gpiod_set_raw_value(struct gpio_desc *desc, int value)
 EXPORT_SYMBOL_GPL(gpiod_set_raw_value);
 
 /**
+ * gpiod_set_value_nocheck() - set a GPIO line value without checking
+ * @desc: the descriptor to set the value on
+ * @value: value to set
+ *
+ * This sets the value of a GPIO line backing a descriptor, applying
+ * different semantic quirks like active low and open drain/source
+ * handling.
+ */
+static void gpiod_set_value_nocheck(struct gpio_desc *desc, int value)
+{
+        if (test_bit(FLAG_ACTIVE_LOW, &desc->flags))
+                value = !value;
+        if (test_bit(FLAG_OPEN_DRAIN, &desc->flags))
+                gpio_set_open_drain_value_commit(desc, value);
+        else if (test_bit(FLAG_OPEN_SOURCE, &desc->flags))
+                gpio_set_open_source_value_commit(desc, value);
+        else
+                gpiod_set_raw_value_commit(desc, value);
+}
+
+/**
  * gpiod_set_value() - assign a gpio's value
  * @desc: gpio whose value will be assigned
  * @value: value to assign
@@ -2897,16 +2927,8 @@ EXPORT_SYMBOL_GPL(gpiod_set_raw_value);
 void gpiod_set_value(struct gpio_desc *desc, int value)
 {
         VALIDATE_DESC_VOID(desc);
-        /* Should be using gpiod_set_value_cansleep() */
         WARN_ON(desc->gdev->chip->can_sleep);
-        if (test_bit(FLAG_ACTIVE_LOW, &desc->flags))
-                value = !value;
-        if (test_bit(FLAG_OPEN_DRAIN, &desc->flags))
-                gpio_set_open_drain_value_commit(desc, value);
-        else if (test_bit(FLAG_OPEN_SOURCE, &desc->flags))
-                gpio_set_open_source_value_commit(desc, value);
-        else
-                gpiod_set_raw_value_commit(desc, value);
+        gpiod_set_value_nocheck(desc, value);
 }
 EXPORT_SYMBOL_GPL(gpiod_set_value);
 
@@ -3234,9 +3256,7 @@ void gpiod_set_value_cansleep(struct gpio_desc *desc, int value)
 {
         might_sleep_if(extra_checks);
         VALIDATE_DESC_VOID(desc);
-        if (test_bit(FLAG_ACTIVE_LOW, &desc->flags))
-                value = !value;
-        gpiod_set_raw_value_commit(desc, value);
+        gpiod_set_value_nocheck(desc, value);
 }
 EXPORT_SYMBOL_GPL(gpiod_set_value_cansleep);
 
diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h
index af48322839c3..6c44d1652139 100644
--- a/drivers/gpio/gpiolib.h
+++ b/drivers/gpio/gpiolib.h
@@ -228,7 +228,8 @@ static inline int gpio_chip_hwgpio(const struct gpio_desc *desc)
         return desc - &desc->gdev->descs[0];
 }
 
-void devprop_gpiochip_set_names(struct gpio_chip *chip);
+void devprop_gpiochip_set_names(struct gpio_chip *chip,
+                                const struct fwnode_handle *fwnode);
 
 /* With descriptor prefix */
 
diff --git a/drivers/gpu/drm/amd/acp/Makefile b/drivers/gpu/drm/amd/acp/Makefile
index 8a08e81ee90d..d4176a3fb706 100644
--- a/drivers/gpu/drm/amd/acp/Makefile
+++ b/drivers/gpu/drm/amd/acp/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the ACP, which is a sub-component
 # of AMDSOC/AMDGPU drm driver.
 # It provides the HW control for ACP related functionalities.
diff --git a/drivers/gpu/drm/amd/amdgpu/Makefile b/drivers/gpu/drm/amd/amdgpu/Makefile
index 78d609123420..90202cf4cd1e 100644
--- a/drivers/gpu/drm/amd/amdgpu/Makefile
+++ b/drivers/gpu/drm/amd/amdgpu/Makefile
@@ -1,4 +1,24 @@
-# SPDX-License-Identifier: GPL-2.0
+#
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
 #
 # Makefile for the drm device driver.  This driver provides support for the
 # Direct Rendering Infrastructure (DRI) in XFree86 4.1.0 and higher.
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
index 6c570d4e4516..f8edf5483f11 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
@@ -1,4 +1,6 @@
 /*
+ * Copyright 2017 Advanced Micro Devices, Inc.
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the "Software"),
  * to deal in the Software without restriction, including without limitation
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
index f337c316ec2c..06525f2c36c3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
@@ -1,4 +1,26 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright 2017 Advanced Micro Devices, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
 #if !defined(_AMDGPU_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _AMDGPU_TRACE_H_
 
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index da43813d67a4..5aeb5f8816f3 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -2467,7 +2467,7 @@ static int gfx_v9_0_kiq_kcq_enable(struct amdgpu_device *adev)
                                   PACKET3_MAP_QUEUES_PIPE(ring->pipe) |
                                   PACKET3_MAP_QUEUES_ME((ring->me == 1 ? 0 : 1)) |
                                   PACKET3_MAP_QUEUES_QUEUE_TYPE(0) | /*queue_type: normal compute queue */
-                                  PACKET3_MAP_QUEUES_ALLOC_FORMAT(1) | /* alloc format: all_on_one_pipe */
+                                  PACKET3_MAP_QUEUES_ALLOC_FORMAT(0) | /* alloc format: all_on_one_pipe */
                                   PACKET3_MAP_QUEUES_ENGINE_SEL(0) | /* engine_sel: compute */
                                   PACKET3_MAP_QUEUES_NUM_QUEUES(1)); /* num_queues: must be 1 */
                 amdgpu_ring_write(kiq_ring, PACKET3_MAP_QUEUES_DOORBELL_OFFSET(ring->doorbell_index));
diff --git a/drivers/gpu/drm/amd/amdkfd/Makefile b/drivers/gpu/drm/amd/amdkfd/Makefile
index 7bb0bc0ca3d6..342c2d937b17 100644
--- a/drivers/gpu/drm/amd/amdkfd/Makefile
+++ b/drivers/gpu/drm/amd/amdkfd/Makefile
@@ -1,4 +1,24 @@
-# SPDX-License-Identifier: GPL-2.0
+#
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
 #
 # Makefile for Heterogenous System Architecture support for AMD GPU devices
 #
diff --git a/drivers/gpu/drm/amd/display/Makefile b/drivers/gpu/drm/amd/display/Makefile
index 8ba37dd9cf7f..c27c81cdeed3 100644
--- a/drivers/gpu/drm/amd/display/Makefile
+++ b/drivers/gpu/drm/amd/display/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the DAL (Display Abstract Layer), which is a  sub-component
 # of the AMDGPU drm driver.
 # It provides the HW control for display related functionalities.
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/Makefile b/drivers/gpu/drm/amd/display/amdgpu_dm/Makefile
index 4699e47aa76b..2b72009844f8 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/Makefile
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the 'dm' sub-component of DAL.
 # It provides the control and status of dm blocks.
 
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index f71fe6d2ddda..bb5fa895fb64 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -2336,7 +2336,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
                        const struct dm_connector_state *dm_state)
 {
         struct drm_display_mode *preferred_mode = NULL;
-        const struct drm_connector *drm_connector;
+        struct drm_connector *drm_connector;
         struct dc_stream_state *stream = NULL;
         struct drm_display_mode mode = *drm_mode;
         bool native_mode_found = false;
@@ -2355,11 +2355,13 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
 
         if (!aconnector->dc_sink) {
                 /*
-                 * Exclude MST from creating fake_sink
-                 * TODO: need to enable MST into fake_sink feature
+                 * Create dc_sink when necessary to MST
+                 * Don't apply fake_sink to MST
                  */
-                if (aconnector->mst_port)
-                        goto stream_create_fail;
+                if (aconnector->mst_port) {
+                        dm_dp_mst_dc_sink_create(drm_connector);
+                        goto mst_dc_sink_create_done;
+                }
 
                 if (create_fake_sink(aconnector))
                         goto stream_create_fail;
@@ -2410,6 +2412,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
 stream_create_fail:
 dm_state_null:
 drm_connector_null:
+mst_dc_sink_create_done:
         return stream;
 }
 
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
index 117521c6a6ed..0230250a1164 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
@@ -189,6 +189,8 @@ struct amdgpu_dm_connector {
         struct mutex hpd_lock;
 
         bool fake_enable;
+
+        bool mst_connected;
 };
 
 #define to_amdgpu_dm_connector(x) container_of(x, struct amdgpu_dm_connector, base)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index f8efb98b1fa7..638c2c2b5cd7 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -185,6 +185,42 @@ static int dm_connector_update_modes(struct drm_connector *connector,
         return ret;
 }
 
+void dm_dp_mst_dc_sink_create(struct drm_connector *connector)
+{
+        struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
+        struct edid *edid;
+        struct dc_sink *dc_sink;
+        struct dc_sink_init_data init_params = {
+                        .link = aconnector->dc_link,
+                        .sink_signal = SIGNAL_TYPE_DISPLAY_PORT_MST };
+
+        edid = drm_dp_mst_get_edid(connector, &aconnector->mst_port->mst_mgr, aconnector->port);
+
+        if (!edid) {
+                drm_mode_connector_update_edid_property(
+                        &aconnector->base,
+                        NULL);
+                return;
+        }
+
+        aconnector->edid = edid;
+
+        dc_sink = dc_link_add_remote_sink(
+                aconnector->dc_link,
+                (uint8_t *)aconnector->edid,
+                (aconnector->edid->extensions + 1) * EDID_LENGTH,
+                &init_params);
+
+        dc_sink->priv = aconnector;
+        aconnector->dc_sink = dc_sink;
+
+        amdgpu_dm_add_sink_to_freesync_module(
+                        connector, aconnector->edid);
+
+        drm_mode_connector_update_edid_property(
+                                        &aconnector->base, aconnector->edid);
+}
+
 static int dm_dp_mst_get_modes(struct drm_connector *connector)
 {
         struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
@@ -311,6 +347,7 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
                         drm_mode_connector_set_path_property(connector, pathprop);
 
                         drm_connector_list_iter_end(&conn_iter);
+                        aconnector->mst_connected = true;
                         return &aconnector->base;
                 }
         }
@@ -363,6 +400,8 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
          */
         amdgpu_dm_connector_funcs_reset(connector);
 
+        aconnector->mst_connected = true;
+
         DRM_INFO("DM_MST: added connector: %p [id: %d] [master: %p]\n",
                         aconnector, connector->base.id, aconnector->mst_port);
 
@@ -394,6 +433,8 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
         drm_mode_connector_update_edid_property(
                         &aconnector->base,
                         NULL);
+
+        aconnector->mst_connected = false;
 }
 
 static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr)
@@ -404,10 +445,18 @@ static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr)
         drm_kms_helper_hotplug_event(dev);
 }
 
+static void dm_dp_mst_link_status_reset(struct drm_connector *connector)
+{
+        mutex_lock(&connector->dev->mode_config.mutex);
+        drm_mode_connector_set_link_status_property(connector, DRM_MODE_LINK_STATUS_BAD);
+        mutex_unlock(&connector->dev->mode_config.mutex);
+}
+
 static void dm_dp_mst_register_connector(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
         struct amdgpu_device *adev = dev->dev_private;
+        struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
 
         if (adev->mode_info.rfbdev)
                 drm_fb_helper_add_one_connector(&adev->mode_info.rfbdev->helper, connector);
@@ -416,6 +465,8 @@ static void dm_dp_mst_register_connector(struct drm_connector *connector)
 
         drm_connector_register(connector);
 
+        if (aconnector->mst_connected)
+                dm_dp_mst_link_status_reset(connector);
 }
 
 static const struct drm_dp_mst_topology_cbs dm_mst_cbs = {
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
index 2da851b40042..8cf51da26657 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
@@ -31,5 +31,6 @@ struct amdgpu_dm_connector;
 
 void amdgpu_dm_initialize_dp_connector(struct amdgpu_display_manager *dm,
                                        struct amdgpu_dm_connector *aconnector);
+void dm_dp_mst_dc_sink_create(struct drm_connector *connector);
 
 #endif
diff --git a/drivers/gpu/drm/amd/display/dc/Makefile b/drivers/gpu/drm/amd/display/dc/Makefile
index 4f83e3011743..aed538a4d1ba 100644
--- a/drivers/gpu/drm/amd/display/dc/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for Display Core (dc) component.
 #
 
diff --git a/drivers/gpu/drm/amd/display/dc/basics/Makefile b/drivers/gpu/drm/amd/display/dc/basics/Makefile
index 43c5ccdeeb72..6af8c8a9ad80 100644
--- a/drivers/gpu/drm/amd/display/dc/basics/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/basics/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the 'utils' sub-component of DAL.
 # It provides the general basic services required by other DAL
 # subcomponents.
diff --git a/drivers/gpu/drm/amd/display/dc/bios/Makefile b/drivers/gpu/drm/amd/display/dc/bios/Makefile
index 6ec815dce9cc..239e86bbec5a 100644
--- a/drivers/gpu/drm/amd/display/dc/bios/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/bios/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the 'bios' sub-component of DAL.
 # It provides the parsing and executing controls for atom bios image.
 
diff --git a/drivers/gpu/drm/amd/display/dc/calcs/Makefile b/drivers/gpu/drm/amd/display/dc/calcs/Makefile
index 41ef35995b02..7959e382ed28 100644
--- a/drivers/gpu/drm/amd/display/dc/calcs/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/calcs/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the 'calcs' sub-component of DAL.
 # It calculates Bandwidth and Watermarks values for HW programming
 #
diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
index 3dce35e66b09..b142629a1058 100644
--- a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
+++ b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
@@ -900,6 +900,15 @@ bool dcn_validate_bandwidth(
                         v->override_vta_ps[input_idx] = pipe->plane_res.scl_data.taps.v_taps;
                         v->override_hta_pschroma[input_idx] = pipe->plane_res.scl_data.taps.h_taps_c;
                         v->override_vta_pschroma[input_idx] = pipe->plane_res.scl_data.taps.v_taps_c;
+                        /*
+                         * Spreadsheet doesn't handle taps_c is one properly,
+                         * need to force Chroma to always be scaled to pass
+                         * bandwidth validation.
+                         */
+                        if (v->override_hta_pschroma[input_idx] == 1)
+                                v->override_hta_pschroma[input_idx] = 2;
+                        if (v->override_vta_pschroma[input_idx] == 1)
+                                v->override_vta_pschroma[input_idx] = 2;
                         v->source_scan[input_idx] = (pipe->plane_state->rotation % 2) ? dcn_bw_vert : dcn_bw_hor;
                 }
                 if (v->is_line_buffer_bpp_fixed == dcn_bw_yes)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_debug.c b/drivers/gpu/drm/amd/display/dc/core/dc_debug.c
index 6acee5426e4b..43c7a7fddb83 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_debug.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_debug.c
@@ -1,4 +1,26 @@
 /*
+ * Copyright 2017 Advanced Micro Devices, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+/*
  * dc_debug.c
  *
  *  Created on: Nov 3, 2016
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index e27ed4a45265..42a111b9505d 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -1801,7 +1801,7 @@ static void disable_link(struct dc_link *link, enum signal_type signal)
                 link->link_enc->funcs->disable_output(link->link_enc, signal, link);
 }
 
-bool dp_active_dongle_validate_timing(
+static bool dp_active_dongle_validate_timing(
                 const struct dc_crtc_timing *timing,
                 const struct dc_dongle_caps *dongle_caps)
 {
@@ -1833,6 +1833,8 @@ bool dp_active_dongle_validate_timing(
         /* Check Color Depth and Pixel Clock */
         if (timing->pixel_encoding == PIXEL_ENCODING_YCBCR420)
                 required_pix_clk /= 2;
+        else if (timing->pixel_encoding == PIXEL_ENCODING_YCBCR422)
+                required_pix_clk = required_pix_clk * 2 / 3;
 
         switch (timing->display_color_depth) {
         case COLOR_DEPTH_666:
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
index b7422d3b71ef..928895809867 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -1,5 +1,5 @@
 /*
-* Copyright 2012-15 Advanced Micro Devices, Inc.
+ * Copyright 2012-15 Advanced Micro Devices, Inc.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the "Software"),
diff --git a/drivers/gpu/drm/amd/display/dc/dc_helper.c b/drivers/gpu/drm/amd/display/dc/dc_helper.c
index 0d84b2a1ccfd..90e81f7ba919 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_helper.c
+++ b/drivers/gpu/drm/amd/display/dc/dc_helper.c
@@ -1,4 +1,26 @@
 /*
+ * Copyright 2017 Advanced Micro Devices, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+/*
  * dc_helper.c
  *
  *  Created on: Aug 30, 2016
diff --git a/drivers/gpu/drm/amd/display/dc/dce/Makefile b/drivers/gpu/drm/amd/display/dc/dce/Makefile
index 8abec0bed379..11401fd8e535 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dce/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for common 'dce' logic
 # HW object file under this folder follow similar pattern for HW programming
 #   - register offset and/or shift + mask stored in the dec_hw struct
diff --git a/drivers/gpu/drm/amd/display/dc/dce100/Makefile b/drivers/gpu/drm/amd/display/dc/dce100/Makefile
index ea40870624b3..a822d4e2a169 100644
--- a/drivers/gpu/drm/amd/display/dc/dce100/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dce100/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the 'controller' sub-component of DAL.
 # It provides the control and status of HW CRTC block.
 
diff --git a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
index 90911258bdb3..3ea43e2a9450 100644
--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
@@ -1,5 +1,5 @@
 /*
-* Copyright 2012-15 Advanced Micro Devices, Inc.
+ * Copyright 2012-15 Advanced Micro Devices, Inc.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the "Software"),
diff --git a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.h b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.h
index de8fdf438f9b..2f366d66635d 100644
--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.h
+++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.h
@@ -1,4 +1,27 @@
 /*
+ * Copyright 2017 Advanced Micro Devices, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ *
+ */
+/*
  * dce100_resource.h
  *
  *  Created on: 2016-01-20
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/Makefile b/drivers/gpu/drm/amd/display/dc/dce110/Makefile
index 98d956e2f218..d564c0eb8b04 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dce110/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the 'controller' sub-component of DAL.
 # It provides the control and status of HW CRTC block.
 
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index 07ff8d2faf3f..d844fadcd56f 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -2866,16 +2866,19 @@ static void dce110_apply_ctx_for_surface(
                 int num_planes,
                 struct dc_state *context)
 {
-        int i, be_idx;
+        int i;
 
         if (num_planes == 0)
                 return;
 
-        be_idx = -1;
         for (i = 0; i < dc->res_pool->pipe_count; i++) {
-                if (stream == context->res_ctx.pipe_ctx[i].stream) {
-                        be_idx = context->res_ctx.pipe_ctx[i].stream_res.tg->inst;
-                        break;
+                struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
+                struct pipe_ctx *old_pipe_ctx = &dc->current_state->res_ctx.pipe_ctx[i];
+
+                if (stream == pipe_ctx->stream) {
+                        if (!pipe_ctx->top_pipe &&
+                                (pipe_ctx->plane_state || old_pipe_ctx->plane_state))
+                                dc->hwss.pipe_control_lock(dc, pipe_ctx, true);
                 }
         }
 
@@ -2895,9 +2898,22 @@ static void dce110_apply_ctx_for_surface(
                                         context->stream_count);
 
                 dce110_program_front_end_for_pipe(dc, pipe_ctx);
+
+                dc->hwss.update_plane_addr(dc, pipe_ctx);
+
                 program_surface_visibility(dc, pipe_ctx);
 
         }
+
+        for (i = 0; i < dc->res_pool->pipe_count; i++) {
+                struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
+                struct pipe_ctx *old_pipe_ctx = &dc->current_state->res_ctx.pipe_ctx[i];
+
+                if ((stream == pipe_ctx->stream) &&
+                        (!pipe_ctx->top_pipe) &&
+                        (pipe_ctx->plane_state || old_pipe_ctx->plane_state))
+                        dc->hwss.pipe_control_lock(dc, pipe_ctx, false);
+        }
 }
 
 static void dce110_power_down_fe(struct dc *dc, int fe_idx)
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
index 61adb8174ce0..42df17f9aa8d 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
@@ -1,5 +1,5 @@
 /*
-* Copyright 2012-15 Advanced Micro Devices, Inc.
+ * Copyright 2012-15 Advanced Micro Devices, Inc.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the "Software"),
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_timing_generator_v.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_timing_generator_v.c
index 07d9303d5477..59b4cd329715 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_timing_generator_v.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_timing_generator_v.c
@@ -1,3 +1,26 @@
+/*
+ * Copyright 2017 Advanced Micro Devices, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
 #include "dm_services.h"
 
 /* include DCE11 register header files */
diff --git a/drivers/gpu/drm/amd/display/dc/dce112/Makefile b/drivers/gpu/drm/amd/display/dc/dce112/Makefile
index 265ac4310d85..8e090446d511 100644
--- a/drivers/gpu/drm/amd/display/dc/dce112/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dce112/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the 'controller' sub-component of DAL.
 # It provides the control and status of HW CRTC block.
 
diff --git a/drivers/gpu/drm/amd/display/dc/dce120/Makefile b/drivers/gpu/drm/amd/display/dc/dce120/Makefile
index 1779b963525c..37db1f8d45ea 100644
--- a/drivers/gpu/drm/amd/display/dc/dce120/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dce120/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the 'controller' sub-component of DAL.
 # It provides the control and status of HW CRTC block.
 
@@ -8,4 +29,4 @@ dce120_hw_sequencer.o
 
 AMD_DAL_DCE120 = $(addprefix $(AMDDALPATH)/dc/dce120/,$(DCE120))
 
-AMD_DISPLAY_FILES += $(AMD_DAL_DCE120)
\ No newline at end of file
+AMD_DISPLAY_FILES += $(AMD_DAL_DCE120)
diff --git a/drivers/gpu/drm/amd/display/dc/dce80/Makefile b/drivers/gpu/drm/amd/display/dc/dce80/Makefile
index c1105895e5fa..bc388aa4b2f5 100644
--- a/drivers/gpu/drm/amd/display/dc/dce80/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dce80/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the 'controller' sub-component of DAL.
 # It provides the control and status of HW CRTC block.
 
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/Makefile b/drivers/gpu/drm/amd/display/dc/dcn10/Makefile
index ebeb88283a14..f565a6042970 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for DCN.
 
 DCN10 = dcn10_resource.o dcn10_ipp.o dcn10_hw_sequencer.o \
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c
index 74e7c82bdc76..a9d55d0dd69e 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c
@@ -159,11 +159,10 @@ bool dpp_get_optimal_number_of_taps(
                         scl_data->taps.h_taps = 1;
                 if (IDENTITY_RATIO(scl_data->ratios.vert))
                         scl_data->taps.v_taps = 1;
-                /*
-                 * Spreadsheet doesn't handle taps_c is one properly,
-                 * need to force Chroma to always be scaled to pass
-                 * bandwidth validation.
-                 */
+                if (IDENTITY_RATIO(scl_data->ratios.horz_c))
+                        scl_data->taps.h_taps_c = 1;
+                if (IDENTITY_RATIO(scl_data->ratios.vert_c))
+                        scl_data->taps.v_taps_c = 1;
         }
 
         return true;
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.h b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.h
index a9782b1aba47..34daf895f848 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.h
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.h
@@ -1360,7 +1360,7 @@ void dpp1_cm_set_output_csc_adjustment(
 
 void dpp1_cm_set_output_csc_default(
                 struct dpp *dpp_base,
-                const struct default_adjustment *default_adjust);
+                enum dc_color_space colorspace);
 
 void dpp1_cm_set_gamut_remap(
         struct dpp *dpp,
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_cm.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_cm.c
index 40627c244bf5..ed1216b53465 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_cm.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_cm.c
@@ -225,14 +225,13 @@ void dpp1_cm_set_gamut_remap(
 
 void dpp1_cm_set_output_csc_default(
                 struct dpp *dpp_base,
-                const struct default_adjustment *default_adjust)
+                enum dc_color_space colorspace)
 {
 
         struct dcn10_dpp *dpp = TO_DCN10_DPP(dpp_base);
         uint32_t ocsc_mode = 0;
 
-        if (default_adjust != NULL) {
-                switch (default_adjust->out_color_space) {
+        switch (colorspace) {
                 case COLOR_SPACE_SRGB:
                 case COLOR_SPACE_2020_RGB_FULLRANGE:
                         ocsc_mode = 0;
@@ -253,7 +252,6 @@ void dpp1_cm_set_output_csc_default(
                 case COLOR_SPACE_UNKNOWN:
                 default:
                         break;
-                }
         }
 
         REG_SET(CM_OCSC_CONTROL, 0, CM_OCSC_MODE, ocsc_mode);
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 961ad5c3b454..05dc01e54531 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -2097,6 +2097,8 @@ static void program_csc_matrix(struct pipe_ctx *pipe_ctx,
                         tbl_entry.color_space = color_space;
                         //tbl_entry.regval = matrix;
                         pipe_ctx->plane_res.dpp->funcs->opp_set_csc_adjustment(pipe_ctx->plane_res.dpp, &tbl_entry);
+        } else {
+                pipe_ctx->plane_res.dpp->funcs->opp_set_csc_default(pipe_ctx->plane_res.dpp, colorspace);
         }
 }
 static bool is_lower_pipe_tree_visible(struct pipe_ctx *pipe_ctx)
diff --git a/drivers/gpu/drm/amd/display/dc/dml/Makefile b/drivers/gpu/drm/amd/display/dc/dml/Makefile
index 87bab8e8139f..3488af2b5786 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dml/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the 'utils' sub-component of DAL.
 # It provides the general basic services required by other DAL
 # subcomponents.
diff --git a/drivers/gpu/drm/amd/display/dc/gpio/Makefile b/drivers/gpu/drm/amd/display/dc/gpio/Makefile
index 70d01a9e9676..562ee189d780 100644
--- a/drivers/gpu/drm/amd/display/dc/gpio/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/gpio/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the 'gpio' sub-component of DAL.
 # It provides the control and status of HW GPIO pins.
 
diff --git a/drivers/gpu/drm/amd/display/dc/i2caux/Makefile b/drivers/gpu/drm/amd/display/dc/i2caux/Makefile
index 55603400acd9..352885cb4d07 100644
--- a/drivers/gpu/drm/amd/display/dc/i2caux/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/i2caux/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the 'i2c' sub-component of DAL.
 # It provides the control and status of HW i2c engine of the adapter.
 
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/dpp.h b/drivers/gpu/drm/amd/display/dc/inc/hw/dpp.h
index 83a68460edcd..9420dfb94d39 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/dpp.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/dpp.h
@@ -64,7 +64,7 @@ struct dpp_funcs {
 
         void (*opp_set_csc_default)(
                 struct dpp *dpp,
-                const struct default_adjustment *default_adjust);
+                enum dc_color_space colorspace);
 
         void (*opp_set_csc_adjustment)(
                 struct dpp *dpp,
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/link_encoder.h b/drivers/gpu/drm/amd/display/dc/inc/hw/link_encoder.h
index 3d33bcda7059..498b7f05c5ca 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/link_encoder.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/link_encoder.h
@@ -1,4 +1,26 @@
 /*
+ * Copyright 2017 Advanced Micro Devices, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+/*
  * link_encoder.h
  *
  *  Created on: Oct 6, 2015
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/stream_encoder.h b/drivers/gpu/drm/amd/display/dc/inc/hw/stream_encoder.h
index 3050afe8e8a9..b5db1692393c 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/stream_encoder.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/stream_encoder.h
@@ -1,4 +1,26 @@
 /*
+ * Copyright 2017 Advanced Micro Devices, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+/*
  * stream_encoder.h
  *
  */
diff --git a/drivers/gpu/drm/amd/display/dc/irq/Makefile b/drivers/gpu/drm/amd/display/dc/irq/Makefile
index c7e93f7223bd..498515aad4a5 100644
--- a/drivers/gpu/drm/amd/display/dc/irq/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/irq/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the 'audio' sub-component of DAL.
 # It provides the control and status of HW adapter resources,
 # that are global for the ASIC and sharable between pipes.
diff --git a/drivers/gpu/drm/amd/display/dc/virtual/Makefile b/drivers/gpu/drm/amd/display/dc/virtual/Makefile
index fc0b7318d9cc..07326d244d50 100644
--- a/drivers/gpu/drm/amd/display/dc/virtual/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/virtual/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the virtual sub-component of DAL.
 # It provides the control and status of HW CRTC block.
 
diff --git a/drivers/gpu/drm/amd/display/modules/freesync/Makefile b/drivers/gpu/drm/amd/display/modules/freesync/Makefile
index db8e0ff6d7a9..fb9a499780e8 100644
--- a/drivers/gpu/drm/amd/display/modules/freesync/Makefile
+++ b/drivers/gpu/drm/amd/display/modules/freesync/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for the 'freesync' sub-module of DAL.
 #
 
diff --git a/drivers/gpu/drm/amd/lib/Makefile b/drivers/gpu/drm/amd/lib/Makefile
index 87cd7009e80f..690243001e1a 100644
--- a/drivers/gpu/drm/amd/lib/Makefile
+++ b/drivers/gpu/drm/amd/lib/Makefile
@@ -1,4 +1,25 @@
 #
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
+#
 # Makefile for AMD library routines, which are used by AMD driver
 # components.
 #
diff --git a/drivers/gpu/drm/amd/powerplay/Makefile b/drivers/gpu/drm/amd/powerplay/Makefile
index 8c55c6e254d9..231785a9e24c 100644
--- a/drivers/gpu/drm/amd/powerplay/Makefile
+++ b/drivers/gpu/drm/amd/powerplay/Makefile
@@ -1,4 +1,24 @@
-# SPDX-License-Identifier: GPL-2.0
+#
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
 
 subdir-ccflags-y += \
                 -I$(FULL_AMD_PATH)/powerplay/inc/  \
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/Makefile b/drivers/gpu/drm/amd/powerplay/hwmgr/Makefile
index 824fb6fe54ae..a212c27f2e17 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/Makefile
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/Makefile
@@ -1,4 +1,24 @@
-# SPDX-License-Identifier: GPL-2.0
+#
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
 #
 # Makefile for the 'hw manager' sub-component of powerplay.
 # It provides the hardware management services for the driver.
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_overdriver.c b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_overdriver.c
index 67fae834bc67..8de384bf9a8f 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_overdriver.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_overdriver.c
@@ -1,4 +1,26 @@
-// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2017 Advanced Micro Devices, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
 #include "pp_overdriver.h"
 #include <linux/errno.h>
 
diff --git a/drivers/gpu/drm/amd/powerplay/inc/smu72.h b/drivers/gpu/drm/amd/powerplay/inc/smu72.h
index 08cd70c75d8b..9ad1cefff79f 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/smu72.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/smu72.h
@@ -1,4 +1,26 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright 2017 Advanced Micro Devices, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
 #ifndef SMU72_H
 #define SMU72_H
 
diff --git a/drivers/gpu/drm/amd/powerplay/inc/smu72_discrete.h b/drivers/gpu/drm/amd/powerplay/inc/smu72_discrete.h
index b2edbc0c3c4d..2aefbb85f620 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/smu72_discrete.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/smu72_discrete.h
@@ -1,4 +1,26 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright 2017 Advanced Micro Devices, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
 #ifndef SMU72_DISCRETE_H
 #define SMU72_DISCRETE_H
 
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/Makefile b/drivers/gpu/drm/amd/powerplay/smumgr/Makefile
index 30d3089d7dba..98e701e4f553 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/Makefile
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/Makefile
@@ -1,4 +1,24 @@
-# SPDX-License-Identifier: GPL-2.0
+#
+# Copyright 2017 Advanced Micro Devices, Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+# THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+#
 #
 # Makefile for the 'smu manager' sub-component of powerplay.
 # It provides the smu management services for the driver.
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_sched_trace.h b/drivers/gpu/drm/amd/scheduler/gpu_sched_trace.h
index 283a0dc25e84..07129e6c31a9 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_sched_trace.h
+++ b/drivers/gpu/drm/amd/scheduler/gpu_sched_trace.h
@@ -1,4 +1,26 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright 2017 Advanced Micro Devices, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
 #if !defined(_GPU_SCHED_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
 #define _GPU_SCHED_TRACE_H_
 
diff --git a/drivers/gpu/drm/armada/armada_crtc.c b/drivers/gpu/drm/armada/armada_crtc.c
index 2e065facdce7..a0f4d2a2a481 100644
--- a/drivers/gpu/drm/armada/armada_crtc.c
+++ b/drivers/gpu/drm/armada/armada_crtc.c
@@ -168,16 +168,23 @@ static void armada_drm_crtc_update(struct armada_crtc *dcrtc)
 void armada_drm_plane_calc_addrs(u32 *addrs, struct drm_framebuffer *fb,
         int x, int y)
 {
+        const struct drm_format_info *format = fb->format;
+        unsigned int num_planes = format->num_planes;
         u32 addr = drm_fb_obj(fb)->dev_addr;
-        int num_planes = fb->format->num_planes;
         int i;
 
         if (num_planes > 3)
                 num_planes = 3;
 
-        for (i = 0; i < num_planes; i++)
+        addrs[0] = addr + fb->offsets[0] + y * fb->pitches[0] +
+                   x * format->cpp[0];
+
+        y /= format->vsub;
+        x /= format->hsub;
+
+        for (i = 1; i < num_planes; i++)
                 addrs[i] = addr + fb->offsets[i] + y * fb->pitches[i] +
-                             x * fb->format->cpp[i];
+                             x * format->cpp[i];
         for (; i < 3; i++)
                 addrs[i] = 0;
 }
@@ -744,15 +751,14 @@ void armada_drm_crtc_plane_disable(struct armada_crtc *dcrtc,
         if (plane->fb)
                 drm_framebuffer_put(plane->fb);
 
-        /* Power down the Y/U/V FIFOs */
-        sram_para1 = CFG_PDWN16x66 | CFG_PDWN32x66;
-
         /* Power down most RAMs and FIFOs if this is the primary plane */
         if (plane->type == DRM_PLANE_TYPE_PRIMARY) {
-                sram_para1 |= CFG_PDWN256x32 | CFG_PDWN256x24 | CFG_PDWN256x8 |
-                              CFG_PDWN32x32 | CFG_PDWN64x66;
+                sram_para1 = CFG_PDWN256x32 | CFG_PDWN256x24 | CFG_PDWN256x8 |
+                             CFG_PDWN32x32 | CFG_PDWN64x66;
                 dma_ctrl0_mask = CFG_GRA_ENA;
         } else {
+                /* Power down the Y/U/V FIFOs */
+                sram_para1 = CFG_PDWN16x66 | CFG_PDWN32x66;
                 dma_ctrl0_mask = CFG_DMA_ENA;
         }
 
@@ -1225,17 +1231,13 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev,
 
         ret = devm_request_irq(dev, irq, armada_drm_irq, 0, "armada_drm_crtc",
                                dcrtc);
-        if (ret < 0) {
-                kfree(dcrtc);
-                return ret;
-        }
+        if (ret < 0)
+                goto err_crtc;
 
         if (dcrtc->variant->init) {
                 ret = dcrtc->variant->init(dcrtc, dev);
-                if (ret) {
-                        kfree(dcrtc);
-                        return ret;
-                }
+                if (ret)
+                        goto err_crtc;
         }
 
         /* Ensure AXI pipeline is enabled */
@@ -1246,13 +1248,15 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev,
         dcrtc->crtc.port = port;
 
         primary = kzalloc(sizeof(*primary), GFP_KERNEL);
-        if (!primary)
-                return -ENOMEM;
+        if (!primary) {
+                ret = -ENOMEM;
+                goto err_crtc;
+        }
 
         ret = armada_drm_plane_init(primary);
         if (ret) {
                 kfree(primary);
-                return ret;
+                goto err_crtc;
         }
 
         ret = drm_universal_plane_init(drm, &primary->base, 0,
@@ -1263,7 +1267,7 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev,
                                        DRM_PLANE_TYPE_PRIMARY, NULL);
         if (ret) {
                 kfree(primary);
-                return ret;
+                goto err_crtc;
         }
 
         ret = drm_crtc_init_with_planes(drm, &dcrtc->crtc, &primary->base, NULL,
@@ -1282,6 +1286,9 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev,
 
 err_crtc_init:
         primary->base.funcs->destroy(&primary->base);
+err_crtc:
+        kfree(dcrtc);
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/armada/armada_crtc.h b/drivers/gpu/drm/armada/armada_crtc.h
index bab11f483575..bfd3514fbe9b 100644
--- a/drivers/gpu/drm/armada/armada_crtc.h
+++ b/drivers/gpu/drm/armada/armada_crtc.h
@@ -42,6 +42,8 @@ struct armada_plane_work {
 };
 
 struct armada_plane_state {
+        u16 src_x;
+        u16 src_y;
         u32 src_hw;
         u32 dst_hw;
         u32 dst_yx;
diff --git a/drivers/gpu/drm/armada/armada_overlay.c b/drivers/gpu/drm/armada/armada_overlay.c
index b411b608821a..aba947696178 100644
--- a/drivers/gpu/drm/armada/armada_overlay.c
+++ b/drivers/gpu/drm/armada/armada_overlay.c
@@ -99,6 +99,7 @@ armada_ovl_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
 {
         struct armada_ovl_plane *dplane = drm_to_armada_ovl_plane(plane);
         struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc);
+        const struct drm_format_info *format;
         struct drm_rect src = {
                 .x1 = src_x,
                 .y1 = src_y,
@@ -117,7 +118,7 @@ armada_ovl_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
         };
         uint32_t val, ctrl0;
         unsigned idx = 0;
-        bool visible;
+        bool visible, fb_changed;
         int ret;
 
         trace_armada_ovl_plane_update(plane, crtc, fb,
@@ -138,6 +139,18 @@ armada_ovl_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
         if (!visible)
                 ctrl0 &= ~CFG_DMA_ENA;
 
+        /*
+         * Shifting a YUV packed format image by one pixel causes the U/V
+         * planes to swap.  Compensate for it by also toggling the UV swap.
+         */
+        format = fb->format;
+        if (format->num_planes == 1 && src.x1 >> 16 & (format->hsub - 1))
+                ctrl0 ^= CFG_DMA_MOD(CFG_SWAPUV);
+
+        fb_changed = plane->fb != fb ||
+                     dplane->base.state.src_x != src.x1 >> 16 ||
+                     dplane->base.state.src_y != src.y1 >> 16;
+
         if (!dcrtc->plane) {
                 dcrtc->plane = plane;
                 armada_ovl_update_attr(&dplane->prop, dcrtc);
@@ -145,7 +158,7 @@ armada_ovl_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
 
         /* FIXME: overlay on an interlaced display */
         /* Just updating the position/size? */
-        if (plane->fb == fb && dplane->base.state.ctrl0 == ctrl0) {
+        if (!fb_changed && dplane->base.state.ctrl0 == ctrl0) {
                 val = (drm_rect_height(&src) & 0xffff0000) |
                       drm_rect_width(&src) >> 16;
                 dplane->base.state.src_hw = val;
@@ -169,9 +182,8 @@ armada_ovl_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
         if (armada_drm_plane_work_wait(&dplane->base, HZ / 25) == 0)
                 armada_drm_plane_work_cancel(dcrtc, &dplane->base);
 
-        if (plane->fb != fb) {
-                u32 addrs[3], pixel_format;
-                int num_planes, hsub;
+        if (fb_changed) {
+                u32 addrs[3];
 
                 /*
                  * Take a reference on the new framebuffer - we want to
@@ -182,23 +194,11 @@ armada_ovl_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
                 if (plane->fb)
                         armada_ovl_retire_fb(dplane, plane->fb);
 
-                src_y = src.y1 >> 16;
-                src_x = src.x1 >> 16;
+                dplane->base.state.src_y = src_y = src.y1 >> 16;
+                dplane->base.state.src_x = src_x = src.x1 >> 16;
 
                 armada_drm_plane_calc_addrs(addrs, fb, src_x, src_y);
 
-                pixel_format = fb->format->format;
-                hsub = drm_format_horz_chroma_subsampling(pixel_format);
-                num_planes = fb->format->num_planes;
-
-                /*
-                 * Annoyingly, shifting a YUYV-format image by one pixel
-                 * causes the U/V planes to toggle.  Toggle the UV swap.
-                 * (Unfortunately, this causes momentary colour flickering.)
-                 */
-                if (src_x & (hsub - 1) && num_planes == 1)
-                        ctrl0 ^= CFG_DMA_MOD(CFG_SWAPUV);
-
                 armada_reg_queue_set(dplane->vbl.regs, idx, addrs[0],
                                      LCD_SPU_DMA_START_ADDR_Y0);
                 armada_reg_queue_set(dplane->vbl.regs, idx, addrs[1],
diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
index 5dd3f1cd074a..a8905049b9da 100644
--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
@@ -946,7 +946,9 @@ static int analogix_dp_get_modes(struct drm_connector *connector)
                         return 0;
                 }
 
+                pm_runtime_get_sync(dp->dev);
                 edid = drm_get_edid(connector, &dp->aux.ddc);
+                pm_runtime_put(dp->dev);
                 if (edid) {
                         drm_mode_connector_update_edid_property(&dp->connector,
                                                                 edid);
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index 25f4b2e9a44f..9ae236036e32 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -152,6 +152,25 @@ static void drm_connector_free(struct kref *kref)
         connector->funcs->destroy(connector);
 }
 
+void drm_connector_free_work_fn(struct work_struct *work)
+{
+        struct drm_connector *connector, *n;
+        struct drm_device *dev =
+                container_of(work, struct drm_device, mode_config.connector_free_work);
+        struct drm_mode_config *config = &dev->mode_config;
+        unsigned long flags;
+        struct llist_node *freed;
+
+        spin_lock_irqsave(&config->connector_list_lock, flags);
+        freed = llist_del_all(&config->connector_free_list);
+        spin_unlock_irqrestore(&config->connector_list_lock, flags);
+
+        llist_for_each_entry_safe(connector, n, freed, free_node) {
+                drm_mode_object_unregister(dev, &connector->base);
+                connector->funcs->destroy(connector);
+        }
+}
+
 /**
  * drm_connector_init - Init a preallocated connector
  * @dev: DRM device
@@ -529,6 +548,25 @@ void drm_connector_list_iter_begin(struct drm_device *dev,
 }
 EXPORT_SYMBOL(drm_connector_list_iter_begin);
 
+/*
+ * Extra-safe connector put function that works in any context. Should only be
+ * used from the connector_iter functions, where we never really expect to
+ * actually release the connector when dropping our final reference.
+ */
+static void
+__drm_connector_put_safe(struct drm_connector *conn)
+{
+        struct drm_mode_config *config = &conn->dev->mode_config;
+
+        lockdep_assert_held(&config->connector_list_lock);
+
+        if (!refcount_dec_and_test(&conn->base.refcount.refcount))
+                return;
+
+        llist_add(&conn->free_node, &config->connector_free_list);
+        schedule_work(&config->connector_free_work);
+}
+
 /**
  * drm_connector_list_iter_next - return next connector
  * @iter: connectr_list iterator
@@ -558,10 +596,10 @@ drm_connector_list_iter_next(struct drm_connector_list_iter *iter)
 
                 /* loop until it's not a zombie connector */
         } while (!kref_get_unless_zero(&iter->conn->base.refcount));
-        spin_unlock_irqrestore(&config->connector_list_lock, flags);
 
         if (old_conn)
-                drm_connector_put(old_conn);
+                __drm_connector_put_safe(old_conn);
+        spin_unlock_irqrestore(&config->connector_list_lock, flags);
 
         return iter->conn;
 }
@@ -578,9 +616,15 @@ EXPORT_SYMBOL(drm_connector_list_iter_next);
  */
 void drm_connector_list_iter_end(struct drm_connector_list_iter *iter)
 {
+        struct drm_mode_config *config = &iter->dev->mode_config;
+        unsigned long flags;
+
         iter->dev = NULL;
-        if (iter->conn)
-                drm_connector_put(iter->conn);
+        if (iter->conn) {
+                spin_lock_irqsave(&config->connector_list_lock, flags);
+                __drm_connector_put_safe(iter->conn);
+                spin_unlock_irqrestore(&config->connector_list_lock, flags);
+        }
         lock_release(&connector_list_iter_dep_map, 0, _RET_IP_);
 }
 EXPORT_SYMBOL(drm_connector_list_iter_end);
@@ -1207,6 +1251,19 @@ int drm_mode_connector_update_edid_property(struct drm_connector *connector,
         if (edid)
                 size = EDID_LENGTH * (1 + edid->extensions);
 
+        /* Set the display info, using edid if available, otherwise
+         * reseting the values to defaults. This duplicates the work
+         * done in drm_add_edid_modes, but that function is not
+         * consistently called before this one in all drivers and the
+         * computation is cheap enough that it seems better to
+         * duplicate it rather than attempt to ensure some arbitrary
+         * ordering of calls.
+         */
+        if (edid)
+                drm_add_display_info(connector, edid);
+        else
+                drm_reset_display_info(connector);
+
         drm_object_property_set_value(&connector->base,
                                       dev->mode_config.non_desktop_property,
                                       connector->display_info.non_desktop);
diff --git a/drivers/gpu/drm/drm_crtc_internal.h b/drivers/gpu/drm/drm_crtc_internal.h
index 9ebb8841778c..af00f42ba269 100644
--- a/drivers/gpu/drm/drm_crtc_internal.h
+++ b/drivers/gpu/drm/drm_crtc_internal.h
@@ -142,6 +142,7 @@ int drm_mode_connector_set_obj_prop(struct drm_mode_object *obj,
                                     uint64_t value);
 int drm_connector_create_standard_properties(struct drm_device *dev);
 const char *drm_get_connector_force_name(enum drm_connector_force force);
+void drm_connector_free_work_fn(struct work_struct *work);
 
 /* IOCTL */
 int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 5dfe14763871..cb487148359a 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -1731,7 +1731,7 @@ EXPORT_SYMBOL(drm_edid_duplicate);
  *
  * Returns true if @vendor is in @edid, false otherwise
  */
-static bool edid_vendor(struct edid *edid, const char *vendor)
+static bool edid_vendor(const struct edid *edid, const char *vendor)
 {
         char edid_vendor[3];
 
@@ -1749,7 +1749,7 @@ static bool edid_vendor(struct edid *edid, const char *vendor)
  *
  * This tells subsequent routines what fixes they need to apply.
  */
-static u32 edid_get_quirks(struct edid *edid)
+static u32 edid_get_quirks(const struct edid *edid)
 {
         const struct edid_quirk *quirk;
         int i;
@@ -2813,7 +2813,7 @@ add_detailed_modes(struct drm_connector *connector, struct edid *edid,
 /*
  * Search EDID for CEA extension block.
  */
-static u8 *drm_find_edid_extension(struct edid *edid, int ext_id)
+static u8 *drm_find_edid_extension(const struct edid *edid, int ext_id)
 {
         u8 *edid_ext = NULL;
         int i;
@@ -2835,12 +2835,12 @@ static u8 *drm_find_edid_extension(struct edid *edid, int ext_id)
         return edid_ext;
 }
 
-static u8 *drm_find_cea_extension(struct edid *edid)
+static u8 *drm_find_cea_extension(const struct edid *edid)
 {
         return drm_find_edid_extension(edid, CEA_EXT);
 }
 
-static u8 *drm_find_displayid_extension(struct edid *edid)
+static u8 *drm_find_displayid_extension(const struct edid *edid)
 {
         return drm_find_edid_extension(edid, DISPLAYID_EXT);
 }
@@ -4363,7 +4363,7 @@ drm_parse_hdmi_vsdb_video(struct drm_connector *connector, const u8 *db)
 }
 
 static void drm_parse_cea_ext(struct drm_connector *connector,
-                              struct edid *edid)
+                              const struct edid *edid)
 {
         struct drm_display_info *info = &connector->display_info;
         const u8 *edid_ext;
@@ -4397,11 +4397,33 @@ static void drm_parse_cea_ext(struct drm_connector *connector,
         }
 }
 
-static void drm_add_display_info(struct drm_connector *connector,
-                                 struct edid *edid, u32 quirks)
+/* A connector has no EDID information, so we've got no EDID to compute quirks from. Reset
+ * all of the values which would have been set from EDID
+ */
+void
+drm_reset_display_info(struct drm_connector *connector)
 {
         struct drm_display_info *info = &connector->display_info;
 
+        info->width_mm = 0;
+        info->height_mm = 0;
+
+        info->bpc = 0;
+        info->color_formats = 0;
+        info->cea_rev = 0;
+        info->max_tmds_clock = 0;
+        info->dvi_dual = false;
+
+        info->non_desktop = 0;
+}
+EXPORT_SYMBOL_GPL(drm_reset_display_info);
+
+u32 drm_add_display_info(struct drm_connector *connector, const struct edid *edid)
+{
+        struct drm_display_info *info = &connector->display_info;
+
+        u32 quirks = edid_get_quirks(edid);
+
         info->width_mm = edid->width_cm * 10;
         info->height_mm = edid->height_cm * 10;
 
@@ -4414,11 +4436,13 @@ static void drm_add_display_info(struct drm_connector *connector,
 
         info->non_desktop = !!(quirks & EDID_QUIRK_NON_DESKTOP);
 
+        DRM_DEBUG_KMS("non_desktop set to %d\n", info->non_desktop);
+
         if (edid->revision < 3)
-                return;
+                return quirks;
 
         if (!(edid->input & DRM_EDID_INPUT_DIGITAL))
-                return;
+                return quirks;
 
         drm_parse_cea_ext(connector, edid);
 
@@ -4438,7 +4462,7 @@ static void drm_add_display_info(struct drm_connector *connector,
 
         /* Only defined for 1.4 with digital displays */
         if (edid->revision < 4)
-                return;
+                return quirks;
 
         switch (edid->input & DRM_EDID_DIGITAL_DEPTH_MASK) {
         case DRM_EDID_DIGITAL_DEPTH_6:
@@ -4473,7 +4497,9 @@ static void drm_add_display_info(struct drm_connector *connector,
                 info->color_formats |= DRM_COLOR_FORMAT_YCRCB444;
         if (edid->features & DRM_EDID_FEATURE_RGB_YCRCB422)
                 info->color_formats |= DRM_COLOR_FORMAT_YCRCB422;
+        return quirks;
 }
+EXPORT_SYMBOL_GPL(drm_add_display_info);
 
 static int validate_displayid(u8 *displayid, int length, int idx)
 {
@@ -4627,14 +4653,12 @@ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid)
                 return 0;
         }
 
-        quirks = edid_get_quirks(edid);
-
         /*
          * CEA-861-F adds ycbcr capability map block, for HDMI 2.0 sinks.
          * To avoid multiple parsing of same block, lets parse that map
          * from sink info, before parsing CEA modes.
          */
-        drm_add_display_info(connector, edid, quirks);
+        quirks = drm_add_display_info(connector, edid);
 
         /*
          * EDID spec says modes should be preferred in this order:
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index d1eb56a1eff4..1402c0e71b03 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -220,17 +220,6 @@ static struct drm_master *drm_lease_create(struct drm_master *lessor, struct idr
 
         mutex_lock(&dev->mode_config.idr_mutex);
 
-        /* Insert the new lessee into the tree */
-        id = idr_alloc(&(drm_lease_owner(lessor)->lessee_idr), lessee, 1, 0, GFP_KERNEL);
-        if (id < 0) {
-                error = id;
-                goto out_lessee;
-        }
-
-        lessee->lessee_id = id;
-        lessee->lessor = drm_master_get(lessor);
-        list_add_tail(&lessee->lessee_list, &lessor->lessees);
-
         idr_for_each_entry(leases, entry, object) {
                 error = 0;
                 if (!idr_find(&dev->mode_config.crtc_idr, object))
@@ -246,6 +235,17 @@ static struct drm_master *drm_lease_create(struct drm_master *lessor, struct idr
                 }
         }
 
+        /* Insert the new lessee into the tree */
+        id = idr_alloc(&(drm_lease_owner(lessor)->lessee_idr), lessee, 1, 0, GFP_KERNEL);
+        if (id < 0) {
+                error = id;
+                goto out_lessee;
+        }
+
+        lessee->lessee_id = id;
+        lessee->lessor = drm_master_get(lessor);
+        list_add_tail(&lessee->lessee_list, &lessor->lessees);
+
         /* Move the leases over */
         lessee->leases = *leases;
         DRM_DEBUG_LEASE("new lessee %d %p, lessor %d %p\n", lessee->lessee_id, lessee, lessor->lessee_id, lessor);
@@ -254,10 +254,10 @@ static struct drm_master *drm_lease_create(struct drm_master *lessor, struct idr
         return lessee;
 
 out_lessee:
-        drm_master_put(&lessee);
-
         mutex_unlock(&dev->mode_config.idr_mutex);
 
+        drm_master_put(&lessee);
+
         return ERR_PTR(error);
 }
 
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 61a1c8ea74bc..c3c79ee6119e 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -575,21 +575,23 @@ EXPORT_SYMBOL(drm_mm_remove_node);
  */
 void drm_mm_replace_node(struct drm_mm_node *old, struct drm_mm_node *new)
 {
+        struct drm_mm *mm = old->mm;
+
         DRM_MM_BUG_ON(!old->allocated);
 
         *new = *old;
 
         list_replace(&old->node_list, &new->node_list);
-        rb_replace_node(&old->rb, &new->rb, &old->mm->interval_tree.rb_root);
+        rb_replace_node_cached(&old->rb, &new->rb, &mm->interval_tree);
 
         if (drm_mm_hole_follows(old)) {
                 list_replace(&old->hole_stack, &new->hole_stack);
                 rb_replace_node(&old->rb_hole_size,
                                 &new->rb_hole_size,
-                                &old->mm->holes_size);
+                                &mm->holes_size);
                 rb_replace_node(&old->rb_hole_addr,
                                 &new->rb_hole_addr,
-                                &old->mm->holes_addr);
+                                &mm->holes_addr);
         }
 
         old->allocated = false;
diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c
index cda8bfab6d3b..256de7313612 100644
--- a/drivers/gpu/drm/drm_mode_config.c
+++ b/drivers/gpu/drm/drm_mode_config.c
@@ -382,6 +382,9 @@ void drm_mode_config_init(struct drm_device *dev)
         ida_init(&dev->mode_config.connector_ida);
         spin_lock_init(&dev->mode_config.connector_list_lock);
 
+        init_llist_head(&dev->mode_config.connector_free_list);
+        INIT_WORK(&dev->mode_config.connector_free_work, drm_connector_free_work_fn);
+
         drm_mode_create_standard_properties(dev);
 
         /* Just to be sure */
@@ -431,6 +434,8 @@ void drm_mode_config_cleanup(struct drm_device *dev)
                 drm_connector_put(connector);
         }
         drm_connector_list_iter_end(&conn_iter);
+        /* connector_iter drops references in a work item. */
+        flush_work(&dev->mode_config.connector_free_work);
         if (WARN_ON(!list_empty(&dev->mode_config.connector_list))) {
                 drm_connector_list_iter_begin(dev, &conn_iter);
                 drm_for_each_connector_iter(connector, &conn_iter)
diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index 37a93cdffb4a..2c90519576a3 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -558,11 +558,10 @@ int drm_plane_check_pixel_format(const struct drm_plane *plane, u32 format)
 }
 
 /*
- * setplane_internal - setplane handler for internal callers
+ * __setplane_internal - setplane handler for internal callers
  *
- * Note that we assume an extra reference has already been taken on fb.  If the
- * update fails, this reference will be dropped before return; if it succeeds,
- * the previous framebuffer (if any) will be unreferenced instead.
+ * This function will take a reference on the new fb for the plane
+ * on success.
  *
  * src_{x,y,w,h} are provided in 16.16 fixed point format
  */
@@ -630,14 +629,12 @@ static int __setplane_internal(struct drm_plane *plane,
         if (!ret) {
                 plane->crtc = crtc;
                 plane->fb = fb;
-                fb = NULL;
+                drm_framebuffer_get(plane->fb);
         } else {
                 plane->old_fb = NULL;
         }
 
 out:
-        if (fb)
-                drm_framebuffer_put(fb);
         if (plane->old_fb)
                 drm_framebuffer_put(plane->old_fb);
         plane->old_fb = NULL;
@@ -685,6 +682,7 @@ int drm_mode_setplane(struct drm_device *dev, void *data,
         struct drm_plane *plane;
         struct drm_crtc *crtc = NULL;
         struct drm_framebuffer *fb = NULL;
+        int ret;
 
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
@@ -717,15 +715,16 @@ int drm_mode_setplane(struct drm_device *dev, void *data,
                 }
         }
 
-        /*
-         * setplane_internal will take care of deref'ing either the old or new
-         * framebuffer depending on success.
-         */
-        return setplane_internal(plane, crtc, fb,
-                                 plane_req->crtc_x, plane_req->crtc_y,
-                                 plane_req->crtc_w, plane_req->crtc_h,
-                                 plane_req->src_x, plane_req->src_y,
-                                 plane_req->src_w, plane_req->src_h);
+        ret = setplane_internal(plane, crtc, fb,
+                                plane_req->crtc_x, plane_req->crtc_y,
+                                plane_req->crtc_w, plane_req->crtc_h,
+                                plane_req->src_x, plane_req->src_y,
+                                plane_req->src_w, plane_req->src_h);
+
+        if (fb)
+                drm_framebuffer_put(fb);
+
+        return ret;
 }
 
 static int drm_mode_cursor_universal(struct drm_crtc *crtc,
@@ -788,13 +787,12 @@ static int drm_mode_cursor_universal(struct drm_crtc *crtc,
                 src_h = fb->height << 16;
         }
 
-        /*
-         * setplane_internal will take care of deref'ing either the old or new
-         * framebuffer depending on success.
-         */
         ret = __setplane_internal(crtc->cursor, crtc, fb,
-                                crtc_x, crtc_y, crtc_w, crtc_h,
-                                0, 0, src_w, src_h, ctx);
+                                  crtc_x, crtc_y, crtc_w, crtc_h,
+                                  0, 0, src_w, src_h, ctx);
+
+        if (fb)
+                drm_framebuffer_put(fb);
 
         /* Update successful; save new cursor position, if necessary */
         if (ret == 0 && req->flags & DRM_MODE_CURSOR_MOVE) {
diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index f776fc1cc543..cb4d09c70fd4 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -369,40 +369,26 @@ static const struct file_operations drm_syncobj_file_fops = {
         .release = drm_syncobj_file_release,
 };
 
-static int drm_syncobj_alloc_file(struct drm_syncobj *syncobj)
-{
-        struct file *file = anon_inode_getfile("syncobj_file",
-                                               &drm_syncobj_file_fops,
-                                               syncobj, 0);
-        if (IS_ERR(file))
-                return PTR_ERR(file);
-
-        drm_syncobj_get(syncobj);
-        if (cmpxchg(&syncobj->file, NULL, file)) {
-                /* lost the race */
-                fput(file);
-        }
-
-        return 0;
-}
-
 int drm_syncobj_get_fd(struct drm_syncobj *syncobj, int *p_fd)
 {
-        int ret;
+        struct file *file;
         int fd;
 
         fd = get_unused_fd_flags(O_CLOEXEC);
         if (fd < 0)
                 return fd;
 
-        if (!syncobj->file) {
-                ret = drm_syncobj_alloc_file(syncobj);
-                if (ret) {
-                        put_unused_fd(fd);
-                        return ret;
-                }
+        file = anon_inode_getfile("syncobj_file",
+                                  &drm_syncobj_file_fops,
+                                  syncobj, 0);
+        if (IS_ERR(file)) {
+                put_unused_fd(fd);
+                return PTR_ERR(file);
         }
-        fd_install(fd, syncobj->file);
+
+        drm_syncobj_get(syncobj);
+        fd_install(fd, file);
+
         *p_fd = fd;
         return 0;
 }
@@ -422,31 +408,24 @@ static int drm_syncobj_handle_to_fd(struct drm_file *file_private,
         return ret;
 }
 
-static struct drm_syncobj *drm_syncobj_fdget(int fd)
-{
-        struct file *file = fget(fd);
-
-        if (!file)
-                return NULL;
-        if (file->f_op != &drm_syncobj_file_fops)
-                goto err;
-
-        return file->private_data;
-err:
-        fput(file);
-        return NULL;
-};
-
 static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
                                     int fd, u32 *handle)
 {
-        struct drm_syncobj *syncobj = drm_syncobj_fdget(fd);
+        struct drm_syncobj *syncobj;
+        struct file *file;
         int ret;
 
-        if (!syncobj)
+        file = fget(fd);
+        if (!file)
                 return -EINVAL;
 
+        if (file->f_op != &drm_syncobj_file_fops) {
+                fput(file);
+                return -EINVAL;
+        }
+
         /* take a reference to put in the idr */
+        syncobj = file->private_data;
         drm_syncobj_get(syncobj);
 
         idr_preload(GFP_KERNEL);
@@ -455,12 +434,14 @@ static int drm_syncobj_fd_to_handle(struct drm_file *file_private,
         spin_unlock(&file_private->syncobj_table_lock);
         idr_preload_end();
 
-        if (ret < 0) {
-                fput(syncobj->file);
-                return ret;
-        }
-        *handle = ret;
-        return 0;
+        if (ret > 0) {
+                *handle = ret;
+                ret = 0;
+        } else
+                drm_syncobj_put(syncobj);
+
+        fput(file);
+        return ret;
 }
 
 static int drm_syncobj_import_sync_file_fence(struct drm_file *file_private,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 82b72425a42f..27e423b87266 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -37,8 +37,6 @@
 #define DRIVER_MAJOR    1
 #define DRIVER_MINOR    0
 
-static struct device *exynos_drm_get_dma_device(void);
-
 int exynos_atomic_check(struct drm_device *dev,
                         struct drm_atomic_state *state)
 {
@@ -148,7 +146,7 @@ static struct drm_driver exynos_drm_driver = {
         .prime_handle_to_fd     = drm_gem_prime_handle_to_fd,
         .prime_fd_to_handle     = drm_gem_prime_fd_to_handle,
         .gem_prime_export       = drm_gem_prime_export,
-        .gem_prime_import       = drm_gem_prime_import,
+        .gem_prime_import       = exynos_drm_gem_prime_import,
         .gem_prime_get_sg_table = exynos_drm_gem_prime_get_sg_table,
         .gem_prime_import_sg_table      = exynos_drm_gem_prime_import_sg_table,
         .gem_prime_vmap         = exynos_drm_gem_prime_vmap,
@@ -301,6 +299,27 @@ static struct component_match *exynos_drm_match_add(struct device *dev)
         return match ?: ERR_PTR(-ENODEV);
 }
 
+static struct device *exynos_drm_get_dma_device(void)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(exynos_drm_drivers); ++i) {
+                struct exynos_drm_driver_info *info = &exynos_drm_drivers[i];
+                struct device *dev;
+
+                if (!info->driver || !(info->flags & DRM_DMA_DEVICE))
+                        continue;
+
+                while ((dev = bus_find_device(&platform_bus_type, NULL,
+                                            &info->driver->driver,
+                                            (void *)platform_bus_type.match))) {
+                        put_device(dev);
+                        return dev;
+                }
+        }
+        return NULL;
+}
+
 static int exynos_drm_bind(struct device *dev)
 {
         struct exynos_drm_private *private;
@@ -469,27 +488,6 @@ static struct platform_driver exynos_drm_platform_driver = {
         },
 };
 
-static struct device *exynos_drm_get_dma_device(void)
-{
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(exynos_drm_drivers); ++i) {
-                struct exynos_drm_driver_info *info = &exynos_drm_drivers[i];
-                struct device *dev;
-
-                if (!info->driver || !(info->flags & DRM_DMA_DEVICE))
-                        continue;
-
-                while ((dev = bus_find_device(&platform_bus_type, NULL,
-                                            &info->driver->driver,
-                                            (void *)platform_bus_type.match))) {
-                        put_device(dev);
-                        return dev;
-                }
-        }
-        return NULL;
-}
-
 static void exynos_drm_unregister_devices(void)
 {
         int i;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index c6847fa708fa..589d465a7f88 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -194,11 +194,6 @@ struct drm_exynos_file_private {
 /*
  * Exynos drm private structure.
  *
- * @da_start: start address to device address space.
- *      with iommu, device address space starts from this address
- *      otherwise default one.
- * @da_space_size: size of device address space.
- *      if 0 then default value is used for it.
  * @pending: the crtcs that have pending updates to finish
  * @lock: protect access to @pending
  * @wait: wait an atomic commit to finish
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index 077de014d610..11cc01b47bc0 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -247,6 +247,15 @@ struct exynos_drm_gem *exynos_drm_gem_create(struct drm_device *dev,
         if (IS_ERR(exynos_gem))
                 return exynos_gem;
 
+        if (!is_drm_iommu_supported(dev) && (flags & EXYNOS_BO_NONCONTIG)) {
+                /*
+                 * when no IOMMU is available, all allocated buffers are
+                 * contiguous anyway, so drop EXYNOS_BO_NONCONTIG flag
+                 */
+                flags &= ~EXYNOS_BO_NONCONTIG;
+                DRM_WARN("Non-contiguous allocation is not supported without IOMMU, falling back to contiguous buffer\n");
+        }
+
         /* set memory type and cache attribute from user side. */
         exynos_gem->flags = flags;
 
@@ -506,6 +515,12 @@ int exynos_drm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
 }
 
 /* low-level interface prime helpers */
+struct drm_gem_object *exynos_drm_gem_prime_import(struct drm_device *dev,
+                                            struct dma_buf *dma_buf)
+{
+        return drm_gem_prime_import_dev(dev, dma_buf, to_dma_dev(dev));
+}
+
 struct sg_table *exynos_drm_gem_prime_get_sg_table(struct drm_gem_object *obj)
 {
         struct exynos_drm_gem *exynos_gem = to_exynos_gem(obj);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.h b/drivers/gpu/drm/exynos/exynos_drm_gem.h
index e86d1a9518c3..5a4c7de80f65 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.h
@@ -117,6 +117,8 @@ int exynos_drm_gem_fault(struct vm_fault *vmf);
 int exynos_drm_gem_mmap(struct file *filp, struct vm_area_struct *vma);
 
 /* low-level interface prime helpers */
+struct drm_gem_object *exynos_drm_gem_prime_import(struct drm_device *dev,
+                                            struct dma_buf *dma_buf);
 struct sg_table *exynos_drm_gem_prime_get_sg_table(struct drm_gem_object *obj);
 struct drm_gem_object *
 exynos_drm_gem_prime_import_sg_table(struct drm_device *dev,
diff --git a/drivers/gpu/drm/i915/gvt/cfg_space.c b/drivers/gpu/drm/i915/gvt/cfg_space.c
index ab19545d59a1..4ce2e6bd0680 100644
--- a/drivers/gpu/drm/i915/gvt/cfg_space.c
+++ b/drivers/gpu/drm/i915/gvt/cfg_space.c
@@ -208,6 +208,20 @@ static int emulate_pci_command_write(struct intel_vgpu *vgpu,
         return 0;
 }
 
+static int emulate_pci_rom_bar_write(struct intel_vgpu *vgpu,
+        unsigned int offset, void *p_data, unsigned int bytes)
+{
+        u32 *pval = (u32 *)(vgpu_cfg_space(vgpu) + offset);
+        u32 new = *(u32 *)(p_data);
+
+        if ((new & PCI_ROM_ADDRESS_MASK) == PCI_ROM_ADDRESS_MASK)
+                /* We don't have rom, return size of 0. */
+                *pval = 0;
+        else
+                vgpu_pci_cfg_mem_write(vgpu, offset, p_data, bytes);
+        return 0;
+}
+
 static int emulate_pci_bar_write(struct intel_vgpu *vgpu, unsigned int offset,
         void *p_data, unsigned int bytes)
 {
@@ -300,6 +314,11 @@ int intel_vgpu_emulate_cfg_write(struct intel_vgpu *vgpu, unsigned int offset,
         }
 
         switch (rounddown(offset, 4)) {
+        case PCI_ROM_ADDRESS:
+                if (WARN_ON(!IS_ALIGNED(offset, 4)))
+                        return -EINVAL;
+                return emulate_pci_rom_bar_write(vgpu, offset, p_data, bytes);
+
         case PCI_BASE_ADDRESS_0 ... PCI_BASE_ADDRESS_5:
                 if (WARN_ON(!IS_ALIGNED(offset, 4)))
                         return -EINVAL;
@@ -375,6 +394,8 @@ void intel_vgpu_init_cfg_space(struct intel_vgpu *vgpu,
                                 pci_resource_len(gvt->dev_priv->drm.pdev, 0);
         vgpu->cfg_space.bar[INTEL_GVT_PCI_BAR_APERTURE].size =
                                 pci_resource_len(gvt->dev_priv->drm.pdev, 2);
+
+        memset(vgpu_cfg_space(vgpu) + PCI_ROM_ADDRESS, 0, 4);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index 85d4c57870fb..49af94627c8a 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -2777,12 +2777,12 @@ int intel_gvt_scan_and_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 }
 
 static struct cmd_info *find_cmd_entry_any_ring(struct intel_gvt *gvt,
-                unsigned int opcode, int rings)
+                unsigned int opcode, unsigned long rings)
 {
         struct cmd_info *info = NULL;
         unsigned int ring;
 
-        for_each_set_bit(ring, (unsigned long *)&rings, I915_NUM_ENGINES) {
+        for_each_set_bit(ring, &rings, I915_NUM_ENGINES) {
                 info = find_cmd_entry(gvt, opcode, ring);
                 if (info)
                         break;
diff --git a/drivers/gpu/drm/i915/gvt/display.c b/drivers/gpu/drm/i915/gvt/display.c
index 355120865efd..309f3fa6794a 100644
--- a/drivers/gpu/drm/i915/gvt/display.c
+++ b/drivers/gpu/drm/i915/gvt/display.c
@@ -266,6 +266,8 @@ static void emulate_monitor_status_change(struct intel_vgpu *vgpu)
         /* Clear host CRT status, so guest couldn't detect this host CRT. */
         if (IS_BROADWELL(dev_priv))
                 vgpu_vreg(vgpu, PCH_ADPA) &= ~ADPA_CRT_HOTPLUG_MONITOR_MASK;
+
+        vgpu_vreg(vgpu, PIPECONF(PIPE_A)) |= PIPECONF_ENABLE;
 }
 
 static void clean_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num)
@@ -282,7 +284,6 @@ static void clean_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num)
 static int setup_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num,
                                     int type, unsigned int resolution)
 {
-        struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
         struct intel_vgpu_port *port = intel_vgpu_port(vgpu, port_num);
 
         if (WARN_ON(resolution >= GVT_EDID_NUM))
@@ -308,7 +309,7 @@ static int setup_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num,
         port->type = type;
 
         emulate_monitor_status_change(vgpu);
-        vgpu_vreg(vgpu, PIPECONF(PIPE_A)) |= PIPECONF_ENABLE;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 8e331142badb..64d67ff9bf08 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -1359,12 +1359,15 @@ static int ppgtt_handle_guest_write_page_table_bytes(void *gp,
                         return ret;
         } else {
                 if (!test_bit(index, spt->post_shadow_bitmap)) {
+                        int type = spt->shadow_page.type;
+
                         ppgtt_get_shadow_entry(spt, &se, index);
                         ret = ppgtt_handle_guest_entry_removal(gpt, &se, index);
                         if (ret)
                                 return ret;
+                        ops->set_pfn(&se, vgpu->gtt.scratch_pt[type].page_mfn);
+                        ppgtt_set_shadow_entry(spt, &se, index);
                 }
-
                 ppgtt_set_post_shadow(spt, index);
         }
 
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 44cd5ff5e97d..1f840f6b81bb 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -137,17 +137,26 @@ static int new_mmio_info(struct intel_gvt *gvt,
         return 0;
 }
 
-static int render_mmio_to_ring_id(struct intel_gvt *gvt, unsigned int reg)
+/**
+ * intel_gvt_render_mmio_to_ring_id - convert a mmio offset into ring id
+ * @gvt: a GVT device
+ * @offset: register offset
+ *
+ * Returns:
+ * Ring ID on success, negative error code if failed.
+ */
+int intel_gvt_render_mmio_to_ring_id(struct intel_gvt *gvt,
+                unsigned int offset)
 {
         enum intel_engine_id id;
         struct intel_engine_cs *engine;
 
-        reg &= ~GENMASK(11, 0);
+        offset &= ~GENMASK(11, 0);
         for_each_engine(engine, gvt->dev_priv, id) {
-                if (engine->mmio_base == reg)
+                if (engine->mmio_base == offset)
                         return id;
         }
-        return -1;
+        return -ENODEV;
 }
 
 #define offset_to_fence_num(offset) \
@@ -1398,18 +1407,36 @@ static int skl_lcpll_write(struct intel_vgpu *vgpu, unsigned int offset,
 static int mmio_read_from_hw(struct intel_vgpu *vgpu,
                 unsigned int offset, void *p_data, unsigned int bytes)
 {
-        struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
+        struct intel_gvt *gvt = vgpu->gvt;
+        struct drm_i915_private *dev_priv = gvt->dev_priv;
+        int ring_id;
+        u32 ring_base;
+
+        ring_id = intel_gvt_render_mmio_to_ring_id(gvt, offset);
+        /**
+         * Read HW reg in following case
+         * a. the offset isn't a ring mmio
+         * b. the offset's ring is running on hw.
+         * c. the offset is ring time stamp mmio
+         */
+        if (ring_id >= 0)
+                ring_base = dev_priv->engine[ring_id]->mmio_base;
+
+        if (ring_id < 0 || vgpu  == gvt->scheduler.engine_owner[ring_id] ||
+            offset == i915_mmio_reg_offset(RING_TIMESTAMP(ring_base)) ||
+            offset == i915_mmio_reg_offset(RING_TIMESTAMP_UDW(ring_base))) {
+                mmio_hw_access_pre(dev_priv);
+                vgpu_vreg(vgpu, offset) = I915_READ(_MMIO(offset));
+                mmio_hw_access_post(dev_priv);
+        }
 
-        mmio_hw_access_pre(dev_priv);
-        vgpu_vreg(vgpu, offset) = I915_READ(_MMIO(offset));
-        mmio_hw_access_post(dev_priv);
         return intel_vgpu_default_mmio_read(vgpu, offset, p_data, bytes);
 }
 
 static int elsp_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                 void *p_data, unsigned int bytes)
 {
-        int ring_id = render_mmio_to_ring_id(vgpu->gvt, offset);
+        int ring_id = intel_gvt_render_mmio_to_ring_id(vgpu->gvt, offset);
         struct intel_vgpu_execlist *execlist;
         u32 data = *(u32 *)p_data;
         int ret = 0;
@@ -1436,7 +1463,7 @@ static int ring_mode_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                 void *p_data, unsigned int bytes)
 {
         u32 data = *(u32 *)p_data;
-        int ring_id = render_mmio_to_ring_id(vgpu->gvt, offset);
+        int ring_id = intel_gvt_render_mmio_to_ring_id(vgpu->gvt, offset);
         bool enable_execlist;
 
         write_vreg(vgpu, offset, p_data, bytes);
diff --git a/drivers/gpu/drm/i915/gvt/mmio.h b/drivers/gpu/drm/i915/gvt/mmio.h
index 32cd64ddad26..dbc04ad2c7a1 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.h
+++ b/drivers/gpu/drm/i915/gvt/mmio.h
@@ -65,6 +65,8 @@ struct intel_gvt_mmio_info {
         struct hlist_node node;
 };
 
+int intel_gvt_render_mmio_to_ring_id(struct intel_gvt *gvt,
+                unsigned int reg);
 unsigned long intel_gvt_get_device_type(struct intel_gvt *gvt);
 bool intel_gvt_match_device(struct intel_gvt *gvt, unsigned long device);
 
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 3ac1dc97a7a0..69f8f0d155b9 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -131,6 +131,20 @@ static inline bool is_gvt_request(struct drm_i915_gem_request *req)
         return i915_gem_context_force_single_submission(req->ctx);
 }
 
+static void save_ring_hw_state(struct intel_vgpu *vgpu, int ring_id)
+{
+        struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
+        u32 ring_base = dev_priv->engine[ring_id]->mmio_base;
+        i915_reg_t reg;
+
+        reg = RING_INSTDONE(ring_base);
+        vgpu_vreg(vgpu, i915_mmio_reg_offset(reg)) = I915_READ_FW(reg);
+        reg = RING_ACTHD(ring_base);
+        vgpu_vreg(vgpu, i915_mmio_reg_offset(reg)) = I915_READ_FW(reg);
+        reg = RING_ACTHD_UDW(ring_base);
+        vgpu_vreg(vgpu, i915_mmio_reg_offset(reg)) = I915_READ_FW(reg);
+}
+
 static int shadow_context_status_change(struct notifier_block *nb,
                 unsigned long action, void *data)
 {
@@ -175,9 +189,12 @@ static int shadow_context_status_change(struct notifier_block *nb,
                 atomic_set(&workload->shadow_ctx_active, 1);
                 break;
         case INTEL_CONTEXT_SCHEDULE_OUT:
-        case INTEL_CONTEXT_SCHEDULE_PREEMPTED:
+                save_ring_hw_state(workload->vgpu, ring_id);
                 atomic_set(&workload->shadow_ctx_active, 0);
                 break;
+        case INTEL_CONTEXT_SCHEDULE_PREEMPTED:
+                save_ring_hw_state(workload->vgpu, ring_id);
+                break;
         default:
                 WARN_ON(1);
                 return NOTIFY_OK;
@@ -740,6 +757,9 @@ int intel_vgpu_init_gvt_context(struct intel_vgpu *vgpu)
         if (IS_ERR(vgpu->shadow_ctx))
                 return PTR_ERR(vgpu->shadow_ctx);
 
+        if (INTEL_INFO(vgpu->gvt->dev_priv)->has_logical_ring_preemption)
+                vgpu->shadow_ctx->priority = INT_MAX;
+
         vgpu->shadow_ctx->engine[RCS].initialised = true;
 
         bitmap_zero(vgpu->shadow_ctx_desc_updated, I915_NUM_ENGINES);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 54b5d4c582b6..e143004e66d5 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -2368,6 +2368,9 @@ struct drm_i915_private {
          */
         struct workqueue_struct *wq;
 
+        /* ordered wq for modesets */
+        struct workqueue_struct *modeset_wq;
+
         /* Display functions */
         struct drm_i915_display_funcs display;
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 3a140eedfc83..5cfba89ed586 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -330,17 +330,10 @@ int i915_gem_object_unbind(struct drm_i915_gem_object *obj)
          * must wait for all rendering to complete to the object (as unbinding
          * must anyway), and retire the requests.
          */
-        ret = i915_gem_object_wait(obj,
-                                   I915_WAIT_INTERRUPTIBLE |
-                                   I915_WAIT_LOCKED |
-                                   I915_WAIT_ALL,
-                                   MAX_SCHEDULE_TIMEOUT,
-                                   NULL);
+        ret = i915_gem_object_set_to_cpu_domain(obj, false);
         if (ret)
                 return ret;
 
-        i915_gem_retire_requests(to_i915(obj->base.dev));
-
         while ((vma = list_first_entry_or_null(&obj->vma_list,
                                                struct i915_vma,
                                                obj_link))) {
@@ -474,7 +467,7 @@ static void __fence_set_priority(struct dma_fence *fence, int prio)
         struct drm_i915_gem_request *rq;
         struct intel_engine_cs *engine;
 
-        if (!dma_fence_is_i915(fence))
+        if (dma_fence_is_signaled(fence) || !dma_fence_is_i915(fence))
                 return;
 
         rq = to_request(fence);
@@ -4712,17 +4705,19 @@ int i915_gem_suspend(struct drm_i915_private *dev_priv)
          * state. Fortunately, the kernel_context is disposable and we do
          * not rely on its state.
          */
-        ret = i915_gem_switch_to_kernel_context(dev_priv);
-        if (ret)
-                goto err_unlock;
+        if (!i915_terminally_wedged(&dev_priv->gpu_error)) {
+                ret = i915_gem_switch_to_kernel_context(dev_priv);
+                if (ret)
+                        goto err_unlock;
 
-        ret = i915_gem_wait_for_idle(dev_priv,
-                                     I915_WAIT_INTERRUPTIBLE |
-                                     I915_WAIT_LOCKED);
-        if (ret && ret != -EIO)
-                goto err_unlock;
+                ret = i915_gem_wait_for_idle(dev_priv,
+                                             I915_WAIT_INTERRUPTIBLE |
+                                             I915_WAIT_LOCKED);
+                if (ret && ret != -EIO)
+                        goto err_unlock;
 
-        assert_kernel_context_is_current(dev_priv);
+                assert_kernel_context_is_current(dev_priv);
+        }
         i915_gem_contexts_lost(dev_priv);
         mutex_unlock(&dev->struct_mutex);
 
@@ -4946,8 +4941,6 @@ int i915_gem_init(struct drm_i915_private *dev_priv)
 {
         int ret;
 
-        mutex_lock(&dev_priv->drm.struct_mutex);
-
         /*
          * We need to fallback to 4K pages since gvt gtt handling doesn't
          * support huge page entries - we will need to check either hypervisor
@@ -4967,18 +4960,19 @@ int i915_gem_init(struct drm_i915_private *dev_priv)
                 dev_priv->gt.cleanup_engine = intel_logical_ring_cleanup;
         }
 
+        ret = i915_gem_init_userptr(dev_priv);
+        if (ret)
+                return ret;
+
         /* This is just a security blanket to placate dragons.
          * On some systems, we very sporadically observe that the first TLBs
          * used by the CS may be stale, despite us poking the TLB reset. If
          * we hold the forcewake during initialisation these problems
          * just magically go away.
          */
+        mutex_lock(&dev_priv->drm.struct_mutex);
         intel_uncore_forcewake_get(dev_priv, FORCEWAKE_ALL);
 
-        ret = i915_gem_init_userptr(dev_priv);
-        if (ret)
-                goto out_unlock;
-
         ret = i915_gem_init_ggtt(dev_priv);
         if (ret)
                 goto out_unlock;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 68a58cce6ab1..7923dfd9963c 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -2951,9 +2951,6 @@ enum i915_power_well_id {
 #define ILK_DPFC_CHICKEN        _MMIO(0x43224)
 #define   ILK_DPFC_DISABLE_DUMMY0 (1<<8)
 #define   ILK_DPFC_NUKE_ON_ANY_MODIFICATION     (1<<23)
-#define   GLK_SKIP_SEG_EN               (1<<12)
-#define   GLK_SKIP_SEG_COUNT_MASK       (3<<10)
-#define   GLK_SKIP_SEG_COUNT(x)         ((x)<<10)
 #define ILK_FBC_RT_BASE         _MMIO(0x2128)
 #define   ILK_FBC_RT_VALID      (1<<0)
 #define   SNB_FBC_FRONT_BUFFER  (1<<1)
@@ -6980,6 +6977,7 @@ enum {
 #define  RESET_PCH_HANDSHAKE_ENABLE     (1<<4)
 
 #define GEN8_CHICKEN_DCPR_1             _MMIO(0x46430)
+#define   SKL_SELECT_ALTERNATE_DC_EXIT  (1<<30)
 #define   MASK_WAKEMEM                  (1<<13)
 
 #define SKL_DFSM                        _MMIO(0x51000)
@@ -7029,6 +7027,8 @@ enum {
 #define GEN9_SLICE_COMMON_ECO_CHICKEN0          _MMIO(0x7308)
 #define  DISABLE_PIXEL_MASK_CAMMING             (1<<14)
 
+#define GEN9_SLICE_COMMON_ECO_CHICKEN1          _MMIO(0x731c)
+
 #define GEN7_L3SQCREG1                          _MMIO(0xB010)
 #define  VLV_B0_WA_L3SQCREG1_VALUE              0x00D30000
 
@@ -8525,6 +8525,7 @@ enum skl_power_gate {
 #define  BXT_CDCLK_CD2X_DIV_SEL_2       (2<<22)
 #define  BXT_CDCLK_CD2X_DIV_SEL_4       (3<<22)
 #define  BXT_CDCLK_CD2X_PIPE(pipe)      ((pipe)<<20)
+#define  CDCLK_DIVMUX_CD_OVERRIDE       (1<<19)
 #define  BXT_CDCLK_CD2X_PIPE_NONE       BXT_CDCLK_CD2X_PIPE(3)
 #define  BXT_CDCLK_SSA_PRECHARGE_ENABLE (1<<16)
 #define  CDCLK_FREQ_DECIMAL_MASK        (0x7ff)
diff --git a/drivers/gpu/drm/i915/i915_sw_fence.c b/drivers/gpu/drm/i915/i915_sw_fence.c
index e8ca67a129d2..ac236b88c99c 100644
--- a/drivers/gpu/drm/i915/i915_sw_fence.c
+++ b/drivers/gpu/drm/i915/i915_sw_fence.c
@@ -367,6 +367,7 @@ struct i915_sw_dma_fence_cb {
         struct dma_fence *dma;
         struct timer_list timer;
         struct irq_work work;
+        struct rcu_head rcu;
 };
 
 static void timer_i915_sw_fence_wake(struct timer_list *t)
@@ -406,7 +407,7 @@ static void irq_i915_sw_fence_work(struct irq_work *wrk)
         del_timer_sync(&cb->timer);
         dma_fence_put(cb->dma);
 
-        kfree(cb);
+        kfree_rcu(cb, rcu);
 }
 
 int i915_sw_fence_await_dma_fence(struct i915_sw_fence *fence,
diff --git a/drivers/gpu/drm/i915/intel_breadcrumbs.c b/drivers/gpu/drm/i915/intel_breadcrumbs.c
index 5f8b9f1f40f1..bcbc7abe6693 100644
--- a/drivers/gpu/drm/i915/intel_breadcrumbs.c
+++ b/drivers/gpu/drm/i915/intel_breadcrumbs.c
@@ -186,7 +186,7 @@ void intel_engine_disarm_breadcrumbs(struct intel_engine_cs *engine)
         struct intel_wait *wait, *n, *first;
 
         if (!b->irq_armed)
-                return;
+                goto wakeup_signaler;
 
         /* We only disarm the irq when we are idle (all requests completed),
          * so if the bottom-half remains asleep, it missed the request
@@ -208,6 +208,14 @@ void intel_engine_disarm_breadcrumbs(struct intel_engine_cs *engine)
         b->waiters = RB_ROOT;
 
         spin_unlock_irq(&b->rb_lock);
+
+        /*
+         * The signaling thread may be asleep holding a reference to a request,
+         * that had its signaling cancelled prior to being preempted. We need
+         * to kick the signaler, just in case, to release any such reference.
+         */
+wakeup_signaler:
+        wake_up_process(b->signaler);
 }
 
 static bool use_fake_irq(const struct intel_breadcrumbs *b)
@@ -651,23 +659,15 @@ static int intel_breadcrumbs_signaler(void *arg)
                 }
 
                 if (unlikely(do_schedule)) {
-                        DEFINE_WAIT(exec);
-
                         if (kthread_should_park())
                                 kthread_parkme();
 
-                        if (kthread_should_stop()) {
-                                GEM_BUG_ON(request);
+                        if (unlikely(kthread_should_stop())) {
+                                i915_gem_request_put(request);
                                 break;
                         }
 
-                        if (request)
-                                add_wait_queue(&request->execute, &exec);
-
                         schedule();
-
-                        if (request)
-                                remove_wait_queue(&request->execute, &exec);
                 }
                 i915_gem_request_put(request);
         } while (1);
diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c
index b2a6d62b71c0..60cf4e58389a 100644
--- a/drivers/gpu/drm/i915/intel_cdclk.c
+++ b/drivers/gpu/drm/i915/intel_cdclk.c
@@ -860,16 +860,10 @@ static void skl_set_preferred_cdclk_vco(struct drm_i915_private *dev_priv,
 
 static void skl_dpll0_enable(struct drm_i915_private *dev_priv, int vco)
 {
-        int min_cdclk = skl_calc_cdclk(0, vco);
         u32 val;
 
         WARN_ON(vco != 8100000 && vco != 8640000);
 
-        /* select the minimum CDCLK before enabling DPLL 0 */
-        val = CDCLK_FREQ_337_308 | skl_cdclk_decimal(min_cdclk);
-        I915_WRITE(CDCLK_CTL, val);
-        POSTING_READ(CDCLK_CTL);
-
         /*
          * We always enable DPLL0 with the lowest link rate possible, but still
          * taking into account the VCO required to operate the eDP panel at the
@@ -923,7 +917,7 @@ static void skl_set_cdclk(struct drm_i915_private *dev_priv,
 {
         int cdclk = cdclk_state->cdclk;
         int vco = cdclk_state->vco;
-        u32 freq_select, pcu_ack;
+        u32 freq_select, pcu_ack, cdclk_ctl;
         int ret;
 
         WARN_ON((cdclk == 24000) != (vco == 0));
@@ -940,7 +934,7 @@ static void skl_set_cdclk(struct drm_i915_private *dev_priv,
                 return;
         }
 
-        /* set CDCLK_CTL */
+        /* Choose frequency for this cdclk */
         switch (cdclk) {
         case 450000:
         case 432000:
@@ -968,10 +962,33 @@ static void skl_set_cdclk(struct drm_i915_private *dev_priv,
             dev_priv->cdclk.hw.vco != vco)
                 skl_dpll0_disable(dev_priv);
 
+        cdclk_ctl = I915_READ(CDCLK_CTL);
+
+        if (dev_priv->cdclk.hw.vco != vco) {
+                /* Wa Display #1183: skl,kbl,cfl */
+                cdclk_ctl &= ~(CDCLK_FREQ_SEL_MASK | CDCLK_FREQ_DECIMAL_MASK);
+                cdclk_ctl |= freq_select | skl_cdclk_decimal(cdclk);
+                I915_WRITE(CDCLK_CTL, cdclk_ctl);
+        }
+
+        /* Wa Display #1183: skl,kbl,cfl */
+        cdclk_ctl |= CDCLK_DIVMUX_CD_OVERRIDE;
+        I915_WRITE(CDCLK_CTL, cdclk_ctl);
+        POSTING_READ(CDCLK_CTL);
+
         if (dev_priv->cdclk.hw.vco != vco)
                 skl_dpll0_enable(dev_priv, vco);
 
-        I915_WRITE(CDCLK_CTL, freq_select | skl_cdclk_decimal(cdclk));
+        /* Wa Display #1183: skl,kbl,cfl */
+        cdclk_ctl &= ~(CDCLK_FREQ_SEL_MASK | CDCLK_FREQ_DECIMAL_MASK);
+        I915_WRITE(CDCLK_CTL, cdclk_ctl);
+
+        cdclk_ctl |= freq_select | skl_cdclk_decimal(cdclk);
+        I915_WRITE(CDCLK_CTL, cdclk_ctl);
+
+        /* Wa Display #1183: skl,kbl,cfl */
+        cdclk_ctl &= ~CDCLK_DIVMUX_CD_OVERRIDE;
+        I915_WRITE(CDCLK_CTL, cdclk_ctl);
         POSTING_READ(CDCLK_CTL);
 
         /* inform PCU of the change */
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 933c18fd4258..58a3755544b2 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -2128,9 +2128,12 @@ static void intel_ddi_clk_select(struct intel_encoder *encoder,
         if (WARN_ON(!pll))
                 return;
 
+         mutex_lock(&dev_priv->dpll_lock);
+
         if (IS_CANNONLAKE(dev_priv)) {
                 /* Configure DPCLKA_CFGCR0 to map the DPLL to the DDI. */
                 val = I915_READ(DPCLKA_CFGCR0);
+                val &= ~DPCLKA_CFGCR0_DDI_CLK_SEL_MASK(port);
                 val |= DPCLKA_CFGCR0_DDI_CLK_SEL(pll->id, port);
                 I915_WRITE(DPCLKA_CFGCR0, val);
 
@@ -2156,6 +2159,8 @@ static void intel_ddi_clk_select(struct intel_encoder *encoder,
         } else if (INTEL_INFO(dev_priv)->gen < 9) {
                 I915_WRITE(PORT_CLK_SEL(port), hsw_pll_to_ddi_pll_sel(pll));
         }
+
+        mutex_unlock(&dev_priv->dpll_lock);
 }
 
 static void intel_ddi_clk_disable(struct intel_encoder *encoder)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 878acc432a4b..50f8443641b8 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1000,7 +1000,8 @@ enum transcoder intel_pipe_to_cpu_transcoder(struct drm_i915_private *dev_priv,
         return crtc->config->cpu_transcoder;
 }
 
-static bool pipe_dsl_stopped(struct drm_i915_private *dev_priv, enum pipe pipe)
+static bool pipe_scanline_is_moving(struct drm_i915_private *dev_priv,
+                                    enum pipe pipe)
 {
         i915_reg_t reg = PIPEDSL(pipe);
         u32 line1, line2;
@@ -1015,7 +1016,28 @@ static bool pipe_dsl_stopped(struct drm_i915_private *dev_priv, enum pipe pipe)
         msleep(5);
         line2 = I915_READ(reg) & line_mask;
 
-        return line1 == line2;
+        return line1 != line2;
+}
+
+static void wait_for_pipe_scanline_moving(struct intel_crtc *crtc, bool state)
+{
+        struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
+        enum pipe pipe = crtc->pipe;
+
+        /* Wait for the display line to settle/start moving */
+        if (wait_for(pipe_scanline_is_moving(dev_priv, pipe) == state, 100))
+                DRM_ERROR("pipe %c scanline %s wait timed out\n",
+                          pipe_name(pipe), onoff(state));
+}
+
+static void intel_wait_for_pipe_scanline_stopped(struct intel_crtc *crtc)
+{
+        wait_for_pipe_scanline_moving(crtc, false);
+}
+
+static void intel_wait_for_pipe_scanline_moving(struct intel_crtc *crtc)
+{
+        wait_for_pipe_scanline_moving(crtc, true);
 }
 
 /*
@@ -1038,7 +1060,6 @@ static void intel_wait_for_pipe_off(struct intel_crtc *crtc)
 {
         struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
         enum transcoder cpu_transcoder = crtc->config->cpu_transcoder;
-        enum pipe pipe = crtc->pipe;
 
         if (INTEL_GEN(dev_priv) >= 4) {
                 i915_reg_t reg = PIPECONF(cpu_transcoder);
@@ -1049,9 +1070,7 @@ static void intel_wait_for_pipe_off(struct intel_crtc *crtc)
                                             100))
                         WARN(1, "pipe_off wait timed out\n");
         } else {
-                /* Wait for the display line to settle */
-                if (wait_for(pipe_dsl_stopped(dev_priv, pipe), 100))
-                        WARN(1, "pipe_off wait timed out\n");
+                intel_wait_for_pipe_scanline_stopped(crtc);
         }
 }
 
@@ -1192,23 +1211,6 @@ void assert_panel_unlocked(struct drm_i915_private *dev_priv, enum pipe pipe)
              pipe_name(pipe));
 }
 
-static void assert_cursor(struct drm_i915_private *dev_priv,
-                          enum pipe pipe, bool state)
-{
-        bool cur_state;
-
-        if (IS_I845G(dev_priv) || IS_I865G(dev_priv))
-                cur_state = I915_READ(CURCNTR(PIPE_A)) & CURSOR_ENABLE;
-        else
-                cur_state = I915_READ(CURCNTR(pipe)) & CURSOR_MODE;
-
-        I915_STATE_WARN(cur_state != state,
-             "cursor on pipe %c assertion failure (expected %s, current %s)\n",
-                        pipe_name(pipe), onoff(state), onoff(cur_state));
-}
-#define assert_cursor_enabled(d, p) assert_cursor(d, p, true)
-#define assert_cursor_disabled(d, p) assert_cursor(d, p, false)
-
 void assert_pipe(struct drm_i915_private *dev_priv,
                  enum pipe pipe, bool state)
 {
@@ -1236,77 +1238,25 @@ void assert_pipe(struct drm_i915_private *dev_priv,
                         pipe_name(pipe), onoff(state), onoff(cur_state));
 }
 
-static void assert_plane(struct drm_i915_private *dev_priv,
-                         enum plane plane, bool state)
+static void assert_plane(struct intel_plane *plane, bool state)
 {
-        u32 val;
-        bool cur_state;
+        bool cur_state = plane->get_hw_state(plane);
 
-        val = I915_READ(DSPCNTR(plane));
-        cur_state = !!(val & DISPLAY_PLANE_ENABLE);
         I915_STATE_WARN(cur_state != state,
-             "plane %c assertion failure (expected %s, current %s)\n",
-                        plane_name(plane), onoff(state), onoff(cur_state));
+                        "%s assertion failure (expected %s, current %s)\n",
+                        plane->base.name, onoff(state), onoff(cur_state));
 }
 
-#define assert_plane_enabled(d, p) assert_plane(d, p, true)
-#define assert_plane_disabled(d, p) assert_plane(d, p, false)
+#define assert_plane_enabled(p) assert_plane(p, true)
+#define assert_plane_disabled(p) assert_plane(p, false)
 
-static void assert_planes_disabled(struct drm_i915_private *dev_priv,
-                                   enum pipe pipe)
+static void assert_planes_disabled(struct intel_crtc *crtc)
 {
-        int i;
-
-        /* Primary planes are fixed to pipes on gen4+ */
-        if (INTEL_GEN(dev_priv) >= 4) {
-                u32 val = I915_READ(DSPCNTR(pipe));
-                I915_STATE_WARN(val & DISPLAY_PLANE_ENABLE,
-                     "plane %c assertion failure, should be disabled but not\n",
-                     plane_name(pipe));
-                return;
-        }
-
-        /* Need to check both planes against the pipe */
-        for_each_pipe(dev_priv, i) {
-                u32 val = I915_READ(DSPCNTR(i));
-                enum pipe cur_pipe = (val & DISPPLANE_SEL_PIPE_MASK) >>
-                        DISPPLANE_SEL_PIPE_SHIFT;
-                I915_STATE_WARN((val & DISPLAY_PLANE_ENABLE) && pipe == cur_pipe,
-                     "plane %c assertion failure, should be off on pipe %c but is still active\n",
-                     plane_name(i), pipe_name(pipe));
-        }
-}
-
-static void assert_sprites_disabled(struct drm_i915_private *dev_priv,
-                                    enum pipe pipe)
-{
-        int sprite;
+        struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
+        struct intel_plane *plane;
 
-        if (INTEL_GEN(dev_priv) >= 9) {
-                for_each_sprite(dev_priv, pipe, sprite) {
-                        u32 val = I915_READ(PLANE_CTL(pipe, sprite));
-                        I915_STATE_WARN(val & PLANE_CTL_ENABLE,
-                             "plane %d assertion failure, should be off on pipe %c but is still active\n",
-                             sprite, pipe_name(pipe));
-                }
-        } else if (IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv)) {
-                for_each_sprite(dev_priv, pipe, sprite) {
-                        u32 val = I915_READ(SPCNTR(pipe, PLANE_SPRITE0 + sprite));
-                        I915_STATE_WARN(val & SP_ENABLE,
-                             "sprite %c assertion failure, should be off on pipe %c but is still active\n",
-                             sprite_name(pipe, sprite), pipe_name(pipe));
-                }
-        } else if (INTEL_GEN(dev_priv) >= 7) {
-                u32 val = I915_READ(SPRCTL(pipe));
-                I915_STATE_WARN(val & SPRITE_ENABLE,
-                     "sprite %c assertion failure, should be off on pipe %c but is still active\n",
-                     plane_name(pipe), pipe_name(pipe));
-        } else if (INTEL_GEN(dev_priv) >= 5 || IS_G4X(dev_priv)) {
-                u32 val = I915_READ(DVSCNTR(pipe));
-                I915_STATE_WARN(val & DVS_ENABLE,
-                     "sprite %c assertion failure, should be off on pipe %c but is still active\n",
-                     plane_name(pipe), pipe_name(pipe));
-        }
+        for_each_intel_plane_on_crtc(&dev_priv->drm, crtc, plane)
+                assert_plane_disabled(plane);
 }
 
 static void assert_vblank_disabled(struct drm_crtc *crtc)
@@ -1899,9 +1849,7 @@ static void intel_enable_pipe(struct intel_crtc *crtc)
 
         DRM_DEBUG_KMS("enabling pipe %c\n", pipe_name(pipe));
 
-        assert_planes_disabled(dev_priv, pipe);
-        assert_cursor_disabled(dev_priv, pipe);
-        assert_sprites_disabled(dev_priv, pipe);
+        assert_planes_disabled(crtc);
 
         /*
          * A pipe without a PLL won't actually be able to drive bits from
@@ -1936,15 +1884,14 @@ static void intel_enable_pipe(struct intel_crtc *crtc)
         POSTING_READ(reg);
 
         /*
-         * Until the pipe starts DSL will read as 0, which would cause
-         * an apparent vblank timestamp jump, which messes up also the
-         * frame count when it's derived from the timestamps. So let's
-         * wait for the pipe to start properly before we call
-         * drm_crtc_vblank_on()
+         * Until the pipe starts PIPEDSL reads will return a stale value,
+         * which causes an apparent vblank timestamp jump when PIPEDSL
+         * resets to its proper value. That also messes up the frame count
+         * when it's derived from the timestamps. So let's wait for the
+         * pipe to start properly before we call drm_crtc_vblank_on()
          */
-        if (dev->max_vblank_count == 0 &&
-            wait_for(intel_get_crtc_scanline(crtc) != crtc->scanline_offset, 50))
-                DRM_ERROR("pipe %c didn't start\n", pipe_name(pipe));
+        if (dev->max_vblank_count == 0)
+                intel_wait_for_pipe_scanline_moving(crtc);
 }
 
 /**
@@ -1971,9 +1918,7 @@ static void intel_disable_pipe(struct intel_crtc *crtc)
          * Make sure planes won't keep trying to pump pixels to us,
          * or we might hang the display.
          */
-        assert_planes_disabled(dev_priv, pipe);
-        assert_cursor_disabled(dev_priv, pipe);
-        assert_sprites_disabled(dev_priv, pipe);
+        assert_planes_disabled(crtc);
 
         reg = PIPECONF(cpu_transcoder);
         val = I915_READ(reg);
@@ -2802,6 +2747,23 @@ intel_set_plane_visible(struct intel_crtc_state *crtc_state,
                       crtc_state->active_planes);
 }
 
+static void intel_plane_disable_noatomic(struct intel_crtc *crtc,
+                                         struct intel_plane *plane)
+{
+        struct intel_crtc_state *crtc_state =
+                to_intel_crtc_state(crtc->base.state);
+        struct intel_plane_state *plane_state =
+                to_intel_plane_state(plane->base.state);
+
+        intel_set_plane_visible(crtc_state, plane_state, false);
+
+        if (plane->id == PLANE_PRIMARY)
+                intel_pre_disable_primary_noatomic(&crtc->base);
+
+        trace_intel_disable_plane(&plane->base, crtc);
+        plane->disable_plane(plane, crtc);
+}
+
 static void
 intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
                              struct intel_initial_plane_config *plane_config)
@@ -2859,12 +2821,7 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
          * simplest solution is to just disable the primary plane now and
          * pretend the BIOS never had it enabled.
          */
-        intel_set_plane_visible(to_intel_crtc_state(crtc_state),
-                                to_intel_plane_state(plane_state),
-                                false);
-        intel_pre_disable_primary_noatomic(&intel_crtc->base);
-        trace_intel_disable_plane(primary, intel_crtc);
-        intel_plane->disable_plane(intel_plane, intel_crtc);
+        intel_plane_disable_noatomic(intel_crtc, intel_plane);
 
         return;
 
@@ -3367,6 +3324,31 @@ static void i9xx_disable_primary_plane(struct intel_plane *primary,
         spin_unlock_irqrestore(&dev_priv->uncore.lock, irqflags);
 }
 
+static bool i9xx_plane_get_hw_state(struct intel_plane *primary)
+{
+
+        struct drm_i915_private *dev_priv = to_i915(primary->base.dev);
+        enum intel_display_power_domain power_domain;
+        enum plane plane = primary->plane;
+        enum pipe pipe = primary->pipe;
+        bool ret;
+
+        /*
+         * Not 100% correct for planes that can move between pipes,
+         * but that's only the case for gen2-4 which don't have any
+         * display power wells.
+         */
+        power_domain = POWER_DOMAIN_PIPE(pipe);
+        if (!intel_display_power_get_if_enabled(dev_priv, power_domain))
+                return false;
+
+        ret = I915_READ(DSPCNTR(plane)) & DISPLAY_PLANE_ENABLE;
+
+        intel_display_power_put(dev_priv, power_domain);
+
+        return ret;
+}
+
 static u32
 intel_fb_stride_alignment(const struct drm_framebuffer *fb, int plane)
 {
@@ -4848,7 +4830,8 @@ void hsw_enable_ips(struct intel_crtc *crtc)
          * a vblank wait.
          */
 
-        assert_plane_enabled(dev_priv, crtc->plane);
+        assert_plane_enabled(to_intel_plane(crtc->base.primary));
+
         if (IS_BROADWELL(dev_priv)) {
                 mutex_lock(&dev_priv->pcu_lock);
                 WARN_ON(sandybridge_pcode_write(dev_priv, DISPLAY_IPS_CONTROL,
@@ -4881,7 +4864,8 @@ void hsw_disable_ips(struct intel_crtc *crtc)
         if (!crtc->config->ips_enabled)
                 return;
 
-        assert_plane_enabled(dev_priv, crtc->plane);
+        assert_plane_enabled(to_intel_plane(crtc->base.primary));
+
         if (IS_BROADWELL(dev_priv)) {
                 mutex_lock(&dev_priv->pcu_lock);
                 WARN_ON(sandybridge_pcode_write(dev_priv, DISPLAY_IPS_CONTROL, 0));
@@ -5881,6 +5865,7 @@ static void intel_crtc_disable_noatomic(struct drm_crtc *crtc,
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         struct drm_i915_private *dev_priv = to_i915(crtc->dev);
         enum intel_display_power_domain domain;
+        struct intel_plane *plane;
         u64 domains;
         struct drm_atomic_state *state;
         struct intel_crtc_state *crtc_state;
@@ -5889,11 +5874,12 @@ static void intel_crtc_disable_noatomic(struct drm_crtc *crtc,
         if (!intel_crtc->active)
                 return;
 
-        if (crtc->primary->state->visible) {
-                intel_pre_disable_primary_noatomic(crtc);
+        for_each_intel_plane_on_crtc(&dev_priv->drm, intel_crtc, plane) {
+                const struct intel_plane_state *plane_state =
+                        to_intel_plane_state(plane->base.state);
 
-                intel_crtc_disable_planes(crtc, 1 << drm_plane_index(crtc->primary));
-                crtc->primary->state->visible = false;
+                if (plane_state->base.visible)
+                        intel_plane_disable_noatomic(intel_crtc, plane);
         }
 
         state = drm_atomic_state_alloc(crtc->dev);
@@ -9459,6 +9445,23 @@ static void i845_disable_cursor(struct intel_plane *plane,
         i845_update_cursor(plane, NULL, NULL);
 }
 
+static bool i845_cursor_get_hw_state(struct intel_plane *plane)
+{
+        struct drm_i915_private *dev_priv = to_i915(plane->base.dev);
+        enum intel_display_power_domain power_domain;
+        bool ret;
+
+        power_domain = POWER_DOMAIN_PIPE(PIPE_A);
+        if (!intel_display_power_get_if_enabled(dev_priv, power_domain))
+                return false;
+
+        ret = I915_READ(CURCNTR(PIPE_A)) & CURSOR_ENABLE;
+
+        intel_display_power_put(dev_priv, power_domain);
+
+        return ret;
+}
+
 static u32 i9xx_cursor_ctl(const struct intel_crtc_state *crtc_state,
                            const struct intel_plane_state *plane_state)
 {
@@ -9652,6 +9655,28 @@ static void i9xx_disable_cursor(struct intel_plane *plane,
         i9xx_update_cursor(plane, NULL, NULL);
 }
 
+static bool i9xx_cursor_get_hw_state(struct intel_plane *plane)
+{
+        struct drm_i915_private *dev_priv = to_i915(plane->base.dev);
+        enum intel_display_power_domain power_domain;
+        enum pipe pipe = plane->pipe;
+        bool ret;
+
+        /*
+         * Not 100% correct for planes that can move between pipes,
+         * but that's only the case for gen2-3 which don't have any
+         * display power wells.
+         */
+        power_domain = POWER_DOMAIN_PIPE(pipe);
+        if (!intel_display_power_get_if_enabled(dev_priv, power_domain))
+                return false;
+
+        ret = I915_READ(CURCNTR(pipe)) & CURSOR_MODE;
+
+        intel_display_power_put(dev_priv, power_domain);
+
+        return ret;
+}
 
 /* VESA 640x480x72Hz mode to set on the pipe */
 static const struct drm_display_mode load_detect_mode = {
@@ -9926,11 +9951,10 @@ found:
         }
 
         ret = intel_modeset_setup_plane_state(state, crtc, mode, fb, 0, 0);
+        drm_framebuffer_put(fb);
         if (ret)
                 goto fail;
 
-        drm_framebuffer_put(fb);
-
         ret = drm_atomic_set_mode_for_crtc(&crtc_state->base, mode);
         if (ret)
                 goto fail;
@@ -12527,11 +12551,15 @@ static int intel_atomic_commit(struct drm_device *dev,
         INIT_WORK(&state->commit_work, intel_atomic_commit_work);
 
         i915_sw_fence_commit(&intel_state->commit_ready);
-        if (nonblock)
+        if (nonblock && intel_state->modeset) {
+                queue_work(dev_priv->modeset_wq, &state->commit_work);
+        } else if (nonblock) {
                 queue_work(system_unbound_wq, &state->commit_work);
-        else
+        } else {
+                if (intel_state->modeset)
+                        flush_workqueue(dev_priv->modeset_wq);
                 intel_atomic_commit_tail(state);
-
+        }
 
         return 0;
 }
@@ -13177,13 +13205,14 @@ intel_primary_plane_create(struct drm_i915_private *dev_priv, enum pipe pipe)
         primary->frontbuffer_bit = INTEL_FRONTBUFFER_PRIMARY(pipe);
         primary->check_plane = intel_check_primary_plane;
 
-        if (INTEL_GEN(dev_priv) >= 10 || IS_GEMINILAKE(dev_priv)) {
+        if (INTEL_GEN(dev_priv) >= 10) {
                 intel_primary_formats = skl_primary_formats;
                 num_formats = ARRAY_SIZE(skl_primary_formats);
                 modifiers = skl_format_modifiers_ccs;
 
                 primary->update_plane = skl_update_plane;
                 primary->disable_plane = skl_disable_plane;
+                primary->get_hw_state = skl_plane_get_hw_state;
         } else if (INTEL_GEN(dev_priv) >= 9) {
                 intel_primary_formats = skl_primary_formats;
                 num_formats = ARRAY_SIZE(skl_primary_formats);
@@ -13194,6 +13223,7 @@ intel_primary_plane_create(struct drm_i915_private *dev_priv, enum pipe pipe)
 
                 primary->update_plane = skl_update_plane;
                 primary->disable_plane = skl_disable_plane;
+                primary->get_hw_state = skl_plane_get_hw_state;
         } else if (INTEL_GEN(dev_priv) >= 4) {
                 intel_primary_formats = i965_primary_formats;
                 num_formats = ARRAY_SIZE(i965_primary_formats);
@@ -13201,6 +13231,7 @@ intel_primary_plane_create(struct drm_i915_private *dev_priv, enum pipe pipe)
 
                 primary->update_plane = i9xx_update_primary_plane;
                 primary->disable_plane = i9xx_disable_primary_plane;
+                primary->get_hw_state = i9xx_plane_get_hw_state;
         } else {
                 intel_primary_formats = i8xx_primary_formats;
                 num_formats = ARRAY_SIZE(i8xx_primary_formats);
@@ -13208,6 +13239,7 @@ intel_primary_plane_create(struct drm_i915_private *dev_priv, enum pipe pipe)
 
                 primary->update_plane = i9xx_update_primary_plane;
                 primary->disable_plane = i9xx_disable_primary_plane;
+                primary->get_hw_state = i9xx_plane_get_hw_state;
         }
 
         if (INTEL_GEN(dev_priv) >= 9)
@@ -13297,10 +13329,12 @@ intel_cursor_plane_create(struct drm_i915_private *dev_priv,
         if (IS_I845G(dev_priv) || IS_I865G(dev_priv)) {
                 cursor->update_plane = i845_update_cursor;
                 cursor->disable_plane = i845_disable_cursor;
+                cursor->get_hw_state = i845_cursor_get_hw_state;
                 cursor->check_plane = i845_check_cursor;
         } else {
                 cursor->update_plane = i9xx_update_cursor;
                 cursor->disable_plane = i9xx_disable_cursor;
+                cursor->get_hw_state = i9xx_cursor_get_hw_state;
                 cursor->check_plane = i9xx_check_cursor;
         }
 
@@ -14445,6 +14479,8 @@ int intel_modeset_init(struct drm_device *dev)
         enum pipe pipe;
         struct intel_crtc *crtc;
 
+        dev_priv->modeset_wq = alloc_ordered_workqueue("i915_modeset", 0);
+
         drm_mode_config_init(dev);
 
         dev->mode_config.min_width = 0;
@@ -14643,38 +14679,56 @@ void i830_enable_pipe(struct drm_i915_private *dev_priv, enum pipe pipe)
 
 void i830_disable_pipe(struct drm_i915_private *dev_priv, enum pipe pipe)
 {
+        struct intel_crtc *crtc = intel_get_crtc_for_pipe(dev_priv, pipe);
+
         DRM_DEBUG_KMS("disabling pipe %c due to force quirk\n",
                       pipe_name(pipe));
 
-        assert_plane_disabled(dev_priv, PLANE_A);
-        assert_plane_disabled(dev_priv, PLANE_B);
+        WARN_ON(I915_READ(DSPCNTR(PLANE_A)) & DISPLAY_PLANE_ENABLE);
+        WARN_ON(I915_READ(DSPCNTR(PLANE_B)) & DISPLAY_PLANE_ENABLE);
+        WARN_ON(I915_READ(DSPCNTR(PLANE_C)) & DISPLAY_PLANE_ENABLE);
+        WARN_ON(I915_READ(CURCNTR(PIPE_A)) & CURSOR_MODE);
+        WARN_ON(I915_READ(CURCNTR(PIPE_B)) & CURSOR_MODE);
 
         I915_WRITE(PIPECONF(pipe), 0);
         POSTING_READ(PIPECONF(pipe));
 
-        if (wait_for(pipe_dsl_stopped(dev_priv, pipe), 100))
-                DRM_ERROR("pipe %c off wait timed out\n", pipe_name(pipe));
+        intel_wait_for_pipe_scanline_stopped(crtc);
 
         I915_WRITE(DPLL(pipe), DPLL_VGA_MODE_DIS);
         POSTING_READ(DPLL(pipe));
 }
 
-static bool
-intel_check_plane_mapping(struct intel_crtc *crtc)
+static bool intel_plane_mapping_ok(struct intel_crtc *crtc,
+                                   struct intel_plane *primary)
 {
         struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
-        u32 val;
+        enum plane plane = primary->plane;
+        u32 val = I915_READ(DSPCNTR(plane));
 
-        if (INTEL_INFO(dev_priv)->num_pipes == 1)
-                return true;
+        return (val & DISPLAY_PLANE_ENABLE) == 0 ||
+                (val & DISPPLANE_SEL_PIPE_MASK) == DISPPLANE_SEL_PIPE(crtc->pipe);
+}
 
-        val = I915_READ(DSPCNTR(!crtc->plane));
+static void
+intel_sanitize_plane_mapping(struct drm_i915_private *dev_priv)
+{
+        struct intel_crtc *crtc;
 
-        if ((val & DISPLAY_PLANE_ENABLE) &&
-            (!!(val & DISPPLANE_SEL_PIPE_MASK) == crtc->pipe))
-                return false;
+        if (INTEL_GEN(dev_priv) >= 4)
+                return;
 
-        return true;
+        for_each_intel_crtc(&dev_priv->drm, crtc) {
+                struct intel_plane *plane =
+                        to_intel_plane(crtc->base.primary);
+
+                if (intel_plane_mapping_ok(crtc, plane))
+                        continue;
+
+                DRM_DEBUG_KMS("%s attached to the wrong pipe, disabling plane\n",
+                              plane->base.name);
+                intel_plane_disable_noatomic(crtc, plane);
+        }
 }
 
 static bool intel_crtc_has_encoders(struct intel_crtc *crtc)
@@ -14730,33 +14784,15 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc,
 
                 /* Disable everything but the primary plane */
                 for_each_intel_plane_on_crtc(dev, crtc, plane) {
-                        if (plane->base.type == DRM_PLANE_TYPE_PRIMARY)
-                                continue;
+                        const struct intel_plane_state *plane_state =
+                                to_intel_plane_state(plane->base.state);
 
-                        trace_intel_disable_plane(&plane->base, crtc);
-                        plane->disable_plane(plane, crtc);
+                        if (plane_state->base.visible &&
+                            plane->base.type != DRM_PLANE_TYPE_PRIMARY)
+                                intel_plane_disable_noatomic(crtc, plane);
                 }
         }
 
-        /* We need to sanitize the plane -> pipe mapping first because this will
-         * disable the crtc (and hence change the state) if it is wrong. Note
-         * that gen4+ has a fixed plane -> pipe mapping.  */
-        if (INTEL_GEN(dev_priv) < 4 && !intel_check_plane_mapping(crtc)) {
-                bool plane;
-
-                DRM_DEBUG_KMS("[CRTC:%d:%s] wrong plane connection detected!\n",
-                              crtc->base.base.id, crtc->base.name);
-
-                /* Pipe has the wrong plane attached and the plane is active.
-                 * Temporarily change the plane mapping and disable everything
-                 * ...  */
-                plane = crtc->plane;
-                crtc->base.primary->state->visible = true;
-                crtc->plane = !plane;
-                intel_crtc_disable_noatomic(&crtc->base, ctx);
-                crtc->plane = plane;
-        }
-
         /* Adjust the state of the output pipe according to whether we
          * have active connectors/encoders. */
         if (crtc->active && !intel_crtc_has_encoders(crtc))
@@ -14861,24 +14897,21 @@ void i915_redisable_vga(struct drm_i915_private *dev_priv)
         intel_display_power_put(dev_priv, POWER_DOMAIN_VGA);
 }
 
-static bool primary_get_hw_state(struct intel_plane *plane)
-{
-        struct drm_i915_private *dev_priv = to_i915(plane->base.dev);
-
-        return I915_READ(DSPCNTR(plane->plane)) & DISPLAY_PLANE_ENABLE;
-}
-
 /* FIXME read out full plane state for all planes */
 static void readout_plane_state(struct intel_crtc *crtc)
 {
-        struct intel_plane *primary = to_intel_plane(crtc->base.primary);
-        bool visible;
+        struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
+        struct intel_crtc_state *crtc_state =
+                to_intel_crtc_state(crtc->base.state);
+        struct intel_plane *plane;
 
-        visible = crtc->active && primary_get_hw_state(primary);
+        for_each_intel_plane_on_crtc(&dev_priv->drm, crtc, plane) {
+                struct intel_plane_state *plane_state =
+                        to_intel_plane_state(plane->base.state);
+                bool visible = plane->get_hw_state(plane);
 
-        intel_set_plane_visible(to_intel_crtc_state(crtc->base.state),
-                                to_intel_plane_state(primary->base.state),
-                                visible);
+                intel_set_plane_visible(crtc_state, plane_state, visible);
+        }
 }
 
 static void intel_modeset_readout_hw_state(struct drm_device *dev)
@@ -15076,6 +15109,8 @@ intel_modeset_setup_hw_state(struct drm_device *dev,
         /* HW state is read out, now we need to sanitize this mess. */
         get_encoder_power_domains(dev_priv);
 
+        intel_sanitize_plane_mapping(dev_priv);
+
         for_each_intel_encoder(dev, encoder) {
                 intel_sanitize_encoder(encoder);
         }
@@ -15252,6 +15287,8 @@ void intel_modeset_cleanup(struct drm_device *dev)
         intel_cleanup_gt_powersave(dev_priv);
 
         intel_teardown_gmbus(dev_priv);
+
+        destroy_workqueue(dev_priv->modeset_wq);
 }
 
 void intel_connector_attach_encoder(struct intel_connector *connector,
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 6c7f8bca574e..5d77f75a9f9c 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -862,6 +862,7 @@ struct intel_plane {
                              const struct intel_plane_state *plane_state);
         void (*disable_plane)(struct intel_plane *plane,
                               struct intel_crtc *crtc);
+        bool (*get_hw_state)(struct intel_plane *plane);
         int (*check_plane)(struct intel_plane *plane,
                            struct intel_crtc_state *crtc_state,
                            struct intel_plane_state *state);
@@ -1924,6 +1925,7 @@ void skl_update_plane(struct intel_plane *plane,
                       const struct intel_crtc_state *crtc_state,
                       const struct intel_plane_state *plane_state);
 void skl_disable_plane(struct intel_plane *plane, struct intel_crtc *crtc);
+bool skl_plane_get_hw_state(struct intel_plane *plane);
 
 /* intel_tv.c */
 void intel_tv_init(struct drm_i915_private *dev_priv);
diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index ab5bf4e2e28e..6074e04dc99f 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -1390,6 +1390,11 @@ static int glk_init_workarounds(struct intel_engine_cs *engine)
         if (ret)
                 return ret;
 
+        /* WA #0862: Userspace has to set "Barrier Mode" to avoid hangs. */
+        ret = wa_ring_whitelist_reg(engine, GEN9_SLICE_COMMON_ECO_CHICKEN1);
+        if (ret)
+                return ret;
+
         /* WaToEnableHwFixForPushConstHWBug:glk */
         WA_SET_BIT_MASKED(COMMON_SLICE_CHICKEN2,
                           GEN8_SBE_DISABLE_REPLAY_BUF_OPTIMIZATION);
diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c
index 3bf65288ffff..5809b29044fc 100644
--- a/drivers/gpu/drm/i915/intel_lpe_audio.c
+++ b/drivers/gpu/drm/i915/intel_lpe_audio.c
@@ -193,7 +193,7 @@ static bool lpe_audio_detect(struct drm_i915_private *dev_priv)
                 };
 
                 if (!pci_dev_present(atom_hdaudio_ids)) {
-                        DRM_INFO("%s\n", "HDaudio controller not detected, using LPE audio instead\n");
+                        DRM_INFO("HDaudio controller not detected, using LPE audio instead\n");
                         lpe_present = true;
                 }
         }
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index d36e25607435..e71a8cd50498 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -974,6 +974,9 @@ static void execlists_schedule(struct drm_i915_gem_request *request, int prio)
 
         GEM_BUG_ON(prio == I915_PRIORITY_INVALID);
 
+        if (i915_gem_request_completed(request))
+                return;
+
         if (prio <= READ_ONCE(request->priotree.priority))
                 return;
 
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index f4a4e9496893..f0d0dbab4150 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -124,7 +124,6 @@ static void bxt_init_clock_gating(struct drm_i915_private *dev_priv)
 
 static void glk_init_clock_gating(struct drm_i915_private *dev_priv)
 {
-        u32 val;
         gen9_init_clock_gating(dev_priv);
 
         /*
@@ -144,11 +143,6 @@ static void glk_init_clock_gating(struct drm_i915_private *dev_priv)
                 I915_WRITE(CHICKEN_MISC_2, val);
         }
 
-        /* Display WA #1133: WaFbcSkipSegments:glk */
-        val = I915_READ(ILK_DPFC_CHICKEN);
-        val &= ~GLK_SKIP_SEG_COUNT_MASK;
-        val |= GLK_SKIP_SEG_EN | GLK_SKIP_SEG_COUNT(1);
-        I915_WRITE(ILK_DPFC_CHICKEN, val);
 }
 
 static void i915_pineview_get_mem_freq(struct drm_i915_private *dev_priv)
@@ -8517,7 +8511,6 @@ static void cnp_init_clock_gating(struct drm_i915_private *dev_priv)
 
 static void cnl_init_clock_gating(struct drm_i915_private *dev_priv)
 {
-        u32 val;
         cnp_init_clock_gating(dev_priv);
 
         /* This is not an Wa. Enable for better image quality */
@@ -8537,12 +8530,6 @@ static void cnl_init_clock_gating(struct drm_i915_private *dev_priv)
                 I915_WRITE(SLICE_UNIT_LEVEL_CLKGATE,
                            I915_READ(SLICE_UNIT_LEVEL_CLKGATE) |
                            SARBUNIT_CLKGATE_DIS);
-
-        /* Display WA #1133: WaFbcSkipSegments:cnl */
-        val = I915_READ(ILK_DPFC_CHICKEN);
-        val &= ~GLK_SKIP_SEG_COUNT_MASK;
-        val |= GLK_SKIP_SEG_EN | GLK_SKIP_SEG_COUNT(1);
-        I915_WRITE(ILK_DPFC_CHICKEN, val);
 }
 
 static void cfl_init_clock_gating(struct drm_i915_private *dev_priv)
diff --git a/drivers/gpu/drm/i915/intel_psr.c b/drivers/gpu/drm/i915/intel_psr.c
index 6e3b430fccdc..55ea5eb3b7df 100644
--- a/drivers/gpu/drm/i915/intel_psr.c
+++ b/drivers/gpu/drm/i915/intel_psr.c
@@ -590,7 +590,7 @@ static void hsw_psr_disable(struct intel_dp *intel_dp,
         struct drm_i915_private *dev_priv = to_i915(dev);
 
         if (dev_priv->psr.active) {
-                i915_reg_t psr_ctl;
+                i915_reg_t psr_status;
                 u32 psr_status_mask;
 
                 if (dev_priv->psr.aux_frame_sync)
@@ -599,24 +599,24 @@ static void hsw_psr_disable(struct intel_dp *intel_dp,
                                         0);
 
                 if (dev_priv->psr.psr2_support) {
-                        psr_ctl = EDP_PSR2_CTL;
+                        psr_status = EDP_PSR2_STATUS_CTL;
                         psr_status_mask = EDP_PSR2_STATUS_STATE_MASK;
 
-                        I915_WRITE(psr_ctl,
-                                   I915_READ(psr_ctl) &
+                        I915_WRITE(EDP_PSR2_CTL,
+                                   I915_READ(EDP_PSR2_CTL) &
                                    ~(EDP_PSR2_ENABLE | EDP_SU_TRACK_ENABLE));
 
                 } else {
-                        psr_ctl = EDP_PSR_STATUS_CTL;
+                        psr_status = EDP_PSR_STATUS_CTL;
                         psr_status_mask = EDP_PSR_STATUS_STATE_MASK;
 
-                        I915_WRITE(psr_ctl,
-                                   I915_READ(psr_ctl) & ~EDP_PSR_ENABLE);
+                        I915_WRITE(EDP_PSR_CTL,
+                                   I915_READ(EDP_PSR_CTL) & ~EDP_PSR_ENABLE);
                 }
 
                 /* Wait till PSR is idle */
                 if (intel_wait_for_register(dev_priv,
-                                            psr_ctl, psr_status_mask, 0,
+                                            psr_status, psr_status_mask, 0,
                                             2000))
                         DRM_ERROR("Timed out waiting for PSR Idle State\n");
 
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index 8af286c63d3b..7e115f3927f6 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -598,6 +598,11 @@ void gen9_enable_dc5(struct drm_i915_private *dev_priv)
 
         DRM_DEBUG_KMS("Enabling DC5\n");
 
+        /* Wa Display #1183: skl,kbl,cfl */
+        if (IS_GEN9_BC(dev_priv))
+                I915_WRITE(GEN8_CHICKEN_DCPR_1, I915_READ(GEN8_CHICKEN_DCPR_1) |
+                           SKL_SELECT_ALTERNATE_DC_EXIT);
+
         gen9_set_dc_state(dev_priv, DC_STATE_EN_UPTO_DC5);
 }
 
@@ -625,6 +630,11 @@ void skl_disable_dc6(struct drm_i915_private *dev_priv)
 {
         DRM_DEBUG_KMS("Disabling DC6\n");
 
+        /* Wa Display #1183: skl,kbl,cfl */
+        if (IS_GEN9_BC(dev_priv))
+                I915_WRITE(GEN8_CHICKEN_DCPR_1, I915_READ(GEN8_CHICKEN_DCPR_1) |
+                           SKL_SELECT_ALTERNATE_DC_EXIT);
+
         gen9_set_dc_state(dev_priv, DC_STATE_DISABLE);
 }
 
@@ -1786,6 +1796,7 @@ void intel_display_power_put(struct drm_i915_private *dev_priv,
         GLK_DISPLAY_POWERWELL_2_POWER_DOMAINS |         \
         BIT_ULL(POWER_DOMAIN_MODESET) |                 \
         BIT_ULL(POWER_DOMAIN_AUX_A) |                   \
+        BIT_ULL(POWER_DOMAIN_GMBUS) |                   \
         BIT_ULL(POWER_DOMAIN_INIT))
 
 #define CNL_DISPLAY_POWERWELL_2_POWER_DOMAINS (         \
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 4fcf80ca91dd..4a8a5d918a83 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -329,6 +329,26 @@ skl_disable_plane(struct intel_plane *plane, struct intel_crtc *crtc)
         spin_unlock_irqrestore(&dev_priv->uncore.lock, irqflags);
 }
 
+bool
+skl_plane_get_hw_state(struct intel_plane *plane)
+{
+        struct drm_i915_private *dev_priv = to_i915(plane->base.dev);
+        enum intel_display_power_domain power_domain;
+        enum plane_id plane_id = plane->id;
+        enum pipe pipe = plane->pipe;
+        bool ret;
+
+        power_domain = POWER_DOMAIN_PIPE(pipe);
+        if (!intel_display_power_get_if_enabled(dev_priv, power_domain))
+                return false;
+
+        ret = I915_READ(PLANE_CTL(pipe, plane_id)) & PLANE_CTL_ENABLE;
+
+        intel_display_power_put(dev_priv, power_domain);
+
+        return ret;
+}
+
 static void
 chv_update_csc(struct intel_plane *plane, uint32_t format)
 {
@@ -506,6 +526,26 @@ vlv_disable_plane(struct intel_plane *plane, struct intel_crtc *crtc)
         spin_unlock_irqrestore(&dev_priv->uncore.lock, irqflags);
 }
 
+static bool
+vlv_plane_get_hw_state(struct intel_plane *plane)
+{
+        struct drm_i915_private *dev_priv = to_i915(plane->base.dev);
+        enum intel_display_power_domain power_domain;
+        enum plane_id plane_id = plane->id;
+        enum pipe pipe = plane->pipe;
+        bool ret;
+
+        power_domain = POWER_DOMAIN_PIPE(pipe);
+        if (!intel_display_power_get_if_enabled(dev_priv, power_domain))
+                return false;
+
+        ret = I915_READ(SPCNTR(pipe, plane_id)) & SP_ENABLE;
+
+        intel_display_power_put(dev_priv, power_domain);
+
+        return ret;
+}
+
 static u32 ivb_sprite_ctl(const struct intel_crtc_state *crtc_state,
                           const struct intel_plane_state *plane_state)
 {
@@ -646,6 +686,25 @@ ivb_disable_plane(struct intel_plane *plane, struct intel_crtc *crtc)
         spin_unlock_irqrestore(&dev_priv->uncore.lock, irqflags);
 }
 
+static bool
+ivb_plane_get_hw_state(struct intel_plane *plane)
+{
+        struct drm_i915_private *dev_priv = to_i915(plane->base.dev);
+        enum intel_display_power_domain power_domain;
+        enum pipe pipe = plane->pipe;
+        bool ret;
+
+        power_domain = POWER_DOMAIN_PIPE(pipe);
+        if (!intel_display_power_get_if_enabled(dev_priv, power_domain))
+                return false;
+
+        ret =  I915_READ(SPRCTL(pipe)) & SPRITE_ENABLE;
+
+        intel_display_power_put(dev_priv, power_domain);
+
+        return ret;
+}
+
 static u32 g4x_sprite_ctl(const struct intel_crtc_state *crtc_state,
                           const struct intel_plane_state *plane_state)
 {
@@ -777,6 +836,25 @@ g4x_disable_plane(struct intel_plane *plane, struct intel_crtc *crtc)
         spin_unlock_irqrestore(&dev_priv->uncore.lock, irqflags);
 }
 
+static bool
+g4x_plane_get_hw_state(struct intel_plane *plane)
+{
+        struct drm_i915_private *dev_priv = to_i915(plane->base.dev);
+        enum intel_display_power_domain power_domain;
+        enum pipe pipe = plane->pipe;
+        bool ret;
+
+        power_domain = POWER_DOMAIN_PIPE(pipe);
+        if (!intel_display_power_get_if_enabled(dev_priv, power_domain))
+                return false;
+
+        ret = I915_READ(DVSCNTR(pipe)) & DVS_ENABLE;
+
+        intel_display_power_put(dev_priv, power_domain);
+
+        return ret;
+}
+
 static int
 intel_check_sprite_plane(struct intel_plane *plane,
                          struct intel_crtc_state *crtc_state,
@@ -1232,6 +1310,7 @@ intel_sprite_plane_create(struct drm_i915_private *dev_priv,
 
                 intel_plane->update_plane = skl_update_plane;
                 intel_plane->disable_plane = skl_disable_plane;
+                intel_plane->get_hw_state = skl_plane_get_hw_state;
 
                 plane_formats = skl_plane_formats;
                 num_plane_formats = ARRAY_SIZE(skl_plane_formats);
@@ -1242,6 +1321,7 @@ intel_sprite_plane_create(struct drm_i915_private *dev_priv,
 
                 intel_plane->update_plane = skl_update_plane;
                 intel_plane->disable_plane = skl_disable_plane;
+                intel_plane->get_hw_state = skl_plane_get_hw_state;
 
                 plane_formats = skl_plane_formats;
                 num_plane_formats = ARRAY_SIZE(skl_plane_formats);
@@ -1252,6 +1332,7 @@ intel_sprite_plane_create(struct drm_i915_private *dev_priv,
 
                 intel_plane->update_plane = vlv_update_plane;
                 intel_plane->disable_plane = vlv_disable_plane;
+                intel_plane->get_hw_state = vlv_plane_get_hw_state;
 
                 plane_formats = vlv_plane_formats;
                 num_plane_formats = ARRAY_SIZE(vlv_plane_formats);
@@ -1267,6 +1348,7 @@ intel_sprite_plane_create(struct drm_i915_private *dev_priv,
 
                 intel_plane->update_plane = ivb_update_plane;
                 intel_plane->disable_plane = ivb_disable_plane;
+                intel_plane->get_hw_state = ivb_plane_get_hw_state;
 
                 plane_formats = snb_plane_formats;
                 num_plane_formats = ARRAY_SIZE(snb_plane_formats);
@@ -1277,6 +1359,7 @@ intel_sprite_plane_create(struct drm_i915_private *dev_priv,
 
                 intel_plane->update_plane = g4x_update_plane;
                 intel_plane->disable_plane = g4x_disable_plane;
+                intel_plane->get_hw_state = g4x_plane_get_hw_state;
 
                 modifiers = i9xx_plane_format_modifiers;
                 if (IS_GEN6(dev_priv)) {
diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/mmu.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/mmu.h
index 0760b93e9d1f..baab93398e54 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/mmu.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/mmu.h
@@ -121,6 +121,7 @@ int nv41_mmu_new(struct nvkm_device *, int, struct nvkm_mmu **);
 int nv44_mmu_new(struct nvkm_device *, int, struct nvkm_mmu **);
 int nv50_mmu_new(struct nvkm_device *, int, struct nvkm_mmu **);
 int g84_mmu_new(struct nvkm_device *, int, struct nvkm_mmu **);
+int mcp77_mmu_new(struct nvkm_device *, int, struct nvkm_mmu **);
 int gf100_mmu_new(struct nvkm_device *, int, struct nvkm_mmu **);
 int gk104_mmu_new(struct nvkm_device *, int, struct nvkm_mmu **);
 int gk20a_mmu_new(struct nvkm_device *, int, struct nvkm_mmu **);
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 2615912430cc..ef687414969e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -224,7 +224,7 @@ nouveau_bo_new(struct nouveau_cli *cli, u64 size, int align,
                 /* Determine if we can get a cache-coherent map, forcing
                  * uncached mapping if we can't.
                  */
-                if (mmu->type[drm->ttm.type_host].type & NVIF_MEM_UNCACHED)
+                if (!nouveau_drm_use_coherent_gpu_mapping(drm))
                         nvbo->force_coherent = true;
         }
 
@@ -262,7 +262,8 @@ nouveau_bo_new(struct nouveau_cli *cli, u64 size, int align,
                 if (cli->device.info.family > NV_DEVICE_INFO_V0_CURIE &&
                     (flags & TTM_PL_FLAG_VRAM) && !vmm->page[i].vram)
                         continue;
-                if ((flags & TTM_PL_FLAG_TT  ) && !vmm->page[i].host)
+                if ((flags & TTM_PL_FLAG_TT) &&
+                    (!vmm->page[i].host || vmm->page[i].shift > PAGE_SHIFT))
                         continue;
 
                 /* Select this page size if it's the first that supports
@@ -1446,11 +1447,13 @@ nouveau_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *reg)
                                 args.nv50.ro = 0;
                                 args.nv50.kind = mem->kind;
                                 args.nv50.comp = mem->comp;
+                                argc = sizeof(args.nv50);
                                 break;
                         case NVIF_CLASS_MEM_GF100:
                                 args.gf100.version = 0;
                                 args.gf100.ro = 0;
                                 args.gf100.kind = mem->kind;
+                                argc = sizeof(args.gf100);
                                 break;
                         default:
                                 WARN_ON(1);
@@ -1458,7 +1461,7 @@ nouveau_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_reg *reg)
                         }
 
                         ret = nvif_object_map_handle(&mem->mem.object,
-                                                     &argc, argc,
+                                                     &args, argc,
                                                      &handle, &length);
                         if (ret != 1)
                                 return ret ? ret : -EINVAL;
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 8d4a5be3b913..56fe261b6268 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -152,9 +152,9 @@ nouveau_cli_work_queue(struct nouveau_cli *cli, struct dma_fence *fence,
         work->cli = cli;
         mutex_lock(&cli->lock);
         list_add_tail(&work->head, &cli->worker);
-        mutex_unlock(&cli->lock);
         if (dma_fence_add_callback(fence, &work->cb, nouveau_cli_work_fence))
                 nouveau_cli_work_fence(fence, &work->cb);
+        mutex_unlock(&cli->lock);
 }
 
 static void
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index 3331e82ae9e7..96f6bd8aee5d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -157,8 +157,8 @@ struct nouveau_drm {
                 struct nvif_object copy;
                 int mtrr;
                 int type_vram;
-                int type_host;
-                int type_ncoh;
+                int type_host[2];
+                int type_ncoh[2];
         } ttm;
 
         /* GEM interface support */
@@ -217,6 +217,13 @@ nouveau_drm(struct drm_device *dev)
         return dev->dev_private;
 }
 
+static inline bool
+nouveau_drm_use_coherent_gpu_mapping(struct nouveau_drm *drm)
+{
+        struct nvif_mmu *mmu = &drm->client.mmu;
+        return !(mmu->type[drm->ttm.type_host[0]].type & NVIF_MEM_UNCACHED);
+}
+
 int nouveau_pmops_suspend(struct device *);
 int nouveau_pmops_resume(struct device *);
 bool nouveau_pmops_runtime(void);
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index c533d8e04afc..be7357bf2246 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -429,7 +429,7 @@ nouveau_fbcon_destroy(struct drm_device *dev, struct nouveau_fbdev *fbcon)
         drm_fb_helper_unregister_fbi(&fbcon->helper);
         drm_fb_helper_fini(&fbcon->helper);
 
-        if (nouveau_fb->nvbo) {
+        if (nouveau_fb && nouveau_fb->nvbo) {
                 nouveau_vma_del(&nouveau_fb->vma);
                 nouveau_bo_unmap(nouveau_fb->nvbo);
                 nouveau_bo_unpin(nouveau_fb->nvbo);
diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
index 589a9621db76..c002f8968507 100644
--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
@@ -103,10 +103,10 @@ nouveau_mem_host(struct ttm_mem_reg *reg, struct ttm_dma_tt *tt)
         u8 type;
         int ret;
 
-        if (mmu->type[drm->ttm.type_host].type & NVIF_MEM_UNCACHED)
-                type = drm->ttm.type_ncoh;
+        if (!nouveau_drm_use_coherent_gpu_mapping(drm))
+                type = drm->ttm.type_ncoh[!!mem->kind];
         else
-                type = drm->ttm.type_host;
+                type = drm->ttm.type_host[0];
 
         if (mem->kind && !(mmu->type[type].type & NVIF_MEM_KIND))
                 mem->comp = mem->kind = 0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
index 08b974b30482..dff51a0ee028 100644
--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
@@ -235,27 +235,46 @@ nouveau_ttm_global_release(struct nouveau_drm *drm)
         drm->ttm.mem_global_ref.release = NULL;
 }
 
-int
-nouveau_ttm_init(struct nouveau_drm *drm)
+static int
+nouveau_ttm_init_host(struct nouveau_drm *drm, u8 kind)
 {
-        struct nvkm_device *device = nvxx_device(&drm->client.device);
-        struct nvkm_pci *pci = device->pci;
         struct nvif_mmu *mmu = &drm->client.mmu;
-        struct drm_device *dev = drm->dev;
-        int typei, ret;
+        int typei;
 
         typei = nvif_mmu_type(mmu, NVIF_MEM_HOST | NVIF_MEM_MAPPABLE |
-                                                   NVIF_MEM_COHERENT);
+                                            kind | NVIF_MEM_COHERENT);
         if (typei < 0)
                 return -ENOSYS;
 
-        drm->ttm.type_host = typei;
+        drm->ttm.type_host[!!kind] = typei;
 
-        typei = nvif_mmu_type(mmu, NVIF_MEM_HOST | NVIF_MEM_MAPPABLE);
+        typei = nvif_mmu_type(mmu, NVIF_MEM_HOST | NVIF_MEM_MAPPABLE | kind);
         if (typei < 0)
                 return -ENOSYS;
 
-        drm->ttm.type_ncoh = typei;
+        drm->ttm.type_ncoh[!!kind] = typei;
+        return 0;
+}
+
+int
+nouveau_ttm_init(struct nouveau_drm *drm)
+{
+        struct nvkm_device *device = nvxx_device(&drm->client.device);
+        struct nvkm_pci *pci = device->pci;
+        struct nvif_mmu *mmu = &drm->client.mmu;
+        struct drm_device *dev = drm->dev;
+        int typei, ret;
+
+        ret = nouveau_ttm_init_host(drm, 0);
+        if (ret)
+                return ret;
+
+        if (drm->client.device.info.family >= NV_DEVICE_INFO_V0_TESLA &&
+            drm->client.device.info.chipset != 0x50) {
+                ret = nouveau_ttm_init_host(drm, NVIF_MEM_KIND);
+                if (ret)
+                        return ret;
+        }
 
         if (drm->client.device.info.platform != NV_DEVICE_INFO_V0_SOC &&
             drm->client.device.info.family >= NV_DEVICE_INFO_V0_TESLA) {
diff --git a/drivers/gpu/drm/nouveau/nouveau_vmm.c b/drivers/gpu/drm/nouveau/nouveau_vmm.c
index 9e2628dd8e4d..f5371d96b003 100644
--- a/drivers/gpu/drm/nouveau/nouveau_vmm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_vmm.c
@@ -67,8 +67,8 @@ nouveau_vma_del(struct nouveau_vma **pvma)
                         nvif_vmm_put(&vma->vmm->vmm, &tmp);
                 }
                 list_del(&vma->head);
-                *pvma = NULL;
                 kfree(*pvma);
+                *pvma = NULL;
         }
 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
index e14643615698..08e77cd55e6e 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
@@ -1251,7 +1251,7 @@ nvaa_chipset = {
         .i2c = g94_i2c_new,
         .imem = nv50_instmem_new,
         .mc = g98_mc_new,
-        .mmu = g84_mmu_new,
+        .mmu = mcp77_mmu_new,
         .mxm = nv50_mxm_new,
         .pci = g94_pci_new,
         .therm = g84_therm_new,
@@ -1283,7 +1283,7 @@ nvac_chipset = {
         .i2c = g94_i2c_new,
         .imem = nv50_instmem_new,
         .mc = g98_mc_new,
-        .mmu = g84_mmu_new,
+        .mmu = mcp77_mmu_new,
         .mxm = nv50_mxm_new,
         .pci = g94_pci_new,
         .therm = g84_therm_new,
@@ -2369,7 +2369,7 @@ nv13b_chipset = {
         .imem = gk20a_instmem_new,
         .ltc = gp100_ltc_new,
         .mc = gp10b_mc_new,
-        .mmu = gf100_mmu_new,
+        .mmu = gp10b_mmu_new,
         .secboot = gp10b_secboot_new,
         .pmu = gm20b_pmu_new,
         .timer = gk20a_timer_new,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
index a2978a37b4f3..700fc754f28a 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
@@ -174,6 +174,7 @@ gf119_sor = {
                 .links = gf119_sor_dp_links,
                 .power = g94_sor_dp_power,
                 .pattern = gf119_sor_dp_pattern,
+                .drive = gf119_sor_dp_drive,
                 .vcpi = gf119_sor_dp_vcpi,
                 .audio = gf119_sor_dp_audio,
                 .audio_sym = gf119_sor_dp_audio_sym,
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/base.c
index 9646adec57cb..243f0a5c8a62 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/base.c
@@ -73,7 +73,8 @@ static int
 nvkm_bar_fini(struct nvkm_subdev *subdev, bool suspend)
 {
         struct nvkm_bar *bar = nvkm_bar(subdev);
-        bar->func->bar1.fini(bar);
+        if (bar->func->bar1.fini)
+                bar->func->bar1.fini(bar);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gk20a.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gk20a.c
index b10077d38839..35878fb538f2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gk20a.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gk20a.c
@@ -26,7 +26,6 @@ gk20a_bar_func = {
         .dtor = gf100_bar_dtor,
         .oneinit = gf100_bar_oneinit,
         .bar1.init = gf100_bar_bar1_init,
-        .bar1.fini = gf100_bar_bar1_fini,
         .bar1.wait = gf100_bar_bar1_wait,
         .bar1.vmm = gf100_bar_bar1_vmm,
         .flush = g84_bar_flush,
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/dp.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/dp.c
index 972370ed36f0..7c7efa4ea0d0 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/dp.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/dp.c
@@ -36,6 +36,7 @@ nvbios_dp_table(struct nvkm_bios *bios, u8 *ver, u8 *hdr, u8 *cnt, u8 *len)
                         if (data) {
                                 *ver = nvbios_rd08(bios, data + 0x00);
                                 switch (*ver) {
+                                case 0x20:
                                 case 0x21:
                                 case 0x30:
                                 case 0x40:
@@ -63,6 +64,7 @@ nvbios_dpout_entry(struct nvkm_bios *bios, u8 idx,
         if (data && idx < *cnt) {
                 u16 outp = nvbios_rd16(bios, data + *hdr + idx * *len);
                 switch (*ver * !!outp) {
+                case 0x20:
                 case 0x21:
                 case 0x30:
                         *hdr = nvbios_rd08(bios, data + 0x04);
@@ -96,12 +98,16 @@ nvbios_dpout_parse(struct nvkm_bios *bios, u8 idx,
                 info->type = nvbios_rd16(bios, data + 0x00);
                 info->mask = nvbios_rd16(bios, data + 0x02);
                 switch (*ver) {
+                case 0x20:
+                        info->mask |= 0x00c0; /* match any link */
+                        /* fall-through */
                 case 0x21:
                 case 0x30:
                         info->flags     = nvbios_rd08(bios, data + 0x05);
                         info->script[0] = nvbios_rd16(bios, data + 0x06);
                         info->script[1] = nvbios_rd16(bios, data + 0x08);
-                        info->lnkcmp    = nvbios_rd16(bios, data + 0x0a);
+                        if (*len >= 0x0c)
+                                info->lnkcmp    = nvbios_rd16(bios, data + 0x0a);
                         if (*len >= 0x0f) {
                                 info->script[2] = nvbios_rd16(bios, data + 0x0c);
                                 info->script[3] = nvbios_rd16(bios, data + 0x0e);
@@ -170,6 +176,7 @@ nvbios_dpcfg_parse(struct nvkm_bios *bios, u16 outp, u8 idx,
         memset(info, 0x00, sizeof(*info));
         if (data) {
                 switch (*ver) {
+                case 0x20:
                 case 0x21:
                         info->dc    = nvbios_rd08(bios, data + 0x02);
                         info->pe    = nvbios_rd08(bios, data + 0x03);
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c
index 1ba7289684aa..db48a1daca0c 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c
@@ -249,7 +249,7 @@ nv50_instobj_acquire(struct nvkm_memory *memory)
                         iobj->base.memory.ptrs = &nv50_instobj_fast;
                 else
                         iobj->base.memory.ptrs = &nv50_instobj_slow;
-                refcount_inc(&iobj->maps);
+                refcount_set(&iobj->maps, 1);
         }
 
         mutex_unlock(&imem->subdev.mutex);
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/Kbuild b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/Kbuild
index 352a65f9371c..67ee983bb026 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/Kbuild
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/Kbuild
@@ -4,6 +4,7 @@ nvkm-y += nvkm/subdev/mmu/nv41.o
 nvkm-y += nvkm/subdev/mmu/nv44.o
 nvkm-y += nvkm/subdev/mmu/nv50.o
 nvkm-y += nvkm/subdev/mmu/g84.o
+nvkm-y += nvkm/subdev/mmu/mcp77.o
 nvkm-y += nvkm/subdev/mmu/gf100.o
 nvkm-y += nvkm/subdev/mmu/gk104.o
 nvkm-y += nvkm/subdev/mmu/gk20a.o
@@ -22,6 +23,7 @@ nvkm-y += nvkm/subdev/mmu/vmmnv04.o
 nvkm-y += nvkm/subdev/mmu/vmmnv41.o
 nvkm-y += nvkm/subdev/mmu/vmmnv44.o
 nvkm-y += nvkm/subdev/mmu/vmmnv50.o
+nvkm-y += nvkm/subdev/mmu/vmmmcp77.o
 nvkm-y += nvkm/subdev/mmu/vmmgf100.o
 nvkm-y += nvkm/subdev/mmu/vmmgk104.o
 nvkm-y += nvkm/subdev/mmu/vmmgk20a.o
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/mcp77.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/mcp77.c
new file mode 100644
index 000000000000..0527b50730d9
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/mcp77.c
@@ -0,0 +1,41 @@
+/*
+ * Copyright 2017 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+#include "mem.h"
+#include "vmm.h"
+
+#include <nvif/class.h>
+
+static const struct nvkm_mmu_func
+mcp77_mmu = {
+        .dma_bits = 40,
+        .mmu = {{ -1, -1, NVIF_CLASS_MMU_NV50}},
+        .mem = {{ -1,  0, NVIF_CLASS_MEM_NV50}, nv50_mem_new, nv50_mem_map },
+        .vmm = {{ -1, -1, NVIF_CLASS_VMM_NV50}, mcp77_vmm_new, false, 0x0200 },
+        .kind = nv50_mmu_kind,
+        .kind_sys = true,
+};
+
+int
+mcp77_mmu_new(struct nvkm_device *device, int index, struct nvkm_mmu **pmmu)
+{
+        return nvkm_mmu_new_(&mcp77_mmu, device, index, pmmu);
+}
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.h b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.h
index 6d8f61ea467a..da06e64d8a7d 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.h
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.h
@@ -95,6 +95,9 @@ struct nvkm_vmm_desc {
         const struct nvkm_vmm_desc_func *func;
 };
 
+extern const struct nvkm_vmm_desc nv50_vmm_desc_12[];
+extern const struct nvkm_vmm_desc nv50_vmm_desc_16[];
+
 extern const struct nvkm_vmm_desc gk104_vmm_desc_16_12[];
 extern const struct nvkm_vmm_desc gk104_vmm_desc_16_16[];
 extern const struct nvkm_vmm_desc gk104_vmm_desc_17_12[];
@@ -169,6 +172,11 @@ int nv04_vmm_new_(const struct nvkm_vmm_func *, struct nvkm_mmu *, u32,
                   const char *, struct nvkm_vmm **);
 int nv04_vmm_valid(struct nvkm_vmm *, void *, u32, struct nvkm_vmm_map *);
 
+int nv50_vmm_join(struct nvkm_vmm *, struct nvkm_memory *);
+void nv50_vmm_part(struct nvkm_vmm *, struct nvkm_memory *);
+int nv50_vmm_valid(struct nvkm_vmm *, void *, u32, struct nvkm_vmm_map *);
+void nv50_vmm_flush(struct nvkm_vmm *, int);
+
 int gf100_vmm_new_(const struct nvkm_vmm_func *, const struct nvkm_vmm_func *,
                    struct nvkm_mmu *, u64, u64, void *, u32,
                    struct lock_class_key *, const char *, struct nvkm_vmm **);
@@ -200,6 +208,8 @@ int nv44_vmm_new(struct nvkm_mmu *, u64, u64, void *, u32,
                  struct lock_class_key *, const char *, struct nvkm_vmm **);
 int nv50_vmm_new(struct nvkm_mmu *, u64, u64, void *, u32,
                  struct lock_class_key *, const char *, struct nvkm_vmm **);
+int mcp77_vmm_new(struct nvkm_mmu *, u64, u64, void *, u32,
+                  struct lock_class_key *, const char *, struct nvkm_vmm **);
 int g84_vmm_new(struct nvkm_mmu *, u64, u64, void *, u32,
                 struct lock_class_key *, const char *, struct nvkm_vmm **);
 int gf100_vmm_new(struct nvkm_mmu *, u64, u64, void *, u32,
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmmcp77.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmmcp77.c
new file mode 100644
index 000000000000..e63d984cbfd4
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmmcp77.c
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2017 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+#include "vmm.h"
+
+static const struct nvkm_vmm_func
+mcp77_vmm = {
+        .join = nv50_vmm_join,
+        .part = nv50_vmm_part,
+        .valid = nv50_vmm_valid,
+        .flush = nv50_vmm_flush,
+        .page_block = 1 << 29,
+        .page = {
+                { 16, &nv50_vmm_desc_16[0], NVKM_VMM_PAGE_xVxx },
+                { 12, &nv50_vmm_desc_12[0], NVKM_VMM_PAGE_xVHx },
+                {}
+        }
+};
+
+int
+mcp77_vmm_new(struct nvkm_mmu *mmu, u64 addr, u64 size, void *argv, u32 argc,
+              struct lock_class_key *key, const char *name,
+              struct nvkm_vmm **pvmm)
+{
+        return nv04_vmm_new_(&mcp77_vmm, mmu, 0, addr, size,
+                             argv, argc, key, name, pvmm);
+}
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmnv50.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmnv50.c
index 863a2edd9861..64f75d906202 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmnv50.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmnv50.c
@@ -32,7 +32,7 @@ static inline void
 nv50_vmm_pgt_pte(struct nvkm_vmm *vmm, struct nvkm_mmu_pt *pt,
                  u32 ptei, u32 ptes, struct nvkm_vmm_map *map, u64 addr)
 {
-        u64 next = addr | map->type, data;
+        u64 next = addr + map->type, data;
         u32 pten;
         int log2blk;
 
@@ -69,7 +69,7 @@ nv50_vmm_pgt_dma(struct nvkm_vmm *vmm, struct nvkm_mmu_pt *pt,
                 VMM_SPAM(vmm, "DMAA %08x %08x PTE(s)", ptei, ptes);
                 nvkm_kmap(pt->memory);
                 while (ptes--) {
-                        const u64 data = *map->dma++ | map->type;
+                        const u64 data = *map->dma++ + map->type;
                         VMM_WO064(pt, vmm, ptei++ * 8, data);
                         map->type += map->ctag;
                 }
@@ -163,21 +163,21 @@ nv50_vmm_pgd = {
         .pde = nv50_vmm_pgd_pde,
 };
 
-static const struct nvkm_vmm_desc
+const struct nvkm_vmm_desc
 nv50_vmm_desc_12[] = {
         { PGT, 17, 8, 0x1000, &nv50_vmm_pgt },
         { PGD, 11, 0, 0x0000, &nv50_vmm_pgd },
         {}
 };
 
-static const struct nvkm_vmm_desc
+const struct nvkm_vmm_desc
 nv50_vmm_desc_16[] = {
         { PGT, 13, 8, 0x1000, &nv50_vmm_pgt },
         { PGD, 11, 0, 0x0000, &nv50_vmm_pgd },
         {}
 };
 
-static void
+void
 nv50_vmm_flush(struct nvkm_vmm *vmm, int level)
 {
         struct nvkm_subdev *subdev = &vmm->mmu->subdev;
@@ -223,7 +223,7 @@ nv50_vmm_flush(struct nvkm_vmm *vmm, int level)
         mutex_unlock(&subdev->mutex);
 }
 
-static int
+int
 nv50_vmm_valid(struct nvkm_vmm *vmm, void *argv, u32 argc,
                struct nvkm_vmm_map *map)
 {
@@ -321,7 +321,7 @@ nv50_vmm_valid(struct nvkm_vmm *vmm, void *argv, u32 argc,
         return 0;
 }
 
-static void
+void
 nv50_vmm_part(struct nvkm_vmm *vmm, struct nvkm_memory *inst)
 {
         struct nvkm_vmm_join *join;
@@ -335,7 +335,7 @@ nv50_vmm_part(struct nvkm_vmm *vmm, struct nvkm_memory *inst)
         }
 }
 
-static int
+int
 nv50_vmm_join(struct nvkm_vmm *vmm, struct nvkm_memory *inst)
 {
         const u32 pd_offset = vmm->mmu->func->vmm.pd_offset;
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
index b1b1f3626b96..ee2431a7804e 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
@@ -71,6 +71,10 @@ nvkm_pci_intr(int irq, void *arg)
         struct nvkm_pci *pci = arg;
         struct nvkm_device *device = pci->subdev.device;
         bool handled = false;
+
+        if (pci->irq < 0)
+                return IRQ_HANDLED;
+
         nvkm_mc_intr_unarm(device);
         if (pci->msi)
                 pci->func->msi_rearm(pci);
@@ -84,11 +88,6 @@ nvkm_pci_fini(struct nvkm_subdev *subdev, bool suspend)
 {
         struct nvkm_pci *pci = nvkm_pci(subdev);
 
-        if (pci->irq >= 0) {
-                free_irq(pci->irq, pci);
-                pci->irq = -1;
-        }
-
         if (pci->agp.bridge)
                 nvkm_agp_fini(pci);
 
@@ -108,8 +107,20 @@ static int
 nvkm_pci_oneinit(struct nvkm_subdev *subdev)
 {
         struct nvkm_pci *pci = nvkm_pci(subdev);
-        if (pci_is_pcie(pci->pdev))
-                return nvkm_pcie_oneinit(pci);
+        struct pci_dev *pdev = pci->pdev;
+        int ret;
+
+        if (pci_is_pcie(pci->pdev)) {
+                ret = nvkm_pcie_oneinit(pci);
+                if (ret)
+                        return ret;
+        }
+
+        ret = request_irq(pdev->irq, nvkm_pci_intr, IRQF_SHARED, "nvkm", pci);
+        if (ret)
+                return ret;
+
+        pci->irq = pdev->irq;
         return 0;
 }
 
@@ -117,7 +128,6 @@ static int
 nvkm_pci_init(struct nvkm_subdev *subdev)
 {
         struct nvkm_pci *pci = nvkm_pci(subdev);
-        struct pci_dev *pdev = pci->pdev;
         int ret;
 
         if (pci->agp.bridge) {
@@ -131,21 +141,34 @@ nvkm_pci_init(struct nvkm_subdev *subdev)
         if (pci->func->init)
                 pci->func->init(pci);
 
-        ret = request_irq(pdev->irq, nvkm_pci_intr, IRQF_SHARED, "nvkm", pci);
-        if (ret)
-                return ret;
+        /* Ensure MSI interrupts are armed, for the case where there are
+         * already interrupts pending (for whatever reason) at load time.
+         */
+        if (pci->msi)
+                pci->func->msi_rearm(pci);
 
-        pci->irq = pdev->irq;
-        return ret;
+        return 0;
 }
 
 static void *
 nvkm_pci_dtor(struct nvkm_subdev *subdev)
 {
         struct nvkm_pci *pci = nvkm_pci(subdev);
+
         nvkm_agp_dtor(pci);
+
+        if (pci->irq >= 0) {
+                /* freq_irq() will call the handler, we use pci->irq == -1
+                 * to signal that it's been torn down and should be a noop.
+                 */
+                int irq = pci->irq;
+                pci->irq = -1;
+                free_irq(irq, pci);
+        }
+
         if (pci->msi)
                 pci_disable_msi(pci->pdev);
+
         return nvkm_pci(subdev);
 }
 
diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c b/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c
index e626eddf24d5..23db74ae1826 100644
--- a/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c
+++ b/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c
@@ -78,6 +78,8 @@ static void hdmi_cec_received_msg(struct hdmi_core_data *core)
 
                         /* then read the message */
                         msg.len = cnt & 0xf;
+                        if (msg.len > CEC_MAX_MSG_SIZE - 2)
+                                msg.len = CEC_MAX_MSG_SIZE - 2;
                         msg.msg[0] = hdmi_read_reg(core->base,
                                                    HDMI_CEC_RX_CMD_HEADER);
                         msg.msg[1] = hdmi_read_reg(core->base,
@@ -104,26 +106,6 @@ static void hdmi_cec_received_msg(struct hdmi_core_data *core)
         }
 }
 
-static void hdmi_cec_transmit_fifo_empty(struct hdmi_core_data *core, u32 stat1)
-{
-        if (stat1 & 2) {
-                u32 dbg3 = hdmi_read_reg(core->base, HDMI_CEC_DBG_3);
-
-                cec_transmit_done(core->adap,
-                                  CEC_TX_STATUS_NACK |
-                                  CEC_TX_STATUS_MAX_RETRIES,
-                                  0, (dbg3 >> 4) & 7, 0, 0);
-        } else if (stat1 & 1) {
-                cec_transmit_done(core->adap,
-                                  CEC_TX_STATUS_ARB_LOST |
-                                  CEC_TX_STATUS_MAX_RETRIES,
-                                  0, 0, 0, 0);
-        } else if (stat1 == 0) {
-                cec_transmit_done(core->adap, CEC_TX_STATUS_OK,
-                                  0, 0, 0, 0);
-        }
-}
-
 void hdmi4_cec_irq(struct hdmi_core_data *core)
 {
         u32 stat0 = hdmi_read_reg(core->base, HDMI_CEC_INT_STATUS_0);
@@ -132,27 +114,21 @@ void hdmi4_cec_irq(struct hdmi_core_data *core)
         hdmi_write_reg(core->base, HDMI_CEC_INT_STATUS_0, stat0);
         hdmi_write_reg(core->base, HDMI_CEC_INT_STATUS_1, stat1);
 
-        if (stat0 & 0x40)
+        if (stat0 & 0x20) {
+                cec_transmit_done(core->adap, CEC_TX_STATUS_OK,
+                                  0, 0, 0, 0);
                 REG_FLD_MOD(core->base, HDMI_CEC_DBG_3, 0x1, 7, 7);
-        else if (stat0 & 0x24)
-                hdmi_cec_transmit_fifo_empty(core, stat1);
-        if (stat1 & 2) {
+        } else if (stat1 & 0x02) {
                 u32 dbg3 = hdmi_read_reg(core->base, HDMI_CEC_DBG_3);
 
                 cec_transmit_done(core->adap,
                                   CEC_TX_STATUS_NACK |
                                   CEC_TX_STATUS_MAX_RETRIES,
                                   0, (dbg3 >> 4) & 7, 0, 0);
-        } else if (stat1 & 1) {
-                cec_transmit_done(core->adap,
-                                  CEC_TX_STATUS_ARB_LOST |
-                                  CEC_TX_STATUS_MAX_RETRIES,
-                                  0, 0, 0, 0);
+                REG_FLD_MOD(core->base, HDMI_CEC_DBG_3, 0x1, 7, 7);
         }
         if (stat0 & 0x02)
                 hdmi_cec_received_msg(core);
-        if (stat1 & 0x3)
-                REG_FLD_MOD(core->base, HDMI_CEC_DBG_3, 0x1, 7, 7);
 }
 
 static bool hdmi_cec_clear_tx_fifo(struct cec_adapter *adap)
@@ -231,18 +207,14 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable)
         /*
          * Enable CEC interrupts:
          * Transmit Buffer Full/Empty Change event
-         * Transmitter FIFO Empty event
          * Receiver FIFO Not Empty event
          */
-        hdmi_write_reg(core->base, HDMI_CEC_INT_ENABLE_0, 0x26);
+        hdmi_write_reg(core->base, HDMI_CEC_INT_ENABLE_0, 0x22);
         /*
          * Enable CEC interrupts:
-         * RX FIFO Overrun Error event
-         * Short Pulse Detected event
          * Frame Retransmit Count Exceeded event
-         * Start Bit Irregularity event
          */
-        hdmi_write_reg(core->base, HDMI_CEC_INT_ENABLE_1, 0x0f);
+        hdmi_write_reg(core->base, HDMI_CEC_INT_ENABLE_1, 0x02);
 
         /* cec calibration enable (self clearing) */
         hdmi_write_reg(core->base, HDMI_CEC_SETUP, 0x03);
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
index dda904ec0534..500b6fb3e028 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -175,11 +175,31 @@ static void sun4i_hdmi_mode_set(struct drm_encoder *encoder,
         writel(val, hdmi->base + SUN4I_HDMI_VID_TIMING_POL_REG);
 }
 
+static enum drm_mode_status sun4i_hdmi_mode_valid(struct drm_encoder *encoder,
+                                        const struct drm_display_mode *mode)
+{
+        struct sun4i_hdmi *hdmi = drm_encoder_to_sun4i_hdmi(encoder);
+        unsigned long rate = mode->clock * 1000;
+        unsigned long diff = rate / 200; /* +-0.5% allowed by HDMI spec */
+        long rounded_rate;
+
+        /* 165 MHz is the typical max pixelclock frequency for HDMI <= 1.2 */
+        if (rate > 165000000)
+                return MODE_CLOCK_HIGH;
+        rounded_rate = clk_round_rate(hdmi->tmds_clk, rate);
+        if (rounded_rate > 0 &&
+            max_t(unsigned long, rounded_rate, rate) -
+            min_t(unsigned long, rounded_rate, rate) < diff)
+                return MODE_OK;
+        return MODE_NOCLOCK;
+}
+
 static const struct drm_encoder_helper_funcs sun4i_hdmi_helper_funcs = {
         .atomic_check   = sun4i_hdmi_atomic_check,
         .disable        = sun4i_hdmi_disable,
         .enable         = sun4i_hdmi_enable,
         .mode_set       = sun4i_hdmi_mode_set,
+        .mode_valid     = sun4i_hdmi_mode_valid,
 };
 
 static const struct drm_encoder_funcs sun4i_hdmi_funcs = {
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
index dc332ea56f6c..3ecffa52c814 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
@@ -102,10 +102,13 @@ static int sun4i_tmds_determine_rate(struct clk_hw *hw,
                                         goto out;
                                 }
 
-                                if (abs(rate - rounded / i) <
-                                    abs(rate - best_parent / best_div)) {
+                                if (!best_parent ||
+                                    abs(rate - rounded / i / j) <
+                                    abs(rate - best_parent / best_half /
+                                        best_div)) {
                                         best_parent = rounded;
-                                        best_div = i;
+                                        best_half = i;
+                                        best_div = j;
                                 }
                         }
                 }
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index e122f5b2a395..f4284b51bdca 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -724,12 +724,12 @@ static int sun4i_tcon_bind(struct device *dev, struct device *master,
         if (IS_ERR(tcon->crtc)) {
                 dev_err(dev, "Couldn't create our CRTC\n");
                 ret = PTR_ERR(tcon->crtc);
-                goto err_free_clocks;
+                goto err_free_dotclock;
         }
 
         ret = sun4i_rgb_init(drm, tcon);
         if (ret < 0)
-                goto err_free_clocks;
+                goto err_free_dotclock;
 
         if (tcon->quirks->needs_de_be_mux) {
                 /*
diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
index b0a1dedac802..476079f1255f 100644
--- a/drivers/gpu/drm/tegra/sor.c
+++ b/drivers/gpu/drm/tegra/sor.c
@@ -2656,6 +2656,9 @@ static int tegra_sor_probe(struct platform_device *pdev)
                                 name, err);
                         goto remove;
                 }
+        } else {
+                /* fall back to the module clock on SOR0 (eDP/LVDS only) */
+                sor->clk_out = sor->clk;
         }
 
         sor->clk_parent = devm_clk_get(&pdev->dev, "parent");
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index 8d7172e8381d..5d252fb27a82 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -81,6 +81,7 @@ struct ttm_page_pool {
         char                    *name;
         unsigned long           nfrees;
         unsigned long           nrefills;
+        unsigned int            order;
 };
 
 /**
@@ -222,6 +223,17 @@ static struct kobj_type ttm_pool_kobj_type = {
 static struct ttm_pool_manager *_manager;
 
 #ifndef CONFIG_X86
+static int set_pages_wb(struct page *page, int numpages)
+{
+#if IS_ENABLED(CONFIG_AGP)
+        int i;
+
+        for (i = 0; i < numpages; i++)
+                unmap_page_from_agp(page++);
+#endif
+        return 0;
+}
+
 static int set_pages_array_wb(struct page **pages, int addrinarray)
 {
 #if IS_ENABLED(CONFIG_AGP)
@@ -284,13 +296,23 @@ static struct ttm_page_pool *ttm_get_pool(int flags, bool huge,
 }
 
 /* set memory back to wb and free the pages. */
-static void ttm_pages_put(struct page *pages[], unsigned npages)
+static void ttm_pages_put(struct page *pages[], unsigned npages,
+                unsigned int order)
 {
-        unsigned i;
-        if (set_pages_array_wb(pages, npages))
-                pr_err("Failed to set %d pages to wb!\n", npages);
-        for (i = 0; i < npages; ++i)
-                __free_page(pages[i]);
+        unsigned int i, pages_nr = (1 << order);
+
+        if (order == 0) {
+                if (set_pages_array_wb(pages, npages))
+                        pr_err("Failed to set %d pages to wb!\n", npages);
+        }
+
+        for (i = 0; i < npages; ++i) {
+                if (order > 0) {
+                        if (set_pages_wb(pages[i], pages_nr))
+                                pr_err("Failed to set %d pages to wb!\n", pages_nr);
+                }
+                __free_pages(pages[i], order);
+        }
 }
 
 static void ttm_pool_update_free_locked(struct ttm_page_pool *pool,
@@ -353,7 +375,7 @@ restart:
                          */
                         spin_unlock_irqrestore(&pool->lock, irq_flags);
 
-                        ttm_pages_put(pages_to_free, freed_pages);
+                        ttm_pages_put(pages_to_free, freed_pages, pool->order);
                         if (likely(nr_free != FREE_ALL_PAGES))
                                 nr_free -= freed_pages;
 
@@ -388,7 +410,7 @@ restart:
         spin_unlock_irqrestore(&pool->lock, irq_flags);
 
         if (freed_pages)
-                ttm_pages_put(pages_to_free, freed_pages);
+                ttm_pages_put(pages_to_free, freed_pages, pool->order);
 out:
         if (pages_to_free != static_buf)
                 kfree(pages_to_free);
@@ -412,6 +434,7 @@ ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
         struct ttm_page_pool *pool;
         int shrink_pages = sc->nr_to_scan;
         unsigned long freed = 0;
+        unsigned int nr_free_pool;
 
         if (!mutex_trylock(&lock))
                 return SHRINK_STOP;
@@ -419,12 +442,20 @@ ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
         /* select start pool in round robin fashion */
         for (i = 0; i < NUM_POOLS; ++i) {
                 unsigned nr_free = shrink_pages;
+                unsigned page_nr;
+
                 if (shrink_pages == 0)
                         break;
+
                 pool = &_manager->pools[(i + pool_offset)%NUM_POOLS];
+                page_nr = (1 << pool->order);
                 /* OK to use static buffer since global mutex is held. */
-                shrink_pages = ttm_page_pool_free(pool, nr_free, true);
-                freed += nr_free - shrink_pages;
+                nr_free_pool = roundup(nr_free, page_nr) >> pool->order;
+                shrink_pages = ttm_page_pool_free(pool, nr_free_pool, true);
+                freed += (nr_free_pool - shrink_pages) << pool->order;
+                if (freed >= sc->nr_to_scan)
+                        break;
+                shrink_pages <<= pool->order;
         }
         mutex_unlock(&lock);
         return freed;
@@ -436,9 +467,12 @@ ttm_pool_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
 {
         unsigned i;
         unsigned long count = 0;
+        struct ttm_page_pool *pool;
 
-        for (i = 0; i < NUM_POOLS; ++i)
-                count += _manager->pools[i].npages;
+        for (i = 0; i < NUM_POOLS; ++i) {
+                pool = &_manager->pools[i];
+                count += (pool->npages << pool->order);
+        }
 
         return count;
 }
@@ -510,8 +544,7 @@ static int ttm_alloc_new_pages(struct list_head *pages, gfp_t gfp_flags,
         int r = 0;
         unsigned i, j, cpages;
         unsigned npages = 1 << order;
-        unsigned max_cpages = min(count,
-                        (unsigned)(PAGE_SIZE/sizeof(struct page *)));
+        unsigned max_cpages = min(count << order, (unsigned)NUM_PAGES_TO_ALLOC);
 
         /* allocate array for page caching change */
         caching_array = kmalloc(max_cpages*sizeof(struct page *), GFP_KERNEL);
@@ -845,7 +878,7 @@ static int ttm_get_pages(struct page **pages, unsigned npages, int flags,
 #endif
         struct list_head plist;
         struct page *p = NULL;
-        unsigned count;
+        unsigned count, first;
         int r;
 
         /* No pool for cached pages */
@@ -886,6 +919,7 @@ static int ttm_get_pages(struct page **pages, unsigned npages, int flags,
                 }
 #endif
 
+                first = i;
                 while (npages) {
                         p = alloc_page(gfp_flags);
                         if (!p) {
@@ -893,6 +927,10 @@ static int ttm_get_pages(struct page **pages, unsigned npages, int flags,
                                 return -ENOMEM;
                         }
 
+                        /* Swap the pages if we detect consecutive order */
+                        if (i > first && pages[i - 1] == p - 1)
+                                swap(p, pages[i - 1]);
+
                         pages[i++] = p;
                         --npages;
                 }
@@ -921,8 +959,15 @@ static int ttm_get_pages(struct page **pages, unsigned npages, int flags,
         r = ttm_page_pool_get_pages(pool, &plist, flags, cstate,
                                     npages - count, 0);
 
-        list_for_each_entry(p, &plist, lru)
-                pages[count++] = p;
+        first = count;
+        list_for_each_entry(p, &plist, lru) {
+                struct page *tmp = p;
+
+                /* Swap the pages if we detect consecutive order */
+                if (count > first && pages[count - 1] == tmp - 1)
+                        swap(tmp, pages[count - 1]);
+                pages[count++] = tmp;
+        }
 
         if (r) {
                 /* If there is any pages in the list put them back to
@@ -937,7 +982,7 @@ static int ttm_get_pages(struct page **pages, unsigned npages, int flags,
 }
 
 static void ttm_page_pool_init_locked(struct ttm_page_pool *pool, gfp_t flags,
-                char *name)
+                char *name, unsigned int order)
 {
         spin_lock_init(&pool->lock);
         pool->fill_lock = false;
@@ -945,35 +990,43 @@ static void ttm_page_pool_init_locked(struct ttm_page_pool *pool, gfp_t flags,
         pool->npages = pool->nfrees = 0;
         pool->gfp_flags = flags;
         pool->name = name;
+        pool->order = order;
 }
 
 int ttm_page_alloc_init(struct ttm_mem_global *glob, unsigned max_pages)
 {
         int ret;
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+        unsigned order = HPAGE_PMD_ORDER;
+#else
+        unsigned order = 0;
+#endif
 
         WARN_ON(_manager);
 
         pr_info("Initializing pool allocator\n");
 
         _manager = kzalloc(sizeof(*_manager), GFP_KERNEL);
+        if (!_manager)
+                return -ENOMEM;
 
-        ttm_page_pool_init_locked(&_manager->wc_pool, GFP_HIGHUSER, "wc");
+        ttm_page_pool_init_locked(&_manager->wc_pool, GFP_HIGHUSER, "wc", 0);
 
-        ttm_page_pool_init_locked(&_manager->uc_pool, GFP_HIGHUSER, "uc");
+        ttm_page_pool_init_locked(&_manager->uc_pool, GFP_HIGHUSER, "uc", 0);
 
         ttm_page_pool_init_locked(&_manager->wc_pool_dma32,
-                                  GFP_USER | GFP_DMA32, "wc dma");
+                                  GFP_USER | GFP_DMA32, "wc dma", 0);
 
         ttm_page_pool_init_locked(&_manager->uc_pool_dma32,
-                                  GFP_USER | GFP_DMA32, "uc dma");
+                                  GFP_USER | GFP_DMA32, "uc dma", 0);
 
         ttm_page_pool_init_locked(&_manager->wc_pool_huge,
                                   GFP_TRANSHUGE & ~(__GFP_MOVABLE | __GFP_COMP),
-                                  "wc huge");
+                                  "wc huge", order);
 
         ttm_page_pool_init_locked(&_manager->uc_pool_huge,
                                   GFP_TRANSHUGE & ~(__GFP_MOVABLE | __GFP_COMP)
-                                  , "uc huge");
+                                  , "uc huge", order);
 
         _manager->options.max_size = max_pages;
         _manager->options.small = SMALL_ALLOCATION;
diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
index 4ae45d7dac42..2decc8e2c79f 100644
--- a/drivers/gpu/drm/vc4/vc4_bo.c
+++ b/drivers/gpu/drm/vc4/vc4_bo.c
@@ -637,7 +637,8 @@ int vc4_bo_inc_usecnt(struct vc4_bo *bo)
         mutex_lock(&bo->madv_lock);
         switch (bo->madv) {
         case VC4_MADV_WILLNEED:
-                refcount_inc(&bo->usecnt);
+                if (!refcount_inc_not_zero(&bo->usecnt))
+                        refcount_set(&bo->usecnt, 1);
                 ret = 0;
                 break;
         case VC4_MADV_DONTNEED:
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index 6c32c89a83a9..c94cce96544c 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -146,7 +146,7 @@ vc4_save_hang_state(struct drm_device *dev)
         struct vc4_exec_info *exec[2];
         struct vc4_bo *bo;
         unsigned long irqflags;
-        unsigned int i, j, unref_list_count, prev_idx;
+        unsigned int i, j, k, unref_list_count;
 
         kernel_state = kcalloc(1, sizeof(*kernel_state), GFP_KERNEL);
         if (!kernel_state)
@@ -182,7 +182,7 @@ vc4_save_hang_state(struct drm_device *dev)
                 return;
         }
 
-        prev_idx = 0;
+        k = 0;
         for (i = 0; i < 2; i++) {
                 if (!exec[i])
                         continue;
@@ -197,7 +197,7 @@ vc4_save_hang_state(struct drm_device *dev)
                         WARN_ON(!refcount_read(&bo->usecnt));
                         refcount_inc(&bo->usecnt);
                         drm_gem_object_get(&exec[i]->bo[j]->base);
-                        kernel_state->bo[j + prev_idx] = &exec[i]->bo[j]->base;
+                        kernel_state->bo[k++] = &exec[i]->bo[j]->base;
                 }
 
                 list_for_each_entry(bo, &exec[i]->unref_list, unref_head) {
@@ -205,12 +205,12 @@ vc4_save_hang_state(struct drm_device *dev)
                          * because they are naturally unpurgeable.
                          */
                         drm_gem_object_get(&bo->base.base);
-                        kernel_state->bo[j + prev_idx] = &bo->base.base;
-                        j++;
+                        kernel_state->bo[k++] = &bo->base.base;
                 }
-                prev_idx = j + 1;
         }
 
+        WARN_ON_ONCE(k != state->bo_count);
+
         if (exec[0])
                 state->start_bin = exec[0]->ct0ca;
         if (exec[1])
@@ -436,6 +436,19 @@ vc4_flush_caches(struct drm_device *dev)
                   VC4_SET_FIELD(0xf, V3D_SLCACTL_ICC));
 }
 
+static void
+vc4_flush_texture_caches(struct drm_device *dev)
+{
+        struct vc4_dev *vc4 = to_vc4_dev(dev);
+
+        V3D_WRITE(V3D_L2CACTL,
+                  V3D_L2CACTL_L2CCLR);
+
+        V3D_WRITE(V3D_SLCACTL,
+                  VC4_SET_FIELD(0xf, V3D_SLCACTL_T1CC) |
+                  VC4_SET_FIELD(0xf, V3D_SLCACTL_T0CC));
+}
+
 /* Sets the registers for the next job to be actually be executed in
  * the hardware.
  *
@@ -474,6 +487,14 @@ vc4_submit_next_render_job(struct drm_device *dev)
         if (!exec)
                 return;
 
+        /* A previous RCL may have written to one of our textures, and
+         * our full cache flush at bin time may have occurred before
+         * that RCL completed.  Flush the texture cache now, but not
+         * the instructions or uniforms (since we don't write those
+         * from an RCL).
+         */
+        vc4_flush_texture_caches(dev);
+
         submit_cl(dev, 1, exec->ct1ca, exec->ct1ea);
 }
 
@@ -888,8 +909,10 @@ vc4_complete_exec(struct drm_device *dev, struct vc4_exec_info *exec)
         /* If we got force-completed because of GPU reset rather than
          * through our IRQ handler, signal the fence now.
          */
-        if (exec->fence)
+        if (exec->fence) {
                 dma_fence_signal(exec->fence);
+                dma_fence_put(exec->fence);
+        }
 
         if (exec->bo) {
                 for (i = 0; i < exec->bo_count; i++) {
diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c
index 61b2e5377993..3dd62d75f531 100644
--- a/drivers/gpu/drm/vc4/vc4_irq.c
+++ b/drivers/gpu/drm/vc4/vc4_irq.c
@@ -139,6 +139,7 @@ vc4_irq_finish_render_job(struct drm_device *dev)
         list_move_tail(&exec->head, &vc4->job_done_list);
         if (exec->fence) {
                 dma_fence_signal_locked(exec->fence);
+                dma_fence_put(exec->fence);
                 exec->fence = NULL;
         }
         vc4_submit_next_render_job(dev);
@@ -208,9 +209,6 @@ vc4_irq_postinstall(struct drm_device *dev)
 {
         struct vc4_dev *vc4 = to_vc4_dev(dev);
 
-        /* Undo the effects of a previous vc4_irq_uninstall. */
-        enable_irq(dev->irq);
-
         /* Enable both the render done and out of memory interrupts. */
         V3D_WRITE(V3D_INTENA, V3D_DRIVER_IRQS);
 
diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c
index 622cd43840b8..493f392b3a0a 100644
--- a/drivers/gpu/drm/vc4/vc4_v3d.c
+++ b/drivers/gpu/drm/vc4/vc4_v3d.c
@@ -327,6 +327,9 @@ static int vc4_v3d_runtime_resume(struct device *dev)
                 return ret;
 
         vc4_v3d_init_hw(vc4->dev);
+
+        /* We disabled the IRQ as part of vc4_irq_uninstall in suspend. */
+        enable_irq(vc4->dev->irq);
         vc4_irq_postinstall(vc4->dev);
 
         return 0;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 21c62a34e558..87e8af5776a3 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -2731,6 +2731,8 @@ static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv,
         }
 
         view_type = vmw_view_cmd_to_type(header->id);
+        if (view_type == vmw_view_max)
+                return -EINVAL;
         cmd = container_of(header, typeof(*cmd), header);
         ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
                                 user_surface_converter,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 0545740b3724..fcd58145d0da 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -697,7 +697,6 @@ vmw_du_plane_duplicate_state(struct drm_plane *plane)
         vps->pinned = 0;
 
         /* Mapping is managed by prepare_fb/cleanup_fb */
-        memset(&vps->guest_map, 0, sizeof(vps->guest_map));
         memset(&vps->host_map, 0, sizeof(vps->host_map));
         vps->cpp = 0;
 
@@ -760,11 +759,6 @@ vmw_du_plane_destroy_state(struct drm_plane *plane,
 
 
         /* Should have been freed by cleanup_fb */
-        if (vps->guest_map.virtual) {
-                DRM_ERROR("Guest mapping not freed\n");
-                ttm_bo_kunmap(&vps->guest_map);
-        }
-
         if (vps->host_map.virtual) {
                 DRM_ERROR("Host mapping not freed\n");
                 ttm_bo_kunmap(&vps->host_map);
@@ -1869,7 +1863,7 @@ u32 vmw_get_vblank_counter(struct drm_device *dev, unsigned int pipe)
  */
 int vmw_enable_vblank(struct drm_device *dev, unsigned int pipe)
 {
-        return -ENOSYS;
+        return -EINVAL;
 }
 
 /**
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
index ff9c8389ff21..cd9da2dd79af 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
@@ -175,7 +175,7 @@ struct vmw_plane_state {
         int pinned;
 
         /* For CPU Blit */
-        struct ttm_bo_kmap_obj host_map, guest_map;
+        struct ttm_bo_kmap_obj host_map;
         unsigned int cpp;
 };
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index b8a09807c5de..3824595fece1 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -266,8 +266,8 @@ static const struct drm_connector_funcs vmw_legacy_connector_funcs = {
         .set_property = vmw_du_connector_set_property,
         .destroy = vmw_ldu_connector_destroy,
         .reset = vmw_du_connector_reset,
-        .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
-        .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+        .atomic_duplicate_state = vmw_du_connector_duplicate_state,
+        .atomic_destroy_state = vmw_du_connector_destroy_state,
         .atomic_set_property = vmw_du_connector_atomic_set_property,
         .atomic_get_property = vmw_du_connector_atomic_get_property,
 };
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
index bc5f6026573d..63a4cd794b73 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
@@ -420,8 +420,8 @@ static const struct drm_connector_funcs vmw_sou_connector_funcs = {
         .set_property = vmw_du_connector_set_property,
         .destroy = vmw_sou_connector_destroy,
         .reset = vmw_du_connector_reset,
-        .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
-        .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+        .atomic_duplicate_state = vmw_du_connector_duplicate_state,
+        .atomic_destroy_state = vmw_du_connector_destroy_state,
         .atomic_set_property = vmw_du_connector_atomic_set_property,
         .atomic_get_property = vmw_du_connector_atomic_get_property,
 };
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index 90b5437fd787..b68d74888ab1 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -114,7 +114,7 @@ struct vmw_screen_target_display_unit {
         bool defined;
 
         /* For CPU Blit */
-        struct ttm_bo_kmap_obj host_map, guest_map;
+        struct ttm_bo_kmap_obj host_map;
         unsigned int cpp;
 };
 
@@ -695,7 +695,8 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
         s32 src_pitch, dst_pitch;
         u8 *src, *dst;
         bool not_used;
-
+        struct ttm_bo_kmap_obj guest_map;
+        int ret;
 
         if (!dirty->num_hits)
                 return;
@@ -706,6 +707,13 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
         if (width == 0 || height == 0)
                 return;
 
+        ret = ttm_bo_kmap(&ddirty->buf->base, 0, ddirty->buf->base.num_pages,
+                          &guest_map);
+        if (ret) {
+                DRM_ERROR("Failed mapping framebuffer for blit: %d\n",
+                          ret);
+                goto out_cleanup;
+        }
 
         /* Assume we are blitting from Host (display_srf) to Guest (dmabuf) */
         src_pitch = stdu->display_srf->base_size.width * stdu->cpp;
@@ -713,7 +721,7 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
         src += ddirty->top * src_pitch + ddirty->left * stdu->cpp;
 
         dst_pitch = ddirty->pitch;
-        dst = ttm_kmap_obj_virtual(&stdu->guest_map, &not_used);
+        dst = ttm_kmap_obj_virtual(&guest_map, &not_used);
         dst += ddirty->fb_top * dst_pitch + ddirty->fb_left * stdu->cpp;
 
 
@@ -772,6 +780,7 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
                 vmw_fifo_commit(dev_priv, sizeof(*cmd));
         }
 
+        ttm_bo_kunmap(&guest_map);
 out_cleanup:
         ddirty->left = ddirty->top = ddirty->fb_left = ddirty->fb_top = S32_MAX;
         ddirty->right = ddirty->bottom = S32_MIN;
@@ -1109,9 +1118,6 @@ vmw_stdu_primary_plane_cleanup_fb(struct drm_plane *plane,
 {
         struct vmw_plane_state *vps = vmw_plane_state_to_vps(old_state);
 
-        if (vps->guest_map.virtual)
-                ttm_bo_kunmap(&vps->guest_map);
-
         if (vps->host_map.virtual)
                 ttm_bo_kunmap(&vps->host_map);
 
@@ -1277,33 +1283,11 @@ vmw_stdu_primary_plane_prepare_fb(struct drm_plane *plane,
          */
         if (vps->content_fb_type == SEPARATE_DMA &&
             !(dev_priv->capabilities & SVGA_CAP_3D)) {
-
-                struct vmw_framebuffer_dmabuf *new_vfbd;
-
-                new_vfbd = vmw_framebuffer_to_vfbd(new_fb);
-
-                ret = ttm_bo_reserve(&new_vfbd->buffer->base, false, false,
-                                     NULL);
-                if (ret)
-                        goto out_srf_unpin;
-
-                ret = ttm_bo_kmap(&new_vfbd->buffer->base, 0,
-                                  new_vfbd->buffer->base.num_pages,
-                                  &vps->guest_map);
-
-                ttm_bo_unreserve(&new_vfbd->buffer->base);
-
-                if (ret) {
-                        DRM_ERROR("Failed to map content buffer to CPU\n");
-                        goto out_srf_unpin;
-                }
-
                 ret = ttm_bo_kmap(&vps->surf->res.backup->base, 0,
                                   vps->surf->res.backup->base.num_pages,
                                   &vps->host_map);
                 if (ret) {
                         DRM_ERROR("Failed to map display buffer to CPU\n");
-                        ttm_bo_kunmap(&vps->guest_map);
                         goto out_srf_unpin;
                 }
 
@@ -1350,7 +1334,6 @@ vmw_stdu_primary_plane_atomic_update(struct drm_plane *plane,
         stdu->display_srf = vps->surf;
         stdu->content_fb_type = vps->content_fb_type;
         stdu->cpp = vps->cpp;
-        memcpy(&stdu->guest_map, &vps->guest_map, sizeof(vps->guest_map));
         memcpy(&stdu->host_map, &vps->host_map, sizeof(vps->host_map));
 
         if (!stdu->defined)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f3fcb836a1f9..0c3f608131cf 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -551,7 +551,7 @@ static int hid_parser_main(struct hid_parser *parser, struct hid_item *item)
                 ret = hid_add_field(parser, HID_FEATURE_REPORT, data);
                 break;
         default:
-                hid_err(parser->device, "unknown main item tag 0x%x\n", item->tag);
+                hid_warn(parser->device, "unknown main item tag 0x%x\n", item->tag);
                 ret = 0;
         }
 
diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
index 68cdc962265b..271f31461da4 100644
--- a/drivers/hid/hid-cp2112.c
+++ b/drivers/hid/hid-cp2112.c
@@ -696,8 +696,16 @@ static int cp2112_xfer(struct i2c_adapter *adap, u16 addr,
                                               (u8 *)&word, 2);
                 break;
         case I2C_SMBUS_I2C_BLOCK_DATA:
-                size = I2C_SMBUS_BLOCK_DATA;
-                /* fallthrough */
+                if (read_write == I2C_SMBUS_READ) {
+                        read_length = data->block[0];
+                        count = cp2112_write_read_req(buf, addr, read_length,
+                                                      command, NULL, 0);
+                } else {
+                        count = cp2112_write_req(buf, addr, command,
+                                                 data->block + 1,
+                                                 data->block[0]);
+                }
+                break;
         case I2C_SMBUS_BLOCK_DATA:
                 if (I2C_SMBUS_READ == read_write) {
                         count = cp2112_write_read_req(buf, addr,
@@ -785,6 +793,9 @@ static int cp2112_xfer(struct i2c_adapter *adap, u16 addr,
         case I2C_SMBUS_WORD_DATA:
                 data->word = le16_to_cpup((__le16 *)buf);
                 break;
+        case I2C_SMBUS_I2C_BLOCK_DATA:
+                memcpy(data->block + 1, buf, read_length);
+                break;
         case I2C_SMBUS_BLOCK_DATA:
                 if (read_length > I2C_SMBUS_BLOCK_MAX) {
                         ret = -EPROTO;
diff --git a/drivers/hid/hid-holtekff.c b/drivers/hid/hid-holtekff.c
index 9325545fc3ae..edc0f64bb584 100644
--- a/drivers/hid/hid-holtekff.c
+++ b/drivers/hid/hid-holtekff.c
@@ -32,10 +32,6 @@
 
 #ifdef CONFIG_HOLTEK_FF
 
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Anssi Hannula <anssi.hannula@iki.fi>");
-MODULE_DESCRIPTION("Force feedback support for Holtek On Line Grip based devices");
-
 /*
  * These commands and parameters are currently known:
  *
@@ -223,3 +219,7 @@ static struct hid_driver holtek_driver = {
         .probe = holtek_probe,
 };
 module_hid_driver(holtek_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Anssi Hannula <anssi.hannula@iki.fi>");
+MODULE_DESCRIPTION("Force feedback support for Holtek On Line Grip based devices");
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index 19f0cf37e0ed..ba0a092ae085 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -659,22 +659,28 @@ void vmbus_close(struct vmbus_channel *channel)
                  */
                 return;
         }
-        mutex_lock(&vmbus_connection.channel_mutex);
         /*
          * Close all the sub-channels first and then close the
          * primary channel.
          */
         list_for_each_safe(cur, tmp, &channel->sc_list) {
                 cur_channel = list_entry(cur, struct vmbus_channel, sc_list);
-                vmbus_close_internal(cur_channel);
                 if (cur_channel->rescind) {
+                        wait_for_completion(&cur_channel->rescind_event);
+                        mutex_lock(&vmbus_connection.channel_mutex);
+                        vmbus_close_internal(cur_channel);
                         hv_process_channel_removal(
                                            cur_channel->offermsg.child_relid);
+                } else {
+                        mutex_lock(&vmbus_connection.channel_mutex);
+                        vmbus_close_internal(cur_channel);
                 }
+                mutex_unlock(&vmbus_connection.channel_mutex);
         }
         /*
          * Now close the primary.
          */
+        mutex_lock(&vmbus_connection.channel_mutex);
         vmbus_close_internal(channel);
         mutex_unlock(&vmbus_connection.channel_mutex);
 }
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index ec5454f3f4a6..c21020b69114 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -333,6 +333,7 @@ static struct vmbus_channel *alloc_channel(void)
                 return NULL;
 
         spin_lock_init(&channel->lock);
+        init_completion(&channel->rescind_event);
 
         INIT_LIST_HEAD(&channel->sc_list);
         INIT_LIST_HEAD(&channel->percpu_list);
@@ -898,6 +899,7 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
         /*
          * Now wait for offer handling to complete.
          */
+        vmbus_rescind_cleanup(channel);
         while (READ_ONCE(channel->probe_done) == false) {
                 /*
                  * We wait here until any channel offer is currently
@@ -913,7 +915,6 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
         if (channel->device_obj) {
                 if (channel->chn_rescind_callback) {
                         channel->chn_rescind_callback(channel);
-                        vmbus_rescind_cleanup(channel);
                         return;
                 }
                 /*
@@ -922,7 +923,6 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
                  */
                 dev = get_device(&channel->device_obj->device);
                 if (dev) {
-                        vmbus_rescind_cleanup(channel);
                         vmbus_device_unregister(channel->device_obj);
                         put_device(dev);
                 }
@@ -936,13 +936,14 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
                  * 2. Then close the primary channel.
                  */
                 mutex_lock(&vmbus_connection.channel_mutex);
-                vmbus_rescind_cleanup(channel);
                 if (channel->state == CHANNEL_OPEN_STATE) {
                         /*
                          * The channel is currently not open;
                          * it is safe for us to cleanup the channel.
                          */
                         hv_process_channel_removal(rescind->child_relid);
+                } else {
+                        complete(&channel->rescind_event);
                 }
                 mutex_unlock(&vmbus_connection.channel_mutex);
         }
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index 76ed9a216f10..610223f0e945 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -1378,6 +1378,8 @@ void vmbus_device_unregister(struct hv_device *device_obj)
         pr_debug("child device %s unregistered\n",
                 dev_name(&device_obj->device));
 
+        kset_unregister(device_obj->channels_kset);
+
         /*
          * Kick off the process of unregistering the device.
          * This will call vmbus_remove() and eventually vmbus_device_release()
diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
index c9790e2c3440..af5123042990 100644
--- a/drivers/hwmon/hwmon.c
+++ b/drivers/hwmon/hwmon.c
@@ -143,6 +143,7 @@ static int hwmon_thermal_add_sensor(struct device *dev,
                                     struct hwmon_device *hwdev, int index)
 {
         struct hwmon_thermal_data *tdata;
+        struct thermal_zone_device *tzd;
 
         tdata = devm_kzalloc(dev, sizeof(*tdata), GFP_KERNEL);
         if (!tdata)
@@ -151,8 +152,14 @@ static int hwmon_thermal_add_sensor(struct device *dev,
         tdata->hwdev = hwdev;
         tdata->index = index;
 
-        devm_thermal_zone_of_sensor_register(&hwdev->dev, index, tdata,
-                                             &hwmon_thermal_ops);
+        tzd = devm_thermal_zone_of_sensor_register(&hwdev->dev, index, tdata,
+                                                   &hwmon_thermal_ops);
+        /*
+         * If CONFIG_THERMAL_OF is disabled, this returns -ENODEV,
+         * so ignore that error but forward any other error.
+         */
+        if (IS_ERR(tzd) && (PTR_ERR(tzd) != -ENODEV))
+                return PTR_ERR(tzd);
 
         return 0;
 }
@@ -621,14 +628,20 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
                                 if (!chip->ops->is_visible(drvdata, hwmon_temp,
                                                            hwmon_temp_input, j))
                                         continue;
-                                if (info[i]->config[j] & HWMON_T_INPUT)
-                                        hwmon_thermal_add_sensor(dev, hwdev, j);
+                                if (info[i]->config[j] & HWMON_T_INPUT) {
+                                        err = hwmon_thermal_add_sensor(dev,
+                                                                hwdev, j);
+                                        if (err)
+                                                goto free_device;
+                                }
                         }
                 }
         }
 
         return hdev;
 
+free_device:
+        device_unregister(hdev);
 free_hwmon:
         kfree(hwdev);
 ida_remove:
diff --git a/drivers/hwtracing/stm/ftrace.c b/drivers/hwtracing/stm/ftrace.c
index bd126a7c6da2..7da75644c750 100644
--- a/drivers/hwtracing/stm/ftrace.c
+++ b/drivers/hwtracing/stm/ftrace.c
@@ -42,9 +42,11 @@ static struct stm_ftrace {
  * @len:        length of the data packet
  */
 static void notrace
-stm_ftrace_write(const void *buf, unsigned int len)
+stm_ftrace_write(struct trace_export *export, const void *buf, unsigned int len)
 {
-        stm_source_write(&stm_ftrace.data, STM_FTRACE_CHAN, buf, len);
+        struct stm_ftrace *stm = container_of(export, struct stm_ftrace, ftrace);
+
+        stm_source_write(&stm->data, STM_FTRACE_CHAN, buf, len);
 }
 
 static int stm_ftrace_link(struct stm_source_data *data)
diff --git a/drivers/i2c/busses/i2c-cht-wc.c b/drivers/i2c/busses/i2c-cht-wc.c
index 0d05dadb2dc5..44cffad43701 100644
--- a/drivers/i2c/busses/i2c-cht-wc.c
+++ b/drivers/i2c/busses/i2c-cht-wc.c
@@ -379,7 +379,7 @@ static int cht_wc_i2c_adap_i2c_remove(struct platform_device *pdev)
         return 0;
 }
 
-static struct platform_device_id cht_wc_i2c_adap_id_table[] = {
+static const struct platform_device_id cht_wc_i2c_adap_id_table[] = {
         { .name = "cht_wcove_ext_chgr" },
         {},
 };
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index 174579d32e5f..462948e2c535 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -983,7 +983,7 @@ static void piix4_adap_remove(struct i2c_adapter *adap)
 
         if (adapdata->smba) {
                 i2c_del_adapter(adap);
-                if (adapdata->port == (0 << 1)) {
+                if (adapdata->port == (0 << piix4_port_shift_sb800)) {
                         release_region(adapdata->smba, SMBIOSIZE);
                         if (adapdata->sb800_main)
                                 release_region(SB800_PIIX4_SMB_IDX, 2);
diff --git a/drivers/i2c/busses/i2c-stm32.h b/drivers/i2c/busses/i2c-stm32.h
index dab51761f8c5..d4f9cef251ac 100644
--- a/drivers/i2c/busses/i2c-stm32.h
+++ b/drivers/i2c/busses/i2c-stm32.h
@@ -1,10 +1,11 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * i2c-stm32.h
  *
  * Copyright (C) M'boumba Cedric Madianga 2017
+ * Copyright (C) STMicroelectronics 2017
  * Author: M'boumba Cedric Madianga <cedric.madianga@gmail.com>
  *
- * License terms:  GNU General Public License (GPL), version 2
  */
 
 #ifndef _I2C_STM32_H
diff --git a/drivers/i2c/busses/i2c-stm32f4.c b/drivers/i2c/busses/i2c-stm32f4.c
index 4ec108496f15..47c8d00de53f 100644
--- a/drivers/i2c/busses/i2c-stm32f4.c
+++ b/drivers/i2c/busses/i2c-stm32f4.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Driver for STMicroelectronics STM32 I2C controller
  *
@@ -6,11 +7,11 @@
  * http://www.st.com/resource/en/reference_manual/DM00031020.pdf
  *
  * Copyright (C) M'boumba Cedric Madianga 2016
+ * Copyright (C) STMicroelectronics 2017
  * Author: M'boumba Cedric Madianga <cedric.madianga@gmail.com>
  *
  * This driver is based on i2c-st.c
  *
- * License terms:  GNU General Public License (GPL), version 2
  */
 
 #include <linux/clk.h>
diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
index d4a6e9c2e9aa..b445b3bb0bb1 100644
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Driver for STMicroelectronics STM32F7 I2C controller
  *
@@ -7,11 +8,11 @@
  * http://www.st.com/resource/en/reference_manual/dm00124865.pdf
  *
  * Copyright (C) M'boumba Cedric Madianga 2017
+ * Copyright (C) STMicroelectronics 2017
  * Author: M'boumba Cedric Madianga <cedric.madianga@gmail.com>
  *
  * This driver is based on i2c-stm32f4.c
  *
- * License terms:  GNU General Public License (GPL), version 2
  */
 #include <linux/clk.h>
 #include <linux/delay.h>
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index 706164b4c5be..f7829a74140c 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -821,8 +821,12 @@ void i2c_unregister_device(struct i2c_client *client)
 {
         if (!client)
                 return;
-        if (client->dev.of_node)
+
+        if (client->dev.of_node) {
                 of_node_clear_flag(client->dev.of_node, OF_POPULATED);
+                of_node_put(client->dev.of_node);
+        }
+
         if (ACPI_COMPANION(&client->dev))
                 acpi_device_clear_enumerated(ACPI_COMPANION(&client->dev));
         device_unregister(&client->dev);
diff --git a/drivers/i2c/i2c-core-smbus.c b/drivers/i2c/i2c-core-smbus.c
index 4bb9927afd01..a1082c04ac5c 100644
--- a/drivers/i2c/i2c-core-smbus.c
+++ b/drivers/i2c/i2c-core-smbus.c
@@ -397,16 +397,17 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter *adapter, u16 addr,
                                    the underlying bus driver */
                 break;
         case I2C_SMBUS_I2C_BLOCK_DATA:
+                if (data->block[0] > I2C_SMBUS_BLOCK_MAX) {
+                        dev_err(&adapter->dev, "Invalid block %s size %d\n",
+                                read_write == I2C_SMBUS_READ ? "read" : "write",
+                                data->block[0]);
+                        return -EINVAL;
+                }
+
                 if (read_write == I2C_SMBUS_READ) {
                         msg[1].len = data->block[0];
                 } else {
                         msg[0].len = data->block[0] + 1;
-                        if (msg[0].len > I2C_SMBUS_BLOCK_MAX + 1) {
-                                dev_err(&adapter->dev,
-                                        "Invalid block write size %d\n",
-                                        data->block[0]);
-                                return -EINVAL;
-                        }
                         for (i = 1; i <= data->block[0]; i++)
                                 msgbuf0[i] = data->block[i];
                 }
diff --git a/drivers/iio/adc/cpcap-adc.c b/drivers/iio/adc/cpcap-adc.c
index 3576ec73ec23..9ad60421d360 100644
--- a/drivers/iio/adc/cpcap-adc.c
+++ b/drivers/iio/adc/cpcap-adc.c
@@ -1011,7 +1011,7 @@ static int cpcap_adc_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, indio_dev);
 
         ddata->irq = platform_get_irq_byname(pdev, "adcdone");
-        if (!ddata->irq)
+        if (ddata->irq < 0)
                 return -ENODEV;
 
         error = devm_request_threaded_irq(&pdev->dev, ddata->irq, NULL,
diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
index 9c6932ffc0af..36047147ce7c 100644
--- a/drivers/iio/adc/meson_saradc.c
+++ b/drivers/iio/adc/meson_saradc.c
@@ -221,8 +221,10 @@ enum meson_sar_adc_chan7_mux_sel {
 
 struct meson_sar_adc_data {
         bool                                    has_bl30_integration;
+        u32                                     bandgap_reg;
         unsigned int                            resolution;
         const char                              *name;
+        const struct regmap_config              *regmap_config;
 };
 
 struct meson_sar_adc_priv {
@@ -242,13 +244,20 @@ struct meson_sar_adc_priv {
         int                                     calibscale;
 };
 
-static const struct regmap_config meson_sar_adc_regmap_config = {
+static const struct regmap_config meson_sar_adc_regmap_config_gxbb = {
         .reg_bits = 8,
         .val_bits = 32,
         .reg_stride = 4,
         .max_register = MESON_SAR_ADC_REG13,
 };
 
+static const struct regmap_config meson_sar_adc_regmap_config_meson8 = {
+        .reg_bits = 8,
+        .val_bits = 32,
+        .reg_stride = 4,
+        .max_register = MESON_SAR_ADC_DELTA_10,
+};
+
 static unsigned int meson_sar_adc_get_fifo_count(struct iio_dev *indio_dev)
 {
         struct meson_sar_adc_priv *priv = iio_priv(indio_dev);
@@ -600,7 +609,7 @@ static int meson_sar_adc_clk_init(struct iio_dev *indio_dev,
         init.num_parents = 1;
 
         priv->clk_gate.reg = base + MESON_SAR_ADC_REG3;
-        priv->clk_gate.bit_idx = fls(MESON_SAR_ADC_REG3_CLK_EN);
+        priv->clk_gate.bit_idx = __ffs(MESON_SAR_ADC_REG3_CLK_EN);
         priv->clk_gate.hw.init = &init;
 
         priv->adc_clk = devm_clk_register(&indio_dev->dev, &priv->clk_gate.hw);
@@ -685,6 +694,20 @@ static int meson_sar_adc_init(struct iio_dev *indio_dev)
         return 0;
 }
 
+static void meson_sar_adc_set_bandgap(struct iio_dev *indio_dev, bool on_off)
+{
+        struct meson_sar_adc_priv *priv = iio_priv(indio_dev);
+        u32 enable_mask;
+
+        if (priv->data->bandgap_reg == MESON_SAR_ADC_REG11)
+                enable_mask = MESON_SAR_ADC_REG11_BANDGAP_EN;
+        else
+                enable_mask = MESON_SAR_ADC_DELTA_10_TS_VBG_EN;
+
+        regmap_update_bits(priv->regmap, priv->data->bandgap_reg, enable_mask,
+                           on_off ? enable_mask : 0);
+}
+
 static int meson_sar_adc_hw_enable(struct iio_dev *indio_dev)
 {
         struct meson_sar_adc_priv *priv = iio_priv(indio_dev);
@@ -717,9 +740,9 @@ static int meson_sar_adc_hw_enable(struct iio_dev *indio_dev)
         regval = FIELD_PREP(MESON_SAR_ADC_REG0_FIFO_CNT_IRQ_MASK, 1);
         regmap_update_bits(priv->regmap, MESON_SAR_ADC_REG0,
                            MESON_SAR_ADC_REG0_FIFO_CNT_IRQ_MASK, regval);
-        regmap_update_bits(priv->regmap, MESON_SAR_ADC_REG11,
-                           MESON_SAR_ADC_REG11_BANDGAP_EN,
-                           MESON_SAR_ADC_REG11_BANDGAP_EN);
+
+        meson_sar_adc_set_bandgap(indio_dev, true);
+
         regmap_update_bits(priv->regmap, MESON_SAR_ADC_REG3,
                            MESON_SAR_ADC_REG3_ADC_EN,
                            MESON_SAR_ADC_REG3_ADC_EN);
@@ -739,8 +762,7 @@ static int meson_sar_adc_hw_enable(struct iio_dev *indio_dev)
 err_adc_clk:
         regmap_update_bits(priv->regmap, MESON_SAR_ADC_REG3,
                            MESON_SAR_ADC_REG3_ADC_EN, 0);
-        regmap_update_bits(priv->regmap, MESON_SAR_ADC_REG11,
-                           MESON_SAR_ADC_REG11_BANDGAP_EN, 0);
+        meson_sar_adc_set_bandgap(indio_dev, false);
         clk_disable_unprepare(priv->sana_clk);
 err_sana_clk:
         clk_disable_unprepare(priv->core_clk);
@@ -765,8 +787,8 @@ static int meson_sar_adc_hw_disable(struct iio_dev *indio_dev)
 
         regmap_update_bits(priv->regmap, MESON_SAR_ADC_REG3,
                            MESON_SAR_ADC_REG3_ADC_EN, 0);
-        regmap_update_bits(priv->regmap, MESON_SAR_ADC_REG11,
-                           MESON_SAR_ADC_REG11_BANDGAP_EN, 0);
+
+        meson_sar_adc_set_bandgap(indio_dev, false);
 
         clk_disable_unprepare(priv->sana_clk);
         clk_disable_unprepare(priv->core_clk);
@@ -844,30 +866,40 @@ static const struct iio_info meson_sar_adc_iio_info = {
 
 static const struct meson_sar_adc_data meson_sar_adc_meson8_data = {
         .has_bl30_integration = false,
+        .bandgap_reg = MESON_SAR_ADC_DELTA_10,
+        .regmap_config = &meson_sar_adc_regmap_config_meson8,
         .resolution = 10,
         .name = "meson-meson8-saradc",
 };
 
 static const struct meson_sar_adc_data meson_sar_adc_meson8b_data = {
         .has_bl30_integration = false,
+        .bandgap_reg = MESON_SAR_ADC_DELTA_10,
+        .regmap_config = &meson_sar_adc_regmap_config_meson8,
         .resolution = 10,
         .name = "meson-meson8b-saradc",
 };
 
 static const struct meson_sar_adc_data meson_sar_adc_gxbb_data = {
         .has_bl30_integration = true,
+        .bandgap_reg = MESON_SAR_ADC_REG11,
+        .regmap_config = &meson_sar_adc_regmap_config_gxbb,
         .resolution = 10,
         .name = "meson-gxbb-saradc",
 };
 
 static const struct meson_sar_adc_data meson_sar_adc_gxl_data = {
         .has_bl30_integration = true,
+        .bandgap_reg = MESON_SAR_ADC_REG11,
+        .regmap_config = &meson_sar_adc_regmap_config_gxbb,
         .resolution = 12,
         .name = "meson-gxl-saradc",
 };
 
 static const struct meson_sar_adc_data meson_sar_adc_gxm_data = {
         .has_bl30_integration = true,
+        .bandgap_reg = MESON_SAR_ADC_REG11,
+        .regmap_config = &meson_sar_adc_regmap_config_gxbb,
         .resolution = 12,
         .name = "meson-gxm-saradc",
 };
@@ -945,7 +977,7 @@ static int meson_sar_adc_probe(struct platform_device *pdev)
                 return ret;
 
         priv->regmap = devm_regmap_init_mmio(&pdev->dev, base,
-                                             &meson_sar_adc_regmap_config);
+                                             priv->data->regmap_config);
         if (IS_ERR(priv->regmap))
                 return PTR_ERR(priv->regmap);
 
diff --git a/drivers/iio/health/max30102.c b/drivers/iio/health/max30102.c
index 203ffb9cad6a..147a8c14235f 100644
--- a/drivers/iio/health/max30102.c
+++ b/drivers/iio/health/max30102.c
@@ -371,7 +371,7 @@ static int max30102_read_raw(struct iio_dev *indio_dev,
                 mutex_unlock(&indio_dev->mlock);
                 break;
         case IIO_CHAN_INFO_SCALE:
-                *val = 1;  /* 0.0625 */
+                *val = 1000;  /* 62.5 */
                 *val2 = 16;
                 ret = IIO_VAL_FRACTIONAL;
                 break;
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 9c4cfd19b739..2f0998ebeed2 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -631,7 +631,7 @@ static ssize_t __iio_format_value(char *buf, size_t len, unsigned int type,
  * iio_format_value() - Formats a IIO value into its string representation
  * @buf:        The buffer to which the formatted value gets written
  *              which is assumed to be big enough (i.e. PAGE_SIZE).
- * @type:       One of the IIO_VAL_... constants. This decides how the val
+ * @type:       One of the IIO_VAL_* constants. This decides how the val
  *              and val2 parameters are formatted.
  * @size:       Number of IIO value entries contained in vals
  * @vals:       Pointer to the values, exact meaning depends on the
@@ -639,7 +639,7 @@ static ssize_t __iio_format_value(char *buf, size_t len, unsigned int type,
  *
  * Return: 0 by default, a negative number on failure or the
  *         total number of characters written for a type that belongs
- *         to the IIO_VAL_... constant.
+ *         to the IIO_VAL_* constant.
  */
 ssize_t iio_format_value(char *buf, unsigned int type, int size, int *vals)
 {
diff --git a/drivers/iio/proximity/sx9500.c b/drivers/iio/proximity/sx9500.c
index 53c5d653e780..df23dbcc030a 100644
--- a/drivers/iio/proximity/sx9500.c
+++ b/drivers/iio/proximity/sx9500.c
@@ -869,6 +869,7 @@ static int sx9500_init_device(struct iio_dev *indio_dev)
 static void sx9500_gpio_probe(struct i2c_client *client,
                               struct sx9500_data *data)
 {
+        struct gpio_desc *gpiod_int;
         struct device *dev;
 
         if (!client)
@@ -876,6 +877,14 @@ static void sx9500_gpio_probe(struct i2c_client *client,
 
         dev = &client->dev;
 
+        if (client->irq <= 0) {
+                gpiod_int = devm_gpiod_get(dev, SX9500_GPIO_INT, GPIOD_IN);
+                if (IS_ERR(gpiod_int))
+                        dev_err(dev, "gpio get irq failed\n");
+                else
+                        client->irq = gpiod_to_irq(gpiod_int);
+        }
+
         data->gpiod_rst = devm_gpiod_get(dev, SX9500_GPIO_RESET, GPIOD_OUT_HIGH);
         if (IS_ERR(data->gpiod_rst)) {
                 dev_warn(dev, "gpio get reset pin failed\n");
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index 7750a9c38b06..1df7da47f431 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -763,11 +763,11 @@ static int complete_subctxt(struct hfi1_filedata *fd)
         }
 
         if (ret) {
-                hfi1_rcd_put(fd->uctxt);
-                fd->uctxt = NULL;
                 spin_lock_irqsave(&fd->dd->uctxt_lock, flags);
                 __clear_bit(fd->subctxt, fd->uctxt->in_use_ctxts);
                 spin_unlock_irqrestore(&fd->dd->uctxt_lock, flags);
+                hfi1_rcd_put(fd->uctxt);
+                fd->uctxt = NULL;
         }
 
         return ret;
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 5007280321b6..4236c8086820 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1543,7 +1543,8 @@ static int mlx5_ib_alloc_transport_domain(struct mlx5_ib_dev *dev, u32 *tdn)
                 return err;
 
         if ((MLX5_CAP_GEN(dev->mdev, port_type) != MLX5_CAP_PORT_TYPE_ETH) ||
-            !MLX5_CAP_GEN(dev->mdev, disable_local_lb))
+            (!MLX5_CAP_GEN(dev->mdev, disable_local_lb_uc) &&
+             !MLX5_CAP_GEN(dev->mdev, disable_local_lb_mc)))
                 return err;
 
         mutex_lock(&dev->lb_mutex);
@@ -1561,7 +1562,8 @@ static void mlx5_ib_dealloc_transport_domain(struct mlx5_ib_dev *dev, u32 tdn)
         mlx5_core_dealloc_transport_domain(dev->mdev, tdn);
 
         if ((MLX5_CAP_GEN(dev->mdev, port_type) != MLX5_CAP_PORT_TYPE_ETH) ||
-            !MLX5_CAP_GEN(dev->mdev, disable_local_lb))
+            (!MLX5_CAP_GEN(dev->mdev, disable_local_lb_uc) &&
+             !MLX5_CAP_GEN(dev->mdev, disable_local_lb_mc)))
                 return;
 
         mutex_lock(&dev->lb_mutex);
@@ -4711,7 +4713,8 @@ static int mlx5_ib_stage_caps_init(struct mlx5_ib_dev *dev)
                 return err;
 
         if ((MLX5_CAP_GEN(dev->mdev, port_type) == MLX5_CAP_PORT_TYPE_ETH) &&
-            MLX5_CAP_GEN(dev->mdev, disable_local_lb))
+            (MLX5_CAP_GEN(dev->mdev, disable_local_lb_uc) ||
+             MLX5_CAP_GEN(dev->mdev, disable_local_lb_mc)))
                 mutex_init(&dev->lb_mutex);
 
         return 0;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index d5cc95ffd4ac..39d24bf694a8 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -4674,12 +4674,11 @@ static void to_rdma_ah_attr(struct mlx5_ib_dev *ibdev,
 
         memset(ah_attr, 0, sizeof(*ah_attr));
 
-        ah_attr->type = rdma_ah_find_type(&ibdev->ib_dev, path->port);
-        rdma_ah_set_port_num(ah_attr, path->port);
-        if (rdma_ah_get_port_num(ah_attr) == 0 ||
-            rdma_ah_get_port_num(ah_attr) > ibdev->num_ports)
+        if (!path->port || path->port > ibdev->num_ports)
                 return;
 
+        ah_attr->type = rdma_ah_find_type(&ibdev->ib_dev, path->port);
+
         rdma_ah_set_port_num(ah_attr, path->port);
         rdma_ah_set_sl(ah_attr, path->dci_cfi_prio_sl & 0xf);
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index dfbb8fdda5f6..962fbcb57dc7 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1458,8 +1458,7 @@ void ipoib_cm_skb_too_long(struct net_device *dev, struct sk_buff *skb,
         struct ipoib_dev_priv *priv = ipoib_priv(dev);
         int e = skb_queue_empty(&priv->cm.skb_queue);
 
-        if (skb_dst(skb))
-                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
+        skb_dst_update_pmtu(skb, mtu);
 
         skb_queue_tail(&priv->cm.skb_queue, skb);
         if (e)
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index fd55163801a3..fff40b097947 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -741,6 +741,7 @@ isert_connect_error(struct rdma_cm_id *cma_id)
 {
         struct isert_conn *isert_conn = cma_id->qp->qp_context;
 
+        ib_drain_qp(isert_conn->qp);
         list_del_init(&isert_conn->node);
         isert_conn->cm_id = NULL;
         isert_put_conn(isert_conn);
diff --git a/drivers/input/joystick/analog.c b/drivers/input/joystick/analog.c
index 3d8ff09eba57..c868a878c84f 100644
--- a/drivers/input/joystick/analog.c
+++ b/drivers/input/joystick/analog.c
@@ -163,7 +163,7 @@ static unsigned int get_time_pit(void)
 #define GET_TIME(x)     do { x = (unsigned int)rdtsc(); } while (0)
 #define DELTA(x,y)      ((y)-(x))
 #define TIME_NAME       "TSC"
-#elif defined(__alpha__) || defined(CONFIG_MN10300) || defined(CONFIG_ARM) || defined(CONFIG_ARM64) || defined(CONFIG_TILE)
+#elif defined(__alpha__) || defined(CONFIG_MN10300) || defined(CONFIG_ARM) || defined(CONFIG_ARM64) || defined(CONFIG_RISCV) || defined(CONFIG_TILE)
 #define GET_TIME(x)     do { x = get_cycles(); } while (0)
 #define DELTA(x,y)      ((y)-(x))
 #define TIME_NAME       "get_cycles"
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index d86e59515b9c..d88d3e0f59fb 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -229,6 +229,7 @@ static const struct xpad_device {
         { 0x0e6f, 0x0213, "Afterglow Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
         { 0x0e6f, 0x021f, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
         { 0x0e6f, 0x0246, "Rock Candy Gamepad for Xbox One 2015", 0, XTYPE_XBOXONE },
+        { 0x0e6f, 0x02ab, "PDP Controller for Xbox One", 0, XTYPE_XBOXONE },
         { 0x0e6f, 0x0301, "Logic3 Controller", 0, XTYPE_XBOX360 },
         { 0x0e6f, 0x0346, "Rock Candy Gamepad for Xbox One 2016", 0, XTYPE_XBOXONE },
         { 0x0e6f, 0x0401, "Logic3 Controller", 0, XTYPE_XBOX360 },
@@ -476,6 +477,22 @@ static const u8 xboxone_hori_init[] = {
 };
 
 /*
+ * This packet is required for some of the PDP pads to start
+ * sending input reports. One of those pads is (0x0e6f:0x02ab).
+ */
+static const u8 xboxone_pdp_init1[] = {
+        0x0a, 0x20, 0x00, 0x03, 0x00, 0x01, 0x14
+};
+
+/*
+ * This packet is required for some of the PDP pads to start
+ * sending input reports. One of those pads is (0x0e6f:0x02ab).
+ */
+static const u8 xboxone_pdp_init2[] = {
+        0x06, 0x20, 0x00, 0x02, 0x01, 0x00
+};
+
+/*
  * A specific rumble packet is required for some PowerA pads to start
  * sending input reports. One of those pads is (0x24c6:0x543a).
  */
@@ -505,6 +522,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = {
         XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init),
         XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init),
         XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init),
+        XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init1),
+        XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init2),
         XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init),
         XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init),
         XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init),
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index ae473123583b..3d51175c4d72 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1651,7 +1651,7 @@ ims_pcu_get_cdc_union_desc(struct usb_interface *intf)
                                 return union_desc;
 
                         dev_err(&intf->dev,
-                                "Union descriptor to short (%d vs %zd\n)",
+                                "Union descriptor too short (%d vs %zd)\n",
                                 union_desc->bLength, sizeof(*union_desc));
                         return NULL;
                 }
diff --git a/drivers/input/misc/twl4030-vibra.c b/drivers/input/misc/twl4030-vibra.c
index 6c51d404874b..c37aea9ac272 100644
--- a/drivers/input/misc/twl4030-vibra.c
+++ b/drivers/input/misc/twl4030-vibra.c
@@ -178,12 +178,14 @@ static SIMPLE_DEV_PM_OPS(twl4030_vibra_pm_ops,
                          twl4030_vibra_suspend, twl4030_vibra_resume);
 
 static bool twl4030_vibra_check_coexist(struct twl4030_vibra_data *pdata,
-                              struct device_node *node)
+                              struct device_node *parent)
 {
+        struct device_node *node;
+
         if (pdata && pdata->coexist)
                 return true;
 
-        node = of_find_node_by_name(node, "codec");
+        node = of_get_child_by_name(parent, "codec");
         if (node) {
                 of_node_put(node);
                 return true;
diff --git a/drivers/input/misc/twl6040-vibra.c b/drivers/input/misc/twl6040-vibra.c
index 5690eb7ff954..15e0d352c4cc 100644
--- a/drivers/input/misc/twl6040-vibra.c
+++ b/drivers/input/misc/twl6040-vibra.c
@@ -248,8 +248,7 @@ static int twl6040_vibra_probe(struct platform_device *pdev)
         int vddvibr_uV = 0;
         int error;
 
-        of_node_get(twl6040_core_dev->of_node);
-        twl6040_core_node = of_find_node_by_name(twl6040_core_dev->of_node,
+        twl6040_core_node = of_get_child_by_name(twl6040_core_dev->of_node,
                                                  "vibra");
         if (!twl6040_core_node) {
                 dev_err(&pdev->dev, "parent of node is missing?\n");
diff --git a/drivers/input/misc/xen-kbdfront.c b/drivers/input/misc/xen-kbdfront.c
index 6bf56bb5f8d9..d91f3b1c5375 100644
--- a/drivers/input/misc/xen-kbdfront.c
+++ b/drivers/input/misc/xen-kbdfront.c
@@ -326,8 +326,6 @@ static int xenkbd_probe(struct xenbus_device *dev,
                                      0, width, 0, 0);
                 input_set_abs_params(mtouch, ABS_MT_POSITION_Y,
                                      0, height, 0, 0);
-                input_set_abs_params(mtouch, ABS_MT_PRESSURE,
-                                     0, 255, 0, 0);
 
                 ret = input_mt_init_slots(mtouch, num_cont, INPUT_MT_DIRECT);
                 if (ret) {
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 579b899add26..dbe57da8c1a1 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1250,29 +1250,32 @@ static int alps_decode_ss4_v2(struct alps_fields *f,
         case SS4_PACKET_ID_MULTI:
                 if (priv->flags & ALPS_BUTTONPAD) {
                         if (IS_SS4PLUS_DEV(priv->dev_id)) {
-                                f->mt[0].x = SS4_PLUS_BTL_MF_X_V2(p, 0);
-                                f->mt[1].x = SS4_PLUS_BTL_MF_X_V2(p, 1);
+                                f->mt[2].x = SS4_PLUS_BTL_MF_X_V2(p, 0);
+                                f->mt[3].x = SS4_PLUS_BTL_MF_X_V2(p, 1);
+                                no_data_x = SS4_PLUS_MFPACKET_NO_AX_BL;
                         } else {
                                 f->mt[2].x = SS4_BTL_MF_X_V2(p, 0);
                                 f->mt[3].x = SS4_BTL_MF_X_V2(p, 1);
+                                no_data_x = SS4_MFPACKET_NO_AX_BL;
                         }
+                        no_data_y = SS4_MFPACKET_NO_AY_BL;
 
                         f->mt[2].y = SS4_BTL_MF_Y_V2(p, 0);
                         f->mt[3].y = SS4_BTL_MF_Y_V2(p, 1);
-                        no_data_x = SS4_MFPACKET_NO_AX_BL;
-                        no_data_y = SS4_MFPACKET_NO_AY_BL;
                 } else {
                         if (IS_SS4PLUS_DEV(priv->dev_id)) {
-                                f->mt[0].x = SS4_PLUS_STD_MF_X_V2(p, 0);
-                                f->mt[1].x = SS4_PLUS_STD_MF_X_V2(p, 1);
+                                f->mt[2].x = SS4_PLUS_STD_MF_X_V2(p, 0);
+                                f->mt[3].x = SS4_PLUS_STD_MF_X_V2(p, 1);
+                                no_data_x = SS4_PLUS_MFPACKET_NO_AX;
                         } else {
-                                f->mt[0].x = SS4_STD_MF_X_V2(p, 0);
-                                f->mt[1].x = SS4_STD_MF_X_V2(p, 1);
+                                f->mt[2].x = SS4_STD_MF_X_V2(p, 0);
+                                f->mt[3].x = SS4_STD_MF_X_V2(p, 1);
+                                no_data_x = SS4_MFPACKET_NO_AX;
                         }
+                        no_data_y = SS4_MFPACKET_NO_AY;
+
                         f->mt[2].y = SS4_STD_MF_Y_V2(p, 0);
                         f->mt[3].y = SS4_STD_MF_Y_V2(p, 1);
-                        no_data_x = SS4_MFPACKET_NO_AX;
-                        no_data_y = SS4_MFPACKET_NO_AY;
                 }
 
                 f->first_mp = 0;
diff --git a/drivers/input/mouse/alps.h b/drivers/input/mouse/alps.h
index c80a7c76cb76..79b6d69d1486 100644
--- a/drivers/input/mouse/alps.h
+++ b/drivers/input/mouse/alps.h
@@ -141,10 +141,12 @@ enum SS4_PACKET_ID {
 #define SS4_TS_Z_V2(_b)         (s8)(_b[4] & 0x7F)
 
 
-#define SS4_MFPACKET_NO_AX      8160    /* X-Coordinate value */
-#define SS4_MFPACKET_NO_AY      4080    /* Y-Coordinate value */
-#define SS4_MFPACKET_NO_AX_BL   8176    /* Buttonless X-Coordinate value */
-#define SS4_MFPACKET_NO_AY_BL   4088    /* Buttonless Y-Coordinate value */
+#define SS4_MFPACKET_NO_AX              8160    /* X-Coordinate value */
+#define SS4_MFPACKET_NO_AY              4080    /* Y-Coordinate value */
+#define SS4_MFPACKET_NO_AX_BL           8176    /* Buttonless X-Coord value */
+#define SS4_MFPACKET_NO_AY_BL           4088    /* Buttonless Y-Coord value */
+#define SS4_PLUS_MFPACKET_NO_AX         4080    /* SS4 PLUS, X */
+#define SS4_PLUS_MFPACKET_NO_AX_BL      4088    /* Buttonless SS4 PLUS, X */
 
 /*
  * enum V7_PACKET_ID - defines the packet type for V7
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index b84cd978fce2..a4aaa748e987 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1613,7 +1613,7 @@ static int elantech_set_properties(struct elantech_data *etd)
                 case 5:
                         etd->hw_version = 3;
                         break;
-                case 6 ... 14:
+                case 6 ... 15:
                         etd->hw_version = 4;
                         break;
                 default:
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index ee5466a374bf..cd9f61cb3fc6 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -173,6 +173,7 @@ static const char * const smbus_pnp_ids[] = {
         "LEN0046", /* X250 */
         "LEN004a", /* W541 */
         "LEN200f", /* T450s */
+        "LEN2018", /* T460p */
         NULL
 };
 
diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
index 0871010f18d5..bbd29220dbe9 100644
--- a/drivers/input/mouse/trackpoint.c
+++ b/drivers/input/mouse/trackpoint.c
@@ -19,6 +19,13 @@
 #include "psmouse.h"
 #include "trackpoint.h"
 
+static const char * const trackpoint_variants[] = {
+        [TP_VARIANT_IBM]        = "IBM",
+        [TP_VARIANT_ALPS]       = "ALPS",
+        [TP_VARIANT_ELAN]       = "Elan",
+        [TP_VARIANT_NXP]        = "NXP",
+};
+
 /*
  * Power-on Reset: Resets all trackpoint parameters, including RAM values,
  * to defaults.
@@ -26,7 +33,7 @@
  */
 static int trackpoint_power_on_reset(struct ps2dev *ps2dev)
 {
-        unsigned char results[2];
+        u8 results[2];
         int tries = 0;
 
         /* Issue POR command, and repeat up to once if 0xFC00 received */
@@ -38,7 +45,7 @@ static int trackpoint_power_on_reset(struct ps2dev *ps2dev)
 
         /* Check for success response -- 0xAA00 */
         if (results[0] != 0xAA || results[1] != 0x00)
-                return -1;
+                return -ENODEV;
 
         return 0;
 }
@@ -46,8 +53,7 @@ static int trackpoint_power_on_reset(struct ps2dev *ps2dev)
 /*
  * Device IO: read, write and toggle bit
  */
-static int trackpoint_read(struct ps2dev *ps2dev,
-                           unsigned char loc, unsigned char *results)
+static int trackpoint_read(struct ps2dev *ps2dev, u8 loc, u8 *results)
 {
         if (ps2_command(ps2dev, NULL, MAKE_PS2_CMD(0, 0, TP_COMMAND)) ||
             ps2_command(ps2dev, results, MAKE_PS2_CMD(0, 1, loc))) {
@@ -57,8 +63,7 @@ static int trackpoint_read(struct ps2dev *ps2dev,
         return 0;
 }
 
-static int trackpoint_write(struct ps2dev *ps2dev,
-                            unsigned char loc, unsigned char val)
+static int trackpoint_write(struct ps2dev *ps2dev, u8 loc, u8 val)
 {
         if (ps2_command(ps2dev, NULL, MAKE_PS2_CMD(0, 0, TP_COMMAND)) ||
             ps2_command(ps2dev, NULL, MAKE_PS2_CMD(0, 0, TP_WRITE_MEM)) ||
@@ -70,8 +75,7 @@ static int trackpoint_write(struct ps2dev *ps2dev,
         return 0;
 }
 
-static int trackpoint_toggle_bit(struct ps2dev *ps2dev,
-                                 unsigned char loc, unsigned char mask)
+static int trackpoint_toggle_bit(struct ps2dev *ps2dev, u8 loc, u8 mask)
 {
         /* Bad things will happen if the loc param isn't in this range */
         if (loc < 0x20 || loc >= 0x2F)
@@ -87,11 +91,11 @@ static int trackpoint_toggle_bit(struct ps2dev *ps2dev,
         return 0;
 }
 
-static int trackpoint_update_bit(struct ps2dev *ps2dev, unsigned char loc,
-                                 unsigned char mask, unsigned char value)
+static int trackpoint_update_bit(struct ps2dev *ps2dev,
+                                 u8 loc, u8 mask, u8 value)
 {
         int retval = 0;
-        unsigned char data;
+        u8 data;
 
         trackpoint_read(ps2dev, loc, &data);
         if (((data & mask) == mask) != !!value)
@@ -105,17 +109,18 @@ static int trackpoint_update_bit(struct ps2dev *ps2dev, unsigned char loc,
  */
 struct trackpoint_attr_data {
         size_t field_offset;
-        unsigned char command;
-        unsigned char mask;
-        unsigned char inverted;
-        unsigned char power_on_default;
+        u8 command;
+        u8 mask;
+        bool inverted;
+        u8 power_on_default;
 };
 
-static ssize_t trackpoint_show_int_attr(struct psmouse *psmouse, void *data, char *buf)
+static ssize_t trackpoint_show_int_attr(struct psmouse *psmouse,
+                                        void *data, char *buf)
 {
         struct trackpoint_data *tp = psmouse->private;
         struct trackpoint_attr_data *attr = data;
-        unsigned char value = *(unsigned char *)((char *)tp + attr->field_offset);
+        u8 value = *(u8 *)((void *)tp + attr->field_offset);
 
         if (attr->inverted)
                 value = !value;
@@ -128,8 +133,8 @@ static ssize_t trackpoint_set_int_attr(struct psmouse *psmouse, void *data,
 {
         struct trackpoint_data *tp = psmouse->private;
         struct trackpoint_attr_data *attr = data;
-        unsigned char *field = (unsigned char *)((char *)tp + attr->field_offset);
-        unsigned char value;
+        u8 *field = (void *)tp + attr->field_offset;
+        u8 value;
         int err;
 
         err = kstrtou8(buf, 10, &value);
@@ -157,17 +162,14 @@ static ssize_t trackpoint_set_bit_attr(struct psmouse *psmouse, void *data,
 {
         struct trackpoint_data *tp = psmouse->private;
         struct trackpoint_attr_data *attr = data;
-        unsigned char *field = (unsigned char *)((char *)tp + attr->field_offset);
-        unsigned int value;
+        bool *field = (void *)tp + attr->field_offset;
+        bool value;
         int err;
 
-        err = kstrtouint(buf, 10, &value);
+        err = kstrtobool(buf, &value);
         if (err)
                 return err;
 
-        if (value > 1)
-                return -EINVAL;
-
         if (attr->inverted)
                 value = !value;
 
@@ -193,30 +195,6 @@ PSMOUSE_DEFINE_ATTR(_name, S_IWUSR | S_IRUGO,				\
                     &trackpoint_attr_##_name,                           \
                     trackpoint_show_int_attr, trackpoint_set_bit_attr)
 
-#define TRACKPOINT_UPDATE_BIT(_psmouse, _tp, _name)                     \
-do {                                                                    \
-        struct trackpoint_attr_data *_attr = &trackpoint_attr_##_name;  \
-                                                                        \
-        trackpoint_update_bit(&_psmouse->ps2dev,                        \
-                        _attr->command, _attr->mask, _tp->_name);       \
-} while (0)
-
-#define TRACKPOINT_UPDATE(_power_on, _psmouse, _tp, _name)              \
-do {                                                                    \
-        if (!_power_on ||                                               \
-            _tp->_name != trackpoint_attr_##_name.power_on_default) {   \
-                if (!trackpoint_attr_##_name.mask)                      \
-                        trackpoint_write(&_psmouse->ps2dev,             \
-                                 trackpoint_attr_##_name.command,       \
-                                 _tp->_name);                           \
-                else                                                    \
-                        TRACKPOINT_UPDATE_BIT(_psmouse, _tp, _name);    \
-        }                                                               \
-} while (0)
-
-#define TRACKPOINT_SET_POWER_ON_DEFAULT(_tp, _name)                             \
-        (_tp->_name = trackpoint_attr_##_name.power_on_default)
-
 TRACKPOINT_INT_ATTR(sensitivity, TP_SENS, TP_DEF_SENS);
 TRACKPOINT_INT_ATTR(speed, TP_SPEED, TP_DEF_SPEED);
 TRACKPOINT_INT_ATTR(inertia, TP_INERTIA, TP_DEF_INERTIA);
@@ -229,13 +207,33 @@ TRACKPOINT_INT_ATTR(ztime, TP_Z_TIME, TP_DEF_Z_TIME);
 TRACKPOINT_INT_ATTR(jenks, TP_JENKS_CURV, TP_DEF_JENKS_CURV);
 TRACKPOINT_INT_ATTR(drift_time, TP_DRIFT_TIME, TP_DEF_DRIFT_TIME);
 
-TRACKPOINT_BIT_ATTR(press_to_select, TP_TOGGLE_PTSON, TP_MASK_PTSON, 0,
+TRACKPOINT_BIT_ATTR(press_to_select, TP_TOGGLE_PTSON, TP_MASK_PTSON, false,
                     TP_DEF_PTSON);
-TRACKPOINT_BIT_ATTR(skipback, TP_TOGGLE_SKIPBACK, TP_MASK_SKIPBACK, 0,
+TRACKPOINT_BIT_ATTR(skipback, TP_TOGGLE_SKIPBACK, TP_MASK_SKIPBACK, false,
                     TP_DEF_SKIPBACK);
-TRACKPOINT_BIT_ATTR(ext_dev, TP_TOGGLE_EXT_DEV, TP_MASK_EXT_DEV, 1,
+TRACKPOINT_BIT_ATTR(ext_dev, TP_TOGGLE_EXT_DEV, TP_MASK_EXT_DEV, true,
                     TP_DEF_EXT_DEV);
 
+static bool trackpoint_is_attr_available(struct psmouse *psmouse,
+                                         struct attribute *attr)
+{
+        struct trackpoint_data *tp = psmouse->private;
+
+        return tp->variant_id == TP_VARIANT_IBM ||
+                attr == &psmouse_attr_sensitivity.dattr.attr ||
+                attr == &psmouse_attr_press_to_select.dattr.attr;
+}
+
+static umode_t trackpoint_is_attr_visible(struct kobject *kobj,
+                                          struct attribute *attr, int n)
+{
+        struct device *dev = container_of(kobj, struct device, kobj);
+        struct serio *serio = to_serio_port(dev);
+        struct psmouse *psmouse = serio_get_drvdata(serio);
+
+        return trackpoint_is_attr_available(psmouse, attr) ? attr->mode : 0;
+}
+
 static struct attribute *trackpoint_attrs[] = {
         &psmouse_attr_sensitivity.dattr.attr,
         &psmouse_attr_speed.dattr.attr,
@@ -255,24 +253,56 @@ static struct attribute *trackpoint_attrs[] = {
 };
 
 static struct attribute_group trackpoint_attr_group = {
-        .attrs = trackpoint_attrs,
+        .is_visible     = trackpoint_is_attr_visible,
+        .attrs          = trackpoint_attrs,
 };
 
-static int trackpoint_start_protocol(struct psmouse *psmouse, unsigned char *firmware_id)
-{
-        unsigned char param[2] = { 0 };
+#define TRACKPOINT_UPDATE(_power_on, _psmouse, _tp, _name)              \
+do {                                                                    \
+        struct trackpoint_attr_data *_attr = &trackpoint_attr_##_name;  \
+                                                                        \
+        if ((!_power_on || _tp->_name != _attr->power_on_default) &&    \
+            trackpoint_is_attr_available(_psmouse,                      \
+                                &psmouse_attr_##_name.dattr.attr)) {    \
+                if (!_attr->mask)                                       \
+                        trackpoint_write(&_psmouse->ps2dev,             \
+                                         _attr->command, _tp->_name);   \
+                else                                                    \
+                        trackpoint_update_bit(&_psmouse->ps2dev,        \
+                                        _attr->command, _attr->mask,    \
+                                        _tp->_name);                    \
+        }                                                               \
+} while (0)
 
-        if (ps2_command(&psmouse->ps2dev, param, MAKE_PS2_CMD(0, 2, TP_READ_ID)))
-                return -1;
+#define TRACKPOINT_SET_POWER_ON_DEFAULT(_tp, _name)                     \
+do {                                                                    \
+        _tp->_name = trackpoint_attr_##_name.power_on_default;          \
+} while (0)
 
-        /* add new TP ID. */
-        if (!(param[0] & TP_MAGIC_IDENT))
-                return -1;
+static int trackpoint_start_protocol(struct psmouse *psmouse,
+                                     u8 *variant_id, u8 *firmware_id)
+{
+        u8 param[2] = { 0 };
+        int error;
 
-        if (firmware_id)
-                *firmware_id = param[1];
+        error = ps2_command(&psmouse->ps2dev,
+                            param, MAKE_PS2_CMD(0, 2, TP_READ_ID));
+        if (error)
+                return error;
+
+        switch (param[0]) {
+        case TP_VARIANT_IBM:
+        case TP_VARIANT_ALPS:
+        case TP_VARIANT_ELAN:
+        case TP_VARIANT_NXP:
+                if (variant_id)
+                        *variant_id = param[0];
+                if (firmware_id)
+                        *firmware_id = param[1];
+                return 0;
+        }
 
-        return 0;
+        return -ENODEV;
 }
 
 /*
@@ -285,7 +315,7 @@ static int trackpoint_sync(struct psmouse *psmouse, bool in_power_on_state)
 {
         struct trackpoint_data *tp = psmouse->private;
 
-        if (!in_power_on_state) {
+        if (!in_power_on_state && tp->variant_id == TP_VARIANT_IBM) {
                 /*
                  * Disable features that may make device unusable
                  * with this driver.
@@ -347,7 +377,8 @@ static void trackpoint_defaults(struct trackpoint_data *tp)
 
 static void trackpoint_disconnect(struct psmouse *psmouse)
 {
-        sysfs_remove_group(&psmouse->ps2dev.serio->dev.kobj, &trackpoint_attr_group);
+        device_remove_group(&psmouse->ps2dev.serio->dev,
+                            &trackpoint_attr_group);
 
         kfree(psmouse->private);
         psmouse->private = NULL;
@@ -355,14 +386,20 @@ static void trackpoint_disconnect(struct psmouse *psmouse)
 
 static int trackpoint_reconnect(struct psmouse *psmouse)
 {
-        int reset_fail;
+        struct trackpoint_data *tp = psmouse->private;
+        int error;
+        bool was_reset;
 
-        if (trackpoint_start_protocol(psmouse, NULL))
-                return -1;
+        error = trackpoint_start_protocol(psmouse, NULL, NULL);
+        if (error)
+                return error;
 
-        reset_fail = trackpoint_power_on_reset(&psmouse->ps2dev);
-        if (trackpoint_sync(psmouse, !reset_fail))
-                return -1;
+        was_reset = tp->variant_id == TP_VARIANT_IBM &&
+                    trackpoint_power_on_reset(&psmouse->ps2dev) == 0;
+
+        error = trackpoint_sync(psmouse, was_reset);
+        if (error)
+                return error;
 
         return 0;
 }
@@ -370,46 +407,66 @@ static int trackpoint_reconnect(struct psmouse *psmouse)
 int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
 {
         struct ps2dev *ps2dev = &psmouse->ps2dev;
-        unsigned char firmware_id;
-        unsigned char button_info;
+        struct trackpoint_data *tp;
+        u8 variant_id;
+        u8 firmware_id;
+        u8 button_info;
         int error;
 
-        if (trackpoint_start_protocol(psmouse, &firmware_id))
-                return -1;
+        error = trackpoint_start_protocol(psmouse, &variant_id, &firmware_id);
+        if (error)
+                return error;
 
         if (!set_properties)
                 return 0;
 
-        if (trackpoint_read(ps2dev, TP_EXT_BTN, &button_info)) {
-                psmouse_warn(psmouse, "failed to get extended button data, assuming 3 buttons\n");
-                button_info = 0x33;
-        }
-
-        psmouse->private = kzalloc(sizeof(struct trackpoint_data), GFP_KERNEL);
-        if (!psmouse->private)
+        tp = kzalloc(sizeof(*tp), GFP_KERNEL);
+        if (!tp)
                 return -ENOMEM;
 
-        psmouse->vendor = "IBM";
+        trackpoint_defaults(tp);
+        tp->variant_id = variant_id;
+        tp->firmware_id = firmware_id;
+
+        psmouse->private = tp;
+
+        psmouse->vendor = trackpoint_variants[variant_id];
         psmouse->name = "TrackPoint";
 
         psmouse->reconnect = trackpoint_reconnect;
         psmouse->disconnect = trackpoint_disconnect;
 
+        if (variant_id != TP_VARIANT_IBM) {
+                /* Newer variants do not support extended button query. */
+                button_info = 0x33;
+        } else {
+                error = trackpoint_read(ps2dev, TP_EXT_BTN, &button_info);
+                if (error) {
+                        psmouse_warn(psmouse,
+                                     "failed to get extended button data, assuming 3 buttons\n");
+                        button_info = 0x33;
+                } else if (!button_info) {
+                        psmouse_warn(psmouse,
+                                     "got 0 in extended button data, assuming 3 buttons\n");
+                        button_info = 0x33;
+                }
+        }
+
         if ((button_info & 0x0f) >= 3)
-                __set_bit(BTN_MIDDLE, psmouse->dev->keybit);
+                input_set_capability(psmouse->dev, EV_KEY, BTN_MIDDLE);
 
         __set_bit(INPUT_PROP_POINTER, psmouse->dev->propbit);
         __set_bit(INPUT_PROP_POINTING_STICK, psmouse->dev->propbit);
 
-        trackpoint_defaults(psmouse->private);
-
-        error = trackpoint_power_on_reset(ps2dev);
-
-        /* Write defaults to TP only if reset fails. */
-        if (error)
+        if (variant_id != TP_VARIANT_IBM ||
+            trackpoint_power_on_reset(ps2dev) != 0) {
+                /*
+                 * Write defaults to TP if we did not reset the trackpoint.
+                 */
                 trackpoint_sync(psmouse, false);
+        }
 
-        error = sysfs_create_group(&ps2dev->serio->dev.kobj, &trackpoint_attr_group);
+        error = device_add_group(&ps2dev->serio->dev, &trackpoint_attr_group);
         if (error) {
                 psmouse_err(psmouse,
                             "failed to create sysfs attributes, error: %d\n",
@@ -420,8 +477,8 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
         }
 
         psmouse_info(psmouse,
-                     "IBM TrackPoint firmware: 0x%02x, buttons: %d/%d\n",
-                     firmware_id,
+                     "%s TrackPoint firmware: 0x%02x, buttons: %d/%d\n",
+                     psmouse->vendor, firmware_id,
                      (button_info & 0xf0) >> 4, button_info & 0x0f);
 
         return 0;
diff --git a/drivers/input/mouse/trackpoint.h b/drivers/input/mouse/trackpoint.h
index 88055755f82e..10a039148234 100644
--- a/drivers/input/mouse/trackpoint.h
+++ b/drivers/input/mouse/trackpoint.h
@@ -21,10 +21,16 @@
 #define TP_COMMAND              0xE2    /* Commands start with this */
 
 #define TP_READ_ID              0xE1    /* Sent for device identification */
-#define TP_MAGIC_IDENT          0x03    /* Sent after a TP_READ_ID followed */
-                                        /* by the firmware ID */
-                                        /* Firmware ID includes 0x1, 0x2, 0x3 */
 
+/*
+ * Valid first byte responses to the "Read Secondary ID" (0xE1) command.
+ * 0x01 was the original IBM trackpoint, others implement very limited
+ * subset of trackpoint features.
+ */
+#define TP_VARIANT_IBM          0x01
+#define TP_VARIANT_ALPS         0x02
+#define TP_VARIANT_ELAN         0x03
+#define TP_VARIANT_NXP          0x04
 
 /*
  * Commands
@@ -136,18 +142,20 @@
 
 #define MAKE_PS2_CMD(params, results, cmd) ((params<<12) | (results<<8) | (cmd))
 
-struct trackpoint_data
-{
-        unsigned char sensitivity, speed, inertia, reach;
-        unsigned char draghys, mindrag;
-        unsigned char thresh, upthresh;
-        unsigned char ztime, jenks;
-        unsigned char drift_time;
+struct trackpoint_data {
+        u8 variant_id;
+        u8 firmware_id;
+
+        u8 sensitivity, speed, inertia, reach;
+        u8 draghys, mindrag;
+        u8 thresh, upthresh;
+        u8 ztime, jenks;
+        u8 drift_time;
 
         /* toggles */
-        unsigned char press_to_select;
-        unsigned char skipback;
-        unsigned char ext_dev;
+        bool press_to_select;
+        bool skipback;
+        bool ext_dev;
 };
 
 #ifdef CONFIG_MOUSE_PS2_TRACKPOINT
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index 4f2bb5947a4e..141ea228aac6 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -230,8 +230,10 @@ static irqreturn_t rmi_irq_fn(int irq, void *dev_id)
                 rmi_dbg(RMI_DEBUG_CORE, &rmi_dev->dev,
                         "Failed to process interrupt request: %d\n", ret);
 
-        if (count)
+        if (count) {
                 kfree(attn_data.data);
+                attn_data.data = NULL;
+        }
 
         if (!kfifo_is_empty(&drvdata->attn_fifo))
                 return rmi_irq_fn(irq, dev_id);
diff --git a/drivers/input/rmi4/rmi_f01.c b/drivers/input/rmi4/rmi_f01.c
index ae966e333a2f..8a07ae147df6 100644
--- a/drivers/input/rmi4/rmi_f01.c
+++ b/drivers/input/rmi4/rmi_f01.c
@@ -570,14 +570,19 @@ static int rmi_f01_probe(struct rmi_function *fn)
 
         dev_set_drvdata(&fn->dev, f01);
 
-        error = devm_device_add_group(&fn->rmi_dev->dev, &rmi_f01_attr_group);
+        error = sysfs_create_group(&fn->rmi_dev->dev.kobj, &rmi_f01_attr_group);
         if (error)
-                dev_warn(&fn->dev,
-                         "Failed to create attribute group: %d\n", error);
+                dev_warn(&fn->dev, "Failed to create sysfs group: %d\n", error);
 
         return 0;
 }
 
+static void rmi_f01_remove(struct rmi_function *fn)
+{
+        /* Note that the bus device is used, not the F01 device */
+        sysfs_remove_group(&fn->rmi_dev->dev.kobj, &rmi_f01_attr_group);
+}
+
 static int rmi_f01_config(struct rmi_function *fn)
 {
         struct f01_data *f01 = dev_get_drvdata(&fn->dev);
@@ -717,6 +722,7 @@ struct rmi_function_handler rmi_f01_handler = {
         },
         .func           = 0x01,
         .probe          = rmi_f01_probe,
+        .remove         = rmi_f01_remove,
         .config         = rmi_f01_config,
         .attention      = rmi_f01_attention,
         .suspend        = rmi_f01_suspend,
diff --git a/drivers/input/touchscreen/88pm860x-ts.c b/drivers/input/touchscreen/88pm860x-ts.c
index 7ed828a51f4c..3486d9403805 100644
--- a/drivers/input/touchscreen/88pm860x-ts.c
+++ b/drivers/input/touchscreen/88pm860x-ts.c
@@ -126,7 +126,7 @@ static int pm860x_touch_dt_init(struct platform_device *pdev,
         int data, n, ret;
         if (!np)
                 return -ENODEV;
-        np = of_find_node_by_name(np, "touch");
+        np = of_get_child_by_name(np, "touch");
         if (!np) {
                 dev_err(&pdev->dev, "Can't find touch node\n");
                 return -EINVAL;
@@ -144,13 +144,13 @@ static int pm860x_touch_dt_init(struct platform_device *pdev,
         if (data) {
                 ret = pm860x_reg_write(i2c, PM8607_GPADC_MISC1, data);
                 if (ret < 0)
-                        return -EINVAL;
+                        goto err_put_node;
         }
         /* set tsi prebias time */
         if (!of_property_read_u32(np, "marvell,88pm860x-tsi-prebias", &data)) {
                 ret = pm860x_reg_write(i2c, PM8607_TSI_PREBIAS, data);
                 if (ret < 0)
-                        return -EINVAL;
+                        goto err_put_node;
         }
         /* set prebias & prechg time of pen detect */
         data = 0;
@@ -161,10 +161,18 @@ static int pm860x_touch_dt_init(struct platform_device *pdev,
         if (data) {
                 ret = pm860x_reg_write(i2c, PM8607_PD_PREBIAS, data);
                 if (ret < 0)
-                        return -EINVAL;
+                        goto err_put_node;
         }
         of_property_read_u32(np, "marvell,88pm860x-resistor-X", res_x);
+
+        of_node_put(np);
+
         return 0;
+
+err_put_node:
+        of_node_put(np);
+
+        return -EINVAL;
 }
 #else
 #define pm860x_touch_dt_init(x, y, z)   (-1)
diff --git a/drivers/input/touchscreen/elants_i2c.c b/drivers/input/touchscreen/elants_i2c.c
index e102d7764bc2..a458e5ec9e41 100644
--- a/drivers/input/touchscreen/elants_i2c.c
+++ b/drivers/input/touchscreen/elants_i2c.c
@@ -27,6 +27,7 @@
 #include <linux/module.h>
 #include <linux/input.h>
 #include <linux/interrupt.h>
+#include <linux/irq.h>
 #include <linux/platform_device.h>
 #include <linux/async.h>
 #include <linux/i2c.h>
@@ -1261,10 +1262,13 @@ static int elants_i2c_probe(struct i2c_client *client,
         }
 
         /*
-         * Systems using device tree should set up interrupt via DTS,
-         * the rest will use the default falling edge interrupts.
+         * Platform code (ACPI, DTS) should normally set up interrupt
+         * for us, but in case it did not let's fall back to using falling
+         * edge to be compatible with older Chromebooks.
          */
-        irqflags = client->dev.of_node ? 0 : IRQF_TRIGGER_FALLING;
+        irqflags = irq_get_trigger_type(client->irq);
+        if (!irqflags)
+                irqflags = IRQF_TRIGGER_FALLING;
 
         error = devm_request_threaded_irq(&client->dev, client->irq,
                                           NULL, elants_i2c_irq,
diff --git a/drivers/input/touchscreen/hideep.c b/drivers/input/touchscreen/hideep.c
index fc080a7c2e1f..f1cd4dd9a4a3 100644
--- a/drivers/input/touchscreen/hideep.c
+++ b/drivers/input/touchscreen/hideep.c
@@ -10,8 +10,7 @@
 #include <linux/of.h>
 #include <linux/firmware.h>
 #include <linux/delay.h>
-#include <linux/gpio.h>
-#include <linux/gpio/machine.h>
+#include <linux/gpio/consumer.h>
 #include <linux/i2c.h>
 #include <linux/acpi.h>
 #include <linux/interrupt.h>
diff --git a/drivers/input/touchscreen/of_touchscreen.c b/drivers/input/touchscreen/of_touchscreen.c
index 8d7f9c8f2771..9642f103b726 100644
--- a/drivers/input/touchscreen/of_touchscreen.c
+++ b/drivers/input/touchscreen/of_touchscreen.c
@@ -13,6 +13,7 @@
 #include <linux/input.h>
 #include <linux/input/mt.h>
 #include <linux/input/touchscreen.h>
+#include <linux/module.h>
 
 static bool touchscreen_get_prop_u32(struct device *dev,
                                      const char *property,
@@ -185,3 +186,6 @@ void touchscreen_report_pos(struct input_dev *input,
         input_report_abs(input, multitouch ? ABS_MT_POSITION_Y : ABS_Y, y);
 }
 EXPORT_SYMBOL(touchscreen_report_pos);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("Device-tree helpers functions for touchscreen devices");
diff --git a/drivers/input/touchscreen/s6sy761.c b/drivers/input/touchscreen/s6sy761.c
index 26b1cb8a88ec..675efa93d444 100644
--- a/drivers/input/touchscreen/s6sy761.c
+++ b/drivers/input/touchscreen/s6sy761.c
@@ -1,13 +1,8 @@
-/*
- * Copyright (c) 2017 Samsung Electronics Co., Ltd.
- * Author: Andi Shyti <andi.shyti@samsung.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * Samsung S6SY761 Touchscreen device driver
- */
+// SPDX-License-Identifier: GPL-2.0
+// Samsung S6SY761 Touchscreen device driver
+//
+// Copyright (c) 2017 Samsung Electronics Co., Ltd.
+// Copyright (c) 2017 Andi Shyti <andi.shyti@samsung.com>
 
 #include <asm/unaligned.h>
 #include <linux/delay.h>
diff --git a/drivers/input/touchscreen/stmfts.c b/drivers/input/touchscreen/stmfts.c
index c12d01899939..2a123e20a42e 100644
--- a/drivers/input/touchscreen/stmfts.c
+++ b/drivers/input/touchscreen/stmfts.c
@@ -1,13 +1,8 @@
-/*
- * Copyright (c) 2017 Samsung Electronics Co., Ltd.
- * Author: Andi Shyti <andi.shyti@samsung.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * STMicroelectronics FTS Touchscreen device driver
- */
+// SPDX-License-Identifier: GPL-2.0
+// STMicroelectronics FTS Touchscreen device driver
+//
+// Copyright (c) 2017 Samsung Electronics Co., Ltd.
+// Copyright (c) 2017 Andi Shyti <andi.shyti@samsung.com>
 
 #include <linux/delay.h>
 #include <linux/i2c.h>
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 7d5eb004091d..97baf88d9505 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -4184,7 +4184,7 @@ static void amd_ir_update_irte(struct irq_data *irqd, struct amd_iommu *iommu,
                                struct irq_cfg *cfg);
 
 static int irq_remapping_activate(struct irq_domain *domain,
-                                  struct irq_data *irq_data, bool early)
+                                  struct irq_data *irq_data, bool reserve)
 {
         struct amd_ir_data *data = irq_data->chip_data;
         struct irq_2_irte *irte_info = &data->irq_2_irte;
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index f122071688fd..744592d330ca 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -1698,13 +1698,15 @@ static int arm_smmu_domain_finalise(struct iommu_domain *domain)
         domain->pgsize_bitmap = pgtbl_cfg.pgsize_bitmap;
         domain->geometry.aperture_end = (1UL << ias) - 1;
         domain->geometry.force_aperture = true;
-        smmu_domain->pgtbl_ops = pgtbl_ops;
 
         ret = finalise_stage_fn(smmu_domain, &pgtbl_cfg);
-        if (ret < 0)
+        if (ret < 0) {
                 free_io_pgtable_ops(pgtbl_ops);
+                return ret;
+        }
 
-        return ret;
+        smmu_domain->pgtbl_ops = pgtbl_ops;
+        return 0;
 }
 
 static __le64 *arm_smmu_get_step_for_sid(struct arm_smmu_device *smmu, u32 sid)
@@ -1731,7 +1733,7 @@ static __le64 *arm_smmu_get_step_for_sid(struct arm_smmu_device *smmu, u32 sid)
 
 static void arm_smmu_install_ste_for_dev(struct iommu_fwspec *fwspec)
 {
-        int i;
+        int i, j;
         struct arm_smmu_master_data *master = fwspec->iommu_priv;
         struct arm_smmu_device *smmu = master->smmu;
 
@@ -1739,6 +1741,13 @@ static void arm_smmu_install_ste_for_dev(struct iommu_fwspec *fwspec)
                 u32 sid = fwspec->ids[i];
                 __le64 *step = arm_smmu_get_step_for_sid(smmu, sid);
 
+                /* Bridged PCI devices may end up with duplicated IDs */
+                for (j = 0; j < i; j++)
+                        if (fwspec->ids[j] == sid)
+                                break;
+                if (j < i)
+                        continue;
+
                 arm_smmu_write_strtab_ent(smmu, sid, step, &master->ste);
         }
 }
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index a0babdbf7146..4a2de34895ec 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -2250,10 +2250,12 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
                 uint64_t tmp;
 
                 if (!sg_res) {
+                        unsigned int pgoff = sg->offset & ~PAGE_MASK;
+
                         sg_res = aligned_nrpages(sg->offset, sg->length);
-                        sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + sg->offset;
+                        sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + pgoff;
                         sg->dma_length = sg->length;
-                        pteval = page_to_phys(sg_page(sg)) | prot;
+                        pteval = (sg_phys(sg) - pgoff) | prot;
                         phys_pfn = pteval >> VTD_PAGE_SHIFT;
                 }
 
@@ -3787,7 +3789,7 @@ static int intel_nontranslate_map_sg(struct device *hddev,
 
         for_each_sg(sglist, sg, nelems, i) {
                 BUG_ON(!sg_page(sg));
-                sg->dma_address = page_to_phys(sg_page(sg)) + sg->offset;
+                sg->dma_address = sg_phys(sg);
                 sg->dma_length = sg->length;
         }
         return nelems;
diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index 76a193c7fcfc..66f69af2c219 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -1397,7 +1397,7 @@ static void intel_irq_remapping_free(struct irq_domain *domain,
 }
 
 static int intel_irq_remapping_activate(struct irq_domain *domain,
-                                        struct irq_data *irq_data, bool early)
+                                        struct irq_data *irq_data, bool reserve)
 {
         intel_ir_reconfigure_irte(irq_data, true);
         return 0;
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 4039e64cd342..06f025fd5726 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -2303,7 +2303,7 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
 }
 
 static int its_irq_domain_activate(struct irq_domain *domain,
-                                   struct irq_data *d, bool early)
+                                   struct irq_data *d, bool reserve)
 {
         struct its_device *its_dev = irq_data_get_irq_chip_data(d);
         u32 event = its_get_event_id(d);
@@ -2818,7 +2818,7 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq
 }
 
 static int its_vpe_irq_domain_activate(struct irq_domain *domain,
-                                       struct irq_data *d, bool early)
+                                       struct irq_data *d, bool reserve)
 {
         struct its_vpe *vpe = irq_data_get_irq_chip_data(d);
         struct its_node *its;
diff --git a/drivers/irqchip/irq-renesas-intc-irqpin.c b/drivers/irqchip/irq-renesas-intc-irqpin.c
index 06f29cf5018a..cee59fe1321c 100644
--- a/drivers/irqchip/irq-renesas-intc-irqpin.c
+++ b/drivers/irqchip/irq-renesas-intc-irqpin.c
@@ -342,6 +342,9 @@ static irqreturn_t intc_irqpin_shared_irq_handler(int irq, void *dev_id)
  */
 static struct lock_class_key intc_irqpin_irq_lock_class;
 
+/* And this is for the request mutex */
+static struct lock_class_key intc_irqpin_irq_request_class;
+
 static int intc_irqpin_irq_domain_map(struct irq_domain *h, unsigned int virq,
                                       irq_hw_number_t hw)
 {
@@ -352,7 +355,8 @@ static int intc_irqpin_irq_domain_map(struct irq_domain *h, unsigned int virq,
 
         intc_irqpin_dbg(&p->irq[hw], "map");
         irq_set_chip_data(virq, h->host_data);
-        irq_set_lockdep_class(virq, &intc_irqpin_irq_lock_class);
+        irq_set_lockdep_class(virq, &intc_irqpin_irq_lock_class,
+                              &intc_irqpin_irq_request_class);
         irq_set_chip_and_handler(virq, &p->irq_chip, handle_level_irq);
         return 0;
 }
diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c
index fd83c7f77a95..ede4fa0ac2cc 100644
--- a/drivers/leds/led-core.c
+++ b/drivers/leds/led-core.c
@@ -188,6 +188,7 @@ void led_blink_set(struct led_classdev *led_cdev,
 {
         del_timer_sync(&led_cdev->blink_timer);
 
+        clear_bit(LED_BLINK_SW, &led_cdev->work_flags);
         clear_bit(LED_BLINK_ONESHOT, &led_cdev->work_flags);
         clear_bit(LED_BLINK_ONESHOT_STOP, &led_cdev->work_flags);
 
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index b8ac591aaaa7..c546b567f3b5 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1611,7 +1611,8 @@ static unsigned long __scan(struct dm_bufio_client *c, unsigned long nr_to_scan,
         int l;
         struct dm_buffer *b, *tmp;
         unsigned long freed = 0;
-        unsigned long count = nr_to_scan;
+        unsigned long count = c->n_buffers[LIST_CLEAN] +
+                              c->n_buffers[LIST_DIRTY];
         unsigned long retain_target = get_retain_buffers(c);
 
         for (l = 0; l < LIST_SIZE; l++) {
@@ -1647,8 +1648,11 @@ static unsigned long
 dm_bufio_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
 {
         struct dm_bufio_client *c = container_of(shrink, struct dm_bufio_client, shrinker);
+        unsigned long count = READ_ONCE(c->n_buffers[LIST_CLEAN]) +
+                              READ_ONCE(c->n_buffers[LIST_DIRTY]);
+        unsigned long retain_target = get_retain_buffers(c);
 
-        return READ_ONCE(c->n_buffers[LIST_CLEAN]) + READ_ONCE(c->n_buffers[LIST_DIRTY]);
+        return (count < retain_target) ? 0 : (count - retain_target);
 }
 
 /*
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index cf23a14f9c6a..47407e43b96a 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -3472,18 +3472,18 @@ static int __init dm_cache_init(void)
 {
         int r;
 
-        r = dm_register_target(&cache_target);
-        if (r) {
-                DMERR("cache target registration failed: %d", r);
-                return r;
-        }
-
         migration_cache = KMEM_CACHE(dm_cache_migration, 0);
         if (!migration_cache) {
                 dm_unregister_target(&cache_target);
                 return -ENOMEM;
         }
 
+        r = dm_register_target(&cache_target);
+        if (r) {
+                DMERR("cache target registration failed: %d", r);
+                return r;
+        }
+
         return 0;
 }
 
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 9fc12f556534..554d60394c06 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1954,10 +1954,15 @@ static int crypt_setkey(struct crypt_config *cc)
         /* Ignore extra keys (which are used for IV etc) */
         subkey_size = crypt_subkey_size(cc);
 
-        if (crypt_integrity_hmac(cc))
+        if (crypt_integrity_hmac(cc)) {
+                if (subkey_size < cc->key_mac_size)
+                        return -EINVAL;
+
                 crypt_copy_authenckey(cc->authenc_key, cc->key,
                                       subkey_size - cc->key_mac_size,
                                       cc->key_mac_size);
+        }
+
         for (i = 0; i < cc->tfms_count; i++) {
                 if (crypt_integrity_hmac(cc))
                         r = crypto_aead_setkey(cc->cipher_tfm.tfms_aead[i],
@@ -2053,9 +2058,6 @@ static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string
 
         ret = crypt_setkey(cc);
 
-        /* wipe the kernel key payload copy in each case */
-        memset(cc->key, 0, cc->key_size * sizeof(u8));
-
         if (!ret) {
                 set_bit(DM_CRYPT_KEY_VALID, &cc->flags);
                 kzfree(cc->key_string);
@@ -2523,6 +2525,10 @@ static int crypt_ctr_cipher(struct dm_target *ti, char *cipher_in, char *key)
                 }
         }
 
+        /* wipe the kernel key payload copy */
+        if (cc->key_string)
+                memset(cc->key, 0, cc->key_size * sizeof(u8));
+
         return ret;
 }
 
@@ -2740,6 +2746,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                         cc->tag_pool_max_sectors * cc->on_disk_tag_size);
                 if (!cc->tag_pool) {
                         ti->error = "Cannot allocate integrity tags mempool";
+                        ret = -ENOMEM;
                         goto bad;
                 }
 
@@ -2961,6 +2968,9 @@ static int crypt_message(struct dm_target *ti, unsigned argc, char **argv)
                                 return ret;
                         if (cc->iv_gen_ops && cc->iv_gen_ops->init)
                                 ret = cc->iv_gen_ops->init(cc);
+                        /* wipe the kernel key payload copy */
+                        if (cc->key_string)
+                                memset(cc->key, 0, cc->key_size * sizeof(u8));
                         return ret;
                 }
                 if (argc == 2 && !strcasecmp(argv[1], "wipe")) {
@@ -3007,7 +3017,7 @@ static void crypt_io_hints(struct dm_target *ti, struct queue_limits *limits)
 
 static struct target_type crypt_target = {
         .name   = "crypt",
-        .version = {1, 18, 0},
+        .version = {1, 18, 1},
         .module = THIS_MODULE,
         .ctr    = crypt_ctr,
         .dtr    = crypt_dtr,
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index 05c7bfd0c9d9..46d7c8749222 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -2559,7 +2559,8 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
         int r = 0;
         unsigned i;
         __u64 journal_pages, journal_desc_size, journal_tree_size;
-        unsigned char *crypt_data = NULL;
+        unsigned char *crypt_data = NULL, *crypt_iv = NULL;
+        struct skcipher_request *req = NULL;
 
         ic->commit_ids[0] = cpu_to_le64(0x1111111111111111ULL);
         ic->commit_ids[1] = cpu_to_le64(0x2222222222222222ULL);
@@ -2617,9 +2618,20 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
 
                 if (blocksize == 1) {
                         struct scatterlist *sg;
-                        SKCIPHER_REQUEST_ON_STACK(req, ic->journal_crypt);
-                        unsigned char iv[ivsize];
-                        skcipher_request_set_tfm(req, ic->journal_crypt);
+
+                        req = skcipher_request_alloc(ic->journal_crypt, GFP_KERNEL);
+                        if (!req) {
+                                *error = "Could not allocate crypt request";
+                                r = -ENOMEM;
+                                goto bad;
+                        }
+
+                        crypt_iv = kmalloc(ivsize, GFP_KERNEL);
+                        if (!crypt_iv) {
+                                *error = "Could not allocate iv";
+                                r = -ENOMEM;
+                                goto bad;
+                        }
 
                         ic->journal_xor = dm_integrity_alloc_page_list(ic);
                         if (!ic->journal_xor) {
@@ -2641,9 +2653,9 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
                                 sg_set_buf(&sg[i], va, PAGE_SIZE);
                         }
                         sg_set_buf(&sg[i], &ic->commit_ids, sizeof ic->commit_ids);
-                        memset(iv, 0x00, ivsize);
+                        memset(crypt_iv, 0x00, ivsize);
 
-                        skcipher_request_set_crypt(req, sg, sg, PAGE_SIZE * ic->journal_pages + sizeof ic->commit_ids, iv);
+                        skcipher_request_set_crypt(req, sg, sg, PAGE_SIZE * ic->journal_pages + sizeof ic->commit_ids, crypt_iv);
                         init_completion(&comp.comp);
                         comp.in_flight = (atomic_t)ATOMIC_INIT(1);
                         if (do_crypt(true, req, &comp))
@@ -2659,10 +2671,22 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
                         crypto_free_skcipher(ic->journal_crypt);
                         ic->journal_crypt = NULL;
                 } else {
-                        SKCIPHER_REQUEST_ON_STACK(req, ic->journal_crypt);
-                        unsigned char iv[ivsize];
                         unsigned crypt_len = roundup(ivsize, blocksize);
 
+                        req = skcipher_request_alloc(ic->journal_crypt, GFP_KERNEL);
+                        if (!req) {
+                                *error = "Could not allocate crypt request";
+                                r = -ENOMEM;
+                                goto bad;
+                        }
+
+                        crypt_iv = kmalloc(ivsize, GFP_KERNEL);
+                        if (!crypt_iv) {
+                                *error = "Could not allocate iv";
+                                r = -ENOMEM;
+                                goto bad;
+                        }
+
                         crypt_data = kmalloc(crypt_len, GFP_KERNEL);
                         if (!crypt_data) {
                                 *error = "Unable to allocate crypt data";
@@ -2670,8 +2694,6 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
                                 goto bad;
                         }
 
-                        skcipher_request_set_tfm(req, ic->journal_crypt);
-
                         ic->journal_scatterlist = dm_integrity_alloc_journal_scatterlist(ic, ic->journal);
                         if (!ic->journal_scatterlist) {
                                 *error = "Unable to allocate sg list";
@@ -2695,12 +2717,12 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
                                 struct skcipher_request *section_req;
                                 __u32 section_le = cpu_to_le32(i);
 
-                                memset(iv, 0x00, ivsize);
+                                memset(crypt_iv, 0x00, ivsize);
                                 memset(crypt_data, 0x00, crypt_len);
                                 memcpy(crypt_data, &section_le, min((size_t)crypt_len, sizeof(section_le)));
 
                                 sg_init_one(&sg, crypt_data, crypt_len);
-                                skcipher_request_set_crypt(req, &sg, &sg, crypt_len, iv);
+                                skcipher_request_set_crypt(req, &sg, &sg, crypt_len, crypt_iv);
                                 init_completion(&comp.comp);
                                 comp.in_flight = (atomic_t)ATOMIC_INIT(1);
                                 if (do_crypt(true, req, &comp))
@@ -2758,6 +2780,9 @@ retest_commit_id:
         }
 bad:
         kfree(crypt_data);
+        kfree(crypt_iv);
+        skcipher_request_free(req);
+
         return r;
 }
 
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index c8faa2b85842..f7810cc869ac 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -458,6 +458,38 @@ do {									\
 } while (0)
 
 /*
+ * Check whether bios must be queued in the device-mapper core rather
+ * than here in the target.
+ *
+ * If MPATHF_QUEUE_IF_NO_PATH and MPATHF_SAVED_QUEUE_IF_NO_PATH hold
+ * the same value then we are not between multipath_presuspend()
+ * and multipath_resume() calls and we have no need to check
+ * for the DMF_NOFLUSH_SUSPENDING flag.
+ */
+static bool __must_push_back(struct multipath *m, unsigned long flags)
+{
+        return ((test_bit(MPATHF_QUEUE_IF_NO_PATH, &flags) !=
+                 test_bit(MPATHF_SAVED_QUEUE_IF_NO_PATH, &flags)) &&
+                dm_noflush_suspending(m->ti));
+}
+
+/*
+ * Following functions use READ_ONCE to get atomic access to
+ * all m->flags to avoid taking spinlock
+ */
+static bool must_push_back_rq(struct multipath *m)
+{
+        unsigned long flags = READ_ONCE(m->flags);
+        return test_bit(MPATHF_QUEUE_IF_NO_PATH, &flags) || __must_push_back(m, flags);
+}
+
+static bool must_push_back_bio(struct multipath *m)
+{
+        unsigned long flags = READ_ONCE(m->flags);
+        return __must_push_back(m, flags);
+}
+
+/*
  * Map cloned requests (request-based multipath)
  */
 static int multipath_clone_and_map(struct dm_target *ti, struct request *rq,
@@ -478,7 +510,7 @@ static int multipath_clone_and_map(struct dm_target *ti, struct request *rq,
                 pgpath = choose_pgpath(m, nr_bytes);
 
         if (!pgpath) {
-                if (test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags))
+                if (must_push_back_rq(m))
                         return DM_MAPIO_DELAY_REQUEUE;
                 dm_report_EIO(m);       /* Failed */
                 return DM_MAPIO_KILL;
@@ -553,7 +585,7 @@ static int __multipath_map_bio(struct multipath *m, struct bio *bio, struct dm_m
         }
 
         if (!pgpath) {
-                if (test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags))
+                if (must_push_back_bio(m))
                         return DM_MAPIO_REQUEUE;
                 dm_report_EIO(m);
                 return DM_MAPIO_KILL;
@@ -651,8 +683,7 @@ static int queue_if_no_path(struct multipath *m, bool queue_if_no_path,
         assign_bit(MPATHF_SAVED_QUEUE_IF_NO_PATH, &m->flags,
                    (save_old_value && test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) ||
                    (!save_old_value && queue_if_no_path));
-        assign_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags,
-                   queue_if_no_path || dm_noflush_suspending(m->ti));
+        assign_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags, queue_if_no_path);
         spin_unlock_irqrestore(&m->lock, flags);
 
         if (!queue_if_no_path) {
@@ -1486,7 +1517,7 @@ static int multipath_end_io(struct dm_target *ti, struct request *clone,
                         fail_path(pgpath);
 
                 if (atomic_read(&m->nr_valid_paths) == 0 &&
-                    !test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) {
+                    !must_push_back_rq(m)) {
                         if (error == BLK_STS_IOERR)
                                 dm_report_EIO(m);
                         /* complete with the original error */
@@ -1521,8 +1552,12 @@ static int multipath_end_io_bio(struct dm_target *ti, struct bio *clone,
 
         if (atomic_read(&m->nr_valid_paths) == 0 &&
             !test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) {
-                dm_report_EIO(m);
-                *error = BLK_STS_IOERR;
+                if (must_push_back_bio(m)) {
+                        r = DM_ENDIO_REQUEUE;
+                } else {
+                        dm_report_EIO(m);
+                        *error = BLK_STS_IOERR;
+                }
                 goto done;
         }
 
@@ -1957,13 +1992,6 @@ static int __init dm_multipath_init(void)
 {
         int r;
 
-        r = dm_register_target(&multipath_target);
-        if (r < 0) {
-                DMERR("request-based register failed %d", r);
-                r = -EINVAL;
-                goto bad_register_target;
-        }
-
         kmultipathd = alloc_workqueue("kmpathd", WQ_MEM_RECLAIM, 0);
         if (!kmultipathd) {
                 DMERR("failed to create workqueue kmpathd");
@@ -1985,13 +2013,20 @@ static int __init dm_multipath_init(void)
                 goto bad_alloc_kmpath_handlerd;
         }
 
+        r = dm_register_target(&multipath_target);
+        if (r < 0) {
+                DMERR("request-based register failed %d", r);
+                r = -EINVAL;
+                goto bad_register_target;
+        }
+
         return 0;
 
+bad_register_target:
+        destroy_workqueue(kmpath_handlerd);
 bad_alloc_kmpath_handlerd:
         destroy_workqueue(kmultipathd);
 bad_alloc_kmultipathd:
-        dm_unregister_target(&multipath_target);
-bad_register_target:
         return r;
 }
 
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index 1113b42e1eda..a0613bd8ed00 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -2411,24 +2411,6 @@ static int __init dm_snapshot_init(void)
                 return r;
         }
 
-        r = dm_register_target(&snapshot_target);
-        if (r < 0) {
-                DMERR("snapshot target register failed %d", r);
-                goto bad_register_snapshot_target;
-        }
-
-        r = dm_register_target(&origin_target);
-        if (r < 0) {
-                DMERR("Origin target register failed %d", r);
-                goto bad_register_origin_target;
-        }
-
-        r = dm_register_target(&merge_target);
-        if (r < 0) {
-                DMERR("Merge target register failed %d", r);
-                goto bad_register_merge_target;
-        }
-
         r = init_origin_hash();
         if (r) {
                 DMERR("init_origin_hash failed.");
@@ -2449,19 +2431,37 @@ static int __init dm_snapshot_init(void)
                 goto bad_pending_cache;
         }
 
+        r = dm_register_target(&snapshot_target);
+        if (r < 0) {
+                DMERR("snapshot target register failed %d", r);
+                goto bad_register_snapshot_target;
+        }
+
+        r = dm_register_target(&origin_target);
+        if (r < 0) {
+                DMERR("Origin target register failed %d", r);
+                goto bad_register_origin_target;
+        }
+
+        r = dm_register_target(&merge_target);
+        if (r < 0) {
+                DMERR("Merge target register failed %d", r);
+                goto bad_register_merge_target;
+        }
+
         return 0;
 
-bad_pending_cache:
-        kmem_cache_destroy(exception_cache);
-bad_exception_cache:
-        exit_origin_hash();
-bad_origin_hash:
-        dm_unregister_target(&merge_target);
 bad_register_merge_target:
         dm_unregister_target(&origin_target);
 bad_register_origin_target:
         dm_unregister_target(&snapshot_target);
 bad_register_snapshot_target:
+        kmem_cache_destroy(pending_cache);
+bad_pending_cache:
+        kmem_cache_destroy(exception_cache);
+bad_exception_cache:
+        exit_origin_hash();
+bad_origin_hash:
         dm_exception_store_exit();
 
         return r;
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 88130b5d95f9..aaffd0c0ee9a 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -453,14 +453,15 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,
 
                 refcount_set(&dd->count, 1);
                 list_add(&dd->list, &t->devices);
+                goto out;
 
         } else if (dd->dm_dev->mode != (mode | dd->dm_dev->mode)) {
                 r = upgrade_mode(dd, mode, t->md);
                 if (r)
                         return r;
-                refcount_inc(&dd->count);
         }
-
+        refcount_inc(&dd->count);
+out:
         *result = dd->dm_dev;
         return 0;
 }
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index d31d18d9727c..36ef284ad086 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -80,10 +80,14 @@
 #define SECTOR_TO_BLOCK_SHIFT 3
 
 /*
+ * For btree insert:
  *  3 for btree insert +
  *  2 for btree lookup used within space map
+ * For btree remove:
+ *  2 for shadow spine +
+ *  4 for rebalance 3 child node
  */
-#define THIN_MAX_CONCURRENT_LOCKS 5
+#define THIN_MAX_CONCURRENT_LOCKS 6
 
 /* This should be plenty */
 #define SPACE_MAP_ROOT_SIZE 128
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 89e5dff9b4cf..f91d771fff4b 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -4355,30 +4355,28 @@ static struct target_type thin_target = {
 
 static int __init dm_thin_init(void)
 {
-        int r;
+        int r = -ENOMEM;
 
         pool_table_init();
 
+        _new_mapping_cache = KMEM_CACHE(dm_thin_new_mapping, 0);
+        if (!_new_mapping_cache)
+                return r;
+
         r = dm_register_target(&thin_target);
         if (r)
-                return r;
+                goto bad_new_mapping_cache;
 
         r = dm_register_target(&pool_target);
         if (r)
-                goto bad_pool_target;
-
-        r = -ENOMEM;
-
-        _new_mapping_cache = KMEM_CACHE(dm_thin_new_mapping, 0);
-        if (!_new_mapping_cache)
-                goto bad_new_mapping_cache;
+                goto bad_thin_target;
 
         return 0;
 
-bad_new_mapping_cache:
-        dm_unregister_target(&pool_target);
-bad_pool_target:
+bad_thin_target:
         dm_unregister_target(&thin_target);
+bad_new_mapping_cache:
+        kmem_cache_destroy(_new_mapping_cache);
 
         return r;
 }
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 41c050b59ec4..4e4dee0ec2de 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7605,7 +7605,9 @@ static int status_resync(struct seq_file *seq, struct mddev *mddev)
                 if (test_bit(MD_RECOVERY_DONE, &mddev->recovery))
                         /* Still cleaning up */
                         resync = max_sectors;
-        } else
+        } else if (resync > max_sectors)
+                resync = max_sectors;
+        else
                 resync -= atomic_read(&mddev->recovery_active);
 
         if (resync == 0) {
diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index f21ce6a3d4cf..58b319757b1e 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -683,23 +683,8 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key)
         pn->keys[1] = rn->keys[0];
         memcpy_disk(value_ptr(pn, 1), &val, sizeof(__le64));
 
-        /*
-         * rejig the spine.  This is ugly, since it knows too
-         * much about the spine
-         */
-        if (s->nodes[0] != new_parent) {
-                unlock_block(s->info, s->nodes[0]);
-                s->nodes[0] = new_parent;
-        }
-        if (key < le64_to_cpu(rn->keys[0])) {
-                unlock_block(s->info, right);
-                s->nodes[1] = left;
-        } else {
-                unlock_block(s->info, left);
-                s->nodes[1] = right;
-        }
-        s->count = 2;
-
+        unlock_block(s->info, left);
+        unlock_block(s->info, right);
         return 0;
 }
 
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index cc9d337a1ed3..6df398e3a008 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -809,11 +809,15 @@ static void flush_pending_writes(struct r1conf *conf)
         spin_lock_irq(&conf->device_lock);
 
         if (conf->pending_bio_list.head) {
+                struct blk_plug plug;
                 struct bio *bio;
+
                 bio = bio_list_get(&conf->pending_bio_list);
                 conf->pending_count = 0;
                 spin_unlock_irq(&conf->device_lock);
+                blk_start_plug(&plug);
                 flush_bio_list(conf, bio);
+                blk_finish_plug(&plug);
         } else
                 spin_unlock_irq(&conf->device_lock);
 }
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index b9edbc747a95..c131835cf008 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -894,10 +894,13 @@ static void flush_pending_writes(struct r10conf *conf)
         spin_lock_irq(&conf->device_lock);
 
         if (conf->pending_bio_list.head) {
+                struct blk_plug plug;
                 struct bio *bio;
+
                 bio = bio_list_get(&conf->pending_bio_list);
                 conf->pending_count = 0;
                 spin_unlock_irq(&conf->device_lock);
+                blk_start_plug(&plug);
                 /* flush any pending bitmap writes to disk
                  * before proceeding w/ I/O */
                 bitmap_unplug(conf->mddev->bitmap);
@@ -918,6 +921,7 @@ static void flush_pending_writes(struct r10conf *conf)
                                 generic_make_request(bio);
                         bio = next;
                 }
+                blk_finish_plug(&plug);
         } else
                 spin_unlock_irq(&conf->device_lock);
 }
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index f1c86d938502..39f31f07ffe9 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -2577,31 +2577,22 @@ static ssize_t r5c_journal_mode_show(struct mddev *mddev, char *page)
 int r5c_journal_mode_set(struct mddev *mddev, int mode)
 {
         struct r5conf *conf;
-        int err;
 
         if (mode < R5C_JOURNAL_MODE_WRITE_THROUGH ||
             mode > R5C_JOURNAL_MODE_WRITE_BACK)
                 return -EINVAL;
 
-        err = mddev_lock(mddev);
-        if (err)
-                return err;
         conf = mddev->private;
-        if (!conf || !conf->log) {
-                mddev_unlock(mddev);
+        if (!conf || !conf->log)
                 return -ENODEV;
-        }
 
         if (raid5_calc_degraded(conf) > 0 &&
-            mode == R5C_JOURNAL_MODE_WRITE_BACK) {
-                mddev_unlock(mddev);
+            mode == R5C_JOURNAL_MODE_WRITE_BACK)
                 return -EINVAL;
-        }
 
         mddev_suspend(mddev);
         conf->log->r5c_journal_mode = mode;
         mddev_resume(mddev);
-        mddev_unlock(mddev);
 
         pr_debug("md/raid:%s: setting r5c cache mode to %d: %s\n",
                  mdname(mddev), mode, r5c_journal_mode_str[mode]);
@@ -2614,6 +2605,7 @@ static ssize_t r5c_journal_mode_store(struct mddev *mddev,
 {
         int mode = ARRAY_SIZE(r5c_journal_mode_str);
         size_t len = length;
+        int ret;
 
         if (len < 2)
                 return -EINVAL;
@@ -2625,8 +2617,12 @@ static ssize_t r5c_journal_mode_store(struct mddev *mddev,
                 if (strlen(r5c_journal_mode_str[mode]) == len &&
                     !strncmp(page, r5c_journal_mode_str[mode], len))
                         break;
-
-        return r5c_journal_mode_set(mddev, mode) ?: length;
+        ret = mddev_lock(mddev);
+        if (ret)
+                return ret;
+        ret = r5c_journal_mode_set(mddev, mode);
+        mddev_unlock(mddev);
+        return ret ?: length;
 }
 
 struct md_sysfs_entry
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 31dc25e2871a..98ce4272ace9 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2677,13 +2677,13 @@ static void raid5_error(struct mddev *mddev, struct md_rdev *rdev)
         pr_debug("raid456: error called\n");
 
         spin_lock_irqsave(&conf->device_lock, flags);
+        set_bit(Faulty, &rdev->flags);
         clear_bit(In_sync, &rdev->flags);
         mddev->degraded = raid5_calc_degraded(conf);
         spin_unlock_irqrestore(&conf->device_lock, flags);
         set_bit(MD_RECOVERY_INTR, &mddev->recovery);
 
         set_bit(Blocked, &rdev->flags);
-        set_bit(Faulty, &rdev->flags);
         set_mask_bits(&mddev->sb_flags, 0,
                       BIT(MD_SB_CHANGE_DEVS) | BIT(MD_SB_CHANGE_PENDING));
         pr_crit("md/raid:%s: Disk failure on %s, disabling device.\n"
diff --git a/drivers/media/common/siano/smscoreapi.c b/drivers/media/common/siano/smscoreapi.c
index e4ea2a0c7a24..c5c827e11b64 100644
--- a/drivers/media/common/siano/smscoreapi.c
+++ b/drivers/media/common/siano/smscoreapi.c
@@ -521,13 +521,13 @@ static void list_add_locked(struct list_head *new, struct list_head *head,
         spin_unlock_irqrestore(lock, flags);
 }
 
-/**
+/*
  * register a client callback that called when device plugged in/unplugged
  * NOTE: if devices exist callback is called immediately for each device
  *
  * @param hotplug callback
  *
- * @return 0 on success, <0 on error.
+ * return: 0 on success, <0 on error.
  */
 int smscore_register_hotplug(hotplug_t hotplug)
 {
@@ -562,7 +562,7 @@ int smscore_register_hotplug(hotplug_t hotplug)
 }
 EXPORT_SYMBOL_GPL(smscore_register_hotplug);
 
-/**
+/*
  * unregister a client callback that called when device plugged in/unplugged
  *
  * @param hotplug callback
@@ -636,7 +636,7 @@ smscore_buffer_t *smscore_createbuffer(u8 *buffer, void *common_buffer,
         return cb;
 }
 
-/**
+/*
  * creates coredev object for a device, prepares buffers,
  * creates buffer mappings, notifies registered hotplugs about new device.
  *
@@ -644,7 +644,7 @@ smscore_buffer_t *smscore_createbuffer(u8 *buffer, void *common_buffer,
  *               and handlers
  * @param coredev pointer to a value that receives created coredev object
  *
- * @return 0 on success, <0 on error.
+ * return: 0 on success, <0 on error.
  */
 int smscore_register_device(struct smsdevice_params_t *params,
                             struct smscore_device_t **coredev,
@@ -764,10 +764,10 @@ static int smscore_sendrequest_and_wait(struct smscore_device_t *coredev,
                         0 : -ETIME;
 }
 
-/**
+/*
  * Starts & enables IR operations
  *
- * @return 0 on success, < 0 on error.
+ * return: 0 on success, < 0 on error.
  */
 static int smscore_init_ir(struct smscore_device_t *coredev)
 {
@@ -812,13 +812,13 @@ static int smscore_init_ir(struct smscore_device_t *coredev)
         return 0;
 }
 
-/**
+/*
  * configures device features according to board configuration structure.
  *
  * @param coredev pointer to a coredev object returned by
  *                smscore_register_device
  *
- * @return 0 on success, <0 on error.
+ * return: 0 on success, <0 on error.
  */
 static int smscore_configure_board(struct smscore_device_t *coredev)
 {
@@ -861,13 +861,13 @@ static int smscore_configure_board(struct smscore_device_t *coredev)
         return 0;
 }
 
-/**
+/*
  * sets initial device mode and notifies client hotplugs that device is ready
  *
  * @param coredev pointer to a coredev object returned by
  *                smscore_register_device
  *
- * @return 0 on success, <0 on error.
+ * return: 0 on success, <0 on error.
  */
 int smscore_start_device(struct smscore_device_t *coredev)
 {
@@ -1087,7 +1087,7 @@ static char *smscore_fw_lkup[][DEVICE_MODE_MAX] = {
         },
 };
 
-/**
+/*
  * get firmware file name from one of the two mechanisms : sms_boards or
  * smscore_fw_lkup.
  * @param coredev pointer to a coredev object returned by
@@ -1096,7 +1096,7 @@ static char *smscore_fw_lkup[][DEVICE_MODE_MAX] = {
  * @param lookup if 1, always get the fw filename from smscore_fw_lkup
  *       table. if 0, try first to get from sms_boards
  *
- * @return 0 on success, <0 on error.
+ * return: 0 on success, <0 on error.
  */
 static char *smscore_get_fw_filename(struct smscore_device_t *coredev,
                               int mode)
@@ -1125,7 +1125,7 @@ static char *smscore_get_fw_filename(struct smscore_device_t *coredev,
         return fw[mode];
 }
 
-/**
+/*
  * loads specified firmware into a buffer and calls device loadfirmware_handler
  *
  * @param coredev pointer to a coredev object returned by
@@ -1133,7 +1133,7 @@ static char *smscore_get_fw_filename(struct smscore_device_t *coredev,
  * @param filename null-terminated string specifies firmware file name
  * @param loadfirmware_handler device handler that loads firmware
  *
- * @return 0 on success, <0 on error.
+ * return: 0 on success, <0 on error.
  */
 static int smscore_load_firmware_from_file(struct smscore_device_t *coredev,
                                            int mode,
@@ -1182,14 +1182,14 @@ static int smscore_load_firmware_from_file(struct smscore_device_t *coredev,
         return rc;
 }
 
-/**
+/*
  * notifies all clients registered with the device, notifies hotplugs,
  * frees all buffers and coredev object
  *
  * @param coredev pointer to a coredev object returned by
  *                smscore_register_device
  *
- * @return 0 on success, <0 on error.
+ * return: 0 on success, <0 on error.
  */
 void smscore_unregister_device(struct smscore_device_t *coredev)
 {
@@ -1282,14 +1282,14 @@ static int smscore_detect_mode(struct smscore_device_t *coredev)
         return rc;
 }
 
-/**
+/*
  * send init device request and wait for response
  *
  * @param coredev pointer to a coredev object returned by
  *                smscore_register_device
  * @param mode requested mode of operation
  *
- * @return 0 on success, <0 on error.
+ * return: 0 on success, <0 on error.
  */
 static int smscore_init_device(struct smscore_device_t *coredev, int mode)
 {
@@ -1315,7 +1315,7 @@ static int smscore_init_device(struct smscore_device_t *coredev, int mode)
         return rc;
 }
 
-/**
+/*
  * calls device handler to change mode of operation
  * NOTE: stellar/usb may disconnect when changing mode
  *
@@ -1323,7 +1323,7 @@ static int smscore_init_device(struct smscore_device_t *coredev, int mode)
  *                smscore_register_device
  * @param mode requested mode of operation
  *
- * @return 0 on success, <0 on error.
+ * return: 0 on success, <0 on error.
  */
 int smscore_set_device_mode(struct smscore_device_t *coredev, int mode)
 {
@@ -1411,13 +1411,13 @@ int smscore_set_device_mode(struct smscore_device_t *coredev, int mode)
         return rc;
 }
 
-/**
+/*
  * calls device handler to get current mode of operation
  *
  * @param coredev pointer to a coredev object returned by
  *                smscore_register_device
  *
- * @return current mode
+ * return: current mode
  */
 int smscore_get_device_mode(struct smscore_device_t *coredev)
 {
@@ -1425,7 +1425,7 @@ int smscore_get_device_mode(struct smscore_device_t *coredev)
 }
 EXPORT_SYMBOL_GPL(smscore_get_device_mode);
 
-/**
+/*
  * find client by response id & type within the clients list.
  * return client handle or NULL.
  *
@@ -1462,7 +1462,7 @@ found:
         return client;
 }
 
-/**
+/*
  * find client by response id/type, call clients onresponse handler
  * return buffer to pool on error
  *
@@ -1615,13 +1615,13 @@ void smscore_onresponse(struct smscore_device_t *coredev,
 }
 EXPORT_SYMBOL_GPL(smscore_onresponse);
 
-/**
+/*
  * return pointer to next free buffer descriptor from core pool
  *
  * @param coredev pointer to a coredev object returned by
  *                smscore_register_device
  *
- * @return pointer to descriptor on success, NULL on error.
+ * return: pointer to descriptor on success, NULL on error.
  */
 
 static struct smscore_buffer_t *get_entry(struct smscore_device_t *coredev)
@@ -1648,7 +1648,7 @@ struct smscore_buffer_t *smscore_getbuffer(struct smscore_device_t *coredev)
 }
 EXPORT_SYMBOL_GPL(smscore_getbuffer);
 
-/**
+/*
  * return buffer descriptor to a pool
  *
  * @param coredev pointer to a coredev object returned by
@@ -1693,7 +1693,7 @@ static int smscore_validate_client(struct smscore_device_t *coredev,
         return 0;
 }
 
-/**
+/*
  * creates smsclient object, check that id is taken by another client
  *
  * @param coredev pointer to a coredev object from clients hotplug
@@ -1705,7 +1705,7 @@ static int smscore_validate_client(struct smscore_device_t *coredev,
  * @param context client-specific context
  * @param client pointer to a value that receives created smsclient object
  *
- * @return 0 on success, <0 on error.
+ * return: 0 on success, <0 on error.
  */
 int smscore_register_client(struct smscore_device_t *coredev,
                             struct smsclient_params_t *params,
@@ -1740,7 +1740,7 @@ int smscore_register_client(struct smscore_device_t *coredev,
 }
 EXPORT_SYMBOL_GPL(smscore_register_client);
 
-/**
+/*
  * frees smsclient object and all subclients associated with it
  *
  * @param client pointer to smsclient object returned by
@@ -1771,7 +1771,7 @@ void smscore_unregister_client(struct smscore_client_t *client)
 }
 EXPORT_SYMBOL_GPL(smscore_unregister_client);
 
-/**
+/*
  * verifies that source id is not taken by another client,
  * calls device handler to send requests to the device
  *
@@ -1780,7 +1780,7 @@ EXPORT_SYMBOL_GPL(smscore_unregister_client);
  * @param buffer pointer to a request buffer
  * @param size size (in bytes) of request buffer
  *
- * @return 0 on success, <0 on error.
+ * return: 0 on success, <0 on error.
  */
 int smsclient_sendrequest(struct smscore_client_t *client,
                           void *buffer, size_t size)
diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c
index 95b3723282f4..d48b61eb01f4 100644
--- a/drivers/media/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb-core/dvb_ca_en50221.c
@@ -206,7 +206,7 @@ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot,
  * @hlen: Number of bytes in haystack.
  * @needle: Buffer to find.
  * @nlen: Number of bytes in needle.
- * @return Pointer into haystack needle was found at, or NULL if not found.
+ * return: Pointer into haystack needle was found at, or NULL if not found.
  */
 static char *findstr(char *haystack, int hlen, char *needle, int nlen)
 {
@@ -226,7 +226,7 @@ static char *findstr(char *haystack, int hlen, char *needle, int nlen)
 /* ************************************************************************** */
 /* EN50221 physical interface functions */
 
-/**
+/*
  * dvb_ca_en50221_check_camstatus - Check CAM status.
  */
 static int dvb_ca_en50221_check_camstatus(struct dvb_ca_private *ca, int slot)
@@ -275,9 +275,9 @@ static int dvb_ca_en50221_check_camstatus(struct dvb_ca_private *ca, int slot)
  * @ca: CA instance.
  * @slot: Slot on interface.
  * @waitfor: Flags to wait for.
- * @timeout_ms: Timeout in milliseconds.
+ * @timeout_hz: Timeout in milliseconds.
  *
- * @return 0 on success, nonzero on error.
+ * return: 0 on success, nonzero on error.
  */
 static int dvb_ca_en50221_wait_if_status(struct dvb_ca_private *ca, int slot,
                                          u8 waitfor, int timeout_hz)
@@ -325,7 +325,7 @@ static int dvb_ca_en50221_wait_if_status(struct dvb_ca_private *ca, int slot,
  * @ca: CA instance.
  * @slot: Slot id.
  *
- * @return 0 on success, nonzero on failure.
+ * return: 0 on success, nonzero on failure.
  */
 static int dvb_ca_en50221_link_init(struct dvb_ca_private *ca, int slot)
 {
@@ -397,11 +397,11 @@ static int dvb_ca_en50221_link_init(struct dvb_ca_private *ca, int slot)
  * @ca: CA instance.
  * @slot: Slot id.
  * @address: Address to read from. Updated.
- * @tupleType: Tuple id byte. Updated.
- * @tupleLength: Tuple length. Updated.
+ * @tuple_type: Tuple id byte. Updated.
+ * @tuple_length: Tuple length. Updated.
  * @tuple: Dest buffer for tuple (must be 256 bytes). Updated.
  *
- * @return 0 on success, nonzero on error.
+ * return: 0 on success, nonzero on error.
  */
 static int dvb_ca_en50221_read_tuple(struct dvb_ca_private *ca, int slot,
                                      int *address, int *tuple_type,
@@ -455,7 +455,7 @@ static int dvb_ca_en50221_read_tuple(struct dvb_ca_private *ca, int slot,
  * @ca: CA instance.
  * @slot: Slot id.
  *
- * @return 0 on success, <0 on failure.
+ * return: 0 on success, <0 on failure.
  */
 static int dvb_ca_en50221_parse_attributes(struct dvb_ca_private *ca, int slot)
 {
@@ -632,10 +632,11 @@ static int dvb_ca_en50221_set_configoption(struct dvb_ca_private *ca, int slot)
  * @ca: CA instance.
  * @slot: Slot to read from.
  * @ebuf: If non-NULL, the data will be written to this buffer. If NULL,
- * the data will be added into the buffering system as a normal fragment.
+ *        the data will be added into the buffering system as a normal
+ *        fragment.
  * @ecount: Size of ebuf. Ignored if ebuf is NULL.
  *
- * @return Number of bytes read, or < 0 on error
+ * return: Number of bytes read, or < 0 on error
  */
 static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot,
                                     u8 *ebuf, int ecount)
@@ -784,11 +785,11 @@ exit:
  *
  * @ca: CA instance.
  * @slot: Slot to write to.
- * @ebuf: The data in this buffer is treated as a complete link-level packet to
- * be written.
- * @count: Size of ebuf.
+ * @buf: The data in this buffer is treated as a complete link-level packet to
+ *       be written.
+ * @bytes_write: Size of ebuf.
  *
- * @return Number of bytes written, or < 0 on error.
+ * return: Number of bytes written, or < 0 on error.
  */
 static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot,
                                      u8 *buf, int bytes_write)
@@ -933,7 +934,7 @@ static int dvb_ca_en50221_slot_shutdown(struct dvb_ca_private *ca, int slot)
 /**
  * dvb_ca_en50221_camchange_irq - A CAMCHANGE IRQ has occurred.
  *
- * @ca: CA instance.
+ * @pubca: CA instance.
  * @slot: Slot concerned.
  * @change_type: One of the DVB_CA_CAMCHANGE_* values.
  */
@@ -963,7 +964,7 @@ EXPORT_SYMBOL(dvb_ca_en50221_camchange_irq);
 /**
  * dvb_ca_en50221_camready_irq - A CAMREADY IRQ has occurred.
  *
- * @ca: CA instance.
+ * @pubca: CA instance.
  * @slot: Slot concerned.
  */
 void dvb_ca_en50221_camready_irq(struct dvb_ca_en50221 *pubca, int slot)
@@ -983,7 +984,7 @@ EXPORT_SYMBOL(dvb_ca_en50221_camready_irq);
 /**
  * dvb_ca_en50221_frda_irq - An FR or DA IRQ has occurred.
  *
- * @ca: CA instance.
+ * @pubca: CA instance.
  * @slot: Slot concerned.
  */
 void dvb_ca_en50221_frda_irq(struct dvb_ca_en50221 *pubca, int slot)
@@ -1091,7 +1092,7 @@ static void dvb_ca_en50221_thread_update_delay(struct dvb_ca_private *ca)
  *
  * @ca: CA instance.
  * @slot: Slot to process.
- * @return: 0 .. no change
+ * return:: 0 .. no change
  *          1 .. CAM state changed
  */
 
@@ -1296,7 +1297,7 @@ static void dvb_ca_en50221_thread_state_machine(struct dvb_ca_private *ca,
         mutex_unlock(&sl->slot_lock);
 }
 
-/**
+/*
  * Kernel thread which monitors CA slots for CAM changes, and performs data
  * transfers.
  */
@@ -1336,12 +1337,11 @@ static int dvb_ca_en50221_thread(void *data)
  * Real ioctl implementation.
  * NOTE: CA_SEND_MSG/CA_GET_MSG ioctls have userspace buffers passed to them.
  *
- * @inode: Inode concerned.
  * @file: File concerned.
  * @cmd: IOCTL command.
- * @arg: Associated argument.
+ * @parg: Associated argument.
  *
- * @return 0 on success, <0 on error.
+ * return: 0 on success, <0 on error.
  */
 static int dvb_ca_en50221_io_do_ioctl(struct file *file,
                                       unsigned int cmd, void *parg)
@@ -1420,12 +1420,11 @@ out_unlock:
 /**
  * Wrapper for ioctl implementation.
  *
- * @inode: Inode concerned.
  * @file: File concerned.
  * @cmd: IOCTL command.
  * @arg: Associated argument.
  *
- * @return 0 on success, <0 on error.
+ * return: 0 on success, <0 on error.
  */
 static long dvb_ca_en50221_io_ioctl(struct file *file,
                                     unsigned int cmd, unsigned long arg)
@@ -1441,7 +1440,7 @@ static long dvb_ca_en50221_io_ioctl(struct file *file,
  * @count: Size of source buffer.
  * @ppos: Position in file (ignored).
  *
- * @return Number of bytes read, or <0 on error.
+ * return: Number of bytes read, or <0 on error.
  */
 static ssize_t dvb_ca_en50221_io_write(struct file *file,
                                        const char __user *buf, size_t count,
@@ -1536,7 +1535,7 @@ exit:
         return status;
 }
 
-/**
+/*
  * Condition for waking up in dvb_ca_en50221_io_read_condition
  */
 static int dvb_ca_en50221_io_read_condition(struct dvb_ca_private *ca,
@@ -1593,7 +1592,7 @@ nextslot:
  * @count: Size of destination buffer.
  * @ppos: Position in file (ignored).
  *
- * @return Number of bytes read, or <0 on error.
+ * return: Number of bytes read, or <0 on error.
  */
 static ssize_t dvb_ca_en50221_io_read(struct file *file, char __user *buf,
                                       size_t count, loff_t *ppos)
@@ -1702,7 +1701,7 @@ exit:
  * @inode: Inode concerned.
  * @file: File concerned.
  *
- * @return 0 on success, <0 on failure.
+ * return: 0 on success, <0 on failure.
  */
 static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file)
 {
@@ -1752,7 +1751,7 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file)
  * @inode: Inode concerned.
  * @file: File concerned.
  *
- * @return 0 on success, <0 on failure.
+ * return: 0 on success, <0 on failure.
  */
 static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file)
 {
@@ -1781,7 +1780,7 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file)
  * @file: File concerned.
  * @wait: poll wait table.
  *
- * @return Standard poll mask.
+ * return: Standard poll mask.
  */
 static unsigned int dvb_ca_en50221_io_poll(struct file *file, poll_table *wait)
 {
@@ -1838,11 +1837,11 @@ static const struct dvb_device dvbdev_ca = {
  * Initialise a new DVB CA EN50221 interface device.
  *
  * @dvb_adapter: DVB adapter to attach the new CA device to.
- * @ca: The dvb_ca instance.
+ * @pubca: The dvb_ca instance.
  * @flags: Flags describing the CA device (DVB_CA_FLAG_*).
  * @slot_count: Number of slots supported.
  *
- * @return 0 on success, nonzero on failure
+ * return: 0 on success, nonzero on failure
  */
 int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter,
                         struct dvb_ca_en50221 *pubca, int flags, int slot_count)
@@ -1929,8 +1928,7 @@ EXPORT_SYMBOL(dvb_ca_en50221_init);
 /**
  * Release a DVB CA EN50221 interface device.
  *
- * @ca_dev: The dvb_device_t instance for the CA device.
- * @ca: The associated dvb_ca instance.
+ * @pubca: The associated dvb_ca instance.
  */
 void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca)
 {
diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index 3ad83359098b..2afaa8226342 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -369,11 +369,14 @@ static void dvb_frontend_swzigzag_update_delay(struct dvb_frontend_private *fepr
 }
 
 /**
- * Performs automatic twiddling of frontend parameters.
+ * dvb_frontend_swzigzag_autotune - Performs automatic twiddling of frontend
+ *      parameters.
  *
- * @param fe The frontend concerned.
- * @param check_wrapped Checks if an iteration has completed. DO NOT SET ON THE FIRST ATTEMPT
- * @returns Number of complete iterations that have been performed.
+ * @fe: The frontend concerned.
+ * @check_wrapped: Checks if an iteration has completed.
+ *                 DO NOT SET ON THE FIRST ATTEMPT.
+ *
+ * return: Number of complete iterations that have been performed.
  */
 static int dvb_frontend_swzigzag_autotune(struct dvb_frontend *fe, int check_wrapped)
 {
@@ -1253,7 +1256,7 @@ dtv_property_legacy_params_sync(struct dvb_frontend *fe,
  * dtv_get_frontend - calls a callback for retrieving DTV parameters
  * @fe:         struct dvb_frontend pointer
  * @c:          struct dtv_frontend_properties pointer (DVBv5 cache)
- * @p_out       struct dvb_frontend_parameters pointer (DVBv3 FE struct)
+ * @p_out:      struct dvb_frontend_parameters pointer (DVBv3 FE struct)
  *
  * This routine calls either the DVBv3 or DVBv5 get_frontend call.
  * If c is not null, it will update the DVBv5 cache struct pointed by it.
diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c
index 06b0dcc13695..c018e3c06d5d 100644
--- a/drivers/media/dvb-core/dvb_net.c
+++ b/drivers/media/dvb-core/dvb_net.c
@@ -125,7 +125,7 @@ struct dvb_net_priv {
 };
 
 
-/**
+/*
  *      Determine the packet's protocol ID. The rule here is that we
  *      assume 802.3 if the type field is short enough to be a length.
  *      This is normal practice and works for any 'now in use' protocol.
@@ -155,7 +155,7 @@ static __be16 dvb_net_eth_type_trans(struct sk_buff *skb,
 
         rawp = skb->data;
 
-        /**
+        /*
          *      This is a magic hack to spot IPX packets. Older Novell breaks
          *      the protocol design and runs IPX over 802.3 without an 802.2 LLC
          *      layer. We look for FFFF which isn't a used 802.2 SSAP/DSAP. This
@@ -164,7 +164,7 @@ static __be16 dvb_net_eth_type_trans(struct sk_buff *skb,
         if (*(unsigned short *)rawp == 0xFFFF)
                 return htons(ETH_P_802_3);
 
-        /**
+        /*
          *      Real 802.2 LLC
          */
         return htons(ETH_P_802_2);
@@ -215,7 +215,8 @@ static int ule_exthdr_padding(struct dvb_net_priv *p)
         return 0;
 }
 
-/** Handle ULE extension headers.
+/*
+ * Handle ULE extension headers.
  *  Function is called after a successful CRC32 verification of an ULE SNDU to complete its decoding.
  *  Returns: >= 0: nr. of bytes consumed by next extension header
  *           -1:   Mandatory extension header that is not recognized or TEST SNDU; discard.
@@ -291,7 +292,7 @@ static int handle_ule_extensions( struct dvb_net_priv *p )
 }
 
 
-/** Prepare for a new ULE SNDU: reset the decoder state. */
+/* Prepare for a new ULE SNDU: reset the decoder state. */
 static inline void reset_ule( struct dvb_net_priv *p )
 {
         p->ule_skb = NULL;
@@ -304,7 +305,7 @@ static inline void reset_ule( struct dvb_net_priv *p )
         p->ule_bridged = 0;
 }
 
-/**
+/*
  * Decode ULE SNDUs according to draft-ietf-ipdvb-ule-03.txt from a sequence of
  * TS cells of a single PID.
  */
@@ -1005,7 +1006,7 @@ static int dvb_net_sec_callback(const u8 *buffer1, size_t buffer1_len,
 {
         struct net_device *dev = filter->priv;
 
-        /**
+        /*
          * we rely on the DVB API definition where exactly one complete
          * section is delivered in buffer1
          */
diff --git a/drivers/media/dvb-frontends/af9013.h b/drivers/media/dvb-frontends/af9013.h
index 353274524f1b..a290722c04fd 100644
--- a/drivers/media/dvb-frontends/af9013.h
+++ b/drivers/media/dvb-frontends/af9013.h
@@ -38,6 +38,13 @@
  * @api_version: Firmware API version.
  * @gpio: GPIOs.
  * @get_dvb_frontend: Get DVB frontend callback.
+ *
+ * AF9013/5 GPIOs (mostly guessed):
+ *   * demod#1-gpio#0 - set demod#2 i2c-addr for dual devices
+ *   * demod#1-gpio#1 - xtal setting (?)
+ *   * demod#1-gpio#3 - tuner#1
+ *   * demod#2-gpio#0 - tuner#2
+ *   * demod#2-gpio#1 - xtal setting (?)
  */
 struct af9013_platform_data {
         /*
@@ -89,16 +96,15 @@ struct af9013_platform_data {
 #define AF9013_TS_PARALLEL  AF9013_TS_MODE_PARALLEL
 #define AF9013_TS_SERIAL    AF9013_TS_MODE_SERIAL
 
-/*
- * AF9013/5 GPIOs (mostly guessed)
- * demod#1-gpio#0 - set demod#2 i2c-addr for dual devices
- * demod#1-gpio#1 - xtal setting (?)
- * demod#1-gpio#3 - tuner#1
- * demod#2-gpio#0 - tuner#2
- * demod#2-gpio#1 - xtal setting (?)
- */
-
 #if IS_REACHABLE(CONFIG_DVB_AF9013)
+/**
+ * Attach an af9013 demod
+ *
+ * @config: pointer to &struct af9013_config with demod configuration.
+ * @i2c: i2c adapter to use.
+ *
+ * return: FE pointer on success, NULL on failure.
+ */
 extern struct dvb_frontend *af9013_attach(const struct af9013_config *config,
         struct i2c_adapter *i2c);
 #else
diff --git a/drivers/media/dvb-frontends/ascot2e.h b/drivers/media/dvb-frontends/ascot2e.h
index dc61bf7d1b09..418c565baf83 100644
--- a/drivers/media/dvb-frontends/ascot2e.h
+++ b/drivers/media/dvb-frontends/ascot2e.h
@@ -41,6 +41,15 @@ struct ascot2e_config {
 };
 
 #if IS_REACHABLE(CONFIG_DVB_ASCOT2E)
+/**
+ * Attach an ascot2e tuner
+ *
+ * @fe: frontend to be attached
+ * @config: pointer to &struct ascot2e_config with tuner configuration.
+ * @i2c: i2c adapter to use.
+ *
+ * return: FE pointer on success, NULL on failure.
+ */
 extern struct dvb_frontend *ascot2e_attach(struct dvb_frontend *fe,
                                         const struct ascot2e_config *config,
                                         struct i2c_adapter *i2c);
diff --git a/drivers/media/dvb-frontends/cxd2820r.h b/drivers/media/dvb-frontends/cxd2820r.h
index f3ff8f6eb3bb..a49400c0e28e 100644
--- a/drivers/media/dvb-frontends/cxd2820r.h
+++ b/drivers/media/dvb-frontends/cxd2820r.h
@@ -49,7 +49,6 @@
  * @gpio_chip_base: GPIO.
  * @get_dvb_frontend: Get DVB frontend.
  */
-
 struct cxd2820r_platform_data {
         u8 ts_mode;
         bool ts_clk_inv;
@@ -62,6 +61,17 @@ struct cxd2820r_platform_data {
         bool attach_in_use;
 };
 
+/**
+ * struct cxd2820r_config - configuration for cxd2020r demod
+ *
+ * @i2c_address: Demodulator I2C address. Driver determines DVB-C slave I2C
+ *               address automatically from master address.
+ *               Default: none, must set. Values: 0x6c, 0x6d.
+ * @ts_mode:    TS output mode. Default: none, must set. Values: FIXME?
+ * @ts_clock_inv: TS clock inverted. Default: 0. Values: 0, 1.
+ * @if_agc_polarity: Default: 0. Values: 0, 1
+ * @spec_inv:   Spectrum inversion. Default: 0. Values: 0, 1.
+ */
 struct cxd2820r_config {
         /* Demodulator I2C address.
          * Driver determines DVB-C slave I2C address automatically from master
@@ -98,6 +108,18 @@ struct cxd2820r_config {
 
 
 #if IS_REACHABLE(CONFIG_DVB_CXD2820R)
+/**
+ * Attach a cxd2820r demod
+ *
+ * @config: pointer to &struct cxd2820r_config with demod configuration.
+ * @i2c: i2c adapter to use.
+ * @gpio_chip_base: if zero, disables GPIO setting. Otherwise, if
+ *                  CONFIG_GPIOLIB is set dynamically allocate
+ *                  gpio base; if is not set, use its value to
+ *                  setup the GPIO pins.
+ *
+ * return: FE pointer on success, NULL on failure.
+ */
 extern struct dvb_frontend *cxd2820r_attach(
         const struct cxd2820r_config *config,
         struct i2c_adapter *i2c,
diff --git a/drivers/media/dvb-frontends/drx39xyj/bsp_i2c.h b/drivers/media/dvb-frontends/drx39xyj/bsp_i2c.h
index 5b5421f70388..2b3af247a1f1 100644
--- a/drivers/media/dvb-frontends/drx39xyj/bsp_i2c.h
+++ b/drivers/media/dvb-frontends/drx39xyj/bsp_i2c.h
@@ -52,7 +52,7 @@ struct i2c_device_addr {
 };
 
 
-/**
+/*
 * \def IS_I2C_10BIT( addr )
 * \brief Determine if I2C address 'addr' is a 10 bits address or not.
 * \param addr The I2C address.
@@ -67,7 +67,7 @@ struct i2c_device_addr {
 Exported FUNCTIONS
 ------------------------------------------------------------------------------*/
 
-/**
+/*
 * \fn drxbsp_i2c_init()
 * \brief Initialize I2C communication module.
 * \return drx_status_t Return status.
@@ -76,7 +76,7 @@ Exported FUNCTIONS
 */
         drx_status_t drxbsp_i2c_init(void);
 
-/**
+/*
 * \fn drxbsp_i2c_term()
 * \brief Terminate I2C communication module.
 * \return drx_status_t Return status.
@@ -85,7 +85,7 @@ Exported FUNCTIONS
 */
         drx_status_t drxbsp_i2c_term(void);
 
-/**
+/*
 * \fn drx_status_t drxbsp_i2c_write_read( struct i2c_device_addr *w_dev_addr,
 *                                       u16 w_count,
 *                                       u8 *wData,
@@ -121,7 +121,7 @@ Exported FUNCTIONS
                                          struct i2c_device_addr *r_dev_addr,
                                          u16 r_count, u8 *r_data);
 
-/**
+/*
 * \fn drxbsp_i2c_error_text()
 * \brief Returns a human readable error.
 * Counter part of numerical drx_i2c_error_g.
@@ -130,7 +130,7 @@ Exported FUNCTIONS
 */
         char *drxbsp_i2c_error_text(void);
 
-/**
+/*
 * \var drx_i2c_error_g;
 * \brief I2C specific error codes, platform dependent.
 */
diff --git a/drivers/media/dvb-frontends/drx39xyj/drx_driver.h b/drivers/media/dvb-frontends/drx39xyj/drx_driver.h
index cd69e187ba7a..855685b6b386 100644
--- a/drivers/media/dvb-frontends/drx39xyj/drx_driver.h
+++ b/drivers/media/dvb-frontends/drx39xyj/drx_driver.h
@@ -46,7 +46,7 @@ struct i2c_device_addr {
         void *user_data;                /* User data pointer */
 };
 
-/**
+/*
 * \def IS_I2C_10BIT( addr )
 * \brief Determine if I2C address 'addr' is a 10 bits address or not.
 * \param addr The I2C address.
@@ -61,7 +61,7 @@ struct i2c_device_addr {
 Exported FUNCTIONS
 ------------------------------------------------------------------------------*/
 
-/**
+/*
 * \fn drxbsp_i2c_init()
 * \brief Initialize I2C communication module.
 * \return int Return status.
@@ -70,7 +70,7 @@ Exported FUNCTIONS
 */
 int drxbsp_i2c_init(void);
 
-/**
+/*
 * \fn drxbsp_i2c_term()
 * \brief Terminate I2C communication module.
 * \return int Return status.
@@ -79,7 +79,7 @@ int drxbsp_i2c_init(void);
 */
 int drxbsp_i2c_term(void);
 
-/**
+/*
 * \fn int drxbsp_i2c_write_read( struct i2c_device_addr *w_dev_addr,
 *                                       u16 w_count,
 *                                       u8 * wData,
@@ -115,7 +115,7 @@ int drxbsp_i2c_write_read(struct i2c_device_addr *w_dev_addr,
                                         struct i2c_device_addr *r_dev_addr,
                                         u16 r_count, u8 *r_data);
 
-/**
+/*
 * \fn drxbsp_i2c_error_text()
 * \brief Returns a human readable error.
 * Counter part of numerical drx_i2c_error_g.
@@ -124,7 +124,7 @@ int drxbsp_i2c_write_read(struct i2c_device_addr *w_dev_addr,
 */
 char *drxbsp_i2c_error_text(void);
 
-/**
+/*
 * \var drx_i2c_error_g;
 * \brief I2C specific error codes, platform dependent.
 */
@@ -241,13 +241,13 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
                                                 struct i2c_device_addr *r_dev_addr,
                                                 u16 r_count, u8 *r_data);
 
-/**************
+/*************
 *
 * This section configures the DRX Data Access Protocols (DAPs).
 *
 **************/
 
-/**
+/*
 * \def DRXDAP_SINGLE_MASTER
 * \brief Enable I2C single or I2C multimaster mode on host.
 *
@@ -262,7 +262,7 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
 #define DRXDAP_SINGLE_MASTER 1
 #endif
 
-/**
+/*
 * \def DRXDAP_MAX_WCHUNKSIZE
 * \brief Defines maximum chunksize of an i2c write action by host.
 *
@@ -282,7 +282,7 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
 #define  DRXDAP_MAX_WCHUNKSIZE 60
 #endif
 
-/**
+/*
 * \def DRXDAP_MAX_RCHUNKSIZE
 * \brief Defines maximum chunksize of an i2c read action by host.
 *
@@ -297,13 +297,13 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
 #define  DRXDAP_MAX_RCHUNKSIZE 60
 #endif
 
-/**************
+/*************
 *
 * This section describes drxdriver defines.
 *
 **************/
 
-/**
+/*
 * \def DRX_UNKNOWN
 * \brief Generic UNKNOWN value for DRX enumerated types.
 *
@@ -313,7 +313,7 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
 #define DRX_UNKNOWN (254)
 #endif
 
-/**
+/*
 * \def DRX_AUTO
 * \brief Generic AUTO value for DRX enumerated types.
 *
@@ -324,104 +324,104 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
 #define DRX_AUTO    (255)
 #endif
 
-/**************
+/*************
 *
 * This section describes flag definitions for the device capbilities.
 *
 **************/
 
-/**
+/*
 * \brief LNA capability flag
 *
 * Device has a Low Noise Amplifier
 *
 */
 #define DRX_CAPABILITY_HAS_LNA           (1UL <<  0)
-/**
+/*
 * \brief OOB-RX capability flag
 *
 * Device has OOB-RX
 *
 */
 #define DRX_CAPABILITY_HAS_OOBRX         (1UL <<  1)
-/**
+/*
 * \brief ATV capability flag
 *
 * Device has ATV
 *
 */
 #define DRX_CAPABILITY_HAS_ATV           (1UL <<  2)
-/**
+/*
 * \brief DVB-T capability flag
 *
 * Device has DVB-T
 *
 */
 #define DRX_CAPABILITY_HAS_DVBT          (1UL <<  3)
-/**
+/*
 * \brief  ITU-B capability flag
 *
 * Device has ITU-B
 *
 */
 #define DRX_CAPABILITY_HAS_ITUB          (1UL <<  4)
-/**
+/*
 * \brief  Audio capability flag
 *
 * Device has Audio
 *
 */
 #define DRX_CAPABILITY_HAS_AUD           (1UL <<  5)
-/**
+/*
 * \brief  SAW switch capability flag
 *
 * Device has SAW switch
 *
 */
 #define DRX_CAPABILITY_HAS_SAWSW         (1UL <<  6)
-/**
+/*
 * \brief  GPIO1 capability flag
 *
 * Device has GPIO1
 *
 */
 #define DRX_CAPABILITY_HAS_GPIO1         (1UL <<  7)
-/**
+/*
 * \brief  GPIO2 capability flag
 *
 * Device has GPIO2
 *
 */
 #define DRX_CAPABILITY_HAS_GPIO2         (1UL <<  8)
-/**
+/*
 * \brief  IRQN capability flag
 *
 * Device has IRQN
 *
 */
 #define DRX_CAPABILITY_HAS_IRQN          (1UL <<  9)
-/**
+/*
 * \brief  8VSB capability flag
 *
 * Device has 8VSB
 *
 */
 #define DRX_CAPABILITY_HAS_8VSB          (1UL << 10)
-/**
+/*
 * \brief  SMA-TX capability flag
 *
 * Device has SMATX
 *
 */
 #define DRX_CAPABILITY_HAS_SMATX         (1UL << 11)
-/**
+/*
 * \brief  SMA-RX capability flag
 *
 * Device has SMARX
 *
 */
 #define DRX_CAPABILITY_HAS_SMARX         (1UL << 12)
-/**
+/*
 * \brief  ITU-A/C capability flag
 *
 * Device has ITU-A/C
@@ -439,7 +439,7 @@ MACROS
          DRX_VERSIONSTRING_HELP(PATCH)
 #define DRX_VERSIONSTRING_HELP(NUM) #NUM
 
-/**
+/*
 * \brief Macro to create byte array elements from 16 bit integers.
 * This macro is used to create byte arrays for block writes.
 * Block writes speed up I2C traffic between host and demod.
@@ -449,7 +449,7 @@ MACROS
 #define DRX_16TO8(x) ((u8) (((u16)x) & 0xFF)), \
                         ((u8)((((u16)x)>>8)&0xFF))
 
-/**
+/*
 * \brief Macro to convert 16 bit register value to a s32
 */
 #define DRX_U16TODRXFREQ(x)   ((x & 0x8000) ? \
@@ -461,191 +461,191 @@ MACROS
 ENUM
 -------------------------------------------------------------------------*/
 
-/**
+/*
 * \enum enum drx_standard
 * \brief Modulation standards.
 */
 enum drx_standard {
-        DRX_STANDARD_DVBT = 0, /**< Terrestrial DVB-T.               */
-        DRX_STANDARD_8VSB,     /**< Terrestrial 8VSB.                */
-        DRX_STANDARD_NTSC,     /**< Terrestrial\Cable analog NTSC.   */
+        DRX_STANDARD_DVBT = 0, /*< Terrestrial DVB-T.               */
+        DRX_STANDARD_8VSB,     /*< Terrestrial 8VSB.                */
+        DRX_STANDARD_NTSC,     /*< Terrestrial\Cable analog NTSC.   */
         DRX_STANDARD_PAL_SECAM_BG,
-                                /**< Terrestrial analog PAL/SECAM B/G */
+                                /*< Terrestrial analog PAL/SECAM B/G */
         DRX_STANDARD_PAL_SECAM_DK,
-                                /**< Terrestrial analog PAL/SECAM D/K */
+                                /*< Terrestrial analog PAL/SECAM D/K */
         DRX_STANDARD_PAL_SECAM_I,
-                                /**< Terrestrial analog PAL/SECAM I   */
+                                /*< Terrestrial analog PAL/SECAM I   */
         DRX_STANDARD_PAL_SECAM_L,
-                                /**< Terrestrial analog PAL/SECAM L
+                                /*< Terrestrial analog PAL/SECAM L
                                         with negative modulation        */
         DRX_STANDARD_PAL_SECAM_LP,
-                                /**< Terrestrial analog PAL/SECAM L
+                                /*< Terrestrial analog PAL/SECAM L
                                         with positive modulation        */
-        DRX_STANDARD_ITU_A,    /**< Cable ITU ANNEX A.               */
-        DRX_STANDARD_ITU_B,    /**< Cable ITU ANNEX B.               */
-        DRX_STANDARD_ITU_C,    /**< Cable ITU ANNEX C.               */
-        DRX_STANDARD_ITU_D,    /**< Cable ITU ANNEX D.               */
-        DRX_STANDARD_FM,       /**< Terrestrial\Cable FM radio       */
-        DRX_STANDARD_DTMB,     /**< Terrestrial DTMB standard (China)*/
+        DRX_STANDARD_ITU_A,    /*< Cable ITU ANNEX A.               */
+        DRX_STANDARD_ITU_B,    /*< Cable ITU ANNEX B.               */
+        DRX_STANDARD_ITU_C,    /*< Cable ITU ANNEX C.               */
+        DRX_STANDARD_ITU_D,    /*< Cable ITU ANNEX D.               */
+        DRX_STANDARD_FM,       /*< Terrestrial\Cable FM radio       */
+        DRX_STANDARD_DTMB,     /*< Terrestrial DTMB standard (China)*/
         DRX_STANDARD_UNKNOWN = DRX_UNKNOWN,
-                                /**< Standard unknown.                */
+                                /*< Standard unknown.                */
         DRX_STANDARD_AUTO = DRX_AUTO
-                                /**< Autodetect standard.             */
+                                /*< Autodetect standard.             */
 };
 
-/**
+/*
 * \enum enum drx_standard
 * \brief Modulation sub-standards.
 */
 enum drx_substandard {
-        DRX_SUBSTANDARD_MAIN = 0, /**< Main subvariant of standard   */
+        DRX_SUBSTANDARD_MAIN = 0, /*< Main subvariant of standard   */
         DRX_SUBSTANDARD_ATV_BG_SCANDINAVIA,
         DRX_SUBSTANDARD_ATV_DK_POLAND,
         DRX_SUBSTANDARD_ATV_DK_CHINA,
         DRX_SUBSTANDARD_UNKNOWN = DRX_UNKNOWN,
-                                        /**< Sub-standard unknown.         */
+                                        /*< Sub-standard unknown.         */
         DRX_SUBSTANDARD_AUTO = DRX_AUTO
-                                        /**< Auto (default) sub-standard   */
+                                        /*< Auto (default) sub-standard   */
 };
 
-/**
+/*
 * \enum enum drx_bandwidth
 * \brief Channel bandwidth or channel spacing.
 */
 enum drx_bandwidth {
-        DRX_BANDWIDTH_8MHZ = 0,  /**< Bandwidth 8 MHz.   */
-        DRX_BANDWIDTH_7MHZ,      /**< Bandwidth 7 MHz.   */
-        DRX_BANDWIDTH_6MHZ,      /**< Bandwidth 6 MHz.   */
+        DRX_BANDWIDTH_8MHZ = 0,  /*< Bandwidth 8 MHz.   */
+        DRX_BANDWIDTH_7MHZ,      /*< Bandwidth 7 MHz.   */
+        DRX_BANDWIDTH_6MHZ,      /*< Bandwidth 6 MHz.   */
         DRX_BANDWIDTH_UNKNOWN = DRX_UNKNOWN,
-                                        /**< Bandwidth unknown. */
+                                        /*< Bandwidth unknown. */
         DRX_BANDWIDTH_AUTO = DRX_AUTO
-                                        /**< Auto Set Bandwidth */
+                                        /*< Auto Set Bandwidth */
 };
 
-/**
+/*
 * \enum enum drx_mirror
 * \brief Indicate if channel spectrum is mirrored or not.
 */
 enum drx_mirror {
-        DRX_MIRROR_NO = 0,   /**< Spectrum is not mirrored.           */
-        DRX_MIRROR_YES,      /**< Spectrum is mirrored.               */
+        DRX_MIRROR_NO = 0,   /*< Spectrum is not mirrored.           */
+        DRX_MIRROR_YES,      /*< Spectrum is mirrored.               */
         DRX_MIRROR_UNKNOWN = DRX_UNKNOWN,
-                                /**< Unknown if spectrum is mirrored.    */
+                                /*< Unknown if spectrum is mirrored.    */
         DRX_MIRROR_AUTO = DRX_AUTO
-                                /**< Autodetect if spectrum is mirrored. */
+                                /*< Autodetect if spectrum is mirrored. */
 };
 
-/**
+/*
 * \enum enum drx_modulation
 * \brief Constellation type of the channel.
 */
 enum drx_modulation {
-        DRX_CONSTELLATION_BPSK = 0,  /**< Modulation is BPSK.       */
-        DRX_CONSTELLATION_QPSK,      /**< Constellation is QPSK.    */
-        DRX_CONSTELLATION_PSK8,      /**< Constellation is PSK8.    */
-        DRX_CONSTELLATION_QAM16,     /**< Constellation is QAM16.   */
-        DRX_CONSTELLATION_QAM32,     /**< Constellation is QAM32.   */
-        DRX_CONSTELLATION_QAM64,     /**< Constellation is QAM64.   */
-        DRX_CONSTELLATION_QAM128,    /**< Constellation is QAM128.  */
-        DRX_CONSTELLATION_QAM256,    /**< Constellation is QAM256.  */
-        DRX_CONSTELLATION_QAM512,    /**< Constellation is QAM512.  */
-        DRX_CONSTELLATION_QAM1024,   /**< Constellation is QAM1024. */
-        DRX_CONSTELLATION_QPSK_NR,   /**< Constellation is QPSK_NR  */
+        DRX_CONSTELLATION_BPSK = 0,  /*< Modulation is BPSK.       */
+        DRX_CONSTELLATION_QPSK,      /*< Constellation is QPSK.    */
+        DRX_CONSTELLATION_PSK8,      /*< Constellation is PSK8.    */
+        DRX_CONSTELLATION_QAM16,     /*< Constellation is QAM16.   */
+        DRX_CONSTELLATION_QAM32,     /*< Constellation is QAM32.   */
+        DRX_CONSTELLATION_QAM64,     /*< Constellation is QAM64.   */
+        DRX_CONSTELLATION_QAM128,    /*< Constellation is QAM128.  */
+        DRX_CONSTELLATION_QAM256,    /*< Constellation is QAM256.  */
+        DRX_CONSTELLATION_QAM512,    /*< Constellation is QAM512.  */
+        DRX_CONSTELLATION_QAM1024,   /*< Constellation is QAM1024. */
+        DRX_CONSTELLATION_QPSK_NR,   /*< Constellation is QPSK_NR  */
         DRX_CONSTELLATION_UNKNOWN = DRX_UNKNOWN,
-                                        /**< Constellation unknown.    */
+                                        /*< Constellation unknown.    */
         DRX_CONSTELLATION_AUTO = DRX_AUTO
-                                        /**< Autodetect constellation. */
+                                        /*< Autodetect constellation. */
 };
 
-/**
+/*
 * \enum enum drx_hierarchy
 * \brief Hierarchy of the channel.
 */
 enum drx_hierarchy {
-        DRX_HIERARCHY_NONE = 0, /**< None hierarchical channel.     */
-        DRX_HIERARCHY_ALPHA1,   /**< Hierarchical channel, alpha=1. */
-        DRX_HIERARCHY_ALPHA2,   /**< Hierarchical channel, alpha=2. */
-        DRX_HIERARCHY_ALPHA4,   /**< Hierarchical channel, alpha=4. */
+        DRX_HIERARCHY_NONE = 0, /*< None hierarchical channel.     */
+        DRX_HIERARCHY_ALPHA1,   /*< Hierarchical channel, alpha=1. */
+        DRX_HIERARCHY_ALPHA2,   /*< Hierarchical channel, alpha=2. */
+        DRX_HIERARCHY_ALPHA4,   /*< Hierarchical channel, alpha=4. */
         DRX_HIERARCHY_UNKNOWN = DRX_UNKNOWN,
-                                /**< Hierarchy unknown.             */
+                                /*< Hierarchy unknown.             */
         DRX_HIERARCHY_AUTO = DRX_AUTO
-                                /**< Autodetect hierarchy.          */
+                                /*< Autodetect hierarchy.          */
 };
 
-/**
+/*
 * \enum enum drx_priority
 * \brief Channel priority in case of hierarchical transmission.
 */
 enum drx_priority {
-        DRX_PRIORITY_LOW = 0,  /**< Low priority channel.  */
-        DRX_PRIORITY_HIGH,     /**< High priority channel. */
+        DRX_PRIORITY_LOW = 0,  /*< Low priority channel.  */
+        DRX_PRIORITY_HIGH,     /*< High priority channel. */
         DRX_PRIORITY_UNKNOWN = DRX_UNKNOWN
-                                /**< Priority unknown.      */
+                                /*< Priority unknown.      */
 };
 
-/**
+/*
 * \enum enum drx_coderate
 * \brief Channel priority in case of hierarchical transmission.
 */
 enum drx_coderate {
-                DRX_CODERATE_1DIV2 = 0, /**< Code rate 1/2nd.      */
-                DRX_CODERATE_2DIV3,     /**< Code rate 2/3nd.      */
-                DRX_CODERATE_3DIV4,     /**< Code rate 3/4nd.      */
-                DRX_CODERATE_5DIV6,     /**< Code rate 5/6nd.      */
-                DRX_CODERATE_7DIV8,     /**< Code rate 7/8nd.      */
+                DRX_CODERATE_1DIV2 = 0, /*< Code rate 1/2nd.      */
+                DRX_CODERATE_2DIV3,     /*< Code rate 2/3nd.      */
+                DRX_CODERATE_3DIV4,     /*< Code rate 3/4nd.      */
+                DRX_CODERATE_5DIV6,     /*< Code rate 5/6nd.      */
+                DRX_CODERATE_7DIV8,     /*< Code rate 7/8nd.      */
                 DRX_CODERATE_UNKNOWN = DRX_UNKNOWN,
-                                        /**< Code rate unknown.    */
+                                        /*< Code rate unknown.    */
                 DRX_CODERATE_AUTO = DRX_AUTO
-                                        /**< Autodetect code rate. */
+                                        /*< Autodetect code rate. */
 };
 
-/**
+/*
 * \enum enum drx_guard
 * \brief Guard interval of a channel.
 */
 enum drx_guard {
-        DRX_GUARD_1DIV32 = 0, /**< Guard interval 1/32nd.     */
-        DRX_GUARD_1DIV16,     /**< Guard interval 1/16th.     */
-        DRX_GUARD_1DIV8,      /**< Guard interval 1/8th.      */
-        DRX_GUARD_1DIV4,      /**< Guard interval 1/4th.      */
+        DRX_GUARD_1DIV32 = 0, /*< Guard interval 1/32nd.     */
+        DRX_GUARD_1DIV16,     /*< Guard interval 1/16th.     */
+        DRX_GUARD_1DIV8,      /*< Guard interval 1/8th.      */
+        DRX_GUARD_1DIV4,      /*< Guard interval 1/4th.      */
         DRX_GUARD_UNKNOWN = DRX_UNKNOWN,
-                                /**< Guard interval unknown.    */
+                                /*< Guard interval unknown.    */
         DRX_GUARD_AUTO = DRX_AUTO
-                                /**< Autodetect guard interval. */
+                                /*< Autodetect guard interval. */
 };
 
-/**
+/*
 * \enum enum drx_fft_mode
 * \brief FFT mode.
 */
 enum drx_fft_mode {
-        DRX_FFTMODE_2K = 0,    /**< 2K FFT mode.         */
-        DRX_FFTMODE_4K,        /**< 4K FFT mode.         */
-        DRX_FFTMODE_8K,        /**< 8K FFT mode.         */
+        DRX_FFTMODE_2K = 0,    /*< 2K FFT mode.         */
+        DRX_FFTMODE_4K,        /*< 4K FFT mode.         */
+        DRX_FFTMODE_8K,        /*< 8K FFT mode.         */
         DRX_FFTMODE_UNKNOWN = DRX_UNKNOWN,
-                                /**< FFT mode unknown.    */
+                                /*< FFT mode unknown.    */
         DRX_FFTMODE_AUTO = DRX_AUTO
-                                /**< Autodetect FFT mode. */
+                                /*< Autodetect FFT mode. */
 };
 
-/**
+/*
 * \enum enum drx_classification
 * \brief Channel classification.
 */
 enum drx_classification {
-        DRX_CLASSIFICATION_GAUSS = 0, /**< Gaussion noise.            */
-        DRX_CLASSIFICATION_HVY_GAUSS, /**< Heavy Gaussion noise.      */
-        DRX_CLASSIFICATION_COCHANNEL, /**< Co-channel.                */
-        DRX_CLASSIFICATION_STATIC,    /**< Static echo.               */
-        DRX_CLASSIFICATION_MOVING,    /**< Moving echo.               */
-        DRX_CLASSIFICATION_ZERODB,    /**< Zero dB echo.              */
+        DRX_CLASSIFICATION_GAUSS = 0, /*< Gaussion noise.            */
+        DRX_CLASSIFICATION_HVY_GAUSS, /*< Heavy Gaussion noise.      */
+        DRX_CLASSIFICATION_COCHANNEL, /*< Co-channel.                */
+        DRX_CLASSIFICATION_STATIC,    /*< Static echo.               */
+        DRX_CLASSIFICATION_MOVING,    /*< Moving echo.               */
+        DRX_CLASSIFICATION_ZERODB,    /*< Zero dB echo.              */
         DRX_CLASSIFICATION_UNKNOWN = DRX_UNKNOWN,
-                                        /**< Unknown classification     */
+                                        /*< Unknown classification     */
         DRX_CLASSIFICATION_AUTO = DRX_AUTO
-                                        /**< Autodetect classification. */
+                                        /*< Autodetect classification. */
 };
 
-/**
+/*
 * /enum enum drx_interleave_mode
 * /brief Interleave modes
 */
@@ -673,80 +673,80 @@ enum drx_interleave_mode {
         DRX_INTERLEAVEMODE_B52_M48,
         DRX_INTERLEAVEMODE_B52_M0,
         DRX_INTERLEAVEMODE_UNKNOWN = DRX_UNKNOWN,
-                                        /**< Unknown interleave mode    */
+                                        /*< Unknown interleave mode    */
         DRX_INTERLEAVEMODE_AUTO = DRX_AUTO
-                                        /**< Autodetect interleave mode */
+                                        /*< Autodetect interleave mode */
 };
 
-/**
+/*
 * \enum enum drx_carrier_mode
 * \brief Channel Carrier Mode.
 */
 enum drx_carrier_mode {
-        DRX_CARRIER_MULTI = 0,          /**< Multi carrier mode       */
-        DRX_CARRIER_SINGLE,             /**< Single carrier mode      */
+        DRX_CARRIER_MULTI = 0,          /*< Multi carrier mode       */
+        DRX_CARRIER_SINGLE,             /*< Single carrier mode      */
         DRX_CARRIER_UNKNOWN = DRX_UNKNOWN,
-                                        /**< Carrier mode unknown.    */
-        DRX_CARRIER_AUTO = DRX_AUTO     /**< Autodetect carrier mode  */
+                                        /*< Carrier mode unknown.    */
+        DRX_CARRIER_AUTO = DRX_AUTO     /*< Autodetect carrier mode  */
 };
 
-/**
+/*
 * \enum enum drx_frame_mode
 * \brief Channel Frame Mode.
 */
 enum drx_frame_mode {
-        DRX_FRAMEMODE_420 = 0,   /**< 420 with variable PN  */
-        DRX_FRAMEMODE_595,       /**< 595                   */
-        DRX_FRAMEMODE_945,       /**< 945 with variable PN  */
+        DRX_FRAMEMODE_420 = 0,   /*< 420 with variable PN  */
+        DRX_FRAMEMODE_595,       /*< 595                   */
+        DRX_FRAMEMODE_945,       /*< 945 with variable PN  */
         DRX_FRAMEMODE_420_FIXED_PN,
-                                        /**< 420 with fixed PN     */
+                                        /*< 420 with fixed PN     */
         DRX_FRAMEMODE_945_FIXED_PN,
-                                        /**< 945 with fixed PN     */
+                                        /*< 945 with fixed PN     */
         DRX_FRAMEMODE_UNKNOWN = DRX_UNKNOWN,
-                                        /**< Frame mode unknown.   */
+                                        /*< Frame mode unknown.   */
         DRX_FRAMEMODE_AUTO = DRX_AUTO
-                                        /**< Autodetect frame mode */
+                                        /*< Autodetect frame mode */
 };
 
-/**
+/*
 * \enum enum drx_tps_frame
 * \brief Frame number in current super-frame.
 */
 enum drx_tps_frame {
-        DRX_TPS_FRAME1 = 0,       /**< TPS frame 1.       */
-        DRX_TPS_FRAME2,           /**< TPS frame 2.       */
-        DRX_TPS_FRAME3,           /**< TPS frame 3.       */
-        DRX_TPS_FRAME4,           /**< TPS frame 4.       */
+        DRX_TPS_FRAME1 = 0,       /*< TPS frame 1.       */
+        DRX_TPS_FRAME2,           /*< TPS frame 2.       */
+        DRX_TPS_FRAME3,           /*< TPS frame 3.       */
+        DRX_TPS_FRAME4,           /*< TPS frame 4.       */
         DRX_TPS_FRAME_UNKNOWN = DRX_UNKNOWN
-                                        /**< TPS frame unknown. */
+                                        /*< TPS frame unknown. */
 };
 
-/**
+/*
 * \enum enum drx_ldpc
 * \brief TPS LDPC .
 */
 enum drx_ldpc {
-        DRX_LDPC_0_4 = 0,         /**< LDPC 0.4           */
-        DRX_LDPC_0_6,             /**< LDPC 0.6           */
-        DRX_LDPC_0_8,             /**< LDPC 0.8           */
+        DRX_LDPC_0_4 = 0,         /*< LDPC 0.4           */
+        DRX_LDPC_0_6,             /*< LDPC 0.6           */
+        DRX_LDPC_0_8,             /*< LDPC 0.8           */
         DRX_LDPC_UNKNOWN = DRX_UNKNOWN,
-                                        /**< LDPC unknown.      */
-        DRX_LDPC_AUTO = DRX_AUTO  /**< Autodetect LDPC    */
+                                        /*< LDPC unknown.      */
+        DRX_LDPC_AUTO = DRX_AUTO  /*< Autodetect LDPC    */
 };
 
-/**
+/*
 * \enum enum drx_pilot_mode
 * \brief Pilot modes in DTMB.
 */
 enum drx_pilot_mode {
-        DRX_PILOT_ON = 0,         /**< Pilot On             */
-        DRX_PILOT_OFF,            /**< Pilot Off            */
+        DRX_PILOT_ON = 0,         /*< Pilot On             */
+        DRX_PILOT_OFF,            /*< Pilot Off            */
         DRX_PILOT_UNKNOWN = DRX_UNKNOWN,
-                                        /**< Pilot unknown.       */
-        DRX_PILOT_AUTO = DRX_AUTO /**< Autodetect Pilot     */
+                                        /*< Pilot unknown.       */
+        DRX_PILOT_AUTO = DRX_AUTO /*< Autodetect Pilot     */
 };
 
-/**
+/*
  * enum drxu_code_action - indicate if firmware has to be uploaded or verified.
  * @UCODE_UPLOAD:       Upload the microcode image to device
  * @UCODE_VERIFY:       Compare microcode image with code on device
@@ -756,7 +756,7 @@ enum drxu_code_action {
         UCODE_VERIFY
 };
 
-/**
+/*
 * \enum enum drx_lock_status * \brief Used to reflect current lock status of demodulator.
 *
 * The generic lock states have device dependent semantics.
@@ -801,7 +801,7 @@ enum drx_lock_status {
         DRX_LOCKED
 };
 
-/**
+/*
 * \enum enum drx_uio* \brief Used to address a User IO (UIO).
 */
 enum drx_uio {
@@ -840,7 +840,7 @@ enum drx_uio {
         DRX_UIO_MAX = DRX_UIO32
 };
 
-/**
+/*
 * \enum enum drxuio_mode * \brief Used to configure the modus oprandi of a UIO.
 *
 * DRX_UIO_MODE_FIRMWARE is an old uio mode.
@@ -850,37 +850,37 @@ enum drx_uio {
 */
 enum drxuio_mode {
         DRX_UIO_MODE_DISABLE = 0x01,
-                            /**< not used, pin is configured as input */
+                            /*< not used, pin is configured as input */
         DRX_UIO_MODE_READWRITE = 0x02,
-                            /**< used for read/write by application   */
+                            /*< used for read/write by application   */
         DRX_UIO_MODE_FIRMWARE = 0x04,
-                            /**< controlled by firmware, function 0   */
+                            /*< controlled by firmware, function 0   */
         DRX_UIO_MODE_FIRMWARE0 = DRX_UIO_MODE_FIRMWARE,
-                                            /**< same as above        */
+                                            /*< same as above        */
         DRX_UIO_MODE_FIRMWARE1 = 0x08,
-                            /**< controlled by firmware, function 1   */
+                            /*< controlled by firmware, function 1   */
         DRX_UIO_MODE_FIRMWARE2 = 0x10,
-                            /**< controlled by firmware, function 2   */
+                            /*< controlled by firmware, function 2   */
         DRX_UIO_MODE_FIRMWARE3 = 0x20,
-                            /**< controlled by firmware, function 3   */
+                            /*< controlled by firmware, function 3   */
         DRX_UIO_MODE_FIRMWARE4 = 0x40,
-                            /**< controlled by firmware, function 4   */
+                            /*< controlled by firmware, function 4   */
         DRX_UIO_MODE_FIRMWARE5 = 0x80
-                            /**< controlled by firmware, function 5   */
+                            /*< controlled by firmware, function 5   */
 };
 
-/**
+/*
 * \enum enum drxoob_downstream_standard * \brief Used to select OOB standard.
 *
 * Based on ANSI 55-1 and 55-2
 */
 enum drxoob_downstream_standard {
         DRX_OOB_MODE_A = 0,
-                       /**< ANSI 55-1   */
+                       /*< ANSI 55-1   */
         DRX_OOB_MODE_B_GRADE_A,
-                       /**< ANSI 55-2 A */
+                       /*< ANSI 55-2 A */
         DRX_OOB_MODE_B_GRADE_B
-                       /**< ANSI 55-2 B */
+                       /*< ANSI 55-2 B */
 };
 
 /*-------------------------------------------------------------------------
@@ -924,7 +924,7 @@ STRUCTS
 /*============================================================================*/
 /*============================================================================*/
 
-/**
+/*
  * struct drxu_code_info        Parameters for microcode upload and verfiy.
  *
  * @mc_file:    microcode file name
@@ -935,7 +935,7 @@ struct drxu_code_info {
         char                    *mc_file;
 };
 
-/**
+/*
 * \struct drx_mc_version_rec_t
 * \brief Microcode version record
 * Version numbers are stored in BCD format, as usual:
@@ -963,7 +963,7 @@ struct drx_mc_version_rec {
 
 /*========================================*/
 
-/**
+/*
 * \struct drx_filter_info_t
 * \brief Parameters for loading filter coefficients
 *
@@ -971,18 +971,18 @@ struct drx_mc_version_rec {
 */
 struct drx_filter_info {
         u8 *data_re;
-              /**< pointer to coefficients for RE */
+              /*< pointer to coefficients for RE */
         u8 *data_im;
-              /**< pointer to coefficients for IM */
+              /*< pointer to coefficients for IM */
         u16 size_re;
-              /**< size of coefficients for RE    */
+              /*< size of coefficients for RE    */
         u16 size_im;
-              /**< size of coefficients for IM    */
+              /*< size of coefficients for IM    */
 };
 
 /*========================================*/
 
-/**
+/*
 * \struct struct drx_channel * \brief The set of parameters describing a single channel.
 *
 * Used by DRX_CTRL_SET_CHANNEL and DRX_CTRL_GET_CHANNEL.
@@ -991,29 +991,29 @@ struct drx_filter_info {
 */
 struct drx_channel {
         s32 frequency;
-                                /**< frequency in kHz                 */
+                                /*< frequency in kHz                 */
         enum drx_bandwidth bandwidth;
-                                /**< bandwidth                        */
-        enum drx_mirror mirror; /**< mirrored or not on RF            */
+                                /*< bandwidth                        */
+        enum drx_mirror mirror; /*< mirrored or not on RF            */
         enum drx_modulation constellation;
-                                /**< constellation                    */
+                                /*< constellation                    */
         enum drx_hierarchy hierarchy;
-                                /**< hierarchy                        */
-        enum drx_priority priority;     /**< priority                         */
-        enum drx_coderate coderate;     /**< coderate                         */
-        enum drx_guard guard;   /**< guard interval                   */
-        enum drx_fft_mode fftmode;      /**< fftmode                          */
+                                /*< hierarchy                        */
+        enum drx_priority priority;     /*< priority                         */
+        enum drx_coderate coderate;     /*< coderate                         */
+        enum drx_guard guard;   /*< guard interval                   */
+        enum drx_fft_mode fftmode;      /*< fftmode                          */
         enum drx_classification classification;
-                                /**< classification                   */
+                                /*< classification                   */
         u32 symbolrate;
-                                /**< symbolrate in symbols/sec        */
+                                /*< symbolrate in symbols/sec        */
         enum drx_interleave_mode interleavemode;
-                                /**< interleaveMode QAM               */
-        enum drx_ldpc ldpc;             /**< ldpc                             */
-        enum drx_carrier_mode carrier;  /**< carrier                          */
+                                /*< interleaveMode QAM               */
+        enum drx_ldpc ldpc;             /*< ldpc                             */
+        enum drx_carrier_mode carrier;  /*< carrier                          */
         enum drx_frame_mode framemode;
-                                /**< frame mode                       */
-        enum drx_pilot_mode pilot;      /**< pilot mode                       */
+                                /*< frame mode                       */
+        enum drx_pilot_mode pilot;      /*< pilot mode                       */
 };
 
 /*========================================*/
@@ -1027,74 +1027,74 @@ enum drx_cfg_sqi_speed {
 
 /*========================================*/
 
-/**
+/*
 * \struct struct drx_complex * A complex number.
 *
 * Used by DRX_CTRL_CONSTEL.
 */
 struct drx_complex {
         s16 im;
-     /**< Imaginary part. */
+     /*< Imaginary part. */
         s16 re;
-     /**< Real part.      */
+     /*< Real part.      */
 };
 
 /*========================================*/
 
-/**
+/*
 * \struct struct drx_frequency_plan * Array element of a frequency plan.
 *
 * Used by DRX_CTRL_SCAN_INIT.
 */
 struct drx_frequency_plan {
         s32 first;
-                     /**< First centre frequency in this band        */
+                     /*< First centre frequency in this band        */
         s32 last;
-                     /**< Last centre frequency in this band         */
+                     /*< Last centre frequency in this band         */
         s32 step;
-                     /**< Stepping frequency in this band            */
+                     /*< Stepping frequency in this band            */
         enum drx_bandwidth bandwidth;
-                     /**< Bandwidth within this frequency band       */
+                     /*< Bandwidth within this frequency band       */
         u16 ch_number;
-                     /**< First channel number in this band, or first
+                     /*< First channel number in this band, or first
                             index in ch_names                         */
         char **ch_names;
-                     /**< Optional list of channel names in this
+                     /*< Optional list of channel names in this
                             band                                     */
 };
 
 /*========================================*/
 
-/**
+/*
 * \struct struct drx_scan_param * Parameters for channel scan.
 *
 * Used by DRX_CTRL_SCAN_INIT.
 */
 struct drx_scan_param {
         struct drx_frequency_plan *frequency_plan;
-                                  /**< Frequency plan (array)*/
-        u16 frequency_plan_size;  /**< Number of bands       */
-        u32 num_tries;            /**< Max channels tried    */
-        s32 skip;         /**< Minimum frequency step to take
+                                  /*< Frequency plan (array)*/
+        u16 frequency_plan_size;  /*< Number of bands       */
+        u32 num_tries;            /*< Max channels tried    */
+        s32 skip;         /*< Minimum frequency step to take
                                         after a channel is found */
-        void *ext_params;         /**< Standard specific params */
+        void *ext_params;         /*< Standard specific params */
 };
 
 /*========================================*/
 
-/**
+/*
 * \brief Scan commands.
 * Used by scanning algorithms.
 */
 enum drx_scan_command {
-                DRX_SCAN_COMMAND_INIT = 0,/**< Initialize scanning */
-                DRX_SCAN_COMMAND_NEXT,    /**< Next scan           */
-                DRX_SCAN_COMMAND_STOP     /**< Stop scanning       */
+                DRX_SCAN_COMMAND_INIT = 0,/*< Initialize scanning */
+                DRX_SCAN_COMMAND_NEXT,    /*< Next scan           */
+                DRX_SCAN_COMMAND_STOP     /*< Stop scanning       */
 };
 
 /*========================================*/
 
-/**
+/*
 * \brief Inner scan function prototype.
 */
 typedef int(*drx_scan_func_t) (void *scan_context,
@@ -1104,77 +1104,77 @@ typedef int(*drx_scan_func_t) (void *scan_context,
 
 /*========================================*/
 
-/**
+/*
 * \struct struct drxtps_info * TPS information, DVB-T specific.
 *
 * Used by DRX_CTRL_TPS_INFO.
 */
         struct drxtps_info {
-                enum drx_fft_mode fftmode;      /**< Fft mode       */
-                enum drx_guard guard;   /**< Guard interval */
+                enum drx_fft_mode fftmode;      /*< Fft mode       */
+                enum drx_guard guard;   /*< Guard interval */
                 enum drx_modulation constellation;
-                                        /**< Constellation  */
+                                        /*< Constellation  */
                 enum drx_hierarchy hierarchy;
-                                        /**< Hierarchy      */
+                                        /*< Hierarchy      */
                 enum drx_coderate high_coderate;
-                                        /**< High code rate */
+                                        /*< High code rate */
                 enum drx_coderate low_coderate;
-                                        /**< Low cod rate   */
-                enum drx_tps_frame frame;       /**< Tps frame      */
-                u8 length;              /**< Length         */
-                u16 cell_id;            /**< Cell id        */
+                                        /*< Low cod rate   */
+                enum drx_tps_frame frame;       /*< Tps frame      */
+                u8 length;              /*< Length         */
+                u16 cell_id;            /*< Cell id        */
         };
 
 /*========================================*/
 
-/**
+/*
 * \brief Power mode of device.
 *
 * Used by DRX_CTRL_SET_POWER_MODE.
 */
         enum drx_power_mode {
                 DRX_POWER_UP = 0,
-                         /**< Generic         , Power Up Mode   */
+                         /*< Generic         , Power Up Mode   */
                 DRX_POWER_MODE_1,
-                         /**< Device specific , Power Up Mode   */
+                         /*< Device specific , Power Up Mode   */
                 DRX_POWER_MODE_2,
-                         /**< Device specific , Power Up Mode   */
+                         /*< Device specific , Power Up Mode   */
                 DRX_POWER_MODE_3,
-                         /**< Device specific , Power Up Mode   */
+                         /*< Device specific , Power Up Mode   */
                 DRX_POWER_MODE_4,
-                         /**< Device specific , Power Up Mode   */
+                         /*< Device specific , Power Up Mode   */
                 DRX_POWER_MODE_5,
-                         /**< Device specific , Power Up Mode   */
+                         /*< Device specific , Power Up Mode   */
                 DRX_POWER_MODE_6,
-                         /**< Device specific , Power Up Mode   */
+                         /*< Device specific , Power Up Mode   */
                 DRX_POWER_MODE_7,
-                         /**< Device specific , Power Up Mode   */
+                         /*< Device specific , Power Up Mode   */
                 DRX_POWER_MODE_8,
-                         /**< Device specific , Power Up Mode   */
+                         /*< Device specific , Power Up Mode   */
 
                 DRX_POWER_MODE_9,
-                         /**< Device specific , Power Down Mode */
+                         /*< Device specific , Power Down Mode */
                 DRX_POWER_MODE_10,
-                         /**< Device specific , Power Down Mode */
+                         /*< Device specific , Power Down Mode */
                 DRX_POWER_MODE_11,
-                         /**< Device specific , Power Down Mode */
+                         /*< Device specific , Power Down Mode */
                 DRX_POWER_MODE_12,
-                         /**< Device specific , Power Down Mode */
+                         /*< Device specific , Power Down Mode */
                 DRX_POWER_MODE_13,
-                         /**< Device specific , Power Down Mode */
+                         /*< Device specific , Power Down Mode */
                 DRX_POWER_MODE_14,
-                         /**< Device specific , Power Down Mode */
+                         /*< Device specific , Power Down Mode */
                 DRX_POWER_MODE_15,
-                         /**< Device specific , Power Down Mode */
+                         /*< Device specific , Power Down Mode */
                 DRX_POWER_MODE_16,
-                         /**< Device specific , Power Down Mode */
+                         /*< Device specific , Power Down Mode */
                 DRX_POWER_DOWN = 255
-                         /**< Generic         , Power Down Mode */
+                         /*< Generic         , Power Down Mode */
         };
 
 /*========================================*/
 
-/**
+/*
 * \enum enum drx_module * \brief Software module identification.
 *
 * Used by DRX_CTRL_VERSION.
@@ -1191,93 +1191,93 @@ typedef int(*drx_scan_func_t) (void *scan_context,
                 DRX_MODULE_UNKNOWN
         };
 
-/**
+/*
 * \enum struct drx_version * \brief Version information of one software module.
 *
 * Used by DRX_CTRL_VERSION.
 */
         struct drx_version {
                 enum drx_module module_type;
-                               /**< Type identifier of the module */
+                               /*< Type identifier of the module */
                 char *module_name;
-                               /**< Name or description of module */
-                u16 v_major;  /**< Major version number          */
-                u16 v_minor;  /**< Minor version number          */
-                u16 v_patch;  /**< Patch version number          */
-                char *v_string; /**< Version as text string        */
+                               /*< Name or description of module */
+                u16 v_major;  /*< Major version number          */
+                u16 v_minor;  /*< Minor version number          */
+                u16 v_patch;  /*< Patch version number          */
+                char *v_string; /*< Version as text string        */
         };
 
-/**
+/*
 * \enum struct drx_version_list * \brief List element of NULL terminated, linked list for version information.
 *
 * Used by DRX_CTRL_VERSION.
 */
 struct drx_version_list {
-        struct drx_version *version;/**< Version information */
+        struct drx_version *version;/*< Version information */
         struct drx_version_list *next;
-                              /**< Next list element   */
+                              /*< Next list element   */
 };
 
 /*========================================*/
 
-/**
+/*
 * \brief Parameters needed to confiugure a UIO.
 *
 * Used by DRX_CTRL_UIO_CFG.
 */
         struct drxuio_cfg {
                 enum drx_uio uio;
-                       /**< UIO identifier       */
+                       /*< UIO identifier       */
                 enum drxuio_mode mode;
-                       /**< UIO operational mode */
+                       /*< UIO operational mode */
         };
 
 /*========================================*/
 
-/**
+/*
 * \brief Parameters needed to read from or write to a UIO.
 *
 * Used by DRX_CTRL_UIO_READ and DRX_CTRL_UIO_WRITE.
 */
         struct drxuio_data {
                 enum drx_uio uio;
-                   /**< UIO identifier              */
+                   /*< UIO identifier              */
                 bool value;
-                   /**< UIO value (true=1, false=0) */
+                   /*< UIO value (true=1, false=0) */
         };
 
 /*========================================*/
 
-/**
+/*
 * \brief Parameters needed to configure OOB.
 *
 * Used by DRX_CTRL_SET_OOB.
 */
         struct drxoob {
-                s32 frequency;     /**< Frequency in kHz      */
+                s32 frequency;     /*< Frequency in kHz      */
                 enum drxoob_downstream_standard standard;
-                                                   /**< OOB standard          */
-                bool spectrum_inverted;    /**< If true, then spectrum
+                                                   /*< OOB standard          */
+                bool spectrum_inverted;    /*< If true, then spectrum
                                                          is inverted          */
         };
 
 /*========================================*/
 
-/**
+/*
 * \brief Metrics from OOB.
 *
 * Used by DRX_CTRL_GET_OOB.
 */
         struct drxoob_status {
-                s32 frequency; /**< Frequency in Khz         */
-                enum drx_lock_status lock;        /**< Lock status              */
-                u32 mer;                  /**< MER                      */
-                s32 symbol_rate_offset;   /**< Symbolrate offset in ppm */
+                s32 frequency; /*< Frequency in Khz         */
+                enum drx_lock_status lock;        /*< Lock status              */
+                u32 mer;                  /*< MER                      */
+                s32 symbol_rate_offset;   /*< Symbolrate offset in ppm */
         };
 
 /*========================================*/
 
-/**
+/*
 * \brief Device dependent configuration data.
 *
 * Used by DRX_CTRL_SET_CFG and DRX_CTRL_GET_CFG.
@@ -1285,14 +1285,14 @@ struct drx_version_list {
 */
         struct drx_cfg {
                 u32 cfg_type;
-                          /**< Function identifier */
+                          /*< Function identifier */
                 void *cfg_data;
-                          /**< Function data */
+                          /*< Function data */
         };
 
 /*========================================*/
 
-/**
+/*
 * /struct DRXMpegStartWidth_t
 * MStart width [nr MCLK cycles] for serial MPEG output.
 */
@@ -1303,7 +1303,7 @@ struct drx_version_list {
         };
 
 /* CTRL CFG MPEG output */
-/**
+/*
 * \struct struct drx_cfg_mpeg_output * \brief Configuration parameters for MPEG output control.
 *
 * Used by DRX_CFG_MPEG_OUTPUT, in combination with DRX_CTRL_SET_CFG and
@@ -1311,29 +1311,29 @@ struct drx_version_list {
 */
 
         struct drx_cfg_mpeg_output {
-                bool enable_mpeg_output;/**< If true, enable MPEG output      */
-                bool insert_rs_byte;    /**< If true, insert RS byte          */
-                bool enable_parallel;   /**< If true, parallel out otherwise
+                bool enable_mpeg_output;/*< If true, enable MPEG output      */
+                bool insert_rs_byte;    /*< If true, insert RS byte          */
+                bool enable_parallel;   /*< If true, parallel out otherwise
                                                                      serial   */
-                bool invert_data;       /**< If true, invert DATA signals     */
-                bool invert_err;        /**< If true, invert ERR signal       */
-                bool invert_str;        /**< If true, invert STR signals      */
-                bool invert_val;        /**< If true, invert VAL signals      */
-                bool invert_clk;        /**< If true, invert CLK signals      */
-                bool static_clk;        /**< If true, static MPEG clockrate
+                bool invert_data;       /*< If true, invert DATA signals     */
+                bool invert_err;        /*< If true, invert ERR signal       */
+                bool invert_str;        /*< If true, invert STR signals      */
+                bool invert_val;        /*< If true, invert VAL signals      */
+                bool invert_clk;        /*< If true, invert CLK signals      */
+                bool static_clk;        /*< If true, static MPEG clockrate
                                              will be used, otherwise clockrate
                                              will adapt to the bitrate of the
                                              TS                               */
-                u32 bitrate;            /**< Maximum bitrate in b/s in case
+                u32 bitrate;            /*< Maximum bitrate in b/s in case
                                              static clockrate is selected     */
                 enum drxmpeg_str_width width_str;
-                                        /**< MPEG start width                 */
+                                        /*< MPEG start width                 */
         };
 
 
 /*========================================*/
 
-/**
+/*
 * \struct struct drxi2c_data * \brief Data for I2C via 2nd or 3rd or etc I2C port.
 *
 * Used by DRX_CTRL_I2C_READWRITE.
@@ -1341,187 +1341,187 @@ struct drx_version_list {
 *
 */
         struct drxi2c_data {
-                u16 port_nr;    /**< I2C port number               */
+                u16 port_nr;    /*< I2C port number               */
                 struct i2c_device_addr *w_dev_addr;
-                                /**< Write device address          */
-                u16 w_count;    /**< Size of write data in bytes   */
-                u8 *wData;      /**< Pointer to write data         */
+                                /*< Write device address          */
+                u16 w_count;    /*< Size of write data in bytes   */
+                u8 *wData;      /*< Pointer to write data         */
                 struct i2c_device_addr *r_dev_addr;
-                                /**< Read device address           */
-                u16 r_count;    /**< Size of data to read in bytes */
-                u8 *r_data;     /**< Pointer to read buffer        */
+                                /*< Read device address           */
+                u16 r_count;    /*< Size of data to read in bytes */
+                u8 *r_data;     /*< Pointer to read buffer        */
         };
 
 /*========================================*/
 
-/**
+/*
 * \enum enum drx_aud_standard * \brief Audio standard identifier.
 *
 * Used by DRX_CTRL_SET_AUD.
 */
         enum drx_aud_standard {
-                DRX_AUD_STANDARD_BTSC,     /**< set BTSC standard (USA)       */
-                DRX_AUD_STANDARD_A2,       /**< set A2-Korea FM Stereo        */
-                DRX_AUD_STANDARD_EIAJ,     /**< set to Japanese FM Stereo     */
-                DRX_AUD_STANDARD_FM_STEREO,/**< set to FM-Stereo Radio        */
-                DRX_AUD_STANDARD_M_MONO,   /**< for 4.5 MHz mono detected     */
-                DRX_AUD_STANDARD_D_K_MONO, /**< for 6.5 MHz mono detected     */
-                DRX_AUD_STANDARD_BG_FM,    /**< set BG_FM standard            */
-                DRX_AUD_STANDARD_D_K1,     /**< set D_K1 standard             */
-                DRX_AUD_STANDARD_D_K2,     /**< set D_K2 standard             */
-                DRX_AUD_STANDARD_D_K3,     /**< set D_K3 standard             */
+                DRX_AUD_STANDARD_BTSC,     /*< set BTSC standard (USA)       */
+                DRX_AUD_STANDARD_A2,       /*< set A2-Korea FM Stereo        */
+                DRX_AUD_STANDARD_EIAJ,     /*< set to Japanese FM Stereo     */
+                DRX_AUD_STANDARD_FM_STEREO,/*< set to FM-Stereo Radio        */
+                DRX_AUD_STANDARD_M_MONO,   /*< for 4.5 MHz mono detected     */
+                DRX_AUD_STANDARD_D_K_MONO, /*< for 6.5 MHz mono detected     */
+                DRX_AUD_STANDARD_BG_FM,    /*< set BG_FM standard            */
+                DRX_AUD_STANDARD_D_K1,     /*< set D_K1 standard             */
+                DRX_AUD_STANDARD_D_K2,     /*< set D_K2 standard             */
+                DRX_AUD_STANDARD_D_K3,     /*< set D_K3 standard             */
                 DRX_AUD_STANDARD_BG_NICAM_FM,
-                                           /**< set BG_NICAM_FM standard      */
+                                           /*< set BG_NICAM_FM standard      */
                 DRX_AUD_STANDARD_L_NICAM_AM,
-                                           /**< set L_NICAM_AM standard       */
+                                           /*< set L_NICAM_AM standard       */
                 DRX_AUD_STANDARD_I_NICAM_FM,
-                                           /**< set I_NICAM_FM standard       */
+                                           /*< set I_NICAM_FM standard       */
                 DRX_AUD_STANDARD_D_K_NICAM_FM,
-                                           /**< set D_K_NICAM_FM standard     */
-                DRX_AUD_STANDARD_NOT_READY,/**< used to detect audio standard */
+                                           /*< set D_K_NICAM_FM standard     */
+                DRX_AUD_STANDARD_NOT_READY,/*< used to detect audio standard */
                 DRX_AUD_STANDARD_AUTO = DRX_AUTO,
-                                           /**< Automatic Standard Detection  */
+                                           /*< Automatic Standard Detection  */
                 DRX_AUD_STANDARD_UNKNOWN = DRX_UNKNOWN
-                                           /**< used as auto and for readback */
+                                           /*< used as auto and for readback */
         };
 
 /* CTRL_AUD_GET_STATUS    - struct drx_aud_status */
-/**
+/*
 * \enum enum drx_aud_nicam_status * \brief Status of NICAM carrier.
 */
         enum drx_aud_nicam_status {
                 DRX_AUD_NICAM_DETECTED = 0,
-                                          /**< NICAM carrier detected         */
+                                          /*< NICAM carrier detected         */
                 DRX_AUD_NICAM_NOT_DETECTED,
-                                          /**< NICAM carrier not detected     */
-                DRX_AUD_NICAM_BAD         /**< NICAM carrier bad quality      */
+                                          /*< NICAM carrier not detected     */
+                DRX_AUD_NICAM_BAD         /*< NICAM carrier bad quality      */
         };
 
-/**
+/*
 * \struct struct drx_aud_status * \brief Audio status characteristics.
 */
         struct drx_aud_status {
-                bool stereo;              /**< stereo detection               */
-                bool carrier_a;   /**< carrier A detected             */
-                bool carrier_b;   /**< carrier B detected             */
-                bool sap;                 /**< sap / bilingual detection      */
-                bool rds;                 /**< RDS data array present         */
+                bool stereo;              /*< stereo detection               */
+                bool carrier_a;   /*< carrier A detected             */
+                bool carrier_b;   /*< carrier B detected             */
+                bool sap;                 /*< sap / bilingual detection      */
+                bool rds;                 /*< RDS data array present         */
                 enum drx_aud_nicam_status nicam_status;
-                                          /**< status of NICAM carrier        */
-                s8 fm_ident;              /**< FM Identification value        */
+                                          /*< status of NICAM carrier        */
+                s8 fm_ident;              /*< FM Identification value        */
         };
 
 /* CTRL_AUD_READ_RDS       - DRXRDSdata_t */
 
-/**
+/*
 * \struct DRXRDSdata_t
 * \brief Raw RDS data array.
 */
         struct drx_cfg_aud_rds {
-                bool valid;               /**< RDS data validation            */
-                u16 data[18];             /**< data from one RDS data array   */
+                bool valid;               /*< RDS data validation            */
+                u16 data[18];             /*< data from one RDS data array   */
         };
 
 /* DRX_CFG_AUD_VOLUME      - struct drx_cfg_aud_volume - set/get */
-/**
+/*
 * \enum DRXAudAVCDecayTime_t
 * \brief Automatic volume control configuration.
 */
         enum drx_aud_avc_mode {
-                DRX_AUD_AVC_OFF,          /**< Automatic volume control off   */
-                DRX_AUD_AVC_DECAYTIME_8S, /**< level volume in  8 seconds     */
-                DRX_AUD_AVC_DECAYTIME_4S, /**< level volume in  4 seconds     */
-                DRX_AUD_AVC_DECAYTIME_2S, /**< level volume in  2 seconds     */
-                DRX_AUD_AVC_DECAYTIME_20MS/**< level volume in 20 millisec    */
+                DRX_AUD_AVC_OFF,          /*< Automatic volume control off   */
+                DRX_AUD_AVC_DECAYTIME_8S, /*< level volume in  8 seconds     */
+                DRX_AUD_AVC_DECAYTIME_4S, /*< level volume in  4 seconds     */
+                DRX_AUD_AVC_DECAYTIME_2S, /*< level volume in  2 seconds     */
+                DRX_AUD_AVC_DECAYTIME_20MS/*< level volume in 20 millisec    */
         };
 
-/**
+/*
 * /enum DRXAudMaxAVCGain_t
 * /brief Automatic volume control max gain in audio baseband.
 */
         enum drx_aud_avc_max_gain {
-                DRX_AUD_AVC_MAX_GAIN_0DB, /**< maximum AVC gain  0 dB         */
-                DRX_AUD_AVC_MAX_GAIN_6DB, /**< maximum AVC gain  6 dB         */
-                DRX_AUD_AVC_MAX_GAIN_12DB /**< maximum AVC gain 12 dB         */
+                DRX_AUD_AVC_MAX_GAIN_0DB, /*< maximum AVC gain  0 dB         */
+                DRX_AUD_AVC_MAX_GAIN_6DB, /*< maximum AVC gain  6 dB         */
+                DRX_AUD_AVC_MAX_GAIN_12DB /*< maximum AVC gain 12 dB         */
         };
 
-/**
+/*
 * /enum DRXAudMaxAVCAtten_t
 * /brief Automatic volume control max attenuation in audio baseband.
 */
         enum drx_aud_avc_max_atten {
                 DRX_AUD_AVC_MAX_ATTEN_12DB,
-                                          /**< maximum AVC attenuation 12 dB  */
+                                          /*< maximum AVC attenuation 12 dB  */
                 DRX_AUD_AVC_MAX_ATTEN_18DB,
-                                          /**< maximum AVC attenuation 18 dB  */
-                DRX_AUD_AVC_MAX_ATTEN_24DB/**< maximum AVC attenuation 24 dB  */
+                                          /*< maximum AVC attenuation 18 dB  */
+                DRX_AUD_AVC_MAX_ATTEN_24DB/*< maximum AVC attenuation 24 dB  */
         };
-/**
+/*
 * \struct struct drx_cfg_aud_volume * \brief Audio volume configuration.
 */
         struct drx_cfg_aud_volume {
-                bool mute;                /**< mute overrides volume setting  */
-                s16 volume;               /**< volume, range -114 to 12 dB    */
-                enum drx_aud_avc_mode avc_mode;  /**< AVC auto volume control mode   */
-                u16 avc_ref_level;        /**< AVC reference level            */
+                bool mute;                /*< mute overrides volume setting  */
+                s16 volume;               /*< volume, range -114 to 12 dB    */
+                enum drx_aud_avc_mode avc_mode;  /*< AVC auto volume control mode   */
+                u16 avc_ref_level;        /*< AVC reference level            */
                 enum drx_aud_avc_max_gain avc_max_gain;
-                                          /**< AVC max gain selection         */
+                                          /*< AVC max gain selection         */
                 enum drx_aud_avc_max_atten avc_max_atten;
-                                          /**< AVC max attenuation selection  */
-                s16 strength_left;        /**< quasi-peak, left speaker       */
-                s16 strength_right;       /**< quasi-peak, right speaker      */
+                                          /*< AVC max attenuation selection  */
+                s16 strength_left;        /*< quasi-peak, left speaker       */
+                s16 strength_right;       /*< quasi-peak, right speaker      */
         };
 
 /* DRX_CFG_I2S_OUTPUT      - struct drx_cfg_i2s_output - set/get */
-/**
+/*
 * \enum enum drxi2s_mode * \brief I2S output mode.
 */
         enum drxi2s_mode {
-                DRX_I2S_MODE_MASTER,      /**< I2S is in master mode          */
-                DRX_I2S_MODE_SLAVE        /**< I2S is in slave mode           */
+                DRX_I2S_MODE_MASTER,      /*< I2S is in master mode          */
+                DRX_I2S_MODE_SLAVE        /*< I2S is in slave mode           */
         };
 
-/**
+/*
 * \enum enum drxi2s_word_length * \brief Width of I2S data.
 */
         enum drxi2s_word_length {
-                DRX_I2S_WORDLENGTH_32 = 0,/**< I2S data is 32 bit wide        */
-                DRX_I2S_WORDLENGTH_16 = 1 /**< I2S data is 16 bit wide        */
+                DRX_I2S_WORDLENGTH_32 = 0,/*< I2S data is 32 bit wide        */
+                DRX_I2S_WORDLENGTH_16 = 1 /*< I2S data is 16 bit wide        */
         };
 
-/**
+/*
 * \enum enum drxi2s_format * \brief Data wordstrobe alignment for I2S.
 */
         enum drxi2s_format {
                 DRX_I2S_FORMAT_WS_WITH_DATA,
-                                    /**< I2S data and wordstrobe are aligned  */
+                                    /*< I2S data and wordstrobe are aligned  */
                 DRX_I2S_FORMAT_WS_ADVANCED
-                                    /**< I2S data one cycle after wordstrobe  */
+                                    /*< I2S data one cycle after wordstrobe  */
         };
 
-/**
+/*
 * \enum enum drxi2s_polarity * \brief Polarity of I2S data.
 */
         enum drxi2s_polarity {
-                DRX_I2S_POLARITY_RIGHT,/**< wordstrobe - right high, left low */
-                DRX_I2S_POLARITY_LEFT  /**< wordstrobe - right low, left high */
+                DRX_I2S_POLARITY_RIGHT,/*< wordstrobe - right high, left low */
+                DRX_I2S_POLARITY_LEFT  /*< wordstrobe - right low, left high */
         };
 
-/**
+/*
 * \struct struct drx_cfg_i2s_output * \brief I2S output configuration.
 */
         struct drx_cfg_i2s_output {
-                bool output_enable;       /**< I2S output enable              */
-                u32 frequency;    /**< range from 8000-48000 Hz       */
-                enum drxi2s_mode mode;    /**< I2S mode, master or slave      */
+                bool output_enable;       /*< I2S output enable              */
+                u32 frequency;    /*< range from 8000-48000 Hz       */
+                enum drxi2s_mode mode;    /*< I2S mode, master or slave      */
                 enum drxi2s_word_length word_length;
-                                          /**< I2S wordlength, 16 or 32 bits  */
-                enum drxi2s_polarity polarity;/**< I2S wordstrobe polarity        */
-                enum drxi2s_format format;        /**< I2S wordstrobe delay to data   */
+                                          /*< I2S wordlength, 16 or 32 bits  */
+                enum drxi2s_polarity polarity;/*< I2S wordstrobe polarity        */
+                enum drxi2s_format format;        /*< I2S wordstrobe delay to data   */
         };
 
 /* ------------------------------expert interface-----------------------------*/
-/**
+/*
 * /enum enum drx_aud_fm_deemphasis * setting for FM-Deemphasis in audio demodulator.
 *
 */
@@ -1531,7 +1531,7 @@ struct drx_version_list {
                 DRX_AUD_FM_DEEMPH_OFF
         };
 
-/**
+/*
 * /enum DRXAudDeviation_t
 * setting for deviation mode in audio demodulator.
 *
@@ -1541,7 +1541,7 @@ struct drx_version_list {
                 DRX_AUD_DEVIATION_HIGH
         };
 
-/**
+/*
 * /enum enum drx_no_carrier_option * setting for carrier, mute/noise.
 *
 */
@@ -1550,7 +1550,7 @@ struct drx_version_list {
                 DRX_NO_CARRIER_NOISE
         };
 
-/**
+/*
 * \enum DRXAudAutoSound_t
 * \brief Automatic Sound
 */
@@ -1560,7 +1560,7 @@ struct drx_version_list {
                 DRX_AUD_AUTO_SOUND_SELECT_ON_CHANGE_OFF
         };
 
-/**
+/*
 * \enum DRXAudASSThres_t
 * \brief Automatic Sound Select Thresholds
 */
@@ -1570,7 +1570,7 @@ struct drx_version_list {
                 u16 nicam;      /* Nicam Threshold for ASS configuration */
         };
 
-/**
+/*
 * \struct struct drx_aud_carrier * \brief Carrier detection related parameters
 */
         struct drx_aud_carrier {
@@ -1580,7 +1580,7 @@ struct drx_version_list {
                 s32 dco;        /* frequency adjustment (A) */
         };
 
-/**
+/*
 * \struct struct drx_cfg_aud_carriers * \brief combining carrier A & B to one struct
 */
         struct drx_cfg_aud_carriers {
@@ -1588,7 +1588,7 @@ struct drx_version_list {
                 struct drx_aud_carrier b;
         };
 
-/**
+/*
 * /enum enum drx_aud_i2s_src * Selection of audio source
 */
         enum drx_aud_i2s_src {
@@ -1597,19 +1597,19 @@ struct drx_version_list {
                 DRX_AUD_SRC_STEREO_OR_A,
                 DRX_AUD_SRC_STEREO_OR_B};
 
-/**
+/*
 * \enum enum drx_aud_i2s_matrix * \brief Used for selecting I2S output.
 */
         enum drx_aud_i2s_matrix {
                 DRX_AUD_I2S_MATRIX_A_MONO,
-                                        /**< A sound only, stereo or mono     */
+                                        /*< A sound only, stereo or mono     */
                 DRX_AUD_I2S_MATRIX_B_MONO,
-                                        /**< B sound only, stereo or mono     */
+                                        /*< B sound only, stereo or mono     */
                 DRX_AUD_I2S_MATRIX_STEREO,
-                                        /**< A+B sound, transparant           */
-                DRX_AUD_I2S_MATRIX_MONO /**< A+B mixed to mono sum, (L+R)/2   */};
+                                        /*< A+B sound, transparant           */
+                DRX_AUD_I2S_MATRIX_MONO /*< A+B mixed to mono sum, (L+R)/2   */};
 
-/**
+/*
 * /enum enum drx_aud_fm_matrix * setting for FM-Matrix in audio demodulator.
 *
 */
@@ -1620,7 +1620,7 @@ struct drx_version_list {
                 DRX_AUD_FM_MATRIX_SOUND_A,
                 DRX_AUD_FM_MATRIX_SOUND_B};
 
-/**
+/*
 * \struct DRXAudMatrices_t
 * \brief Mixer settings
 */
@@ -1630,22 +1630,22 @@ struct drx_cfg_aud_mixer {
         enum drx_aud_fm_matrix matrix_fm;
 };
 
-/**
+/*
 * \enum DRXI2SVidSync_t
 * \brief Audio/video synchronization, interacts with I2S mode.
 * AUTO_1 and AUTO_2 are for automatic video standard detection with preference
 * for NTSC or Monochrome, because the frequencies are too close (59.94 & 60 Hz)
 */
         enum drx_cfg_aud_av_sync {
-                DRX_AUD_AVSYNC_OFF,/**< audio/video synchronization is off   */
+                DRX_AUD_AVSYNC_OFF,/*< audio/video synchronization is off   */
                 DRX_AUD_AVSYNC_NTSC,
-                                   /**< it is an NTSC system                 */
+                                   /*< it is an NTSC system                 */
                 DRX_AUD_AVSYNC_MONOCHROME,
-                                   /**< it is a MONOCHROME system            */
+                                   /*< it is a MONOCHROME system            */
                 DRX_AUD_AVSYNC_PAL_SECAM
-                                   /**< it is a PAL/SECAM system             */};
+                                   /*< it is a PAL/SECAM system             */};
 
-/**
+/*
 * \struct struct drx_cfg_aud_prescale * \brief Prescalers
 */
 struct drx_cfg_aud_prescale {
@@ -1653,7 +1653,7 @@ struct drx_cfg_aud_prescale {
         s16 nicam_gain;
 };
 
-/**
+/*
 * \struct struct drx_aud_beep * \brief Beep
 */
 struct drx_aud_beep {
@@ -1662,14 +1662,14 @@ struct drx_aud_beep {
         bool mute;
 };
 
-/**
+/*
 * \enum enum drx_aud_btsc_detect * \brief BTSC detetcion mode
 */
         enum drx_aud_btsc_detect {
                 DRX_BTSC_STEREO,
                 DRX_BTSC_MONO_AND_SAP};
 
-/**
+/*
 * \struct struct drx_aud_data * \brief Audio data structure
 */
 struct drx_aud_data {
@@ -1692,7 +1692,7 @@ struct drx_aud_data {
         bool rds_data_present;
 };
 
-/**
+/*
 * \enum enum drx_qam_lock_range * \brief QAM lock range mode
 */
         enum drx_qam_lock_range {
@@ -1782,7 +1782,7 @@ struct drx_aud_data {
                                                              u32 wdata, /* data to write               */
                                                              u32 *rdata);       /* data to read                */
 
-/**
+/*
 * \struct struct drx_access_func * \brief Interface to an access protocol.
 */
 struct drx_access_func {
@@ -1811,85 +1811,85 @@ struct drx_reg_dump {
 /*============================================================================*/
 /*============================================================================*/
 
-/**
+/*
 * \struct struct drx_common_attr * \brief Set of common attributes, shared by all DRX devices.
 */
         struct drx_common_attr {
                 /* Microcode (firmware) attributes */
-                char *microcode_file;   /**<  microcode filename           */
+                char *microcode_file;   /*<  microcode filename           */
                 bool verify_microcode;
-                                   /**< Use microcode verify or not.          */
+                                   /*< Use microcode verify or not.          */
                 struct drx_mc_version_rec mcversion;
-                                   /**< Version record of microcode from file */
+                                   /*< Version record of microcode from file */
 
                 /* Clocks and tuner attributes */
                 s32 intermediate_freq;
-                                     /**< IF,if tuner instance not used. (kHz)*/
+                                     /*< IF,if tuner instance not used. (kHz)*/
                 s32 sys_clock_freq;
-                                     /**< Systemclock frequency.  (kHz)       */
+                                     /*< Systemclock frequency.  (kHz)       */
                 s32 osc_clock_freq;
-                                     /**< Oscillator clock frequency.  (kHz)  */
+                                     /*< Oscillator clock frequency.  (kHz)  */
                 s16 osc_clock_deviation;
-                                     /**< Oscillator clock deviation.  (ppm)  */
+                                     /*< Oscillator clock deviation.  (ppm)  */
                 bool mirror_freq_spect;
-                                     /**< Mirror IF frequency spectrum or not.*/
+                                     /*< Mirror IF frequency spectrum or not.*/
 
                 /* Initial MPEG output attributes */
                 struct drx_cfg_mpeg_output mpeg_cfg;
-                                     /**< MPEG configuration                  */
+                                     /*< MPEG configuration                  */
 
-                bool is_opened;     /**< if true instance is already opened. */
+                bool is_opened;     /*< if true instance is already opened. */
 
                 /* Channel scan */
                 struct drx_scan_param *scan_param;
-                                      /**< scan parameters                    */
+                                      /*< scan parameters                    */
                 u16 scan_freq_plan_index;
-                                      /**< next index in freq plan            */
+                                      /*< next index in freq plan            */
                 s32 scan_next_frequency;
-                                      /**< next freq to scan                  */
-                bool scan_ready;     /**< scan ready flag                    */
-                u32 scan_max_channels;/**< number of channels in freqplan     */
+                                      /*< next freq to scan                  */
+                bool scan_ready;     /*< scan ready flag                    */
+                u32 scan_max_channels;/*< number of channels in freqplan     */
                 u32 scan_channels_scanned;
-                                        /**< number of channels scanned       */
+                                        /*< number of channels scanned       */
                 /* Channel scan - inner loop: demod related */
                 drx_scan_func_t scan_function;
-                                      /**< function to check channel          */
+                                      /*< function to check channel          */
                 /* Channel scan - inner loop: SYSObj related */
-                void *scan_context;    /**< Context Pointer of SYSObj          */
+                void *scan_context;    /*< Context Pointer of SYSObj          */
                 /* Channel scan - parameters for default DTV scan function in core driver  */
                 u16 scan_demod_lock_timeout;
-                                         /**< millisecs to wait for lock      */
+                                         /*< millisecs to wait for lock      */
                 enum drx_lock_status scan_desired_lock;
-                                      /**< lock requirement for channel found */
+                                      /*< lock requirement for channel found */
                 /* scan_active can be used by SetChannel to decide how to program the tuner,
                    fast or slow (but stable). Usually fast during scan. */
-                bool scan_active;    /**< true when scan routines are active */
+                bool scan_active;    /*< true when scan routines are active */
 
                 /* Power management */
                 enum drx_power_mode current_power_mode;
-                                      /**< current power management mode      */
+                                      /*< current power management mode      */
 
                 /* Tuner */
-                u8 tuner_port_nr;     /**< nr of I2C port to wich tuner is    */
+                u8 tuner_port_nr;     /*< nr of I2C port to wich tuner is    */
                 s32 tuner_min_freq_rf;
-                                      /**< minimum RF input frequency, in kHz */
+                                      /*< minimum RF input frequency, in kHz */
                 s32 tuner_max_freq_rf;
-                                      /**< maximum RF input frequency, in kHz */
-                bool tuner_rf_agc_pol; /**< if true invert RF AGC polarity     */
-                bool tuner_if_agc_pol; /**< if true invert IF AGC polarity     */
-                bool tuner_slow_mode; /**< if true invert IF AGC polarity     */
+                                      /*< maximum RF input frequency, in kHz */
+                bool tuner_rf_agc_pol; /*< if true invert RF AGC polarity     */
+                bool tuner_if_agc_pol; /*< if true invert IF AGC polarity     */
+                bool tuner_slow_mode; /*< if true invert IF AGC polarity     */
 
                 struct drx_channel current_channel;
-                                      /**< current channel parameters         */
+                                      /*< current channel parameters         */
                 enum drx_standard current_standard;
-                                      /**< current standard selection         */
+                                      /*< current standard selection         */
                 enum drx_standard prev_standard;
-                                      /**< previous standard selection        */
+                                      /*< previous standard selection        */
                 enum drx_standard di_cache_standard;
-                                      /**< standard in DI cache if available  */
-                bool use_bootloader; /**< use bootloader in open             */
-                u32 capabilities;   /**< capabilities flags                 */
-                u32 product_id;      /**< product ID inc. metal fix number   */};
+                                      /*< standard in DI cache if available  */
+                bool use_bootloader; /*< use bootloader in open             */
+                u32 capabilities;   /*< capabilities flags                 */
+                u32 product_id;      /*< product ID inc. metal fix number   */};
 
 /*
 * Generic functions for DRX devices.
@@ -1897,16 +1897,16 @@ struct drx_reg_dump {
 
 struct drx_demod_instance;
 
-/**
+/*
 * \struct struct drx_demod_instance * \brief Top structure of demodulator instance.
 */
 struct drx_demod_instance {
-                                /**< data access protocol functions       */
+                                /*< data access protocol functions       */
         struct i2c_device_addr *my_i2c_dev_addr;
-                                /**< i2c address and device identifier    */
+                                /*< i2c address and device identifier    */
         struct drx_common_attr *my_common_attr;
-                                /**< common DRX attributes                */
-        void *my_ext_attr;    /**< device specific attributes           */
+                                /*< common DRX attributes                */
+        void *my_ext_attr;    /*< device specific attributes           */
         /* generic demodulator data */
 
         struct i2c_adapter      *i2c;
@@ -2195,7 +2195,7 @@ Conversion from enum values to human readable form.
 Access macros
 -------------------------------------------------------------------------*/
 
-/**
+/*
 * \brief Create a compilable reference to the microcode attribute
 * \param d pointer to demod instance
 *
@@ -2229,7 +2229,7 @@ Access macros
 #define DRX_ATTR_I2CDEVID(d)        ((d)->my_i2c_dev_addr->i2c_dev_id)
 #define DRX_ISMCVERTYPE(x) ((x) == AUX_VER_RECORD)
 
-/**************************/
+/*************************/
 
 /* Macros with device-specific handling are converted to CFG functions */
 
@@ -2285,7 +2285,7 @@ Access macros
 #define DRX_GET_QAM_LOCKRANGE(d, x) DRX_ACCESSMACRO_GET((d), (x), \
          DRX_XS_CFG_QAM_LOCKRANGE, enum drx_qam_lock_range, DRX_UNKNOWN)
 
-/**
+/*
 * \brief Macro to check if std is an ATV standard
 * \retval true std is an ATV standard
 * \retval false std is an ATV standard
@@ -2298,7 +2298,7 @@ Access macros
                               ((std) == DRX_STANDARD_NTSC) || \
                               ((std) == DRX_STANDARD_FM))
 
-/**
+/*
 * \brief Macro to check if std is an QAM standard
 * \retval true std is an QAM standards
 * \retval false std is an QAM standards
@@ -2308,14 +2308,14 @@ Access macros
                               ((std) == DRX_STANDARD_ITU_C) || \
                               ((std) == DRX_STANDARD_ITU_D))
 
-/**
+/*
 * \brief Macro to check if std is VSB standard
 * \retval true std is VSB standard
 * \retval false std is not VSB standard
 */
 #define DRX_ISVSBSTD(std) ((std) == DRX_STANDARD_8VSB)
 
-/**
+/*
 * \brief Macro to check if std is DVBT standard
 * \retval true std is DVBT standard
 * \retval false std is not DVBT standard
diff --git a/drivers/media/dvb-frontends/drx39xyj/drxj.c b/drivers/media/dvb-frontends/drx39xyj/drxj.c
index 499ccff557bf..8cbd8cc21059 100644
--- a/drivers/media/dvb-frontends/drx39xyj/drxj.c
+++ b/drivers/media/dvb-frontends/drx39xyj/drxj.c
@@ -73,7 +73,7 @@ INCLUDE FILES
 
 #define DRX39XX_MAIN_FIRMWARE "dvb-fe-drxj-mc-1.0.8.fw"
 
-/**
+/*
 * \brief Maximum u32 value.
 */
 #ifndef MAX_U32
@@ -100,8 +100,8 @@ INCLUDE FILES
 #ifndef OOB_DRX_DRIVE_STRENGTH
 #define OOB_DRX_DRIVE_STRENGTH 0x02
 #endif
-/**** START DJCOMBO patches to DRXJ registermap constants *********************/
-/**** registermap 200706071303 from drxj **************************************/
+/*** START DJCOMBO patches to DRXJ registermap constants *********************/
+/*** registermap 200706071303 from drxj **************************************/
 #define   ATV_TOP_CR_AMP_TH_FM                                              0x0
 #define   ATV_TOP_CR_AMP_TH_L                                               0xA
 #define   ATV_TOP_CR_AMP_TH_LP                                              0xA
@@ -188,7 +188,7 @@ INCLUDE FILES
 #define     IQM_RC_ADJ_SEL_B_OFF                                            0x0
 #define     IQM_RC_ADJ_SEL_B_QAM                                            0x1
 #define     IQM_RC_ADJ_SEL_B_VSB                                            0x2
-/**** END DJCOMBO patches to DRXJ registermap *********************************/
+/*** END DJCOMBO patches to DRXJ registermap *********************************/
 
 #include "drx_driver_version.h"
 
@@ -208,25 +208,25 @@ DEFINES
 #define DRXJ_WAKE_UP_KEY (demod->my_i2c_dev_addr->i2c_addr)
 #endif
 
-/**
+/*
 * \def DRXJ_DEF_I2C_ADDR
 * \brief Default I2C address of a demodulator instance.
 */
 #define DRXJ_DEF_I2C_ADDR (0x52)
 
-/**
+/*
 * \def DRXJ_DEF_DEMOD_DEV_ID
 * \brief Default device identifier of a demodultor instance.
 */
 #define DRXJ_DEF_DEMOD_DEV_ID      (1)
 
-/**
+/*
 * \def DRXJ_SCAN_TIMEOUT
 * \brief Timeout value for waiting on demod lock during channel scan (millisec).
 */
 #define DRXJ_SCAN_TIMEOUT    1000
 
-/**
+/*
 * \def HI_I2C_DELAY
 * \brief HI timing delay for I2C timing (in nano seconds)
 *
@@ -234,7 +234,7 @@ DEFINES
 */
 #define HI_I2C_DELAY    42
 
-/**
+/*
 * \def HI_I2C_BRIDGE_DELAY
 * \brief HI timing delay for I2C timing (in nano seconds)
 *
@@ -242,13 +242,13 @@ DEFINES
 */
 #define HI_I2C_BRIDGE_DELAY   750
 
-/**
+/*
 * \brief Time Window for MER and SER Measurement in Units of Segment duration.
 */
 #define VSB_TOP_MEASUREMENT_PERIOD  64
 #define SYMBOLS_PER_SEGMENT         832
 
-/**
+/*
 * \brief bit rate and segment rate constants used for SER and BER.
 */
 /* values taken from the QAM microcode */
@@ -260,21 +260,21 @@ DEFINES
 #define DRXJ_QAM_SL_SIG_POWER_QAM64       43008
 #define DRXJ_QAM_SL_SIG_POWER_QAM128      20992
 #define DRXJ_QAM_SL_SIG_POWER_QAM256      43520
-/**
+/*
 * \brief Min supported symbolrates.
 */
 #ifndef DRXJ_QAM_SYMBOLRATE_MIN
 #define DRXJ_QAM_SYMBOLRATE_MIN          (520000)
 #endif
 
-/**
+/*
 * \brief Max supported symbolrates.
 */
 #ifndef DRXJ_QAM_SYMBOLRATE_MAX
 #define DRXJ_QAM_SYMBOLRATE_MAX         (7233000)
 #endif
 
-/**
+/*
 * \def DRXJ_QAM_MAX_WAITTIME
 * \brief Maximal wait time for QAM auto constellation in ms
 */
@@ -290,7 +290,7 @@ DEFINES
 #define DRXJ_QAM_DEMOD_LOCK_EXT_WAITTIME 200
 #endif
 
-/**
+/*
 * \def SCU status and results
 * \brief SCU
 */
@@ -299,7 +299,7 @@ DEFINES
 #define FEC_RS_MEASUREMENT_PERIOD   12894       /* 1 sec */
 #define FEC_RS_MEASUREMENT_PRESCALE 1   /* n sec */
 
-/**
+/*
 * \def DRX_AUD_MAX_DEVIATION
 * \brief Needed for calculation of prescale feature in AUD
 */
@@ -307,14 +307,14 @@ DEFINES
 #define DRXJ_AUD_MAX_FM_DEVIATION  100  /* kHz */
 #endif
 
-/**
+/*
 * \brief Needed for calculation of NICAM prescale feature in AUD
 */
 #ifndef DRXJ_AUD_MAX_NICAM_PRESCALE
 #define DRXJ_AUD_MAX_NICAM_PRESCALE  (9)        /* dB */
 #endif
 
-/**
+/*
 * \brief Needed for calculation of NICAM prescale feature in AUD
 */
 #ifndef DRXJ_AUD_MAX_WAITTIME
@@ -371,21 +371,21 @@ DEFINES
 /*============================================================================*/
 /*=== GLOBAL VARIABLEs =======================================================*/
 /*============================================================================*/
-/**
+/*
 */
 
-/**
+/*
 * \brief Temporary register definitions.
 *        (register definitions that are not yet available in register master)
 */
 
-/******************************************************************************/
+/*****************************************************************************/
 /* Audio block 0x103 is write only. To avoid shadowing in driver accessing    */
 /* RAM adresses directly. This must be READ ONLY to avoid problems.           */
 /* Writing to the interface adresses is more than only writing the RAM        */
 /* locations                                                                  */
-/******************************************************************************/
-/**
+/*****************************************************************************/
+/*
 * \brief RAM location of MODUS registers
 */
 #define AUD_DEM_RAM_MODUS_HI__A              0x10204A3
@@ -394,13 +394,13 @@ DEFINES
 #define AUD_DEM_RAM_MODUS_LO__A              0x10204A4
 #define AUD_DEM_RAM_MODUS_LO__M              0x0FFF
 
-/**
+/*
 * \brief RAM location of I2S config registers
 */
 #define AUD_DEM_RAM_I2S_CONFIG1__A           0x10204B1
 #define AUD_DEM_RAM_I2S_CONFIG2__A           0x10204B2
 
-/**
+/*
 * \brief RAM location of DCO config registers
 */
 #define AUD_DEM_RAM_DCO_B_HI__A              0x1020461
@@ -408,20 +408,20 @@ DEFINES
 #define AUD_DEM_RAM_DCO_A_HI__A              0x1020463
 #define AUD_DEM_RAM_DCO_A_LO__A              0x1020464
 
-/**
+/*
 * \brief RAM location of Threshold registers
 */
 #define AUD_DEM_RAM_NICAM_THRSHLD__A         0x102045A
 #define AUD_DEM_RAM_A2_THRSHLD__A            0x10204BB
 #define AUD_DEM_RAM_BTSC_THRSHLD__A          0x10204A6
 
-/**
+/*
 * \brief RAM location of Carrier Threshold registers
 */
 #define AUD_DEM_RAM_CM_A_THRSHLD__A          0x10204AF
 #define AUD_DEM_RAM_CM_B_THRSHLD__A          0x10204B0
 
-/**
+/*
 * \brief FM Matrix register fix
 */
 #ifdef AUD_DEM_WR_FM_MATRIX__A
@@ -430,7 +430,7 @@ DEFINES
 #define AUD_DEM_WR_FM_MATRIX__A              0x105006F
 
 /*============================================================================*/
-/**
+/*
 * \brief Defines required for audio
 */
 #define AUD_VOLUME_ZERO_DB                      115
@@ -443,14 +443,14 @@ DEFINES
 #define AUD_I2S_FREQUENCY_MIN                   12000UL
 #define AUD_RDS_ARRAY_SIZE                      18
 
-/**
+/*
 * \brief Needed for calculation of prescale feature in AUD
 */
 #ifndef DRX_AUD_MAX_FM_DEVIATION
 #define DRX_AUD_MAX_FM_DEVIATION  (100) /* kHz */
 #endif
 
-/**
+/*
 * \brief Needed for calculation of NICAM prescale feature in AUD
 */
 #ifndef DRX_AUD_MAX_NICAM_PRESCALE
@@ -478,7 +478,7 @@ DEFINES
 /*=== REGISTER ACCESS MACROS =================================================*/
 /*============================================================================*/
 
-/**
+/*
 * This macro is used to create byte arrays for block writes.
 * Block writes speed up I2C traffic between host and demod.
 * The macro takes care of the required byte order in a 16 bits word.
@@ -486,7 +486,7 @@ DEFINES
 */
 #define DRXJ_16TO8(x) ((u8) (((u16)x) & 0xFF)), \
                        ((u8)((((u16)x)>>8)&0xFF))
-/**
+/*
 * This macro is used to convert byte array to 16 bit register value for block read.
 * Block read speed up I2C traffic between host and demod.
 * The macro takes care of the required byte order in a 16 bits word.
@@ -501,7 +501,7 @@ DEFINES
 /*=== HI COMMAND RELATED DEFINES =============================================*/
 /*============================================================================*/
 
-/**
+/*
 * \brief General maximum number of retries for ucode command interfaces
 */
 #define DRXJ_MAX_RETRIES (100)
@@ -807,7 +807,7 @@ static struct drxj_data drxj_data_g = {
          },
 };
 
-/**
+/*
 * \var drxj_default_addr_g
 * \brief Default I2C address and device identifier.
 */
@@ -816,7 +816,7 @@ static struct i2c_device_addr drxj_default_addr_g = {
         DRXJ_DEF_DEMOD_DEV_ID   /* device id */
 };
 
-/**
+/*
 * \var drxj_default_comm_attr_g
 * \brief Default common attributes of a drxj demodulator instance.
 */
@@ -887,7 +887,7 @@ static struct drx_common_attr drxj_default_comm_attr_g = {
         0                       /* mfx */
 };
 
-/**
+/*
 * \var drxj_default_demod_g
 * \brief Default drxj demodulator instance.
 */
@@ -897,7 +897,7 @@ static struct drx_demod_instance drxj_default_demod_g = {
         &drxj_data_g            /* demod device specific attributes */
 };
 
-/**
+/*
 * \brief Default audio data structure for DRK demodulator instance.
 *
 * This structure is DRXK specific.
@@ -997,7 +997,7 @@ struct drxj_hi_cmd {
 /*=== MICROCODE RELATED STRUCTURES ===========================================*/
 /*============================================================================*/
 
-/**
+/*
  * struct drxu_code_block_hdr - Structure of the microcode block headers
  *
  * @addr:       Destination address of the data in this block
@@ -1086,7 +1086,7 @@ static u32 frac28(u32 N, u32 D)
         return Q1;
 }
 
-/**
+/*
 * \fn u32 log1_times100( u32 x)
 * \brief Compute: 100*log10(x)
 * \param x 32 bits
@@ -1198,7 +1198,7 @@ static u32 log1_times100(u32 x)
 
 }
 
-/**
+/*
 * \fn u32 frac_times1e6( u16 N, u32 D)
 * \brief Compute: (N/D) * 1000000.
 * \param N nominator 16-bits.
@@ -1235,7 +1235,7 @@ static u32 frac_times1e6(u32 N, u32 D)
 /*============================================================================*/
 
 
-/**
+/*
 * \brief Values for NICAM prescaler gain. Computed from dB to integer
 *        and rounded. For calc used formula: 16*10^(prescaleGain[dB]/20).
 *
@@ -1280,7 +1280,7 @@ static const u16 nicam_presc_table_val[43] = {
 #define DRXJ_DAP_AUDTRIF_TIMEOUT 80     /* millisec */
 /*============================================================================*/
 
-/**
+/*
 * \fn bool is_handled_by_aud_tr_if( u32 addr )
 * \brief Check if this address is handled by the audio token ring interface.
 * \param addr
@@ -1386,7 +1386,7 @@ int drxbsp_i2c_write_read(struct i2c_device_addr *w_dev_addr,
 
 /*============================================================================*/
 
-/******************************
+/*****************************
 *
 * int drxdap_fasi_read_block (
 *      struct i2c_device_addr *dev_addr,      -- address of I2C device
@@ -1498,7 +1498,7 @@ static int drxdap_fasi_read_block(struct i2c_device_addr *dev_addr,
 }
 
 
-/******************************
+/*****************************
 *
 * int drxdap_fasi_read_reg16 (
 *     struct i2c_device_addr *dev_addr, -- address of I2C device
@@ -1531,7 +1531,7 @@ static int drxdap_fasi_read_reg16(struct i2c_device_addr *dev_addr,
         return rc;
 }
 
-/******************************
+/*****************************
 *
 * int drxdap_fasi_read_reg32 (
 *     struct i2c_device_addr *dev_addr, -- address of I2C device
@@ -1566,7 +1566,7 @@ static int drxdap_fasi_read_reg32(struct i2c_device_addr *dev_addr,
         return rc;
 }
 
-/******************************
+/*****************************
 *
 * int drxdap_fasi_write_block (
 *      struct i2c_device_addr *dev_addr,    -- address of I2C device
@@ -1705,7 +1705,7 @@ static int drxdap_fasi_write_block(struct i2c_device_addr *dev_addr,
         return first_err;
 }
 
-/******************************
+/*****************************
 *
 * int drxdap_fasi_write_reg16 (
 *     struct i2c_device_addr *dev_addr, -- address of I2C device
@@ -1734,7 +1734,7 @@ static int drxdap_fasi_write_reg16(struct i2c_device_addr *dev_addr,
         return drxdap_fasi_write_block(dev_addr, addr, sizeof(data), buf, flags);
 }
 
-/******************************
+/*****************************
 *
 * int drxdap_fasi_read_modify_write_reg16 (
 *      struct i2c_device_addr *dev_addr,   -- address of I2C device
@@ -1778,7 +1778,7 @@ static int drxdap_fasi_read_modify_write_reg16(struct i2c_device_addr *dev_addr,
         return rc;
 }
 
-/******************************
+/*****************************
 *
 * int drxdap_fasi_write_reg32 (
 *     struct i2c_device_addr *dev_addr, -- address of I2C device
@@ -1811,7 +1811,7 @@ static int drxdap_fasi_write_reg32(struct i2c_device_addr *dev_addr,
 
 /*============================================================================*/
 
-/**
+/*
 * \fn int drxj_dap_rm_write_reg16short
 * \brief Read modify write 16 bits audio register using short format only.
 * \param dev_addr
@@ -1890,7 +1890,7 @@ static int drxj_dap_read_modify_write_reg16(struct i2c_device_addr *dev_addr,
 
 /*============================================================================*/
 
-/**
+/*
 * \fn int drxj_dap_read_aud_reg16
 * \brief Read 16 bits audio register
 * \param dev_addr
@@ -1997,7 +1997,7 @@ static int drxj_dap_read_reg16(struct i2c_device_addr *dev_addr,
 }
 /*============================================================================*/
 
-/**
+/*
 * \fn int drxj_dap_write_aud_reg16
 * \brief Write 16 bits audio register
 * \param dev_addr
@@ -2086,7 +2086,7 @@ static int drxj_dap_write_reg16(struct i2c_device_addr *dev_addr,
 #define DRXJ_HI_ATOMIC_READ      SIO_HI_RA_RAM_PAR_3_ACP_RW_READ
 #define DRXJ_HI_ATOMIC_WRITE     SIO_HI_RA_RAM_PAR_3_ACP_RW_WRITE
 
-/**
+/*
 * \fn int drxj_dap_atomic_read_write_block()
 * \brief Basic access routine for atomic read or write access
 * \param dev_addr  pointer to i2c dev address
@@ -2168,7 +2168,7 @@ rw_error:
 
 /*============================================================================*/
 
-/**
+/*
 * \fn int drxj_dap_atomic_read_reg32()
 * \brief Atomic read of 32 bits words
 */
@@ -2215,7 +2215,7 @@ int drxj_dap_atomic_read_reg32(struct i2c_device_addr *dev_addr,
 /*============================================================================*/
 /*============================================================================*/
 
-/**
+/*
 * \fn int hi_cfg_command()
 * \brief Configure HI with settings stored in the demod structure.
 * \param demod Demodulator.
@@ -2258,7 +2258,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int hi_command()
 * \brief Configure HI with settings stored in the demod structure.
 * \param dev_addr I2C address.
@@ -2369,7 +2369,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int init_hi( const struct drx_demod_instance *demod )
 * \brief Initialise and configurate HI.
 * \param demod pointer to demod data.
@@ -2450,7 +2450,7 @@ rw_error:
 /*============================================================================*/
 /*============================================================================*/
 
-/**
+/*
 * \fn int get_device_capabilities()
 * \brief Get and store device capabilities.
 * \param demod  Pointer to demodulator instance.
@@ -2656,7 +2656,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int power_up_device()
 * \brief Power up device.
 * \param demod  Pointer to demodulator instance.
@@ -2710,7 +2710,7 @@ static int power_up_device(struct drx_demod_instance *demod)
 /*----------------------------------------------------------------------------*/
 /* MPEG Output Configuration Functions - begin                                */
 /*----------------------------------------------------------------------------*/
-/**
+/*
 * \fn int ctrl_set_cfg_mpeg_output()
 * \brief Set MPEG output configuration of the device.
 * \param devmod  Pointer to demodulator instance.
@@ -3356,7 +3356,7 @@ rw_error:
 /* miscellaneous configurations - begin                           */
 /*----------------------------------------------------------------------------*/
 
-/**
+/*
 * \fn int set_mpegtei_handling()
 * \brief Activate MPEG TEI handling settings.
 * \param devmod  Pointer to demodulator instance.
@@ -3429,7 +3429,7 @@ rw_error:
 }
 
 /*----------------------------------------------------------------------------*/
-/**
+/*
 * \fn int bit_reverse_mpeg_output()
 * \brief Set MPEG output bit-endian settings.
 * \param devmod  Pointer to demodulator instance.
@@ -3472,7 +3472,7 @@ rw_error:
 }
 
 /*----------------------------------------------------------------------------*/
-/**
+/*
 * \fn int set_mpeg_start_width()
 * \brief Set MPEG start width.
 * \param devmod  Pointer to demodulator instance.
@@ -3522,7 +3522,7 @@ rw_error:
 /*----------------------------------------------------------------------------*/
 /* UIO Configuration Functions - begin                                        */
 /*----------------------------------------------------------------------------*/
-/**
+/*
 * \fn int ctrl_set_uio_cfg()
 * \brief Configure modus oprandi UIO.
 * \param demod Pointer to demodulator instance.
@@ -3659,7 +3659,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int ctrl_uio_write()
 * \brief Write to a UIO.
 * \param demod Pointer to demodulator instance.
@@ -3868,7 +3868,7 @@ rw_error:
 /*----------------------------------------------------------------------------*/
 /* I2C Bridge Functions - begin                                               */
 /*----------------------------------------------------------------------------*/
-/**
+/*
 * \fn int ctrl_i2c_bridge()
 * \brief Open or close the I2C switch to tuner.
 * \param demod Pointer to demodulator instance.
@@ -3903,7 +3903,7 @@ ctrl_i2c_bridge(struct drx_demod_instance *demod, bool *bridge_closed)
 /*----------------------------------------------------------------------------*/
 /* Smart antenna Functions - begin                                            */
 /*----------------------------------------------------------------------------*/
-/**
+/*
 * \fn int smart_ant_init()
 * \brief Initialize Smart Antenna.
 * \param pointer to struct drx_demod_instance.
@@ -4116,7 +4116,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int DRXJ_DAP_SCUAtomicReadWriteBlock()
 * \brief Basic access routine for SCU atomic read or write access
 * \param dev_addr  pointer to i2c dev address
@@ -4188,7 +4188,7 @@ rw_error:
 
 /*============================================================================*/
 
-/**
+/*
 * \fn int DRXJ_DAP_AtomicReadReg16()
 * \brief Atomic read of 16 bits words
 */
@@ -4216,7 +4216,7 @@ int drxj_dap_scu_atomic_read_reg16(struct i2c_device_addr *dev_addr,
 }
 
 /*============================================================================*/
-/**
+/*
 * \fn int drxj_dap_scu_atomic_write_reg16()
 * \brief Atomic read of 16 bits words
 */
@@ -4237,7 +4237,7 @@ int drxj_dap_scu_atomic_write_reg16(struct i2c_device_addr *dev_addr,
 }
 
 /* -------------------------------------------------------------------------- */
-/**
+/*
 * \brief Measure result of ADC synchronisation
 * \param demod demod instance
 * \param count (returned) count
@@ -4297,7 +4297,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \brief Synchronize analog and digital clock domains
 * \param demod demod instance
 * \return int.
@@ -4365,7 +4365,7 @@ rw_error:
 /*==                8VSB & QAM COMMON DATAPATH FUNCTIONS                    ==*/
 /*============================================================================*/
 /*============================================================================*/
-/**
+/*
 * \fn int init_agc ()
 * \brief Initialize AGC for all standards.
 * \param demod instance of demodulator.
@@ -4741,7 +4741,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int set_frequency ()
 * \brief Set frequency shift.
 * \param demod instance of demodulator.
@@ -4839,7 +4839,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int get_acc_pkt_err()
 * \brief Retrieve signal strength for VSB and QAM.
 * \param demod Pointer to demod instance
@@ -4891,7 +4891,7 @@ rw_error:
 
 /*============================================================================*/
 
-/**
+/*
 * \fn int set_agc_rf ()
 * \brief Configure RF AGC
 * \param demod instance of demodulator.
@@ -5105,7 +5105,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int set_agc_if ()
 * \brief Configure If AGC
 * \param demod instance of demodulator.
@@ -5334,7 +5334,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int set_iqm_af ()
 * \brief Configure IQM AF registers
 * \param demod instance of demodulator.
@@ -5380,7 +5380,7 @@ rw_error:
 /*============================================================================*/
 /*============================================================================*/
 
-/**
+/*
 * \fn int power_down_vsb ()
 * \brief Powr down QAM related blocks.
 * \param demod instance of demodulator.
@@ -5478,7 +5478,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int set_vsb_leak_n_gain ()
 * \brief Set ATSC demod.
 * \param demod instance of demodulator.
@@ -5694,7 +5694,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int set_vsb()
 * \brief Set 8VSB demod.
 * \param demod instance of demodulator.
@@ -6200,7 +6200,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn static short get_vsb_post_rs_pck_err(struct i2c_device_addr *dev_addr, u16 *PckErrs)
 * \brief Get the values of packet error in 8VSB mode
 * \return Error code
@@ -6239,7 +6239,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn static short GetVSBBer(struct i2c_device_addr *dev_addr, u32 *ber)
 * \brief Get the values of ber in VSB mode
 * \return Error code
@@ -6284,7 +6284,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn static short get_vs_bpre_viterbi_ber(struct i2c_device_addr *dev_addr, u32 *ber)
 * \brief Get the values of ber in VSB mode
 * \return Error code
@@ -6306,7 +6306,7 @@ static int get_vs_bpre_viterbi_ber(struct i2c_device_addr *dev_addr,
         return 0;
 }
 
-/**
+/*
 * \fn static int get_vsbmer(struct i2c_device_addr *dev_addr, u16 *mer)
 * \brief Get the values of MER
 * \return Error code
@@ -6340,7 +6340,7 @@ rw_error:
 /*============================================================================*/
 /*============================================================================*/
 
-/**
+/*
 * \fn int power_down_qam ()
 * \brief Powr down QAM related blocks.
 * \param demod instance of demodulator.
@@ -6444,7 +6444,7 @@ rw_error:
 
 /*============================================================================*/
 
-/**
+/*
 * \fn int set_qam_measurement ()
 * \brief Setup of the QAM Measuremnt intervals for signal quality
 * \param demod instance of demod.
@@ -6656,7 +6656,7 @@ rw_error:
 
 /*============================================================================*/
 
-/**
+/*
 * \fn int set_qam16 ()
 * \brief QAM16 specific setup
 * \param demod instance of demod.
@@ -6891,7 +6891,7 @@ rw_error:
 
 /*============================================================================*/
 
-/**
+/*
 * \fn int set_qam32 ()
 * \brief QAM32 specific setup
 * \param demod instance of demod.
@@ -7126,7 +7126,7 @@ rw_error:
 
 /*============================================================================*/
 
-/**
+/*
 * \fn int set_qam64 ()
 * \brief QAM64 specific setup
 * \param demod instance of demod.
@@ -7362,7 +7362,7 @@ rw_error:
 
 /*============================================================================*/
 
-/**
+/*
 * \fn int set_qam128 ()
 * \brief QAM128 specific setup
 * \param demod: instance of demod.
@@ -7597,7 +7597,7 @@ rw_error:
 
 /*============================================================================*/
 
-/**
+/*
 * \fn int set_qam256 ()
 * \brief QAM256 specific setup
 * \param demod: instance of demod.
@@ -7835,7 +7835,7 @@ rw_error:
 #define QAM_SET_OP_CONSTELLATION 0x2
 #define QAM_SET_OP_SPECTRUM 0X4
 
-/**
+/*
 * \fn int set_qam ()
 * \brief Set QAM demod.
 * \param demod:   instance of demod.
@@ -8845,7 +8845,7 @@ rw_error:
 #define  DEMOD_LOCKED   0x1
 #define  SYNC_FLIPPED   0x2
 #define  SPEC_MIRRORED  0x4
-/**
+/*
 * \fn int qam64auto ()
 * \brief auto do sync pattern switching and mirroring.
 * \param demod:   instance of demod.
@@ -8993,7 +8993,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int qam256auto ()
 * \brief auto do sync pattern switching and mirroring.
 * \param demod:   instance of demod.
@@ -9077,7 +9077,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int set_qam_channel ()
 * \brief Set QAM channel according to the requested constellation.
 * \param demod:   instance of demod.
@@ -9284,7 +9284,7 @@ rw_error:
 
 /*============================================================================*/
 
-/**
+/*
 * \fn static short get_qamrs_err_count(struct i2c_device_addr *dev_addr)
 * \brief Get RS error count in QAM mode (used for post RS BER calculation)
 * \return Error code
@@ -9355,7 +9355,7 @@ rw_error:
 
 /*============================================================================*/
 
-/**
+/*
  * \fn int get_sig_strength()
  * \brief Retrieve signal strength for VSB and QAM.
  * \param demod Pointer to demod instance
@@ -9435,7 +9435,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int ctrl_get_qam_sig_quality()
 * \brief Retrieve QAM signal quality from device.
 * \param devmod Pointer to demodulator instance.
@@ -9721,7 +9721,7 @@ rw_error:
 */
 /* -------------------------------------------------------------------------- */
 
-/**
+/*
 * \fn int power_down_atv ()
 * \brief Power down ATV.
 * \param demod instance of demodulator
@@ -9822,7 +9822,7 @@ rw_error:
 
 /*============================================================================*/
 
-/**
+/*
 * \brief Power up AUD.
 * \param demod instance of demodulator
 * \return int.
@@ -9850,7 +9850,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int set_orx_nsu_aox()
 * \brief Configure OrxNsuAox for OOB
 * \param demod instance of demodulator.
@@ -9884,7 +9884,7 @@ rw_error:
         return rc;
 }
 
-/**
+/*
 * \fn int ctrl_set_oob()
 * \brief Set OOB channel to be used.
 * \param demod instance of demodulator
@@ -9986,9 +9986,9 @@ static int ctrl_set_oob(struct drx_demod_instance *demod, struct drxoob *oob_par
                     20;
         }
 
-   /*********/
+   /********/
         /* Stop  */
-   /*********/
+   /********/
         rc = drxj_dap_write_reg16(dev_addr, ORX_COMM_EXEC__A, ORX_COMM_EXEC_STOP, 0);
         if (rc != 0) {
                 pr_err("error %d\n", rc);
@@ -10004,9 +10004,9 @@ static int ctrl_set_oob(struct drx_demod_instance *demod, struct drxoob *oob_par
                 pr_err("error %d\n", rc);
                 goto rw_error;
         }
-   /*********/
+   /********/
         /* Reset */
-   /*********/
+   /********/
         scu_cmd.command = SCU_RAM_COMMAND_STANDARD_OOB
             | SCU_RAM_COMMAND_CMD_DEMOD_RESET;
         scu_cmd.parameter_len = 0;
@@ -10017,9 +10017,9 @@ static int ctrl_set_oob(struct drx_demod_instance *demod, struct drxoob *oob_par
                 pr_err("error %d\n", rc);
                 goto rw_error;
         }
-   /***********/
+   /**********/
         /* SET_ENV */
-   /***********/
+   /**********/
         /* set frequency, spectrum inversion and data rate */
         scu_cmd.command = SCU_RAM_COMMAND_STANDARD_OOB
             | SCU_RAM_COMMAND_CMD_DEMOD_SET_ENV;
@@ -10376,9 +10376,9 @@ static int ctrl_set_oob(struct drx_demod_instance *demod, struct drxoob *oob_par
                 pr_err("error %d\n", rc);
                 goto rw_error;
         }
-        /*********/
+        /********/
         /* Start */
-        /*********/
+        /********/
         scu_cmd.command = SCU_RAM_COMMAND_STANDARD_OOB
             | SCU_RAM_COMMAND_CMD_DEMOD_START;
         scu_cmd.parameter_len = 0;
@@ -10419,7 +10419,7 @@ rw_error:
 /*=============================================================================
   ===== ctrl_set_channel() ==========================================================
   ===========================================================================*/
-/**
+/*
 * \fn int ctrl_set_channel()
 * \brief Select a new transmission channel.
 * \param demod instance of demod.
@@ -10652,7 +10652,7 @@ rw_error:
   ===== SigQuality() ==========================================================
   ===========================================================================*/
 
-/**
+/*
 * \fn int ctrl_sig_quality()
 * \brief Retrieve signal quality form device.
 * \param devmod Pointer to demodulator instance.
@@ -10768,7 +10768,7 @@ rw_error:
 
 /*============================================================================*/
 
-/**
+/*
 * \fn int ctrl_lock_status()
 * \brief Retrieve lock status .
 * \param dev_addr Pointer to demodulator device address.
@@ -10856,7 +10856,7 @@ rw_error:
 
 /*============================================================================*/
 
-/**
+/*
 * \fn int ctrl_set_standard()
 * \brief Set modulation standard to be used.
 * \param standard Modulation standard.
@@ -11012,7 +11012,7 @@ static void drxj_reset_mode(struct drxj_data *ext_attr)
         ext_attr->vsb_pre_saw_cfg.use_pre_saw = true;
 }
 
-/**
+/*
 * \fn int ctrl_power_mode()
 * \brief Set the power mode of the device to the specified power mode
 * \param demod Pointer to demodulator instance.
@@ -11171,7 +11171,7 @@ rw_error:
 /*== CTRL Set/Get Config related functions ===================================*/
 /*============================================================================*/
 
-/**
+/*
 * \fn int ctrl_set_cfg_pre_saw()
 * \brief Set Pre-saw reference.
 * \param demod demod instance
@@ -11234,7 +11234,7 @@ rw_error:
 
 /*============================================================================*/
 
-/**
+/*
 * \fn int ctrl_set_cfg_afe_gain()
 * \brief Set AFE Gain.
 * \param demod demod instance
@@ -11324,7 +11324,7 @@ static int drx_ctrl_u_code(struct drx_demod_instance *demod,
                        enum drxu_code_action action);
 static int drxj_set_lna_state(struct drx_demod_instance *demod, bool state);
 
-/**
+/*
 * \fn drxj_open()
 * \brief Open the demod instance, configure device, configure drxdriver
 * \return Status_t Return status.
@@ -11543,7 +11543,7 @@ rw_error:
 }
 
 /*============================================================================*/
-/**
+/*
 * \fn drxj_close()
 * \brief Close the demod instance, power down the device
 * \return Status_t Return status.
@@ -11594,7 +11594,7 @@ rw_error:
  * Microcode related functions
  */
 
-/**
+/*
  * drx_u_code_compute_crc       - Compute CRC of block of microcode data.
  * @block_data: Pointer to microcode data.
  * @nr_words:   Size of microcode block (number of 16 bits words).
@@ -11622,7 +11622,7 @@ static u16 drx_u_code_compute_crc(u8 *block_data, u16 nr_words)
         return (u16)(crc_word >> 16);
 }
 
-/**
+/*
  * drx_check_firmware - checks if the loaded firmware is valid
  *
  * @demod:      demod structure
@@ -11708,7 +11708,7 @@ eof:
         return -EINVAL;
 }
 
-/**
+/*
  * drx_ctrl_u_code - Handle microcode upload or verify.
  * @dev_addr: Address of device.
  * @mc_info:  Pointer to information about microcode data.
diff --git a/drivers/media/dvb-frontends/drx39xyj/drxj.h b/drivers/media/dvb-frontends/drx39xyj/drxj.h
index 6c5b8f78f9f6..d3ee1c23bb2f 100644
--- a/drivers/media/dvb-frontends/drx39xyj/drxj.h
+++ b/drivers/media/dvb-frontends/drx39xyj/drxj.h
@@ -69,15 +69,15 @@ TYPEDEFS
 
         struct drxjscu_cmd {
                 u16 command;
-                        /**< Command number */
+                        /*< Command number */
                 u16 parameter_len;
-                        /**< Data length in byte */
+                        /*< Data length in byte */
                 u16 result_len;
-                        /**< result length in byte */
+                        /*< result length in byte */
                 u16 *parameter;
-                        /**< General purpous param */
+                        /*< General purpous param */
                 u16 *result;
-                        /**< General purpous param */};
+                        /*< General purpous param */};
 
 /*============================================================================*/
 /*============================================================================*/
@@ -130,7 +130,7 @@ TYPEDEFS
 
                 DRXJ_CFG_MAX    /* dummy, never to be used */};
 
-/**
+/*
 * /struct enum drxj_cfg_smart_ant_io * smart antenna i/o.
 */
 enum drxj_cfg_smart_ant_io {
@@ -138,7 +138,7 @@ enum drxj_cfg_smart_ant_io {
         DRXJ_SMT_ANT_INPUT
 };
 
-/**
+/*
 * /struct struct drxj_cfg_smart_ant * Set smart antenna.
 */
         struct drxj_cfg_smart_ant {
@@ -146,7 +146,7 @@ enum drxj_cfg_smart_ant_io {
                 u16 ctrl_data;
         };
 
-/**
+/*
 * /struct DRXJAGCSTATUS_t
 * AGC status information from the DRXJ-IQM-AF.
 */
@@ -158,7 +158,7 @@ struct drxj_agc_status {
 
 /* DRXJ_CFG_AGC_RF, DRXJ_CFG_AGC_IF */
 
-/**
+/*
 * /struct enum drxj_agc_ctrl_mode * Available AGCs modes in the DRXJ.
 */
         enum drxj_agc_ctrl_mode {
@@ -166,7 +166,7 @@ struct drxj_agc_status {
                 DRX_AGC_CTRL_USER,
                 DRX_AGC_CTRL_OFF};
 
-/**
+/*
 * /struct struct drxj_cfg_agc * Generic interface for all AGCs present on the DRXJ.
 */
         struct drxj_cfg_agc {
@@ -182,7 +182,7 @@ struct drxj_agc_status {
 
 /* DRXJ_CFG_PRE_SAW */
 
-/**
+/*
 * /struct struct drxj_cfg_pre_saw * Interface to configure pre SAW sense.
 */
         struct drxj_cfg_pre_saw {
@@ -192,14 +192,14 @@ struct drxj_agc_status {
 
 /* DRXJ_CFG_AFE_GAIN */
 
-/**
+/*
 * /struct struct drxj_cfg_afe_gain * Interface to configure gain of AFE (LNA + PGA).
 */
         struct drxj_cfg_afe_gain {
                 enum drx_standard standard;     /* standard to which these settings apply */
                 u16 gain;       /* gain in 0.1 dB steps, DRXJ range 140 .. 335 */};
 
-/**
+/*
 * /struct drxjrs_errors
 * Available failure information in DRXJ_FEC_RS.
 *
@@ -208,25 +208,25 @@ struct drxj_agc_status {
 */
         struct drxjrs_errors {
                 u16 nr_bit_errors;
-                                /**< no of pre RS bit errors          */
+                                /*< no of pre RS bit errors          */
                 u16 nr_symbol_errors;
-                                /**< no of pre RS symbol errors       */
+                                /*< no of pre RS symbol errors       */
                 u16 nr_packet_errors;
-                                /**< no of pre RS packet errors       */
+                                /*< no of pre RS packet errors       */
                 u16 nr_failures;
-                                /**< no of post RS failures to decode */
+                                /*< no of post RS failures to decode */
                 u16 nr_snc_par_fail_count;
-                                /**< no of post RS bit erros          */
+                                /*< no of post RS bit erros          */
         };
 
-/**
+/*
 * /struct struct drxj_cfg_vsb_misc * symbol error rate
 */
         struct drxj_cfg_vsb_misc {
                 u32 symb_error;
-                              /**< symbol error rate sps */};
+                              /*< symbol error rate sps */};
 
-/**
+/*
 * /enum enum drxj_mpeg_output_clock_rate * Mpeg output clock rate.
 *
 */
@@ -234,7 +234,7 @@ struct drxj_agc_status {
                 DRXJ_MPEG_START_WIDTH_1CLKCYC,
                 DRXJ_MPEG_START_WIDTH_8CLKCYC};
 
-/**
+/*
 * /enum enum drxj_mpeg_output_clock_rate * Mpeg output clock rate.
 *
 */
@@ -247,20 +247,20 @@ struct drxj_agc_status {
                 DRXJ_MPEGOUTPUT_CLOCK_RATE_25313K,
                 DRXJ_MPEGOUTPUT_CLOCK_RATE_21696K};
 
-/**
+/*
 * /struct DRXJCfgMisc_t
 * Change TEI bit of MPEG output
 * reverse MPEG output bit order
 * set MPEG output clock rate
 */
         struct drxj_cfg_mpeg_output_misc {
-                bool disable_tei_handling;            /**< if true pass (not change) TEI bit */
-                bool bit_reverse_mpeg_outout;         /**< if true, parallel: msb on MD0; serial: lsb out first */
+                bool disable_tei_handling;            /*< if true pass (not change) TEI bit */
+                bool bit_reverse_mpeg_outout;         /*< if true, parallel: msb on MD0; serial: lsb out first */
                 enum drxj_mpeg_output_clock_rate mpeg_output_clock_rate;
-                                                      /**< set MPEG output clock rate that overwirtes the derived one from symbol rate */
-                enum drxj_mpeg_start_width mpeg_start_width;  /**< set MPEG output start width */};
+                                                      /*< set MPEG output clock rate that overwirtes the derived one from symbol rate */
+                enum drxj_mpeg_start_width mpeg_start_width;  /*< set MPEG output start width */};
 
-/**
+/*
 * /enum enum drxj_xtal_freq * Supported external crystal reference frequency.
 */
         enum drxj_xtal_freq {
@@ -269,21 +269,21 @@ struct drxj_agc_status {
                 DRXJ_XTAL_FREQ_20P25MHZ,
                 DRXJ_XTAL_FREQ_4MHZ};
 
-/**
+/*
 * /enum enum drxj_xtal_freq * Supported external crystal reference frequency.
 */
         enum drxji2c_speed {
                 DRXJ_I2C_SPEED_400KBPS,
                 DRXJ_I2C_SPEED_100KBPS};
 
-/**
+/*
 * /struct struct drxj_cfg_hw_cfg * Get hw configuration, such as crystal reference frequency, I2C speed, etc...
 */
         struct drxj_cfg_hw_cfg {
                 enum drxj_xtal_freq xtal_freq;
-                                   /**< crystal reference frequency */
+                                   /*< crystal reference frequency */
                 enum drxji2c_speed i2c_speed;
-                                   /**< 100 or 400 kbps */};
+                                   /*< 100 or 400 kbps */};
 
 /*
  *  DRXJ_CFG_ATV_MISC
@@ -352,7 +352,7 @@ struct drxj_cfg_oob_misc {
  *  DRXJ_CFG_ATV_OUTPUT
  */
 
-/**
+/*
 * /enum DRXJAttenuation_t
 * Attenuation setting for SIF AGC.
 *
@@ -363,7 +363,7 @@ struct drxj_cfg_oob_misc {
                 DRXJ_SIF_ATTENUATION_6DB,
                 DRXJ_SIF_ATTENUATION_9DB};
 
-/**
+/*
 * /struct struct drxj_cfg_atv_output * SIF attenuation setting.
 *
 */
@@ -398,7 +398,7 @@ struct drxj_cfg_atv_output {
 /*============================================================================*/
 
 /*========================================*/
-/**
+/*
 * /struct struct drxj_data * DRXJ specific attributes.
 *
 * Global data container for DRXJ specific data.
@@ -406,93 +406,93 @@ struct drxj_cfg_atv_output {
 */
         struct drxj_data {
                 /* device capabilties (determined during drx_open()) */
-                bool has_lna;             /**< true if LNA (aka PGA) present */
-                bool has_oob;             /**< true if OOB supported */
-                bool has_ntsc;            /**< true if NTSC supported */
-                bool has_btsc;            /**< true if BTSC supported */
-                bool has_smatx;   /**< true if mat_tx is available */
-                bool has_smarx;   /**< true if mat_rx is available */
-                bool has_gpio;            /**< true if GPIO is available */
-                bool has_irqn;            /**< true if IRQN is available */
+                bool has_lna;             /*< true if LNA (aka PGA) present */
+                bool has_oob;             /*< true if OOB supported */
+                bool has_ntsc;            /*< true if NTSC supported */
+                bool has_btsc;            /*< true if BTSC supported */
+                bool has_smatx;   /*< true if mat_tx is available */
+                bool has_smarx;   /*< true if mat_rx is available */
+                bool has_gpio;            /*< true if GPIO is available */
+                bool has_irqn;            /*< true if IRQN is available */
                 /* A1/A2/A... */
-                u8 mfx;           /**< metal fix */
+                u8 mfx;           /*< metal fix */
 
                 /* tuner settings */
-                bool mirror_freq_spect_oob;/**< tuner inversion (true = tuner mirrors the signal */
+                bool mirror_freq_spect_oob;/*< tuner inversion (true = tuner mirrors the signal */
 
                 /* standard/channel settings */
-                enum drx_standard standard;       /**< current standard information                     */
+                enum drx_standard standard;       /*< current standard information                     */
                 enum drx_modulation constellation;
-                                          /**< current constellation                            */
-                s32 frequency; /**< center signal frequency in KHz                   */
+                                          /*< current constellation                            */
+                s32 frequency; /*< center signal frequency in KHz                   */
                 enum drx_bandwidth curr_bandwidth;
-                                          /**< current channel bandwidth                        */
-                enum drx_mirror mirror;   /**< current channel mirror                           */
+                                          /*< current channel bandwidth                        */
+                enum drx_mirror mirror;   /*< current channel mirror                           */
 
                 /* signal quality information */
-                u32 fec_bits_desired;     /**< BER accounting period                            */
-                u16 fec_vd_plen;          /**< no of trellis symbols: VD SER measurement period */
-                u16 qam_vd_prescale;      /**< Viterbi Measurement Prescale                     */
-                u16 qam_vd_period;        /**< Viterbi Measurement period                       */
-                u16 fec_rs_plen;          /**< defines RS BER measurement period                */
-                u16 fec_rs_prescale;      /**< ReedSolomon Measurement Prescale                 */
-                u16 fec_rs_period;        /**< ReedSolomon Measurement period                   */
-                bool reset_pkt_err_acc;   /**< Set a flag to reset accumulated packet error     */
-                u16 pkt_err_acc_start;    /**< Set a flag to reset accumulated packet error     */
+                u32 fec_bits_desired;     /*< BER accounting period                            */
+                u16 fec_vd_plen;          /*< no of trellis symbols: VD SER measurement period */
+                u16 qam_vd_prescale;      /*< Viterbi Measurement Prescale                     */
+                u16 qam_vd_period;        /*< Viterbi Measurement period                       */
+                u16 fec_rs_plen;          /*< defines RS BER measurement period                */
+                u16 fec_rs_prescale;      /*< ReedSolomon Measurement Prescale                 */
+                u16 fec_rs_period;        /*< ReedSolomon Measurement period                   */
+                bool reset_pkt_err_acc;   /*< Set a flag to reset accumulated packet error     */
+                u16 pkt_err_acc_start;    /*< Set a flag to reset accumulated packet error     */
 
                 /* HI configuration */
-                u16 hi_cfg_timing_div;    /**< HI Configure() parameter 2                       */
-                u16 hi_cfg_bridge_delay;          /**< HI Configure() parameter 3                       */
-                u16 hi_cfg_wake_up_key;   /**< HI Configure() parameter 4                       */
-                u16 hi_cfg_ctrl;          /**< HI Configure() parameter 5                       */
-                u16 hi_cfg_transmit;      /**< HI Configure() parameter 6                       */
+                u16 hi_cfg_timing_div;    /*< HI Configure() parameter 2                       */
+                u16 hi_cfg_bridge_delay;          /*< HI Configure() parameter 3                       */
+                u16 hi_cfg_wake_up_key;   /*< HI Configure() parameter 4                       */
+                u16 hi_cfg_ctrl;          /*< HI Configure() parameter 5                       */
+                u16 hi_cfg_transmit;      /*< HI Configure() parameter 6                       */
 
                 /* UIO configuration */
-                enum drxuio_mode uio_sma_rx_mode;/**< current mode of SmaRx pin                        */
-                enum drxuio_mode uio_sma_tx_mode;/**< current mode of SmaTx pin                        */
-                enum drxuio_mode uio_gpio_mode; /**< current mode of ASEL pin                         */
-                enum drxuio_mode uio_irqn_mode; /**< current mode of IRQN pin                         */
+                enum drxuio_mode uio_sma_rx_mode;/*< current mode of SmaRx pin                        */
+                enum drxuio_mode uio_sma_tx_mode;/*< current mode of SmaTx pin                        */
+                enum drxuio_mode uio_gpio_mode; /*< current mode of ASEL pin                         */
+                enum drxuio_mode uio_irqn_mode; /*< current mode of IRQN pin                         */
 
                 /* IQM fs frequecy shift and inversion */
-                u32 iqm_fs_rate_ofs;       /**< frequency shifter setting after setchannel      */
-                bool pos_image;    /**< Ture: positive image                            */
+                u32 iqm_fs_rate_ofs;       /*< frequency shifter setting after setchannel      */
+                bool pos_image;    /*< Ture: positive image                            */
                 /* IQM RC frequecy shift */
-                u32 iqm_rc_rate_ofs;       /**< frequency shifter setting after setchannel      */
+                u32 iqm_rc_rate_ofs;       /*< frequency shifter setting after setchannel      */
 
                 /* ATV configuration */
-                u32 atv_cfg_changed_flags; /**< flag: flags cfg changes */
-                s16 atv_top_equ0[DRXJ_COEF_IDX_MAX];         /**< shadow of ATV_TOP_EQU0__A */
-                s16 atv_top_equ1[DRXJ_COEF_IDX_MAX];         /**< shadow of ATV_TOP_EQU1__A */
-                s16 atv_top_equ2[DRXJ_COEF_IDX_MAX];         /**< shadow of ATV_TOP_EQU2__A */
-                s16 atv_top_equ3[DRXJ_COEF_IDX_MAX];         /**< shadow of ATV_TOP_EQU3__A */
-                bool phase_correction_bypass;/**< flag: true=bypass */
-                s16 atv_top_vid_peak;     /**< shadow of ATV_TOP_VID_PEAK__A */
-                u16 atv_top_noise_th;     /**< shadow of ATV_TOP_NOISE_TH__A */
-                bool enable_cvbs_output;  /**< flag CVBS ouput enable */
-                bool enable_sif_output;   /**< flag SIF ouput enable */
+                u32 atv_cfg_changed_flags; /*< flag: flags cfg changes */
+                s16 atv_top_equ0[DRXJ_COEF_IDX_MAX];         /*< shadow of ATV_TOP_EQU0__A */
+                s16 atv_top_equ1[DRXJ_COEF_IDX_MAX];         /*< shadow of ATV_TOP_EQU1__A */
+                s16 atv_top_equ2[DRXJ_COEF_IDX_MAX];         /*< shadow of ATV_TOP_EQU2__A */
+                s16 atv_top_equ3[DRXJ_COEF_IDX_MAX];         /*< shadow of ATV_TOP_EQU3__A */
+                bool phase_correction_bypass;/*< flag: true=bypass */
+                s16 atv_top_vid_peak;     /*< shadow of ATV_TOP_VID_PEAK__A */
+                u16 atv_top_noise_th;     /*< shadow of ATV_TOP_NOISE_TH__A */
+                bool enable_cvbs_output;  /*< flag CVBS ouput enable */
+                bool enable_sif_output;   /*< flag SIF ouput enable */
                  enum drxjsif_attenuation sif_attenuation;
-                                          /**< current SIF att setting */
+                                          /*< current SIF att setting */
                 /* Agc configuration for QAM and VSB */
-                struct drxj_cfg_agc qam_rf_agc_cfg; /**< qam RF AGC config */
-                struct drxj_cfg_agc qam_if_agc_cfg; /**< qam IF AGC config */
-                struct drxj_cfg_agc vsb_rf_agc_cfg; /**< vsb RF AGC config */
-                struct drxj_cfg_agc vsb_if_agc_cfg; /**< vsb IF AGC config */
+                struct drxj_cfg_agc qam_rf_agc_cfg; /*< qam RF AGC config */
+                struct drxj_cfg_agc qam_if_agc_cfg; /*< qam IF AGC config */
+                struct drxj_cfg_agc vsb_rf_agc_cfg; /*< vsb RF AGC config */
+                struct drxj_cfg_agc vsb_if_agc_cfg; /*< vsb IF AGC config */
 
                 /* PGA gain configuration for QAM and VSB */
-                u16 qam_pga_cfg;          /**< qam PGA config */
-                u16 vsb_pga_cfg;          /**< vsb PGA config */
+                u16 qam_pga_cfg;          /*< qam PGA config */
+                u16 vsb_pga_cfg;          /*< vsb PGA config */
 
                 /* Pre SAW configuration for QAM and VSB */
                 struct drxj_cfg_pre_saw qam_pre_saw_cfg;
-                                          /**< qam pre SAW config */
+                                          /*< qam pre SAW config */
                 struct drxj_cfg_pre_saw vsb_pre_saw_cfg;
-                                          /**< qam pre SAW config */
+                                          /*< qam pre SAW config */
 
                 /* Version information */
-                char v_text[2][12];       /**< allocated text versions */
-                struct drx_version v_version[2]; /**< allocated versions structs */
+                char v_text[2][12];       /*< allocated text versions */
+                struct drx_version v_version[2]; /*< allocated versions structs */
                 struct drx_version_list v_list_elements[2];
-                                          /**< allocated version list */
+                                          /*< allocated version list */
 
                 /* smart antenna configuration */
                 bool smart_ant_inverted;
@@ -502,25 +502,25 @@ struct drxj_cfg_atv_output {
                 bool oob_power_on;
 
                 /* MPEG static bitrate setting */
-                u32 mpeg_ts_static_bitrate;  /**< bitrate static MPEG output */
-                bool disable_te_ihandling;  /**< MPEG TS TEI handling */
-                bool bit_reverse_mpeg_outout;/**< MPEG output bit order */
+                u32 mpeg_ts_static_bitrate;  /*< bitrate static MPEG output */
+                bool disable_te_ihandling;  /*< MPEG TS TEI handling */
+                bool bit_reverse_mpeg_outout;/*< MPEG output bit order */
                  enum drxj_mpeg_output_clock_rate mpeg_output_clock_rate;
-                                            /**< MPEG output clock rate */
+                                            /*< MPEG output clock rate */
                  enum drxj_mpeg_start_width mpeg_start_width;
-                                            /**< MPEG Start width */
+                                            /*< MPEG Start width */
 
                 /* Pre SAW & Agc configuration for ATV */
                 struct drxj_cfg_pre_saw atv_pre_saw_cfg;
-                                          /**< atv pre SAW config */
-                struct drxj_cfg_agc atv_rf_agc_cfg; /**< atv RF AGC config */
-                struct drxj_cfg_agc atv_if_agc_cfg; /**< atv IF AGC config */
-                u16 atv_pga_cfg;          /**< atv pga config    */
+                                          /*< atv pre SAW config */
+                struct drxj_cfg_agc atv_rf_agc_cfg; /*< atv RF AGC config */
+                struct drxj_cfg_agc atv_if_agc_cfg; /*< atv IF AGC config */
+                u16 atv_pga_cfg;          /*< atv pga config    */
 
                 u32 curr_symbol_rate;
 
                 /* pin-safe mode */
-                bool pdr_safe_mode;         /**< PDR safe mode activated      */
+                bool pdr_safe_mode;         /*< PDR safe mode activated      */
                 u16 pdr_safe_restore_val_gpio;
                 u16 pdr_safe_restore_val_v_sync;
                 u16 pdr_safe_restore_val_sma_rx;
@@ -531,12 +531,12 @@ struct drxj_cfg_atv_output {
                 enum drxj_cfg_oob_lo_power oob_lo_pow;
 
                 struct drx_aud_data aud_data;
-                                    /**< audio storage                  */};
+                                    /*< audio storage                  */};
 
 /*-------------------------------------------------------------------------
 Access MACROS
 -------------------------------------------------------------------------*/
-/**
+/*
 * \brief Compilable references to attributes
 * \param d pointer to demod instance
 *
@@ -554,7 +554,7 @@ Access MACROS
 DEFINES
 -------------------------------------------------------------------------*/
 
-/**
+/*
 * \def DRXJ_NTSC_CARRIER_FREQ_OFFSET
 * \brief Offset from picture carrier to centre frequency in kHz, in RF domain
 *
@@ -569,7 +569,7 @@ DEFINES
 */
 #define DRXJ_NTSC_CARRIER_FREQ_OFFSET           ((s32)(1750))
 
-/**
+/*
 * \def DRXJ_PAL_SECAM_BG_CARRIER_FREQ_OFFSET
 * \brief Offset from picture carrier to centre frequency in kHz, in RF domain
 *
@@ -585,7 +585,7 @@ DEFINES
 */
 #define DRXJ_PAL_SECAM_BG_CARRIER_FREQ_OFFSET   ((s32)(2375))
 
-/**
+/*
 * \def DRXJ_PAL_SECAM_DKIL_CARRIER_FREQ_OFFSET
 * \brief Offset from picture carrier to centre frequency in kHz, in RF domain
 *
@@ -601,7 +601,7 @@ DEFINES
 */
 #define DRXJ_PAL_SECAM_DKIL_CARRIER_FREQ_OFFSET ((s32)(2775))
 
-/**
+/*
 * \def DRXJ_PAL_SECAM_LP_CARRIER_FREQ_OFFSET
 * \brief Offset from picture carrier to centre frequency in kHz, in RF domain
 *
@@ -616,7 +616,7 @@ DEFINES
 */
 #define DRXJ_PAL_SECAM_LP_CARRIER_FREQ_OFFSET   ((s32)(-3255))
 
-/**
+/*
 * \def DRXJ_FM_CARRIER_FREQ_OFFSET
 * \brief Offset from sound carrier to centre frequency in kHz, in RF domain
 *
diff --git a/drivers/media/dvb-frontends/drxk.h b/drivers/media/dvb-frontends/drxk.h
index eb9bdc9f59c4..b16fedbb53a3 100644
--- a/drivers/media/dvb-frontends/drxk.h
+++ b/drivers/media/dvb-frontends/drxk.h
@@ -20,17 +20,18 @@
  * @antenna_dvbt:       GPIO bit for changing antenna to DVB-C. A value of 1
  *                      means that 1=DVBC, 0 = DVBT. Zero means the opposite.
  * @mpeg_out_clk_strength: DRXK Mpeg output clock drive strength.
+ * @chunk_size:         maximum size for I2C messages
  * @microcode_name:     Name of the firmware file with the microcode
  * @qam_demod_parameter_count:  The number of parameters used for the command
  *                              to set the demodulator parameters. All
  *                              firmwares are using the 2-parameter commmand.
- *                              An exception is the "drxk_a3.mc" firmware,
+ *                              An exception is the ``drxk_a3.mc`` firmware,
  *                              which uses the 4-parameter command.
  *                              A value of 0 (default) or lower indicates that
  *                              the correct number of parameters will be
  *                              automatically detected.
  *
- * On the *_gpio vars, bit 0 is UIO-1, bit 1 is UIO-2 and bit 2 is
+ * On the ``*_gpio`` vars, bit 0 is UIO-1, bit 1 is UIO-2 and bit 2 is
  * UIO-3.
  */
 struct drxk_config {
@@ -52,6 +53,14 @@ struct drxk_config {
 };
 
 #if IS_REACHABLE(CONFIG_DVB_DRXK)
+/**
+ * Attach a drxk demod
+ *
+ * @config: pointer to &struct drxk_config with demod configuration.
+ * @i2c: i2c adapter to use.
+ *
+ * return: FE pointer on success, NULL on failure.
+ */
 extern struct dvb_frontend *drxk_attach(const struct drxk_config *config,
                                         struct i2c_adapter *i2c);
 #else
diff --git a/drivers/media/dvb-frontends/drxk_hard.c b/drivers/media/dvb-frontends/drxk_hard.c
index 48a8aad47a74..f59ac2e91c59 100644
--- a/drivers/media/dvb-frontends/drxk_hard.c
+++ b/drivers/media/dvb-frontends/drxk_hard.c
@@ -207,9 +207,9 @@ static inline u32 log10times100(u32 value)
         return (100L * intlog10(value)) >> 24;
 }
 
-/****************************************************************************/
+/***************************************************************************/
 /* I2C **********************************************************************/
-/****************************************************************************/
+/***************************************************************************/
 
 static int drxk_i2c_lock(struct drxk_state *state)
 {
@@ -3444,7 +3444,7 @@ error:
 
 /*============================================================================*/
 
-/**
+/*
 * \brief Activate DVBT specific presets
 * \param demod instance of demodulator.
 * \return DRXStatus_t.
@@ -3484,7 +3484,7 @@ error:
 
 /*============================================================================*/
 
-/**
+/*
 * \brief Initialize channelswitch-independent settings for DVBT.
 * \param demod instance of demodulator.
 * \return DRXStatus_t.
@@ -3696,7 +3696,7 @@ error:
 }
 
 /*============================================================================*/
-/**
+/*
 * \brief start dvbt demodulating for channel.
 * \param demod instance of demodulator.
 * \return DRXStatus_t.
@@ -3732,7 +3732,7 @@ error:
 
 /*============================================================================*/
 
-/**
+/*
 * \brief Set up dvbt demodulator for channel.
 * \param demod instance of demodulator.
 * \return DRXStatus_t.
@@ -4086,7 +4086,7 @@ error:
 
 /*============================================================================*/
 
-/**
+/*
 * \brief Retrieve lock status .
 * \param demod    Pointer to demodulator instance.
 * \param lockStat Pointer to lock status structure.
@@ -4148,7 +4148,7 @@ static int power_up_qam(struct drxk_state *state)
 }
 
 
-/** Power Down QAM */
+/* Power Down QAM */
 static int power_down_qam(struct drxk_state *state)
 {
         u16 data = 0;
@@ -4186,7 +4186,7 @@ error:
 
 /*============================================================================*/
 
-/**
+/*
 * \brief Setup of the QAM Measurement intervals for signal quality
 * \param demod instance of demod.
 * \param modulation current modulation.
@@ -4461,7 +4461,7 @@ error:
 
 /*============================================================================*/
 
-/**
+/*
 * \brief QAM32 specific setup
 * \param demod instance of demod.
 * \return DRXStatus_t.
@@ -4657,7 +4657,7 @@ error:
 
 /*============================================================================*/
 
-/**
+/*
 * \brief QAM64 specific setup
 * \param demod instance of demod.
 * \return DRXStatus_t.
@@ -4852,7 +4852,7 @@ error:
 
 /*============================================================================*/
 
-/**
+/*
 * \brief QAM128 specific setup
 * \param demod: instance of demod.
 * \return DRXStatus_t.
@@ -5049,7 +5049,7 @@ error:
 
 /*============================================================================*/
 
-/**
+/*
 * \brief QAM256 specific setup
 * \param demod: instance of demod.
 * \return DRXStatus_t.
@@ -5244,7 +5244,7 @@ error:
 
 
 /*============================================================================*/
-/**
+/*
 * \brief Reset QAM block.
 * \param demod:   instance of demod.
 * \param channel: pointer to channel data.
@@ -5272,7 +5272,7 @@ error:
 
 /*============================================================================*/
 
-/**
+/*
 * \brief Set QAM symbolrate.
 * \param demod:   instance of demod.
 * \param channel: pointer to channel data.
@@ -5341,7 +5341,7 @@ error:
 
 /*============================================================================*/
 
-/**
+/*
 * \brief Get QAM lock status.
 * \param demod:   instance of demod.
 * \param channel: pointer to channel data.
diff --git a/drivers/media/dvb-frontends/dvb-pll.h b/drivers/media/dvb-frontends/dvb-pll.h
index 6aaa9c6bff9c..212e0730f154 100644
--- a/drivers/media/dvb-frontends/dvb-pll.h
+++ b/drivers/media/dvb-frontends/dvb-pll.h
@@ -30,16 +30,17 @@
 #define DVB_PLL_TDEE4                  18
 #define DVB_PLL_THOMSON_DTT7520X       19
 
+#if IS_REACHABLE(CONFIG_DVB_PLL)
 /**
  * Attach a dvb-pll to the supplied frontend structure.
  *
- * @param fe Frontend to attach to.
- * @param pll_addr i2c address of the PLL (if used).
- * @param i2c i2c adapter to use (set to NULL if not used).
- * @param pll_desc_id dvb_pll_desc to use.
- * @return Frontend pointer on success, NULL on failure
+ * @fe: Frontend to attach to.
+ * @pll_addr: i2c address of the PLL (if used).
+ * @i2c: i2c adapter to use (set to NULL if not used).
+ * @pll_desc_id: dvb_pll_desc to use.
+ *
+ * return: Frontend pointer on success, NULL on failure
  */
-#if IS_REACHABLE(CONFIG_DVB_PLL)
 extern struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe,
                                            int pll_addr,
                                            struct i2c_adapter *i2c,
diff --git a/drivers/media/dvb-frontends/helene.h b/drivers/media/dvb-frontends/helene.h
index 333615491d9e..c9fc81c7e4e7 100644
--- a/drivers/media/dvb-frontends/helene.h
+++ b/drivers/media/dvb-frontends/helene.h
@@ -38,6 +38,7 @@ enum helene_xtal {
  * @set_tuner_priv:     Callback function private context
  * @set_tuner_callback: Callback function that notifies the parent driver
  *                      which tuner is active now
+ * @xtal: Cristal frequency as described by &enum helene_xtal
  */
 struct helene_config {
         u8      i2c_address;
@@ -48,9 +49,31 @@ struct helene_config {
 };
 
 #if IS_REACHABLE(CONFIG_DVB_HELENE)
+/**
+ * Attach a helene tuner (terrestrial and cable standards)
+ *
+ * @fe: frontend to be attached
+ * @config: pointer to &struct helene_config with tuner configuration.
+ * @i2c: i2c adapter to use.
+ *
+ * return: FE pointer on success, NULL on failure.
+ */
 extern struct dvb_frontend *helene_attach(struct dvb_frontend *fe,
                                         const struct helene_config *config,
                                         struct i2c_adapter *i2c);
+
+/**
+ * Attach a helene tuner (satellite standards)
+ *
+ * @fe: frontend to be attached
+ * @config: pointer to &struct helene_config with tuner configuration.
+ * @i2c: i2c adapter to use.
+ *
+ * return: FE pointer on success, NULL on failure.
+ */
+extern struct dvb_frontend *helene_attach_s(struct dvb_frontend *fe,
+                                        const struct helene_config *config,
+                                        struct i2c_adapter *i2c);
 #else
 static inline struct dvb_frontend *helene_attach(struct dvb_frontend *fe,
                                         const struct helene_config *config,
@@ -59,13 +82,6 @@ static inline struct dvb_frontend *helene_attach(struct dvb_frontend *fe,
         pr_warn("%s: driver disabled by Kconfig\n", __func__);
         return NULL;
 }
-#endif
-
-#if IS_REACHABLE(CONFIG_DVB_HELENE)
-extern struct dvb_frontend *helene_attach_s(struct dvb_frontend *fe,
-                                        const struct helene_config *config,
-                                        struct i2c_adapter *i2c);
-#else
 static inline struct dvb_frontend *helene_attach_s(struct dvb_frontend *fe,
                                         const struct helene_config *config,
                                         struct i2c_adapter *i2c)
diff --git a/drivers/media/dvb-frontends/horus3a.h b/drivers/media/dvb-frontends/horus3a.h
index 672a556df71a..9157fd037e2f 100644
--- a/drivers/media/dvb-frontends/horus3a.h
+++ b/drivers/media/dvb-frontends/horus3a.h
@@ -41,6 +41,15 @@ struct horus3a_config {
 };
 
 #if IS_REACHABLE(CONFIG_DVB_HORUS3A)
+/**
+ * Attach a horus3a tuner
+ *
+ * @fe: frontend to be attached
+ * @config: pointer to &struct helene_config with tuner configuration.
+ * @i2c: i2c adapter to use.
+ *
+ * return: FE pointer on success, NULL on failure.
+ */
 extern struct dvb_frontend *horus3a_attach(struct dvb_frontend *fe,
                                         const struct horus3a_config *config,
                                         struct i2c_adapter *i2c);
diff --git a/drivers/media/dvb-frontends/ix2505v.c b/drivers/media/dvb-frontends/ix2505v.c
index 534b24fa2b95..965012ad5c59 100644
--- a/drivers/media/dvb-frontends/ix2505v.c
+++ b/drivers/media/dvb-frontends/ix2505v.c
@@ -1,4 +1,4 @@
-/**
+/*
  * Driver for Sharp IX2505V (marked B0017) DVB-S silicon tuner
  *
  * Copyright (C) 2010 Malcolm Priestley
@@ -36,7 +36,7 @@ struct ix2505v_state {
         u32 frequency;
 };
 
-/**
+/*
  *  Data read format of the Sharp IX2505V B0017
  *
  *  byte1:   1   |   1   |   0   |   0   |   0   |  MA1  |  MA0  |  1
@@ -99,7 +99,7 @@ static void ix2505v_release(struct dvb_frontend *fe)
 
 }
 
-/**
+/*
  *  Data write format of the Sharp IX2505V B0017
  *
  *  byte1:   1   |   1   |   0   |   0   |   0   | 0(MA1)| 0(MA0)|  0
diff --git a/drivers/media/dvb-frontends/ix2505v.h b/drivers/media/dvb-frontends/ix2505v.h
index 0b0a431c74f6..49ed93e754ed 100644
--- a/drivers/media/dvb-frontends/ix2505v.h
+++ b/drivers/media/dvb-frontends/ix2505v.h
@@ -20,31 +20,33 @@
 #include "dvb_frontend.h"
 
 /**
- * Attach a ix2505v tuner to the supplied frontend structure.
+ * struct ix2505v_config - ix2505 attachment configuration
  *
- * @param fe Frontend to attach to.
- * @param config ix2505v_config structure
- * @return FE pointer on success, NULL on failure.
+ * @tuner_address: tuner address
+ * @tuner_gain: Baseband AMP gain control 0/1=0dB(default) 2=-2bB 3=-4dB
+ * @tuner_chargepump: Charge pump output +/- 0=120 1=260 2=555 3=1200(default)
+ * @min_delay_ms: delay after tune
+ * @tuner_write_only: disables reads
  */
-
 struct ix2505v_config {
         u8 tuner_address;
-
-        /*Baseband AMP gain control 0/1=0dB(default) 2=-2bB 3=-4dB */
         u8 tuner_gain;
-
-        /*Charge pump output +/- 0=120 1=260 2=555 3=1200(default) */
         u8 tuner_chargepump;
-
-        /* delay after tune */
         int min_delay_ms;
-
-        /* disables reads*/
         u8 tuner_write_only;
 
 };
 
 #if IS_REACHABLE(CONFIG_DVB_IX2505V)
+/**
+ * Attach a ix2505v tuner to the supplied frontend structure.
+ *
+ * @fe: Frontend to attach to.
+ * @config: pointer to &struct ix2505v_config
+ * @i2c: pointer to &struct i2c_adapter.
+ *
+ * return: FE pointer on success, NULL on failure.
+ */
 extern struct dvb_frontend *ix2505v_attach(struct dvb_frontend *fe,
         const struct ix2505v_config *config, struct i2c_adapter *i2c);
 #else
diff --git a/drivers/media/dvb-frontends/l64781.c b/drivers/media/dvb-frontends/l64781.c
index 68923c84679a..e5a6c1766664 100644
--- a/drivers/media/dvb-frontends/l64781.c
+++ b/drivers/media/dvb-frontends/l64781.c
@@ -517,7 +517,7 @@ struct dvb_frontend* l64781_attach(const struct l64781_config* config,
         state->i2c = i2c;
         state->first = 1;
 
-        /**
+        /*
          *  the L64781 won't show up before we send the reset_and_configure()
          *  broadcast. If nothing responds there is no L64781 on the bus...
          */
diff --git a/drivers/media/dvb-frontends/m88ds3103.h b/drivers/media/dvb-frontends/m88ds3103.h
index 04b355a005fb..1a8964a2265d 100644
--- a/drivers/media/dvb-frontends/m88ds3103.h
+++ b/drivers/media/dvb-frontends/m88ds3103.h
@@ -25,6 +25,34 @@
  */
 
 /**
+ * enum m88ds3103_ts_mode - TS connection mode
+ * @M88DS3103_TS_SERIAL:        TS output pin D0, normal
+ * @M88DS3103_TS_SERIAL_D7:     TS output pin D7
+ * @M88DS3103_TS_PARALLEL:      TS Parallel mode
+ * @M88DS3103_TS_CI:            TS CI Mode
+ */
+enum m88ds3103_ts_mode {
+        M88DS3103_TS_SERIAL,
+        M88DS3103_TS_SERIAL_D7,
+        M88DS3103_TS_PARALLEL,
+        M88DS3103_TS_CI
+};
+
+/**
+ * enum m88ds3103_clock_out
+ * @M88DS3103_CLOCK_OUT_DISABLED:       Clock output is disabled
+ * @M88DS3103_CLOCK_OUT_ENABLED:        Clock output is enabled with crystal
+ *                                      clock.
+ * @M88DS3103_CLOCK_OUT_ENABLED_DIV2:   Clock output is enabled with half
+ *                                      crystal clock.
+ */
+enum m88ds3103_clock_out {
+        M88DS3103_CLOCK_OUT_DISABLED,
+        M88DS3103_CLOCK_OUT_ENABLED,
+        M88DS3103_CLOCK_OUT_ENABLED_DIV2
+};
+
+/**
  * struct m88ds3103_platform_data - Platform data for the m88ds3103 driver
  * @clk: Clock frequency.
  * @i2c_wr_max: Max bytes I2C adapter can write at once.
@@ -44,24 +72,16 @@
  * @get_dvb_frontend: Get DVB frontend.
  * @get_i2c_adapter: Get I2C adapter.
  */
-
 struct m88ds3103_platform_data {
         u32 clk;
         u16 i2c_wr_max;
-#define M88DS3103_TS_SERIAL             0 /* TS output pin D0, normal */
-#define M88DS3103_TS_SERIAL_D7          1 /* TS output pin D7 */
-#define M88DS3103_TS_PARALLEL           2 /* TS Parallel mode */
-#define M88DS3103_TS_CI                 3 /* TS CI Mode */
-        u8 ts_mode:2;
+        enum m88ds3103_ts_mode ts_mode;
         u32 ts_clk;
+        enum m88ds3103_clock_out clk_out;
         u8 ts_clk_pol:1;
         u8 spec_inv:1;
         u8 agc;
         u8 agc_inv:1;
-#define M88DS3103_CLOCK_OUT_DISABLED        0
-#define M88DS3103_CLOCK_OUT_ENABLED         1
-#define M88DS3103_CLOCK_OUT_ENABLED_DIV2    2
-        u8 clk_out:2;
         u8 envelope_mode:1;
         u8 lnb_hv_pol:1;
         u8 lnb_en_pol:1;
@@ -73,105 +93,60 @@ struct m88ds3103_platform_data {
         u8 attach_in_use:1;
 };
 
-/*
- * Do not add new m88ds3103_attach() users! Use I2C bindings instead.
+/**
+ * struct m88ds3103_config - m88ds3102 configuration
+ *
+ * @i2c_addr:   I2C address. Default: none, must set. Example: 0x68, ...
+ * @clock:      Device's clock. Default: none, must set. Example: 27000000
+ * @i2c_wr_max: Max bytes I2C provider is asked to write at once.
+ *              Default: none, must set. Example: 33, 65, ...
+ * @ts_mode:    TS output mode, as defined by &enum m88ds3103_ts_mode.
+ *              Default: M88DS3103_TS_SERIAL.
+ * @ts_clk:     TS clk in KHz. Default: 0.
+ * @ts_clk_pol: TS clk polarity.Default: 0.
+ *              1-active at falling edge; 0-active at rising edge.
+ * @spec_inv:   Spectrum inversion. Default: 0.
+ * @agc_inv:    AGC polarity. Default: 0.
+ * @clock_out:  Clock output, as defined by &enum m88ds3103_clock_out.
+ *              Default: M88DS3103_CLOCK_OUT_DISABLED.
+ * @envelope_mode: DiSEqC envelope mode. Default: 0.
+ * @agc:        AGC configuration. Default: none, must set.
+ * @lnb_hv_pol: LNB H/V pin polarity. Default: 0. Values:
+ *              1: pin high set to VOLTAGE_13, pin low to set VOLTAGE_18;
+ *              0: pin high set to VOLTAGE_18, pin low to set VOLTAGE_13.
+ * @lnb_en_pol: LNB enable pin polarity. Default: 0. Values:
+ *              1: pin high to enable, pin low to disable;
+ *              0: pin high to disable, pin low to enable.
  */
 struct m88ds3103_config {
-        /*
-         * I2C address
-         * Default: none, must set
-         * 0x68, ...
-         */
         u8 i2c_addr;
-
-        /*
-         * clock
-         * Default: none, must set
-         * 27000000
-         */
         u32 clock;
-
-        /*
-         * max bytes I2C provider is asked to write at once
-         * Default: none, must set
-         * 33, 65, ...
-         */
         u16 i2c_wr_max;
-
-        /*
-         * TS output mode
-         * Default: M88DS3103_TS_SERIAL
-         */
-#define M88DS3103_TS_SERIAL             0 /* TS output pin D0, normal */
-#define M88DS3103_TS_SERIAL_D7          1 /* TS output pin D7 */
-#define M88DS3103_TS_PARALLEL           2 /* TS Parallel mode */
-#define M88DS3103_TS_CI                 3 /* TS CI Mode */
         u8 ts_mode;
-
-        /*
-         * TS clk in KHz
-         * Default: 0.
-         */
         u32 ts_clk;
-
-        /*
-         * TS clk polarity.
-         * Default: 0. 1-active at falling edge; 0-active at rising edge.
-         */
         u8 ts_clk_pol:1;
-
-        /*
-         * spectrum inversion
-         * Default: 0
-         */
         u8 spec_inv:1;
-
-        /*
-         * AGC polarity
-         * Default: 0
-         */
         u8 agc_inv:1;
-
-        /*
-         * clock output
-         * Default: M88DS3103_CLOCK_OUT_DISABLED
-         */
-#define M88DS3103_CLOCK_OUT_DISABLED        0
-#define M88DS3103_CLOCK_OUT_ENABLED         1
-#define M88DS3103_CLOCK_OUT_ENABLED_DIV2    2
         u8 clock_out;
-
-        /*
-         * DiSEqC envelope mode
-         * Default: 0
-         */
         u8 envelope_mode:1;
-
-        /*
-         * AGC configuration
-         * Default: none, must set
-         */
         u8 agc;
-
-        /*
-         * LNB H/V pin polarity
-         * Default: 0.
-         * 1: pin high set to VOLTAGE_13, pin low to set VOLTAGE_18.
-         * 0: pin high set to VOLTAGE_18, pin low to set VOLTAGE_13.
-         */
         u8 lnb_hv_pol:1;
-
-        /*
-         * LNB enable pin polarity
-         * Default: 0.
-         * 1: pin high to enable, pin low to disable.
-         * 0: pin high to disable, pin low to enable.
-         */
         u8 lnb_en_pol:1;
 };
 
 #if defined(CONFIG_DVB_M88DS3103) || \
                 (defined(CONFIG_DVB_M88DS3103_MODULE) && defined(MODULE))
+/**
+ * Attach a m88ds3103 demod
+ *
+ * @config: pointer to &struct m88ds3103_config with demod configuration.
+ * @i2c: i2c adapter to use.
+ * @tuner_i2c: on success, returns the I2C adapter associated with
+ *              m88ds3103 tuner.
+ *
+ * return: FE pointer on success, NULL on failure.
+ * Note: Do not add new m88ds3103_attach() users! Use I2C bindings instead.
+ */
 extern struct dvb_frontend *m88ds3103_attach(
                 const struct m88ds3103_config *config,
                 struct i2c_adapter *i2c,
diff --git a/drivers/media/dvb-frontends/mb86a20s.h b/drivers/media/dvb-frontends/mb86a20s.h
index dfb02db2126c..05c9725d1c5f 100644
--- a/drivers/media/dvb-frontends/mb86a20s.h
+++ b/drivers/media/dvb-frontends/mb86a20s.h
@@ -26,7 +26,6 @@
  * @demod_address:      the demodulator's i2c address
  * @is_serial:          if true, TS is serial. Otherwise, TS is parallel
  */
-
 struct mb86a20s_config {
         u32     fclk;
         u8      demod_address;
@@ -34,9 +33,17 @@ struct mb86a20s_config {
 };
 
 #if IS_REACHABLE(CONFIG_DVB_MB86A20S)
+/**
+ * Attach a mb86a20s demod
+ *
+ * @config: pointer to &struct mb86a20s_config with demod configuration.
+ * @i2c: i2c adapter to use.
+ *
+ * return: FE pointer on success, NULL on failure.
+ */
 extern struct dvb_frontend *mb86a20s_attach(const struct mb86a20s_config *config,
                                            struct i2c_adapter *i2c);
-extern struct i2c_adapter *mb86a20s_get_tuner_i2c_adapter(struct dvb_frontend *);
+
 #else
 static inline struct dvb_frontend *mb86a20s_attach(
         const struct mb86a20s_config *config, struct i2c_adapter *i2c)
@@ -44,12 +51,6 @@ static inline struct dvb_frontend *mb86a20s_attach(
         printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
         return NULL;
 }
-static inline struct i2c_adapter *
-        mb86a20s_get_tuner_i2c_adapter(struct dvb_frontend *fe)
-{
-        printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
-        return NULL;
-}
 #endif
 
 #endif /* MB86A20S */
diff --git a/drivers/media/dvb-frontends/mn88472.h b/drivers/media/dvb-frontends/mn88472.h
index 323632523876..8cd5ef61903b 100644
--- a/drivers/media/dvb-frontends/mn88472.h
+++ b/drivers/media/dvb-frontends/mn88472.h
@@ -19,21 +19,21 @@
 
 #include <linux/dvb/frontend.h>
 
+/* Define old names for backward compatibility */
+#define VARIABLE_TS_CLOCK   MN88472_TS_CLK_VARIABLE
+#define FIXED_TS_CLOCK      MN88472_TS_CLK_FIXED
+#define SERIAL_TS_MODE      MN88472_TS_MODE_SERIAL
+#define PARALLEL_TS_MODE    MN88472_TS_MODE_PARALLEL
+
 /**
  * struct mn88472_config - Platform data for the mn88472 driver
  * @xtal: Clock frequency.
  * @ts_mode: TS mode.
  * @ts_clock: TS clock config.
  * @i2c_wr_max: Max number of bytes driver writes to I2C at once.
- * @get_dvb_frontend: Get DVB frontend.
+ * @fe: pointer to a frontend pointer
+ * @get_dvb_frontend: Get DVB frontend callback.
  */
-
-/* Define old names for backward compatibility */
-#define VARIABLE_TS_CLOCK   MN88472_TS_CLK_VARIABLE
-#define FIXED_TS_CLOCK      MN88472_TS_CLK_FIXED
-#define SERIAL_TS_MODE      MN88472_TS_MODE_SERIAL
-#define PARALLEL_TS_MODE    MN88472_TS_MODE_PARALLEL
-
 struct mn88472_config {
         unsigned int xtal;
 
diff --git a/drivers/media/dvb-frontends/rtl2830.h b/drivers/media/dvb-frontends/rtl2830.h
index 0cde151e6608..458ac94e8a8b 100644
--- a/drivers/media/dvb-frontends/rtl2830.h
+++ b/drivers/media/dvb-frontends/rtl2830.h
@@ -32,7 +32,6 @@
  * @pid_filter: Set PID to PID filter.
  * @pid_filter_ctrl: Control PID filter.
  */
-
 struct rtl2830_platform_data {
         u32 clk;
         bool spec_inv;
diff --git a/drivers/media/dvb-frontends/rtl2832.h b/drivers/media/dvb-frontends/rtl2832.h
index 03c0de039fa9..6a124ff71c2b 100644
--- a/drivers/media/dvb-frontends/rtl2832.h
+++ b/drivers/media/dvb-frontends/rtl2832.h
@@ -35,7 +35,6 @@
  * @pid_filter: Set PID to PID filter.
  * @pid_filter_ctrl: Control PID filter.
  */
-
 struct rtl2832_platform_data {
         u32 clk;
         /*
diff --git a/drivers/media/dvb-frontends/rtl2832_sdr.h b/drivers/media/dvb-frontends/rtl2832_sdr.h
index d8fc7e7212e3..8f88c2fb8627 100644
--- a/drivers/media/dvb-frontends/rtl2832_sdr.h
+++ b/drivers/media/dvb-frontends/rtl2832_sdr.h
@@ -33,15 +33,11 @@
  * struct rtl2832_sdr_platform_data - Platform data for the rtl2832_sdr driver
  * @clk: Clock frequency (4000000, 16000000, 25000000, 28800000).
  * @tuner: Used tuner model.
- * @i2c_client: rtl2832 demod driver I2C client.
- * @bulk_read: rtl2832 driver private I/O interface.
- * @bulk_write: rtl2832 driver private I/O interface.
- * @update_bits: rtl2832 driver private I/O interface.
+ * @regmap: pointer to &struct regmap.
  * @dvb_frontend: rtl2832 DVB frontend.
  * @v4l2_subdev: Tuner v4l2 controls.
  * @dvb_usb_device: DVB USB interface for USB streaming.
  */
-
 struct rtl2832_sdr_platform_data {
         u32 clk;
         /*
diff --git a/drivers/media/dvb-frontends/sp887x.c b/drivers/media/dvb-frontends/sp887x.c
index 7c511c3cd4ca..d2c402b52c6e 100644
--- a/drivers/media/dvb-frontends/sp887x.c
+++ b/drivers/media/dvb-frontends/sp887x.c
@@ -57,7 +57,7 @@ static int sp887x_writereg (struct sp887x_state* state, u16 reg, u16 data)
         int ret;
 
         if ((ret = i2c_transfer(state->i2c, &msg, 1)) != 1) {
-                /**
+                /*
                  *  in case of soft reset we ignore ACK errors...
                  */
                 if (!(reg == 0xf1a && data == 0x000 &&
@@ -130,7 +130,7 @@ static void sp887x_setup_agc (struct sp887x_state* state)
 
 #define BLOCKSIZE 30
 #define FW_SIZE 0x4000
-/**
+/*
  *  load firmware and setup MPEG interface...
  */
 static int sp887x_initial_setup (struct dvb_frontend* fe, const struct firmware *fw)
@@ -279,7 +279,7 @@ static int configure_reg0xc05(struct dtv_frontend_properties *p, u16 *reg0xc05)
         return 0;
 }
 
-/**
+/*
  *  estimates division of two 24bit numbers,
  *  derived from the ves1820/stv0299 driver code
  */
diff --git a/drivers/media/dvb-frontends/stb6000.h b/drivers/media/dvb-frontends/stb6000.h
index 78e75dfc317f..e94a3d5facf6 100644
--- a/drivers/media/dvb-frontends/stb6000.h
+++ b/drivers/media/dvb-frontends/stb6000.h
@@ -26,15 +26,16 @@
 #include <linux/i2c.h>
 #include "dvb_frontend.h"
 
+#if IS_REACHABLE(CONFIG_DVB_STB6000)
 /**
  * Attach a stb6000 tuner to the supplied frontend structure.
  *
- * @param fe Frontend to attach to.
- * @param addr i2c address of the tuner.
- * @param i2c i2c adapter to use.
- * @return FE pointer on success, NULL on failure.
+ * @fe: Frontend to attach to.
+ * @addr: i2c address of the tuner.
+ * @i2c: i2c adapter to use.
+ *
+ * return: FE pointer on success, NULL on failure.
  */
-#if IS_REACHABLE(CONFIG_DVB_STB6000)
 extern struct dvb_frontend *stb6000_attach(struct dvb_frontend *fe, int addr,
                                            struct i2c_adapter *i2c);
 #else
diff --git a/drivers/media/dvb-frontends/stv0299.c b/drivers/media/dvb-frontends/stv0299.c
index b36b21a13201..b1f3d675d316 100644
--- a/drivers/media/dvb-frontends/stv0299.c
+++ b/drivers/media/dvb-frontends/stv0299.c
@@ -368,7 +368,7 @@ static int stv0299_set_voltage(struct dvb_frontend *fe,
         reg0x08 = stv0299_readreg (state, 0x08);
         reg0x0c = stv0299_readreg (state, 0x0c);
 
-        /**
+        /*
          *  H/V switching over OP0, OP1 and OP2 are LNB power enable bits
          */
         reg0x0c &= 0x0f;
diff --git a/drivers/media/dvb-frontends/tda10071.h b/drivers/media/dvb-frontends/tda10071.h
index 8f184026ee11..da1a87bc1603 100644
--- a/drivers/media/dvb-frontends/tda10071.h
+++ b/drivers/media/dvb-frontends/tda10071.h
@@ -38,7 +38,6 @@
  * @tuner_i2c_addr: CX24118A tuner I2C address (0x14, 0x54, ...).
  * @get_dvb_frontend: Get DVB frontend.
  */
-
 struct tda10071_platform_data {
         u32 clk;
         u16 i2c_wr_max;
diff --git a/drivers/media/dvb-frontends/tda826x.h b/drivers/media/dvb-frontends/tda826x.h
index 81abe1aebe9f..6a7bed12e741 100644
--- a/drivers/media/dvb-frontends/tda826x.h
+++ b/drivers/media/dvb-frontends/tda826x.h
@@ -29,11 +29,12 @@
 /**
  * Attach a tda826x tuner to the supplied frontend structure.
  *
- * @param fe Frontend to attach to.
- * @param addr i2c address of the tuner.
- * @param i2c i2c adapter to use.
- * @param has_loopthrough Set to 1 if the card has a loopthrough RF connector.
- * @return FE pointer on success, NULL on failure.
+ * @fe: Frontend to attach to.
+ * @addr: i2c address of the tuner.
+ * @i2c: i2c adapter to use.
+ * @has_loopthrough: Set to 1 if the card has a loopthrough RF connector.
+ *
+ * return: FE pointer on success, NULL on failure.
  */
 #if IS_REACHABLE(CONFIG_DVB_TDA826X)
 extern struct dvb_frontend* tda826x_attach(struct dvb_frontend *fe, int addr,
diff --git a/drivers/media/dvb-frontends/tua6100.c b/drivers/media/dvb-frontends/tua6100.c
index 18e6d4c5be21..1d41abd47f04 100644
--- a/drivers/media/dvb-frontends/tua6100.c
+++ b/drivers/media/dvb-frontends/tua6100.c
@@ -1,4 +1,4 @@
-/**
+/*
  * Driver for Infineon tua6100 pll.
  *
  * (c) 2006 Andrew de Quincey
diff --git a/drivers/media/dvb-frontends/tua6100.h b/drivers/media/dvb-frontends/tua6100.h
index 9f15cbdfdeca..6c098a894ea6 100644
--- a/drivers/media/dvb-frontends/tua6100.h
+++ b/drivers/media/dvb-frontends/tua6100.h
@@ -1,4 +1,4 @@
-/**
+/*
  * Driver for Infineon tua6100 PLL.
  *
  * (c) 2006 Andrew de Quincey
diff --git a/drivers/media/dvb-frontends/zd1301_demod.h b/drivers/media/dvb-frontends/zd1301_demod.h
index ceb2e05e873c..6cd8f6f9c415 100644
--- a/drivers/media/dvb-frontends/zd1301_demod.h
+++ b/drivers/media/dvb-frontends/zd1301_demod.h
@@ -27,7 +27,6 @@
  * @reg_read: Register read callback.
  * @reg_write: Register write callback.
  */
-
 struct zd1301_demod_platform_data {
         void *reg_priv;
         int (*reg_read)(void *, u16, u8 *);
@@ -41,8 +40,7 @@ struct zd1301_demod_platform_data {
  *
  * Return: Pointer to DVB frontend which given platform device owns.
  */
-
-struct dvb_frontend *zd1301_demod_get_dvb_frontend(struct platform_device *);
+struct dvb_frontend *zd1301_demod_get_dvb_frontend(struct platform_device *pdev);
 
 /**
  * zd1301_demod_get_i2c_adapter() - Get pointer to I2C adapter
@@ -50,11 +48,16 @@ struct dvb_frontend *zd1301_demod_get_dvb_frontend(struct platform_device *);
  *
  * Return: Pointer to I2C adapter which given platform device owns.
  */
-
-struct i2c_adapter *zd1301_demod_get_i2c_adapter(struct platform_device *);
+struct i2c_adapter *zd1301_demod_get_i2c_adapter(struct platform_device *pdev);
 
 #else
 
+/**
+ * zd1301_demod_get_dvb_frontend() - Attach a zd1301 frontend
+ * @dev: Pointer to platform device
+ *
+ * Return: Pointer to %struct dvb_frontend or NULL if attach fails.
+ */
 static inline struct dvb_frontend *zd1301_demod_get_dvb_frontend(struct platform_device *dev)
 {
         printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
diff --git a/drivers/media/dvb-frontends/zl10036.c b/drivers/media/dvb-frontends/zl10036.c
index 062282739ce5..89dd65ae88ad 100644
--- a/drivers/media/dvb-frontends/zl10036.c
+++ b/drivers/media/dvb-frontends/zl10036.c
@@ -1,4 +1,4 @@
-/**
+/*
  * Driver for Zarlink zl10036 DVB-S silicon tuner
  *
  * Copyright (C) 2006 Tino Reichardt
@@ -157,7 +157,7 @@ static int zl10036_sleep(struct dvb_frontend *fe)
         return ret;
 }
 
-/**
+/*
  * register map of the ZL10036/ZL10038
  *
  * reg[default] content
@@ -219,7 +219,7 @@ static int zl10036_set_bandwidth(struct zl10036_state *state, u32 fbw)
         if (fbw <= 28820) {
                 br = _BR_MAXIMUM;
         } else {
-                /**
+                /*
                  *  f(bw)=34,6MHz f(xtal)=10.111MHz
                  *  br = (10111/34600) * 63 * 1/K = 14;
                  */
@@ -315,7 +315,7 @@ static int zl10036_set_params(struct dvb_frontend *fe)
         ||  (frequency > fe->ops.info.frequency_max))
                 return -EINVAL;
 
-        /**
+        /*
          * alpha = 1.35 for dvb-s
          * fBW = (alpha*symbolrate)/(2*0.8)
          * 1.35 / (2*0.8) = 27 / 32
diff --git a/drivers/media/dvb-frontends/zl10036.h b/drivers/media/dvb-frontends/zl10036.h
index 88751adfecf7..ec90ca927739 100644
--- a/drivers/media/dvb-frontends/zl10036.h
+++ b/drivers/media/dvb-frontends/zl10036.h
@@ -20,20 +20,20 @@
 #include <linux/i2c.h>
 #include "dvb_frontend.h"
 
-/**
- * Attach a zl10036 tuner to the supplied frontend structure.
- *
- * @param fe Frontend to attach to.
- * @param config zl10036_config structure
- * @return FE pointer on success, NULL on failure.
- */
-
 struct zl10036_config {
         u8 tuner_address;
         int rf_loop_enable;
 };
 
 #if IS_REACHABLE(CONFIG_DVB_ZL10036)
+/**
+ * Attach a zl10036 tuner to the supplied frontend structure.
+ *
+ * @fe: Frontend to attach to.
+ * @config: zl10036_config structure.
+ * @i2c: pointer to struct i2c_adapter.
+ * return: FE pointer on success, NULL on failure.
+ */
 extern struct dvb_frontend *zl10036_attach(struct dvb_frontend *fe,
         const struct zl10036_config *config, struct i2c_adapter *i2c);
 #else
diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
index 3c6d6428f525..cb5d7ff82915 100644
--- a/drivers/media/i2c/Kconfig
+++ b/drivers/media/i2c/Kconfig
@@ -676,6 +676,7 @@ config VIDEO_OV13858
         tristate "OmniVision OV13858 sensor support"
         depends on I2C && VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
         depends on MEDIA_CAMERA_SUPPORT
+        select V4L2_FWNODE
         ---help---
           This is a Video4Linux2 sensor-level driver for the OmniVision
           OV13858 camera.
diff --git a/drivers/media/i2c/et8ek8/Kconfig b/drivers/media/i2c/et8ek8/Kconfig
index 14399365ad7f..9fe409e95666 100644
--- a/drivers/media/i2c/et8ek8/Kconfig
+++ b/drivers/media/i2c/et8ek8/Kconfig
@@ -1,6 +1,7 @@
 config VIDEO_ET8EK8
         tristate "ET8EK8 camera sensor support"
         depends on I2C && VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
+        select V4L2_FWNODE
         ---help---
           This is a driver for the Toshiba ET8EK8 5 MP camera sensor.
           It is used for example in Nokia N900 (RX-51).
diff --git a/drivers/media/i2c/imx274.c b/drivers/media/i2c/imx274.c
index 800b9bf9cdd3..2f71af2f90bf 100644
--- a/drivers/media/i2c/imx274.c
+++ b/drivers/media/i2c/imx274.c
@@ -1770,8 +1770,7 @@ static int imx274_probe(struct i2c_client *client,
         return 0;
 
 err_ctrls:
-        v4l2_async_unregister_subdev(sd);
-        v4l2_ctrl_handler_free(sd->ctrl_handler);
+        v4l2_ctrl_handler_free(&imx274->ctrls.handler);
 err_me:
         media_entity_cleanup(&sd->entity);
 err_regmap:
@@ -1788,7 +1787,7 @@ static int imx274_remove(struct i2c_client *client)
         imx274_write_table(imx274, mode_table[IMX274_MODE_STOP_STREAM]);
 
         v4l2_async_unregister_subdev(sd);
-        v4l2_ctrl_handler_free(sd->ctrl_handler);
+        v4l2_ctrl_handler_free(&imx274->ctrls.handler);
         media_entity_cleanup(&sd->entity);
         mutex_destroy(&imx274->lock);
         return 0;
diff --git a/drivers/media/i2c/lm3560.c b/drivers/media/i2c/lm3560.c
index 251a2aaf98c3..b600e03aa94b 100644
--- a/drivers/media/i2c/lm3560.c
+++ b/drivers/media/i2c/lm3560.c
@@ -50,6 +50,7 @@ enum led_enable {
 /**
  * struct lm3560_flash
  *
+ * @dev: pointer to &struct device
  * @pdata: platform data
  * @regmap: reg. map for i2c
  * @lock: muxtex for serial access.
diff --git a/drivers/media/i2c/m5mols/m5mols_capture.c b/drivers/media/i2c/m5mols/m5mols_capture.c
index a0cd6dc32eb0..0fb457f57995 100644
--- a/drivers/media/i2c/m5mols/m5mols_capture.c
+++ b/drivers/media/i2c/m5mols/m5mols_capture.c
@@ -33,6 +33,10 @@
 
 /**
  * m5mols_read_rational - I2C read of a rational number
+ * @sd: sub-device, as pointed by struct v4l2_subdev
+ * @addr_num: numerator register
+ * @addr_den: denominator register
+ * @val: place to store the division result
  *
  * Read numerator and denominator from registers @addr_num and @addr_den
  * respectively and return the division result in @val.
@@ -53,6 +57,7 @@ static int m5mols_read_rational(struct v4l2_subdev *sd, u32 addr_num,
 
 /**
  * m5mols_capture_info - Gather captured image information
+ * @info: M-5MOLS driver data structure
  *
  * For now it gathers only EXIF information and file size.
  */
diff --git a/drivers/media/i2c/m5mols/m5mols_controls.c b/drivers/media/i2c/m5mols/m5mols_controls.c
index c2218c0a9e6f..82eab7c2bc8c 100644
--- a/drivers/media/i2c/m5mols/m5mols_controls.c
+++ b/drivers/media/i2c/m5mols/m5mols_controls.c
@@ -126,6 +126,7 @@ static struct m5mols_scenemode m5mols_default_scenemode[] = {
 
 /**
  * m5mols_do_scenemode() - Change current scenemode
+ * @info: M-5MOLS driver data structure
  * @mode:       Desired mode of the scenemode
  *
  * WARNING: The execution order is important. Do not change the order.
diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c
index 463534d44756..12e79f9e32d5 100644
--- a/drivers/media/i2c/m5mols/m5mols_core.c
+++ b/drivers/media/i2c/m5mols/m5mols_core.c
@@ -114,7 +114,8 @@ static const struct m5mols_resolution m5mols_reg_res[] = {
 
 /**
  * m5mols_swap_byte - an byte array to integer conversion function
- * @size: size in bytes of I2C packet defined in the M-5MOLS datasheet
+ * @data: byte array
+ * @length: size in bytes of I2C packet defined in the M-5MOLS datasheet
  *
  * Convert I2C data byte array with performing any required byte
  * reordering to assure proper values for each data type, regardless
@@ -132,8 +133,9 @@ static u32 m5mols_swap_byte(u8 *data, u8 length)
 
 /**
  * m5mols_read -  I2C read function
- * @reg: combination of size, category and command for the I2C packet
+ * @sd: sub-device, as pointed by struct v4l2_subdev
  * @size: desired size of I2C packet
+ * @reg: combination of size, category and command for the I2C packet
  * @val: read value
  *
  * Returns 0 on success, or else negative errno.
@@ -232,6 +234,7 @@ int m5mols_read_u32(struct v4l2_subdev *sd, u32 reg, u32 *val)
 
 /**
  * m5mols_write - I2C command write function
+ * @sd: sub-device, as pointed by struct v4l2_subdev
  * @reg: combination of size, category and command for the I2C packet
  * @val: value to write
  *
@@ -284,6 +287,7 @@ int m5mols_write(struct v4l2_subdev *sd, u32 reg, u32 val)
 
 /**
  * m5mols_busy_wait - Busy waiting with I2C register polling
+ * @sd: sub-device, as pointed by struct v4l2_subdev
  * @reg: the I2C_REG() address of an 8-bit status register to check
  * @value: expected status register value
  * @mask: bit mask for the read status register value
@@ -316,6 +320,8 @@ int m5mols_busy_wait(struct v4l2_subdev *sd, u32 reg, u32 value, u32 mask,
 
 /**
  * m5mols_enable_interrupt - Clear interrupt pending bits and unmask interrupts
+ * @sd: sub-device, as pointed by struct v4l2_subdev
+ * @reg: combination of size, category and command for the I2C packet
  *
  * Before writing desired interrupt value the INT_FACTOR register should
  * be read to clear pending interrupts.
@@ -349,6 +355,8 @@ int m5mols_wait_interrupt(struct v4l2_subdev *sd, u8 irq_mask, u32 timeout)
 
 /**
  * m5mols_reg_mode - Write the mode and check busy status
+ * @sd: sub-device, as pointed by struct v4l2_subdev
+ * @mode: the required operation mode
  *
  * It always accompanies a little delay changing the M-5MOLS mode, so it is
  * needed checking current busy status to guarantee right mode.
@@ -364,6 +372,7 @@ static int m5mols_reg_mode(struct v4l2_subdev *sd, u8 mode)
 
 /**
  * m5mols_set_mode - set the M-5MOLS controller mode
+ * @info: M-5MOLS driver data structure
  * @mode: the required operation mode
  *
  * The commands of M-5MOLS are grouped into specific modes. Each functionality
@@ -421,6 +430,7 @@ int m5mols_set_mode(struct m5mols_info *info, u8 mode)
 
 /**
  * m5mols_get_version - retrieve full revisions information of M-5MOLS
+ * @sd: sub-device, as pointed by struct v4l2_subdev
  *
  * The version information includes revisions of hardware and firmware,
  * AutoFocus alghorithm version and the version string.
@@ -489,6 +499,7 @@ static enum m5mols_restype __find_restype(u32 code)
 
 /**
  * __find_resolution - Lookup preset and type of M-5MOLS's resolution
+ * @sd: sub-device, as pointed by struct v4l2_subdev
  * @mf: pixel format to find/negotiate the resolution preset for
  * @type: M-5MOLS resolution type
  * @resolution: M-5MOLS resolution preset register value
@@ -662,6 +673,7 @@ static const struct v4l2_subdev_pad_ops m5mols_pad_ops = {
 
 /**
  * m5mols_restore_controls - Apply current control values to the registers
+ * @info: M-5MOLS driver data structure
  *
  * m5mols_do_scenemode() handles all parameters for which there is yet no
  * individual control. It should be replaced at some point by setting each
@@ -686,6 +698,7 @@ int m5mols_restore_controls(struct m5mols_info *info)
 
 /**
  * m5mols_start_monitor - Start the monitor mode
+ * @info: M-5MOLS driver data structure
  *
  * Before applying the controls setup the resolution and frame rate
  * in PARAMETER mode, and then switch over to MONITOR mode.
@@ -789,6 +802,7 @@ int __attribute__ ((weak)) m5mols_update_fw(struct v4l2_subdev *sd,
 
 /**
  * m5mols_fw_start - M-5MOLS internal ARM controller initialization
+ * @sd: sub-device, as pointed by struct v4l2_subdev
  *
  * Execute the M-5MOLS internal ARM controller initialization sequence.
  * This function should be called after the supply voltage has been
@@ -844,6 +858,8 @@ static int m5mols_auto_focus_stop(struct m5mols_info *info)
 
 /**
  * m5mols_s_power - Main sensor power control function
+ * @sd: sub-device, as pointed by struct v4l2_subdev
+ * @on: if true, powers on the device; powers off otherwise.
  *
  * To prevent breaking the lens when the sensor is powered off the Soft-Landing
  * algorithm is called where available. The Soft-Landing algorithm availability
diff --git a/drivers/media/i2c/ov5647.c b/drivers/media/i2c/ov5647.c
index 34179d232a35..da39c49de503 100644
--- a/drivers/media/i2c/ov5647.c
+++ b/drivers/media/i2c/ov5647.c
@@ -428,8 +428,8 @@ static int ov5647_sensor_set_register(struct v4l2_subdev *sd,
 }
 #endif
 
-/**
- * @short Subdev core operations registration
+/*
+ * Subdev core operations registration
  */
 static const struct v4l2_subdev_core_ops ov5647_subdev_core_ops = {
         .s_power                = ov5647_sensor_power,
diff --git a/drivers/media/i2c/s5k6a3.c b/drivers/media/i2c/s5k6a3.c
index 67dcca76f981..2e140272794b 100644
--- a/drivers/media/i2c/s5k6a3.c
+++ b/drivers/media/i2c/s5k6a3.c
@@ -53,6 +53,9 @@ enum {
  * @gpio_reset: GPIO connected to the sensor's reset pin
  * @lock: mutex protecting the structure's members below
  * @format: media bus format at the sensor's source pad
+ * @clock: pointer to &struct clk.
+ * @clock_frequency: clock frequency
+ * @power_count: stores state if device is powered
  */
 struct s5k6a3 {
         struct device *dev;
diff --git a/drivers/media/i2c/s5k6aa.c b/drivers/media/i2c/s5k6aa.c
index 9fd254a8e20d..13c10b5e2b45 100644
--- a/drivers/media/i2c/s5k6aa.c
+++ b/drivers/media/i2c/s5k6aa.c
@@ -421,6 +421,7 @@ static int s5k6aa_set_ahb_address(struct i2c_client *client)
 
 /**
  * s5k6aa_configure_pixel_clock - apply ISP main clock/PLL configuration
+ * @s5k6aa: pointer to &struct s5k6aa describing the device
  *
  * Configure the internal ISP PLL for the required output frequency.
  * Locking: called with s5k6aa.lock mutex held.
@@ -669,6 +670,7 @@ static int s5k6aa_set_input_params(struct s5k6aa *s5k6aa)
 
 /**
  * s5k6aa_configure_video_bus - configure the video output interface
+ * @s5k6aa: pointer to &struct s5k6aa describing the device
  * @bus_type: video bus type: parallel or MIPI-CSI
  * @nlanes: number of MIPI lanes to be used (MIPI-CSI only)
  *
@@ -724,6 +726,8 @@ static int s5k6aa_new_config_sync(struct i2c_client *client, int timeout,
 
 /**
  * s5k6aa_set_prev_config - write user preview register set
+ * @s5k6aa: pointer to &struct s5k6aa describing the device
+ * @preset: s5kaa preset to be applied
  *
  * Configure output resolution and color fromat, pixel clock
  * frequency range, device frame rate type and frame period range.
@@ -777,6 +781,7 @@ static int s5k6aa_set_prev_config(struct s5k6aa *s5k6aa,
 
 /**
  * s5k6aa_initialize_isp - basic ISP MCU initialization
+ * @sd: pointer to V4L2 sub-device descriptor
  *
  * Configure AHB addresses for registers read/write; configure PLLs for
  * required output pixel clock. The ISP power supply needs to be already
diff --git a/drivers/media/i2c/tvp514x.c b/drivers/media/i2c/tvp514x.c
index ad2df998f9c5..d575b3e7e835 100644
--- a/drivers/media/i2c/tvp514x.c
+++ b/drivers/media/i2c/tvp514x.c
@@ -86,6 +86,7 @@ static int tvp514x_s_stream(struct v4l2_subdev *sd, int enable);
 /**
  * struct tvp514x_decoder - TVP5146/47 decoder object
  * @sd: Subdevice Slave handle
+ * @hdl: embedded &struct v4l2_ctrl_handler
  * @tvp514x_regs: copy of hw's regs with preset values.
  * @pdata: Board specific
  * @ver: Chip version
@@ -98,6 +99,9 @@ static int tvp514x_s_stream(struct v4l2_subdev *sd, int enable);
  * @std_list: Standards list
  * @input: Input routing at chip level
  * @output: Output routing at chip level
+ * @pad: subdev media pad associated with the decoder
+ * @format: media bus frame format
+ * @int_seq: driver's register init sequence
  */
 struct tvp514x_decoder {
         struct v4l2_subdev sd;
@@ -211,7 +215,7 @@ static struct tvp514x_reg tvp514x_reg_list_default[] = {
         {TOK_TERM, 0, 0},
 };
 
-/**
+/*
  * List of image formats supported by TVP5146/47 decoder
  * Currently we are using 8 bit mode only, but can be
  * extended to 10/20 bit mode.
@@ -226,7 +230,7 @@ static const struct v4l2_fmtdesc tvp514x_fmt_list[] = {
         },
 };
 
-/**
+/*
  * Supported standards -
  *
  * Currently supports two standards only, need to add support for rest of the
@@ -931,7 +935,7 @@ static int tvp514x_get_pad_format(struct v4l2_subdev *sd,
  * tvp514x_set_pad_format() - V4L2 decoder interface handler for set pad format
  * @sd: pointer to standard V4L2 sub-device structure
  * @cfg: pad configuration
- * @format: pointer to v4l2_subdev_format structure
+ * @fmt: pointer to v4l2_subdev_format structure
  *
  * Set pad format for the output pad
  */
@@ -1199,7 +1203,7 @@ static const struct tvp514x_reg tvp514xm_init_reg_seq[] = {
         {TOK_TERM, 0, 0},
 };
 
-/**
+/*
  * I2C Device Table -
  *
  * name - Name of the actual device/chip.
diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
index 11829c0fa138..509d69e6ca4a 100644
--- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
+++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
@@ -82,11 +82,11 @@ DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
  * @start_addr_lo:      DMA ring buffer start address, lower part
  * @start_addr_hi:      DMA ring buffer start address, higher part
  * @size:               DMA ring buffer size register
-                        Bits [0-7]:     DMA packet size, 188 bytes
-                        Bits [16-23]:   packets count in block, 128 packets
-                        Bits [24-31]:   blocks count, 8 blocks
+ *                      * Bits [0-7]:   DMA packet size, 188 bytes
+ *                      * Bits [16-23]: packets count in block, 128 packets
+ *                      * Bits [24-31]: blocks count, 8 blocks
  * @timeout:            DMA timeout in units of 8ns
-                        For example, value of 375000000 equals to 3 sec
+ *                      For example, value of 375000000 equals to 3 sec
  * @curr_addr_lo:       Current ring buffer head address, lower part
  * @curr_addr_hi:       Current ring buffer head address, higher part
  * @stat_pkt_received:  Statistic register, not tested
diff --git a/drivers/media/pci/solo6x10/solo6x10-enc.c b/drivers/media/pci/solo6x10/solo6x10-enc.c
index d28211bb9674..58d6b5131dd0 100644
--- a/drivers/media/pci/solo6x10/solo6x10-enc.c
+++ b/drivers/media/pci/solo6x10/solo6x10-enc.c
@@ -175,7 +175,7 @@ out:
         return 0;
 }
 
-/**
+/*
  * Set channel Quality Profile (0-3).
  */
 void solo_s_jpeg_qp(struct solo_dev *solo_dev, unsigned int ch,
diff --git a/drivers/media/pci/sta2x11/sta2x11_vip.c b/drivers/media/pci/sta2x11/sta2x11_vip.c
index eb5a9eae7c8e..dd199bfc1d45 100644
--- a/drivers/media/pci/sta2x11/sta2x11_vip.c
+++ b/drivers/media/pci/sta2x11/sta2x11_vip.c
@@ -404,6 +404,7 @@ static const struct v4l2_file_operations vip_fops = {
  * vidioc_querycap - return capabilities of device
  * @file: descriptor of device
  * @cap: contains return values
+ * @priv: unused
  *
  * the capabilities of the device are returned
  *
@@ -429,6 +430,7 @@ static int vidioc_querycap(struct file *file, void *priv,
  * vidioc_s_std - set video standard
  * @file: descriptor of device
  * @std: contains standard to be set
+ * @priv: unused
  *
  * the video standard is set
  *
@@ -466,6 +468,7 @@ static int vidioc_s_std(struct file *file, void *priv, v4l2_std_id std)
 /**
  * vidioc_g_std - get video standard
  * @file: descriptor of device
+ * @priv: unused
  * @std: contains return values
  *
  * the current video standard is returned
@@ -483,6 +486,7 @@ static int vidioc_g_std(struct file *file, void *priv, v4l2_std_id *std)
 /**
  * vidioc_querystd - get possible video standards
  * @file: descriptor of device
+ * @priv: unused
  * @std: contains return values
  *
  * all possible video standards are returned
@@ -512,6 +516,7 @@ static int vidioc_enum_input(struct file *file, void *priv,
 /**
  * vidioc_s_input - set input line
  * @file: descriptor of device
+ * @priv: unused
  * @i: new input line number
  *
  * the current active input line is set
@@ -538,6 +543,7 @@ static int vidioc_s_input(struct file *file, void *priv, unsigned int i)
 /**
  * vidioc_g_input - return input line
  * @file: descriptor of device
+ * @priv: unused
  * @i: returned input line number
  *
  * the current active input line is returned
@@ -554,6 +560,8 @@ static int vidioc_g_input(struct file *file, void *priv, unsigned int *i)
 
 /**
  * vidioc_enum_fmt_vid_cap - return video capture format
+ * @file: descriptor of device
+ * @priv: unused
  * @f: returned format information
  *
  * returns name and format of video capture
@@ -577,6 +585,7 @@ static int vidioc_enum_fmt_vid_cap(struct file *file, void *priv,
 /**
  * vidioc_try_fmt_vid_cap - set video capture format
  * @file: descriptor of device
+ * @priv: unused
  * @f: new format
  *
  * new video format is set which includes width and
@@ -639,6 +648,7 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
 /**
  * vidioc_s_fmt_vid_cap - set current video format parameters
  * @file: descriptor of device
+ * @priv: unused
  * @f: returned format information
  *
  * set new capture format
@@ -706,6 +716,7 @@ static int vidioc_s_fmt_vid_cap(struct file *file, void *priv,
 /**
  * vidioc_g_fmt_vid_cap - get current video format parameters
  * @file: descriptor of device
+ * @priv: unused
  * @f: contains format information
  *
  * returns current video format parameters
diff --git a/drivers/media/pci/tw68/tw68-risc.c b/drivers/media/pci/tw68/tw68-risc.c
index 7439db212a69..82ff9c9494f3 100644
--- a/drivers/media/pci/tw68/tw68-risc.c
+++ b/drivers/media/pci/tw68/tw68-risc.c
@@ -29,14 +29,15 @@
 #include "tw68.h"
 
 /**
- *  @rp         pointer to current risc program position
- *  @sglist     pointer to "scatter-gather list" of buffer pointers
- *  @offset     offset to target memory buffer
- *  @sync_line  0 -> no sync, 1 -> odd sync, 2 -> even sync
- *  @bpl        number of bytes per scan line
- *  @padding    number of bytes of padding to add
- *  @lines      number of lines in field
- *  @jump       insert a jump at the start
+ * tw68_risc_field
+ *  @rp:        pointer to current risc program position
+ *  @sglist:    pointer to "scatter-gather list" of buffer pointers
+ *  @offset:    offset to target memory buffer
+ *  @sync_line: 0 -> no sync, 1 -> odd sync, 2 -> even sync
+ *  @bpl:       number of bytes per scan line
+ *  @padding:   number of bytes of padding to add
+ *  @lines:     number of lines in field
+ *  @jump:      insert a jump at the start
  */
 static __le32 *tw68_risc_field(__le32 *rp, struct scatterlist *sglist,
                             unsigned int offset, u32 sync_line,
@@ -120,18 +121,18 @@ static __le32 *tw68_risc_field(__le32 *rp, struct scatterlist *sglist,
  *      memory for the dma controller "program" and then fills in that
  *      memory with the appropriate "instructions".
  *
- *      @pci_dev        structure with info about the pci
+ *      @pci:           structure with info about the pci
  *                      slot which our device is in.
- *      @risc           structure with info about the memory
+ *      @buf:           structure with info about the memory
  *                      used for our controller program.
- *      @sglist         scatter-gather list entry
- *      @top_offset     offset within the risc program area for the
+ *      @sglist:        scatter-gather list entry
+ *      @top_offset:    offset within the risc program area for the
  *                      first odd frame line
- *      @bottom_offset  offset within the risc program area for the
+ *      @bottom_offset: offset within the risc program area for the
  *                      first even frame line
- *      @bpl            number of data bytes per scan line
- *      @padding        number of extra bytes to add at end of line
- *      @lines          number of scan lines
+ *      @bpl:           number of data bytes per scan line
+ *      @padding:       number of extra bytes to add at end of line
+ *      @lines:         number of scan lines
  */
 int tw68_risc_buffer(struct pci_dev *pci,
                         struct tw68_buf *buf,
diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c
index 07e89a4985a6..16352e2263d2 100644
--- a/drivers/media/platform/davinci/vpif.c
+++ b/drivers/media/platform/davinci/vpif.c
@@ -47,8 +47,9 @@ EXPORT_SYMBOL_GPL(vpif_lock);
 void __iomem *vpif_base;
 EXPORT_SYMBOL_GPL(vpif_base);
 
-/**
+/*
  * vpif_ch_params: video standard configuration parameters for vpif
+ *
  * The table must include all presets from supported subdevices.
  */
 const struct vpif_channel_config_params vpif_ch_params[] = {
diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c
index a89367ab1e06..fca4dc829f73 100644
--- a/drivers/media/platform/davinci/vpif_capture.c
+++ b/drivers/media/platform/davinci/vpif_capture.c
@@ -109,7 +109,7 @@ static int vpif_buffer_prepare(struct vb2_buffer *vb)
  * @vq: vb2_queue ptr
  * @nbuffers: ptr to number of buffers requested by application
  * @nplanes:: contains number of distinct video planes needed to hold a frame
- * @sizes[]: contains the size (in bytes) of each plane.
+ * @sizes: contains the size (in bytes) of each plane.
  * @alloc_devs: ptr to allocation context
  *
  * This callback function is called when reqbuf() is called to adjust
@@ -167,7 +167,7 @@ static void vpif_buffer_queue(struct vb2_buffer *vb)
 
 /**
  * vpif_start_streaming : Starts the DMA engine for streaming
- * @vb: ptr to vb2_buffer
+ * @vq: ptr to vb2_buffer
  * @count: number of buffers
  */
 static int vpif_start_streaming(struct vb2_queue *vq, unsigned int count)
@@ -629,7 +629,7 @@ static void vpif_calculate_offsets(struct channel_obj *ch)
 
 /**
  * vpif_get_default_field() - Get default field type based on interface
- * @vpif_params - ptr to vpif params
+ * @iface: ptr to vpif interface
  */
 static inline enum v4l2_field vpif_get_default_field(
                                 struct vpif_interface *iface)
@@ -640,8 +640,8 @@ static inline enum v4l2_field vpif_get_default_field(
 
 /**
  * vpif_config_addr() - function to configure buffer address in vpif
- * @ch - channel ptr
- * @muxmode - channel mux mode
+ * @ch: channel ptr
+ * @muxmode: channel mux mode
  */
 static void vpif_config_addr(struct channel_obj *ch, int muxmode)
 {
@@ -661,9 +661,9 @@ static void vpif_config_addr(struct channel_obj *ch, int muxmode)
 
 /**
  * vpif_input_to_subdev() - Maps input to sub device
- * @vpif_cfg - global config ptr
- * @chan_cfg - channel config ptr
- * @input_index - Given input index from application
+ * @vpif_cfg: global config ptr
+ * @chan_cfg: channel config ptr
+ * @input_index: Given input index from application
  *
  * lookup the sub device information for a given input index.
  * we report all the inputs to application. inputs table also
@@ -699,9 +699,9 @@ static int vpif_input_to_subdev(
 
 /**
  * vpif_set_input() - Select an input
- * @vpif_cfg - global config ptr
- * @ch - channel
- * @_index - Given input index from application
+ * @vpif_cfg: global config ptr
+ * @ch: channel
+ * @index: Given input index from application
  *
  * Select the given input.
  */
@@ -792,7 +792,7 @@ static int vpif_querystd(struct file *file, void *priv, v4l2_std_id *std_id)
  * vpif_g_std() - get STD handler
  * @file: file ptr
  * @priv: file handle
- * @std_id: ptr to std id
+ * @std: ptr to std id
  */
 static int vpif_g_std(struct file *file, void *priv, v4l2_std_id *std)
 {
@@ -933,7 +933,7 @@ static int vpif_s_input(struct file *file, void *priv, unsigned int index)
  * vpif_enum_fmt_vid_cap() - ENUM_FMT handler
  * @file: file ptr
  * @priv: file handle
- * @index: input index
+ * @fmt: ptr to V4L2 format descriptor
  */
 static int vpif_enum_fmt_vid_cap(struct file *file, void  *priv,
                                         struct v4l2_fmtdesc *fmt)
@@ -1745,6 +1745,7 @@ static int vpif_remove(struct platform_device *device)
 #ifdef CONFIG_PM_SLEEP
 /**
  * vpif_suspend: vpif device suspend
+ * @dev: pointer to &struct device
  */
 static int vpif_suspend(struct device *dev)
 {
diff --git a/drivers/media/platform/davinci/vpif_display.c b/drivers/media/platform/davinci/vpif_display.c
index ff2f75a328c9..7be636237acf 100644
--- a/drivers/media/platform/davinci/vpif_display.c
+++ b/drivers/media/platform/davinci/vpif_display.c
@@ -102,7 +102,7 @@ static int vpif_buffer_prepare(struct vb2_buffer *vb)
  * @vq: vb2_queue ptr
  * @nbuffers: ptr to number of buffers requested by application
  * @nplanes:: contains number of distinct video planes needed to hold a frame
- * @sizes[]: contains the size (in bytes) of each plane.
+ * @sizes: contains the size (in bytes) of each plane.
  * @alloc_devs: ptr to allocation context
  *
  * This callback function is called when reqbuf() is called to adjust
@@ -158,7 +158,7 @@ static void vpif_buffer_queue(struct vb2_buffer *vb)
 
 /**
  * vpif_start_streaming : Starts the DMA engine for streaming
- * @vb: ptr to vb2_buffer
+ * @vq: ptr to vb2_buffer
  * @count: number of buffers
  */
 static int vpif_start_streaming(struct vb2_queue *vq, unsigned int count)
@@ -766,9 +766,9 @@ static int vpif_enum_output(struct file *file, void *fh,
 
 /**
  * vpif_output_to_subdev() - Maps output to sub device
- * @vpif_cfg - global config ptr
- * @chan_cfg - channel config ptr
- * @index - Given output index from application
+ * @vpif_cfg: global config ptr
+ * @chan_cfg: channel config ptr
+ * @index: Given output index from application
  *
  * lookup the sub device information for a given output index.
  * we report all the output to application. output table also
@@ -802,9 +802,9 @@ vpif_output_to_subdev(struct vpif_display_config *vpif_cfg,
 
 /**
  * vpif_set_output() - Select an output
- * @vpif_cfg - global config ptr
- * @ch - channel
- * @index - Given output index from application
+ * @vpif_cfg: global config ptr
+ * @ch: channel
+ * @index: Given output index from application
  *
  * Select the given output.
  */
diff --git a/drivers/media/platform/exynos4-is/fimc-capture.c b/drivers/media/platform/exynos4-is/fimc-capture.c
index 948fe01f6c96..ed9302caa004 100644
--- a/drivers/media/platform/exynos4-is/fimc-capture.c
+++ b/drivers/media/platform/exynos4-is/fimc-capture.c
@@ -146,6 +146,7 @@ static int fimc_stop_capture(struct fimc_dev *fimc, bool suspend)
 
 /**
  * fimc_capture_config_update - apply the camera interface configuration
+ * @ctx: FIMC capture context
  *
  * To be called from within the interrupt handler with fimc.slock
  * spinlock held. It updates the camera pixel crop, rotation and
@@ -858,6 +859,7 @@ static int fimc_pipeline_try_format(struct fimc_ctx *ctx,
  * fimc_get_sensor_frame_desc - query the sensor for media bus frame parameters
  * @sensor: pointer to the sensor subdev
  * @plane_fmt: provides plane sizes corresponding to the frame layout entries
+ * @num_planes: number of planes
  * @try: true to set the frame parameters, false to query only
  *
  * This function is used by this driver only for compressed/blob data formats.
@@ -1101,6 +1103,7 @@ static int fimc_cap_g_input(struct file *file, void *priv, unsigned int *i)
 /**
  * fimc_pipeline_validate - check for formats inconsistencies
  *                          between source and sink pad of each link
+ * @fimc:       the FIMC device this context applies to
  *
  * Return 0 if all formats match or -EPIPE otherwise.
  */
diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
index c15596b56dc9..0ef583cfc424 100644
--- a/drivers/media/platform/exynos4-is/media-dev.c
+++ b/drivers/media/platform/exynos4-is/media-dev.c
@@ -60,6 +60,7 @@ static void __setup_sensor_notification(struct fimc_md *fmd,
 
 /**
  * fimc_pipeline_prepare - update pipeline information with subdevice pointers
+ * @p: fimc pipeline
  * @me: media entity terminating the pipeline
  *
  * Caller holds the graph mutex.
@@ -151,8 +152,8 @@ static int __subdev_set_power(struct v4l2_subdev *sd, int on)
 
 /**
  * fimc_pipeline_s_power - change power state of all pipeline subdevs
- * @fimc: fimc device terminating the pipeline
- * @state: true to power on, false to power off
+ * @p: fimc device terminating the pipeline
+ * @on: true to power on, false to power off
  *
  * Needs to be called with the graph mutex held.
  */
@@ -219,6 +220,7 @@ static int __fimc_pipeline_enable(struct exynos_media_pipeline *ep,
 /**
  * __fimc_pipeline_open - update the pipeline information, enable power
  *                        of all pipeline subdevs and the sensor clock
+ * @ep: fimc device terminating the pipeline
  * @me: media entity to start graph walk with
  * @prepare: true to walk the current pipeline and acquire all subdevs
  *
@@ -252,7 +254,7 @@ static int __fimc_pipeline_open(struct exynos_media_pipeline *ep,
 
 /**
  * __fimc_pipeline_close - disable the sensor clock and pipeline power
- * @fimc: fimc device terminating the pipeline
+ * @ep: fimc device terminating the pipeline
  *
  * Disable power of all subdevs and turn the external sensor clock off.
  */
@@ -281,7 +283,7 @@ static int __fimc_pipeline_close(struct exynos_media_pipeline *ep)
 
 /**
  * __fimc_pipeline_s_stream - call s_stream() on pipeline subdevs
- * @pipeline: video pipeline structure
+ * @ep: video pipeline structure
  * @on: passed as the s_stream() callback argument
  */
 static int __fimc_pipeline_s_stream(struct exynos_media_pipeline *ep, bool on)
@@ -902,6 +904,7 @@ static int __fimc_md_create_fimc_is_links(struct fimc_md *fmd)
 
 /**
  * fimc_md_create_links - create default links between registered entities
+ * @fmd: fimc media device
  *
  * Parallel interface sensor entities are connected directly to FIMC capture
  * entities. The sensors using MIPI CSIS bus are connected through immutable
diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c
index 560aadabcb11..cba46a656338 100644
--- a/drivers/media/platform/exynos4-is/mipi-csis.c
+++ b/drivers/media/platform/exynos4-is/mipi-csis.c
@@ -189,7 +189,7 @@ struct csis_drvdata {
  * @irq: requested s5p-mipi-csis irq number
  * @interrupt_mask: interrupt mask of the all used interrupts
  * @flags: the state variable for power and streaming control
- * @clock_frequency: device bus clock frequency
+ * @clk_frequency: device bus clock frequency
  * @hs_settle: HS-RX settle time
  * @num_lanes: number of MIPI-CSI data lanes used
  * @max_num_lanes: maximum number of MIPI-CSI data lanes supported
diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c
index b7731b18ecae..aa3ce41898bc 100644
--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c
+++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c
@@ -59,6 +59,7 @@ struct h264_fb {
  * @read_idx  : read index
  * @write_idx : write index
  * @count     : buffer count in list
+ * @reserved  : for 8 bytes alignment
  */
 struct h264_ring_fb_list {
         struct h264_fb fb_list[H264_MAX_FB_NUM];
diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c
index b9fad6a48879..3e84a761db3a 100644
--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c
+++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c
@@ -155,7 +155,6 @@ struct vdec_vp8_vpu_inst {
  * @reg_base               : HW register base address
  * @frm_cnt                : decode frame count
  * @ctx                    : V4L2 context
- * @dev                    : platform device
  * @vpu                    : VPU instance for decoder
  * @vsi                    : VPU share information
  */
diff --git a/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c b/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c
index 4eb3be37ba14..6cf31b366aad 100644
--- a/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c
+++ b/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c
@@ -34,7 +34,7 @@ static const char h264_filler_marker[] = {0x0, 0x0, 0x0, 0x1, 0xc};
 #define H264_FILLER_MARKER_SIZE ARRAY_SIZE(h264_filler_marker)
 #define VENC_PIC_BITSTREAM_BYTE_CNT 0x0098
 
-/**
+/*
  * enum venc_h264_vpu_work_buf - h264 encoder buffer index
  */
 enum venc_h264_vpu_work_buf {
@@ -50,7 +50,7 @@ enum venc_h264_vpu_work_buf {
         VENC_H264_VPU_WORK_BUF_MAX,
 };
 
-/**
+/*
  * enum venc_h264_bs_mode - for bs_mode argument in h264_enc_vpu_encode
  */
 enum venc_h264_bs_mode {
diff --git a/drivers/media/platform/mtk-vcodec/venc/venc_vp8_if.c b/drivers/media/platform/mtk-vcodec/venc/venc_vp8_if.c
index acb639c4abd2..957420dd60de 100644
--- a/drivers/media/platform/mtk-vcodec/venc/venc_vp8_if.c
+++ b/drivers/media/platform/mtk-vcodec/venc/venc_vp8_if.c
@@ -34,7 +34,7 @@
 /* This ac_tag is vp8 frame tag. */
 #define MAX_AC_TAG_SIZE 10
 
-/**
+/*
  * enum venc_vp8_vpu_work_buf - vp8 encoder buffer index
  */
 enum venc_vp8_vpu_work_buf {
diff --git a/drivers/media/platform/mtk-vpu/mtk_vpu.c b/drivers/media/platform/mtk-vpu/mtk_vpu.c
index 853d598937f6..1ff6a93262b7 100644
--- a/drivers/media/platform/mtk-vpu/mtk_vpu.c
+++ b/drivers/media/platform/mtk-vpu/mtk_vpu.c
@@ -181,6 +181,7 @@ struct share_obj {
  * @extmem:             VPU extended memory information
  * @reg:                VPU TCM and configuration registers
  * @run:                VPU initialization status
+ * @wdt:                VPU watchdog workqueue
  * @ipi_desc:           VPU IPI descriptor
  * @recv_buf:           VPU DTCM share buffer for receiving. The
  *                      receive buffer is only accessed in interrupt context.
@@ -194,7 +195,7 @@ struct share_obj {
  *                      suppose a client is using VPU to decode VP8.
  *                      If the other client wants to encode VP8,
  *                      it has to wait until VP8 decode completes.
- * @wdt_refcnt          WDT reference count to make sure the watchdog can be
+ * @wdt_refcnt:         WDT reference count to make sure the watchdog can be
  *                      disabled if no other client is using VPU service
  * @ack_wq:             The wait queue for each codec and mdp. When sleeping
  *                      processes wake up, they will check the condition
diff --git a/drivers/media/platform/pxa_camera.c b/drivers/media/platform/pxa_camera.c
index 9d3f0cb1d95a..295f34ad1080 100644
--- a/drivers/media/platform/pxa_camera.c
+++ b/drivers/media/platform/pxa_camera.c
@@ -235,6 +235,7 @@ enum pxa_mbus_layout {
  *                      stored in memory in the following way:
  * @packing:            Type of sample-packing, that has to be used
  * @order:              Sample order when storing in memory
+ * @layout:             Planes layout in memory
  * @bits_per_sample:    How many bits the bridge has to sample
  */
 struct pxa_mbus_pixelfmt {
@@ -852,10 +853,10 @@ static void pxa_camera_dma_irq_v(void *data)
 /**
  * pxa_init_dma_channel - init dma descriptors
  * @pcdev: pxa camera device
- * @vb: videobuffer2 buffer
- * @dma: dma video buffer
+ * @buf: pxa camera buffer
  * @channel: dma channel (0 => 'Y', 1 => 'U', 2 => 'V')
- * @cibr: camera Receive Buffer Register
+ * @sg: dma scatter list
+ * @sglen: dma scatter list length
  *
  * Prepares the pxa dma descriptors to transfer one camera channel.
  *
@@ -1010,6 +1011,8 @@ static void pxa_camera_wakeup(struct pxa_camera_dev *pcdev,
 /**
  * pxa_camera_check_link_miss - check missed DMA linking
  * @pcdev: camera device
+ * @last_submitted: an opaque DMA cookie for last submitted
+ * @last_issued: an opaque DMA cookie for last issued
  *
  * The DMA chaining is done with DMA running. This means a tiny temporal window
  * remains, where a buffer is queued on the chain, while the chain is already
diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
index 3245bc45f4a0..b13dec3081e5 100644
--- a/drivers/media/platform/rcar_fdp1.c
+++ b/drivers/media/platform/rcar_fdp1.c
@@ -1132,7 +1132,7 @@ static int fdp1_device_process(struct fdp1_ctx *ctx)
  * mem2mem callbacks
  */
 
-/**
+/*
  * job_ready() - check whether an instance is ready to be scheduled to run
  */
 static int fdp1_m2m_job_ready(void *priv)
diff --git a/drivers/media/platform/rcar_jpu.c b/drivers/media/platform/rcar_jpu.c
index 070bac36d766..f6092ae45912 100644
--- a/drivers/media/platform/rcar_jpu.c
+++ b/drivers/media/platform/rcar_jpu.c
@@ -257,7 +257,7 @@ struct jpu_fmt {
 };
 
 /**
- * jpu_q_data - parameters of one queue
+ * struct jpu_q_data - parameters of one queue
  * @fmtinfo: driver-specific format of this queue
  * @format: multiplanar format of this queue
  * @sequence: sequence number
@@ -269,7 +269,7 @@ struct jpu_q_data {
 };
 
 /**
- * jpu_ctx - the device context data
+ * struct jpu_ctx - the device context data
  * @jpu: JPEG IP device for this context
  * @encoder: compression (encode) operation or decompression (decode)
  * @compr_quality: destination image quality in compression (encode) mode
diff --git a/drivers/media/platform/s3c-camif/camif-core.c b/drivers/media/platform/s3c-camif/camif-core.c
index c4ab63986c8f..79bc0ef6bb41 100644
--- a/drivers/media/platform/s3c-camif/camif-core.c
+++ b/drivers/media/platform/s3c-camif/camif-core.c
@@ -103,6 +103,7 @@ static const struct camif_fmt camif_formats[] = {
 
 /**
  * s3c_camif_find_format() - lookup camif color format by fourcc or an index
+ * @vp: video path (DMA) description (codec/preview)
  * @pixelformat: fourcc to match, ignored if null
  * @index: index to the camif_formats array, ignored if negative
  */
diff --git a/drivers/media/platform/sh_veu.c b/drivers/media/platform/sh_veu.c
index 15a562af13c7..dedc1b024f6f 100644
--- a/drivers/media/platform/sh_veu.c
+++ b/drivers/media/platform/sh_veu.c
@@ -267,7 +267,7 @@ static void sh_veu_process(struct sh_veu_dev *veu,
         sh_veu_reg_write(veu, VEU_EIER, 1); /* enable interrupt in VEU */
 }
 
-/**
+/*
  * sh_veu_device_run() - prepares and starts the device
  *
  * This will be called by the framework when it decides to schedule a particular
diff --git a/drivers/media/platform/soc_camera/soc_scale_crop.c b/drivers/media/platform/soc_camera/soc_scale_crop.c
index 0116097c0c0f..270ec613c27c 100644
--- a/drivers/media/platform/soc_camera/soc_scale_crop.c
+++ b/drivers/media/platform/soc_camera/soc_scale_crop.c
@@ -306,16 +306,17 @@ update_cache:
 }
 
 /**
- * @icd         - soc-camera device
- * @rect        - camera cropping window
- * @subrect     - part of rect, sent to the user
- * @mf          - in- / output camera output window
- * @width       - on input: max host input width
- *                on output: user width, mapped back to input
- * @height      - on input: max host input height
- *                on output: user height, mapped back to input
- * @host_can_scale - host can scale this pixel format
- * @shift       - shift, used for scaling
+ * soc_camera_client_scale
+ * @icd:                soc-camera device
+ * @rect:               camera cropping window
+ * @subrect:            part of rect, sent to the user
+ * @mf:                 in- / output camera output window
+ * @width:              on input: max host input width;
+ *                      on output: user width, mapped back to input
+ * @height:             on input: max host input height;
+ *                      on output: user height, mapped back to input
+ * @host_can_scale:     host can scale this pixel format
+ * @shift:              shift, used for scaling
  */
 int soc_camera_client_scale(struct soc_camera_device *icd,
                         struct v4l2_rect *rect, struct v4l2_rect *subrect,
diff --git a/drivers/media/platform/sti/hva/hva-h264.c b/drivers/media/platform/sti/hva/hva-h264.c
index a7e5eed17ada..17f1eb0ba957 100644
--- a/drivers/media/platform/sti/hva/hva-h264.c
+++ b/drivers/media/platform/sti/hva/hva-h264.c
@@ -134,7 +134,7 @@ enum hva_h264_sei_payload_type {
         SEI_FRAME_PACKING_ARRANGEMENT = 45
 };
 
-/**
+/*
  * stereo Video Info struct
  */
 struct hva_h264_stereo_video_sei {
@@ -146,7 +146,9 @@ struct hva_h264_stereo_video_sei {
         u8 right_view_self_contained_flag;
 };
 
-/**
+/*
+ * struct hva_h264_td
+ *
  * @frame_width: width in pixels of the buffer containing the input frame
  * @frame_height: height in pixels of the buffer containing the input frame
  * @frame_num: the parameter to be written in the slice header
@@ -352,7 +354,9 @@ struct hva_h264_td {
         u32 addr_brc_in_out_parameter;
 };
 
-/**
+/*
+ * struct hva_h264_slice_po
+ *
  * @ slice_size: slice size
  * @ slice_start_time: start time
  * @ slice_stop_time: stop time
@@ -365,7 +369,9 @@ struct hva_h264_slice_po {
         u32 slice_num;
 };
 
-/**
+/*
+ * struct hva_h264_po
+ *
  * @ bitstream_size: bitstream size
  * @ dct_bitstream_size: dtc bitstream size
  * @ stuffing_bits: number of stuffing bits inserted by the encoder
@@ -391,7 +397,9 @@ struct hva_h264_task {
         struct hva_h264_po po;
 };
 
-/**
+/*
+ * struct hva_h264_ctx
+ *
  * @seq_info:  sequence information buffer
  * @ref_frame: reference frame buffer
  * @rec_frame: reconstructed frame buffer
diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c
index 45bd10544189..e395aa85c8ad 100644
--- a/drivers/media/platform/ti-vpe/vpe.c
+++ b/drivers/media/platform/ti-vpe/vpe.c
@@ -926,7 +926,7 @@ static struct vpe_ctx *file2ctx(struct file *file)
  * mem2mem callbacks
  */
 
-/**
+/*
  * job_ready() - check whether an instance is ready to be scheduled to run
  */
 static int job_ready(void *priv)
diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
index 7bf9fa2f8534..065483e62db4 100644
--- a/drivers/media/platform/vim2m.c
+++ b/drivers/media/platform/vim2m.c
@@ -343,7 +343,7 @@ static void schedule_irq(struct vim2m_dev *dev, int msec_timeout)
  * mem2mem callbacks
  */
 
-/**
+/*
  * job_ready() - check whether an instance is ready to be scheduled to run
  */
 static int job_ready(void *priv)
diff --git a/drivers/media/platform/vsp1/vsp1_dl.c b/drivers/media/platform/vsp1/vsp1_dl.c
index 8b5cbb6b7a70..4257451f1bd8 100644
--- a/drivers/media/platform/vsp1/vsp1_dl.c
+++ b/drivers/media/platform/vsp1/vsp1_dl.c
@@ -70,6 +70,7 @@ struct vsp1_dl_body {
  * @dma: DMA address for the header
  * @body0: first display list body
  * @fragments: list of extra display list bodies
+ * @has_chain: if true, indicates that there's a partition chain
  * @chain: entry in the display list partition chain
  */
 struct vsp1_dl_list {
diff --git a/drivers/media/radio/radio-si476x.c b/drivers/media/radio/radio-si476x.c
index 271f725b17e8..540ac887a63c 100644
--- a/drivers/media/radio/radio-si476x.c
+++ b/drivers/media/radio/radio-si476x.c
@@ -158,7 +158,7 @@ enum si476x_ctrl_idx {
 };
 static struct v4l2_ctrl_config si476x_ctrls[] = {
 
-        /**
+        /*
          * SI476X during its station seeking(or tuning) process uses several
          * parameters to detrmine if "the station" is valid:
          *
@@ -197,7 +197,7 @@ static struct v4l2_ctrl_config si476x_ctrls[] = {
                 .step   = 2,
         },
 
-        /**
+        /*
          * #V4L2_CID_SI476X_HARMONICS_COUNT -- number of harmonics
          * built-in power-line noise supression filter is to reject
          * during AM-mode operation.
@@ -213,7 +213,7 @@ static struct v4l2_ctrl_config si476x_ctrls[] = {
                 .step   = 1,
         },
 
-        /**
+        /*
          * #V4L2_CID_SI476X_DIVERSITY_MODE -- configuration which
          * two tuners working in diversity mode are to work in.
          *
@@ -237,7 +237,7 @@ static struct v4l2_ctrl_config si476x_ctrls[] = {
                 .max    = ARRAY_SIZE(phase_diversity_modes) - 1,
         },
 
-        /**
+        /*
          * #V4L2_CID_SI476X_INTERCHIP_LINK -- inter-chip link in
          * diversity mode indicator. Allows user to determine if two
          * chips working in diversity mode have established a link
@@ -296,11 +296,15 @@ struct si476x_radio_ops {
 /**
  * struct si476x_radio - radio device
  *
- * @core: Pointer to underlying core device
+ * @v4l2dev: Pointer to V4L2 device created by V4L2 subsystem
  * @videodev: Pointer to video device created by V4L2 subsystem
+ * @ctrl_handler: V4L2 controls handler
+ * @core: Pointer to underlying core device
  * @ops: Vtable of functions. See struct si476x_radio_ops for details
- * @kref: Reference counter
- * @core_lock: An r/w semaphore to brebvent the deletion of underlying
+ * @debugfs: pointer to &strucd dentry for debugfs
+ * @audmode: audio mode, as defined for the rxsubchans field
+ *           at videodev2.h
+ *
  * core structure is the radio device is being used
  */
 struct si476x_radio {
diff --git a/drivers/media/radio/radio-wl1273.c b/drivers/media/radio/radio-wl1273.c
index 903fcd5e99c0..3cbdc085c65d 100644
--- a/drivers/media/radio/radio-wl1273.c
+++ b/drivers/media/radio/radio-wl1273.c
@@ -1330,7 +1330,7 @@ static int wl1273_fm_vidioc_s_input(struct file *file, void *priv,
 
 /**
  * wl1273_fm_set_tx_power() -   Set the transmission power value.
- * @core:                       A pointer to the device struct.
+ * @radio:                      A pointer to the device struct.
  * @power:                      The new power value.
  */
 static int wl1273_fm_set_tx_power(struct wl1273_device *radio, u16 power)
diff --git a/drivers/media/rc/img-ir/img-ir-hw.c b/drivers/media/rc/img-ir/img-ir-hw.c
index f54bc5d23893..ec4ded84cd17 100644
--- a/drivers/media/rc/img-ir/img-ir-hw.c
+++ b/drivers/media/rc/img-ir/img-ir-hw.c
@@ -339,7 +339,7 @@ static void img_ir_decoder_preprocess(struct img_ir_decoder *decoder)
 /**
  * img_ir_decoder_convert() - Generate internal timings in decoder.
  * @decoder:    Decoder to be converted to internal timings.
- * @timings:    Timing register values.
+ * @reg_timings: Timing register values.
  * @clock_hz:   IR clock rate in Hz.
  *
  * Fills out the repeat timings and timing register values for a specific clock
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index b25b35b3f6da..eb943e862515 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -492,7 +492,7 @@ static void free_imon_context(struct imon_context *ictx)
         dev_dbg(dev, "%s: iMON context freed\n", __func__);
 }
 
-/**
+/*
  * Called when the Display device (e.g. /dev/lcd0)
  * is opened by the application.
  */
@@ -542,7 +542,7 @@ exit:
         return retval;
 }
 
-/**
+/*
  * Called when the display device (e.g. /dev/lcd0)
  * is closed by the application.
  */
@@ -575,7 +575,7 @@ static int display_close(struct inode *inode, struct file *file)
         return retval;
 }
 
-/**
+/*
  * Sends a packet to the device -- this function must be called with
  * ictx->lock held, or its unlock/lock sequence while waiting for tx
  * to complete can/will lead to a deadlock.
@@ -664,7 +664,7 @@ static int send_packet(struct imon_context *ictx)
         return retval;
 }
 
-/**
+/*
  * Sends an associate packet to the iMON 2.4G.
  *
  * This might not be such a good idea, since it has an id collision with
@@ -694,7 +694,7 @@ static int send_associate_24g(struct imon_context *ictx)
         return retval;
 }
 
-/**
+/*
  * Sends packets to setup and show clock on iMON display
  *
  * Arguments: year - last 2 digits of year, month - 1..12,
@@ -781,7 +781,7 @@ static int send_set_imon_clock(struct imon_context *ictx,
         return retval;
 }
 
-/**
+/*
  * These are the sysfs functions to handle the association on the iMON 2.4G LT.
  */
 static ssize_t show_associate_remote(struct device *d,
@@ -823,7 +823,7 @@ static ssize_t store_associate_remote(struct device *d,
         return count;
 }
 
-/**
+/*
  * sysfs functions to control internal imon clock
  */
 static ssize_t show_imon_clock(struct device *d,
@@ -923,7 +923,7 @@ static const struct attribute_group imon_rf_attr_group = {
         .attrs = imon_rf_sysfs_entries
 };
 
-/**
+/*
  * Writes data to the VFD.  The iMON VFD is 2x16 characters
  * and requires data in 5 consecutive USB interrupt packets,
  * each packet but the last carrying 7 bytes.
@@ -1008,7 +1008,7 @@ exit:
         return (!retval) ? n_bytes : retval;
 }
 
-/**
+/*
  * Writes data to the LCD.  The iMON OEM LCD screen expects 8-byte
  * packets. We accept data as 16 hexadecimal digits, followed by a
  * newline (to make it easy to drive the device from a command-line
@@ -1066,7 +1066,7 @@ exit:
         return (!retval) ? n_bytes : retval;
 }
 
-/**
+/*
  * Callback function for USB core API: transmit data
  */
 static void usb_tx_callback(struct urb *urb)
@@ -1087,7 +1087,7 @@ static void usb_tx_callback(struct urb *urb)
         complete(&ictx->tx.finished);
 }
 
-/**
+/*
  * report touchscreen input
  */
 static void imon_touch_display_timeout(struct timer_list *t)
@@ -1103,7 +1103,7 @@ static void imon_touch_display_timeout(struct timer_list *t)
         input_sync(ictx->touch);
 }
 
-/**
+/*
  * iMON IR receivers support two different signal sets -- those used by
  * the iMON remotes, and those used by the Windows MCE remotes (which is
  * really just RC-6), but only one or the other at a time, as the signals
@@ -1191,7 +1191,7 @@ static inline int tv2int(const struct timeval *a, const struct timeval *b)
         return sec;
 }
 
-/**
+/*
  * The directional pad behaves a bit differently, depending on whether this is
  * one of the older ffdc devices or a newer device. Newer devices appear to
  * have a higher resolution matrix for more precise mouse movement, but it
@@ -1543,7 +1543,7 @@ static void imon_pad_to_keys(struct imon_context *ictx, unsigned char *buf)
         }
 }
 
-/**
+/*
  * figure out if these is a press or a release. We don't actually
  * care about repeats, as those will be auto-generated within the IR
  * subsystem for repeating scancodes.
@@ -1592,10 +1592,10 @@ static int imon_parse_press_type(struct imon_context *ictx,
         return press_type;
 }
 
-/**
+/*
  * Process the incoming packet
  */
-/**
+/*
  * Convert bit count to time duration (in us) and submit
  * the value to lirc_dev.
  */
@@ -1608,7 +1608,7 @@ static void submit_data(struct imon_context *context)
         ir_raw_event_store_with_filter(context->rdev, &ev);
 }
 
-/**
+/*
  * Process the incoming packet
  */
 static void imon_incoming_ir_raw(struct imon_context *context,
@@ -1831,7 +1831,7 @@ not_input_data:
         }
 }
 
-/**
+/*
  * Callback function for USB core API: receive data
  */
 static void usb_rx_callback_intf0(struct urb *urb)
@@ -2485,7 +2485,7 @@ static void imon_init_display(struct imon_context *ictx,
 
 }
 
-/**
+/*
  * Callback function for USB core API: Probe
  */
 static int imon_probe(struct usb_interface *interface,
@@ -2583,7 +2583,7 @@ fail:
         return ret;
 }
 
-/**
+/*
  * Callback function for USB core API: disconnect
  */
 static void imon_disconnect(struct usb_interface *interface)
diff --git a/drivers/media/rc/ir-jvc-decoder.c b/drivers/media/rc/ir-jvc-decoder.c
index e2bd68c42edf..22c8aee3df4f 100644
--- a/drivers/media/rc/ir-jvc-decoder.c
+++ b/drivers/media/rc/ir-jvc-decoder.c
@@ -39,7 +39,7 @@ enum jvc_state {
 /**
  * ir_jvc_decode() - Decode one JVC pulse or space
  * @dev:        the struct rc_dev descriptor of the device
- * @duration:   the struct ir_raw_event descriptor of the pulse/space
+ * @ev:   the struct ir_raw_event descriptor of the pulse/space
  *
  * This function returns -EINVAL if the pulse violates the state machine
  */
diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
index 8f2f37412fc5..4fd4521693d9 100644
--- a/drivers/media/rc/ir-lirc-codec.c
+++ b/drivers/media/rc/ir-lirc-codec.c
@@ -25,8 +25,8 @@
 /**
  * ir_lirc_decode() - Send raw IR data to lirc_dev to be relayed to the
  *                    lircd userspace daemon for decoding.
- * @input_dev:  the struct rc_dev descriptor of the device
- * @duration:   the struct ir_raw_event descriptor of the pulse/space
+ * @dev:        the struct rc_dev descriptor of the device
+ * @ev:         the struct ir_raw_event descriptor of the pulse/space
  *
  * This function returns -EINVAL if the lirc interfaces aren't wired up.
  */
diff --git a/drivers/media/rc/ir-nec-decoder.c b/drivers/media/rc/ir-nec-decoder.c
index a95d09acc22a..6880c190dcd2 100644
--- a/drivers/media/rc/ir-nec-decoder.c
+++ b/drivers/media/rc/ir-nec-decoder.c
@@ -41,7 +41,7 @@ enum nec_state {
 /**
  * ir_nec_decode() - Decode one NEC pulse or space
  * @dev:        the struct rc_dev descriptor of the device
- * @duration:   the struct ir_raw_event descriptor of the pulse/space
+ * @ev:         the struct ir_raw_event descriptor of the pulse/space
  *
  * This function returns -EINVAL if the pulse violates the state machine
  */
@@ -183,7 +183,6 @@ static int ir_nec_decode(struct rc_dev *dev, struct ir_raw_event ev)
  * ir_nec_scancode_to_raw() - encode an NEC scancode ready for modulation.
  * @protocol:   specific protocol to use
  * @scancode:   a single NEC scancode.
- * @raw:        raw data to be modulated.
  */
 static u32 ir_nec_scancode_to_raw(enum rc_proto protocol, u32 scancode)
 {
diff --git a/drivers/media/rc/ir-sanyo-decoder.c b/drivers/media/rc/ir-sanyo-decoder.c
index 758c60956850..d94e07b02f3b 100644
--- a/drivers/media/rc/ir-sanyo-decoder.c
+++ b/drivers/media/rc/ir-sanyo-decoder.c
@@ -48,7 +48,7 @@ enum sanyo_state {
 /**
  * ir_sanyo_decode() - Decode one SANYO pulse or space
  * @dev:        the struct rc_dev descriptor of the device
- * @duration:   the struct ir_raw_event descriptor of the pulse/space
+ * @ev:         the struct ir_raw_event descriptor of the pulse/space
  *
  * This function returns -EINVAL if the pulse violates the state machine
  */
diff --git a/drivers/media/rc/ir-sharp-decoder.c b/drivers/media/rc/ir-sharp-decoder.c
index 129b558acc92..7140dd6160ee 100644
--- a/drivers/media/rc/ir-sharp-decoder.c
+++ b/drivers/media/rc/ir-sharp-decoder.c
@@ -39,7 +39,7 @@ enum sharp_state {
 /**
  * ir_sharp_decode() - Decode one Sharp pulse or space
  * @dev:        the struct rc_dev descriptor of the device
- * @duration:   the struct ir_raw_event descriptor of the pulse/space
+ * @ev:         the struct ir_raw_event descriptor of the pulse/space
  *
  * This function returns -EINVAL if the pulse violates the state machine
  */
diff --git a/drivers/media/rc/ir-xmp-decoder.c b/drivers/media/rc/ir-xmp-decoder.c
index 6f464be1c8d7..712bc6d76e92 100644
--- a/drivers/media/rc/ir-xmp-decoder.c
+++ b/drivers/media/rc/ir-xmp-decoder.c
@@ -35,7 +35,7 @@ enum xmp_state {
 /**
  * ir_xmp_decode() - Decode one XMP pulse or space
  * @dev:        the struct rc_dev descriptor of the device
- * @duration:   the struct ir_raw_event descriptor of the pulse/space
+ * @ev:         the struct ir_raw_event descriptor of the pulse/space
  *
  * This function returns -EINVAL if the pulse violates the state machine
  */
diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c
index f6e5ba4fbb49..d78483a504c9 100644
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -128,7 +128,7 @@ EXPORT_SYMBOL_GPL(ir_raw_event_store_edge);
 /**
  * ir_raw_event_store_with_filter() - pass next pulse/space to decoders with some processing
  * @dev:        the struct rc_dev device descriptor
- * @type:       the type of the event that has occurred
+ * @ev:         the event that has occurred
  *
  * This routine (which may be called from an interrupt context) works
  * in similar manner to ir_raw_event_store_edge.
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 17950e29d4e3..c144b77eac98 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -39,41 +39,41 @@ static const struct {
         [RC_PROTO_UNKNOWN] = { .name = "unknown", .repeat_period = 250 },
         [RC_PROTO_OTHER] = { .name = "other", .repeat_period = 250 },
         [RC_PROTO_RC5] = { .name = "rc-5",
-                .scancode_bits = 0x1f7f, .repeat_period = 164 },
+                .scancode_bits = 0x1f7f, .repeat_period = 250 },
         [RC_PROTO_RC5X_20] = { .name = "rc-5x-20",
-                .scancode_bits = 0x1f7f3f, .repeat_period = 164 },
+                .scancode_bits = 0x1f7f3f, .repeat_period = 250 },
         [RC_PROTO_RC5_SZ] = { .name = "rc-5-sz",
-                .scancode_bits = 0x2fff, .repeat_period = 164 },
+                .scancode_bits = 0x2fff, .repeat_period = 250 },
         [RC_PROTO_JVC] = { .name = "jvc",
                 .scancode_bits = 0xffff, .repeat_period = 250 },
         [RC_PROTO_SONY12] = { .name = "sony-12",
-                .scancode_bits = 0x1f007f, .repeat_period = 100 },
+                .scancode_bits = 0x1f007f, .repeat_period = 250 },
         [RC_PROTO_SONY15] = { .name = "sony-15",
-                .scancode_bits = 0xff007f, .repeat_period = 100 },
+                .scancode_bits = 0xff007f, .repeat_period = 250 },
         [RC_PROTO_SONY20] = { .name = "sony-20",
-                .scancode_bits = 0x1fff7f, .repeat_period = 100 },
+                .scancode_bits = 0x1fff7f, .repeat_period = 250 },
         [RC_PROTO_NEC] = { .name = "nec",
-                .scancode_bits = 0xffff, .repeat_period = 160 },
+                .scancode_bits = 0xffff, .repeat_period = 250 },
         [RC_PROTO_NECX] = { .name = "nec-x",
-                .scancode_bits = 0xffffff, .repeat_period = 160 },
+                .scancode_bits = 0xffffff, .repeat_period = 250 },
         [RC_PROTO_NEC32] = { .name = "nec-32",
-                .scancode_bits = 0xffffffff, .repeat_period = 160 },
+                .scancode_bits = 0xffffffff, .repeat_period = 250 },
         [RC_PROTO_SANYO] = { .name = "sanyo",
                 .scancode_bits = 0x1fffff, .repeat_period = 250 },
         [RC_PROTO_MCIR2_KBD] = { .name = "mcir2-kbd",
-                .scancode_bits = 0xffff, .repeat_period = 150 },
+                .scancode_bits = 0xffff, .repeat_period = 250 },
         [RC_PROTO_MCIR2_MSE] = { .name = "mcir2-mse",
-                .scancode_bits = 0x1fffff, .repeat_period = 150 },
+                .scancode_bits = 0x1fffff, .repeat_period = 250 },
         [RC_PROTO_RC6_0] = { .name = "rc-6-0",
-                .scancode_bits = 0xffff, .repeat_period = 164 },
+                .scancode_bits = 0xffff, .repeat_period = 250 },
         [RC_PROTO_RC6_6A_20] = { .name = "rc-6-6a-20",
-                .scancode_bits = 0xfffff, .repeat_period = 164 },
+                .scancode_bits = 0xfffff, .repeat_period = 250 },
         [RC_PROTO_RC6_6A_24] = { .name = "rc-6-6a-24",
-                .scancode_bits = 0xffffff, .repeat_period = 164 },
+                .scancode_bits = 0xffffff, .repeat_period = 250 },
         [RC_PROTO_RC6_6A_32] = { .name = "rc-6-6a-32",
-                .scancode_bits = 0xffffffff, .repeat_period = 164 },
+                .scancode_bits = 0xffffffff, .repeat_period = 250 },
         [RC_PROTO_RC6_MCE] = { .name = "rc-6-mce",
-                .scancode_bits = 0xffff7fff, .repeat_period = 164 },
+                .scancode_bits = 0xffff7fff, .repeat_period = 250 },
         [RC_PROTO_SHARP] = { .name = "sharp",
                 .scancode_bits = 0x1fff, .repeat_period = 250 },
         [RC_PROTO_XMP] = { .name = "xmp", .repeat_period = 250 },
@@ -170,10 +170,11 @@ static struct rc_map_list empty_map = {
  * @name:       name to assign to the table
  * @rc_proto:   ir type to assign to the new table
  * @size:       initial size of the table
- * @return:     zero on success or a negative error code
  *
  * This routine will initialize the rc_map and will allocate
  * memory to hold at least the specified number of elements.
+ *
+ * return:      zero on success or a negative error code
  */
 static int ir_create_table(struct rc_map *rc_map,
                            const char *name, u64 rc_proto, size_t size)
@@ -216,10 +217,11 @@ static void ir_free_table(struct rc_map *rc_map)
  * ir_resize_table() - resizes a scancode table if necessary
  * @rc_map:     the rc_map to resize
  * @gfp_flags:  gfp flags to use when allocating memory
- * @return:     zero on success or a negative error code
  *
  * This routine will shrink the rc_map if it has lots of
  * unused entries and grow it if it is full.
+ *
+ * return:      zero on success or a negative error code
  */
 static int ir_resize_table(struct rc_map *rc_map, gfp_t gfp_flags)
 {
@@ -265,11 +267,13 @@ static int ir_resize_table(struct rc_map *rc_map, gfp_t gfp_flags)
  * @dev:        the struct rc_dev device descriptor
  * @rc_map:     scancode table to be adjusted
  * @index:      index of the mapping that needs to be updated
- * @keycode:    the desired keycode
- * @return:     previous keycode assigned to the mapping
+ * @new_keycode: the desired keycode
  *
  * This routine is used to update scancode->keycode mapping at given
  * position.
+ *
+ * return:      previous keycode assigned to the mapping
+ *
  */
 static unsigned int ir_update_mapping(struct rc_dev *dev,
                                       struct rc_map *rc_map,
@@ -320,12 +324,13 @@ static unsigned int ir_update_mapping(struct rc_dev *dev,
  * @scancode:   the desired scancode
  * @resize:     controls whether we allowed to resize the table to
  *              accommodate not yet present scancodes
- * @return:     index of the mapping containing scancode in question
- *              or -1U in case of failure.
  *
  * This routine is used to locate given scancode in rc_map.
  * If scancode is not yet present the routine will allocate a new slot
  * for it.
+ *
+ * return:      index of the mapping containing scancode in question
+ *              or -1U in case of failure.
  */
 static unsigned int ir_establish_scancode(struct rc_dev *dev,
                                           struct rc_map *rc_map,
@@ -375,11 +380,12 @@ static unsigned int ir_establish_scancode(struct rc_dev *dev,
 /**
  * ir_setkeycode() - set a keycode in the scancode->keycode table
  * @idev:       the struct input_dev device descriptor
- * @scancode:   the desired scancode
- * @keycode:    result
- * @return:     -EINVAL if the keycode could not be inserted, otherwise zero.
+ * @ke:         Input keymap entry
+ * @old_keycode: result
  *
  * This routine is used to handle evdev EVIOCSKEY ioctl.
+ *
+ * return:      -EINVAL if the keycode could not be inserted, otherwise zero.
  */
 static int ir_setkeycode(struct input_dev *idev,
                          const struct input_keymap_entry *ke,
@@ -422,11 +428,11 @@ out:
 /**
  * ir_setkeytable() - sets several entries in the scancode->keycode table
  * @dev:        the struct rc_dev device descriptor
- * @to:         the struct rc_map to copy entries to
  * @from:       the struct rc_map to copy entries from
- * @return:     -ENOMEM if all keycodes could not be inserted, otherwise zero.
  *
  * This routine is used to handle table initialization.
+ *
+ * return:      -ENOMEM if all keycodes could not be inserted, otherwise zero.
  */
 static int ir_setkeytable(struct rc_dev *dev,
                           const struct rc_map *from)
@@ -474,10 +480,11 @@ static int rc_map_cmp(const void *key, const void *elt)
  * ir_lookup_by_scancode() - locate mapping by scancode
  * @rc_map:     the struct rc_map to search
  * @scancode:   scancode to look for in the table
- * @return:     index in the table, -1U if not found
  *
  * This routine performs binary search in RC keykeymap table for
  * given scancode.
+ *
+ * return:      index in the table, -1U if not found
  */
 static unsigned int ir_lookup_by_scancode(const struct rc_map *rc_map,
                                           unsigned int scancode)
@@ -495,11 +502,11 @@ static unsigned int ir_lookup_by_scancode(const struct rc_map *rc_map,
 /**
  * ir_getkeycode() - get a keycode from the scancode->keycode table
  * @idev:       the struct input_dev device descriptor
- * @scancode:   the desired scancode
- * @keycode:    used to return the keycode, if found, or KEY_RESERVED
- * @return:     always returns zero.
+ * @ke:         Input keymap entry
  *
  * This routine is used to handle evdev EVIOCGKEY ioctl.
+ *
+ * return:      always returns zero.
  */
 static int ir_getkeycode(struct input_dev *idev,
                          struct input_keymap_entry *ke)
@@ -556,11 +563,12 @@ out:
  * rc_g_keycode_from_table() - gets the keycode that corresponds to a scancode
  * @dev:        the struct rc_dev descriptor of the device
  * @scancode:   the scancode to look for
- * @return:     the corresponding keycode, or KEY_RESERVED
  *
  * This routine is used by drivers which need to convert a scancode to a
  * keycode. Normally it should not be used since drivers should have no
  * interest in keycodes.
+ *
+ * return:      the corresponding keycode, or KEY_RESERVED
  */
 u32 rc_g_keycode_from_table(struct rc_dev *dev, u32 scancode)
 {
@@ -625,7 +633,8 @@ EXPORT_SYMBOL_GPL(rc_keyup);
 
 /**
  * ir_timer_keyup() - generates a keyup event after a timeout
- * @cookie:     a pointer to the struct rc_dev for the device
+ *
+ * @t:          a pointer to the struct timer_list
  *
  * This routine will generate a keyup event some time after a keydown event
  * is generated when no further activity has been detected.
@@ -780,7 +789,8 @@ EXPORT_SYMBOL_GPL(rc_keydown_notimeout);
  *                        provides sensible defaults
  * @dev:        the struct rc_dev descriptor of the device
  * @filter:     the scancode and mask
- * @return:     0 or -EINVAL if the filter is not valid
+ *
+ * return:      0 or -EINVAL if the filter is not valid
  */
 static int rc_validate_filter(struct rc_dev *dev,
                               struct rc_scancode_filter *filter)
diff --git a/drivers/media/rc/sir_ir.c b/drivers/media/rc/sir_ir.c
index 76120664b700..9ee2c9196b4d 100644
--- a/drivers/media/rc/sir_ir.c
+++ b/drivers/media/rc/sir_ir.c
@@ -57,7 +57,7 @@ static void add_read_queue(int flag, unsigned long val);
 static irqreturn_t sir_interrupt(int irq, void *dev_id);
 static void send_space(unsigned long len);
 static void send_pulse(unsigned long len);
-static void init_hardware(void);
+static int init_hardware(void);
 static void drop_hardware(void);
 /* Initialisation */
 
@@ -263,11 +263,36 @@ static void send_pulse(unsigned long len)
         }
 }
 
-static void init_hardware(void)
+static int init_hardware(void)
 {
+        u8 scratch, scratch2, scratch3;
         unsigned long flags;
 
         spin_lock_irqsave(&hardware_lock, flags);
+
+        /*
+         * This is a simple port existence test, borrowed from the autoconfig
+         * function in drivers/tty/serial/8250/8250_port.c
+         */
+        scratch = sinp(UART_IER);
+        soutp(UART_IER, 0);
+#ifdef __i386__
+        outb(0xff, 0x080);
+#endif
+        scratch2 = sinp(UART_IER) & 0x0f;
+        soutp(UART_IER, 0x0f);
+#ifdef __i386__
+        outb(0x00, 0x080);
+#endif
+        scratch3 = sinp(UART_IER) & 0x0f;
+        soutp(UART_IER, scratch);
+        if (scratch2 != 0 || scratch3 != 0x0f) {
+                /* we fail, there's nothing here */
+                spin_unlock_irqrestore(&hardware_lock, flags);
+                pr_err("port existence test failed, cannot continue\n");
+                return -ENODEV;
+        }
+
         /* reset UART */
         outb(0, io + UART_MCR);
         outb(0, io + UART_IER);
@@ -285,6 +310,8 @@ static void init_hardware(void)
         /* turn on UART */
         outb(UART_MCR_DTR | UART_MCR_RTS | UART_MCR_OUT2, io + UART_MCR);
         spin_unlock_irqrestore(&hardware_lock, flags);
+
+        return 0;
 }
 
 static void drop_hardware(void)
@@ -334,14 +361,19 @@ static int sir_ir_probe(struct platform_device *dev)
                 pr_err("IRQ %d already in use.\n", irq);
                 return retval;
         }
+
+        retval = init_hardware();
+        if (retval) {
+                del_timer_sync(&timerlist);
+                return retval;
+        }
+
         pr_info("I/O port 0x%.4x, IRQ %d.\n", io, irq);
 
         retval = devm_rc_register_device(&sir_ir_dev->dev, rcdev);
         if (retval < 0)
                 return retval;
 
-        init_hardware();
-
         return 0;
 }
 
diff --git a/drivers/media/rc/st_rc.c b/drivers/media/rc/st_rc.c
index a8e39c635f34..d2efd7b2c3bc 100644
--- a/drivers/media/rc/st_rc.c
+++ b/drivers/media/rc/st_rc.c
@@ -49,7 +49,7 @@ struct st_rc_device {
 #define IRB_RX_NOISE_SUPPR      0x5c    /* noise suppression  */
 #define IRB_RX_POLARITY_INV     0x68    /* polarity inverter  */
 
-/**
+/*
  * IRQ set: Enable full FIFO                 1  -> bit  3;
  *          Enable overrun IRQ               1  -> bit  2;
  *          Enable last symbol IRQ           1  -> bit  1:
@@ -72,7 +72,7 @@ static void st_rc_send_lirc_timeout(struct rc_dev *rdev)
         ir_raw_event_store(rdev, &ev);
 }
 
-/**
+/*
  * RX graphical example to better understand the difference between ST IR block
  * output and standard definition used by LIRC (and most of the world!)
  *
@@ -317,7 +317,7 @@ static int st_rc_probe(struct platform_device *pdev)
         device_init_wakeup(dev, true);
         dev_pm_set_wake_irq(dev, rc_dev->irq);
 
-        /**
+        /*
          * for LIRC_MODE_MODE2 or LIRC_MODE_PULSE or LIRC_MODE_RAW
          * lircd expects a long space first before a signal train to sync.
          */
diff --git a/drivers/media/rc/streamzap.c b/drivers/media/rc/streamzap.c
index 4eebfcfc10f3..c9a70fda88a8 100644
--- a/drivers/media/rc/streamzap.c
+++ b/drivers/media/rc/streamzap.c
@@ -191,7 +191,7 @@ static void sz_push_half_space(struct streamzap_ir *sz,
         sz_push_full_space(sz, value & SZ_SPACE_MASK);
 }
 
-/**
+/*
  * streamzap_callback - usb IRQ handler callback
  *
  * This procedure is invoked on reception of data from
@@ -321,7 +321,7 @@ out:
         return NULL;
 }
 
-/**
+/*
  *      streamzap_probe
  *
  *      Called by usb-core to associated with a candidate device
@@ -450,7 +450,7 @@ free_sz:
         return retval;
 }
 
-/**
+/*
  * streamzap_disconnect
  *
  * Called by the usb core when the device is removed from the system.
diff --git a/drivers/media/tuners/mt2063.c b/drivers/media/tuners/mt2063.c
index 8b39d8dc97a0..5c87c5c6a455 100644
--- a/drivers/media/tuners/mt2063.c
+++ b/drivers/media/tuners/mt2063.c
@@ -1397,9 +1397,9 @@ static u32 MT2063_Round_fLO(u32 f_LO, u32 f_LO_Step, u32 f_ref)
  *                        risk of overflow.  It accurately calculates
  *                        f_ref * num / denom to within 1 HZ with fixed math.
  *
- * @num :       Fractional portion of the multiplier
+ * @f_ref:      SRO frequency.
+ * @num:        Fractional portion of the multiplier
  * @denom:      denominator portion of the ratio
- * @f_Ref:      SRO frequency.
  *
  * This calculation handles f_ref as two separate 14-bit fields.
  * Therefore, a maximum value of 2^28-1 may safely be used for f_ref.
@@ -1464,8 +1464,6 @@ static u32 MT2063_CalcLO1Mult(u32 *Div,
  * @f_LO:       desired LO frequency.
  * @f_LO_Step:  Minimum step size for the LO (in Hz).
  * @f_Ref:      SRO frequency.
- * @f_Avoid:    Range of PLL frequencies to avoid near
- *              integer multiples of f_Ref (in Hz).
  *
  * Returns: Recalculated LO frequency.
  */
diff --git a/drivers/media/usb/dvb-usb/cinergyT2-fe.c b/drivers/media/usb/dvb-usb/cinergyT2-fe.c
index f9772ad0a2a5..5a2f81311fb7 100644
--- a/drivers/media/usb/dvb-usb/cinergyT2-fe.c
+++ b/drivers/media/usb/dvb-usb/cinergyT2-fe.c
@@ -26,7 +26,7 @@
 #include "cinergyT2.h"
 
 
-/**
+/*
  *  convert linux-dvb frontend parameter set into TPS.
  *  See ETSI ETS-300744, section 4.6.2, table 9 for details.
  *
diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c
index 92098c1b78e5..366b05529915 100644
--- a/drivers/media/usb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/usb/dvb-usb/dib0700_devices.c
@@ -1677,10 +1677,10 @@ static int dib8096_set_param_override(struct dvb_frontend *fe)
                 return -EINVAL;
         }
 
-        /** Update PLL if needed ratio **/
+        /* Update PLL if needed ratio */
         state->dib8000_ops.update_pll(fe, &dib8090_pll_config_12mhz, fe->dtv_property_cache.bandwidth_hz / 1000, 0);
 
-        /** Get optimize PLL ratio to remove spurious **/
+        /* Get optimize PLL ratio to remove spurious */
         pll_ratio = dib8090_compute_pll_parameters(fe);
         if (pll_ratio == 17)
                 timf = 21387946;
@@ -1691,7 +1691,7 @@ static int dib8096_set_param_override(struct dvb_frontend *fe)
         else
                 timf = 18179756;
 
-        /** Update ratio **/
+        /* Update ratio */
         state->dib8000_ops.update_pll(fe, &dib8090_pll_config_12mhz, fe->dtv_property_cache.bandwidth_hz / 1000, pll_ratio);
 
         state->dib8000_ops.ctrl_timf(fe, DEMOD_TIMF_SET, timf);
@@ -3357,7 +3357,7 @@ static int novatd_sleep_override(struct dvb_frontend* fe)
         return state->sleep(fe);
 }
 
-/**
+/*
  * novatd_frontend_attach - Nova-TD specific attach
  *
  * Nova-TD has GPIO0, 1 and 2 for LEDs. So do not fiddle with them except for
diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c
index 8207e6900656..bcacb0f22028 100644
--- a/drivers/media/usb/dvb-usb/dibusb-common.c
+++ b/drivers/media/usb/dvb-usb/dibusb-common.c
@@ -223,8 +223,20 @@ EXPORT_SYMBOL(dibusb_i2c_algo);
 
 int dibusb_read_eeprom_byte(struct dvb_usb_device *d, u8 offs, u8 *val)
 {
-        u8 wbuf[1] = { offs };
-        return dibusb_i2c_msg(d, 0x50, wbuf, 1, val, 1);
+        u8 *buf;
+        int rc;
+
+        buf = kmalloc(2, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        buf[0] = offs;
+
+        rc = dibusb_i2c_msg(d, 0x50, &buf[0], 1, &buf[1], 1);
+        *val = buf[1];
+        kfree(buf);
+
+        return rc;
 }
 EXPORT_SYMBOL(dibusb_read_eeprom_byte);
 
diff --git a/drivers/media/usb/dvb-usb/friio-fe.c b/drivers/media/usb/dvb-usb/friio-fe.c
index 41261317bd5c..b6046e0e07f6 100644
--- a/drivers/media/usb/dvb-usb/friio-fe.c
+++ b/drivers/media/usb/dvb-usb/friio-fe.c
@@ -297,7 +297,7 @@ static int jdvbt90502_set_frontend(struct dvb_frontend *fe)
 }
 
 
-/**
+/*
  * (reg, val) commad list to initialize this module.
  *  captured on a Windows box.
  */
diff --git a/drivers/media/usb/dvb-usb/friio.c b/drivers/media/usb/dvb-usb/friio.c
index 62abe6c43a32..16875945e662 100644
--- a/drivers/media/usb/dvb-usb/friio.c
+++ b/drivers/media/usb/dvb-usb/friio.c
@@ -21,7 +21,7 @@ MODULE_PARM_DESC(debug,
 
 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 
-/**
+/*
  * Indirect I2C access to the PLL via FE.
  * whole I2C protocol data to the PLL is sent via the FE's I2C register.
  * This is done by a control msg to the FE with the I2C data accompanied, and
diff --git a/drivers/media/usb/gspca/ov519.c b/drivers/media/usb/gspca/ov519.c
index f1537daf4e2e..1b30434b72ef 100644
--- a/drivers/media/usb/gspca/ov519.c
+++ b/drivers/media/usb/gspca/ov519.c
@@ -1,4 +1,4 @@
-/**
+/*
  * OV519 driver
  *
  * Copyright (C) 2008-2011 Jean-François Moine <moinejf@free.fr>
diff --git a/drivers/media/usb/pwc/pwc-dec23.c b/drivers/media/usb/pwc/pwc-dec23.c
index 3792fedff951..1283b3bd9800 100644
--- a/drivers/media/usb/pwc/pwc-dec23.c
+++ b/drivers/media/usb/pwc/pwc-dec23.c
@@ -649,11 +649,10 @@ static void DecompressBand23(struct pwc_dec23_private *pdec,
 }
 
 /**
- *
  * Uncompress a pwc23 buffer.
- *
- * src: raw data
- * dst: image output
+ * @pdev: pointer to pwc device's internal struct
+ * @src: raw data
+ * @dst: image output
  */
 void pwc_dec23_decompress(struct pwc_device *pdev,
                           const void *src,
diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
index 8c1f926567ec..d07349cf9489 100644
--- a/drivers/media/usb/siano/smsusb.c
+++ b/drivers/media/usb/siano/smsusb.c
@@ -74,7 +74,7 @@ struct smsusb_device_t {
 static int smsusb_submit_urb(struct smsusb_device_t *dev,
                              struct smsusb_urb_t *surb);
 
-/**
+/*
  * Completing URB's callback handler - bottom half (proccess context)
  * submits the URB prepared on smsusb_onresponse()
  */
@@ -86,7 +86,7 @@ static void do_submit_urb(struct work_struct *work)
         smsusb_submit_urb(dev, surb);
 }
 
-/**
+/*
  * Completing URB's callback handler - top half (interrupt context)
  * adds completing sms urb to the global surbs list and activtes the worker
  * thread the surb
diff --git a/drivers/media/usb/ttusb-budget/dvb-ttusb-budget.c b/drivers/media/usb/ttusb-budget/dvb-ttusb-budget.c
index b842f367249f..a142b9dc0feb 100644
--- a/drivers/media/usb/ttusb-budget/dvb-ttusb-budget.c
+++ b/drivers/media/usb/ttusb-budget/dvb-ttusb-budget.c
@@ -76,7 +76,7 @@ DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 #define TTUSB_REV_2_2   0x22
 #define TTUSB_BUDGET_NAME "ttusb_stc_fw"
 
-/**
+/*
  *  since we're casting (struct ttusb*) <-> (struct dvb_demux*) around
  *  the dvb_demux field must be the first in struct!!
  */
@@ -713,7 +713,7 @@ static void ttusb_process_frame(struct ttusb *ttusb, u8 * data, int len)
                                         }
                                 }
 
-                        /**
+                        /*
                          * if length is valid and we reached the end:
                          * goto next muxpack
                          */
@@ -729,7 +729,7 @@ static void ttusb_process_frame(struct ttusb *ttusb, u8 * data, int len)
                                         /* maximum bytes, until we know the length */
                                         ttusb->muxpack_len = 2;
 
-                                /**
+                                /*
                                  * no muxpacks left?
                                  * return to search-sync state
                                  */
diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c
index b55b79b8e921..127f8a0c098b 100644
--- a/drivers/media/usb/usbtv/usbtv-core.c
+++ b/drivers/media/usb/usbtv/usbtv-core.c
@@ -144,6 +144,7 @@ static void usbtv_disconnect(struct usb_interface *intf)
 
 static const struct usb_device_id usbtv_id_table[] = {
         { USB_DEVICE(0x1b71, 0x3002) },
+        { USB_DEVICE(0x1f71, 0x3301) },
         {}
 };
 MODULE_DEVICE_TABLE(usb, usbtv_id_table);
diff --git a/drivers/media/v4l2-core/tuner-core.c b/drivers/media/v4l2-core/tuner-core.c
index 8db45dfc271b..82852f23a3b6 100644
--- a/drivers/media/v4l2-core/tuner-core.c
+++ b/drivers/media/v4l2-core/tuner-core.c
@@ -239,7 +239,7 @@ static const struct analog_demod_ops tuner_analog_ops = {
  * @type:               type of the tuner (e. g. tuner number)
  * @new_mode_mask:      Indicates if tuner supports TV and/or Radio
  * @new_config:         an optional parameter used by a few tuners to adjust
-                        internal parameters, like LNA mode
+ *                      internal parameters, like LNA mode
  * @tuner_callback:     an optional function to be called when switching
  *                      to analog mode
  *
@@ -750,6 +750,7 @@ static int tuner_remove(struct i2c_client *client)
 /**
  * check_mode - Verify if tuner supports the requested mode
  * @t: a pointer to the module's internal struct_tuner
+ * @mode: mode of the tuner, as defined by &enum v4l2_tuner_type.
  *
  * This function checks if the tuner is capable of tuning analog TV,
  * digital TV or radio, depending on what the caller wants. If the
@@ -757,6 +758,7 @@ static int tuner_remove(struct i2c_client *client)
  * returns 0.
  * This function is needed for boards that have a separate tuner for
  * radio (like devices with tea5767).
+ *
  * NOTE: mt20xx uses V4L2_TUNER_DIGITAL_TV and calls set_tv_freq to
  *       select a TV frequency. So, t_mode = T_ANALOG_TV could actually
  *       be used to represent a Digital TV too.
diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
index a7c3464976f2..e5acfab470a5 100644
--- a/drivers/media/v4l2-core/v4l2-async.c
+++ b/drivers/media/v4l2-core/v4l2-async.c
@@ -558,8 +558,7 @@ int v4l2_async_register_subdev(struct v4l2_subdev *sd)
                 if (!asd)
                         continue;
 
-                ret = v4l2_async_match_notify(notifier, notifier->v4l2_dev, sd,
-                                              asd);
+                ret = v4l2_async_match_notify(notifier, v4l2_dev, sd, asd);
                 if (ret)
                         goto err_unbind;
 
diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
index 5c8c49d240d1..930f9c53a64e 100644
--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
+++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
@@ -245,11 +245,11 @@ EXPORT_SYMBOL_GPL(v4l2_find_dv_timings_cea861_vic);
 
 /**
  * v4l2_match_dv_timings - check if two timings match
- * @t1 - compare this v4l2_dv_timings struct...
- * @t2 - with this struct.
- * @pclock_delta - the allowed pixelclock deviation.
- * @match_reduced_fps - if true, then fail if V4L2_DV_FL_REDUCED_FPS does not
- * match.
+ * @t1: compare this v4l2_dv_timings struct...
+ * @t2: with this struct.
+ * @pclock_delta: the allowed pixelclock deviation.
+ * @match_reduced_fps: if true, then fail if V4L2_DV_FL_REDUCED_FPS does not
+ *      match.
  *
  * Compare t1 with t2 with a given margin of error for the pixelclock.
  */
diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c
index 681b192420d9..fb72c7ac04d4 100644
--- a/drivers/media/v4l2-core/v4l2-fwnode.c
+++ b/drivers/media/v4l2-core/v4l2-fwnode.c
@@ -458,11 +458,6 @@ static int __v4l2_async_notifier_parse_fwnode_endpoints(
                 if (!is_available)
                         continue;
 
-                if (WARN_ON(notifier->num_subdevs >= notifier->max_subdevs)) {
-                        ret = -EINVAL;
-                        break;
-                }
-
                 if (has_port) {
                         struct fwnode_endpoint ep;
 
@@ -474,6 +469,11 @@ static int __v4l2_async_notifier_parse_fwnode_endpoints(
                                 continue;
                 }
 
+                if (WARN_ON(notifier->num_subdevs >= notifier->max_subdevs)) {
+                        ret = -EINVAL;
+                        break;
+                }
+
                 ret = v4l2_async_notifier_fwnode_parse_endpoint(
                         dev, notifier, fwnode, asd_struct_size, parse_endpoint);
                 if (ret < 0)
diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
index f62e68aa04c4..bc580fbe18fa 100644
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -183,6 +183,7 @@ EXPORT_SYMBOL(v4l2_m2m_get_curr_priv);
 
 /**
  * v4l2_m2m_try_run() - select next job to perform and run it if possible
+ * @m2m_dev: per-device context
  *
  * Get next transaction (if present) from the waiting jobs list and run it.
  */
@@ -281,6 +282,7 @@ EXPORT_SYMBOL_GPL(v4l2_m2m_try_schedule);
 
 /**
  * v4l2_m2m_cancel_job() - cancel pending jobs for the context
+ * @m2m_ctx: m2m context with jobs to be canceled
  *
  * In case of streamoff or release called on any context,
  * 1] If the context is currently running, then abort job will be called
diff --git a/drivers/media/v4l2-core/videobuf-core.c b/drivers/media/v4l2-core/videobuf-core.c
index 1dbf6f7785bb..e87fb13b22dc 100644
--- a/drivers/media/v4l2-core/videobuf-core.c
+++ b/drivers/media/v4l2-core/videobuf-core.c
@@ -222,7 +222,7 @@ int videobuf_queue_is_busy(struct videobuf_queue *q)
 }
 EXPORT_SYMBOL_GPL(videobuf_queue_is_busy);
 
-/**
+/*
  * __videobuf_free() - free all the buffers and their control structures
  *
  * This function can only be called if streaming/reading is off, i.e. no buffers
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index cb115ba6a1d2..a8589d96ef72 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -188,7 +188,7 @@ module_param(debug, int, 0644);
 static void __vb2_queue_cancel(struct vb2_queue *q);
 static void __enqueue_in_driver(struct vb2_buffer *vb);
 
-/**
+/*
  * __vb2_buf_mem_alloc() - allocate video memory for the given buffer
  */
 static int __vb2_buf_mem_alloc(struct vb2_buffer *vb)
@@ -229,7 +229,7 @@ free:
         return ret;
 }
 
-/**
+/*
  * __vb2_buf_mem_free() - free memory of the given buffer
  */
 static void __vb2_buf_mem_free(struct vb2_buffer *vb)
@@ -243,7 +243,7 @@ static void __vb2_buf_mem_free(struct vb2_buffer *vb)
         }
 }
 
-/**
+/*
  * __vb2_buf_userptr_put() - release userspace memory associated with
  * a USERPTR buffer
  */
@@ -258,7 +258,7 @@ static void __vb2_buf_userptr_put(struct vb2_buffer *vb)
         }
 }
 
-/**
+/*
  * __vb2_plane_dmabuf_put() - release memory associated with
  * a DMABUF shared plane
  */
@@ -277,7 +277,7 @@ static void __vb2_plane_dmabuf_put(struct vb2_buffer *vb, struct vb2_plane *p)
         p->dbuf_mapped = 0;
 }
 
-/**
+/*
  * __vb2_buf_dmabuf_put() - release memory associated with
  * a DMABUF shared buffer
  */
@@ -289,7 +289,7 @@ static void __vb2_buf_dmabuf_put(struct vb2_buffer *vb)
                 __vb2_plane_dmabuf_put(vb, &vb->planes[plane]);
 }
 
-/**
+/*
  * __setup_offsets() - setup unique offsets ("cookies") for every plane in
  * the buffer.
  */
@@ -317,7 +317,7 @@ static void __setup_offsets(struct vb2_buffer *vb)
         }
 }
 
-/**
+/*
  * __vb2_queue_alloc() - allocate videobuf buffer structures and (for MMAP type)
  * video buffer memory for all buffers/planes on the queue and initializes the
  * queue
@@ -386,7 +386,7 @@ static int __vb2_queue_alloc(struct vb2_queue *q, enum vb2_memory memory,
         return buffer;
 }
 
-/**
+/*
  * __vb2_free_mem() - release all video buffer memory for a given queue
  */
 static void __vb2_free_mem(struct vb2_queue *q, unsigned int buffers)
@@ -410,7 +410,7 @@ static void __vb2_free_mem(struct vb2_queue *q, unsigned int buffers)
         }
 }
 
-/**
+/*
  * __vb2_queue_free() - free buffers at the end of the queue - video memory and
  * related information, if no buffers are left return the queue to an
  * uninitialized state. Might be called even if the queue has already been freed.
@@ -544,7 +544,7 @@ bool vb2_buffer_in_use(struct vb2_queue *q, struct vb2_buffer *vb)
 }
 EXPORT_SYMBOL(vb2_buffer_in_use);
 
-/**
+/*
  * __buffers_in_use() - return true if any buffers on the queue are in use and
  * the queue cannot be freed (by the means of REQBUFS(0)) call
  */
@@ -564,7 +564,7 @@ void vb2_core_querybuf(struct vb2_queue *q, unsigned int index, void *pb)
 }
 EXPORT_SYMBOL_GPL(vb2_core_querybuf);
 
-/**
+/*
  * __verify_userptr_ops() - verify that all memory operations required for
  * USERPTR queue type have been provided
  */
@@ -577,7 +577,7 @@ static int __verify_userptr_ops(struct vb2_queue *q)
         return 0;
 }
 
-/**
+/*
  * __verify_mmap_ops() - verify that all memory operations required for
  * MMAP queue type have been provided
  */
@@ -590,7 +590,7 @@ static int __verify_mmap_ops(struct vb2_queue *q)
         return 0;
 }
 
-/**
+/*
  * __verify_dmabuf_ops() - verify that all memory operations required for
  * DMABUF queue type have been provided
  */
@@ -953,7 +953,7 @@ void vb2_discard_done(struct vb2_queue *q)
 }
 EXPORT_SYMBOL_GPL(vb2_discard_done);
 
-/**
+/*
  * __prepare_mmap() - prepare an MMAP buffer
  */
 static int __prepare_mmap(struct vb2_buffer *vb, const void *pb)
@@ -966,7 +966,7 @@ static int __prepare_mmap(struct vb2_buffer *vb, const void *pb)
         return ret ? ret : call_vb_qop(vb, buf_prepare, vb);
 }
 
-/**
+/*
  * __prepare_userptr() - prepare a USERPTR buffer
  */
 static int __prepare_userptr(struct vb2_buffer *vb, const void *pb)
@@ -1082,7 +1082,7 @@ err:
         return ret;
 }
 
-/**
+/*
  * __prepare_dmabuf() - prepare a DMABUF buffer
  */
 static int __prepare_dmabuf(struct vb2_buffer *vb, const void *pb)
@@ -1215,7 +1215,7 @@ err:
         return ret;
 }
 
-/**
+/*
  * __enqueue_in_driver() - enqueue a vb2_buffer in driver for processing
  */
 static void __enqueue_in_driver(struct vb2_buffer *vb)
@@ -1298,7 +1298,7 @@ int vb2_core_prepare_buf(struct vb2_queue *q, unsigned int index, void *pb)
 }
 EXPORT_SYMBOL_GPL(vb2_core_prepare_buf);
 
-/**
+/*
  * vb2_start_streaming() - Attempt to start streaming.
  * @q:          videobuf2 queue
  *
@@ -1427,7 +1427,7 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb)
 }
 EXPORT_SYMBOL_GPL(vb2_core_qbuf);
 
-/**
+/*
  * __vb2_wait_for_done_vb() - wait for a buffer to become available
  * for dequeuing
  *
@@ -1502,7 +1502,7 @@ static int __vb2_wait_for_done_vb(struct vb2_queue *q, int nonblocking)
         return 0;
 }
 
-/**
+/*
  * __vb2_get_done_vb() - get a buffer ready for dequeuing
  *
  * Will sleep if required for nonblocking == false.
@@ -1553,7 +1553,7 @@ int vb2_wait_for_all_buffers(struct vb2_queue *q)
 }
 EXPORT_SYMBOL_GPL(vb2_wait_for_all_buffers);
 
-/**
+/*
  * __vb2_dqbuf() - bring back the buffer to the DEQUEUED state
  */
 static void __vb2_dqbuf(struct vb2_buffer *vb)
@@ -1625,7 +1625,7 @@ int vb2_core_dqbuf(struct vb2_queue *q, unsigned int *pindex, void *pb,
 }
 EXPORT_SYMBOL_GPL(vb2_core_dqbuf);
 
-/**
+/*
  * __vb2_queue_cancel() - cancel and stop (pause) streaming
  *
  * Removes all queued buffers from driver's queue and all buffers queued by
@@ -1773,7 +1773,7 @@ int vb2_core_streamoff(struct vb2_queue *q, unsigned int type)
 }
 EXPORT_SYMBOL_GPL(vb2_core_streamoff);
 
-/**
+/*
  * __find_plane_by_offset() - find plane associated with the given offset off
  */
 static int __find_plane_by_offset(struct vb2_queue *q, unsigned long off,
@@ -2104,7 +2104,7 @@ unsigned int vb2_core_poll(struct vb2_queue *q, struct file *file,
 }
 EXPORT_SYMBOL_GPL(vb2_core_poll);
 
-/**
+/*
  * struct vb2_fileio_buf - buffer context used by file io emulator
  *
  * vb2 provides a compatibility layer and emulator of file io (read and
@@ -2118,7 +2118,7 @@ struct vb2_fileio_buf {
         unsigned int queued:1;
 };
 
-/**
+/*
  * struct vb2_fileio_data - queue context used by file io emulator
  *
  * @cur_index:  the index of the buffer currently being read from or
@@ -2155,7 +2155,7 @@ struct vb2_fileio_data {
         unsigned write_immediately:1;
 };
 
-/**
+/*
  * __vb2_init_fileio() - initialize file io emulator
  * @q:          videobuf2 queue
  * @read:       mode selector (1 means read, 0 means write)
@@ -2274,7 +2274,7 @@ err_kfree:
         return ret;
 }
 
-/**
+/*
  * __vb2_cleanup_fileio() - free resourced used by file io emulator
  * @q:          videobuf2 queue
  */
@@ -2293,7 +2293,7 @@ static int __vb2_cleanup_fileio(struct vb2_queue *q)
         return 0;
 }
 
-/**
+/*
  * __vb2_perform_fileio() - perform a single file io (read or write) operation
  * @q:          videobuf2 queue
  * @data:       pointed to target userspace buffer
diff --git a/drivers/media/v4l2-core/videobuf2-memops.c b/drivers/media/v4l2-core/videobuf2-memops.c
index 4bb8424114ce..89e51989332b 100644
--- a/drivers/media/v4l2-core/videobuf2-memops.c
+++ b/drivers/media/v4l2-core/videobuf2-memops.c
@@ -120,7 +120,7 @@ static void vb2_common_vm_close(struct vm_area_struct *vma)
         h->put(h->arg);
 }
 
-/**
+/*
  * vb2_common_vm_ops - common vm_ops used for tracking refcount of mmaped
  * video buffers
  */
diff --git a/drivers/media/v4l2-core/videobuf2-v4l2.c b/drivers/media/v4l2-core/videobuf2-v4l2.c
index 0c0669976bdc..4075314a6989 100644
--- a/drivers/media/v4l2-core/videobuf2-v4l2.c
+++ b/drivers/media/v4l2-core/videobuf2-v4l2.c
@@ -49,7 +49,7 @@ module_param(debug, int, 0644);
 #define V4L2_BUFFER_OUT_FLAGS   (V4L2_BUF_FLAG_PFRAME | V4L2_BUF_FLAG_BFRAME | \
                                  V4L2_BUF_FLAG_KEYFRAME | V4L2_BUF_FLAG_TIMECODE)
 
-/**
+/*
  * __verify_planes_array() - verify that the planes array passed in struct
  * v4l2_buffer from userspace can be safely used
  */
@@ -78,7 +78,7 @@ static int __verify_planes_array_core(struct vb2_buffer *vb, const void *pb)
         return __verify_planes_array(vb, pb);
 }
 
-/**
+/*
  * __verify_length() - Verify that the bytesused value for each plane fits in
  * the plane length and that the data offset doesn't exceed the bytesused value.
  */
@@ -181,7 +181,7 @@ static int vb2_queue_or_prepare_buf(struct vb2_queue *q, struct v4l2_buffer *b,
         return __verify_planes_array(q->bufs[b->index], b);
 }
 
-/**
+/*
  * __fill_v4l2_buffer() - fill in a struct v4l2_buffer with information to be
  * returned to userspace
  */
@@ -286,7 +286,7 @@ static void __fill_v4l2_buffer(struct vb2_buffer *vb, void *pb)
                 q->last_buffer_dequeued = true;
 }
 
-/**
+/*
  * __fill_vb2_buffer() - fill a vb2_buffer with information provided in a
  * v4l2_buffer by the userspace. It also verifies that struct
  * v4l2_buffer has a valid number of planes.
@@ -446,7 +446,7 @@ static const struct vb2_buf_ops v4l2_buf_ops = {
         .copy_timestamp         = __copy_timestamp,
 };
 
-/**
+/*
  * vb2_querybuf() - query video buffer information
  * @q:          videobuf queue
  * @b:          buffer struct passed from userspace to vidioc_querybuf handler
diff --git a/drivers/mfd/arizona-irq.c b/drivers/mfd/arizona-irq.c
index 09cf3699e354..a307832d7e45 100644
--- a/drivers/mfd/arizona-irq.c
+++ b/drivers/mfd/arizona-irq.c
@@ -184,6 +184,7 @@ static struct irq_chip arizona_irq_chip = {
 };
 
 static struct lock_class_key arizona_irq_lock_class;
+static struct lock_class_key arizona_irq_request_class;
 
 static int arizona_irq_map(struct irq_domain *h, unsigned int virq,
                               irq_hw_number_t hw)
@@ -191,7 +192,8 @@ static int arizona_irq_map(struct irq_domain *h, unsigned int virq,
         struct arizona *data = h->host_data;
 
         irq_set_chip_data(virq, data);
-        irq_set_lockdep_class(virq, &arizona_irq_lock_class);
+        irq_set_lockdep_class(virq, &arizona_irq_lock_class,
+                &arizona_irq_request_class);
         irq_set_chip_and_handler(virq, &arizona_irq_chip, handle_simple_irq);
         irq_set_nested_thread(virq, 1);
         irq_set_noprobe(virq);
diff --git a/drivers/mfd/cros_ec_spi.c b/drivers/mfd/cros_ec_spi.c
index c9714072e224..59c82cdcf48d 100644
--- a/drivers/mfd/cros_ec_spi.c
+++ b/drivers/mfd/cros_ec_spi.c
@@ -377,6 +377,7 @@ static int cros_ec_pkt_xfer_spi(struct cros_ec_device *ec_dev,
         u8 *ptr;
         u8 *rx_buf;
         u8 sum;
+        u8 rx_byte;
         int ret = 0, final_ret;
 
         len = cros_ec_prepare_tx(ec_dev, ec_msg);
@@ -421,25 +422,22 @@ static int cros_ec_pkt_xfer_spi(struct cros_ec_device *ec_dev,
         if (!ret) {
                 /* Verify that EC can process command */
                 for (i = 0; i < len; i++) {
-                        switch (rx_buf[i]) {
-                        case EC_SPI_PAST_END:
-                        case EC_SPI_RX_BAD_DATA:
-                        case EC_SPI_NOT_READY:
-                                ret = -EAGAIN;
-                                ec_msg->result = EC_RES_IN_PROGRESS;
-                        default:
+                        rx_byte = rx_buf[i];
+                        if (rx_byte == EC_SPI_PAST_END  ||
+                            rx_byte == EC_SPI_RX_BAD_DATA ||
+                            rx_byte == EC_SPI_NOT_READY) {
+                                ret = -EREMOTEIO;
                                 break;
                         }
-                        if (ret)
-                                break;
                 }
-                if (!ret)
-                        ret = cros_ec_spi_receive_packet(ec_dev,
-                                        ec_msg->insize + sizeof(*response));
-        } else {
-                dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
         }
 
+        if (!ret)
+                ret = cros_ec_spi_receive_packet(ec_dev,
+                                ec_msg->insize + sizeof(*response));
+        else
+                dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
+
         final_ret = terminate_request(ec_dev);
 
         spi_bus_unlock(ec_spi->spi->master);
@@ -508,6 +506,7 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
         int i, len;
         u8 *ptr;
         u8 *rx_buf;
+        u8 rx_byte;
         int sum;
         int ret = 0, final_ret;
 
@@ -544,25 +543,22 @@ static int cros_ec_cmd_xfer_spi(struct cros_ec_device *ec_dev,
         if (!ret) {
                 /* Verify that EC can process command */
                 for (i = 0; i < len; i++) {
-                        switch (rx_buf[i]) {
-                        case EC_SPI_PAST_END:
-                        case EC_SPI_RX_BAD_DATA:
-                        case EC_SPI_NOT_READY:
-                                ret = -EAGAIN;
-                                ec_msg->result = EC_RES_IN_PROGRESS;
-                        default:
+                        rx_byte = rx_buf[i];
+                        if (rx_byte == EC_SPI_PAST_END  ||
+                            rx_byte == EC_SPI_RX_BAD_DATA ||
+                            rx_byte == EC_SPI_NOT_READY) {
+                                ret = -EREMOTEIO;
                                 break;
                         }
-                        if (ret)
-                                break;
                 }
-                if (!ret)
-                        ret = cros_ec_spi_receive_response(ec_dev,
-                                        ec_msg->insize + EC_MSG_TX_PROTO_BYTES);
-        } else {
-                dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
         }
 
+        if (!ret)
+                ret = cros_ec_spi_receive_response(ec_dev,
+                                ec_msg->insize + EC_MSG_TX_PROTO_BYTES);
+        else
+                dev_err(ec_dev->dev, "spi transfer failed: %d\n", ret);
+
         final_ret = terminate_request(ec_dev);
 
         spi_bus_unlock(ec_spi->spi->master);
@@ -667,6 +663,7 @@ static int cros_ec_spi_probe(struct spi_device *spi)
                            sizeof(struct ec_response_get_protocol_info);
         ec_dev->dout_size = sizeof(struct ec_host_request);
 
+        ec_spi->last_transfer_ns = ktime_get_ns();
 
         err = cros_ec_register(ec_dev);
         if (err) {
diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
index 590fb9aad77d..c3ed885c155c 100644
--- a/drivers/mfd/rtsx_pcr.c
+++ b/drivers/mfd/rtsx_pcr.c
@@ -1543,6 +1543,9 @@ static void rtsx_pci_shutdown(struct pci_dev *pcidev)
         rtsx_pci_power_off(pcr, HOST_ENTER_S1);
 
         pci_disable_device(pcidev);
+        free_irq(pcr->irq, (void *)pcr);
+        if (pcr->msi_en)
+                pci_disable_msi(pcr->pci);
 }
 
 #else /* CONFIG_PM */
diff --git a/drivers/mfd/twl4030-audio.c b/drivers/mfd/twl4030-audio.c
index da16bf45fab4..dc94ffc6321a 100644
--- a/drivers/mfd/twl4030-audio.c
+++ b/drivers/mfd/twl4030-audio.c
@@ -159,13 +159,18 @@ unsigned int twl4030_audio_get_mclk(void)
 EXPORT_SYMBOL_GPL(twl4030_audio_get_mclk);
 
 static bool twl4030_audio_has_codec(struct twl4030_audio_data *pdata,
-                              struct device_node *node)
+                              struct device_node *parent)
 {
+        struct device_node *node;
+
         if (pdata && pdata->codec)
                 return true;
 
-        if (of_find_node_by_name(node, "codec"))
+        node = of_get_child_by_name(parent, "codec");
+        if (node) {
+                of_node_put(node);
                 return true;
+        }
 
         return false;
 }
diff --git a/drivers/mfd/twl6040.c b/drivers/mfd/twl6040.c
index d66502d36ba0..dd19f17a1b63 100644
--- a/drivers/mfd/twl6040.c
+++ b/drivers/mfd/twl6040.c
@@ -97,12 +97,16 @@ static struct reg_sequence twl6040_patch[] = {
 };
 
 
-static bool twl6040_has_vibra(struct device_node *node)
+static bool twl6040_has_vibra(struct device_node *parent)
 {
-#ifdef CONFIG_OF
-        if (of_find_node_by_name(node, "vibra"))
+        struct device_node *node;
+
+        node = of_get_child_by_name(parent, "vibra");
+        if (node) {
+                of_node_put(node);
                 return true;
-#endif
+        }
+
         return false;
 }
 
diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index 305a7a464d09..4d63ac8a82e0 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -562,7 +562,7 @@ static ssize_t at24_eeprom_write_i2c(struct at24_data *at24, const char *buf,
 static int at24_read(void *priv, unsigned int off, void *val, size_t count)
 {
         struct at24_data *at24 = priv;
-        struct i2c_client *client;
+        struct device *dev = &at24->client[0]->dev;
         char *buf = val;
         int ret;
 
@@ -572,11 +572,9 @@ static int at24_read(void *priv, unsigned int off, void *val, size_t count)
         if (off + count > at24->chip.byte_len)
                 return -EINVAL;
 
-        client = at24_translate_offset(at24, &off);
-
-        ret = pm_runtime_get_sync(&client->dev);
+        ret = pm_runtime_get_sync(dev);
         if (ret < 0) {
-                pm_runtime_put_noidle(&client->dev);
+                pm_runtime_put_noidle(dev);
                 return ret;
         }
 
@@ -592,7 +590,7 @@ static int at24_read(void *priv, unsigned int off, void *val, size_t count)
                 status = at24->read_func(at24, buf, off, count);
                 if (status < 0) {
                         mutex_unlock(&at24->lock);
-                        pm_runtime_put(&client->dev);
+                        pm_runtime_put(dev);
                         return status;
                 }
                 buf += status;
@@ -602,7 +600,7 @@ static int at24_read(void *priv, unsigned int off, void *val, size_t count)
 
         mutex_unlock(&at24->lock);
 
-        pm_runtime_put(&client->dev);
+        pm_runtime_put(dev);
 
         return 0;
 }
@@ -610,7 +608,7 @@ static int at24_read(void *priv, unsigned int off, void *val, size_t count)
 static int at24_write(void *priv, unsigned int off, void *val, size_t count)
 {
         struct at24_data *at24 = priv;
-        struct i2c_client *client;
+        struct device *dev = &at24->client[0]->dev;
         char *buf = val;
         int ret;
 
@@ -620,11 +618,9 @@ static int at24_write(void *priv, unsigned int off, void *val, size_t count)
         if (off + count > at24->chip.byte_len)
                 return -EINVAL;
 
-        client = at24_translate_offset(at24, &off);
-
-        ret = pm_runtime_get_sync(&client->dev);
+        ret = pm_runtime_get_sync(dev);
         if (ret < 0) {
-                pm_runtime_put_noidle(&client->dev);
+                pm_runtime_put_noidle(dev);
                 return ret;
         }
 
@@ -640,7 +636,7 @@ static int at24_write(void *priv, unsigned int off, void *val, size_t count)
                 status = at24->write_func(at24, buf, off, count);
                 if (status < 0) {
                         mutex_unlock(&at24->lock);
-                        pm_runtime_put(&client->dev);
+                        pm_runtime_put(dev);
                         return status;
                 }
                 buf += status;
@@ -650,7 +646,7 @@ static int at24_write(void *priv, unsigned int off, void *val, size_t count)
 
         mutex_unlock(&at24->lock);
 
-        pm_runtime_put(&client->dev);
+        pm_runtime_put(dev);
 
         return 0;
 }
@@ -880,7 +876,7 @@ static int at24_probe(struct i2c_client *client, const struct i2c_device_id *id)
         at24->nvmem_config.reg_read = at24_read;
         at24->nvmem_config.reg_write = at24_write;
         at24->nvmem_config.priv = at24;
-        at24->nvmem_config.stride = 4;
+        at24->nvmem_config.stride = 1;
         at24->nvmem_config.word_size = 1;
         at24->nvmem_config.size = chip.byte_len;
 
diff --git a/drivers/misc/pti.c b/drivers/misc/pti.c
index eda38cbe8530..41f2a9f6851d 100644
--- a/drivers/misc/pti.c
+++ b/drivers/misc/pti.c
@@ -32,7 +32,7 @@
 #include <linux/pci.h>
 #include <linux/mutex.h>
 #include <linux/miscdevice.h>
-#include <linux/pti.h>
+#include <linux/intel-pti.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
 
diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h
index f06cd91964ce..79a5b985ccf5 100644
--- a/drivers/mmc/core/card.h
+++ b/drivers/mmc/core/card.h
@@ -75,9 +75,11 @@ struct mmc_fixup {
 #define EXT_CSD_REV_ANY (-1u)
 
 #define CID_MANFID_SANDISK      0x2
+#define CID_MANFID_ATP          0x9
 #define CID_MANFID_TOSHIBA      0x11
 #define CID_MANFID_MICRON       0x13
 #define CID_MANFID_SAMSUNG      0x15
+#define CID_MANFID_APACER       0x27
 #define CID_MANFID_KINGSTON     0x70
 #define CID_MANFID_HYNIX        0x90
 
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index d209fb466979..208a762b87ef 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1290,7 +1290,7 @@ out_err:
 
 static void mmc_select_driver_type(struct mmc_card *card)
 {
-        int card_drv_type, drive_strength, drv_type;
+        int card_drv_type, drive_strength, drv_type = 0;
         int fixed_drv_type = card->host->fixed_drv_type;
 
         card_drv_type = card->ext_csd.raw_driver_strength |
diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
index f664e9cbc9f8..75d317623852 100644
--- a/drivers/mmc/core/quirks.h
+++ b/drivers/mmc/core/quirks.h
@@ -53,6 +53,14 @@ static const struct mmc_fixup mmc_blk_fixups[] = {
                   MMC_QUIRK_BLK_NO_CMD23),
 
         /*
+         * Some SD cards lockup while using CMD23 multiblock transfers.
+         */
+        MMC_FIXUP("AF SD", CID_MANFID_ATP, CID_OEMID_ANY, add_quirk_sd,
+                  MMC_QUIRK_BLK_NO_CMD23),
+        MMC_FIXUP("APUSD", CID_MANFID_APACER, 0x5048, add_quirk_sd,
+                  MMC_QUIRK_BLK_NO_CMD23),
+
+        /*
          * Some MMC cards need longer data read timeout than indicated in CSD.
          */
         MMC_FIXUP(CID_NAME_ANY, CID_MANFID_MICRON, 0x200, add_quirk_mmc,
diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
index fcf7235d5742..157e1d9e7725 100644
--- a/drivers/mmc/host/renesas_sdhi_core.c
+++ b/drivers/mmc/host/renesas_sdhi_core.c
@@ -24,6 +24,7 @@
 #include <linux/kernel.h>
 #include <linux/clk.h>
 #include <linux/slab.h>
+#include <linux/module.h>
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/mmc/host.h>
@@ -667,3 +668,5 @@ int renesas_sdhi_remove(struct platform_device *pdev)
         return 0;
 }
 EXPORT_SYMBOL_GPL(renesas_sdhi_remove);
+
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/mmc/host/s3cmci.c b/drivers/mmc/host/s3cmci.c
index f7f157a62a4a..555c7f133eb8 100644
--- a/drivers/mmc/host/s3cmci.c
+++ b/drivers/mmc/host/s3cmci.c
@@ -1424,7 +1424,9 @@ static const struct file_operations s3cmci_fops_state = {
 struct s3cmci_reg {
         unsigned short  addr;
         unsigned char   *name;
-} debug_regs[] = {
+};
+
+static const struct s3cmci_reg debug_regs[] = {
         DBG_REG(CON),
         DBG_REG(PRE),
         DBG_REG(CMDARG),
@@ -1446,7 +1448,7 @@ struct s3cmci_reg {
 static int s3cmci_regs_show(struct seq_file *seq, void *v)
 {
         struct s3cmci_host *host = seq->private;
-        struct s3cmci_reg *rptr = debug_regs;
+        const struct s3cmci_reg *rptr = debug_regs;
 
         for (; rptr->name; rptr++)
                 seq_printf(seq, "SDI%s\t=0x%08x\n", rptr->name,
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index 85140c9af581..8b941f814472 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -687,6 +687,20 @@ static inline void esdhc_pltfm_set_clock(struct sdhci_host *host,
                 return;
         }
 
+        /* For i.MX53 eSDHCv3, SYSCTL.SDCLKFS may not be set to 0. */
+        if (is_imx53_esdhc(imx_data)) {
+                /*
+                 * According to the i.MX53 reference manual, if DLLCTRL[10] can
+                 * be set, then the controller is eSDHCv3, else it is eSDHCv2.
+                 */
+                val = readl(host->ioaddr + ESDHC_DLL_CTRL);
+                writel(val | BIT(10), host->ioaddr + ESDHC_DLL_CTRL);
+                temp = readl(host->ioaddr + ESDHC_DLL_CTRL);
+                writel(val, host->ioaddr + ESDHC_DLL_CTRL);
+                if (temp & BIT(10))
+                        pre_div = 2;
+        }
+
         temp = sdhci_readl(host, ESDHC_SYSTEM_CONTROL);
         temp &= ~(ESDHC_CLOCK_IPGEN | ESDHC_CLOCK_HCKEN | ESDHC_CLOCK_PEREN
                 | ESDHC_CLOCK_MASK);
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index f80e911b8843..73b605577447 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -1114,7 +1114,7 @@ static int mtd_check_oob_ops(struct mtd_info *mtd, loff_t offs,
         if (!ops->oobbuf)
                 ops->ooblen = 0;
 
-        if (offs < 0 || offs + ops->len >= mtd->size)
+        if (offs < 0 || offs + ops->len > mtd->size)
                 return -EINVAL;
 
         if (ops->ooblen) {
diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
index e0eb51d8c012..dd56a671ea42 100644
--- a/drivers/mtd/nand/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/brcmnand/brcmnand.c
@@ -1763,7 +1763,7 @@ try_dmaread:
                         err = brcmstb_nand_verify_erased_page(mtd, chip, buf,
                                                               addr);
                         /* erased page bitflips corrected */
-                        if (err > 0)
+                        if (err >= 0)
                                 return err;
                 }
 
diff --git a/drivers/mtd/nand/gpio.c b/drivers/mtd/nand/gpio.c
index 484f7fbc3f7d..a8bde6665c24 100644
--- a/drivers/mtd/nand/gpio.c
+++ b/drivers/mtd/nand/gpio.c
@@ -253,9 +253,9 @@ static int gpio_nand_probe(struct platform_device *pdev)
                 goto out_ce;
         }
 
-        gpiomtd->nwp = devm_gpiod_get(dev, "ale", GPIOD_OUT_LOW);
-        if (IS_ERR(gpiomtd->nwp)) {
-                ret = PTR_ERR(gpiomtd->nwp);
+        gpiomtd->ale = devm_gpiod_get(dev, "ale", GPIOD_OUT_LOW);
+        if (IS_ERR(gpiomtd->ale)) {
+                ret = PTR_ERR(gpiomtd->ale);
                 goto out_ce;
         }
 
diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
index 50f8d4a1b983..d4d824ef64e9 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
@@ -1067,9 +1067,6 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip,
                 return ret;
         }
 
-        /* handle the block mark swapping */
-        block_mark_swapping(this, payload_virt, auxiliary_virt);
-
         /* Loop over status bytes, accumulating ECC status. */
         status = auxiliary_virt + nfc_geo->auxiliary_status_offset;
 
@@ -1158,6 +1155,9 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip,
                 max_bitflips = max_t(unsigned int, max_bitflips, *status);
         }
 
+        /* handle the block mark swapping */
+        block_mark_swapping(this, buf, auxiliary_virt);
+
         if (oob_required) {
                 /*
                  * It's time to deliver the OOB bytes. See gpmi_ecc_read_oob()
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index 90b9a9ccbe60..9285f60e5783 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -963,6 +963,7 @@ static void prepare_start_command(struct pxa3xx_nand_info *info, int command)
 
         switch (command) {
         case NAND_CMD_READ0:
+        case NAND_CMD_READOOB:
         case NAND_CMD_PAGEPROG:
                 info->use_ecc = 1;
                 break;
diff --git a/drivers/mux/core.c b/drivers/mux/core.c
index 2260063b0ea8..6e5cf9d9cd99 100644
--- a/drivers/mux/core.c
+++ b/drivers/mux/core.c
@@ -413,6 +413,7 @@ static int of_dev_node_match(struct device *dev, const void *data)
         return dev->of_node == data;
 }
 
+/* Note this function returns a reference to the mux_chip dev. */
 static struct mux_chip *of_find_mux_chip_by_node(struct device_node *np)
 {
         struct device *dev;
@@ -466,6 +467,7 @@ struct mux_control *mux_control_get(struct device *dev, const char *mux_name)
             (!args.args_count && (mux_chip->controllers > 1))) {
                 dev_err(dev, "%pOF: wrong #mux-control-cells for %pOF\n",
                         np, args.np);
+                put_device(&mux_chip->dev);
                 return ERR_PTR(-EINVAL);
         }
 
@@ -476,10 +478,10 @@ struct mux_control *mux_control_get(struct device *dev, const char *mux_name)
         if (controller >= mux_chip->controllers) {
                 dev_err(dev, "%pOF: bad mux controller %u specified in %pOF\n",
                         np, controller, args.np);
+                put_device(&mux_chip->dev);
                 return ERR_PTR(-EINVAL);
         }
 
-        get_device(&mux_chip->dev);
         return &mux_chip->mux[controller];
 }
 EXPORT_SYMBOL_GPL(mux_control_get);
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index a13a4896a8bd..760d2c07e3a2 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -184,12 +184,12 @@
  * Below is some version info we got:
  *    SOC   Version   IP-Version  Glitch- [TR]WRN_INT IRQ Err Memory err RTR re-
  *                                Filter? connected?  Passive detection  ception in MB
- *   MX25  FlexCAN2  03.00.00.00     no        no         ?       no        no
+ *   MX25  FlexCAN2  03.00.00.00     no        no        no       no        no
  *   MX28  FlexCAN2  03.00.04.00    yes       yes        no       no        no
- *   MX35  FlexCAN2  03.00.00.00     no        no         ?       no        no
+ *   MX35  FlexCAN2  03.00.00.00     no        no        no       no        no
  *   MX53  FlexCAN2  03.00.00.00    yes        no        no       no        no
  *   MX6s  FlexCAN3  10.00.12.00    yes       yes        no       no       yes
- *   VF610 FlexCAN3  ?               no       yes         ?      yes       yes?
+ *   VF610 FlexCAN3  ?               no       yes        no      yes       yes?
  *
  * Some SOCs do not have the RX_WARN & TX_WARN interrupt line connected.
  */
@@ -297,7 +297,8 @@ static const struct flexcan_devtype_data fsl_imx6q_devtype_data = {
 
 static const struct flexcan_devtype_data fsl_vf610_devtype_data = {
         .quirks = FLEXCAN_QUIRK_DISABLE_RXFG | FLEXCAN_QUIRK_ENABLE_EACEN_RRS |
-                FLEXCAN_QUIRK_DISABLE_MECR | FLEXCAN_QUIRK_USE_OFF_TIMESTAMP,
+                FLEXCAN_QUIRK_DISABLE_MECR | FLEXCAN_QUIRK_USE_OFF_TIMESTAMP |
+                FLEXCAN_QUIRK_BROKEN_PERR_STATE,
 };
 
 static const struct can_bittiming_const flexcan_bittiming_const = {
@@ -525,7 +526,7 @@ static int flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 data = be32_to_cpup((__be32 *)&cf->data[0]);
                 flexcan_write(data, &priv->tx_mb->data[0]);
         }
-        if (cf->can_dlc > 3) {
+        if (cf->can_dlc > 4) {
                 data = be32_to_cpup((__be32 *)&cf->data[4]);
                 flexcan_write(data, &priv->tx_mb->data[1]);
         }
diff --git a/drivers/net/can/peak_canfd/peak_canfd.c b/drivers/net/can/peak_canfd/peak_canfd.c
index 85268be0c913..55513411a82e 100644
--- a/drivers/net/can/peak_canfd/peak_canfd.c
+++ b/drivers/net/can/peak_canfd/peak_canfd.c
@@ -258,21 +258,18 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv,
         /* if this frame is an echo, */
         if ((rx_msg_flags & PUCAN_MSG_LOOPED_BACK) &&
             !(rx_msg_flags & PUCAN_MSG_SELF_RECEIVE)) {
-                int n;
                 unsigned long flags;
 
                 spin_lock_irqsave(&priv->echo_lock, flags);
-                n = can_get_echo_skb(priv->ndev, msg->client);
+                can_get_echo_skb(priv->ndev, msg->client);
                 spin_unlock_irqrestore(&priv->echo_lock, flags);
 
                 /* count bytes of the echo instead of skb */
                 stats->tx_bytes += cf_len;
                 stats->tx_packets++;
 
-                if (n) {
-                        /* restart tx queue only if a slot is free */
-                        netif_wake_queue(priv->ndev);
-                }
+                /* restart tx queue (a slot is free) */
+                netif_wake_queue(priv->ndev);
 
                 return 0;
         }
diff --git a/drivers/net/can/peak_canfd/peak_pciefd_main.c b/drivers/net/can/peak_canfd/peak_pciefd_main.c
index b4efd711f824..788c3464a3b0 100644
--- a/drivers/net/can/peak_canfd/peak_pciefd_main.c
+++ b/drivers/net/can/peak_canfd/peak_pciefd_main.c
@@ -825,7 +825,10 @@ err_release_regions:
 err_disable_pci:
         pci_disable_device(pdev);
 
-        return err;
+        /* pci_xxx_config_word() return positive PCIBIOS_xxx error codes while
+         * the probe() function must return a negative errno in case of failure
+         * (err is unchanged if negative) */
+        return pcibios_err_to_errno(err);
 }
 
 /* free the board structure object, as well as its resources: */
diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c
index 131026fbc2d7..5adc95c922ee 100644
--- a/drivers/net/can/sja1000/peak_pci.c
+++ b/drivers/net/can/sja1000/peak_pci.c
@@ -717,7 +717,10 @@ failure_release_regions:
 failure_disable_pci:
         pci_disable_device(pdev);
 
-        return err;
+        /* pci_xxx_config_word() return positive PCIBIOS_xxx error codes while
+         * the probe() function must return a negative errno in case of failure
+         * (err is unchanged if negative) */
+        return pcibios_err_to_errno(err);
 }
 
 static void peak_pci_remove(struct pci_dev *pdev)
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index 4d4941469cfc..db6ea936dc3f 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -637,6 +637,9 @@ static int ti_hecc_rx_poll(struct napi_struct *napi, int quota)
                 mbx_mask = hecc_read(priv, HECC_CANMIM);
                 mbx_mask |= HECC_TX_MBOX_MASK;
                 hecc_write(priv, HECC_CANMIM, mbx_mask);
+        } else {
+                /* repoll is done only if whole budget is used */
+                num_pkts = quota;
         }
 
         return num_pkts;
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index b3d02759c226..12ff0020ecd6 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -288,6 +288,8 @@ static void ems_usb_read_interrupt_callback(struct urb *urb)
 
         case -ECONNRESET: /* unlink */
         case -ENOENT:
+        case -EPIPE:
+        case -EPROTO:
         case -ESHUTDOWN:
                 return;
 
@@ -393,6 +395,7 @@ static void ems_usb_rx_err(struct ems_usb *dev, struct ems_cpc_msg *msg)
 
                 if (dev->can.state == CAN_STATE_ERROR_WARNING ||
                     dev->can.state == CAN_STATE_ERROR_PASSIVE) {
+                        cf->can_id |= CAN_ERR_CRTL;
                         cf->data[1] = (txerr > rxerr) ?
                             CAN_ERR_CRTL_TX_PASSIVE : CAN_ERR_CRTL_RX_PASSIVE;
                 }
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index 9fdb0f0bfa06..c6dcf93675c0 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -393,6 +393,8 @@ static void esd_usb2_read_bulk_callback(struct urb *urb)
                 break;
 
         case -ENOENT:
+        case -EPIPE:
+        case -EPROTO:
         case -ESHUTDOWN:
                 return;
 
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 68ac3e88a8ce..8bf80ad9dc44 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -449,7 +449,7 @@ static int gs_usb_set_bittiming(struct net_device *netdev)
                 dev_err(netdev->dev.parent, "Couldn't set bittimings (err=%d)",
                         rc);
 
-        return rc;
+        return (rc > 0) ? 0 : rc;
 }
 
 static void gs_usb_xmit_callback(struct urb *urb)
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 9b18d96ef526..63587b8e6825 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -609,8 +609,8 @@ static int kvaser_usb_wait_msg(const struct kvaser_usb *dev, u8 id,
                         }
 
                         if (pos + tmp->len > actual_len) {
-                                dev_err(dev->udev->dev.parent,
-                                        "Format error\n");
+                                dev_err_ratelimited(dev->udev->dev.parent,
+                                                    "Format error\n");
                                 break;
                         }
 
@@ -813,6 +813,7 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv,
         if (err) {
                 netdev_err(netdev, "Error transmitting URB\n");
                 usb_unanchor_urb(urb);
+                kfree(buf);
                 usb_free_urb(urb);
                 return err;
         }
@@ -1325,6 +1326,8 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
         case 0:
                 break;
         case -ENOENT:
+        case -EPIPE:
+        case -EPROTO:
         case -ESHUTDOWN:
                 return;
         default:
@@ -1333,7 +1336,7 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
                 goto resubmit_urb;
         }
 
-        while (pos <= urb->actual_length - MSG_HEADER_LEN) {
+        while (pos <= (int)(urb->actual_length - MSG_HEADER_LEN)) {
                 msg = urb->transfer_buffer + pos;
 
                 /* The Kvaser firmware can only read and write messages that
@@ -1352,7 +1355,8 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
                 }
 
                 if (pos + msg->len > urb->actual_length) {
-                        dev_err(dev->udev->dev.parent, "Format error\n");
+                        dev_err_ratelimited(dev->udev->dev.parent,
+                                            "Format error\n");
                         break;
                 }
 
@@ -1768,6 +1772,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                 spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
 
                 usb_unanchor_urb(urb);
+                kfree(buf);
 
                 stats->tx_dropped++;
 
diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
index 7f0272558bef..8d8c2086424d 100644
--- a/drivers/net/can/usb/mcba_usb.c
+++ b/drivers/net/can/usb/mcba_usb.c
@@ -592,6 +592,8 @@ static void mcba_usb_read_bulk_callback(struct urb *urb)
                 break;
 
         case -ENOENT:
+        case -EPIPE:
+        case -EPROTO:
         case -ESHUTDOWN:
                 return;
 
@@ -862,7 +864,7 @@ static int mcba_usb_probe(struct usb_interface *intf,
                 goto cleanup_unregister_candev;
         }
 
-        dev_info(&intf->dev, "Microchip CAN BUS analizer connected\n");
+        dev_info(&intf->dev, "Microchip CAN BUS Analyzer connected\n");
 
         return 0;
 
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
index 7ccdc3e30c98..53d6bb045e9e 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
@@ -184,7 +184,7 @@ static int pcan_usb_fd_send_cmd(struct peak_usb_device *dev, void *cmd_tail)
         void *cmd_head = pcan_usb_fd_cmd_buffer(dev);
         int err = 0;
         u8 *packet_ptr;
-        int i, n = 1, packet_len;
+        int packet_len;
         ptrdiff_t cmd_len;
 
         /* usb device unregistered? */
@@ -201,17 +201,13 @@ static int pcan_usb_fd_send_cmd(struct peak_usb_device *dev, void *cmd_tail)
         }
 
         packet_ptr = cmd_head;
+        packet_len = cmd_len;
 
         /* firmware is not able to re-assemble 512 bytes buffer in full-speed */
-        if ((dev->udev->speed != USB_SPEED_HIGH) &&
-            (cmd_len > PCAN_UFD_LOSPD_PKT_SIZE)) {
-                packet_len = PCAN_UFD_LOSPD_PKT_SIZE;
-                n += cmd_len / packet_len;
-        } else {
-                packet_len = cmd_len;
-        }
+        if (unlikely(dev->udev->speed != USB_SPEED_HIGH))
+                packet_len = min(packet_len, PCAN_UFD_LOSPD_PKT_SIZE);
 
-        for (i = 0; i < n; i++) {
+        do {
                 err = usb_bulk_msg(dev->udev,
                                    usb_sndbulkpipe(dev->udev,
                                                    PCAN_USBPRO_EP_CMDOUT),
@@ -224,7 +220,12 @@ static int pcan_usb_fd_send_cmd(struct peak_usb_device *dev, void *cmd_tail)
                 }
 
                 packet_ptr += packet_len;
-        }
+                cmd_len -= packet_len;
+
+                if (cmd_len < PCAN_UFD_LOSPD_PKT_SIZE)
+                        packet_len = cmd_len;
+
+        } while (packet_len > 0);
 
         return err;
 }
diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
index d000cb62d6ae..27861c417c94 100644
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -524,6 +524,8 @@ static void usb_8dev_read_bulk_callback(struct urb *urb)
                 break;
 
         case -ENOENT:
+        case -EPIPE:
+        case -EPROTO:
         case -ESHUTDOWN:
                 return;
 
diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c
index 8404e8852a0f..b4c4a2c76437 100644
--- a/drivers/net/can/vxcan.c
+++ b/drivers/net/can/vxcan.c
@@ -194,7 +194,7 @@ static int vxcan_newlink(struct net *net, struct net_device *dev,
                 tbp = peer_tb;
         }
 
-        if (tbp[IFLA_IFNAME]) {
+        if (ifmp && tbp[IFLA_IFNAME]) {
                 nla_strlcpy(ifname, tbp[IFLA_IFNAME], IFNAMSIZ);
                 name_assign_type = NET_NAME_USER;
         } else {
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index f5a8dd96fd75..4498ab897d94 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1500,10 +1500,13 @@ static enum dsa_tag_protocol b53_get_tag_protocol(struct dsa_switch *ds,
 {
         struct b53_device *dev = ds->priv;
 
-        /* Older models support a different tag format that we do not
-         * support in net/dsa/tag_brcm.c yet.
+        /* Older models (5325, 5365) support a different tag format that we do
+         * not support in net/dsa/tag_brcm.c yet. 539x and 531x5 require managed
+         * mode to be turned on which means we need to specifically manage ARL
+         * misses on multicast addresses (TBD).
          */
-        if (is5325(dev) || is5365(dev) || !b53_can_enable_brcm_tags(ds, port))
+        if (is5325(dev) || is5365(dev) || is539x(dev) || is531x5(dev) ||
+            !b53_can_enable_brcm_tags(ds, port))
                 return DSA_TAG_PROTO_NONE;
 
         /* Broadcom BCM58xx chips have a flow accelerator on Port 8
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index ea01f24f15e7..b62d47210db8 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -14,7 +14,6 @@
 #include <linux/netdevice.h>
 #include <linux/interrupt.h>
 #include <linux/platform_device.h>
-#include <linux/of.h>
 #include <linux/phy.h>
 #include <linux/phy_fixed.h>
 #include <linux/mii.h>
diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c
index b721a2009b50..23b45da784cb 100644
--- a/drivers/net/dsa/bcm_sf2_cfp.c
+++ b/drivers/net/dsa/bcm_sf2_cfp.c
@@ -625,7 +625,7 @@ static int bcm_sf2_cfp_ipv6_rule_set(struct bcm_sf2_priv *priv, int port,
         bcm_sf2_cfp_slice_ipv6(priv, v6_spec->ip6src, v6_spec->psrc,
                                 slice_num, false);
         bcm_sf2_cfp_slice_ipv6(priv, v6_m_spec->ip6src, v6_m_spec->psrc,
-                                slice_num, true);
+                                SLICE_NUM_MASK, true);
 
         /* Insert into TCAM now because we need to insert a second rule */
         bcm_sf2_cfp_rule_addr_set(priv, rule_index[0]);
@@ -699,7 +699,7 @@ static int bcm_sf2_cfp_ipv6_rule_set(struct bcm_sf2_priv *priv, int port,
         /* Insert into Action and policer RAMs now, set chain ID to
          * the one we are chained to
          */
-        ret = bcm_sf2_cfp_act_pol_set(priv, rule_index[0], port_num,
+        ret = bcm_sf2_cfp_act_pol_set(priv, rule_index[1], port_num,
                                       queue_num, true);
         if (ret)
                 goto out_err;
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 8171055fde7a..66d33e97cbc5 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -339,7 +339,7 @@ static void mv88e6xxx_g1_irq_free(struct mv88e6xxx_chip *chip)
         u16 mask;
 
         mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, &mask);
-        mask |= GENMASK(chip->g1_irq.nirqs, 0);
+        mask &= ~GENMASK(chip->g1_irq.nirqs, 0);
         mv88e6xxx_g1_write(chip, MV88E6XXX_G1_CTL1, mask);
 
         free_irq(chip->irq, chip);
@@ -395,7 +395,7 @@ static int mv88e6xxx_g1_irq_setup(struct mv88e6xxx_chip *chip)
         return 0;
 
 out_disable:
-        mask |= GENMASK(chip->g1_irq.nirqs, 0);
+        mask &= ~GENMASK(chip->g1_irq.nirqs, 0);
         mv88e6xxx_g1_write(chip, MV88E6XXX_G1_CTL1, mask);
 
 out_mapping:
@@ -2177,6 +2177,19 @@ static const struct of_device_id mv88e6xxx_mdio_external_match[] = {
         { },
 };
 
+static void mv88e6xxx_mdios_unregister(struct mv88e6xxx_chip *chip)
+
+{
+        struct mv88e6xxx_mdio_bus *mdio_bus;
+        struct mii_bus *bus;
+
+        list_for_each_entry(mdio_bus, &chip->mdios, list) {
+                bus = mdio_bus->bus;
+
+                mdiobus_unregister(bus);
+        }
+}
+
 static int mv88e6xxx_mdios_register(struct mv88e6xxx_chip *chip,
                                     struct device_node *np)
 {
@@ -2201,27 +2214,16 @@ static int mv88e6xxx_mdios_register(struct mv88e6xxx_chip *chip,
                 match = of_match_node(mv88e6xxx_mdio_external_match, child);
                 if (match) {
                         err = mv88e6xxx_mdio_register(chip, child, true);
-                        if (err)
+                        if (err) {
+                                mv88e6xxx_mdios_unregister(chip);
                                 return err;
+                        }
                 }
         }
 
         return 0;
 }
 
-static void mv88e6xxx_mdios_unregister(struct mv88e6xxx_chip *chip)
-
-{
-        struct mv88e6xxx_mdio_bus *mdio_bus;
-        struct mii_bus *bus;
-
-        list_for_each_entry(mdio_bus, &chip->mdios, list) {
-                bus = mdio_bus->bus;
-
-                mdiobus_unregister(bus);
-        }
-}
-
 static int mv88e6xxx_get_eeprom_len(struct dsa_switch *ds)
 {
         struct mv88e6xxx_chip *chip = ds->priv;
diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
index a7801f6668a5..6315774d72b3 100644
--- a/drivers/net/dsa/mv88e6xxx/port.c
+++ b/drivers/net/dsa/mv88e6xxx/port.c
@@ -338,6 +338,7 @@ int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
                 cmode = MV88E6XXX_PORT_STS_CMODE_2500BASEX;
                 break;
         case PHY_INTERFACE_MODE_XGMII:
+        case PHY_INTERFACE_MODE_XAUI:
                 cmode = MV88E6XXX_PORT_STS_CMODE_XAUI;
                 break;
         case PHY_INTERFACE_MODE_RXAUI:
diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
index f4e13a7014bd..36c8950dbd2d 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
@@ -602,7 +602,7 @@ struct vortex_private {
         struct sk_buff* rx_skbuff[RX_RING_SIZE];
         struct sk_buff* tx_skbuff[TX_RING_SIZE];
         unsigned int cur_rx, cur_tx;            /* The next free ring entry */
-        unsigned int dirty_rx, dirty_tx;        /* The ring entries to be free()ed. */
+        unsigned int dirty_tx;  /* The ring entries to be free()ed. */
         struct vortex_extra_stats xstats;       /* NIC-specific extra stats */
         struct sk_buff *tx_skb;                         /* Packet being eaten by bus master ctrl.  */
         dma_addr_t tx_skb_dma;                          /* Allocated DMA address for bus master ctrl DMA.   */
@@ -618,7 +618,6 @@ struct vortex_private {
 
         /* The remainder are related to chip state, mostly media selection. */
         struct timer_list timer;                        /* Media selection timer. */
-        struct timer_list rx_oom_timer;         /* Rx skb allocation retry timer */
         int options;                                            /* User-settable misc. driver options. */
         unsigned int media_override:4,          /* Passed-in media type. */
                 default_media:4,                                /* Read from the EEPROM/Wn3_Config. */
@@ -760,7 +759,6 @@ static void mdio_sync(struct vortex_private *vp, int bits);
 static int mdio_read(struct net_device *dev, int phy_id, int location);
 static void mdio_write(struct net_device *vp, int phy_id, int location, int value);
 static void vortex_timer(struct timer_list *t);
-static void rx_oom_timer(struct timer_list *t);
 static netdev_tx_t vortex_start_xmit(struct sk_buff *skb,
                                      struct net_device *dev);
 static netdev_tx_t boomerang_start_xmit(struct sk_buff *skb,
@@ -1601,7 +1599,6 @@ vortex_up(struct net_device *dev)
 
         timer_setup(&vp->timer, vortex_timer, 0);
         mod_timer(&vp->timer, RUN_AT(media_tbl[dev->if_port].wait));
-        timer_setup(&vp->rx_oom_timer, rx_oom_timer, 0);
 
         if (vortex_debug > 1)
                 pr_debug("%s: Initial media type %s.\n",
@@ -1676,7 +1673,7 @@ vortex_up(struct net_device *dev)
         window_write16(vp, 0x0040, 4, Wn4_NetDiag);
 
         if (vp->full_bus_master_rx) { /* Boomerang bus master. */
-                vp->cur_rx = vp->dirty_rx = 0;
+                vp->cur_rx = 0;
                 /* Initialize the RxEarly register as recommended. */
                 iowrite16(SetRxThreshold + (1536>>2), ioaddr + EL3_CMD);
                 iowrite32(0x0020, ioaddr + PktStatus);
@@ -1729,6 +1726,7 @@ vortex_open(struct net_device *dev)
         struct vortex_private *vp = netdev_priv(dev);
         int i;
         int retval;
+        dma_addr_t dma;
 
         /* Use the now-standard shared IRQ implementation. */
         if ((retval = request_irq(dev->irq, vp->full_bus_master_rx ?
@@ -1753,7 +1751,11 @@ vortex_open(struct net_device *dev)
                                 break;                  /* Bad news!  */
 
                         skb_reserve(skb, NET_IP_ALIGN); /* Align IP on 16 byte boundaries */
-                        vp->rx_ring[i].addr = cpu_to_le32(pci_map_single(VORTEX_PCI(vp), skb->data, PKT_BUF_SZ, PCI_DMA_FROMDEVICE));
+                        dma = pci_map_single(VORTEX_PCI(vp), skb->data,
+                                             PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
+                        if (dma_mapping_error(&VORTEX_PCI(vp)->dev, dma))
+                                break;
+                        vp->rx_ring[i].addr = cpu_to_le32(dma);
                 }
                 if (i != RX_RING_SIZE) {
                         pr_emerg("%s: no memory for rx ring\n", dev->name);
@@ -2067,6 +2069,12 @@ vortex_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 int len = (skb->len + 3) & ~3;
                 vp->tx_skb_dma = pci_map_single(VORTEX_PCI(vp), skb->data, len,
                                                 PCI_DMA_TODEVICE);
+                if (dma_mapping_error(&VORTEX_PCI(vp)->dev, vp->tx_skb_dma)) {
+                        dev_kfree_skb_any(skb);
+                        dev->stats.tx_dropped++;
+                        return NETDEV_TX_OK;
+                }
+
                 spin_lock_irq(&vp->window_lock);
                 window_set(vp, 7);
                 iowrite32(vp->tx_skb_dma, ioaddr + Wn7_MasterAddr);
@@ -2593,7 +2601,7 @@ boomerang_rx(struct net_device *dev)
         int entry = vp->cur_rx % RX_RING_SIZE;
         void __iomem *ioaddr = vp->ioaddr;
         int rx_status;
-        int rx_work_limit = vp->dirty_rx + RX_RING_SIZE - vp->cur_rx;
+        int rx_work_limit = RX_RING_SIZE;
 
         if (vortex_debug > 5)
                 pr_debug("boomerang_rx(): status %4.4x\n", ioread16(ioaddr+EL3_STATUS));
@@ -2614,7 +2622,8 @@ boomerang_rx(struct net_device *dev)
                 } else {
                         /* The packet length: up to 4.5K!. */
                         int pkt_len = rx_status & 0x1fff;
-                        struct sk_buff *skb;
+                        struct sk_buff *skb, *newskb;
+                        dma_addr_t newdma;
                         dma_addr_t dma = le32_to_cpu(vp->rx_ring[entry].addr);
 
                         if (vortex_debug > 4)
@@ -2633,9 +2642,27 @@ boomerang_rx(struct net_device *dev)
                                 pci_dma_sync_single_for_device(VORTEX_PCI(vp), dma, PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
                                 vp->rx_copy++;
                         } else {
+                                /* Pre-allocate the replacement skb.  If it or its
+                                 * mapping fails then recycle the buffer thats already
+                                 * in place
+                                 */
+                                newskb = netdev_alloc_skb_ip_align(dev, PKT_BUF_SZ);
+                                if (!newskb) {
+                                        dev->stats.rx_dropped++;
+                                        goto clear_complete;
+                                }
+                                newdma = pci_map_single(VORTEX_PCI(vp), newskb->data,
+                                                        PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
+                                if (dma_mapping_error(&VORTEX_PCI(vp)->dev, newdma)) {
+                                        dev->stats.rx_dropped++;
+                                        consume_skb(newskb);
+                                        goto clear_complete;
+                                }
+
                                 /* Pass up the skbuff already on the Rx ring. */
                                 skb = vp->rx_skbuff[entry];
-                                vp->rx_skbuff[entry] = NULL;
+                                vp->rx_skbuff[entry] = newskb;
+                                vp->rx_ring[entry].addr = cpu_to_le32(newdma);
                                 skb_put(skb, pkt_len);
                                 pci_unmap_single(VORTEX_PCI(vp), dma, PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
                                 vp->rx_nocopy++;
@@ -2653,55 +2680,15 @@ boomerang_rx(struct net_device *dev)
                         netif_rx(skb);
                         dev->stats.rx_packets++;
                 }
-                entry = (++vp->cur_rx) % RX_RING_SIZE;
-        }
-        /* Refill the Rx ring buffers. */
-        for (; vp->cur_rx - vp->dirty_rx > 0; vp->dirty_rx++) {
-                struct sk_buff *skb;
-                entry = vp->dirty_rx % RX_RING_SIZE;
-                if (vp->rx_skbuff[entry] == NULL) {
-                        skb = netdev_alloc_skb_ip_align(dev, PKT_BUF_SZ);
-                        if (skb == NULL) {
-                                static unsigned long last_jif;
-                                if (time_after(jiffies, last_jif + 10 * HZ)) {
-                                        pr_warn("%s: memory shortage\n",
-                                                dev->name);
-                                        last_jif = jiffies;
-                                }
-                                if ((vp->cur_rx - vp->dirty_rx) == RX_RING_SIZE)
-                                        mod_timer(&vp->rx_oom_timer, RUN_AT(HZ * 1));
-                                break;                  /* Bad news!  */
-                        }
 
-                        vp->rx_ring[entry].addr = cpu_to_le32(pci_map_single(VORTEX_PCI(vp), skb->data, PKT_BUF_SZ, PCI_DMA_FROMDEVICE));
-                        vp->rx_skbuff[entry] = skb;
-                }
+clear_complete:
                 vp->rx_ring[entry].status = 0;  /* Clear complete bit. */
                 iowrite16(UpUnstall, ioaddr + EL3_CMD);
+                entry = (++vp->cur_rx) % RX_RING_SIZE;
         }
         return 0;
 }
 
-/*
- * If we've hit a total OOM refilling the Rx ring we poll once a second
- * for some memory.  Otherwise there is no way to restart the rx process.
- */
-static void
-rx_oom_timer(struct timer_list *t)
-{
-        struct vortex_private *vp = from_timer(vp, t, rx_oom_timer);
-        struct net_device *dev = vp->mii.dev;
-
-        spin_lock_irq(&vp->lock);
-        if ((vp->cur_rx - vp->dirty_rx) == RX_RING_SIZE)        /* This test is redundant, but makes me feel good */
-                boomerang_rx(dev);
-        if (vortex_debug > 1) {
-                pr_debug("%s: rx_oom_timer %s\n", dev->name,
-                        ((vp->cur_rx - vp->dirty_rx) != RX_RING_SIZE) ? "succeeded" : "retrying");
-        }
-        spin_unlock_irq(&vp->lock);
-}
-
 static void
 vortex_down(struct net_device *dev, int final_down)
 {
@@ -2711,7 +2698,6 @@ vortex_down(struct net_device *dev, int final_down)
         netdev_reset_queue(dev);
         netif_stop_queue(dev);
 
-        del_timer_sync(&vp->rx_oom_timer);
         del_timer_sync(&vp->timer);
 
         /* Turn off statistics ASAP.  We update dev->stats below. */
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 97c5a89a9cf7..fbe21a817bd8 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -75,6 +75,9 @@ static struct workqueue_struct *ena_wq;
 MODULE_DEVICE_TABLE(pci, ena_pci_tbl);
 
 static int ena_rss_init_default(struct ena_adapter *adapter);
+static void check_for_admin_com_state(struct ena_adapter *adapter);
+static void ena_destroy_device(struct ena_adapter *adapter);
+static int ena_restore_device(struct ena_adapter *adapter);
 
 static void ena_tx_timeout(struct net_device *dev)
 {
@@ -1565,7 +1568,7 @@ static int ena_rss_configure(struct ena_adapter *adapter)
 
 static int ena_up_complete(struct ena_adapter *adapter)
 {
-        int rc, i;
+        int rc;
 
         rc = ena_rss_configure(adapter);
         if (rc)
@@ -1584,17 +1587,6 @@ static int ena_up_complete(struct ena_adapter *adapter)
 
         ena_napi_enable_all(adapter);
 
-        /* Enable completion queues interrupt */
-        for (i = 0; i < adapter->num_queues; i++)
-                ena_unmask_interrupt(&adapter->tx_ring[i],
-                                     &adapter->rx_ring[i]);
-
-        /* schedule napi in case we had pending packets
-         * from the last time we disable napi
-         */
-        for (i = 0; i < adapter->num_queues; i++)
-                napi_schedule(&adapter->ena_napi[i].napi);
-
         return 0;
 }
 
@@ -1731,7 +1723,7 @@ create_err:
 
 static int ena_up(struct ena_adapter *adapter)
 {
-        int rc;
+        int rc, i;
 
         netdev_dbg(adapter->netdev, "%s\n", __func__);
 
@@ -1774,6 +1766,17 @@ static int ena_up(struct ena_adapter *adapter)
 
         set_bit(ENA_FLAG_DEV_UP, &adapter->flags);
 
+        /* Enable completion queues interrupt */
+        for (i = 0; i < adapter->num_queues; i++)
+                ena_unmask_interrupt(&adapter->tx_ring[i],
+                                     &adapter->rx_ring[i]);
+
+        /* schedule napi in case we had pending packets
+         * from the last time we disable napi
+         */
+        for (i = 0; i < adapter->num_queues; i++)
+                napi_schedule(&adapter->ena_napi[i].napi);
+
         return rc;
 
 err_up:
@@ -1884,6 +1887,17 @@ static int ena_close(struct net_device *netdev)
         if (test_bit(ENA_FLAG_DEV_UP, &adapter->flags))
                 ena_down(adapter);
 
+        /* Check for device status and issue reset if needed*/
+        check_for_admin_com_state(adapter);
+        if (unlikely(test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags))) {
+                netif_err(adapter, ifdown, adapter->netdev,
+                          "Destroy failure, restarting device\n");
+                ena_dump_stats_to_dmesg(adapter);
+                /* rtnl lock already obtained in dev_ioctl() layer */
+                ena_destroy_device(adapter);
+                ena_restore_device(adapter);
+        }
+
         return 0;
 }
 
@@ -2544,11 +2558,12 @@ static void ena_destroy_device(struct ena_adapter *adapter)
 
         ena_com_set_admin_running_state(ena_dev, false);
 
-        ena_close(netdev);
+        if (test_bit(ENA_FLAG_DEV_UP, &adapter->flags))
+                ena_down(adapter);
 
         /* Before releasing the ENA resources, a device reset is required.
          * (to prevent the device from accessing them).
-         * In case the reset flag is set and the device is up, ena_close
+         * In case the reset flag is set and the device is up, ena_down()
          * already perform the reset, so it can be skipped.
          */
         if (!(test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags) && dev_up))
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
index 57e796870595..105fdb958cef 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
@@ -50,7 +50,7 @@
 #define AQ_CFG_PCI_FUNC_MSIX_IRQS   9U
 #define AQ_CFG_PCI_FUNC_PORTS       2U
 
-#define AQ_CFG_SERVICE_TIMER_INTERVAL    (2 * HZ)
+#define AQ_CFG_SERVICE_TIMER_INTERVAL    (1 * HZ)
 #define AQ_CFG_POLLING_TIMER_INTERVAL   ((unsigned int)(2 * HZ))
 
 #define AQ_CFG_SKB_FRAGS_MAX   32U
@@ -80,6 +80,7 @@
 #define AQ_CFG_DRV_VERSION      __stringify(NIC_MAJOR_DRIVER_VERSION)"."\
                                 __stringify(NIC_MINOR_DRIVER_VERSION)"."\
                                 __stringify(NIC_BUILD_DRIVER_VERSION)"."\
-                                __stringify(NIC_REVISION_DRIVER_VERSION)
+                                __stringify(NIC_REVISION_DRIVER_VERSION) \
+                                AQ_CFG_DRV_VERSION_SUFFIX
 
 #endif /* AQ_CFG_H */
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c b/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
index 70efb7467bf3..f2d8063a2cef 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c
@@ -66,14 +66,14 @@ static const char aq_ethtool_stat_names[][ETH_GSTRING_LEN] = {
         "OutUCast",
         "OutMCast",
         "OutBCast",
-        "InUCastOctects",
-        "OutUCastOctects",
-        "InMCastOctects",
-        "OutMCastOctects",
-        "InBCastOctects",
-        "OutBCastOctects",
-        "InOctects",
-        "OutOctects",
+        "InUCastOctets",
+        "OutUCastOctets",
+        "InMCastOctets",
+        "OutMCastOctets",
+        "InBCastOctets",
+        "OutBCastOctets",
+        "InOctets",
+        "OutOctets",
         "InPacketsDma",
         "OutPacketsDma",
         "InOctetsDma",
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
index 0207927dc8a6..b3825de6cdfb 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
@@ -46,6 +46,28 @@ struct aq_hw_link_status_s {
         unsigned int mbps;
 };
 
+struct aq_stats_s {
+        u64 uprc;
+        u64 mprc;
+        u64 bprc;
+        u64 erpt;
+        u64 uptc;
+        u64 mptc;
+        u64 bptc;
+        u64 erpr;
+        u64 mbtc;
+        u64 bbtc;
+        u64 mbrc;
+        u64 bbrc;
+        u64 ubrc;
+        u64 ubtc;
+        u64 dpc;
+        u64 dma_pkt_rc;
+        u64 dma_pkt_tc;
+        u64 dma_oct_rc;
+        u64 dma_oct_tc;
+};
+
 #define AQ_HW_IRQ_INVALID 0U
 #define AQ_HW_IRQ_LEGACY  1U
 #define AQ_HW_IRQ_MSI     2U
@@ -85,7 +107,9 @@ struct aq_hw_ops {
         void (*destroy)(struct aq_hw_s *self);
 
         int (*get_hw_caps)(struct aq_hw_s *self,
-                           struct aq_hw_caps_s *aq_hw_caps);
+                           struct aq_hw_caps_s *aq_hw_caps,
+                           unsigned short device,
+                           unsigned short subsystem_device);
 
         int (*hw_ring_tx_xmit)(struct aq_hw_s *self, struct aq_ring_s *aq_ring,
                                unsigned int frags);
@@ -164,8 +188,7 @@ struct aq_hw_ops {
 
         int (*hw_update_stats)(struct aq_hw_s *self);
 
-        int (*hw_get_hw_stats)(struct aq_hw_s *self, u64 *data,
-                               unsigned int *p_count);
+        struct aq_stats_s *(*hw_get_hw_stats)(struct aq_hw_s *self);
 
         int (*hw_get_fw_version)(struct aq_hw_s *self, u32 *fw_version);
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index 78dfb2ab78ce..75a894a9251c 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -37,6 +37,8 @@ static unsigned int aq_itr_rx;
 module_param_named(aq_itr_rx, aq_itr_rx, uint, 0644);
 MODULE_PARM_DESC(aq_itr_rx, "RX interrupt throttle rate");
 
+static void aq_nic_update_ndev_stats(struct aq_nic_s *self);
+
 static void aq_nic_rss_init(struct aq_nic_s *self, unsigned int num_rss_queues)
 {
         struct aq_nic_cfg_s *cfg = &self->aq_nic_cfg;
@@ -166,11 +168,8 @@ static int aq_nic_update_link_status(struct aq_nic_s *self)
 static void aq_nic_service_timer_cb(struct timer_list *t)
 {
         struct aq_nic_s *self = from_timer(self, t, service_timer);
-        struct net_device *ndev = aq_nic_get_ndev(self);
+        int ctimer = AQ_CFG_SERVICE_TIMER_INTERVAL;
         int err = 0;
-        unsigned int i = 0U;
-        struct aq_ring_stats_rx_s stats_rx;
-        struct aq_ring_stats_tx_s stats_tx;
 
         if (aq_utils_obj_test(&self->header.flags, AQ_NIC_FLAGS_IS_NOT_READY))
                 goto err_exit;
@@ -182,23 +181,14 @@ static void aq_nic_service_timer_cb(struct timer_list *t)
         if (self->aq_hw_ops.hw_update_stats)
                 self->aq_hw_ops.hw_update_stats(self->aq_hw);
 
-        memset(&stats_rx, 0U, sizeof(struct aq_ring_stats_rx_s));
-        memset(&stats_tx, 0U, sizeof(struct aq_ring_stats_tx_s));
-        for (i = AQ_DIMOF(self->aq_vec); i--;) {
-                if (self->aq_vec[i])
-                        aq_vec_add_stats(self->aq_vec[i], &stats_rx, &stats_tx);
-        }
+        aq_nic_update_ndev_stats(self);
 
-        ndev->stats.rx_packets = stats_rx.packets;
-        ndev->stats.rx_bytes = stats_rx.bytes;
-        ndev->stats.rx_errors = stats_rx.errors;
-        ndev->stats.tx_packets = stats_tx.packets;
-        ndev->stats.tx_bytes = stats_tx.bytes;
-        ndev->stats.tx_errors = stats_tx.errors;
+        /* If no link - use faster timer rate to detect link up asap */
+        if (!netif_carrier_ok(self->ndev))
+                ctimer = max(ctimer / 2, 1);
 
 err_exit:
-        mod_timer(&self->service_timer,
-                  jiffies + AQ_CFG_SERVICE_TIMER_INTERVAL);
+        mod_timer(&self->service_timer, jiffies + ctimer);
 }
 
 static void aq_nic_polling_timer_cb(struct timer_list *t)
@@ -222,7 +212,7 @@ static struct net_device *aq_nic_ndev_alloc(void)
 
 struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
                                    const struct ethtool_ops *et_ops,
-                                   struct device *dev,
+                                   struct pci_dev *pdev,
                                    struct aq_pci_func_s *aq_pci_func,
                                    unsigned int port,
                                    const struct aq_hw_ops *aq_hw_ops)
@@ -242,7 +232,7 @@ struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
         ndev->netdev_ops = ndev_ops;
         ndev->ethtool_ops = et_ops;
 
-        SET_NETDEV_DEV(ndev, dev);
+        SET_NETDEV_DEV(ndev, &pdev->dev);
 
         ndev->if_port = port;
         self->ndev = ndev;
@@ -254,7 +244,8 @@ struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
 
         self->aq_hw = self->aq_hw_ops.create(aq_pci_func, self->port,
                                                 &self->aq_hw_ops);
-        err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps);
+        err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps,
+                                          pdev->device, pdev->subsystem_device);
         if (err < 0)
                 goto err_exit;
 
@@ -749,16 +740,40 @@ int aq_nic_get_regs_count(struct aq_nic_s *self)
 
 void aq_nic_get_stats(struct aq_nic_s *self, u64 *data)
 {
-        struct aq_vec_s *aq_vec = NULL;
         unsigned int i = 0U;
         unsigned int count = 0U;
-        int err = 0;
+        struct aq_vec_s *aq_vec = NULL;
+        struct aq_stats_s *stats = self->aq_hw_ops.hw_get_hw_stats(self->aq_hw);
 
-        err = self->aq_hw_ops.hw_get_hw_stats(self->aq_hw, data, &count);
-        if (err < 0)
+        if (!stats)
                 goto err_exit;
 
-        data += count;
+        data[i] = stats->uprc + stats->mprc + stats->bprc;
+        data[++i] = stats->uprc;
+        data[++i] = stats->mprc;
+        data[++i] = stats->bprc;
+        data[++i] = stats->erpt;
+        data[++i] = stats->uptc + stats->mptc + stats->bptc;
+        data[++i] = stats->uptc;
+        data[++i] = stats->mptc;
+        data[++i] = stats->bptc;
+        data[++i] = stats->ubrc;
+        data[++i] = stats->ubtc;
+        data[++i] = stats->mbrc;
+        data[++i] = stats->mbtc;
+        data[++i] = stats->bbrc;
+        data[++i] = stats->bbtc;
+        data[++i] = stats->ubrc + stats->mbrc + stats->bbrc;
+        data[++i] = stats->ubtc + stats->mbtc + stats->bbtc;
+        data[++i] = stats->dma_pkt_rc;
+        data[++i] = stats->dma_pkt_tc;
+        data[++i] = stats->dma_oct_rc;
+        data[++i] = stats->dma_oct_tc;
+        data[++i] = stats->dpc;
+
+        i++;
+
+        data += i;
         count = 0U;
 
         for (i = 0U, aq_vec = self->aq_vec[0];
@@ -768,7 +783,20 @@ void aq_nic_get_stats(struct aq_nic_s *self, u64 *data)
         }
 
 err_exit:;
-        (void)err;
+}
+
+static void aq_nic_update_ndev_stats(struct aq_nic_s *self)
+{
+        struct net_device *ndev = self->ndev;
+        struct aq_stats_s *stats = self->aq_hw_ops.hw_get_hw_stats(self->aq_hw);
+
+        ndev->stats.rx_packets = stats->uprc + stats->mprc + stats->bprc;
+        ndev->stats.rx_bytes = stats->ubrc + stats->mbrc + stats->bbrc;
+        ndev->stats.rx_errors = stats->erpr;
+        ndev->stats.tx_packets = stats->uptc + stats->mptc + stats->bptc;
+        ndev->stats.tx_bytes = stats->ubtc + stats->mbtc + stats->bbtc;
+        ndev->stats.tx_errors = stats->erpt;
+        ndev->stats.multicast = stats->mprc;
 }
 
 void aq_nic_get_link_ksettings(struct aq_nic_s *self,
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
index 4309983acdd6..3c9f8db03d5f 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
@@ -71,7 +71,7 @@ struct aq_nic_cfg_s {
 
 struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
                                    const struct ethtool_ops *et_ops,
-                                   struct device *dev,
+                                   struct pci_dev *pdev,
                                    struct aq_pci_func_s *aq_pci_func,
                                    unsigned int port,
                                    const struct aq_hw_ops *aq_hw_ops);
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
index cadaa646c89f..58c29d04b186 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
@@ -51,7 +51,8 @@ struct aq_pci_func_s *aq_pci_func_alloc(struct aq_hw_ops *aq_hw_ops,
         pci_set_drvdata(pdev, self);
         self->pdev = pdev;
 
-        err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps);
+        err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps, pdev->device,
+                                     pdev->subsystem_device);
         if (err < 0)
                 goto err_exit;
 
@@ -59,7 +60,7 @@ struct aq_pci_func_s *aq_pci_func_alloc(struct aq_hw_ops *aq_hw_ops,
 
         for (port = 0; port < self->ports; ++port) {
                 struct aq_nic_s *aq_nic = aq_nic_alloc_cold(ndev_ops, eth_ops,
-                                                            &pdev->dev, self,
+                                                            pdev, self,
                                                             port, aq_hw_ops);
 
                 if (!aq_nic) {
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
index 07b3c49a16a4..f18dce14c93c 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
@@ -18,9 +18,20 @@
 #include "hw_atl_a0_internal.h"
 
 static int hw_atl_a0_get_hw_caps(struct aq_hw_s *self,
-                                 struct aq_hw_caps_s *aq_hw_caps)
+                                 struct aq_hw_caps_s *aq_hw_caps,
+                                 unsigned short device,
+                                 unsigned short subsystem_device)
 {
         memcpy(aq_hw_caps, &hw_atl_a0_hw_caps_, sizeof(*aq_hw_caps));
+
+        if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001)
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G;
+
+        if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) {
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G;
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_5G;
+        }
+
         return 0;
 }
 
@@ -333,6 +344,10 @@ static int hw_atl_a0_hw_init(struct aq_hw_s *self,
         hw_atl_a0_hw_rss_set(self, &aq_nic_cfg->aq_rss);
         hw_atl_a0_hw_rss_hash_set(self, &aq_nic_cfg->aq_rss);
 
+        /* Reset link status and read out initial hardware counters */
+        self->aq_link_status.mbps = 0;
+        hw_atl_utils_update_stats(self);
+
         err = aq_hw_err_from_flags(self);
         if (err < 0)
                 goto err_exit;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index ec68c20efcbd..e4a22ce7bf09 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -16,11 +16,23 @@
 #include "hw_atl_utils.h"
 #include "hw_atl_llh.h"
 #include "hw_atl_b0_internal.h"
+#include "hw_atl_llh_internal.h"
 
 static int hw_atl_b0_get_hw_caps(struct aq_hw_s *self,
-                                 struct aq_hw_caps_s *aq_hw_caps)
+                                 struct aq_hw_caps_s *aq_hw_caps,
+                                 unsigned short device,
+                                 unsigned short subsystem_device)
 {
         memcpy(aq_hw_caps, &hw_atl_b0_hw_caps_, sizeof(*aq_hw_caps));
+
+        if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001)
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G;
+
+        if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) {
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G;
+                aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_5G;
+        }
+
         return 0;
 }
 
@@ -357,6 +369,7 @@ static int hw_atl_b0_hw_init(struct aq_hw_s *self,
         };
 
         int err = 0;
+        u32 val;
 
         self->aq_nic_cfg = aq_nic_cfg;
 
@@ -374,6 +387,20 @@ static int hw_atl_b0_hw_init(struct aq_hw_s *self,
         hw_atl_b0_hw_rss_set(self, &aq_nic_cfg->aq_rss);
         hw_atl_b0_hw_rss_hash_set(self, &aq_nic_cfg->aq_rss);
 
+        /* Force limit MRRS on RDM/TDM to 2K */
+        val = aq_hw_read_reg(self, pci_reg_control6_adr);
+        aq_hw_write_reg(self, pci_reg_control6_adr, (val & ~0x707) | 0x404);
+
+        /* TX DMA total request limit. B0 hardware is not capable to
+         * handle more than (8K-MRRS) incoming DMA data.
+         * Value 24 in 256byte units
+         */
+        aq_hw_write_reg(self, tx_dma_total_req_limit_adr, 24);
+
+        /* Reset link status and read out initial hardware counters */
+        self->aq_link_status.mbps = 0;
+        hw_atl_utils_update_stats(self);
+
         err = aq_hw_err_from_flags(self);
         if (err < 0)
                 goto err_exit;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
index 5527fc0e5942..93450ec930e8 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
@@ -2343,6 +2343,9 @@
 #define tx_dma_desc_base_addrmsw_adr(descriptor) \
                         (0x00007c04u + (descriptor) * 0x40)
 
+/* tx dma total request limit */
+#define tx_dma_total_req_limit_adr 0x00007b20u
+
 /* tx interrupt moderation control register definitions
  * Preprocessor definitions for TX Interrupt Moderation Control Register
  * Base Address: 0x00008980
@@ -2369,6 +2372,9 @@
 /* default value of bitfield reg_res_dsbl */
 #define pci_reg_res_dsbl_default 0x1
 
+/* PCI core control register */
+#define pci_reg_control6_adr 0x1014u
+
 /* global microprocessor scratch pad definitions */
 #define glb_cpu_scratch_scp_adr(scratch_scp) (0x00000300u + (scratch_scp) * 0x4)
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
index 1fe016fc4bc7..f2ce12ed4218 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
@@ -503,73 +503,43 @@ int hw_atl_utils_update_stats(struct aq_hw_s *self)
         struct hw_atl_s *hw_self = PHAL_ATLANTIC;
         struct hw_aq_atl_utils_mbox mbox;
 
-        if (!self->aq_link_status.mbps)
-                return 0;
-
         hw_atl_utils_mpi_read_stats(self, &mbox);
 
 #define AQ_SDELTA(_N_) (hw_self->curr_stats._N_ += \
                         mbox.stats._N_ - hw_self->last_stats._N_)
-
-        AQ_SDELTA(uprc);
-        AQ_SDELTA(mprc);
-        AQ_SDELTA(bprc);
-        AQ_SDELTA(erpt);
-
-        AQ_SDELTA(uptc);
-        AQ_SDELTA(mptc);
-        AQ_SDELTA(bptc);
-        AQ_SDELTA(erpr);
-
-        AQ_SDELTA(ubrc);
-        AQ_SDELTA(ubtc);
-        AQ_SDELTA(mbrc);
-        AQ_SDELTA(mbtc);
-        AQ_SDELTA(bbrc);
-        AQ_SDELTA(bbtc);
-        AQ_SDELTA(dpc);
-
+        if (self->aq_link_status.mbps) {
+                AQ_SDELTA(uprc);
+                AQ_SDELTA(mprc);
+                AQ_SDELTA(bprc);
+                AQ_SDELTA(erpt);
+
+                AQ_SDELTA(uptc);
+                AQ_SDELTA(mptc);
+                AQ_SDELTA(bptc);
+                AQ_SDELTA(erpr);
+
+                AQ_SDELTA(ubrc);
+                AQ_SDELTA(ubtc);
+                AQ_SDELTA(mbrc);
+                AQ_SDELTA(mbtc);
+                AQ_SDELTA(bbrc);
+                AQ_SDELTA(bbtc);
+                AQ_SDELTA(dpc);
+        }
 #undef AQ_SDELTA
+        hw_self->curr_stats.dma_pkt_rc = stats_rx_dma_good_pkt_counterlsw_get(self);
+        hw_self->curr_stats.dma_pkt_tc = stats_tx_dma_good_pkt_counterlsw_get(self);
+        hw_self->curr_stats.dma_oct_rc = stats_rx_dma_good_octet_counterlsw_get(self);
+        hw_self->curr_stats.dma_oct_tc = stats_tx_dma_good_octet_counterlsw_get(self);
 
         memcpy(&hw_self->last_stats, &mbox.stats, sizeof(mbox.stats));
 
         return 0;
 }
 
-int hw_atl_utils_get_hw_stats(struct aq_hw_s *self,
-                              u64 *data, unsigned int *p_count)
+struct aq_stats_s *hw_atl_utils_get_hw_stats(struct aq_hw_s *self)
 {
-        struct hw_atl_s *hw_self = PHAL_ATLANTIC;
-        struct hw_atl_stats_s *stats = &hw_self->curr_stats;
-        int i = 0;
-
-        data[i] = stats->uprc + stats->mprc + stats->bprc;
-        data[++i] = stats->uprc;
-        data[++i] = stats->mprc;
-        data[++i] = stats->bprc;
-        data[++i] = stats->erpt;
-        data[++i] = stats->uptc + stats->mptc + stats->bptc;
-        data[++i] = stats->uptc;
-        data[++i] = stats->mptc;
-        data[++i] = stats->bptc;
-        data[++i] = stats->ubrc;
-        data[++i] = stats->ubtc;
-        data[++i] = stats->mbrc;
-        data[++i] = stats->mbtc;
-        data[++i] = stats->bbrc;
-        data[++i] = stats->bbtc;
-        data[++i] = stats->ubrc + stats->mbrc + stats->bbrc;
-        data[++i] = stats->ubtc + stats->mbtc + stats->bbtc;
-        data[++i] = stats_rx_dma_good_pkt_counterlsw_get(self);
-        data[++i] = stats_tx_dma_good_pkt_counterlsw_get(self);
-        data[++i] = stats_rx_dma_good_octet_counterlsw_get(self);
-        data[++i] = stats_tx_dma_good_octet_counterlsw_get(self);
-        data[++i] = stats->dpc;
-
-        if (p_count)
-                *p_count = ++i;
-
-        return 0;
+        return &PHAL_ATLANTIC->curr_stats;
 }
 
 static const u32 hw_atl_utils_hw_mac_regs[] = {
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
index c99cc690e425..21aeca6908d3 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
@@ -129,7 +129,7 @@ struct __packed hw_aq_atl_utils_mbox {
 struct __packed hw_atl_s {
         struct aq_hw_s base;
         struct hw_atl_stats_s last_stats;
-        struct hw_atl_stats_s curr_stats;
+        struct aq_stats_s curr_stats;
         u64 speed;
         unsigned int chip_features;
         u32 fw_ver_actual;
@@ -207,8 +207,6 @@ int hw_atl_utils_get_fw_version(struct aq_hw_s *self, u32 *fw_version);
 
 int hw_atl_utils_update_stats(struct aq_hw_s *self);
 
-int hw_atl_utils_get_hw_stats(struct aq_hw_s *self,
-                              u64 *data,
-                              unsigned int *p_count);
+struct aq_stats_s *hw_atl_utils_get_hw_stats(struct aq_hw_s *self);
 
 #endif /* HW_ATL_UTILS_H */
diff --git a/drivers/net/ethernet/aquantia/atlantic/ver.h b/drivers/net/ethernet/aquantia/atlantic/ver.h
index 0de858d215c2..9009f2651e70 100644
--- a/drivers/net/ethernet/aquantia/atlantic/ver.h
+++ b/drivers/net/ethernet/aquantia/atlantic/ver.h
@@ -11,8 +11,10 @@
 #define VER_H
 
 #define NIC_MAJOR_DRIVER_VERSION           1
-#define NIC_MINOR_DRIVER_VERSION           5
-#define NIC_BUILD_DRIVER_VERSION           345
+#define NIC_MINOR_DRIVER_VERSION           6
+#define NIC_BUILD_DRIVER_VERSION           13
 #define NIC_REVISION_DRIVER_VERSION        0
 
+#define AQ_CFG_DRV_VERSION_SUFFIX "-kern"
+
 #endif /* VER_H */
diff --git a/drivers/net/ethernet/arc/emac.h b/drivers/net/ethernet/arc/emac.h
index 3c63b16d485f..d9efbc8d783b 100644
--- a/drivers/net/ethernet/arc/emac.h
+++ b/drivers/net/ethernet/arc/emac.h
@@ -159,6 +159,8 @@ struct arc_emac_priv {
         unsigned int link;
         unsigned int duplex;
         unsigned int speed;
+
+        unsigned int rx_missed_errors;
 };
 
 /**
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
index 3241af1ce718..bd277b0dc615 100644
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -26,6 +26,8 @@
 
 #include "emac.h"
 
+static void arc_emac_restart(struct net_device *ndev);
+
 /**
  * arc_emac_tx_avail - Return the number of available slots in the tx ring.
  * @priv: Pointer to ARC EMAC private data structure.
@@ -210,39 +212,48 @@ static int arc_emac_rx(struct net_device *ndev, int budget)
                         continue;
                 }
 
-                pktlen = info & LEN_MASK;
-                stats->rx_packets++;
-                stats->rx_bytes += pktlen;
-                skb = rx_buff->skb;
-                skb_put(skb, pktlen);
-                skb->dev = ndev;
-                skb->protocol = eth_type_trans(skb, ndev);
-
-                dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
-                                 dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
-
-                /* Prepare the BD for next cycle */
-                rx_buff->skb = netdev_alloc_skb_ip_align(ndev,
-                                                         EMAC_BUFFER_SIZE);
-                if (unlikely(!rx_buff->skb)) {
+                /* Prepare the BD for next cycle. netif_receive_skb()
+                 * only if new skb was allocated and mapped to avoid holes
+                 * in the RX fifo.
+                 */
+                skb = netdev_alloc_skb_ip_align(ndev, EMAC_BUFFER_SIZE);
+                if (unlikely(!skb)) {
+                        if (net_ratelimit())
+                                netdev_err(ndev, "cannot allocate skb\n");
+                        /* Return ownership to EMAC */
+                        rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
                         stats->rx_errors++;
-                        /* Because receive_skb is below, increment rx_dropped */
                         stats->rx_dropped++;
                         continue;
                 }
 
-                /* receive_skb only if new skb was allocated to avoid holes */
-                netif_receive_skb(skb);
-
-                addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data,
+                addr = dma_map_single(&ndev->dev, (void *)skb->data,
                                       EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);
                 if (dma_mapping_error(&ndev->dev, addr)) {
                         if (net_ratelimit())
-                                netdev_err(ndev, "cannot dma map\n");
-                        dev_kfree_skb(rx_buff->skb);
+                                netdev_err(ndev, "cannot map dma buffer\n");
+                        dev_kfree_skb(skb);
+                        /* Return ownership to EMAC */
+                        rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
                         stats->rx_errors++;
+                        stats->rx_dropped++;
                         continue;
                 }
+
+                /* unmap previosly mapped skb */
+                dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
+                                 dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
+
+                pktlen = info & LEN_MASK;
+                stats->rx_packets++;
+                stats->rx_bytes += pktlen;
+                skb_put(rx_buff->skb, pktlen);
+                rx_buff->skb->dev = ndev;
+                rx_buff->skb->protocol = eth_type_trans(rx_buff->skb, ndev);
+
+                netif_receive_skb(rx_buff->skb);
+
+                rx_buff->skb = skb;
                 dma_unmap_addr_set(rx_buff, addr, addr);
                 dma_unmap_len_set(rx_buff, len, EMAC_BUFFER_SIZE);
 
@@ -259,6 +270,53 @@ static int arc_emac_rx(struct net_device *ndev, int budget)
 }
 
 /**
+ * arc_emac_rx_miss_handle - handle R_MISS register
+ * @ndev:       Pointer to the net_device structure.
+ */
+static void arc_emac_rx_miss_handle(struct net_device *ndev)
+{
+        struct arc_emac_priv *priv = netdev_priv(ndev);
+        struct net_device_stats *stats = &ndev->stats;
+        unsigned int miss;
+
+        miss = arc_reg_get(priv, R_MISS);
+        if (miss) {
+                stats->rx_errors += miss;
+                stats->rx_missed_errors += miss;
+                priv->rx_missed_errors += miss;
+        }
+}
+
+/**
+ * arc_emac_rx_stall_check - check RX stall
+ * @ndev:       Pointer to the net_device structure.
+ * @budget:     How many BDs requested to process on 1 call.
+ * @work_done:  How many BDs processed
+ *
+ * Under certain conditions EMAC stop reception of incoming packets and
+ * continuously increment R_MISS register instead of saving data into
+ * provided buffer. This function detect that condition and restart
+ * EMAC.
+ */
+static void arc_emac_rx_stall_check(struct net_device *ndev,
+                                    int budget, unsigned int work_done)
+{
+        struct arc_emac_priv *priv = netdev_priv(ndev);
+        struct arc_emac_bd *rxbd;
+
+        if (work_done)
+                priv->rx_missed_errors = 0;
+
+        if (priv->rx_missed_errors && budget) {
+                rxbd = &priv->rxbd[priv->last_rx_bd];
+                if (le32_to_cpu(rxbd->info) & FOR_EMAC) {
+                        arc_emac_restart(ndev);
+                        priv->rx_missed_errors = 0;
+                }
+        }
+}
+
+/**
  * arc_emac_poll - NAPI poll handler.
  * @napi:       Pointer to napi_struct structure.
  * @budget:     How many BDs to process on 1 call.
@@ -272,6 +330,7 @@ static int arc_emac_poll(struct napi_struct *napi, int budget)
         unsigned int work_done;
 
         arc_emac_tx_clean(ndev);
+        arc_emac_rx_miss_handle(ndev);
 
         work_done = arc_emac_rx(ndev, budget);
         if (work_done < budget) {
@@ -279,6 +338,8 @@ static int arc_emac_poll(struct napi_struct *napi, int budget)
                 arc_reg_or(priv, R_ENABLE, RXINT_MASK | TXINT_MASK);
         }
 
+        arc_emac_rx_stall_check(ndev, budget, work_done);
+
         return work_done;
 }
 
@@ -320,6 +381,8 @@ static irqreturn_t arc_emac_intr(int irq, void *dev_instance)
                 if (status & MSER_MASK) {
                         stats->rx_missed_errors += 0x100;
                         stats->rx_errors += 0x100;
+                        priv->rx_missed_errors += 0x100;
+                        napi_schedule(&priv->napi);
                 }
 
                 if (status & RXCR_MASK) {
@@ -732,6 +795,63 @@ static int arc_emac_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 }
 
 
+/**
+ * arc_emac_restart - Restart EMAC
+ * @ndev:       Pointer to net_device structure.
+ *
+ * This function do hardware reset of EMAC in order to restore
+ * network packets reception.
+ */
+static void arc_emac_restart(struct net_device *ndev)
+{
+        struct arc_emac_priv *priv = netdev_priv(ndev);
+        struct net_device_stats *stats = &ndev->stats;
+        int i;
+
+        if (net_ratelimit())
+                netdev_warn(ndev, "restarting stalled EMAC\n");
+
+        netif_stop_queue(ndev);
+
+        /* Disable interrupts */
+        arc_reg_clr(priv, R_ENABLE, RXINT_MASK | TXINT_MASK | ERR_MASK);
+
+        /* Disable EMAC */
+        arc_reg_clr(priv, R_CTRL, EN_MASK);
+
+        /* Return the sk_buff to system */
+        arc_free_tx_queue(ndev);
+
+        /* Clean Tx BD's */
+        priv->txbd_curr = 0;
+        priv->txbd_dirty = 0;
+        memset(priv->txbd, 0, TX_RING_SZ);
+
+        for (i = 0; i < RX_BD_NUM; i++) {
+                struct arc_emac_bd *rxbd = &priv->rxbd[i];
+                unsigned int info = le32_to_cpu(rxbd->info);
+
+                if (!(info & FOR_EMAC)) {
+                        stats->rx_errors++;
+                        stats->rx_dropped++;
+                }
+                /* Return ownership to EMAC */
+                rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
+        }
+        priv->last_rx_bd = 0;
+
+        /* Make sure info is visible to EMAC before enable */
+        wmb();
+
+        /* Enable interrupts */
+        arc_reg_set(priv, R_ENABLE, RXINT_MASK | TXINT_MASK | ERR_MASK);
+
+        /* Enable EMAC */
+        arc_reg_or(priv, R_CTRL, EN_MASK);
+
+        netif_start_queue(ndev);
+}
+
 static const struct net_device_ops arc_emac_netdev_ops = {
         .ndo_open               = arc_emac_open,
         .ndo_stop               = arc_emac_stop,
diff --git a/drivers/net/ethernet/arc/emac_rockchip.c b/drivers/net/ethernet/arc/emac_rockchip.c
index e278e3d96ee0..16f9bee992fe 100644
--- a/drivers/net/ethernet/arc/emac_rockchip.c
+++ b/drivers/net/ethernet/arc/emac_rockchip.c
@@ -199,9 +199,11 @@ static int emac_rockchip_probe(struct platform_device *pdev)
 
         /* RMII interface needs always a rate of 50MHz */
         err = clk_set_rate(priv->refclk, 50000000);
-        if (err)
+        if (err) {
                 dev_err(dev,
                         "failed to change reference clock rate (%d)\n", err);
+                goto out_regulator_disable;
+        }
 
         if (priv->soc_data->need_div_macclk) {
                 priv->macclk = devm_clk_get(dev, "macclk");
@@ -220,19 +222,24 @@ static int emac_rockchip_probe(struct platform_device *pdev)
 
                 /* RMII TX/RX needs always a rate of 25MHz */
                 err = clk_set_rate(priv->macclk, 25000000);
-                if (err)
+                if (err) {
                         dev_err(dev,
                                 "failed to change mac clock rate (%d)\n", err);
+                        goto out_clk_disable_macclk;
+                }
         }
 
         err = arc_emac_probe(ndev, interface);
         if (err) {
                 dev_err(dev, "failed to probe arc emac (%d)\n", err);
-                goto out_regulator_disable;
+                goto out_clk_disable_macclk;
         }
 
         return 0;
 
+out_clk_disable_macclk:
+        if (priv->soc_data->need_div_macclk)
+                clk_disable_unprepare(priv->macclk);
 out_regulator_disable:
         if (priv->regulator)
                 regulator_disable(priv->regulator);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 4c739d5355d2..8ae269ec17a1 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3030,7 +3030,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link)
 
         del_timer_sync(&bp->timer);
 
-        if (IS_PF(bp)) {
+        if (IS_PF(bp) && !BP_NOMCP(bp)) {
                 /* Set ALWAYS_ALIVE bit in shmem */
                 bp->fw_drv_pulse_wr_seq |= DRV_PULSE_ALWAYS_ALIVE;
                 bnx2x_drv_pulse(bp);
@@ -3116,7 +3116,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link)
         bp->cnic_loaded = false;
 
         /* Clear driver version indication in shmem */
-        if (IS_PF(bp))
+        if (IS_PF(bp) && !BP_NOMCP(bp))
                 bnx2x_update_mng_version(bp);
 
         /* Check if there are pending parity attentions. If there are - set
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 91e2a7560b48..ddd5d3ebd201 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -9578,6 +9578,15 @@ static int bnx2x_init_shmem(struct bnx2x *bp)
 
         do {
                 bp->common.shmem_base = REG_RD(bp, MISC_REG_SHARED_MEM_ADDR);
+
+                /* If we read all 0xFFs, means we are in PCI error state and
+                 * should bail out to avoid crashes on adapter's FW reads.
+                 */
+                if (bp->common.shmem_base == 0xFFFFFFFF) {
+                        bp->flags |= NO_MCP_FLAG;
+                        return -ENODEV;
+                }
+
                 if (bp->common.shmem_base) {
                         val = SHMEM_RD(bp, validity_map[BP_PORT(bp)]);
                         if (val & SHR_MEM_VALIDITY_MB)
@@ -14320,7 +14329,10 @@ static pci_ers_result_t bnx2x_io_slot_reset(struct pci_dev *pdev)
                 BNX2X_ERR("IO slot reset --> driver unload\n");
 
                 /* MCP should have been reset; Need to wait for validity */
-                bnx2x_init_shmem(bp);
+                if (bnx2x_init_shmem(bp)) {
+                        rtnl_unlock();
+                        return PCI_ERS_RESULT_DISCONNECT;
+                }
 
                 if (IS_PF(bp) && SHMEM2_HAS(bp, drv_capabilities_flag)) {
                         u32 v;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index c5c38d4b7d1c..61ca4eb7c6fa 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1883,7 +1883,7 @@ static int bnxt_poll_work(struct bnxt *bp, struct bnxt_napi *bnapi, int budget)
                          * here forever if we consistently cannot allocate
                          * buffers.
                          */
-                        else if (rc == -ENOMEM)
+                        else if (rc == -ENOMEM && budget)
                                 rx_pkts++;
                         else if (rc == -EBUSY)  /* partial completion */
                                 break;
@@ -1969,7 +1969,7 @@ static int bnxt_poll_nitroa0(struct napi_struct *napi, int budget)
                                 cpu_to_le32(RX_CMPL_ERRORS_CRC_ERROR);
 
                         rc = bnxt_rx_pkt(bp, bnapi, &raw_cons, &event);
-                        if (likely(rc == -EIO))
+                        if (likely(rc == -EIO) && budget)
                                 rx_pkts++;
                         else if (rc == -EBUSY)  /* partial completion */
                                 break;
@@ -3368,6 +3368,7 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len,
         u16 cp_ring_id, len = 0;
         struct hwrm_err_output *resp = bp->hwrm_cmd_resp_addr;
         u16 max_req_len = BNXT_HWRM_MAX_REQ_LEN;
+        struct hwrm_short_input short_input = {0};
 
         req->seq_id = cpu_to_le16(bp->hwrm_cmd_seq++);
         memset(resp, 0, PAGE_SIZE);
@@ -3376,7 +3377,6 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len,
 
         if (bp->flags & BNXT_FLAG_SHORT_CMD) {
                 void *short_cmd_req = bp->hwrm_short_cmd_req_addr;
-                struct hwrm_short_input short_input = {0};
 
                 memcpy(short_cmd_req, req, msg_len);
                 memset(short_cmd_req + msg_len, 0, BNXT_HWRM_MAX_REQ_LEN -
@@ -8263,8 +8263,9 @@ static void bnxt_shutdown(struct pci_dev *pdev)
         if (netif_running(dev))
                 dev_close(dev);
 
+        bnxt_ulp_shutdown(bp);
+
         if (system_state == SYSTEM_POWER_OFF) {
-                bnxt_ulp_shutdown(bp);
                 bnxt_clear_int_mode(bp);
                 pci_wake_from_d3(pdev, bp->wol);
                 pci_set_power_state(pdev, PCI_D3hot);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
index 5ee18660bc33..c9617675f934 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -70,7 +70,7 @@ static int bnxt_vf_ndo_prep(struct bnxt *bp, int vf_id)
                 netdev_err(bp->dev, "vf ndo called though sriov is disabled\n");
                 return -EINVAL;
         }
-        if (vf_id >= bp->pf.max_vfs) {
+        if (vf_id >= bp->pf.active_vfs) {
                 netdev_err(bp->dev, "Invalid VF id %d\n", vf_id);
                 return -EINVAL;
         }
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index d5031f436f83..d8fee26cd45e 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -56,7 +56,6 @@ static int bnxt_tc_parse_redir(struct bnxt *bp,
 {
         int ifindex = tcf_mirred_ifindex(tc_act);
         struct net_device *dev;
-        u16 dst_fid;
 
         dev = __dev_get_by_index(dev_net(bp->dev), ifindex);
         if (!dev) {
@@ -64,15 +63,7 @@ static int bnxt_tc_parse_redir(struct bnxt *bp,
                 return -EINVAL;
         }
 
-        /* find the FID from dev */
-        dst_fid = bnxt_flow_get_dst_fid(bp, dev);
-        if (dst_fid == BNXT_FID_INVALID) {
-                netdev_info(bp->dev, "can't get fid for ifindex=%d", ifindex);
-                return -EINVAL;
-        }
-
         actions->flags |= BNXT_TC_ACTION_FLAG_FWD;
-        actions->dst_fid = dst_fid;
         actions->dst_dev = dev;
         return 0;
 }
@@ -160,13 +151,17 @@ static int bnxt_tc_parse_actions(struct bnxt *bp,
         if (rc)
                 return rc;
 
-        /* Tunnel encap/decap action must be accompanied by a redirect action */
-        if ((actions->flags & BNXT_TC_ACTION_FLAG_TUNNEL_ENCAP ||
-             actions->flags & BNXT_TC_ACTION_FLAG_TUNNEL_DECAP) &&
-            !(actions->flags & BNXT_TC_ACTION_FLAG_FWD)) {
-                netdev_info(bp->dev,
-                            "error: no redir action along with encap/decap");
-                return -EINVAL;
+        if (actions->flags & BNXT_TC_ACTION_FLAG_FWD) {
+                if (actions->flags & BNXT_TC_ACTION_FLAG_TUNNEL_ENCAP) {
+                        /* dst_fid is PF's fid */
+                        actions->dst_fid = bp->pf.fw_fid;
+                } else {
+                        /* find the FID from dst_dev */
+                        actions->dst_fid =
+                                bnxt_flow_get_dst_fid(bp, actions->dst_dev);
+                        if (actions->dst_fid == BNXT_FID_INVALID)
+                                return -EINVAL;
+                }
         }
 
         return rc;
@@ -426,7 +421,7 @@ static int bnxt_hwrm_cfa_flow_alloc(struct bnxt *bp, struct bnxt_tc_flow *flow,
         }
 
         /* If all IP and L4 fields are wildcarded then this is an L2 flow */
-        if (is_wildcard(&l3_mask, sizeof(l3_mask)) &&
+        if (is_wildcard(l3_mask, sizeof(*l3_mask)) &&
             is_wildcard(&flow->l4_mask, sizeof(flow->l4_mask))) {
                 flow_flags |= CFA_FLOW_ALLOC_REQ_FLAGS_FLOWTYPE_L2;
         } else {
@@ -532,10 +527,8 @@ static int hwrm_cfa_decap_filter_alloc(struct bnxt *bp,
         }
 
         if (flow->flags & BNXT_TC_FLOW_FLAGS_TUNL_ETH_ADDRS) {
-                enables |= CFA_DECAP_FILTER_ALLOC_REQ_ENABLES_DST_MACADDR |
-                           CFA_DECAP_FILTER_ALLOC_REQ_ENABLES_SRC_MACADDR;
+                enables |= CFA_DECAP_FILTER_ALLOC_REQ_ENABLES_DST_MACADDR;
                 ether_addr_copy(req.dst_macaddr, l2_info->dmac);
-                ether_addr_copy(req.src_macaddr, l2_info->smac);
         }
         if (l2_info->num_vlans) {
                 enables |= CFA_DECAP_FILTER_ALLOC_REQ_ENABLES_T_IVLAN_VID;
@@ -901,10 +894,10 @@ static void bnxt_tc_put_decap_handle(struct bnxt *bp,
 
 static int bnxt_tc_resolve_tunnel_hdrs(struct bnxt *bp,
                                        struct ip_tunnel_key *tun_key,
-                                       struct bnxt_tc_l2_key *l2_info,
-                                       struct net_device *real_dst_dev)
+                                       struct bnxt_tc_l2_key *l2_info)
 {
 #ifdef CONFIG_INET
+        struct net_device *real_dst_dev = bp->dev;
         struct flowi4 flow = { {0} };
         struct net_device *dst_dev;
         struct neighbour *nbr;
@@ -1008,14 +1001,13 @@ static int bnxt_tc_get_decap_handle(struct bnxt *bp, struct bnxt_tc_flow *flow,
          */
         tun_key.u.ipv4.dst = flow->tun_key.u.ipv4.src;
         tun_key.tp_dst = flow->tun_key.tp_dst;
-        rc = bnxt_tc_resolve_tunnel_hdrs(bp, &tun_key, &l2_info, bp->dev);
+        rc = bnxt_tc_resolve_tunnel_hdrs(bp, &tun_key, &l2_info);
         if (rc)
                 goto put_decap;
 
-        decap_key->ttl = tun_key.ttl;
         decap_l2_info = &decap_node->l2_info;
+        /* decap smac is wildcarded */
         ether_addr_copy(decap_l2_info->dmac, l2_info.smac);
-        ether_addr_copy(decap_l2_info->smac, l2_info.dmac);
         if (l2_info.num_vlans) {
                 decap_l2_info->num_vlans = l2_info.num_vlans;
                 decap_l2_info->inner_vlan_tpid = l2_info.inner_vlan_tpid;
@@ -1095,8 +1087,7 @@ static int bnxt_tc_get_encap_handle(struct bnxt *bp, struct bnxt_tc_flow *flow,
         if (encap_node->tunnel_handle != INVALID_TUNNEL_HANDLE)
                 goto done;
 
-        rc = bnxt_tc_resolve_tunnel_hdrs(bp, encap_key, &encap_node->l2_info,
-                                         flow->actions.dst_dev);
+        rc = bnxt_tc_resolve_tunnel_hdrs(bp, encap_key, &encap_node->l2_info);
         if (rc)
                 goto put_encap;
 
@@ -1169,6 +1160,15 @@ static int __bnxt_tc_del_flow(struct bnxt *bp,
         return 0;
 }
 
+static void bnxt_tc_set_src_fid(struct bnxt *bp, struct bnxt_tc_flow *flow,
+                                u16 src_fid)
+{
+        if (flow->actions.flags & BNXT_TC_ACTION_FLAG_TUNNEL_DECAP)
+                flow->src_fid = bp->pf.fw_fid;
+        else
+                flow->src_fid = src_fid;
+}
+
 /* Add a new flow or replace an existing flow.
  * Notes on locking:
  * There are essentially two critical sections here.
@@ -1204,7 +1204,8 @@ static int bnxt_tc_add_flow(struct bnxt *bp, u16 src_fid,
         rc = bnxt_tc_parse_flow(bp, tc_flow_cmd, flow);
         if (rc)
                 goto free_node;
-        flow->src_fid = src_fid;
+
+        bnxt_tc_set_src_fid(bp, flow, src_fid);
 
         if (!bnxt_tc_can_offload(bp, flow)) {
                 rc = -ENOSPC;
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index de51c2177d03..8995cfefbfcf 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -4,11 +4,13 @@
  * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com)
  * Copyright (C) 2001, 2002, 2003 Jeff Garzik (jgarzik@pobox.com)
  * Copyright (C) 2004 Sun Microsystems Inc.
- * Copyright (C) 2005-2014 Broadcom Corporation.
+ * Copyright (C) 2005-2016 Broadcom Corporation.
+ * Copyright (C) 2016-2017 Broadcom Limited.
  *
  * Firmware is:
  *      Derived from proprietary unpublished source code,
- *      Copyright (C) 2000-2003 Broadcom Corporation.
+ *      Copyright (C) 2000-2016 Broadcom Corporation.
+ *      Copyright (C) 2016-2017 Broadcom Ltd.
  *
  *      Permission is hereby granted for the distribution of this firmware
  *      data in hexadecimal or equivalent format, provided this copyright
@@ -10052,6 +10054,16 @@ static int tg3_reset_hw(struct tg3 *tp, bool reset_phy)
 
         tw32(GRC_MODE, tp->grc_mode | val);
 
+        /* On one of the AMD platform, MRRS is restricted to 4000 because of
+         * south bridge limitation. As a workaround, Driver is setting MRRS
+         * to 2048 instead of default 4096.
+         */
+        if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL &&
+            tp->pdev->subsystem_device == TG3PCI_SUBDEVICE_ID_DELL_5762) {
+                val = tr32(TG3PCI_DEV_STATUS_CTRL) & ~MAX_READ_REQ_MASK;
+                tw32(TG3PCI_DEV_STATUS_CTRL, val | MAX_READ_REQ_SIZE_2048);
+        }
+
         /* Setup the timer prescalar register.  Clock is always 66Mhz. */
         val = tr32(GRC_MISC_CFG);
         val &= ~0xff;
@@ -14225,7 +14237,10 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu)
         /* Reset PHY, otherwise the read DMA engine will be in a mode that
          * breaks all requests to 256 bytes.
          */
-        if (tg3_asic_rev(tp) == ASIC_REV_57766)
+        if (tg3_asic_rev(tp) == ASIC_REV_57766 ||
+            tg3_asic_rev(tp) == ASIC_REV_5717 ||
+            tg3_asic_rev(tp) == ASIC_REV_5719 ||
+            tg3_asic_rev(tp) == ASIC_REV_5720)
                 reset_phy = true;
 
         err = tg3_restart_hw(tp, reset_phy);
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index c2d02d02d1e6..1f0271fa7c74 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -5,7 +5,8 @@
  * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com)
  * Copyright (C) 2001 Jeff Garzik (jgarzik@pobox.com)
  * Copyright (C) 2004 Sun Microsystems Inc.
- * Copyright (C) 2007-2014 Broadcom Corporation.
+ * Copyright (C) 2007-2016 Broadcom Corporation.
+ * Copyright (C) 2016-2017 Broadcom Limited.
  */
 
 #ifndef _T3_H
@@ -96,6 +97,7 @@
 #define TG3PCI_SUBDEVICE_ID_DELL_JAGUAR         0x0106
 #define TG3PCI_SUBDEVICE_ID_DELL_MERLOT         0x0109
 #define TG3PCI_SUBDEVICE_ID_DELL_SLIM_MERLOT    0x010a
+#define TG3PCI_SUBDEVICE_ID_DELL_5762           0x07f0
 #define TG3PCI_SUBVENDOR_ID_COMPAQ              PCI_VENDOR_ID_COMPAQ
 #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE      0x007c
 #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE_2    0x009a
@@ -281,6 +283,9 @@
 #define TG3PCI_STD_RING_PROD_IDX        0x00000098 /* 64-bit */
 #define TG3PCI_RCV_RET_RING_CON_IDX     0x000000a0 /* 64-bit */
 /* 0xa8 --> 0xb8 unused */
+#define TG3PCI_DEV_STATUS_CTRL          0x000000b4
+#define  MAX_READ_REQ_SIZE_2048          0x00004000
+#define  MAX_READ_REQ_MASK               0x00007000
 #define TG3PCI_DUAL_MAC_CTRL            0x000000b8
 #define  DUAL_MAC_CTRL_CH_MASK           0x00000003
 #define  DUAL_MAC_CTRL_ID                0x00000004
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
index 6aa0eee88ea5..a5eecd895a82 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
@@ -1113,7 +1113,7 @@ static int liquidio_watchdog(void *param)
                                 dev_err(&oct->pci_dev->dev,
                                         "ERROR: Octeon core %d crashed or got stuck!  See oct-fwdump for details.\n",
                                         core);
-                                        err_msg_was_printed[core] = true;
+                                err_msg_was_printed[core] = true;
                         }
                 }
 
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 8b2c31e2a2b0..a3d12dbde95b 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -1355,6 +1355,8 @@ nicvf_sq_add_hdr_subdesc(struct nicvf *nic, struct snd_queue *sq, int qentry,
 
         /* Offload checksum calculation to HW */
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                if (ip.v4->version == 4)
+                        hdr->csum_l3 = 1; /* Enable IP csum calculation */
                 hdr->l3_offset = skb_network_offset(skb);
                 hdr->l4_offset = skb_transport_offset(skb);
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index 6f9fa6e3c42a..d8424ed16c33 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -344,7 +344,6 @@ struct adapter_params {
 
         unsigned int sf_size;             /* serial flash size in bytes */
         unsigned int sf_nsec;             /* # of flash sectors */
-        unsigned int sf_fw_start;         /* start of FW image in flash */
 
         unsigned int fw_vers;             /* firmware version */
         unsigned int bs_vers;             /* bootstrap version */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
index d4a548a6a55c..a452d5a1b0f3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
@@ -111,6 +111,9 @@ static void cxgb4_process_flow_match(struct net_device *dev,
                         ethtype_mask = 0;
                 }
 
+                if (ethtype_key == ETH_P_IPV6)
+                        fs->type = 1;
+
                 fs->val.ethtype = ethtype_key;
                 fs->mask.ethtype = ethtype_mask;
                 fs->val.proto = key->ip_proto;
@@ -205,8 +208,8 @@ static void cxgb4_process_flow_match(struct net_device *dev,
                                            VLAN_PRIO_SHIFT);
                 vlan_tci_mask = mask->vlan_id | (mask->vlan_priority <<
                                                  VLAN_PRIO_SHIFT);
-                fs->val.ivlan = cpu_to_be16(vlan_tci);
-                fs->mask.ivlan = cpu_to_be16(vlan_tci_mask);
+                fs->val.ivlan = vlan_tci;
+                fs->mask.ivlan = vlan_tci_mask;
 
                 /* Chelsio adapters use ivlan_vld bit to match vlan packets
                  * as 802.1Q. Also, when vlan tag is present in packets,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index f63210f15579..375ef86a84da 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -2844,8 +2844,6 @@ enum {
         SF_RD_DATA_FAST = 0xb,        /* read flash */
         SF_RD_ID        = 0x9f,       /* read ID */
         SF_ERASE_SECTOR = 0xd8,       /* erase sector */
-
-        FW_MAX_SIZE = 16 * SF_SEC_SIZE,
 };
 
 /**
@@ -3558,8 +3556,9 @@ int t4_load_fw(struct adapter *adap, const u8 *fw_data, unsigned int size)
         const __be32 *p = (const __be32 *)fw_data;
         const struct fw_hdr *hdr = (const struct fw_hdr *)fw_data;
         unsigned int sf_sec_size = adap->params.sf_size / adap->params.sf_nsec;
-        unsigned int fw_img_start = adap->params.sf_fw_start;
-        unsigned int fw_start_sec = fw_img_start / sf_sec_size;
+        unsigned int fw_start_sec = FLASH_FW_START_SEC;
+        unsigned int fw_size = FLASH_FW_MAX_SIZE;
+        unsigned int fw_start = FLASH_FW_START;
 
         if (!size) {
                 dev_err(adap->pdev_dev, "FW image has no data\n");
@@ -3575,9 +3574,9 @@ int t4_load_fw(struct adapter *adap, const u8 *fw_data, unsigned int size)
                         "FW image size differs from size in FW header\n");
                 return -EINVAL;
         }
-        if (size > FW_MAX_SIZE) {
+        if (size > fw_size) {
                 dev_err(adap->pdev_dev, "FW image too large, max is %u bytes\n",
-                        FW_MAX_SIZE);
+                        fw_size);
                 return -EFBIG;
         }
         if (!t4_fw_matches_chip(adap, hdr))
@@ -3604,11 +3603,11 @@ int t4_load_fw(struct adapter *adap, const u8 *fw_data, unsigned int size)
          */
         memcpy(first_page, fw_data, SF_PAGE_SIZE);
         ((struct fw_hdr *)first_page)->fw_ver = cpu_to_be32(0xffffffff);
-        ret = t4_write_flash(adap, fw_img_start, SF_PAGE_SIZE, first_page);
+        ret = t4_write_flash(adap, fw_start, SF_PAGE_SIZE, first_page);
         if (ret)
                 goto out;
 
-        addr = fw_img_start;
+        addr = fw_start;
         for (size -= SF_PAGE_SIZE; size; size -= SF_PAGE_SIZE) {
                 addr += SF_PAGE_SIZE;
                 fw_data += SF_PAGE_SIZE;
@@ -3618,7 +3617,7 @@ int t4_load_fw(struct adapter *adap, const u8 *fw_data, unsigned int size)
         }
 
         ret = t4_write_flash(adap,
-                             fw_img_start + offsetof(struct fw_hdr, fw_ver),
+                             fw_start + offsetof(struct fw_hdr, fw_ver),
                              sizeof(hdr->fw_ver), (const u8 *)&hdr->fw_ver);
 out:
         if (ret)
diff --git a/drivers/net/ethernet/cirrus/cs89x0.c b/drivers/net/ethernet/cirrus/cs89x0.c
index 410a0a95130b..b3e7fafee3df 100644
--- a/drivers/net/ethernet/cirrus/cs89x0.c
+++ b/drivers/net/ethernet/cirrus/cs89x0.c
@@ -1913,3 +1913,7 @@ static struct platform_driver cs89x0_driver = {
 module_platform_driver_probe(cs89x0_driver, cs89x0_platform_probe);
 
 #endif /* CONFIG_CS89x0_PLATFORM */
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Crystal Semiconductor (Now Cirrus Logic) CS89[02]0 network driver");
+MODULE_AUTHOR("Russell Nelson <nelson@crynwr.com>");
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index c6e859a27ee6..e180657a02ef 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -4634,6 +4634,15 @@ int be_update_queues(struct be_adapter *adapter)
 
         be_schedule_worker(adapter);
 
+        /*
+         * The IF was destroyed and re-created. We need to clear
+         * all promiscuous flags valid for the destroyed IF.
+         * Without this promisc mode is not restored during
+         * be_open() because the driver thinks that it is
+         * already enabled in HW.
+         */
+        adapter->if_flags &= ~BE_IF_FLAGS_ALL_PROMISCUOUS;
+
         if (netif_running(netdev))
                 status = be_open(netdev);
 
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 610573855213..a74300a4459c 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -818,6 +818,12 @@ static void fec_enet_bd_init(struct net_device *dev)
                 for (i = 0; i < txq->bd.ring_size; i++) {
                         /* Initialize the BD for every fragment in the page. */
                         bdp->cbd_sc = cpu_to_fec16(0);
+                        if (bdp->cbd_bufaddr &&
+                            !IS_TSO_HEADER(txq, fec32_to_cpu(bdp->cbd_bufaddr)))
+                                dma_unmap_single(&fep->pdev->dev,
+                                                 fec32_to_cpu(bdp->cbd_bufaddr),
+                                                 fec16_to_cpu(bdp->cbd_datlen),
+                                                 DMA_TO_DEVICE);
                         if (txq->tx_skbuff[i]) {
                                 dev_kfree_skb_any(txq->tx_skbuff[i]);
                                 txq->tx_skbuff[i] = NULL;
@@ -3463,6 +3469,10 @@ fec_probe(struct platform_device *pdev)
                         goto failed_regulator;
                 }
         } else {
+                if (PTR_ERR(fep->reg_phy) == -EPROBE_DEFER) {
+                        ret = -EPROBE_DEFER;
+                        goto failed_regulator;
+                }
                 fep->reg_phy = NULL;
         }
 
@@ -3546,8 +3556,9 @@ failed_clk_ipg:
 failed_clk:
         if (of_phy_is_fixed_link(np))
                 of_phy_deregister_fixed_link(np);
-failed_phy:
         of_node_put(phy_node);
+failed_phy:
+        dev_id--;
 failed_ioremap:
         free_netdev(ndev);
 
diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
index 7892f2f0c6b5..2c2976a2dda6 100644
--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
+++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
@@ -613,9 +613,11 @@ static int fs_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
         return NETDEV_TX_OK;
 }
 
-static void fs_timeout(struct net_device *dev)
+static void fs_timeout_work(struct work_struct *work)
 {
-        struct fs_enet_private *fep = netdev_priv(dev);
+        struct fs_enet_private *fep = container_of(work, struct fs_enet_private,
+                                                   timeout_work);
+        struct net_device *dev = fep->ndev;
         unsigned long flags;
         int wake = 0;
 
@@ -627,7 +629,6 @@ static void fs_timeout(struct net_device *dev)
                 phy_stop(dev->phydev);
                 (*fep->ops->stop)(dev);
                 (*fep->ops->restart)(dev);
-                phy_start(dev->phydev);
         }
 
         phy_start(dev->phydev);
@@ -639,6 +640,13 @@ static void fs_timeout(struct net_device *dev)
                 netif_wake_queue(dev);
 }
 
+static void fs_timeout(struct net_device *dev)
+{
+        struct fs_enet_private *fep = netdev_priv(dev);
+
+        schedule_work(&fep->timeout_work);
+}
+
 /*-----------------------------------------------------------------------------
  *  generic link-change handler - should be sufficient for most cases
  *-----------------------------------------------------------------------------*/
@@ -759,6 +767,7 @@ static int fs_enet_close(struct net_device *dev)
         netif_stop_queue(dev);
         netif_carrier_off(dev);
         napi_disable(&fep->napi);
+        cancel_work_sync(&fep->timeout_work);
         phy_stop(dev->phydev);
 
         spin_lock_irqsave(&fep->lock, flags);
@@ -1019,6 +1028,7 @@ static int fs_enet_probe(struct platform_device *ofdev)
 
         ndev->netdev_ops = &fs_enet_netdev_ops;
         ndev->watchdog_timeo = 2 * HZ;
+        INIT_WORK(&fep->timeout_work, fs_timeout_work);
         netif_napi_add(ndev, &fep->napi, fs_enet_napi, fpi->napi_weight);
 
         ndev->ethtool_ops = &fs_ethtool_ops;
diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet.h b/drivers/net/ethernet/freescale/fs_enet/fs_enet.h
index 92e06b37a199..195fae6aec4a 100644
--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet.h
+++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet.h
@@ -125,6 +125,7 @@ struct fs_enet_private {
         spinlock_t lock;        /* during all ops except TX pckt processing */
         spinlock_t tx_lock;     /* during fs_start_xmit and fs_tx         */
         struct fs_platform_info *fpi;
+        struct work_struct timeout_work;
         const struct fs_ops *ops;
         int rx_ring, tx_ring;
         dma_addr_t ring_mem_addr;
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 5be52d89b182..7f837006bb6a 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -1378,9 +1378,11 @@ static int gfar_probe(struct platform_device *ofdev)
 
         gfar_init_addr_hash_table(priv);
 
-        /* Insert receive time stamps into padding alignment bytes */
+        /* Insert receive time stamps into padding alignment bytes, and
+         * plus 2 bytes padding to ensure the cpu alignment.
+         */
         if (priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER)
-                priv->padding = 8;
+                priv->padding = 8 + DEFAULT_PADDING;
 
         if (dev->features & NETIF_F_IP_CSUM ||
             priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER)
@@ -1790,6 +1792,7 @@ static int init_phy(struct net_device *dev)
                 GFAR_SUPPORTED_GBIT : 0;
         phy_interface_t interface;
         struct phy_device *phydev;
+        struct ethtool_eee edata;
 
         priv->oldlink = 0;
         priv->oldspeed = 0;
@@ -1814,6 +1817,10 @@ static int init_phy(struct net_device *dev)
         /* Add support for flow control, but don't advertise it by default */
         phydev->supported |= (SUPPORTED_Pause | SUPPORTED_Asym_Pause);
 
+        /* disable EEE autoneg, EEE not supported by eTSEC */
+        memset(&edata, 0, sizeof(struct ethtool_eee));
+        phy_ethtool_set_eee(phydev, &edata);
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c
index 544114281ea7..9f8d4f8e57e3 100644
--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
+++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
@@ -319,11 +319,10 @@ static int ptp_gianfar_adjtime(struct ptp_clock_info *ptp, s64 delta)
         now = tmr_cnt_read(etsects);
         now += delta;
         tmr_cnt_write(etsects, now);
+        set_fipers(etsects);
 
         spin_unlock_irqrestore(&etsects->lock, flags);
 
-        set_fipers(etsects);
-
         return 0;
 }
 
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index 7feff2450ed6..241db3199b88 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -494,6 +494,9 @@ static u32 __emac_calc_base_mr1(struct emac_instance *dev, int tx_size, int rx_s
         case 16384:
                 ret |= EMAC_MR1_RFS_16K;
                 break;
+        case 8192:
+                ret |= EMAC4_MR1_RFS_8K;
+                break;
         case 4096:
                 ret |= EMAC_MR1_RFS_4K;
                 break;
@@ -516,6 +519,9 @@ static u32 __emac4_calc_base_mr1(struct emac_instance *dev, int tx_size, int rx_
         case 16384:
                 ret |= EMAC4_MR1_TFS_16K;
                 break;
+        case 8192:
+                ret |= EMAC4_MR1_TFS_8K;
+                break;
         case 4096:
                 ret |= EMAC4_MR1_TFS_4K;
                 break;
diff --git a/drivers/net/ethernet/ibm/emac/emac.h b/drivers/net/ethernet/ibm/emac/emac.h
index 5afcc27ceebb..c26d2631ca30 100644
--- a/drivers/net/ethernet/ibm/emac/emac.h
+++ b/drivers/net/ethernet/ibm/emac/emac.h
@@ -151,9 +151,11 @@ struct emac_regs {
 
 #define EMAC4_MR1_RFS_2K                0x00100000
 #define EMAC4_MR1_RFS_4K                0x00180000
+#define EMAC4_MR1_RFS_8K                0x00200000
 #define EMAC4_MR1_RFS_16K               0x00280000
 #define EMAC4_MR1_TFS_2K                0x00020000
 #define EMAC4_MR1_TFS_4K                0x00030000
+#define EMAC4_MR1_TFS_8K                0x00040000
 #define EMAC4_MR1_TFS_16K               0x00050000
 #define EMAC4_MR1_TR                    0x00008000
 #define EMAC4_MR1_MWSW_001              0x00001000
@@ -242,7 +244,7 @@ struct emac_regs {
 #define EMAC_STACR_PHYE                 0x00004000
 #define EMAC_STACR_STAC_MASK            0x00003000
 #define EMAC_STACR_STAC_READ            0x00001000
-#define EMAC_STACR_STAC_WRITE           0x00002000
+#define EMAC_STACR_STAC_WRITE           0x00000800
 #define EMAC_STACR_OPBC_MASK            0x00000C00
 #define EMAC_STACR_OPBC_50              0x00000000
 #define EMAC_STACR_OPBC_66              0x00000400
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 1dc4aef37d3a..b65f5f3ac034 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -410,6 +410,10 @@ static int reset_rx_pools(struct ibmvnic_adapter *adapter)
         struct ibmvnic_rx_pool *rx_pool;
         int rx_scrqs;
         int i, j, rc;
+        u64 *size_array;
+
+        size_array = (u64 *)((u8 *)(adapter->login_rsp_buf) +
+                be32_to_cpu(adapter->login_rsp_buf->off_rxadd_buff_size));
 
         rx_scrqs = be32_to_cpu(adapter->login_rsp_buf->num_rxadd_subcrqs);
         for (i = 0; i < rx_scrqs; i++) {
@@ -417,7 +421,17 @@ static int reset_rx_pools(struct ibmvnic_adapter *adapter)
 
                 netdev_dbg(adapter->netdev, "Re-setting rx_pool[%d]\n", i);
 
-                rc = reset_long_term_buff(adapter, &rx_pool->long_term_buff);
+                if (rx_pool->buff_size != be64_to_cpu(size_array[i])) {
+                        free_long_term_buff(adapter, &rx_pool->long_term_buff);
+                        rx_pool->buff_size = be64_to_cpu(size_array[i]);
+                        alloc_long_term_buff(adapter, &rx_pool->long_term_buff,
+                                             rx_pool->size *
+                                             rx_pool->buff_size);
+                } else {
+                        rc = reset_long_term_buff(adapter,
+                                                  &rx_pool->long_term_buff);
+                }
+
                 if (rc)
                         return rc;
 
@@ -439,14 +453,12 @@ static int reset_rx_pools(struct ibmvnic_adapter *adapter)
 static void release_rx_pools(struct ibmvnic_adapter *adapter)
 {
         struct ibmvnic_rx_pool *rx_pool;
-        int rx_scrqs;
         int i, j;
 
         if (!adapter->rx_pool)
                 return;
 
-        rx_scrqs = be32_to_cpu(adapter->login_rsp_buf->num_rxadd_subcrqs);
-        for (i = 0; i < rx_scrqs; i++) {
+        for (i = 0; i < adapter->num_active_rx_pools; i++) {
                 rx_pool = &adapter->rx_pool[i];
 
                 netdev_dbg(adapter->netdev, "Releasing rx_pool[%d]\n", i);
@@ -469,6 +481,7 @@ static void release_rx_pools(struct ibmvnic_adapter *adapter)
 
         kfree(adapter->rx_pool);
         adapter->rx_pool = NULL;
+        adapter->num_active_rx_pools = 0;
 }
 
 static int init_rx_pools(struct net_device *netdev)
@@ -493,6 +506,8 @@ static int init_rx_pools(struct net_device *netdev)
                 return -1;
         }
 
+        adapter->num_active_rx_pools = 0;
+
         for (i = 0; i < rxadd_subcrqs; i++) {
                 rx_pool = &adapter->rx_pool[i];
 
@@ -536,6 +551,8 @@ static int init_rx_pools(struct net_device *netdev)
                 rx_pool->next_free = 0;
         }
 
+        adapter->num_active_rx_pools = rxadd_subcrqs;
+
         return 0;
 }
 
@@ -586,13 +603,12 @@ static void release_vpd_data(struct ibmvnic_adapter *adapter)
 static void release_tx_pools(struct ibmvnic_adapter *adapter)
 {
         struct ibmvnic_tx_pool *tx_pool;
-        int i, tx_scrqs;
+        int i;
 
         if (!adapter->tx_pool)
                 return;
 
-        tx_scrqs = be32_to_cpu(adapter->login_rsp_buf->num_txsubm_subcrqs);
-        for (i = 0; i < tx_scrqs; i++) {
+        for (i = 0; i < adapter->num_active_tx_pools; i++) {
                 netdev_dbg(adapter->netdev, "Releasing tx_pool[%d]\n", i);
                 tx_pool = &adapter->tx_pool[i];
                 kfree(tx_pool->tx_buff);
@@ -603,6 +619,7 @@ static void release_tx_pools(struct ibmvnic_adapter *adapter)
 
         kfree(adapter->tx_pool);
         adapter->tx_pool = NULL;
+        adapter->num_active_tx_pools = 0;
 }
 
 static int init_tx_pools(struct net_device *netdev)
@@ -619,6 +636,8 @@ static int init_tx_pools(struct net_device *netdev)
         if (!adapter->tx_pool)
                 return -1;
 
+        adapter->num_active_tx_pools = 0;
+
         for (i = 0; i < tx_subcrqs; i++) {
                 tx_pool = &adapter->tx_pool[i];
 
@@ -666,6 +685,8 @@ static int init_tx_pools(struct net_device *netdev)
                 tx_pool->producer_index = 0;
         }
 
+        adapter->num_active_tx_pools = tx_subcrqs;
+
         return 0;
 }
 
@@ -756,6 +777,12 @@ static int ibmvnic_login(struct net_device *netdev)
                 }
         } while (adapter->renegotiate);
 
+        /* handle pending MAC address changes after successful login */
+        if (adapter->mac_change_pending) {
+                __ibmvnic_set_mac(netdev, &adapter->desired.mac);
+                adapter->mac_change_pending = false;
+        }
+
         return 0;
 }
 
@@ -854,7 +881,7 @@ static int ibmvnic_get_vpd(struct ibmvnic_adapter *adapter)
         if (adapter->vpd->buff)
                 len = adapter->vpd->len;
 
-        reinit_completion(&adapter->fw_done);
+        init_completion(&adapter->fw_done);
         crq.get_vpd_size.first = IBMVNIC_CRQ_CMD;
         crq.get_vpd_size.cmd = GET_VPD_SIZE;
         ibmvnic_send_crq(adapter, &crq);
@@ -916,6 +943,13 @@ static int init_resources(struct ibmvnic_adapter *adapter)
         if (!adapter->vpd)
                 return -ENOMEM;
 
+        /* Vital Product Data (VPD) */
+        rc = ibmvnic_get_vpd(adapter);
+        if (rc) {
+                netdev_err(netdev, "failed to initialize Vital Product Data (VPD)\n");
+                return rc;
+        }
+
         adapter->map_id = 1;
         adapter->napi = kcalloc(adapter->req_rx_queues,
                                 sizeof(struct napi_struct), GFP_KERNEL);
@@ -989,15 +1023,10 @@ static int __ibmvnic_open(struct net_device *netdev)
 static int ibmvnic_open(struct net_device *netdev)
 {
         struct ibmvnic_adapter *adapter = netdev_priv(netdev);
-        int rc, vpd;
+        int rc;
 
         mutex_lock(&adapter->reset_lock);
 
-        if (adapter->mac_change_pending) {
-                __ibmvnic_set_mac(netdev, &adapter->desired.mac);
-                adapter->mac_change_pending = false;
-        }
-
         if (adapter->state != VNIC_CLOSED) {
                 rc = ibmvnic_login(netdev);
                 if (rc) {
@@ -1017,11 +1046,6 @@ static int ibmvnic_open(struct net_device *netdev)
         rc = __ibmvnic_open(netdev);
         netif_carrier_on(netdev);
 
-        /* Vital Product Data (VPD) */
-        vpd = ibmvnic_get_vpd(adapter);
-        if (vpd)
-                netdev_err(netdev, "failed to initialize Vital Product Data (VPD)\n");
-
         mutex_unlock(&adapter->reset_lock);
 
         return rc;
@@ -1275,6 +1299,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
         unsigned char *dst;
         u64 *handle_array;
         int index = 0;
+        u8 proto = 0;
         int ret = 0;
 
         if (adapter->resetting) {
@@ -1363,17 +1388,18 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
         }
 
         if (skb->protocol == htons(ETH_P_IP)) {
-                if (ip_hdr(skb)->version == 4)
-                        tx_crq.v1.flags1 |= IBMVNIC_TX_PROT_IPV4;
-                else if (ip_hdr(skb)->version == 6)
-                        tx_crq.v1.flags1 |= IBMVNIC_TX_PROT_IPV6;
-
-                if (ip_hdr(skb)->protocol == IPPROTO_TCP)
-                        tx_crq.v1.flags1 |= IBMVNIC_TX_PROT_TCP;
-                else if (ip_hdr(skb)->protocol != IPPROTO_TCP)
-                        tx_crq.v1.flags1 |= IBMVNIC_TX_PROT_UDP;
+                tx_crq.v1.flags1 |= IBMVNIC_TX_PROT_IPV4;
+                proto = ip_hdr(skb)->protocol;
+        } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                tx_crq.v1.flags1 |= IBMVNIC_TX_PROT_IPV6;
+                proto = ipv6_hdr(skb)->nexthdr;
         }
 
+        if (proto == IPPROTO_TCP)
+                tx_crq.v1.flags1 |= IBMVNIC_TX_PROT_TCP;
+        else if (proto == IPPROTO_UDP)
+                tx_crq.v1.flags1 |= IBMVNIC_TX_PROT_UDP;
+
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 tx_crq.v1.flags1 |= IBMVNIC_TX_CHKSUM_OFFLOAD;
                 hdrs += 2;
@@ -1527,7 +1553,7 @@ static int ibmvnic_set_mac(struct net_device *netdev, void *p)
         struct ibmvnic_adapter *adapter = netdev_priv(netdev);
         struct sockaddr *addr = p;
 
-        if (adapter->state != VNIC_OPEN) {
+        if (adapter->state == VNIC_PROBED) {
                 memcpy(&adapter->desired.mac, addr, sizeof(struct sockaddr));
                 adapter->mac_change_pending = true;
                 return 0;
@@ -1545,6 +1571,7 @@ static int ibmvnic_set_mac(struct net_device *netdev, void *p)
 static int do_reset(struct ibmvnic_adapter *adapter,
                     struct ibmvnic_rwi *rwi, u32 reset_state)
 {
+        u64 old_num_rx_queues, old_num_tx_queues;
         struct net_device *netdev = adapter->netdev;
         int i, rc;
 
@@ -1554,6 +1581,9 @@ static int do_reset(struct ibmvnic_adapter *adapter,
         netif_carrier_off(netdev);
         adapter->reset_reason = rwi->reset_reason;
 
+        old_num_rx_queues = adapter->req_rx_queues;
+        old_num_tx_queues = adapter->req_tx_queues;
+
         if (rwi->reset_reason == VNIC_RESET_MOBILITY) {
                 rc = ibmvnic_reenable_crq_queue(adapter);
                 if (rc)
@@ -1598,6 +1628,12 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                         rc = init_resources(adapter);
                         if (rc)
                                 return rc;
+                } else if (adapter->req_rx_queues != old_num_rx_queues ||
+                           adapter->req_tx_queues != old_num_tx_queues) {
+                        release_rx_pools(adapter);
+                        release_tx_pools(adapter);
+                        init_rx_pools(netdev);
+                        init_tx_pools(netdev);
                 } else {
                         rc = reset_tx_pools(adapter);
                         if (rc)
@@ -3345,7 +3381,11 @@ static void handle_query_ip_offload_rsp(struct ibmvnic_adapter *adapter)
                 return;
         }
 
+        adapter->ip_offload_ctrl.len =
+            cpu_to_be32(sizeof(adapter->ip_offload_ctrl));
         adapter->ip_offload_ctrl.version = cpu_to_be32(INITIAL_VERSION_IOB);
+        adapter->ip_offload_ctrl.ipv4_chksum = buf->ipv4_chksum;
+        adapter->ip_offload_ctrl.ipv6_chksum = buf->ipv6_chksum;
         adapter->ip_offload_ctrl.tcp_ipv4_chksum = buf->tcp_ipv4_chksum;
         adapter->ip_offload_ctrl.udp_ipv4_chksum = buf->udp_ipv4_chksum;
         adapter->ip_offload_ctrl.tcp_ipv6_chksum = buf->tcp_ipv6_chksum;
@@ -3585,7 +3625,17 @@ static void handle_request_cap_rsp(union ibmvnic_crq *crq,
                          *req_value,
                          (long int)be64_to_cpu(crq->request_capability_rsp.
                                                number), name);
-                *req_value = be64_to_cpu(crq->request_capability_rsp.number);
+
+                if (be16_to_cpu(crq->request_capability_rsp.capability) ==
+                    REQ_MTU) {
+                        pr_err("mtu of %llu is not supported. Reverting.\n",
+                               *req_value);
+                        *req_value = adapter->fallback.mtu;
+                } else {
+                        *req_value =
+                                be64_to_cpu(crq->request_capability_rsp.number);
+                }
+
                 ibmvnic_send_req_caps(adapter, 1);
                 return;
         default:
diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
index 4487f1e2c266..3aec42118db2 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.h
+++ b/drivers/net/ethernet/ibm/ibmvnic.h
@@ -1091,6 +1091,8 @@ struct ibmvnic_adapter {
         u64 opt_rxba_entries_per_subcrq;
         __be64 tx_rx_desc_req;
         u8 map_id;
+        u64 num_active_rx_pools;
+        u64 num_active_tx_pools;
 
         struct tasklet_struct tasklet;
         enum vnic_state state;
diff --git a/drivers/net/ethernet/intel/e1000/e1000.h b/drivers/net/ethernet/intel/e1000/e1000.h
index d7bdea79e9fa..8fd2458060a0 100644
--- a/drivers/net/ethernet/intel/e1000/e1000.h
+++ b/drivers/net/ethernet/intel/e1000/e1000.h
@@ -331,7 +331,8 @@ struct e1000_adapter {
 enum e1000_state_t {
         __E1000_TESTING,
         __E1000_RESETTING,
-        __E1000_DOWN
+        __E1000_DOWN,
+        __E1000_DISABLED
 };
 
 #undef pr_fmt
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index 1982f7917a8d..3dd4aeb2706d 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -945,7 +945,7 @@ static int e1000_init_hw_struct(struct e1000_adapter *adapter,
 static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
         struct net_device *netdev;
-        struct e1000_adapter *adapter;
+        struct e1000_adapter *adapter = NULL;
         struct e1000_hw *hw;
 
         static int cards_found;
@@ -955,6 +955,7 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         u16 tmp = 0;
         u16 eeprom_apme_mask = E1000_EEPROM_APME;
         int bars, need_ioport;
+        bool disable_dev = false;
 
         /* do not allocate ioport bars when not needed */
         need_ioport = e1000_is_need_ioport(pdev);
@@ -1259,11 +1260,13 @@ err_mdio_ioremap:
         iounmap(hw->ce4100_gbe_mdio_base_virt);
         iounmap(hw->hw_addr);
 err_ioremap:
+        disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags);
         free_netdev(netdev);
 err_alloc_etherdev:
         pci_release_selected_regions(pdev, bars);
 err_pci_reg:
-        pci_disable_device(pdev);
+        if (!adapter || disable_dev)
+                pci_disable_device(pdev);
         return err;
 }
 
@@ -1281,6 +1284,7 @@ static void e1000_remove(struct pci_dev *pdev)
         struct net_device *netdev = pci_get_drvdata(pdev);
         struct e1000_adapter *adapter = netdev_priv(netdev);
         struct e1000_hw *hw = &adapter->hw;
+        bool disable_dev;
 
         e1000_down_and_stop(adapter);
         e1000_release_manageability(adapter);
@@ -1299,9 +1303,11 @@ static void e1000_remove(struct pci_dev *pdev)
                 iounmap(hw->flash_address);
         pci_release_selected_regions(pdev, adapter->bars);
 
+        disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags);
         free_netdev(netdev);
 
-        pci_disable_device(pdev);
+        if (disable_dev)
+                pci_disable_device(pdev);
 }
 
 /**
@@ -5156,7 +5162,8 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake)
         if (netif_running(netdev))
                 e1000_free_irq(adapter);
 
-        pci_disable_device(pdev);
+        if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags))
+                pci_disable_device(pdev);
 
         return 0;
 }
@@ -5200,6 +5207,10 @@ static int e1000_resume(struct pci_dev *pdev)
                 pr_err("Cannot enable PCI device from suspend\n");
                 return err;
         }
+
+        /* flush memory to make sure state is correct */
+        smp_mb__before_atomic();
+        clear_bit(__E1000_DISABLED, &adapter->flags);
         pci_set_master(pdev);
 
         pci_enable_wake(pdev, PCI_D3hot, 0);
@@ -5274,7 +5285,9 @@ static pci_ers_result_t e1000_io_error_detected(struct pci_dev *pdev,
 
         if (netif_running(netdev))
                 e1000_down(adapter);
-        pci_disable_device(pdev);
+
+        if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags))
+                pci_disable_device(pdev);
 
         /* Request a slot slot reset. */
         return PCI_ERS_RESULT_NEED_RESET;
@@ -5302,6 +5315,10 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev)
                 pr_err("Cannot re-enable PCI device after reset.\n");
                 return PCI_ERS_RESULT_DISCONNECT;
         }
+
+        /* flush memory to make sure state is correct */
+        smp_mb__before_atomic();
+        clear_bit(__E1000_DISABLED, &adapter->flags);
         pci_set_master(pdev);
 
         pci_enable_wake(pdev, PCI_D3hot, 0);
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index d6d4ed7acf03..31277d3bb7dc 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -1367,6 +1367,9 @@ out:
  *  Checks to see of the link status of the hardware has changed.  If a
  *  change in link status has been detected, then we read the PHY registers
  *  to get the current speed/duplex if link exists.
+ *
+ *  Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link
+ *  up).
  **/
 static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
 {
@@ -1382,7 +1385,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
          * Change or Rx Sequence Error interrupt.
          */
         if (!mac->get_link_status)
-                return 0;
+                return 1;
 
         /* First we want to see if the MII Status Register reports
          * link.  If so, then we want to get the current speed/duplex
@@ -1613,10 +1616,12 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
          * different link partner.
          */
         ret_val = e1000e_config_fc_after_link_up(hw);
-        if (ret_val)
+        if (ret_val) {
                 e_dbg("Error configuring flow control\n");
+                return ret_val;
+        }
 
-        return ret_val;
+        return 1;
 }
 
 static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
index 7f605221a686..a434fecfdfeb 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
@@ -2463,7 +2463,6 @@ static int fm10k_handle_resume(struct fm10k_intfc *interface)
         return err;
 }
 
-#ifdef CONFIG_PM
 /**
  * fm10k_resume - Generic PM resume hook
  * @dev: generic device structure
@@ -2472,7 +2471,7 @@ static int fm10k_handle_resume(struct fm10k_intfc *interface)
  * suspend or hibernation. This function does not need to handle lower PCIe
  * device state as the stack takes care of that for us.
  **/
-static int fm10k_resume(struct device *dev)
+static int __maybe_unused fm10k_resume(struct device *dev)
 {
         struct fm10k_intfc *interface = pci_get_drvdata(to_pci_dev(dev));
         struct net_device *netdev = interface->netdev;
@@ -2499,7 +2498,7 @@ static int fm10k_resume(struct device *dev)
  * system suspend or hibernation. This function does not need to handle lower
  * PCIe device state as the stack takes care of that for us.
  **/
-static int fm10k_suspend(struct device *dev)
+static int __maybe_unused fm10k_suspend(struct device *dev)
 {
         struct fm10k_intfc *interface = pci_get_drvdata(to_pci_dev(dev));
         struct net_device *netdev = interface->netdev;
@@ -2511,8 +2510,6 @@ static int fm10k_suspend(struct device *dev)
         return 0;
 }
 
-#endif /* CONFIG_PM */
-
 /**
  * fm10k_io_error_detected - called when PCI error is detected
  * @pdev: Pointer to PCI device
@@ -2643,11 +2640,9 @@ static struct pci_driver fm10k_driver = {
         .id_table               = fm10k_pci_tbl,
         .probe                  = fm10k_probe,
         .remove                 = fm10k_remove,
-#ifdef CONFIG_PM
         .driver = {
                 .pm             = &fm10k_pm_ops,
         },
-#endif /* CONFIG_PM */
         .sriov_configure        = fm10k_iov_configure,
         .err_handler            = &fm10k_err_handler
 };
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 321d8be80871..af792112a2d3 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -1573,11 +1573,18 @@ static int i40e_set_mac(struct net_device *netdev, void *p)
         else
                 netdev_info(netdev, "set new mac address %pM\n", addr->sa_data);
 
+        /* Copy the address first, so that we avoid a possible race with
+         * .set_rx_mode(). If we copy after changing the address in the filter
+         * list, we might open ourselves to a narrow race window where
+         * .set_rx_mode could delete our dev_addr filter and prevent traffic
+         * from passing.
+         */
+        ether_addr_copy(netdev->dev_addr, addr->sa_data);
+
         spin_lock_bh(&vsi->mac_filter_hash_lock);
         i40e_del_mac_filter(vsi, netdev->dev_addr);
         i40e_add_mac_filter(vsi, addr->sa_data);
         spin_unlock_bh(&vsi->mac_filter_hash_lock);
-        ether_addr_copy(netdev->dev_addr, addr->sa_data);
         if (vsi->type == I40E_VSI_MAIN) {
                 i40e_status ret;
 
@@ -1923,6 +1930,14 @@ static int i40e_addr_unsync(struct net_device *netdev, const u8 *addr)
         struct i40e_netdev_priv *np = netdev_priv(netdev);
         struct i40e_vsi *vsi = np->vsi;
 
+        /* Under some circumstances, we might receive a request to delete
+         * our own device address from our uc list. Because we store the
+         * device address in the VSI's MAC/VLAN filter list, we need to ignore
+         * such requests and not delete our device address from this list.
+         */
+        if (ether_addr_equal(addr, netdev->dev_addr))
+                return 0;
+
         i40e_del_mac_filter(vsi, addr);
 
         return 0;
@@ -6038,8 +6053,8 @@ static int i40e_validate_and_set_switch_mode(struct i40e_vsi *vsi)
         /* Set Bit 7 to be valid */
         mode = I40E_AQ_SET_SWITCH_BIT7_VALID;
 
-        /* Set L4type to both TCP and UDP support */
-        mode |= I40E_AQ_SET_SWITCH_L4_TYPE_BOTH;
+        /* Set L4type for TCP support */
+        mode |= I40E_AQ_SET_SWITCH_L4_TYPE_TCP;
 
         /* Set cloud filter mode */
         mode |= I40E_AQ_SET_SWITCH_MODE_NON_TUNNEL;
@@ -6969,18 +6984,18 @@ static int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi,
              is_valid_ether_addr(filter->src_mac)) ||
             (is_multicast_ether_addr(filter->dst_mac) &&
              is_multicast_ether_addr(filter->src_mac)))
-                return -EINVAL;
+                return -EOPNOTSUPP;
 
-        /* Make sure port is specified, otherwise bail out, for channel
-         * specific cloud filter needs 'L4 port' to be non-zero
+        /* Big buffer cloud filter needs 'L4 port' to be non-zero. Also, UDP
+         * ports are not supported via big buffer now.
          */
-        if (!filter->dst_port)
-                return -EINVAL;
+        if (!filter->dst_port || filter->ip_proto == IPPROTO_UDP)
+                return -EOPNOTSUPP;
 
         /* adding filter using src_port/src_ip is not supported at this stage */
         if (filter->src_port || filter->src_ipv4 ||
             !ipv6_addr_any(&filter->ip.v6.src_ip6))
-                return -EINVAL;
+                return -EOPNOTSUPP;
 
         /* copy element needed to add cloud filter from filter */
         i40e_set_cld_element(filter, &cld_filter.element);
@@ -6991,7 +7006,7 @@ static int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi,
             is_multicast_ether_addr(filter->src_mac)) {
                 /* MAC + IP : unsupported mode */
                 if (filter->dst_ipv4)
-                        return -EINVAL;
+                        return -EOPNOTSUPP;
 
                 /* since we validated that L4 port must be valid before
                  * we get here, start with respective "flags" value
@@ -7356,7 +7371,7 @@ static int i40e_configure_clsflower(struct i40e_vsi *vsi,
 
         if (tc < 0) {
                 dev_err(&vsi->back->pdev->dev, "Invalid traffic class\n");
-                return -EINVAL;
+                return -EOPNOTSUPP;
         }
 
         if (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state) ||
@@ -7490,6 +7505,8 @@ static int i40e_setup_tc_cls_flower(struct i40e_netdev_priv *np,
 {
         struct i40e_vsi *vsi = np->vsi;
 
+        if (!tc_can_offload(vsi->netdev))
+                return -EOPNOTSUPP;
         if (cls_flower->common.chain_index)
                 return -EOPNOTSUPP;
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 4566d66ffc7c..5bc2748ac468 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -3047,10 +3047,30 @@ bool __i40e_chk_linearize(struct sk_buff *skb)
         /* Walk through fragments adding latest fragment, testing it, and
          * then removing stale fragments from the sum.
          */
-        stale = &skb_shinfo(skb)->frags[0];
-        for (;;) {
+        for (stale = &skb_shinfo(skb)->frags[0];; stale++) {
+                int stale_size = skb_frag_size(stale);
+
                 sum += skb_frag_size(frag++);
 
+                /* The stale fragment may present us with a smaller
+                 * descriptor than the actual fragment size. To account
+                 * for that we need to remove all the data on the front and
+                 * figure out what the remainder would be in the last
+                 * descriptor associated with the fragment.
+                 */
+                if (stale_size > I40E_MAX_DATA_PER_TXD) {
+                        int align_pad = -(stale->page_offset) &
+                                        (I40E_MAX_READ_REQ_SIZE - 1);
+
+                        sum -= align_pad;
+                        stale_size -= align_pad;
+
+                        do {
+                                sum -= I40E_MAX_DATA_PER_TXD_ALIGNED;
+                                stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED;
+                        } while (stale_size > I40E_MAX_DATA_PER_TXD);
+                }
+
                 /* if sum is negative we failed to make sufficient progress */
                 if (sum < 0)
                         return true;
@@ -3058,7 +3078,7 @@ bool __i40e_chk_linearize(struct sk_buff *skb)
                 if (!nr_frags--)
                         break;
 
-                sum -= skb_frag_size(stale++);
+                sum -= stale_size;
         }
 
         return false;
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
index 50864f99446d..1ba29bb85b67 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
@@ -2012,10 +2012,30 @@ bool __i40evf_chk_linearize(struct sk_buff *skb)
         /* Walk through fragments adding latest fragment, testing it, and
          * then removing stale fragments from the sum.
          */
-        stale = &skb_shinfo(skb)->frags[0];
-        for (;;) {
+        for (stale = &skb_shinfo(skb)->frags[0];; stale++) {
+                int stale_size = skb_frag_size(stale);
+
                 sum += skb_frag_size(frag++);
 
+                /* The stale fragment may present us with a smaller
+                 * descriptor than the actual fragment size. To account
+                 * for that we need to remove all the data on the front and
+                 * figure out what the remainder would be in the last
+                 * descriptor associated with the fragment.
+                 */
+                if (stale_size > I40E_MAX_DATA_PER_TXD) {
+                        int align_pad = -(stale->page_offset) &
+                                        (I40E_MAX_READ_REQ_SIZE - 1);
+
+                        sum -= align_pad;
+                        stale_size -= align_pad;
+
+                        do {
+                                sum -= I40E_MAX_DATA_PER_TXD_ALIGNED;
+                                stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED;
+                        } while (stale_size > I40E_MAX_DATA_PER_TXD);
+                }
+
                 /* if sum is negative we failed to make sufficient progress */
                 if (sum < 0)
                         return true;
@@ -2023,7 +2043,7 @@ bool __i40evf_chk_linearize(struct sk_buff *skb)
                 if (!nr_frags--)
                         break;
 
-                sum -= skb_frag_size(stale++);
+                sum -= stale_size;
         }
 
         return false;
diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c
index c9798210fa0f..0495487f7b42 100644
--- a/drivers/net/ethernet/marvell/mvmdio.c
+++ b/drivers/net/ethernet/marvell/mvmdio.c
@@ -344,7 +344,8 @@ static int orion_mdio_probe(struct platform_device *pdev)
                         dev->regs + MVMDIO_ERR_INT_MASK);
 
         } else if (dev->err_interrupt == -EPROBE_DEFER) {
-                return -EPROBE_DEFER;
+                ret = -EPROBE_DEFER;
+                goto out_mdio;
         }
 
         if (pdev->dev.of_node)
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index bc93b69cfd1e..a539263cd79c 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -1214,6 +1214,10 @@ static void mvneta_port_disable(struct mvneta_port *pp)
         val &= ~MVNETA_GMAC0_PORT_ENABLE;
         mvreg_write(pp, MVNETA_GMAC_CTRL_0, val);
 
+        pp->link = 0;
+        pp->duplex = -1;
+        pp->speed = 0;
+
         udelay(200);
 }
 
@@ -1958,9 +1962,9 @@ static int mvneta_rx_swbm(struct mvneta_port *pp, int rx_todo,
 
                 if (!mvneta_rxq_desc_is_first_last(rx_status) ||
                     (rx_status & MVNETA_RXD_ERR_SUMMARY)) {
+                        mvneta_rx_error(pp, rx_desc);
 err_drop_frame:
                         dev->stats.rx_errors++;
-                        mvneta_rx_error(pp, rx_desc);
                         /* leave the descriptor untouched */
                         continue;
                 }
@@ -3011,7 +3015,7 @@ static void mvneta_cleanup_rxqs(struct mvneta_port *pp)
 {
         int queue;
 
-        for (queue = 0; queue < txq_number; queue++)
+        for (queue = 0; queue < rxq_number; queue++)
                 mvneta_rxq_deinit(pp, &pp->rxqs[queue]);
 }
 
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index d83a78be98a2..634b2f41cc9e 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -85,7 +85,7 @@
 
 /* RSS Registers */
 #define MVPP22_RSS_INDEX                        0x1500
-#define     MVPP22_RSS_INDEX_TABLE_ENTRY(idx)   ((idx) << 8)
+#define     MVPP22_RSS_INDEX_TABLE_ENTRY(idx)   (idx)
 #define     MVPP22_RSS_INDEX_TABLE(idx)         ((idx) << 8)
 #define     MVPP22_RSS_INDEX_QUEUE(idx)         ((idx) << 16)
 #define MVPP22_RSS_TABLE_ENTRY                  0x1508
@@ -5598,7 +5598,7 @@ static int mvpp2_aggr_txq_init(struct platform_device *pdev,
         u32 txq_dma;
 
         /* Allocate memory for TX descriptors */
-        aggr_txq->descs = dma_alloc_coherent(&pdev->dev,
+        aggr_txq->descs = dma_zalloc_coherent(&pdev->dev,
                                 MVPP2_AGGR_TXQ_SIZE * MVPP2_DESC_ALIGNED_SIZE,
                                 &aggr_txq->descs_dma, GFP_KERNEL);
         if (!aggr_txq->descs)
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index 6e423f098a60..31efc47c847e 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -4081,7 +4081,6 @@ static void skge_remove(struct pci_dev *pdev)
         if (hw->ports > 1) {
                 skge_write32(hw, B0_IMSK, 0);
                 skge_read32(hw, B0_IMSK);
-                free_irq(pdev->irq, hw);
         }
         spin_unlock_irq(&hw->hw_lock);
 
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index 54adfd967858..fc67e35b253e 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -1961,11 +1961,12 @@ static int mtk_hw_init(struct mtk_eth *eth)
         /* set GE2 TUNE */
         regmap_write(eth->pctl, GPIO_BIAS_CTRL, 0x0);
 
-        /* GE1, Force 1000M/FD, FC ON */
-        mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(0));
-
-        /* GE2, Force 1000M/FD, FC ON */
-        mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(1));
+        /* Set linkdown as the default for each GMAC. Its own MCR would be set
+         * up with the more appropriate value when mtk_phy_link_adjust call is
+         * being invoked.
+         */
+        for (i = 0; i < MTK_MAC_COUNT; i++)
+                mtk_w32(eth, 0, MTK_MAC_MCR(i));
 
         /* Indicates CDM to parse the MTK special tag from CPU
          * which also is working out for untag packets.
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_port.c b/drivers/net/ethernet/mellanox/mlx4/en_port.c
index e0eb695318e6..1fa4849a6f56 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_port.c
@@ -188,7 +188,7 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
         struct net_device *dev = mdev->pndev[port];
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct net_device_stats *stats = &dev->stats;
-        struct mlx4_cmd_mailbox *mailbox;
+        struct mlx4_cmd_mailbox *mailbox, *mailbox_priority;
         u64 in_mod = reset << 8 | port;
         int err;
         int i, counter_index;
@@ -198,6 +198,13 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
         mailbox = mlx4_alloc_cmd_mailbox(mdev->dev);
         if (IS_ERR(mailbox))
                 return PTR_ERR(mailbox);
+
+        mailbox_priority = mlx4_alloc_cmd_mailbox(mdev->dev);
+        if (IS_ERR(mailbox_priority)) {
+                mlx4_free_cmd_mailbox(mdev->dev, mailbox);
+                return PTR_ERR(mailbox_priority);
+        }
+
         err = mlx4_cmd_box(mdev->dev, 0, mailbox->dma, in_mod, 0,
                            MLX4_CMD_DUMP_ETH_STATS, MLX4_CMD_TIME_CLASS_B,
                            MLX4_CMD_NATIVE);
@@ -206,6 +213,28 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
 
         mlx4_en_stats = mailbox->buf;
 
+        memset(&tmp_counter_stats, 0, sizeof(tmp_counter_stats));
+        counter_index = mlx4_get_default_counter_index(mdev->dev, port);
+        err = mlx4_get_counter_stats(mdev->dev, counter_index,
+                                     &tmp_counter_stats, reset);
+
+        /* 0xffs indicates invalid value */
+        memset(mailbox_priority->buf, 0xff,
+               sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
+
+        if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_FLOWSTATS_EN) {
+                memset(mailbox_priority->buf, 0,
+                       sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
+                err = mlx4_cmd_box(mdev->dev, 0, mailbox_priority->dma,
+                                   in_mod | MLX4_DUMP_ETH_STATS_FLOW_CONTROL,
+                                   0, MLX4_CMD_DUMP_ETH_STATS,
+                                   MLX4_CMD_TIME_CLASS_B, MLX4_CMD_NATIVE);
+                if (err)
+                        goto out;
+        }
+
+        flowstats = mailbox_priority->buf;
+
         spin_lock_bh(&priv->stats_lock);
 
         mlx4_en_fold_software_stats(dev);
@@ -345,31 +374,6 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
         priv->pkstats.tx_prio[8][0] = be64_to_cpu(mlx4_en_stats->TTOT_novlan);
         priv->pkstats.tx_prio[8][1] = be64_to_cpu(mlx4_en_stats->TOCT_novlan);
 
-        spin_unlock_bh(&priv->stats_lock);
-
-        memset(&tmp_counter_stats, 0, sizeof(tmp_counter_stats));
-        counter_index = mlx4_get_default_counter_index(mdev->dev, port);
-        err = mlx4_get_counter_stats(mdev->dev, counter_index,
-                                     &tmp_counter_stats, reset);
-
-        /* 0xffs indicates invalid value */
-        memset(mailbox->buf, 0xff, sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
-
-        if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_FLOWSTATS_EN) {
-                memset(mailbox->buf, 0,
-                       sizeof(*flowstats) * MLX4_NUM_PRIORITIES);
-                err = mlx4_cmd_box(mdev->dev, 0, mailbox->dma,
-                                   in_mod | MLX4_DUMP_ETH_STATS_FLOW_CONTROL,
-                                   0, MLX4_CMD_DUMP_ETH_STATS,
-                                   MLX4_CMD_TIME_CLASS_B, MLX4_CMD_NATIVE);
-                if (err)
-                        goto out;
-        }
-
-        flowstats = mailbox->buf;
-
-        spin_lock_bh(&priv->stats_lock);
-
         if (tmp_counter_stats.counter_mode == 0) {
                 priv->pf_stats.rx_bytes   = be64_to_cpu(tmp_counter_stats.rx_bytes);
                 priv->pf_stats.tx_bytes   = be64_to_cpu(tmp_counter_stats.tx_bytes);
@@ -410,6 +414,7 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
 
 out:
         mlx4_free_cmd_mailbox(mdev->dev, mailbox);
+        mlx4_free_cmd_mailbox(mdev->dev, mailbox_priority);
         return err;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
index 88699b181946..946d9db7c8c2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
@@ -185,7 +185,7 @@ void mlx4_en_ex_selftest(struct net_device *dev, u32 *flags, u64 *buf)
                 if (priv->mdev->dev->caps.flags &
                                         MLX4_DEV_CAP_FLAG_UC_LOOPBACK) {
                         buf[3] = mlx4_en_test_registers(priv);
-                        if (priv->port_up)
+                        if (priv->port_up && dev->mtu >= MLX4_SELFTEST_LB_MIN_MTU)
                                 buf[4] = mlx4_en_test_loopback(priv);
                 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 1856e279a7e0..2b72677eccd4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -153,6 +153,9 @@
 #define SMALL_PACKET_SIZE      (256 - NET_IP_ALIGN)
 #define HEADER_COPY_SIZE       (128 - NET_IP_ALIGN)
 #define MLX4_LOOPBACK_TEST_PAYLOAD (HEADER_COPY_SIZE - ETH_HLEN)
+#define PREAMBLE_LEN           8
+#define MLX4_SELFTEST_LB_MIN_MTU (MLX4_LOOPBACK_TEST_PAYLOAD + NET_IP_ALIGN + \
+                                  ETH_HLEN + PREAMBLE_LEN)
 
 #define MLX4_EN_MIN_MTU         46
 /* VLAN_HLEN is added twice,to support skb vlan tagged with multiple
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 04304dd894c6..606a0e0beeae 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -611,7 +611,6 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
                                                 MLX4_MAX_PORTS;
                                 else
                                         res_alloc->guaranteed[t] = 0;
-                                res_alloc->res_free -= res_alloc->guaranteed[t];
                                 break;
                         default:
                                 break;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 1fffdebbc9e8..e9a1fbcc4adf 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -362,7 +362,7 @@ static int mlx5_internal_err_ret_value(struct mlx5_core_dev *dev, u16 op,
         case MLX5_CMD_OP_QUERY_VPORT_COUNTER:
         case MLX5_CMD_OP_ALLOC_Q_COUNTER:
         case MLX5_CMD_OP_QUERY_Q_COUNTER:
-        case MLX5_CMD_OP_SET_RATE_LIMIT:
+        case MLX5_CMD_OP_SET_PP_RATE_LIMIT:
         case MLX5_CMD_OP_QUERY_RATE_LIMIT:
         case MLX5_CMD_OP_CREATE_SCHEDULING_ELEMENT:
         case MLX5_CMD_OP_QUERY_SCHEDULING_ELEMENT:
@@ -505,7 +505,7 @@ const char *mlx5_command_str(int command)
         MLX5_COMMAND_STR_CASE(ALLOC_Q_COUNTER);
         MLX5_COMMAND_STR_CASE(DEALLOC_Q_COUNTER);
         MLX5_COMMAND_STR_CASE(QUERY_Q_COUNTER);
-        MLX5_COMMAND_STR_CASE(SET_RATE_LIMIT);
+        MLX5_COMMAND_STR_CASE(SET_PP_RATE_LIMIT);
         MLX5_COMMAND_STR_CASE(QUERY_RATE_LIMIT);
         MLX5_COMMAND_STR_CASE(CREATE_SCHEDULING_ELEMENT);
         MLX5_COMMAND_STR_CASE(DESTROY_SCHEDULING_ELEMENT);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index c0872b3284cb..c2d89bfa1a70 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -82,6 +82,9 @@
         max_t(u32, MLX5_MPWRQ_MIN_LOG_STRIDE_SZ(mdev), req)
 #define MLX5_MPWRQ_DEF_LOG_STRIDE_SZ(mdev)       MLX5_MPWRQ_LOG_STRIDE_SZ(mdev, 6)
 #define MLX5_MPWRQ_CQE_CMPRS_LOG_STRIDE_SZ(mdev) MLX5_MPWRQ_LOG_STRIDE_SZ(mdev, 8)
+#define MLX5E_MPWQE_STRIDE_SZ(mdev, cqe_cmprs) \
+        (cqe_cmprs ? MLX5_MPWRQ_CQE_CMPRS_LOG_STRIDE_SZ(mdev) : \
+        MLX5_MPWRQ_DEF_LOG_STRIDE_SZ(mdev))
 
 #define MLX5_MPWRQ_LOG_WQE_SZ                   18
 #define MLX5_MPWRQ_WQE_PAGE_ORDER  (MLX5_MPWRQ_LOG_WQE_SZ - PAGE_SHIFT > 0 ? \
@@ -590,6 +593,7 @@ struct mlx5e_channel {
         struct mlx5_core_dev      *mdev;
         struct hwtstamp_config    *tstamp;
         int                        ix;
+        int                        cpu;
 };
 
 struct mlx5e_channels {
@@ -891,7 +895,7 @@ int mlx5e_vlan_rx_kill_vid(struct net_device *dev, __always_unused __be16 proto,
                            u16 vid);
 void mlx5e_enable_cvlan_filter(struct mlx5e_priv *priv);
 void mlx5e_disable_cvlan_filter(struct mlx5e_priv *priv);
-void mlx5e_timestamp_set(struct mlx5e_priv *priv);
+void mlx5e_timestamp_init(struct mlx5e_priv *priv);
 
 struct mlx5e_redirect_rqt_param {
         bool is_rss;
@@ -935,8 +939,9 @@ void mlx5e_set_tx_cq_mode_params(struct mlx5e_params *params,
                                  u8 cq_period_mode);
 void mlx5e_set_rx_cq_mode_params(struct mlx5e_params *params,
                                  u8 cq_period_mode);
-void mlx5e_set_rq_type_params(struct mlx5_core_dev *mdev,
-                              struct mlx5e_params *params, u8 rq_type);
+void mlx5e_init_rq_type_params(struct mlx5_core_dev *mdev,
+                               struct mlx5e_params *params,
+                               u8 rq_type);
 
 static inline bool mlx5e_tunnel_inner_ft_supported(struct mlx5_core_dev *mdev)
 {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index c6d90b6dd80e..3d46ef48d5b8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -274,6 +274,7 @@ int mlx5e_dcbnl_ieee_setets_core(struct mlx5e_priv *priv, struct ieee_ets *ets)
 static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
                                     struct ieee_ets *ets)
 {
+        bool have_ets_tc = false;
         int bw_sum = 0;
         int i;
 
@@ -288,11 +289,14 @@ static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
         }
 
         /* Validate Bandwidth Sum */
-        for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++)
-                if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS)
+        for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
+                if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) {
+                        have_ets_tc = true;
                         bw_sum += ets->tc_tx_bw[i];
+                }
+        }
 
-        if (bw_sum != 0 && bw_sum != 100) {
+        if (have_ets_tc && bw_sum != 100) {
                 netdev_err(netdev,
                            "Failed to validate ETS: BW sum is illegal\n");
                 return -EINVAL;
@@ -918,8 +922,9 @@ static void mlx5e_dcbnl_query_dcbx_mode(struct mlx5e_priv *priv,
 
 static void mlx5e_ets_init(struct mlx5e_priv *priv)
 {
-        int i;
         struct ieee_ets ets;
+        int err;
+        int i;
 
         if (!MLX5_CAP_GEN(priv->mdev, ets))
                 return;
@@ -932,11 +937,16 @@ static void mlx5e_ets_init(struct mlx5e_priv *priv)
                 ets.prio_tc[i] = i;
         }
 
-        /* tclass[prio=0]=1, tclass[prio=1]=0, tclass[prio=i]=i (for i>1) */
-        ets.prio_tc[0] = 1;
-        ets.prio_tc[1] = 0;
+        if (ets.ets_cap > 1) {
+                /* tclass[prio=0]=1, tclass[prio=1]=0, tclass[prio=i]=i (for i>1) */
+                ets.prio_tc[0] = 1;
+                ets.prio_tc[1] = 0;
+        }
 
-        mlx5e_dcbnl_ieee_setets_core(priv, &ets);
+        err = mlx5e_dcbnl_ieee_setets_core(priv, &ets);
+        if (err)
+                netdev_err(priv->netdev,
+                           "%s, Failed to init ETS: %d\n", __func__, err);
 }
 
 enum {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 23425f028405..ea5fff2c3143 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -207,8 +207,7 @@ void mlx5e_ethtool_get_ethtool_stats(struct mlx5e_priv *priv,
                 return;
 
         mutex_lock(&priv->state_lock);
-        if (test_bit(MLX5E_STATE_OPENED, &priv->state))
-                mlx5e_update_stats(priv, true);
+        mlx5e_update_stats(priv, true);
         mutex_unlock(&priv->state_lock);
 
         for (i = 0; i < mlx5e_num_stats_grps; i++)
@@ -1523,8 +1522,10 @@ int mlx5e_modify_rx_cqe_compression_locked(struct mlx5e_priv *priv, bool new_val
         new_channels.params = priv->channels.params;
         MLX5E_SET_PFLAG(&new_channels.params, MLX5E_PFLAG_RX_CQE_COMPRESS, new_val);
 
-        mlx5e_set_rq_type_params(priv->mdev, &new_channels.params,
-                                 new_channels.params.rq_wq_type);
+        new_channels.params.mpwqe_log_stride_sz =
+                MLX5E_MPWQE_STRIDE_SZ(priv->mdev, new_val);
+        new_channels.params.mpwqe_log_num_strides =
+                MLX5_MPWRQ_LOG_WQE_SZ - new_channels.params.mpwqe_log_stride_sz;
 
         if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
                 priv->channels.params = new_channels.params;
@@ -1536,6 +1537,10 @@ int mlx5e_modify_rx_cqe_compression_locked(struct mlx5e_priv *priv, bool new_val
                 return err;
 
         mlx5e_switch_priv_channels(priv, &new_channels, NULL);
+        mlx5e_dbg(DRV, priv, "MLX5E: RxCqeCmprss was turned %s\n",
+                  MLX5E_GET_PFLAG(&priv->channels.params,
+                                  MLX5E_PFLAG_RX_CQE_COMPRESS) ? "ON" : "OFF");
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index d2b057a3e512..d8aefeed124d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -71,11 +71,6 @@ struct mlx5e_channel_param {
         struct mlx5e_cq_param      icosq_cq;
 };
 
-static int mlx5e_get_node(struct mlx5e_priv *priv, int ix)
-{
-        return pci_irq_get_node(priv->mdev->pdev, MLX5_EQ_VEC_COMP_BASE + ix);
-}
-
 static bool mlx5e_check_fragmented_striding_rq_cap(struct mlx5_core_dev *mdev)
 {
         return MLX5_CAP_GEN(mdev, striding_rq) &&
@@ -83,8 +78,8 @@ static bool mlx5e_check_fragmented_striding_rq_cap(struct mlx5_core_dev *mdev)
                 MLX5_CAP_ETH(mdev, reg_umr_sq);
 }
 
-void mlx5e_set_rq_type_params(struct mlx5_core_dev *mdev,
-                              struct mlx5e_params *params, u8 rq_type)
+void mlx5e_init_rq_type_params(struct mlx5_core_dev *mdev,
+                               struct mlx5e_params *params, u8 rq_type)
 {
         params->rq_wq_type = rq_type;
         params->lro_wqe_sz = MLX5E_PARAMS_DEFAULT_LRO_WQE_SZ;
@@ -93,10 +88,8 @@ void mlx5e_set_rq_type_params(struct mlx5_core_dev *mdev,
                 params->log_rq_size = is_kdump_kernel() ?
                         MLX5E_PARAMS_MINIMUM_LOG_RQ_SIZE_MPW :
                         MLX5E_PARAMS_DEFAULT_LOG_RQ_SIZE_MPW;
-                params->mpwqe_log_stride_sz =
-                        MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS) ?
-                        MLX5_MPWRQ_CQE_CMPRS_LOG_STRIDE_SZ(mdev) :
-                        MLX5_MPWRQ_DEF_LOG_STRIDE_SZ(mdev);
+                params->mpwqe_log_stride_sz = MLX5E_MPWQE_STRIDE_SZ(mdev,
+                        MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS));
                 params->mpwqe_log_num_strides = MLX5_MPWRQ_LOG_WQE_SZ -
                         params->mpwqe_log_stride_sz;
                 break;
@@ -120,13 +113,14 @@ void mlx5e_set_rq_type_params(struct mlx5_core_dev *mdev,
                        MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_CQE_COMPRESS));
 }
 
-static void mlx5e_set_rq_params(struct mlx5_core_dev *mdev, struct mlx5e_params *params)
+static void mlx5e_set_rq_params(struct mlx5_core_dev *mdev,
+                                struct mlx5e_params *params)
 {
         u8 rq_type = mlx5e_check_fragmented_striding_rq_cap(mdev) &&
                     !params->xdp_prog && !MLX5_IPSEC_DEV(mdev) ?
                     MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ :
                     MLX5_WQ_TYPE_LINKED_LIST;
-        mlx5e_set_rq_type_params(mdev, params, rq_type);
+        mlx5e_init_rq_type_params(mdev, params, rq_type);
 }
 
 static void mlx5e_update_carrier(struct mlx5e_priv *priv)
@@ -444,17 +438,16 @@ static int mlx5e_rq_alloc_mpwqe_info(struct mlx5e_rq *rq,
         int wq_sz = mlx5_wq_ll_get_size(&rq->wq);
         int mtt_sz = mlx5e_get_wqe_mtt_sz();
         int mtt_alloc = mtt_sz + MLX5_UMR_ALIGN - 1;
-        int node = mlx5e_get_node(c->priv, c->ix);
         int i;
 
         rq->mpwqe.info = kzalloc_node(wq_sz * sizeof(*rq->mpwqe.info),
-                                        GFP_KERNEL, node);
+                                      GFP_KERNEL, cpu_to_node(c->cpu));
         if (!rq->mpwqe.info)
                 goto err_out;
 
         /* We allocate more than mtt_sz as we will align the pointer */
-        rq->mpwqe.mtt_no_align = kzalloc_node(mtt_alloc * wq_sz,
-                                        GFP_KERNEL, node);
+        rq->mpwqe.mtt_no_align = kzalloc_node(mtt_alloc * wq_sz, GFP_KERNEL,
+                                        cpu_to_node(c->cpu));
         if (unlikely(!rq->mpwqe.mtt_no_align))
                 goto err_free_wqe_info;
 
@@ -562,7 +555,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
         int err;
         int i;
 
-        rqp->wq.db_numa_node = mlx5e_get_node(c->priv, c->ix);
+        rqp->wq.db_numa_node = cpu_to_node(c->cpu);
 
         err = mlx5_wq_ll_create(mdev, &rqp->wq, rqc_wq, &rq->wq,
                                 &rq->wq_ctrl);
@@ -629,8 +622,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
         default: /* MLX5_WQ_TYPE_LINKED_LIST */
                 rq->wqe.frag_info =
                         kzalloc_node(wq_sz * sizeof(*rq->wqe.frag_info),
-                                     GFP_KERNEL,
-                                     mlx5e_get_node(c->priv, c->ix));
+                                     GFP_KERNEL, cpu_to_node(c->cpu));
                 if (!rq->wqe.frag_info) {
                         err = -ENOMEM;
                         goto err_rq_wq_destroy;
@@ -1000,13 +992,13 @@ static int mlx5e_alloc_xdpsq(struct mlx5e_channel *c,
         sq->uar_map   = mdev->mlx5e_res.bfreg.map;
         sq->min_inline_mode = params->tx_min_inline_mode;
 
-        param->wq.db_numa_node = mlx5e_get_node(c->priv, c->ix);
+        param->wq.db_numa_node = cpu_to_node(c->cpu);
         err = mlx5_wq_cyc_create(mdev, &param->wq, sqc_wq, &sq->wq, &sq->wq_ctrl);
         if (err)
                 return err;
         sq->wq.db = &sq->wq.db[MLX5_SND_DBR];
 
-        err = mlx5e_alloc_xdpsq_db(sq, mlx5e_get_node(c->priv, c->ix));
+        err = mlx5e_alloc_xdpsq_db(sq, cpu_to_node(c->cpu));
         if (err)
                 goto err_sq_wq_destroy;
 
@@ -1053,13 +1045,13 @@ static int mlx5e_alloc_icosq(struct mlx5e_channel *c,
         sq->channel   = c;
         sq->uar_map   = mdev->mlx5e_res.bfreg.map;
 
-        param->wq.db_numa_node = mlx5e_get_node(c->priv, c->ix);
+        param->wq.db_numa_node = cpu_to_node(c->cpu);
         err = mlx5_wq_cyc_create(mdev, &param->wq, sqc_wq, &sq->wq, &sq->wq_ctrl);
         if (err)
                 return err;
         sq->wq.db = &sq->wq.db[MLX5_SND_DBR];
 
-        err = mlx5e_alloc_icosq_db(sq, mlx5e_get_node(c->priv, c->ix));
+        err = mlx5e_alloc_icosq_db(sq, cpu_to_node(c->cpu));
         if (err)
                 goto err_sq_wq_destroy;
 
@@ -1126,13 +1118,13 @@ static int mlx5e_alloc_txqsq(struct mlx5e_channel *c,
         if (MLX5_IPSEC_DEV(c->priv->mdev))
                 set_bit(MLX5E_SQ_STATE_IPSEC, &sq->state);
 
-        param->wq.db_numa_node = mlx5e_get_node(c->priv, c->ix);
+        param->wq.db_numa_node = cpu_to_node(c->cpu);
         err = mlx5_wq_cyc_create(mdev, &param->wq, sqc_wq, &sq->wq, &sq->wq_ctrl);
         if (err)
                 return err;
         sq->wq.db    = &sq->wq.db[MLX5_SND_DBR];
 
-        err = mlx5e_alloc_txqsq_db(sq, mlx5e_get_node(c->priv, c->ix));
+        err = mlx5e_alloc_txqsq_db(sq, cpu_to_node(c->cpu));
         if (err)
                 goto err_sq_wq_destroy;
 
@@ -1504,8 +1496,8 @@ static int mlx5e_alloc_cq(struct mlx5e_channel *c,
         struct mlx5_core_dev *mdev = c->priv->mdev;
         int err;
 
-        param->wq.buf_numa_node = mlx5e_get_node(c->priv, c->ix);
-        param->wq.db_numa_node  = mlx5e_get_node(c->priv, c->ix);
+        param->wq.buf_numa_node = cpu_to_node(c->cpu);
+        param->wq.db_numa_node  = cpu_to_node(c->cpu);
         param->eq_ix   = c->ix;
 
         err = mlx5e_alloc_cq_common(mdev, param, cq);
@@ -1604,6 +1596,11 @@ static void mlx5e_close_cq(struct mlx5e_cq *cq)
         mlx5e_free_cq(cq);
 }
 
+static int mlx5e_get_cpu(struct mlx5e_priv *priv, int ix)
+{
+        return cpumask_first(priv->mdev->priv.irq_info[ix].mask);
+}
+
 static int mlx5e_open_tx_cqs(struct mlx5e_channel *c,
                              struct mlx5e_params *params,
                              struct mlx5e_channel_param *cparam)
@@ -1752,12 +1749,13 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
 {
         struct mlx5e_cq_moder icocq_moder = {0, 0};
         struct net_device *netdev = priv->netdev;
+        int cpu = mlx5e_get_cpu(priv, ix);
         struct mlx5e_channel *c;
         unsigned int irq;
         int err;
         int eqn;
 
-        c = kzalloc_node(sizeof(*c), GFP_KERNEL, mlx5e_get_node(priv, ix));
+        c = kzalloc_node(sizeof(*c), GFP_KERNEL, cpu_to_node(cpu));
         if (!c)
                 return -ENOMEM;
 
@@ -1765,6 +1763,7 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
         c->mdev     = priv->mdev;
         c->tstamp   = &priv->tstamp;
         c->ix       = ix;
+        c->cpu      = cpu;
         c->pdev     = &priv->mdev->pdev->dev;
         c->netdev   = priv->netdev;
         c->mkey_be  = cpu_to_be32(priv->mdev->mlx5e_res.mkey.key);
@@ -1853,8 +1852,7 @@ static void mlx5e_activate_channel(struct mlx5e_channel *c)
         for (tc = 0; tc < c->num_tc; tc++)
                 mlx5e_activate_txqsq(&c->sq[tc]);
         mlx5e_activate_rq(&c->rq);
-        netif_set_xps_queue(c->netdev,
-                mlx5_get_vector_affinity(c->priv->mdev, c->ix), c->ix);
+        netif_set_xps_queue(c->netdev, get_cpu_mask(c->cpu), c->ix);
 }
 
 static void mlx5e_deactivate_channel(struct mlx5e_channel *c)
@@ -2671,7 +2669,7 @@ void mlx5e_switch_priv_channels(struct mlx5e_priv *priv,
                 netif_carrier_on(netdev);
 }
 
-void mlx5e_timestamp_set(struct mlx5e_priv *priv)
+void mlx5e_timestamp_init(struct mlx5e_priv *priv)
 {
         priv->tstamp.tx_type   = HWTSTAMP_TX_OFF;
         priv->tstamp.rx_filter = HWTSTAMP_FILTER_NONE;
@@ -2692,7 +2690,6 @@ int mlx5e_open_locked(struct net_device *netdev)
         mlx5e_activate_priv_channels(priv);
         if (priv->profile->update_carrier)
                 priv->profile->update_carrier(priv);
-        mlx5e_timestamp_set(priv);
 
         if (priv->profile->update_stats)
                 queue_delayed_work(priv->wq, &priv->update_stats_work, 0);
@@ -3221,12 +3218,12 @@ static int mlx5e_set_mac(struct net_device *netdev, void *addr)
         return 0;
 }
 
-#define MLX5E_SET_FEATURE(netdev, feature, enable)      \
+#define MLX5E_SET_FEATURE(features, feature, enable)    \
         do {                                            \
                 if (enable)                             \
-                        netdev->features |= feature;    \
+                        *features |= feature;           \
                 else                                    \
-                        netdev->features &= ~feature;   \
+                        *features &= ~feature;          \
         } while (0)
 
 typedef int (*mlx5e_feature_handler)(struct net_device *netdev, bool enable);
@@ -3349,6 +3346,7 @@ static int set_feature_arfs(struct net_device *netdev, bool enable)
 #endif
 
 static int mlx5e_handle_feature(struct net_device *netdev,
+                                netdev_features_t *features,
                                 netdev_features_t wanted_features,
                                 netdev_features_t feature,
                                 mlx5e_feature_handler feature_handler)
@@ -3367,34 +3365,40 @@ static int mlx5e_handle_feature(struct net_device *netdev,
                 return err;
         }
 
-        MLX5E_SET_FEATURE(netdev, feature, enable);
+        MLX5E_SET_FEATURE(features, feature, enable);
         return 0;
 }
 
 static int mlx5e_set_features(struct net_device *netdev,
                               netdev_features_t features)
 {
+        netdev_features_t oper_features = netdev->features;
         int err;
 
-        err  = mlx5e_handle_feature(netdev, features, NETIF_F_LRO,
-                                    set_feature_lro);
-        err |= mlx5e_handle_feature(netdev, features,
+        err  = mlx5e_handle_feature(netdev, &oper_features, features,
+                                    NETIF_F_LRO, set_feature_lro);
+        err |= mlx5e_handle_feature(netdev, &oper_features, features,
                                     NETIF_F_HW_VLAN_CTAG_FILTER,
                                     set_feature_cvlan_filter);
-        err |= mlx5e_handle_feature(netdev, features, NETIF_F_HW_TC,
-                                    set_feature_tc_num_filters);
-        err |= mlx5e_handle_feature(netdev, features, NETIF_F_RXALL,
-                                    set_feature_rx_all);
-        err |= mlx5e_handle_feature(netdev, features, NETIF_F_RXFCS,
-                                    set_feature_rx_fcs);
-        err |= mlx5e_handle_feature(netdev, features, NETIF_F_HW_VLAN_CTAG_RX,
-                                    set_feature_rx_vlan);
+        err |= mlx5e_handle_feature(netdev, &oper_features, features,
+                                    NETIF_F_HW_TC, set_feature_tc_num_filters);
+        err |= mlx5e_handle_feature(netdev, &oper_features, features,
+                                    NETIF_F_RXALL, set_feature_rx_all);
+        err |= mlx5e_handle_feature(netdev, &oper_features, features,
+                                    NETIF_F_RXFCS, set_feature_rx_fcs);
+        err |= mlx5e_handle_feature(netdev, &oper_features, features,
+                                    NETIF_F_HW_VLAN_CTAG_RX, set_feature_rx_vlan);
 #ifdef CONFIG_RFS_ACCEL
-        err |= mlx5e_handle_feature(netdev, features, NETIF_F_NTUPLE,
-                                    set_feature_arfs);
+        err |= mlx5e_handle_feature(netdev, &oper_features, features,
+                                    NETIF_F_NTUPLE, set_feature_arfs);
 #endif
 
-        return err ? -EINVAL : 0;
+        if (err) {
+                netdev->features = oper_features;
+                return -EINVAL;
+        }
+
+        return 0;
 }
 
 static netdev_features_t mlx5e_fix_features(struct net_device *netdev,
@@ -3679,6 +3683,7 @@ static netdev_features_t mlx5e_tunnel_features_check(struct mlx5e_priv *priv,
                                                      struct sk_buff *skb,
                                                      netdev_features_t features)
 {
+        unsigned int offset = 0;
         struct udphdr *udph;
         u8 proto;
         u16 port;
@@ -3688,7 +3693,7 @@ static netdev_features_t mlx5e_tunnel_features_check(struct mlx5e_priv *priv,
                 proto = ip_hdr(skb)->protocol;
                 break;
         case htons(ETH_P_IPV6):
-                proto = ipv6_hdr(skb)->nexthdr;
+                proto = ipv6_find_hdr(skb, &offset, -1, NULL, NULL);
                 break;
         default:
                 goto out;
@@ -4140,6 +4145,8 @@ static void mlx5e_build_nic_netdev_priv(struct mlx5_core_dev *mdev,
         INIT_WORK(&priv->set_rx_mode_work, mlx5e_set_rx_mode_work);
         INIT_WORK(&priv->tx_timeout_work, mlx5e_tx_timeout_work);
         INIT_DELAYED_WORK(&priv->update_stats_work, mlx5e_update_stats_work);
+
+        mlx5e_timestamp_init(priv);
 }
 
 static void mlx5e_set_netdev_dev_addr(struct net_device *netdev)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 2c43606c26b5..3409d86eb06b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -877,6 +877,8 @@ static void mlx5e_init_rep(struct mlx5_core_dev *mdev,
 
         mlx5e_build_rep_params(mdev, &priv->channels.params);
         mlx5e_build_rep_netdev(netdev);
+
+        mlx5e_timestamp_init(priv);
 }
 
 static int mlx5e_init_rep_rx(struct mlx5e_priv *priv)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
index e401d9d245f3..b69a705fd787 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
@@ -201,9 +201,15 @@ static int mlx5e_am_stats_compare(struct mlx5e_rx_am_stats *curr,
                 return (curr->bpms > prev->bpms) ? MLX5E_AM_STATS_BETTER :
                                                    MLX5E_AM_STATS_WORSE;
 
+        if (!prev->ppms)
+                return curr->ppms ? MLX5E_AM_STATS_BETTER :
+                                    MLX5E_AM_STATS_SAME;
+
         if (IS_SIGNIFICANT_DIFF(curr->ppms, prev->ppms))
                 return (curr->ppms > prev->ppms) ? MLX5E_AM_STATS_BETTER :
                                                    MLX5E_AM_STATS_WORSE;
+        if (!prev->epms)
+                return MLX5E_AM_STATS_SAME;
 
         if (IS_SIGNIFICANT_DIFF(curr->epms, prev->epms))
                 return (curr->epms < prev->epms) ? MLX5E_AM_STATS_BETTER :
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
index 1f1f8af87d4d..5a4608281f38 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
@@ -238,15 +238,19 @@ static int mlx5e_test_loopback_setup(struct mlx5e_priv *priv,
         int err = 0;
 
         /* Temporarily enable local_lb */
-        if (MLX5_CAP_GEN(priv->mdev, disable_local_lb)) {
-                mlx5_nic_vport_query_local_lb(priv->mdev, &lbtp->local_lb);
-                if (!lbtp->local_lb)
-                        mlx5_nic_vport_update_local_lb(priv->mdev, true);
+        err = mlx5_nic_vport_query_local_lb(priv->mdev, &lbtp->local_lb);
+        if (err)
+                return err;
+
+        if (!lbtp->local_lb) {
+                err = mlx5_nic_vport_update_local_lb(priv->mdev, true);
+                if (err)
+                        return err;
         }
 
         err = mlx5e_refresh_tirs(priv, true);
         if (err)
-                return err;
+                goto out;
 
         lbtp->loopback_ok = false;
         init_completion(&lbtp->comp);
@@ -256,16 +260,21 @@ static int mlx5e_test_loopback_setup(struct mlx5e_priv *priv,
         lbtp->pt.dev = priv->netdev;
         lbtp->pt.af_packet_priv = lbtp;
         dev_add_pack(&lbtp->pt);
+
+        return 0;
+
+out:
+        if (!lbtp->local_lb)
+                mlx5_nic_vport_update_local_lb(priv->mdev, false);
+
         return err;
 }
 
 static void mlx5e_test_loopback_cleanup(struct mlx5e_priv *priv,
                                         struct mlx5e_lbt_priv *lbtp)
 {
-        if (MLX5_CAP_GEN(priv->mdev, disable_local_lb)) {
-                if (!lbtp->local_lb)
-                        mlx5_nic_vport_update_local_lb(priv->mdev, false);
-        }
+        if (!lbtp->local_lb)
+                mlx5_nic_vport_update_local_lb(priv->mdev, false);
 
         dev_remove_pack(&lbtp->pt);
         mlx5e_refresh_tirs(priv, false);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index 7d3d503fa675..14d57828945d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -470,7 +470,7 @@ static irqreturn_t mlx5_eq_int(int irq, void *eq_ptr)
                         break;
                 case MLX5_EVENT_TYPE_CQ_ERROR:
                         cqn = be32_to_cpu(eqe->data.cq_err.cqn) & 0xffffff;
-                        mlx5_core_warn(dev, "CQ error on CQN 0x%x, syndrom 0x%x\n",
+                        mlx5_core_warn(dev, "CQ error on CQN 0x%x, syndrome 0x%x\n",
                                        cqn, eqe->data.cq_err.syndrome);
                         mlx5_cq_event(dev, cqn, eqe->type);
                         break;
@@ -782,7 +782,7 @@ err1:
         return err;
 }
 
-int mlx5_stop_eqs(struct mlx5_core_dev *dev)
+void mlx5_stop_eqs(struct mlx5_core_dev *dev)
 {
         struct mlx5_eq_table *table = &dev->priv.eq_table;
         int err;
@@ -791,22 +791,26 @@ int mlx5_stop_eqs(struct mlx5_core_dev *dev)
         if (MLX5_CAP_GEN(dev, pg)) {
                 err = mlx5_destroy_unmap_eq(dev, &table->pfault_eq);
                 if (err)
-                        return err;
+                        mlx5_core_err(dev, "failed to destroy page fault eq, err(%d)\n",
+                                      err);
         }
 #endif
 
         err = mlx5_destroy_unmap_eq(dev, &table->pages_eq);
         if (err)
-                return err;
+                mlx5_core_err(dev, "failed to destroy pages eq, err(%d)\n",
+                              err);
 
-        mlx5_destroy_unmap_eq(dev, &table->async_eq);
+        err = mlx5_destroy_unmap_eq(dev, &table->async_eq);
+        if (err)
+                mlx5_core_err(dev, "failed to destroy async eq, err(%d)\n",
+                              err);
         mlx5_cmd_use_polling(dev);
 
         err = mlx5_destroy_unmap_eq(dev, &table->cmd_eq);
         if (err)
-                mlx5_cmd_use_events(dev);
-
-        return err;
+                mlx5_core_err(dev, "failed to destroy command eq, err(%d)\n",
+                              err);
 }
 
 int mlx5_core_eq_query(struct mlx5_core_dev *dev, struct mlx5_eq *eq,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/sdk.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/sdk.c
index 3c11d6e2160a..14962969c5ba 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/sdk.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/sdk.c
@@ -66,6 +66,9 @@ static int mlx5_fpga_mem_read_i2c(struct mlx5_fpga_device *fdev, size_t size,
         u8 actual_size;
         int err;
 
+        if (!size)
+                return -EINVAL;
+
         if (!fdev->mdev)
                 return -ENOTCONN;
 
@@ -95,6 +98,9 @@ static int mlx5_fpga_mem_write_i2c(struct mlx5_fpga_device *fdev, size_t size,
         u8 actual_size;
         int err;
 
+        if (!size)
+                return -EINVAL;
+
         if (!fdev->mdev)
                 return -ENOTCONN;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index c70fd663a633..dfaad9ecb2b8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -174,6 +174,8 @@ static void del_hw_fte(struct fs_node *node);
 static void del_sw_flow_table(struct fs_node *node);
 static void del_sw_flow_group(struct fs_node *node);
 static void del_sw_fte(struct fs_node *node);
+static void del_sw_prio(struct fs_node *node);
+static void del_sw_ns(struct fs_node *node);
 /* Delete rule (destination) is special case that 
  * requires to lock the FTE for all the deletion process.
  */
@@ -408,6 +410,16 @@ static inline struct mlx5_core_dev *get_dev(struct fs_node *node)
         return NULL;
 }
 
+static void del_sw_ns(struct fs_node *node)
+{
+        kfree(node);
+}
+
+static void del_sw_prio(struct fs_node *node)
+{
+        kfree(node);
+}
+
 static void del_hw_flow_table(struct fs_node *node)
 {
         struct mlx5_flow_table *ft;
@@ -2064,7 +2076,7 @@ static struct fs_prio *fs_create_prio(struct mlx5_flow_namespace *ns,
                 return ERR_PTR(-ENOMEM);
 
         fs_prio->node.type = FS_TYPE_PRIO;
-        tree_init_node(&fs_prio->node, NULL, NULL);
+        tree_init_node(&fs_prio->node, NULL, del_sw_prio);
         tree_add_node(&fs_prio->node, &ns->node);
         fs_prio->num_levels = num_levels;
         fs_prio->prio = prio;
@@ -2090,7 +2102,7 @@ static struct mlx5_flow_namespace *fs_create_namespace(struct fs_prio *prio)
                 return ERR_PTR(-ENOMEM);
 
         fs_init_namespace(ns);
-        tree_init_node(&ns->node, NULL, NULL);
+        tree_init_node(&ns->node, NULL, del_sw_ns);
         tree_add_node(&ns->node, &prio->node);
         list_add_tail(&ns->node.list, &prio->node.children);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index 1a0e797ad001..21d29f7936f6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -241,7 +241,7 @@ static void print_health_info(struct mlx5_core_dev *dev)
         u32 fw;
         int i;
 
-        /* If the syndrom is 0, the device is OK and no need to print buffer */
+        /* If the syndrome is 0, the device is OK and no need to print buffer */
         if (!ioread8(&h->synd))
                 return;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index 261b95d014a0..a281d95ce17c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -57,7 +57,7 @@ static void mlx5i_build_nic_params(struct mlx5_core_dev *mdev,
                                    struct mlx5e_params *params)
 {
         /* Override RQ params as IPoIB supports only LINKED LIST RQ for now */
-        mlx5e_set_rq_type_params(mdev, params, MLX5_WQ_TYPE_LINKED_LIST);
+        mlx5e_init_rq_type_params(mdev, params, MLX5_WQ_TYPE_LINKED_LIST);
 
         /* RQ size in ipoib by default is 512 */
         params->log_rq_size = is_kdump_kernel() ?
@@ -86,6 +86,8 @@ void mlx5i_init(struct mlx5_core_dev *mdev,
         mlx5e_build_nic_params(mdev, &priv->channels.params, profile->max_nch(mdev));
         mlx5i_build_nic_params(mdev, &priv->channels.params);
 
+        mlx5e_timestamp_init(priv);
+
         /* netdev init */
         netdev->hw_features    |= NETIF_F_SG;
         netdev->hw_features    |= NETIF_F_IP_CSUM;
@@ -450,7 +452,6 @@ static int mlx5i_open(struct net_device *netdev)
 
         mlx5e_refresh_tirs(epriv, false);
         mlx5e_activate_priv_channels(epriv);
-        mlx5e_timestamp_set(epriv);
 
         mutex_unlock(&epriv->state_lock);
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
index 4b6cb9b38686..e159243e0fcf 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
@@ -451,9 +451,13 @@ void mlx5_pps_event(struct mlx5_core_dev *mdev,
 
         switch (clock->ptp_info.pin_config[pin].func) {
         case PTP_PF_EXTTS:
+                ptp_event.index = pin;
+                ptp_event.timestamp = timecounter_cyc2time(&clock->tc,
+                                        be64_to_cpu(eqe->data.pps.time_stamp));
                 if (clock->pps_info.enabled) {
                         ptp_event.type = PTP_CLOCK_PPSUSR;
-                        ptp_event.pps_times.ts_real = ns_to_timespec64(eqe->data.pps.time_stamp);
+                        ptp_event.pps_times.ts_real =
+                                        ns_to_timespec64(ptp_event.timestamp);
                 } else {
                         ptp_event.type = PTP_CLOCK_EXTTS;
                 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index d4a471a76d82..2ef641c91c26 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -319,11 +319,9 @@ static int mlx5_alloc_irq_vectors(struct mlx5_core_dev *dev)
 {
         struct mlx5_priv *priv = &dev->priv;
         struct mlx5_eq_table *table = &priv->eq_table;
-        struct irq_affinity irqdesc = {
-                .pre_vectors = MLX5_EQ_VEC_COMP_BASE,
-        };
         int num_eqs = 1 << MLX5_CAP_GEN(dev, log_max_eq);
         int nvec;
+        int err;
 
         nvec = MLX5_CAP_GEN(dev, num_ports) * num_online_cpus() +
                MLX5_EQ_VEC_COMP_BASE;
@@ -333,22 +331,23 @@ static int mlx5_alloc_irq_vectors(struct mlx5_core_dev *dev)
 
         priv->irq_info = kcalloc(nvec, sizeof(*priv->irq_info), GFP_KERNEL);
         if (!priv->irq_info)
-                goto err_free_msix;
+                return -ENOMEM;
 
-        nvec = pci_alloc_irq_vectors_affinity(dev->pdev,
+        nvec = pci_alloc_irq_vectors(dev->pdev,
                         MLX5_EQ_VEC_COMP_BASE + 1, nvec,
-                        PCI_IRQ_MSIX | PCI_IRQ_AFFINITY,
-                        &irqdesc);
-        if (nvec < 0)
-                return nvec;
+                        PCI_IRQ_MSIX);
+        if (nvec < 0) {
+                err = nvec;
+                goto err_free_irq_info;
+        }
 
         table->num_comp_vectors = nvec - MLX5_EQ_VEC_COMP_BASE;
 
         return 0;
 
-err_free_msix:
+err_free_irq_info:
         kfree(priv->irq_info);
-        return -ENOMEM;
+        return err;
 }
 
 static void mlx5_free_irq_vectors(struct mlx5_core_dev *dev)
@@ -593,8 +592,7 @@ static int mlx5_core_set_hca_defaults(struct mlx5_core_dev *dev)
         int ret = 0;
 
         /* Disable local_lb by default */
-        if ((MLX5_CAP_GEN(dev, port_type) == MLX5_CAP_PORT_TYPE_ETH) &&
-            MLX5_CAP_GEN(dev, disable_local_lb))
+        if (MLX5_CAP_GEN(dev, port_type) == MLX5_CAP_PORT_TYPE_ETH)
                 ret = mlx5_nic_vport_update_local_lb(dev, false);
 
         return ret;
@@ -633,6 +631,63 @@ u64 mlx5_read_internal_timer(struct mlx5_core_dev *dev)
         return (u64)timer_l | (u64)timer_h1 << 32;
 }
 
+static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
+{
+        struct mlx5_priv *priv  = &mdev->priv;
+        int irq = pci_irq_vector(mdev->pdev, MLX5_EQ_VEC_COMP_BASE + i);
+
+        if (!zalloc_cpumask_var(&priv->irq_info[i].mask, GFP_KERNEL)) {
+                mlx5_core_warn(mdev, "zalloc_cpumask_var failed");
+                return -ENOMEM;
+        }
+
+        cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
+                        priv->irq_info[i].mask);
+
+        if (IS_ENABLED(CONFIG_SMP) &&
+            irq_set_affinity_hint(irq, priv->irq_info[i].mask))
+                mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq);
+
+        return 0;
+}
+
+static void mlx5_irq_clear_affinity_hint(struct mlx5_core_dev *mdev, int i)
+{
+        struct mlx5_priv *priv  = &mdev->priv;
+        int irq = pci_irq_vector(mdev->pdev, MLX5_EQ_VEC_COMP_BASE + i);
+
+        irq_set_affinity_hint(irq, NULL);
+        free_cpumask_var(priv->irq_info[i].mask);
+}
+
+static int mlx5_irq_set_affinity_hints(struct mlx5_core_dev *mdev)
+{
+        int err;
+        int i;
+
+        for (i = 0; i < mdev->priv.eq_table.num_comp_vectors; i++) {
+                err = mlx5_irq_set_affinity_hint(mdev, i);
+                if (err)
+                        goto err_out;
+        }
+
+        return 0;
+
+err_out:
+        for (i--; i >= 0; i--)
+                mlx5_irq_clear_affinity_hint(mdev, i);
+
+        return err;
+}
+
+static void mlx5_irq_clear_affinity_hints(struct mlx5_core_dev *mdev)
+{
+        int i;
+
+        for (i = 0; i < mdev->priv.eq_table.num_comp_vectors; i++)
+                mlx5_irq_clear_affinity_hint(mdev, i);
+}
+
 int mlx5_vector2eqn(struct mlx5_core_dev *dev, int vector, int *eqn,
                     unsigned int *irqn)
 {
@@ -1079,9 +1134,12 @@ static int mlx5_load_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
                 goto err_stop_poll;
         }
 
-        if (boot && mlx5_init_once(dev, priv)) {
-                dev_err(&pdev->dev, "sw objs init failed\n");
-                goto err_stop_poll;
+        if (boot) {
+                err = mlx5_init_once(dev, priv);
+                if (err) {
+                        dev_err(&pdev->dev, "sw objs init failed\n");
+                        goto err_stop_poll;
+                }
         }
 
         err = mlx5_alloc_irq_vectors(dev);
@@ -1091,8 +1149,9 @@ static int mlx5_load_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
         }
 
         dev->priv.uar = mlx5_get_uars_page(dev);
-        if (!dev->priv.uar) {
+        if (IS_ERR(dev->priv.uar)) {
                 dev_err(&pdev->dev, "Failed allocating uar, aborting\n");
+                err = PTR_ERR(dev->priv.uar);
                 goto err_disable_msix;
         }
 
@@ -1108,6 +1167,12 @@ static int mlx5_load_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
                 goto err_stop_eqs;
         }
 
+        err = mlx5_irq_set_affinity_hints(dev);
+        if (err) {
+                dev_err(&pdev->dev, "Failed to alloc affinity hint cpumask\n");
+                goto err_affinity_hints;
+        }
+
         err = mlx5_init_fs(dev);
         if (err) {
                 dev_err(&pdev->dev, "Failed to init flow steering\n");
@@ -1165,6 +1230,9 @@ err_sriov:
         mlx5_cleanup_fs(dev);
 
 err_fs:
+        mlx5_irq_clear_affinity_hints(dev);
+
+err_affinity_hints:
         free_comp_eqs(dev);
 
 err_stop_eqs:
@@ -1233,6 +1301,7 @@ static int mlx5_unload_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
 
         mlx5_sriov_detach(dev);
         mlx5_cleanup_fs(dev);
+        mlx5_irq_clear_affinity_hints(dev);
         free_comp_eqs(dev);
         mlx5_stop_eqs(dev);
         mlx5_put_uars_page(dev, priv->uar);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
index 0f5ddd22927d..02d6c5b5d502 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
@@ -259,8 +259,8 @@ int mlx5_core_create_qp(struct mlx5_core_dev *dev,
 err_cmd:
         memset(din, 0, sizeof(din));
         memset(dout, 0, sizeof(dout));
-        MLX5_SET(destroy_qp_in, in, opcode, MLX5_CMD_OP_DESTROY_QP);
-        MLX5_SET(destroy_qp_in, in, qpn, qp->qpn);
+        MLX5_SET(destroy_qp_in, din, opcode, MLX5_CMD_OP_DESTROY_QP);
+        MLX5_SET(destroy_qp_in, din, qpn, qp->qpn);
         mlx5_cmd_exec(dev, din, sizeof(din), dout, sizeof(dout));
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/rl.c b/drivers/net/ethernet/mellanox/mlx5/core/rl.c
index e651e4c02867..d3c33e9eea72 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/rl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/rl.c
@@ -125,16 +125,16 @@ static struct mlx5_rl_entry *find_rl_entry(struct mlx5_rl_table *table,
         return ret_entry;
 }
 
-static int mlx5_set_rate_limit_cmd(struct mlx5_core_dev *dev,
+static int mlx5_set_pp_rate_limit_cmd(struct mlx5_core_dev *dev,
                                    u32 rate, u16 index)
 {
-        u32 in[MLX5_ST_SZ_DW(set_rate_limit_in)]   = {0};
-        u32 out[MLX5_ST_SZ_DW(set_rate_limit_out)] = {0};
+        u32 in[MLX5_ST_SZ_DW(set_pp_rate_limit_in)]   = {0};
+        u32 out[MLX5_ST_SZ_DW(set_pp_rate_limit_out)] = {0};
 
-        MLX5_SET(set_rate_limit_in, in, opcode,
-                 MLX5_CMD_OP_SET_RATE_LIMIT);
-        MLX5_SET(set_rate_limit_in, in, rate_limit_index, index);
-        MLX5_SET(set_rate_limit_in, in, rate_limit, rate);
+        MLX5_SET(set_pp_rate_limit_in, in, opcode,
+                 MLX5_CMD_OP_SET_PP_RATE_LIMIT);
+        MLX5_SET(set_pp_rate_limit_in, in, rate_limit_index, index);
+        MLX5_SET(set_pp_rate_limit_in, in, rate_limit, rate);
         return mlx5_cmd_exec(dev, in, sizeof(in), out, sizeof(out));
 }
 
@@ -173,7 +173,7 @@ int mlx5_rl_add_rate(struct mlx5_core_dev *dev, u32 rate, u16 *index)
                 entry->refcount++;
         } else {
                 /* new rate limit */
-                err = mlx5_set_rate_limit_cmd(dev, rate, entry->index);
+                err = mlx5_set_pp_rate_limit_cmd(dev, rate, entry->index);
                 if (err) {
                         mlx5_core_err(dev, "Failed configuring rate: %u (%d)\n",
                                       rate, err);
@@ -209,7 +209,7 @@ void mlx5_rl_remove_rate(struct mlx5_core_dev *dev, u32 rate)
         entry->refcount--;
         if (!entry->refcount) {
                 /* need to remove rate */
-                mlx5_set_rate_limit_cmd(dev, 0, entry->index);
+                mlx5_set_pp_rate_limit_cmd(dev, 0, entry->index);
                 entry->rate = 0;
         }
 
@@ -262,8 +262,8 @@ void mlx5_cleanup_rl_table(struct mlx5_core_dev *dev)
         /* Clear all configured rates */
         for (i = 0; i < table->max_size; i++)
                 if (table->rl_entry[i].rate)
-                        mlx5_set_rate_limit_cmd(dev, 0,
-                                                table->rl_entry[i].index);
+                        mlx5_set_pp_rate_limit_cmd(dev, 0,
+                                                   table->rl_entry[i].index);
 
         kfree(dev->priv.rl_table.rl_entry);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/uar.c b/drivers/net/ethernet/mellanox/mlx5/core/uar.c
index 222b25908d01..8b97066dd1f1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/uar.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/uar.c
@@ -168,18 +168,16 @@ struct mlx5_uars_page *mlx5_get_uars_page(struct mlx5_core_dev *mdev)
         struct mlx5_uars_page *ret;
 
         mutex_lock(&mdev->priv.bfregs.reg_head.lock);
-        if (list_empty(&mdev->priv.bfregs.reg_head.list)) {
-                ret = alloc_uars_page(mdev, false);
-                if (IS_ERR(ret)) {
-                        ret = NULL;
-                        goto out;
-                }
-                list_add(&ret->list, &mdev->priv.bfregs.reg_head.list);
-        } else {
+        if (!list_empty(&mdev->priv.bfregs.reg_head.list)) {
                 ret = list_first_entry(&mdev->priv.bfregs.reg_head.list,
                                        struct mlx5_uars_page, list);
                 kref_get(&ret->ref_count);
+                goto out;
         }
+        ret = alloc_uars_page(mdev, false);
+        if (IS_ERR(ret))
+                goto out;
+        list_add(&ret->list, &mdev->priv.bfregs.reg_head.list);
 out:
         mutex_unlock(&mdev->priv.bfregs.reg_head.lock);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
index 9cb939b6a859..dfe36cf6fbea 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
@@ -911,23 +911,33 @@ int mlx5_nic_vport_update_local_lb(struct mlx5_core_dev *mdev, bool enable)
         void *in;
         int err;
 
-        mlx5_core_dbg(mdev, "%s local_lb\n", enable ? "enable" : "disable");
+        if (!MLX5_CAP_GEN(mdev, disable_local_lb_mc) &&
+            !MLX5_CAP_GEN(mdev, disable_local_lb_uc))
+                return 0;
+
         in = kvzalloc(inlen, GFP_KERNEL);
         if (!in)
                 return -ENOMEM;
 
         MLX5_SET(modify_nic_vport_context_in, in,
-                 field_select.disable_mc_local_lb, 1);
-        MLX5_SET(modify_nic_vport_context_in, in,
                  nic_vport_context.disable_mc_local_lb, !enable);
-
-        MLX5_SET(modify_nic_vport_context_in, in,
-                 field_select.disable_uc_local_lb, 1);
         MLX5_SET(modify_nic_vport_context_in, in,
                  nic_vport_context.disable_uc_local_lb, !enable);
 
+        if (MLX5_CAP_GEN(mdev, disable_local_lb_mc))
+                MLX5_SET(modify_nic_vport_context_in, in,
+                         field_select.disable_mc_local_lb, 1);
+
+        if (MLX5_CAP_GEN(mdev, disable_local_lb_uc))
+                MLX5_SET(modify_nic_vport_context_in, in,
+                         field_select.disable_uc_local_lb, 1);
+
         err = mlx5_modify_nic_vport_context(mdev, in, inlen);
 
+        if (!err)
+                mlx5_core_dbg(mdev, "%s local_lb\n",
+                              enable ? "enable" : "disable");
+
         kvfree(in);
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c
index 07a9ba6cfc70..2f74953e4561 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c
@@ -71,9 +71,9 @@ struct mlx5e_vxlan *mlx5e_vxlan_lookup_port(struct mlx5e_priv *priv, u16 port)
         struct mlx5e_vxlan_db *vxlan_db = &priv->vxlan;
         struct mlx5e_vxlan *vxlan;
 
-        spin_lock(&vxlan_db->lock);
+        spin_lock_bh(&vxlan_db->lock);
         vxlan = radix_tree_lookup(&vxlan_db->tree, port);
-        spin_unlock(&vxlan_db->lock);
+        spin_unlock_bh(&vxlan_db->lock);
 
         return vxlan;
 }
@@ -88,8 +88,12 @@ static void mlx5e_vxlan_add_port(struct work_struct *work)
         struct mlx5e_vxlan *vxlan;
         int err;
 
-        if (mlx5e_vxlan_lookup_port(priv, port))
+        mutex_lock(&priv->state_lock);
+        vxlan = mlx5e_vxlan_lookup_port(priv, port);
+        if (vxlan) {
+                atomic_inc(&vxlan->refcount);
                 goto free_work;
+        }
 
         if (mlx5e_vxlan_core_add_port_cmd(priv->mdev, port))
                 goto free_work;
@@ -99,10 +103,11 @@ static void mlx5e_vxlan_add_port(struct work_struct *work)
                 goto err_delete_port;
 
         vxlan->udp_port = port;
+        atomic_set(&vxlan->refcount, 1);
 
-        spin_lock_irq(&vxlan_db->lock);
+        spin_lock_bh(&vxlan_db->lock);
         err = radix_tree_insert(&vxlan_db->tree, vxlan->udp_port, vxlan);
-        spin_unlock_irq(&vxlan_db->lock);
+        spin_unlock_bh(&vxlan_db->lock);
         if (err)
                 goto err_free;
 
@@ -113,35 +118,39 @@ err_free:
 err_delete_port:
         mlx5e_vxlan_core_del_port_cmd(priv->mdev, port);
 free_work:
+        mutex_unlock(&priv->state_lock);
         kfree(vxlan_work);
 }
 
-static void __mlx5e_vxlan_core_del_port(struct mlx5e_priv *priv, u16 port)
+static void mlx5e_vxlan_del_port(struct work_struct *work)
 {
+        struct mlx5e_vxlan_work *vxlan_work =
+                container_of(work, struct mlx5e_vxlan_work, work);
+        struct mlx5e_priv *priv         = vxlan_work->priv;
         struct mlx5e_vxlan_db *vxlan_db = &priv->vxlan;
+        u16 port = vxlan_work->port;
         struct mlx5e_vxlan *vxlan;
+        bool remove = false;
 
-        spin_lock_irq(&vxlan_db->lock);
-        vxlan = radix_tree_delete(&vxlan_db->tree, port);
-        spin_unlock_irq(&vxlan_db->lock);
-
+        mutex_lock(&priv->state_lock);
+        spin_lock_bh(&vxlan_db->lock);
+        vxlan = radix_tree_lookup(&vxlan_db->tree, port);
         if (!vxlan)
-                return;
-
-        mlx5e_vxlan_core_del_port_cmd(priv->mdev, vxlan->udp_port);
-
-        kfree(vxlan);
-}
+                goto out_unlock;
 
-static void mlx5e_vxlan_del_port(struct work_struct *work)
-{
-        struct mlx5e_vxlan_work *vxlan_work =
-                container_of(work, struct mlx5e_vxlan_work, work);
-        struct mlx5e_priv *priv = vxlan_work->priv;
-        u16 port = vxlan_work->port;
+        if (atomic_dec_and_test(&vxlan->refcount)) {
+                radix_tree_delete(&vxlan_db->tree, port);
+                remove = true;
+        }
 
-        __mlx5e_vxlan_core_del_port(priv, port);
+out_unlock:
+        spin_unlock_bh(&vxlan_db->lock);
 
+        if (remove) {
+                mlx5e_vxlan_core_del_port_cmd(priv->mdev, port);
+                kfree(vxlan);
+        }
+        mutex_unlock(&priv->state_lock);
         kfree(vxlan_work);
 }
 
@@ -171,12 +180,11 @@ void mlx5e_vxlan_cleanup(struct mlx5e_priv *priv)
         struct mlx5e_vxlan *vxlan;
         unsigned int port = 0;
 
-        spin_lock_irq(&vxlan_db->lock);
+        /* Lockless since we are the only radix-tree consumers, wq is disabled */
         while (radix_tree_gang_lookup(&vxlan_db->tree, (void **)&vxlan, port, 1)) {
                 port = vxlan->udp_port;
-                spin_unlock_irq(&vxlan_db->lock);
-                __mlx5e_vxlan_core_del_port(priv, (u16)port);
-                spin_lock_irq(&vxlan_db->lock);
+                radix_tree_delete(&vxlan_db->tree, port);
+                mlx5e_vxlan_core_del_port_cmd(priv->mdev, port);
+                kfree(vxlan);
         }
-        spin_unlock_irq(&vxlan_db->lock);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.h b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.h
index 5def12c048e3..5ef6ae7d568a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.h
@@ -36,6 +36,7 @@
 #include "en.h"
 
 struct mlx5e_vxlan {
+        atomic_t refcount;
         u16 udp_port;
 };
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c
index 23f7d828cf67..6ef20e5cc77d 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
@@ -1643,7 +1643,12 @@ static int mlxsw_pci_sw_reset(struct mlxsw_pci *mlxsw_pci,
                 return 0;
         }
 
-        wmb(); /* reset needs to be written before we read control register */
+        /* Reset needs to be written before we read control register, and
+         * we must wait for the HW to become responsive once again
+         */
+        wmb();
+        msleep(MLXSW_PCI_SW_RESET_WAIT_MSECS);
+
         end = jiffies + msecs_to_jiffies(MLXSW_PCI_SW_RESET_TIMEOUT_MSECS);
         do {
                 u32 val = mlxsw_pci_read32(mlxsw_pci, FW_READY);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
index a6441208e9d9..fb082ad21b00 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
@@ -59,6 +59,7 @@
 #define MLXSW_PCI_SW_RESET                      0xF0010
 #define MLXSW_PCI_SW_RESET_RST_BIT              BIT(0)
 #define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS        5000
+#define MLXSW_PCI_SW_RESET_WAIT_MSECS           100
 #define MLXSW_PCI_FW_READY                      0xA1844
 #define MLXSW_PCI_FW_READY_MASK                 0xFFFF
 #define MLXSW_PCI_FW_READY_MAGIC                0x5E
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 2d0897b7d860..c3837ca7a705 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -4300,6 +4300,7 @@ static int mlxsw_sp_port_stp_set(struct mlxsw_sp_port *mlxsw_sp_port,
 
 static int mlxsw_sp_port_ovs_join(struct mlxsw_sp_port *mlxsw_sp_port)
 {
+        u16 vid = 1;
         int err;
 
         err = mlxsw_sp_port_vp_mode_set(mlxsw_sp_port, true);
@@ -4312,8 +4313,19 @@ static int mlxsw_sp_port_ovs_join(struct mlxsw_sp_port *mlxsw_sp_port)
                                      true, false);
         if (err)
                 goto err_port_vlan_set;
+
+        for (; vid <= VLAN_N_VID - 1; vid++) {
+                err = mlxsw_sp_port_vid_learning_set(mlxsw_sp_port,
+                                                     vid, false);
+                if (err)
+                        goto err_vid_learning_set;
+        }
+
         return 0;
 
+err_vid_learning_set:
+        for (vid--; vid >= 1; vid--)
+                mlxsw_sp_port_vid_learning_set(mlxsw_sp_port, vid, true);
 err_port_vlan_set:
         mlxsw_sp_port_stp_set(mlxsw_sp_port, false);
 err_port_stp_set:
@@ -4323,6 +4335,12 @@ err_port_stp_set:
 
 static void mlxsw_sp_port_ovs_leave(struct mlxsw_sp_port *mlxsw_sp_port)
 {
+        u16 vid;
+
+        for (vid = VLAN_N_VID - 1; vid >= 1; vid--)
+                mlxsw_sp_port_vid_learning_set(mlxsw_sp_port,
+                                               vid, true);
+
         mlxsw_sp_port_vlan_set(mlxsw_sp_port, 2, VLAN_N_VID - 1,
                                false, false);
         mlxsw_sp_port_stp_set(mlxsw_sp_port, false);
@@ -4358,7 +4376,10 @@ static int mlxsw_sp_netdevice_port_upper_event(struct net_device *lower_dev,
                 }
                 if (!info->linking)
                         break;
-                if (netdev_has_any_upper_dev(upper_dev)) {
+                if (netdev_has_any_upper_dev(upper_dev) &&
+                    (!netif_is_bridge_master(upper_dev) ||
+                     !mlxsw_sp_bridge_device_is_offloaded(mlxsw_sp,
+                                                          upper_dev))) {
                         NL_SET_ERR_MSG(extack,
                                        "spectrum: Enslaving a port to a device that already has an upper device is not supported");
                         return -EINVAL;
@@ -4486,6 +4507,7 @@ static int mlxsw_sp_netdevice_port_vlan_event(struct net_device *vlan_dev,
                                               u16 vid)
 {
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
+        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         struct netdev_notifier_changeupper_info *info = ptr;
         struct netlink_ext_ack *extack;
         struct net_device *upper_dev;
@@ -4502,7 +4524,10 @@ static int mlxsw_sp_netdevice_port_vlan_event(struct net_device *vlan_dev,
                 }
                 if (!info->linking)
                         break;
-                if (netdev_has_any_upper_dev(upper_dev)) {
+                if (netdev_has_any_upper_dev(upper_dev) &&
+                    (!netif_is_bridge_master(upper_dev) ||
+                     !mlxsw_sp_bridge_device_is_offloaded(mlxsw_sp,
+                                                          upper_dev))) {
                         NL_SET_ERR_MSG(extack, "spectrum: Enslaving a port to a device that already has an upper device is not supported");
                         return -EINVAL;
                 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index 432ab9b12b7f..05ce1befd9b3 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -365,6 +365,8 @@ int mlxsw_sp_port_bridge_join(struct mlxsw_sp_port *mlxsw_sp_port,
 void mlxsw_sp_port_bridge_leave(struct mlxsw_sp_port *mlxsw_sp_port,
                                 struct net_device *brport_dev,
                                 struct net_device *br_dev);
+bool mlxsw_sp_bridge_device_is_offloaded(const struct mlxsw_sp *mlxsw_sp,
+                                         const struct net_device *br_dev);
 
 /* spectrum.c */
 int mlxsw_sp_port_ets_set(struct mlxsw_sp_port *mlxsw_sp_port,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c
index c33beac5def0..b5397da94d7f 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_qdisc.c
@@ -46,7 +46,8 @@ mlxsw_sp_tclass_congestion_enable(struct mlxsw_sp_port *mlxsw_sp_port,
                                   int tclass_num, u32 min, u32 max,
                                   u32 probability, bool is_ecn)
 {
-        char cwtp_cmd[max_t(u8, MLXSW_REG_CWTP_LEN, MLXSW_REG_CWTPM_LEN)];
+        char cwtpm_cmd[MLXSW_REG_CWTPM_LEN];
+        char cwtp_cmd[MLXSW_REG_CWTP_LEN];
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         int err;
 
@@ -60,10 +61,10 @@ mlxsw_sp_tclass_congestion_enable(struct mlxsw_sp_port *mlxsw_sp_port,
         if (err)
                 return err;
 
-        mlxsw_reg_cwtpm_pack(cwtp_cmd, mlxsw_sp_port->local_port, tclass_num,
+        mlxsw_reg_cwtpm_pack(cwtpm_cmd, mlxsw_sp_port->local_port, tclass_num,
                              MLXSW_REG_CWTP_DEFAULT_PROFILE, true, is_ecn);
 
-        return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(cwtpm), cwtp_cmd);
+        return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(cwtpm), cwtpm_cmd);
 }
 
 static int
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 72ef4f8025f0..7042c855a5d6 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -821,13 +821,18 @@ static int mlxsw_sp_vr_lpm_tree_replace(struct mlxsw_sp *mlxsw_sp,
         struct mlxsw_sp_lpm_tree *old_tree = fib->lpm_tree;
         int err;
 
-        err = mlxsw_sp_vr_lpm_tree_bind(mlxsw_sp, fib, new_tree->id);
-        if (err)
-                return err;
         fib->lpm_tree = new_tree;
         mlxsw_sp_lpm_tree_hold(new_tree);
+        err = mlxsw_sp_vr_lpm_tree_bind(mlxsw_sp, fib, new_tree->id);
+        if (err)
+                goto err_tree_bind;
         mlxsw_sp_lpm_tree_put(mlxsw_sp, old_tree);
         return 0;
+
+err_tree_bind:
+        mlxsw_sp_lpm_tree_put(mlxsw_sp, new_tree);
+        fib->lpm_tree = old_tree;
+        return err;
 }
 
 static int mlxsw_sp_vrs_lpm_tree_replace(struct mlxsw_sp *mlxsw_sp,
@@ -868,11 +873,14 @@ err_tree_replace:
         return err;
 
 no_replace:
-        err = mlxsw_sp_vr_lpm_tree_bind(mlxsw_sp, fib, new_tree->id);
-        if (err)
-                return err;
         fib->lpm_tree = new_tree;
         mlxsw_sp_lpm_tree_hold(new_tree);
+        err = mlxsw_sp_vr_lpm_tree_bind(mlxsw_sp, fib, new_tree->id);
+        if (err) {
+                mlxsw_sp_lpm_tree_put(mlxsw_sp, new_tree);
+                fib->lpm_tree = NULL;
+                return err;
+        }
         return 0;
 }
 
@@ -1934,11 +1942,8 @@ static void mlxsw_sp_router_neigh_ent_ipv4_process(struct mlxsw_sp *mlxsw_sp,
         dipn = htonl(dip);
         dev = mlxsw_sp->router->rifs[rif]->dev;
         n = neigh_lookup(&arp_tbl, &dipn, dev);
-        if (!n) {
-                netdev_err(dev, "Failed to find matching neighbour for IP=%pI4h\n",
-                           &dip);
+        if (!n)
                 return;
-        }
 
         netdev_dbg(dev, "Updating neighbour with IP=%pI4h\n", &dip);
         neigh_event_send(n, NULL);
@@ -1965,11 +1970,8 @@ static void mlxsw_sp_router_neigh_ent_ipv6_process(struct mlxsw_sp *mlxsw_sp,
 
         dev = mlxsw_sp->router->rifs[rif]->dev;
         n = neigh_lookup(&nd_tbl, &dip, dev);
-        if (!n) {
-                netdev_err(dev, "Failed to find matching neighbour for IP=%pI6c\n",
-                           &dip);
+        if (!n)
                 return;
-        }
 
         netdev_dbg(dev, "Updating neighbour with IP=%pI6c\n", &dip);
         neigh_event_send(n, NULL);
@@ -2436,25 +2438,16 @@ static void mlxsw_sp_neigh_fini(struct mlxsw_sp *mlxsw_sp)
         rhashtable_destroy(&mlxsw_sp->router->neigh_ht);
 }
 
-static int mlxsw_sp_neigh_rif_flush(struct mlxsw_sp *mlxsw_sp,
-                                    const struct mlxsw_sp_rif *rif)
-{
-        char rauht_pl[MLXSW_REG_RAUHT_LEN];
-
-        mlxsw_reg_rauht_pack(rauht_pl, MLXSW_REG_RAUHT_OP_WRITE_DELETE_ALL,
-                             rif->rif_index, rif->addr);
-        return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(rauht), rauht_pl);
-}
-
 static void mlxsw_sp_neigh_rif_gone_sync(struct mlxsw_sp *mlxsw_sp,
                                          struct mlxsw_sp_rif *rif)
 {
         struct mlxsw_sp_neigh_entry *neigh_entry, *tmp;
 
-        mlxsw_sp_neigh_rif_flush(mlxsw_sp, rif);
         list_for_each_entry_safe(neigh_entry, tmp, &rif->neigh_list,
-                                 rif_list_node)
+                                 rif_list_node) {
+                mlxsw_sp_neigh_entry_update(mlxsw_sp, neigh_entry, false);
                 mlxsw_sp_neigh_entry_destroy(mlxsw_sp, neigh_entry);
+        }
 }
 
 enum mlxsw_sp_nexthop_type {
@@ -3237,7 +3230,7 @@ static void __mlxsw_sp_nexthop_neigh_update(struct mlxsw_sp_nexthop *nh,
 {
         if (!removing)
                 nh->should_offload = 1;
-        else if (nh->offloaded)
+        else
                 nh->should_offload = 0;
         nh->update = 1;
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 7b8548e25ae7..593ad31be749 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -152,6 +152,12 @@ mlxsw_sp_bridge_device_find(const struct mlxsw_sp_bridge *bridge,
         return NULL;
 }
 
+bool mlxsw_sp_bridge_device_is_offloaded(const struct mlxsw_sp *mlxsw_sp,
+                                         const struct net_device *br_dev)
+{
+        return !!mlxsw_sp_bridge_device_find(mlxsw_sp->bridge, br_dev);
+}
+
 static struct mlxsw_sp_bridge_device *
 mlxsw_sp_bridge_device_create(struct mlxsw_sp_bridge *bridge,
                               struct net_device *br_dev)
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.c b/drivers/net/ethernet/netronome/nfp/bpf/main.c
index e379b78e86ef..13190aa09faf 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/main.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c
@@ -82,10 +82,33 @@ static const char *nfp_bpf_extra_cap(struct nfp_app *app, struct nfp_net *nn)
         return nfp_net_ebpf_capable(nn) ? "BPF" : "";
 }
 
+static int
+nfp_bpf_vnic_alloc(struct nfp_app *app, struct nfp_net *nn, unsigned int id)
+{
+        int err;
+
+        nn->app_priv = kzalloc(sizeof(struct nfp_bpf_vnic), GFP_KERNEL);
+        if (!nn->app_priv)
+                return -ENOMEM;
+
+        err = nfp_app_nic_vnic_alloc(app, nn, id);
+        if (err)
+                goto err_free_priv;
+
+        return 0;
+err_free_priv:
+        kfree(nn->app_priv);
+        return err;
+}
+
 static void nfp_bpf_vnic_free(struct nfp_app *app, struct nfp_net *nn)
 {
+        struct nfp_bpf_vnic *bv = nn->app_priv;
+
         if (nn->dp.bpf_offload_xdp)
                 nfp_bpf_xdp_offload(app, nn, NULL);
+        WARN_ON(bv->tc_prog);
+        kfree(bv);
 }
 
 static int nfp_bpf_setup_tc_block_cb(enum tc_setup_type type,
@@ -93,6 +116,9 @@ static int nfp_bpf_setup_tc_block_cb(enum tc_setup_type type,
 {
         struct tc_cls_bpf_offload *cls_bpf = type_data;
         struct nfp_net *nn = cb_priv;
+        struct bpf_prog *oldprog;
+        struct nfp_bpf_vnic *bv;
+        int err;
 
         if (type != TC_SETUP_CLSBPF ||
             !tc_can_offload(nn->dp.netdev) ||
@@ -100,8 +126,6 @@ static int nfp_bpf_setup_tc_block_cb(enum tc_setup_type type,
             cls_bpf->common.protocol != htons(ETH_P_ALL) ||
             cls_bpf->common.chain_index)
                 return -EOPNOTSUPP;
-        if (nn->dp.bpf_offload_xdp)
-                return -EBUSY;
 
         /* Only support TC direct action */
         if (!cls_bpf->exts_integrated ||
@@ -110,16 +134,25 @@ static int nfp_bpf_setup_tc_block_cb(enum tc_setup_type type,
                 return -EOPNOTSUPP;
         }
 
-        switch (cls_bpf->command) {
-        case TC_CLSBPF_REPLACE:
-                return nfp_net_bpf_offload(nn, cls_bpf->prog, true);
-        case TC_CLSBPF_ADD:
-                return nfp_net_bpf_offload(nn, cls_bpf->prog, false);
-        case TC_CLSBPF_DESTROY:
-                return nfp_net_bpf_offload(nn, NULL, true);
-        default:
+        if (cls_bpf->command != TC_CLSBPF_OFFLOAD)
                 return -EOPNOTSUPP;
+
+        bv = nn->app_priv;
+        oldprog = cls_bpf->oldprog;
+
+        /* Don't remove if oldprog doesn't match driver's state */
+        if (bv->tc_prog != oldprog) {
+                oldprog = NULL;
+                if (!cls_bpf->prog)
+                        return 0;
         }
+
+        err = nfp_net_bpf_offload(nn, cls_bpf->prog, oldprog);
+        if (err)
+                return err;
+
+        bv->tc_prog = cls_bpf->prog;
+        return 0;
 }
 
 static int nfp_bpf_setup_tc_block(struct net_device *netdev,
@@ -167,7 +200,7 @@ const struct nfp_app_type app_bpf = {
 
         .extra_cap      = nfp_bpf_extra_cap,
 
-        .vnic_alloc     = nfp_app_nic_vnic_alloc,
+        .vnic_alloc     = nfp_bpf_vnic_alloc,
         .vnic_free      = nfp_bpf_vnic_free,
 
         .setup_tc       = nfp_bpf_setup_tc,
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.h b/drivers/net/ethernet/netronome/nfp/bpf/main.h
index 082a15f6dfb5..57b6043177a3 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/main.h
+++ b/drivers/net/ethernet/netronome/nfp/bpf/main.h
@@ -172,6 +172,14 @@ struct nfp_prog {
         struct list_head insns;
 };
 
+/**
+ * struct nfp_bpf_vnic - per-vNIC BPF priv structure
+ * @tc_prog:    currently loaded cls_bpf program
+ */
+struct nfp_bpf_vnic {
+        struct bpf_prog *tc_prog;
+};
+
 int nfp_bpf_jit(struct nfp_prog *prog);
 
 extern const struct bpf_ext_analyzer_ops nfp_bpf_analyzer_ops;
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 1a603fdd9e80..99b0487b6d82 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -568,6 +568,7 @@ nfp_net_aux_irq_request(struct nfp_net *nn, u32 ctrl_offset,
                 return err;
         }
         nn_writeb(nn, ctrl_offset, entry->entry);
+        nfp_net_irq_unmask(nn, entry->entry);
 
         return 0;
 }
@@ -582,6 +583,7 @@ static void nfp_net_aux_irq_free(struct nfp_net *nn, u32 ctrl_offset,
                                  unsigned int vector_idx)
 {
         nn_writeb(nn, ctrl_offset, 0xff);
+        nn_pci_flush(nn);
         free_irq(nn->irq_entries[vector_idx].vector, nn);
 }
 
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
index 2801ecd09eab..6c02b2d6ba06 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
@@ -333,7 +333,7 @@ nfp_net_get_link_ksettings(struct net_device *netdev,
             ls >= ARRAY_SIZE(ls_to_ethtool))
                 return 0;
 
-        cmd->base.speed = ls_to_ethtool[sts];
+        cmd->base.speed = ls_to_ethtool[ls];
         cmd->base.duplex = DUPLEX_FULL;
 
         return 0;
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
index 924a05e05da0..78b36c67c232 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
@@ -84,16 +84,13 @@ nfp_repr_phy_port_get_stats64(struct nfp_port *port,
 {
         u8 __iomem *mem = port->eth_stats;
 
-        /* TX and RX stats are flipped as we are returning the stats as seen
-         * at the switch port corresponding to the phys port.
-         */
-        stats->tx_packets = readq(mem + NFP_MAC_STATS_RX_FRAMES_RECEIVED_OK);
-        stats->tx_bytes = readq(mem + NFP_MAC_STATS_RX_IN_OCTETS);
-        stats->tx_dropped = readq(mem + NFP_MAC_STATS_RX_IN_ERRORS);
+        stats->tx_packets = readq(mem + NFP_MAC_STATS_TX_FRAMES_TRANSMITTED_OK);
+        stats->tx_bytes = readq(mem + NFP_MAC_STATS_TX_OUT_OCTETS);
+        stats->tx_dropped = readq(mem + NFP_MAC_STATS_TX_OUT_ERRORS);
 
-        stats->rx_packets = readq(mem + NFP_MAC_STATS_TX_FRAMES_TRANSMITTED_OK);
-        stats->rx_bytes = readq(mem + NFP_MAC_STATS_TX_OUT_OCTETS);
-        stats->rx_dropped = readq(mem + NFP_MAC_STATS_TX_OUT_ERRORS);
+        stats->rx_packets = readq(mem + NFP_MAC_STATS_RX_FRAMES_RECEIVED_OK);
+        stats->rx_bytes = readq(mem + NFP_MAC_STATS_RX_IN_OCTETS);
+        stats->rx_dropped = readq(mem + NFP_MAC_STATS_RX_IN_ERRORS);
 }
 
 static void
diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
index c8c4b3940564..b7abb8205d3a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
@@ -358,10 +358,27 @@ static void qed_rdma_resc_free(struct qed_hwfn *p_hwfn)
         kfree(p_rdma_info);
 }
 
+static void qed_rdma_free_tid(void *rdma_cxt, u32 itid)
+{
+        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
+
+        DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "itid = %08x\n", itid);
+
+        spin_lock_bh(&p_hwfn->p_rdma_info->lock);
+        qed_bmap_release_id(p_hwfn, &p_hwfn->p_rdma_info->tid_map, itid);
+        spin_unlock_bh(&p_hwfn->p_rdma_info->lock);
+}
+
+static void qed_rdma_free_reserved_lkey(struct qed_hwfn *p_hwfn)
+{
+        qed_rdma_free_tid(p_hwfn, p_hwfn->p_rdma_info->dev->reserved_lkey);
+}
+
 static void qed_rdma_free(struct qed_hwfn *p_hwfn)
 {
         DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Freeing RDMA\n");
 
+        qed_rdma_free_reserved_lkey(p_hwfn);
         qed_rdma_resc_free(p_hwfn);
 }
 
@@ -615,9 +632,6 @@ static int qed_rdma_reserve_lkey(struct qed_hwfn *p_hwfn)
 {
         struct qed_rdma_device *dev = p_hwfn->p_rdma_info->dev;
 
-        /* The first DPI is reserved for the Kernel */
-        __set_bit(0, p_hwfn->p_rdma_info->dpi_map.bitmap);
-
         /* Tid 0 will be used as the key for "reserved MR".
          * The driver should allocate memory for it so it can be loaded but no
          * ramrod should be passed on it.
@@ -797,17 +811,6 @@ static struct qed_rdma_device *qed_rdma_query_device(void *rdma_cxt)
         return p_hwfn->p_rdma_info->dev;
 }
 
-static void qed_rdma_free_tid(void *rdma_cxt, u32 itid)
-{
-        struct qed_hwfn *p_hwfn = (struct qed_hwfn *)rdma_cxt;
-
-        DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "itid = %08x\n", itid);
-
-        spin_lock_bh(&p_hwfn->p_rdma_info->lock);
-        qed_bmap_release_id(p_hwfn, &p_hwfn->p_rdma_info->tid_map, itid);
-        spin_unlock_bh(&p_hwfn->p_rdma_info->lock);
-}
-
 static void qed_rdma_cnq_prod_update(void *rdma_cxt, u8 qz_offset, u16 prod)
 {
         struct qed_hwfn *p_hwfn;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
index be48d9abd001..3588081b2e27 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
@@ -776,6 +776,7 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
         int rc = 0;
         struct qed_spq *p_spq = p_hwfn ? p_hwfn->p_spq : NULL;
         bool b_ret_ent = true;
+        bool eblock;
 
         if (!p_hwfn)
                 return -EINVAL;
@@ -794,6 +795,11 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
         if (rc)
                 goto spq_post_fail;
 
+        /* Check if entry is in block mode before qed_spq_add_entry,
+         * which might kfree p_ent.
+         */
+        eblock = (p_ent->comp_mode == QED_SPQ_MODE_EBLOCK);
+
         /* Add the request to the pending queue */
         rc = qed_spq_add_entry(p_hwfn, p_ent, p_ent->priority);
         if (rc)
@@ -811,7 +817,7 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
 
         spin_unlock_bh(&p_spq->lock);
 
-        if (p_ent->comp_mode == QED_SPQ_MODE_EBLOCK) {
+        if (eblock) {
                 /* For entries in QED BLOCK mode, the completion code cannot
                  * perform the necessary cleanup - if it did, we couldn't
                  * access p_ent here to see whether it's successful or not.
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-phy.c b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
index 18461fcb9815..53dbf1e163a8 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-phy.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
@@ -47,6 +47,7 @@
 #define MDIO_CLK_25_28                                               7
 
 #define MDIO_WAIT_TIMES                                           1000
+#define MDIO_STATUS_DELAY_TIME                                       1
 
 static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
 {
@@ -65,7 +66,7 @@ static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
 
         if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
                                !(reg & (MDIO_START | MDIO_BUSY)),
-                               100, MDIO_WAIT_TIMES * 100))
+                               MDIO_STATUS_DELAY_TIME, MDIO_WAIT_TIMES * 100))
                 return -EIO;
 
         return (reg >> MDIO_DATA_SHFT) & MDIO_DATA_BMSK;
@@ -88,8 +89,8 @@ static int emac_mdio_write(struct mii_bus *bus, int addr, int regnum, u16 val)
         writel(reg, adpt->base + EMAC_MDIO_CTRL);
 
         if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
-                               !(reg & (MDIO_START | MDIO_BUSY)), 100,
-                               MDIO_WAIT_TIMES * 100))
+                               !(reg & (MDIO_START | MDIO_BUSY)),
+                               MDIO_STATUS_DELAY_TIME, MDIO_WAIT_TIMES * 100))
                 return -EIO;
 
         return 0;
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
index 70c92b649b29..38c924bdd32e 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac.c
@@ -253,18 +253,18 @@ static int emac_open(struct net_device *netdev)
                 return ret;
         }
 
-        ret = emac_mac_up(adpt);
+        ret = adpt->phy.open(adpt);
         if (ret) {
                 emac_mac_rx_tx_rings_free_all(adpt);
                 free_irq(irq->irq, irq);
                 return ret;
         }
 
-        ret = adpt->phy.open(adpt);
+        ret = emac_mac_up(adpt);
         if (ret) {
-                emac_mac_down(adpt);
                 emac_mac_rx_tx_rings_free_all(adpt);
                 free_irq(irq->irq, irq);
+                adpt->phy.close(adpt);
                 return ret;
         }
 
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index 71bee1af71ef..df21e900f874 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -195,6 +195,7 @@ err2:
 err1:
         rmnet_unregister_real_device(real_dev, port);
 err0:
+        kfree(ep);
         return err;
 }
 
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
index 29842ccc91a9..08e4afc0ab39 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
@@ -126,12 +126,12 @@ static int rmnet_map_egress_handler(struct sk_buff *skb,
 
         if (skb_headroom(skb) < required_headroom) {
                 if (pskb_expand_head(skb, required_headroom, 0, GFP_KERNEL))
-                        return RMNET_MAP_CONSUMED;
+                        goto fail;
         }
 
         map_header = rmnet_map_add_map_header(skb, additional_header_len, 0);
         if (!map_header)
-                return RMNET_MAP_CONSUMED;
+                goto fail;
 
         if (port->egress_data_format & RMNET_EGRESS_FORMAT_MUXING) {
                 if (mux_id == 0xff)
@@ -143,6 +143,10 @@ static int rmnet_map_egress_handler(struct sk_buff *skb,
         skb->protocol = htons(ETH_P_MAP);
 
         return RMNET_MAP_SUCCESS;
+
+fail:
+        kfree_skb(skb);
+        return RMNET_MAP_CONSUMED;
 }
 
 static void
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index fc0d5fa65ad4..734286ebe5ef 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -2244,19 +2244,14 @@ static bool rtl8169_do_counters(struct net_device *dev, u32 counter_cmd)
         void __iomem *ioaddr = tp->mmio_addr;
         dma_addr_t paddr = tp->counters_phys_addr;
         u32 cmd;
-        bool ret;
 
         RTL_W32(CounterAddrHigh, (u64)paddr >> 32);
+        RTL_R32(CounterAddrHigh);
         cmd = (u64)paddr & DMA_BIT_MASK(32);
         RTL_W32(CounterAddrLow, cmd);
         RTL_W32(CounterAddrLow, cmd | counter_cmd);
 
-        ret = rtl_udelay_loop_wait_low(tp, &rtl_counters_cond, 10, 1000);
-
-        RTL_W32(CounterAddrLow, 0);
-        RTL_W32(CounterAddrHigh, 0);
-
-        return ret;
+        return rtl_udelay_loop_wait_low(tp, &rtl_counters_cond, 10, 1000);
 }
 
 static bool rtl8169_reset_counters(struct net_device *dev)
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 2b962d349f5f..009780df664b 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -2308,32 +2308,9 @@ static int __maybe_unused ravb_resume(struct device *dev)
         struct ravb_private *priv = netdev_priv(ndev);
         int ret = 0;
 
-        if (priv->wol_enabled) {
-                /* Reduce the usecount of the clock to zero and then
-                 * restore it to its original value. This is done to force
-                 * the clock to be re-enabled which is a workaround
-                 * for renesas-cpg-mssr driver which do not enable clocks
-                 * when resuming from PSCI suspend/resume.
-                 *
-                 * Without this workaround the driver fails to communicate
-                 * with the hardware if WoL was enabled when the system
-                 * entered PSCI suspend. This is due to that if WoL is enabled
-                 * we explicitly keep the clock from being turned off when
-                 * suspending, but in PSCI sleep power is cut so the clock
-                 * is disabled anyhow, the clock driver is not aware of this
-                 * so the clock is not turned back on when resuming.
-                 *
-                 * TODO: once the renesas-cpg-mssr suspend/resume is working
-                 *       this clock dance should be removed.
-                 */
-                clk_disable(priv->clk);
-                clk_disable(priv->clk);
-                clk_enable(priv->clk);
-                clk_enable(priv->clk);
-
-                /* Set reset mode to rearm the WoL logic */
+        /* If WoL is enabled set reset mode to rearm the WoL logic */
+        if (priv->wol_enabled)
                 ravb_write(ndev, CCC_OPC_RESET, CCC);
-        }
 
         /* All register have been reset to default values.
          * Restore all registers which where setup at probe time and
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 7e060aa9fbed..53924a4fc31c 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -147,7 +147,7 @@ static const u16 sh_eth_offset_gigabit[SH_ETH_MAX_REGISTER_OFFSET] = {
         [FWNLCR0]       = 0x0090,
         [FWALCR0]       = 0x0094,
         [TXNLCR1]       = 0x00a0,
-        [TXALCR1]       = 0x00a0,
+        [TXALCR1]       = 0x00a4,
         [RXNLCR1]       = 0x00a8,
         [RXALCR1]       = 0x00ac,
         [FWNLCR1]       = 0x00b0,
@@ -399,7 +399,7 @@ static const u16 sh_eth_offset_fast_sh3_sh2[SH_ETH_MAX_REGISTER_OFFSET] = {
         [FWNLCR0]       = 0x0090,
         [FWALCR0]       = 0x0094,
         [TXNLCR1]       = 0x00a0,
-        [TXALCR1]       = 0x00a0,
+        [TXALCR1]       = 0x00a4,
         [RXNLCR1]       = 0x00a8,
         [RXALCR1]       = 0x00ac,
         [FWNLCR1]       = 0x00b0,
@@ -1149,7 +1149,8 @@ static int sh_eth_tx_free(struct net_device *ndev, bool sent_only)
                            entry, le32_to_cpu(txdesc->status));
                 /* Free the original skb. */
                 if (mdp->tx_skbuff[entry]) {
-                        dma_unmap_single(&ndev->dev, le32_to_cpu(txdesc->addr),
+                        dma_unmap_single(&mdp->pdev->dev,
+                                         le32_to_cpu(txdesc->addr),
                                          le32_to_cpu(txdesc->len) >> 16,
                                          DMA_TO_DEVICE);
                         dev_kfree_skb_irq(mdp->tx_skbuff[entry]);
@@ -1179,14 +1180,14 @@ static void sh_eth_ring_free(struct net_device *ndev)
                         if (mdp->rx_skbuff[i]) {
                                 struct sh_eth_rxdesc *rxdesc = &mdp->rx_ring[i];
 
-                                dma_unmap_single(&ndev->dev,
+                                dma_unmap_single(&mdp->pdev->dev,
                                                  le32_to_cpu(rxdesc->addr),
                                                  ALIGN(mdp->rx_buf_sz, 32),
                                                  DMA_FROM_DEVICE);
                         }
                 }
                 ringsize = sizeof(struct sh_eth_rxdesc) * mdp->num_rx_ring;
-                dma_free_coherent(NULL, ringsize, mdp->rx_ring,
+                dma_free_coherent(&mdp->pdev->dev, ringsize, mdp->rx_ring,
                                   mdp->rx_desc_dma);
                 mdp->rx_ring = NULL;
         }
@@ -1203,7 +1204,7 @@ static void sh_eth_ring_free(struct net_device *ndev)
                 sh_eth_tx_free(ndev, false);
 
                 ringsize = sizeof(struct sh_eth_txdesc) * mdp->num_tx_ring;
-                dma_free_coherent(NULL, ringsize, mdp->tx_ring,
+                dma_free_coherent(&mdp->pdev->dev, ringsize, mdp->tx_ring,
                                   mdp->tx_desc_dma);
                 mdp->tx_ring = NULL;
         }
@@ -1245,9 +1246,9 @@ static void sh_eth_ring_format(struct net_device *ndev)
 
                 /* The size of the buffer is a multiple of 32 bytes. */
                 buf_len = ALIGN(mdp->rx_buf_sz, 32);
-                dma_addr = dma_map_single(&ndev->dev, skb->data, buf_len,
+                dma_addr = dma_map_single(&mdp->pdev->dev, skb->data, buf_len,
                                           DMA_FROM_DEVICE);
-                if (dma_mapping_error(&ndev->dev, dma_addr)) {
+                if (dma_mapping_error(&mdp->pdev->dev, dma_addr)) {
                         kfree_skb(skb);
                         break;
                 }
@@ -1323,8 +1324,8 @@ static int sh_eth_ring_init(struct net_device *ndev)
 
         /* Allocate all Rx descriptors. */
         rx_ringsize = sizeof(struct sh_eth_rxdesc) * mdp->num_rx_ring;
-        mdp->rx_ring = dma_alloc_coherent(NULL, rx_ringsize, &mdp->rx_desc_dma,
-                                          GFP_KERNEL);
+        mdp->rx_ring = dma_alloc_coherent(&mdp->pdev->dev, rx_ringsize,
+                                          &mdp->rx_desc_dma, GFP_KERNEL);
         if (!mdp->rx_ring)
                 goto ring_free;
 
@@ -1332,8 +1333,8 @@ static int sh_eth_ring_init(struct net_device *ndev)
 
         /* Allocate all Tx descriptors. */
         tx_ringsize = sizeof(struct sh_eth_txdesc) * mdp->num_tx_ring;
-        mdp->tx_ring = dma_alloc_coherent(NULL, tx_ringsize, &mdp->tx_desc_dma,
-                                          GFP_KERNEL);
+        mdp->tx_ring = dma_alloc_coherent(&mdp->pdev->dev, tx_ringsize,
+                                          &mdp->tx_desc_dma, GFP_KERNEL);
         if (!mdp->tx_ring)
                 goto ring_free;
         return 0;
@@ -1527,7 +1528,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                         mdp->rx_skbuff[entry] = NULL;
                         if (mdp->cd->rpadir)
                                 skb_reserve(skb, NET_IP_ALIGN);
-                        dma_unmap_single(&ndev->dev, dma_addr,
+                        dma_unmap_single(&mdp->pdev->dev, dma_addr,
                                          ALIGN(mdp->rx_buf_sz, 32),
                                          DMA_FROM_DEVICE);
                         skb_put(skb, pkt_len);
@@ -1555,9 +1556,9 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                         if (skb == NULL)
                                 break;  /* Better luck next round. */
                         sh_eth_set_receive_align(skb);
-                        dma_addr = dma_map_single(&ndev->dev, skb->data,
+                        dma_addr = dma_map_single(&mdp->pdev->dev, skb->data,
                                                   buf_len, DMA_FROM_DEVICE);
-                        if (dma_mapping_error(&ndev->dev, dma_addr)) {
+                        if (dma_mapping_error(&mdp->pdev->dev, dma_addr)) {
                                 kfree_skb(skb);
                                 break;
                         }
@@ -1891,6 +1892,16 @@ static int sh_eth_phy_init(struct net_device *ndev)
                 return PTR_ERR(phydev);
         }
 
+        /* mask with MAC supported features */
+        if (mdp->cd->register_type != SH_ETH_REG_GIGABIT) {
+                int err = phy_set_max_speed(phydev, SPEED_100);
+                if (err) {
+                        netdev_err(ndev, "failed to limit PHY to 100 Mbit/s\n");
+                        phy_disconnect(phydev);
+                        return err;
+                }
+        }
+
         phy_attached_info(phydev);
 
         return 0;
@@ -2078,8 +2089,8 @@ static size_t __sh_eth_get_regs(struct net_device *ndev, u32 *buf)
                 add_reg(CSMR);
         if (cd->select_mii)
                 add_reg(RMII_MII);
-        add_reg(ARSTR);
         if (cd->tsu) {
+                add_tsu_reg(ARSTR);
                 add_tsu_reg(TSU_CTRST);
                 add_tsu_reg(TSU_FWEN0);
                 add_tsu_reg(TSU_FWEN1);
@@ -2441,9 +2452,9 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         /* soft swap. */
         if (!mdp->cd->hw_swap)
                 sh_eth_soft_swap(PTR_ALIGN(skb->data, 4), skb->len + 2);
-        dma_addr = dma_map_single(&ndev->dev, skb->data, skb->len,
+        dma_addr = dma_map_single(&mdp->pdev->dev, skb->data, skb->len,
                                   DMA_TO_DEVICE);
-        if (dma_mapping_error(&ndev->dev, dma_addr)) {
+        if (dma_mapping_error(&mdp->pdev->dev, dma_addr)) {
                 kfree_skb(skb);
                 return NETDEV_TX_OK;
         }
@@ -3214,18 +3225,37 @@ static int sh_eth_drv_probe(struct platform_device *pdev)
         /* ioremap the TSU registers */
         if (mdp->cd->tsu) {
                 struct resource *rtsu;
+
                 rtsu = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-                mdp->tsu_addr = devm_ioremap_resource(&pdev->dev, rtsu);
-                if (IS_ERR(mdp->tsu_addr)) {
-                        ret = PTR_ERR(mdp->tsu_addr);
+                if (!rtsu) {
+                        dev_err(&pdev->dev, "no TSU resource\n");
+                        ret = -ENODEV;
+                        goto out_release;
+                }
+                /* We can only request the  TSU region  for the first port
+                 * of the two  sharing this TSU for the probe to succeed...
+                 */
+                if (devno % 2 == 0 &&
+                    !devm_request_mem_region(&pdev->dev, rtsu->start,
+                                             resource_size(rtsu),
+                                             dev_name(&pdev->dev))) {
+                        dev_err(&pdev->dev, "can't request TSU resource.\n");
+                        ret = -EBUSY;
+                        goto out_release;
+                }
+                mdp->tsu_addr = devm_ioremap(&pdev->dev, rtsu->start,
+                                             resource_size(rtsu));
+                if (!mdp->tsu_addr) {
+                        dev_err(&pdev->dev, "TSU region ioremap() failed.\n");
+                        ret = -ENOMEM;
                         goto out_release;
                 }
                 mdp->port = devno % 2;
                 ndev->features = NETIF_F_HW_VLAN_CTAG_FILTER;
         }
 
-        /* initialize first or needed device */
-        if (!devno || pd->needs_init) {
+        /* Need to init only the first port of the two sharing a TSU */
+        if (devno % 2 == 0) {
                 if (mdp->cd->chip_reset)
                         mdp->cd->chip_reset(ndev);
 
diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
index 0ea7e16f2e6e..9937a2450e57 100644
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -77,6 +77,7 @@ static void efx_dequeue_buffer(struct efx_tx_queue *tx_queue,
         }
 
         if (buffer->flags & EFX_TX_BUF_SKB) {
+                EFX_WARN_ON_PARANOID(!pkts_compl || !bytes_compl);
                 (*pkts_compl)++;
                 (*bytes_compl) += buffer->skb->len;
                 dev_consume_skb_any((struct sk_buff *)buffer->skb);
@@ -426,12 +427,14 @@ static int efx_tx_map_data(struct efx_tx_queue *tx_queue, struct sk_buff *skb,
 static void efx_enqueue_unwind(struct efx_tx_queue *tx_queue)
 {
         struct efx_tx_buffer *buffer;
+        unsigned int bytes_compl = 0;
+        unsigned int pkts_compl = 0;
 
         /* Work backwards until we hit the original insert pointer value */
         while (tx_queue->insert_count != tx_queue->write_count) {
                 --tx_queue->insert_count;
                 buffer = __efx_tx_queue_get_insert_buffer(tx_queue);
-                efx_dequeue_buffer(tx_queue, buffer, NULL, NULL);
+                efx_dequeue_buffer(tx_queue, buffer, &pkts_compl, &bytes_compl);
         }
 }
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index e1e5ac053760..ce2ea2d491ac 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -409,7 +409,7 @@ struct stmmac_desc_ops {
         /* get timestamp value */
          u64(*get_timestamp) (void *desc, u32 ats);
         /* get rx timestamp status */
-        int (*get_rx_timestamp_status) (void *desc, u32 ats);
+        int (*get_rx_timestamp_status)(void *desc, void *next_desc, u32 ats);
         /* Display ring */
         void (*display_ring)(void *head, unsigned int size, bool rx);
         /* set MSS via context descriptor */
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
index e5ff734d4f9b..9eb7f65d8000 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
@@ -808,8 +808,7 @@ static int sun8i_dwmac_set_syscon(struct stmmac_priv *priv)
                          val, reg);
 
         if (gmac->variant->soc_has_internal_phy) {
-                if (of_property_read_bool(priv->plat->phy_node,
-                                          "allwinner,leds-active-low"))
+                if (of_property_read_bool(node, "allwinner,leds-active-low"))
                         reg |= H3_EPHY_LED_POL;
                 else
                         reg &= ~H3_EPHY_LED_POL;
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
index 4b286e27c4ca..7e089bf906b4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
@@ -258,7 +258,8 @@ static int dwmac4_rx_check_timestamp(void *desc)
         return ret;
 }
 
-static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats)
+static int dwmac4_wrback_get_rx_timestamp_status(void *desc, void *next_desc,
+                                                 u32 ats)
 {
         struct dma_desc *p = (struct dma_desc *)desc;
         int ret = -EINVAL;
@@ -270,7 +271,7 @@ static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats)
 
                         /* Check if timestamp is OK from context descriptor */
                         do {
-                                ret = dwmac4_rx_check_timestamp(desc);
+                                ret = dwmac4_rx_check_timestamp(next_desc);
                                 if (ret < 0)
                                         goto exit;
                                 i++;
diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
index 7546b3664113..2a828a312814 100644
--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
@@ -400,7 +400,8 @@ static u64 enh_desc_get_timestamp(void *desc, u32 ats)
         return ns;
 }
 
-static int enh_desc_get_rx_timestamp_status(void *desc, u32 ats)
+static int enh_desc_get_rx_timestamp_status(void *desc, void *next_desc,
+                                            u32 ats)
 {
         if (ats) {
                 struct dma_extended_desc *p = (struct dma_extended_desc *)desc;
diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
index f817f8f36569..db4cee57bb24 100644
--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
@@ -265,7 +265,7 @@ static u64 ndesc_get_timestamp(void *desc, u32 ats)
         return ns;
 }
 
-static int ndesc_get_rx_timestamp_status(void *desc, u32 ats)
+static int ndesc_get_rx_timestamp_status(void *desc, void *next_desc, u32 ats)
 {
         struct dma_desc *p = (struct dma_desc *)desc;
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
index 721b61655261..08c19ebd5306 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
@@ -34,6 +34,7 @@ static u32 stmmac_config_sub_second_increment(void __iomem *ioaddr,
 {
         u32 value = readl(ioaddr + PTP_TCR);
         unsigned long data;
+        u32 reg_value;
 
         /* For GMAC3.x, 4.x versions, convert the ptp_clock to nano second
          *      formula = (1/ptp_clock) * 1000000000
@@ -50,10 +51,11 @@ static u32 stmmac_config_sub_second_increment(void __iomem *ioaddr,
 
         data &= PTP_SSIR_SSINC_MASK;
 
+        reg_value = data;
         if (gmac4)
-                data = data << GMAC4_PTP_SSIR_SSINC_SHIFT;
+                reg_value <<= GMAC4_PTP_SSIR_SSINC_SHIFT;
 
-        writel(data, ioaddr + PTP_SSIR);
+        writel(reg_value, ioaddr + PTP_SSIR);
 
         return data;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index f63c2ddced3c..c0af0bc4e714 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -364,9 +364,15 @@ static void stmmac_eee_ctrl_timer(struct timer_list *t)
 bool stmmac_eee_init(struct stmmac_priv *priv)
 {
         struct net_device *ndev = priv->dev;
+        int interface = priv->plat->interface;
         unsigned long flags;
         bool ret = false;
 
+        if ((interface != PHY_INTERFACE_MODE_MII) &&
+            (interface != PHY_INTERFACE_MODE_GMII) &&
+            !phy_interface_mode_is_rgmii(interface))
+                goto out;
+
         /* Using PCS we cannot dial with the phy registers at this stage
          * so we do not support extra feature like EEE.
          */
@@ -482,7 +488,7 @@ static void stmmac_get_rx_hwtstamp(struct stmmac_priv *priv, struct dma_desc *p,
                 desc = np;
 
         /* Check if timestamp is available */
-        if (priv->hw->desc->get_rx_timestamp_status(desc, priv->adv_ts)) {
+        if (priv->hw->desc->get_rx_timestamp_status(p, np, priv->adv_ts)) {
                 ns = priv->hw->desc->get_timestamp(desc, priv->adv_ts);
                 netdev_dbg(priv->dev, "get valid RX hw timestamp %llu\n", ns);
                 shhwtstamp = skb_hwtstamps(skb);
@@ -2588,6 +2594,7 @@ static int stmmac_open(struct net_device *dev)
 
         priv->dma_buf_sz = STMMAC_ALIGN(buf_sz);
         priv->rx_copybreak = STMMAC_RX_COPYBREAK;
+        priv->mss = 0;
 
         ret = alloc_dma_desc_resources(priv);
         if (ret < 0) {
diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
index ed58c746e4af..f5a7eb22d0f5 100644
--- a/drivers/net/ethernet/ti/netcp_core.c
+++ b/drivers/net/ethernet/ti/netcp_core.c
@@ -715,7 +715,7 @@ static int netcp_process_one_rx_packet(struct netcp_intf *netcp)
                 /* warning!!!! We are retrieving the virtual ptr in the sw_data
                  * field as a 32bit value. Will not work on 64bit machines
                  */
-                page = (struct page *)GET_SW_DATA0(desc);
+                page = (struct page *)GET_SW_DATA0(ndesc);
 
                 if (likely(dma_buff && buf_len && page)) {
                         dma_unmap_page(netcp->dev, dma_buff, PAGE_SIZE,
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index b718a02a6bb6..64fda2e1040e 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -825,6 +825,13 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
         if (IS_ERR(rt))
                 return PTR_ERR(rt);
 
+        if (skb_dst(skb)) {
+                int mtu = dst_mtu(&rt->dst) - sizeof(struct iphdr) -
+                          GENEVE_BASE_HLEN - info->options_len - 14;
+
+                skb_dst_update_pmtu(skb, mtu);
+        }
+
         sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
         if (geneve->collect_md) {
                 tos = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
@@ -864,6 +871,13 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
         if (IS_ERR(dst))
                 return PTR_ERR(dst);
 
+        if (skb_dst(skb)) {
+                int mtu = dst_mtu(dst) - sizeof(struct ipv6hdr) -
+                          GENEVE_BASE_HLEN - info->options_len - 14;
+
+                skb_dst_update_pmtu(skb, mtu);
+        }
+
         sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
         if (geneve->collect_md) {
                 prio = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
index 8483f03d5a41..1ab97d99b9ba 100644
--- a/drivers/net/hippi/rrunner.c
+++ b/drivers/net/hippi/rrunner.c
@@ -1379,8 +1379,8 @@ static int rr_close(struct net_device *dev)
                             rrpriv->info_dma);
         rrpriv->info = NULL;
 
-        free_irq(pdev->irq, dev);
         spin_unlock_irqrestore(&rrpriv->lock, flags);
+        free_irq(pdev->irq, dev);
 
         return 0;
 }
diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index 11c1e7950fe5..77cc4fbaeace 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -393,6 +393,7 @@ static int ipvlan_process_v4_outbound(struct sk_buff *skb)
                 .flowi4_oif = dev->ifindex,
                 .flowi4_tos = RT_TOS(ip4h->tos),
                 .flowi4_flags = FLOWI_FLAG_ANYSRC,
+                .flowi4_mark = skb->mark,
                 .daddr = ip4h->daddr,
                 .saddr = ip4h->saddr,
         };
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index a178c5efd33e..a0f2be81d52e 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1444,9 +1444,14 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
         return 0;
 
 unregister_netdev:
+        /* macvlan_uninit would free the macvlan port */
         unregister_netdevice(dev);
+        return err;
 destroy_macvlan_port:
-        if (create)
+        /* the macvlan port may be freed by macvlan_uninit when fail to register.
+         * so we destroy the macvlan port only when it's valid.
+         */
+        if (create && macvlan_port_get_rtnl(dev))
                 macvlan_port_destroy(port->dev);
         return err;
 }
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index 5f93e6add563..e911e4990b20 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -239,14 +239,10 @@ static int at803x_resume(struct phy_device *phydev)
 {
         int value;
 
-        mutex_lock(&phydev->lock);
-
         value = phy_read(phydev, MII_BMCR);
         value &= ~(BMCR_PDOWN | BMCR_ISOLATE);
         phy_write(phydev, MII_BMCR, value);
 
-        mutex_unlock(&phydev->lock);
-
         return 0;
 }
 
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 4d02b27df044..82104edca393 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -637,6 +637,10 @@ static int m88e1510_config_aneg(struct phy_device *phydev)
         if (err < 0)
                 goto error;
 
+        /* Do not touch the fiber page if we're in copper->sgmii mode */
+        if (phydev->interface == PHY_INTERFACE_MODE_SGMII)
+                return 0;
+
         /* Then the fiber link */
         err = marvell_set_page(phydev, MII_MARVELL_FIBER_PAGE);
         if (err < 0)
@@ -875,6 +879,8 @@ static int m88e1510_config_init(struct phy_device *phydev)
 
         /* SGMII-to-Copper mode initialization */
         if (phydev->interface == PHY_INTERFACE_MODE_SGMII) {
+                u32 pause;
+
                 /* Select page 18 */
                 err = marvell_set_page(phydev, 18);
                 if (err < 0)
@@ -898,6 +904,16 @@ static int m88e1510_config_init(struct phy_device *phydev)
                 err = marvell_set_page(phydev, MII_MARVELL_COPPER_PAGE);
                 if (err < 0)
                         return err;
+
+                /* There appears to be a bug in the 88e1512 when used in
+                 * SGMII to copper mode, where the AN advertisment register
+                 * clears the pause bits each time a negotiation occurs.
+                 * This means we can never be truely sure what was advertised,
+                 * so disable Pause support.
+                 */
+                pause = SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+                phydev->supported &= ~pause;
+                phydev->advertising &= ~pause;
         }
 
         return m88e1121_config_init(phydev);
@@ -2069,7 +2085,7 @@ static struct phy_driver marvell_drivers[] = {
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
                 .config_init = &m88e1145_config_init,
-                .config_aneg = &marvell_config_aneg,
+                .config_aneg = &m88e1101_config_aneg,
                 .read_status = &genphy_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
                 .config_intr = &marvell_config_intr,
diff --git a/drivers/net/phy/mdio-sun4i.c b/drivers/net/phy/mdio-sun4i.c
index 135296508a7e..6425ce04d3f9 100644
--- a/drivers/net/phy/mdio-sun4i.c
+++ b/drivers/net/phy/mdio-sun4i.c
@@ -118,8 +118,10 @@ static int sun4i_mdio_probe(struct platform_device *pdev)
 
         data->regulator = devm_regulator_get(&pdev->dev, "phy");
         if (IS_ERR(data->regulator)) {
-                if (PTR_ERR(data->regulator) == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
+                if (PTR_ERR(data->regulator) == -EPROBE_DEFER) {
+                        ret = -EPROBE_DEFER;
+                        goto err_out_free_mdiobus;
+                }
 
                 dev_info(&pdev->dev, "no regulator found\n");
                 data->regulator = NULL;
diff --git a/drivers/net/phy/mdio-xgene.c b/drivers/net/phy/mdio-xgene.c
index bfd3090fb055..07c6048200c6 100644
--- a/drivers/net/phy/mdio-xgene.c
+++ b/drivers/net/phy/mdio-xgene.c
@@ -194,8 +194,11 @@ static int xgene_mdio_reset(struct xgene_mdio_pdata *pdata)
         }
 
         ret = xgene_enet_ecc_init(pdata);
-        if (ret)
+        if (ret) {
+                if (pdata->dev->of_node)
+                        clk_disable_unprepare(pdata->clk);
                 return ret;
+        }
         xgene_gmac_reset(pdata);
 
         return 0;
@@ -388,8 +391,10 @@ static int xgene_mdio_probe(struct platform_device *pdev)
                 return ret;
 
         mdio_bus = mdiobus_alloc();
-        if (!mdio_bus)
-                return -ENOMEM;
+        if (!mdio_bus) {
+                ret = -ENOMEM;
+                goto out_clk;
+        }
 
         mdio_bus->name = "APM X-Gene MDIO bus";
 
@@ -418,7 +423,7 @@ static int xgene_mdio_probe(struct platform_device *pdev)
                 mdio_bus->phy_mask = ~0;
                 ret = mdiobus_register(mdio_bus);
                 if (ret)
-                        goto out;
+                        goto out_mdiobus;
 
                 acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_HANDLE(dev), 1,
                                     acpi_register_phy, NULL, mdio_bus, NULL);
@@ -426,16 +431,20 @@ static int xgene_mdio_probe(struct platform_device *pdev)
         }
 
         if (ret)
-                goto out;
+                goto out_mdiobus;
 
         pdata->mdio_bus = mdio_bus;
         xgene_mdio_status = true;
 
         return 0;
 
-out:
+out_mdiobus:
         mdiobus_free(mdio_bus);
 
+out_clk:
+        if (dev->of_node)
+                clk_disable_unprepare(pdata->clk);
+
         return ret;
 }
 
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 2df7b62c1a36..54d00a1d2bef 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -270,6 +270,7 @@ static void of_mdiobus_link_mdiodev(struct mii_bus *bus,
 
                 if (addr == mdiodev->addr) {
                         dev->of_node = child;
+                        dev->fwnode = of_fwnode_handle(child);
                         return;
                 }
         }
diff --git a/drivers/net/phy/meson-gxl.c b/drivers/net/phy/meson-gxl.c
index 1ea69b7585d9..842eb871a6e3 100644
--- a/drivers/net/phy/meson-gxl.c
+++ b/drivers/net/phy/meson-gxl.c
@@ -22,6 +22,7 @@
 #include <linux/ethtool.h>
 #include <linux/phy.h>
 #include <linux/netdevice.h>
+#include <linux/bitfield.h>
 
 static int meson_gxl_config_init(struct phy_device *phydev)
 {
@@ -50,6 +51,77 @@ static int meson_gxl_config_init(struct phy_device *phydev)
         return 0;
 }
 
+/* This function is provided to cope with the possible failures of this phy
+ * during aneg process. When aneg fails, the PHY reports that aneg is done
+ * but the value found in MII_LPA is wrong:
+ *  - Early failures: MII_LPA is just 0x0001. if MII_EXPANSION reports that
+ *    the link partner (LP) supports aneg but the LP never acked our base
+ *    code word, it is likely that we never sent it to begin with.
+ *  - Late failures: MII_LPA is filled with a value which seems to make sense
+ *    but it actually is not what the LP is advertising. It seems that we
+ *    can detect this using a magic bit in the WOL bank (reg 12 - bit 12).
+ *    If this particular bit is not set when aneg is reported being done,
+ *    it means MII_LPA is likely to be wrong.
+ *
+ * In both case, forcing a restart of the aneg process solve the problem.
+ * When this failure happens, the first retry is usually successful but,
+ * in some cases, it may take up to 6 retries to get a decent result
+ */
+static int meson_gxl_read_status(struct phy_device *phydev)
+{
+        int ret, wol, lpa, exp;
+
+        if (phydev->autoneg == AUTONEG_ENABLE) {
+                ret = genphy_aneg_done(phydev);
+                if (ret < 0)
+                        return ret;
+                else if (!ret)
+                        goto read_status_continue;
+
+                /* Need to access WOL bank, make sure the access is open */
+                ret = phy_write(phydev, 0x14, 0x0000);
+                if (ret)
+                        return ret;
+                ret = phy_write(phydev, 0x14, 0x0400);
+                if (ret)
+                        return ret;
+                ret = phy_write(phydev, 0x14, 0x0000);
+                if (ret)
+                        return ret;
+                ret = phy_write(phydev, 0x14, 0x0400);
+                if (ret)
+                        return ret;
+
+                /* Request LPI_STATUS WOL register */
+                ret = phy_write(phydev, 0x14, 0x8D80);
+                if (ret)
+                        return ret;
+
+                /* Read LPI_STATUS value */
+                wol = phy_read(phydev, 0x15);
+                if (wol < 0)
+                        return wol;
+
+                lpa = phy_read(phydev, MII_LPA);
+                if (lpa < 0)
+                        return lpa;
+
+                exp = phy_read(phydev, MII_EXPANSION);
+                if (exp < 0)
+                        return exp;
+
+                if (!(wol & BIT(12)) ||
+                    ((exp & EXPANSION_NWAY) && !(lpa & LPA_LPACK))) {
+                        /* Looks like aneg failed after all */
+                        phydev_dbg(phydev, "LPA corruption - aneg restart\n");
+                        return genphy_restart_aneg(phydev);
+                }
+        }
+
+read_status_continue:
+        return genphy_read_status(phydev);
+}
+
 static struct phy_driver meson_gxl_phy[] = {
         {
                 .phy_id         = 0x01814400,
@@ -60,7 +132,7 @@ static struct phy_driver meson_gxl_phy[] = {
                 .config_init    = meson_gxl_config_init,
                 .config_aneg    = genphy_config_aneg,
                 .aneg_done      = genphy_aneg_done,
-                .read_status    = genphy_read_status,
+                .read_status    = meson_gxl_read_status,
                 .suspend        = genphy_suspend,
                 .resume         = genphy_resume,
         },
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index fdb43dd9b5cd..422ff6333c52 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -496,16 +496,18 @@ static int ksz9031_of_load_skew_values(struct phy_device *phydev,
         return ksz9031_extended_write(phydev, OP_DATA, 2, reg, newval);
 }
 
+/* Center KSZ9031RNX FLP timing at 16ms. */
 static int ksz9031_center_flp_timing(struct phy_device *phydev)
 {
         int result;
 
-        /* Center KSZ9031RNX FLP timing at 16ms. */
         result = ksz9031_extended_write(phydev, OP_DATA, 0,
                                         MII_KSZ9031RN_FLP_BURST_TX_HI, 0x0006);
+        if (result)
+                return result;
+
         result = ksz9031_extended_write(phydev, OP_DATA, 0,
                                         MII_KSZ9031RN_FLP_BURST_TX_LO, 0x1A80);
-
         if (result)
                 return result;
 
@@ -622,6 +624,7 @@ static int ksz9031_read_status(struct phy_device *phydev)
                 phydev->link = 0;
                 if (phydev->drv->config_intr && phy_interrupt_is_valid(phydev))
                         phydev->drv->config_intr(phydev);
+                return genphy_config_aneg(phydev);
         }
 
         return 0;
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 2b1e67bc1e73..ed10d1fc8f59 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -828,7 +828,6 @@ EXPORT_SYMBOL(phy_stop);
  */
 void phy_start(struct phy_device *phydev)
 {
-        bool do_resume = false;
         int err = 0;
 
         mutex_lock(&phydev->lock);
@@ -841,6 +840,9 @@ void phy_start(struct phy_device *phydev)
                 phydev->state = PHY_UP;
                 break;
         case PHY_HALTED:
+                /* if phy was suspended, bring the physical link up again */
+                phy_resume(phydev);
+
                 /* make sure interrupts are re-enabled for the PHY */
                 if (phydev->irq != PHY_POLL) {
                         err = phy_enable_interrupts(phydev);
@@ -849,17 +851,12 @@ void phy_start(struct phy_device *phydev)
                 }
 
                 phydev->state = PHY_RESUMING;
-                do_resume = true;
                 break;
         default:
                 break;
         }
         mutex_unlock(&phydev->lock);
 
-        /* if phy was suspended, bring the physical link up again */
-        if (do_resume)
-                phy_resume(phydev);
-
         phy_trigger_machine(phydev, true);
 }
 EXPORT_SYMBOL(phy_start);
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 67f25ac29025..b15b31ca2618 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -135,7 +135,9 @@ static int mdio_bus_phy_resume(struct device *dev)
         if (!mdio_bus_phy_may_suspend(phydev))
                 goto no_resume;
 
+        mutex_lock(&phydev->lock);
         ret = phy_resume(phydev);
+        mutex_unlock(&phydev->lock);
         if (ret < 0)
                 return ret;
 
@@ -1026,7 +1028,9 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
         if (err)
                 goto error;
 
+        mutex_lock(&phydev->lock);
         phy_resume(phydev);
+        mutex_unlock(&phydev->lock);
         phy_led_triggers_register(phydev);
 
         return err;
@@ -1157,6 +1161,8 @@ int phy_resume(struct phy_device *phydev)
         struct phy_driver *phydrv = to_phy_driver(phydev->mdio.dev.driver);
         int ret = 0;
 
+        WARN_ON(!mutex_is_locked(&phydev->lock));
+
         if (phydev->drv && phydrv->resume)
                 ret = phydrv->resume(phydev);
 
@@ -1639,13 +1645,9 @@ int genphy_resume(struct phy_device *phydev)
 {
         int value;
 
-        mutex_lock(&phydev->lock);
-
         value = phy_read(phydev, MII_BMCR);
         phy_write(phydev, MII_BMCR, value & ~BMCR_PDOWN);
 
-        mutex_unlock(&phydev->lock);
-
         return 0;
 }
 EXPORT_SYMBOL(genphy_resume);
diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index e3bbc70372d3..249ce5cbea22 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -526,6 +526,7 @@ struct phylink *phylink_create(struct net_device *ndev, struct device_node *np,
         pl->link_config.pause = MLO_PAUSE_AN;
         pl->link_config.speed = SPEED_UNKNOWN;
         pl->link_config.duplex = DUPLEX_UNKNOWN;
+        pl->link_config.an_enabled = true;
         pl->ops = ops;
         __set_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state);
 
@@ -773,6 +774,7 @@ void phylink_stop(struct phylink *pl)
                 sfp_upstream_stop(pl->sfp_bus);
 
         set_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state);
+        queue_work(system_power_efficient_wq, &pl->resolve);
         flush_work(&pl->resolve);
 }
 EXPORT_SYMBOL_GPL(phylink_stop);
@@ -950,6 +952,7 @@ int phylink_ethtool_ksettings_set(struct phylink *pl,
         mutex_lock(&pl->state_mutex);
         /* Configure the MAC to match the new settings */
         linkmode_copy(pl->link_config.advertising, our_kset.link_modes.advertising);
+        pl->link_config.interface = config.interface;
         pl->link_config.speed = our_kset.base.speed;
         pl->link_config.duplex = our_kset.base.duplex;
         pl->link_config.an_enabled = our_kset.base.autoneg != AUTONEG_DISABLE;
@@ -1293,6 +1296,7 @@ int phylink_mii_ioctl(struct phylink *pl, struct ifreq *ifr, int cmd)
                 switch (cmd) {
                 case SIOCGMIIPHY:
                         mii->phy_id = pl->phydev->mdio.addr;
+                        /* fall through */
 
                 case SIOCGMIIREG:
                         ret = phylink_phy_read(pl, mii->phy_id, mii->reg_num);
@@ -1315,6 +1319,7 @@ int phylink_mii_ioctl(struct phylink *pl, struct ifreq *ifr, int cmd)
                 switch (cmd) {
                 case SIOCGMIIPHY:
                         mii->phy_id = 0;
+                        /* fall through */
 
                 case SIOCGMIIREG:
                         ret = phylink_mii_read(pl, mii->phy_id, mii->reg_num);
@@ -1426,9 +1431,8 @@ static void phylink_sfp_link_down(void *upstream)
         WARN_ON(!lockdep_rtnl_is_held());
 
         set_bit(PHYLINK_DISABLE_LINK, &pl->phylink_disable_state);
+        queue_work(system_power_efficient_wq, &pl->resolve);
         flush_work(&pl->resolve);
-
-        netif_carrier_off(pl->netdev);
 }
 
 static void phylink_sfp_link_up(void *upstream)
diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
index 8a1b1f4c1b7c..ab64a142b832 100644
--- a/drivers/net/phy/sfp-bus.c
+++ b/drivers/net/phy/sfp-bus.c
@@ -356,7 +356,8 @@ EXPORT_SYMBOL_GPL(sfp_register_upstream);
 void sfp_unregister_upstream(struct sfp_bus *bus)
 {
         rtnl_lock();
-        sfp_unregister_bus(bus);
+        if (bus->sfp)
+                sfp_unregister_bus(bus);
         bus->upstream = NULL;
         bus->netdev = NULL;
         rtnl_unlock();
@@ -459,7 +460,8 @@ EXPORT_SYMBOL_GPL(sfp_register_socket);
 void sfp_unregister_socket(struct sfp_bus *bus)
 {
         rtnl_lock();
-        sfp_unregister_bus(bus);
+        if (bus->netdev)
+                sfp_unregister_bus(bus);
         bus->sfp_dev = NULL;
         bus->sfp = NULL;
         bus->socket_ops = NULL;
diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index e381811e5f11..9dfc1c4c954f 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -351,12 +351,13 @@ static void sfp_sm_link_check_los(struct sfp *sfp)
 {
         unsigned int los = sfp->state & SFP_F_LOS;
 
-        /* FIXME: what if neither SFP_OPTIONS_LOS_INVERTED nor
-         * SFP_OPTIONS_LOS_NORMAL are set?  For now, we assume
-         * the same as SFP_OPTIONS_LOS_NORMAL set.
+        /* If neither SFP_OPTIONS_LOS_INVERTED nor SFP_OPTIONS_LOS_NORMAL
+         * are set, we assume that no LOS signal is available.
          */
-        if (sfp->id.ext.options & SFP_OPTIONS_LOS_INVERTED)
+        if (sfp->id.ext.options & cpu_to_be16(SFP_OPTIONS_LOS_INVERTED))
                 los ^= SFP_F_LOS;
+        else if (!(sfp->id.ext.options & cpu_to_be16(SFP_OPTIONS_LOS_NORMAL)))
+                los = 0;
 
         if (los)
                 sfp_sm_next(sfp, SFP_S_WAIT_LOS, 0);
@@ -364,6 +365,22 @@ static void sfp_sm_link_check_los(struct sfp *sfp)
                 sfp_sm_link_up(sfp);
 }
 
+static bool sfp_los_event_active(struct sfp *sfp, unsigned int event)
+{
+        return (sfp->id.ext.options & cpu_to_be16(SFP_OPTIONS_LOS_INVERTED) &&
+                event == SFP_E_LOS_LOW) ||
+               (sfp->id.ext.options & cpu_to_be16(SFP_OPTIONS_LOS_NORMAL) &&
+                event == SFP_E_LOS_HIGH);
+}
+
+static bool sfp_los_event_inactive(struct sfp *sfp, unsigned int event)
+{
+        return (sfp->id.ext.options & cpu_to_be16(SFP_OPTIONS_LOS_INVERTED) &&
+                event == SFP_E_LOS_HIGH) ||
+               (sfp->id.ext.options & cpu_to_be16(SFP_OPTIONS_LOS_NORMAL) &&
+                event == SFP_E_LOS_LOW);
+}
+
 static void sfp_sm_fault(struct sfp *sfp, bool warn)
 {
         if (sfp->sm_retries && !--sfp->sm_retries) {
@@ -470,6 +487,11 @@ static int sfp_sm_mod_probe(struct sfp *sfp)
                 return -EINVAL;
         }
 
+        /* If the module requires address swap mode, warn about it */
+        if (sfp->id.ext.diagmon & SFP_DIAGMON_ADDRMODE)
+                dev_warn(sfp->dev,
+                         "module address swap to access page 0xA2 is not supported.\n");
+
         return sfp_module_insert(sfp->sfp_bus, &sfp->id);
 }
 
@@ -581,9 +603,7 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event)
         case SFP_S_WAIT_LOS:
                 if (event == SFP_E_TX_FAULT)
                         sfp_sm_fault(sfp, true);
-                else if (event ==
-                         (sfp->id.ext.options & SFP_OPTIONS_LOS_INVERTED ?
-                          SFP_E_LOS_HIGH : SFP_E_LOS_LOW))
+                else if (sfp_los_event_inactive(sfp, event))
                         sfp_sm_link_up(sfp);
                 break;
 
@@ -591,9 +611,7 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event)
                 if (event == SFP_E_TX_FAULT) {
                         sfp_sm_link_down(sfp);
                         sfp_sm_fault(sfp, true);
-                } else if (event ==
-                           (sfp->id.ext.options & SFP_OPTIONS_LOS_INVERTED ?
-                            SFP_E_LOS_LOW : SFP_E_LOS_HIGH)) {
+                } else if (sfp_los_event_active(sfp, event)) {
                         sfp_sm_link_down(sfp);
                         sfp_sm_next(sfp, SFP_S_WAIT_LOS, 0);
                 }
@@ -639,7 +657,8 @@ static int sfp_module_info(struct sfp *sfp, struct ethtool_modinfo *modinfo)
 {
         /* locking... and check module is present */
 
-        if (sfp->id.ext.sff8472_compliance) {
+        if (sfp->id.ext.sff8472_compliance &&
+            !(sfp->id.ext.diagmon & SFP_DIAGMON_ADDRMODE)) {
                 modinfo->type = ETH_MODULE_SFF_8472;
                 modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
         } else {
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index d8e5747ff4e3..264d4af0bf69 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -1006,17 +1006,18 @@ static int ppp_unit_register(struct ppp *ppp, int unit, bool ifname_is_set)
         if (!ifname_is_set)
                 snprintf(ppp->dev->name, IFNAMSIZ, "ppp%i", ppp->file.index);
 
+        mutex_unlock(&pn->all_ppp_mutex);
+
         ret = register_netdevice(ppp->dev);
         if (ret < 0)
                 goto err_unit;
 
         atomic_inc(&ppp_unit_count);
 
-        mutex_unlock(&pn->all_ppp_mutex);
-
         return 0;
 
 err_unit:
+        mutex_lock(&pn->all_ppp_mutex);
         unit_put(&pn->units_idr, ppp->file.index);
 err:
         mutex_unlock(&pn->all_ppp_mutex);
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 4e1da1645b15..5aa59f41bf8c 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -842,6 +842,7 @@ static int pppoe_sendmsg(struct socket *sock, struct msghdr *m,
         struct pppoe_hdr *ph;
         struct net_device *dev;
         char *start;
+        int hlen;
 
         lock_sock(sk);
         if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) {
@@ -860,16 +861,16 @@ static int pppoe_sendmsg(struct socket *sock, struct msghdr *m,
         if (total_len > (dev->mtu + dev->hard_header_len))
                 goto end;
 
-
-        skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32,
-                           0, GFP_KERNEL);
+        hlen = LL_RESERVED_SPACE(dev);
+        skb = sock_wmalloc(sk, hlen + sizeof(*ph) + total_len +
+                           dev->needed_tailroom, 0, GFP_KERNEL);
         if (!skb) {
                 error = -ENOMEM;
                 goto end;
         }
 
         /* Reserve space for headers. */
-        skb_reserve(skb, dev->hard_header_len);
+        skb_reserve(skb, hlen);
         skb_reset_network_header(skb);
 
         skb->dev = dev;
@@ -930,7 +931,7 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
         /* Copy the data if there is no space for the header or if it's
          * read-only.
          */
-        if (skb_cow_head(skb, sizeof(*ph) + dev->hard_header_len))
+        if (skb_cow_head(skb, LL_RESERVED_SPACE(dev) + sizeof(*ph)))
                 goto abort;
 
         __skb_push(skb, sizeof(*ph));
diff --git a/drivers/net/tap.c b/drivers/net/tap.c
index e9489b88407c..0a886fda0129 100644
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -829,8 +829,11 @@ static ssize_t tap_do_read(struct tap_queue *q,
         DEFINE_WAIT(wait);
         ssize_t ret = 0;
 
-        if (!iov_iter_count(to))
+        if (!iov_iter_count(to)) {
+                if (skb)
+                        kfree_skb(skb);
                 return 0;
+        }
 
         if (skb)
                 goto put;
@@ -1154,11 +1157,14 @@ static int tap_recvmsg(struct socket *sock, struct msghdr *m,
                        size_t total_len, int flags)
 {
         struct tap_queue *q = container_of(sock, struct tap_queue, sock);
+        struct sk_buff *skb = m->msg_control;
         int ret;
-        if (flags & ~(MSG_DONTWAIT|MSG_TRUNC))
+        if (flags & ~(MSG_DONTWAIT|MSG_TRUNC)) {
+                if (skb)
+                        kfree_skb(skb);
                 return -EINVAL;
-        ret = tap_do_read(q, &m->msg_iter, flags & MSG_DONTWAIT,
-                          m->msg_control);
+        }
+        ret = tap_do_read(q, &m->msg_iter, flags & MSG_DONTWAIT, skb);
         if (ret > total_len) {
                 m->msg_flags |= MSG_TRUNC;
                 ret = flags & MSG_TRUNC ? ret : total_len;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 95749006d687..a8ec589d1359 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -611,6 +611,14 @@ static void tun_queue_purge(struct tun_file *tfile)
         skb_queue_purge(&tfile->sk.sk_error_queue);
 }
 
+static void tun_cleanup_tx_array(struct tun_file *tfile)
+{
+        if (tfile->tx_array.ring.queue) {
+                skb_array_cleanup(&tfile->tx_array);
+                memset(&tfile->tx_array, 0, sizeof(tfile->tx_array));
+        }
+}
+
 static void __tun_detach(struct tun_file *tfile, bool clean)
 {
         struct tun_file *ntfile;
@@ -657,8 +665,7 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
                             tun->dev->reg_state == NETREG_REGISTERED)
                                 unregister_netdevice(tun->dev);
                 }
-                if (tun)
-                        skb_array_cleanup(&tfile->tx_array);
+                tun_cleanup_tx_array(tfile);
                 sock_put(&tfile->sk);
         }
 }
@@ -700,11 +707,13 @@ static void tun_detach_all(struct net_device *dev)
                 /* Drop read queue */
                 tun_queue_purge(tfile);
                 sock_put(&tfile->sk);
+                tun_cleanup_tx_array(tfile);
         }
         list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
                 tun_enable_queue(tfile);
                 tun_queue_purge(tfile);
                 sock_put(&tfile->sk);
+                tun_cleanup_tx_array(tfile);
         }
         BUG_ON(tun->numdisabled != 0);
 
@@ -1952,8 +1961,11 @@ static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile,
 
         tun_debug(KERN_INFO, tun, "tun_do_read\n");
 
-        if (!iov_iter_count(to))
+        if (!iov_iter_count(to)) {
+                if (skb)
+                        kfree_skb(skb);
                 return 0;
+        }
 
         if (!skb) {
                 /* Read frames from ring */
@@ -2069,22 +2081,24 @@ static int tun_recvmsg(struct socket *sock, struct msghdr *m, size_t total_len,
 {
         struct tun_file *tfile = container_of(sock, struct tun_file, socket);
         struct tun_struct *tun = tun_get(tfile);
+        struct sk_buff *skb = m->msg_control;
         int ret;
 
-        if (!tun)
-                return -EBADFD;
+        if (!tun) {
+                ret = -EBADFD;
+                goto out_free_skb;
+        }
 
         if (flags & ~(MSG_DONTWAIT|MSG_TRUNC|MSG_ERRQUEUE)) {
                 ret = -EINVAL;
-                goto out;
+                goto out_put_tun;
         }
         if (flags & MSG_ERRQUEUE) {
                 ret = sock_recv_errqueue(sock->sk, m, total_len,
                                          SOL_PACKET, TUN_TX_TIMESTAMP);
                 goto out;
         }
-        ret = tun_do_read(tun, tfile, &m->msg_iter, flags & MSG_DONTWAIT,
-                          m->msg_control);
+        ret = tun_do_read(tun, tfile, &m->msg_iter, flags & MSG_DONTWAIT, skb);
         if (ret > (ssize_t)total_len) {
                 m->msg_flags |= MSG_TRUNC;
                 ret = flags & MSG_TRUNC ? ret : total_len;
@@ -2092,6 +2106,13 @@ static int tun_recvmsg(struct socket *sock, struct msghdr *m, size_t total_len,
 out:
         tun_put(tun);
         return ret;
+
+out_put_tun:
+        tun_put(tun);
+out_free_skb:
+        if (skb)
+                kfree_skb(skb);
+        return ret;
 }
 
 static int tun_peek_len(struct socket *sock)
@@ -2839,6 +2860,8 @@ static int tun_chr_open(struct inode *inode, struct file * file)
 
         sock_set_flag(&tfile->sk, SOCK_ZEROCOPY);
 
+        memset(&tfile->tx_array, 0, sizeof(tfile->tx_array));
+
         return 0;
 }
 
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 94c7804903c4..ec56ff29aac4 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2396,6 +2396,7 @@ static int lan78xx_reset(struct lan78xx_net *dev)
                 buf = DEFAULT_BURST_CAP_SIZE / FS_USB_PKT_SIZE;
                 dev->rx_urb_size = DEFAULT_BURST_CAP_SIZE;
                 dev->rx_qlen = 4;
+                dev->tx_qlen = 4;
         }
 
         ret = lan78xx_write_reg(dev, BURST_CAP, buf);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index c750cf7c042b..728819feab44 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -261,9 +261,11 @@ static void qmi_wwan_netdev_setup(struct net_device *net)
                 net->hard_header_len = 0;
                 net->addr_len        = 0;
                 net->flags           = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
+                set_bit(EVENT_NO_IP_ALIGN, &dev->flags);
                 netdev_dbg(net, "mode: raw IP\n");
         } else if (!net->header_ops) { /* don't bother if already set */
                 ether_setup(net);
+                clear_bit(EVENT_NO_IP_ALIGN, &dev->flags);
                 netdev_dbg(net, "mode: Ethernet\n");
         }
 
@@ -1098,6 +1100,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x05c6, 0x9084, 4)},
         {QMI_FIXED_INTF(0x05c6, 0x920d, 0)},
         {QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
+        {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */
         {QMI_FIXED_INTF(0x0846, 0x68a2, 8)},
         {QMI_FIXED_INTF(0x12d1, 0x140c, 1)},    /* Huawei E173 */
         {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},    /* Huawei E1820 */
@@ -1202,12 +1205,14 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x9079, 10)},   /* Sierra Wireless EM74xx */
         {QMI_FIXED_INTF(0x1199, 0x907b, 8)},    /* Sierra Wireless EM74xx */
         {QMI_FIXED_INTF(0x1199, 0x907b, 10)},   /* Sierra Wireless EM74xx */
+        {QMI_FIXED_INTF(0x1199, 0x9091, 8)},    /* Sierra Wireless EM7565 */
         {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
         {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
         {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
         {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
         {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
         {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)},    /* Telit ME910 */
+        {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)},    /* Telit ME910 dual modem */
         {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
         {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
         {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)},    /* Telewell TW-3G HSPA+ */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index d51d9abf7986..0657203ffb91 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -606,6 +606,7 @@ enum rtl8152_flags {
         PHY_RESET,
         SCHEDULE_NAPI,
         GREEN_ETHERNET,
+        DELL_TB_RX_AGG_BUG,
 };
 
 /* Define these values to match your device */
@@ -1798,6 +1799,9 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
                 dev_kfree_skb_any(skb);
 
                 remain = agg_buf_sz - (int)(tx_agg_align(tx_data) - agg->head);
+
+                if (test_bit(DELL_TB_RX_AGG_BUG, &tp->flags))
+                        break;
         }
 
         if (!skb_queue_empty(&skb_head)) {
@@ -4133,6 +4137,9 @@ static void r8153_init(struct r8152 *tp)
         /* rx aggregation */
         ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_USB_CTRL);
         ocp_data &= ~(RX_AGG_DISABLE | RX_ZERO_EN);
+        if (test_bit(DELL_TB_RX_AGG_BUG, &tp->flags))
+                ocp_data |= RX_AGG_DISABLE;
+
         ocp_write_word(tp, MCU_TYPE_USB, USB_USB_CTRL, ocp_data);
 
         rtl_tally_reset(tp);
@@ -5207,6 +5214,12 @@ static int rtl8152_probe(struct usb_interface *intf,
                 netdev->hw_features &= ~NETIF_F_RXCSUM;
         }
 
+        if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x3011 &&
+            udev->serial && !strcmp(udev->serial, "000001000000")) {
+                dev_info(&udev->dev, "Dell TB16 Dock, disable RX aggregation");
+                set_bit(DELL_TB_RX_AGG_BUG, &tp->flags);
+        }
+
         netdev->ethtool_ops = &ops;
         netif_set_gso_max_size(netdev, RTL_LIMITED_TSO_SIZE);
 
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 80348b6a8646..8a22ff67b026 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -457,12 +457,10 @@ static enum skb_state defer_bh(struct usbnet *dev, struct sk_buff *skb,
 void usbnet_defer_kevent (struct usbnet *dev, int work)
 {
         set_bit (work, &dev->flags);
-        if (!schedule_work (&dev->kevent)) {
-                if (net_ratelimit())
-                        netdev_err(dev->net, "kevent %d may have been dropped\n", work);
-        } else {
+        if (!schedule_work (&dev->kevent))
+                netdev_dbg(dev->net, "kevent %d may have been dropped\n", work);
+        else
                 netdev_dbg(dev->net, "kevent %d scheduled\n", work);
-        }
 }
 EXPORT_SYMBOL_GPL(usbnet_defer_kevent);
 
@@ -484,7 +482,10 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
                 return -ENOLINK;
         }
 
-        skb = __netdev_alloc_skb_ip_align(dev->net, size, flags);
+        if (test_bit(EVENT_NO_IP_ALIGN, &dev->flags))
+                skb = __netdev_alloc_skb(dev->net, size, flags);
+        else
+                skb = __netdev_alloc_skb_ip_align(dev->net, size, flags);
         if (!skb) {
                 netif_dbg(dev, rx_err, dev->net, "no rx skb\n");
                 usbnet_defer_kevent (dev, EVENT_RX_MEMORY);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 19a985ef9104..559b215c0169 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -756,7 +756,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                 int num_skb_frags;
 
                 buf = virtqueue_get_buf_ctx(rq->vq, &len, &ctx);
-                if (unlikely(!ctx)) {
+                if (unlikely(!buf)) {
                         pr_debug("%s: rx error: %d buffers out of %d missing\n",
                                  dev->name, num_buf,
                                  virtio16_to_cpu(vi->vdev,
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index d1c7029ded7c..cf95290b160c 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1616,7 +1616,6 @@ static void vmxnet3_rq_destroy(struct vmxnet3_rx_queue *rq,
                                           rq->rx_ring[i].basePA);
                         rq->rx_ring[i].base = NULL;
                 }
-                rq->buf_info[i] = NULL;
         }
 
         if (rq->data_ring.base) {
@@ -1638,6 +1637,7 @@ static void vmxnet3_rq_destroy(struct vmxnet3_rx_queue *rq,
                         (rq->rx_ring[0].size + rq->rx_ring[1].size);
                 dma_free_coherent(&adapter->pdev->dev, sz, rq->buf_info[0],
                                   rq->buf_info_pa);
+                rq->buf_info[0] = rq->buf_info[1] = NULL;
         }
 }
 
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index feb1b2e15c2e..139c61c8244a 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -673,8 +673,9 @@ static struct sk_buff *vrf_ip_out(struct net_device *vrf_dev,
                                   struct sock *sk,
                                   struct sk_buff *skb)
 {
-        /* don't divert multicast */
-        if (ipv4_is_multicast(ip_hdr(skb)->daddr))
+        /* don't divert multicast or local broadcast */
+        if (ipv4_is_multicast(ip_hdr(skb)->daddr) ||
+            ipv4_is_lbcast(ip_hdr(skb)->daddr))
                 return skb;
 
         if (qdisc_tx_is_default(vrf_dev))
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 19b9cc51079e..c3e34e3c82a7 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2155,6 +2155,12 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 }
 
                 ndst = &rt->dst;
+                if (skb_dst(skb)) {
+                        int mtu = dst_mtu(ndst) - VXLAN_HEADROOM;
+
+                        skb_dst_update_pmtu(skb, mtu);
+                }
+
                 tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
                 ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
                 err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),
@@ -2190,6 +2196,12 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                                 goto out_unlock;
                 }
 
+                if (skb_dst(skb)) {
+                        int mtu = dst_mtu(ndst) - VXLAN6_HEADROOM;
+
+                        skb_dst_update_pmtu(skb, mtu);
+                }
+
                 tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
                 ttl = ttl ? : ip6_dst_hoplimit(ndst);
                 skb_scrub_packet(skb, xnet);
@@ -3103,6 +3115,11 @@ static void vxlan_config_apply(struct net_device *dev,
 
                 max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM :
                                            VXLAN_HEADROOM);
+                if (max_mtu < ETH_MIN_MTU)
+                        max_mtu = ETH_MIN_MTU;
+
+                if (!changelink && !conf->mtu)
+                        dev->mtu = max_mtu;
         }
 
         if (dev->mtu > max_mtu)
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index f7d228b5ba93..987f1252a3cf 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -384,6 +384,18 @@ static int wcn36xx_config(struct ieee80211_hw *hw, u32 changed)
                 }
         }
 
+        if (changed & IEEE80211_CONF_CHANGE_PS) {
+                list_for_each_entry(tmp, &wcn->vif_list, list) {
+                        vif = wcn36xx_priv_to_vif(tmp);
+                        if (hw->conf.flags & IEEE80211_CONF_PS) {
+                                if (vif->bss_conf.ps) /* ps allowed ? */
+                                        wcn36xx_pmc_enter_bmps_state(wcn, vif);
+                        } else {
+                                wcn36xx_pmc_exit_bmps_state(wcn, vif);
+                        }
+                }
+        }
+
         mutex_unlock(&wcn->conf_mutex);
 
         return 0;
@@ -747,17 +759,6 @@ static void wcn36xx_bss_info_changed(struct ieee80211_hw *hw,
                 vif_priv->dtim_period = bss_conf->dtim_period;
         }
 
-        if (changed & BSS_CHANGED_PS) {
-                wcn36xx_dbg(WCN36XX_DBG_MAC,
-                            "mac bss PS set %d\n",
-                            bss_conf->ps);
-                if (bss_conf->ps) {
-                        wcn36xx_pmc_enter_bmps_state(wcn, vif);
-                } else {
-                        wcn36xx_pmc_exit_bmps_state(wcn, vif);
-                }
-        }
-
         if (changed & BSS_CHANGED_BSSID) {
                 wcn36xx_dbg(WCN36XX_DBG_MAC, "mac bss changed_bssid %pM\n",
                             bss_conf->bssid);
diff --git a/drivers/net/wireless/ath/wcn36xx/pmc.c b/drivers/net/wireless/ath/wcn36xx/pmc.c
index 589fe5f70971..1976b80c235f 100644
--- a/drivers/net/wireless/ath/wcn36xx/pmc.c
+++ b/drivers/net/wireless/ath/wcn36xx/pmc.c
@@ -45,8 +45,10 @@ int wcn36xx_pmc_exit_bmps_state(struct wcn36xx *wcn,
         struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif);
 
         if (WCN36XX_BMPS != vif_priv->pw_state) {
-                wcn36xx_err("Not in BMPS mode, no need to exit from BMPS mode!\n");
-                return -EINVAL;
+                /* Unbalanced call or last BMPS enter failed */
+                wcn36xx_dbg(WCN36XX_DBG_PMC,
+                            "Not in BMPS mode, no need to exit\n");
+                return -EALREADY;
         }
         wcn36xx_smd_exit_bmps(wcn, vif);
         vif_priv->pw_state = WCN36XX_FULL_POWER;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
index 6a59d0609d30..9be0b051066a 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
@@ -182,12 +182,9 @@ static int brcmf_c_process_clm_blob(struct brcmf_if *ifp)
 
         err = request_firmware(&clm, clm_name, dev);
         if (err) {
-                if (err == -ENOENT) {
-                        brcmf_dbg(INFO, "continue with CLM data currently present in firmware\n");
-                        return 0;
-                }
-                brcmf_err("request CLM blob file failed (%d)\n", err);
-                return err;
+                brcmf_info("no clm_blob available(err=%d), device may have limited channels available\n",
+                           err);
+                return 0;
         }
 
         chunk_buf = kzalloc(sizeof(*chunk_buf) + MAX_CHUNK_LEN - 1, GFP_KERNEL);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index 310c4e2746aa..cdf9e4161592 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -2070,7 +2070,7 @@ static int brcmf_sdio_txpkt_hdalign(struct brcmf_sdio *bus, struct sk_buff *pkt)
         return head_pad;
 }
 
-/**
+/*
  * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
  * bus layer usage.
  */
@@ -4121,8 +4121,8 @@ release:
         sdio_release_host(sdiodev->func[1]);
 fail:
         brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
-        device_release_driver(dev);
         device_release_driver(&sdiodev->func[2]->dev);
+        device_release_driver(dev);
 }
 
 struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/txq.h b/drivers/net/wireless/intel/iwlwifi/fw/api/txq.h
index 87b4434224a1..dfa111bb411e 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/txq.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/txq.h
@@ -68,6 +68,9 @@
  * @IWL_MVM_DQA_CMD_QUEUE: a queue reserved for sending HCMDs to the FW
  * @IWL_MVM_DQA_AUX_QUEUE: a queue reserved for aux frames
  * @IWL_MVM_DQA_P2P_DEVICE_QUEUE: a queue reserved for P2P device frames
+ * @IWL_MVM_DQA_INJECT_MONITOR_QUEUE: a queue reserved for injection using
+ *      monitor mode. Note this queue is the same as the queue for P2P device
+ *      but we can't have active monitor mode along with P2P device anyway.
  * @IWL_MVM_DQA_GCAST_QUEUE: a queue reserved for P2P GO/SoftAP GCAST frames
  * @IWL_MVM_DQA_BSS_CLIENT_QUEUE: a queue reserved for BSS activity, to ensure
  *      that we are never left without the possibility to connect to an AP.
@@ -87,6 +90,7 @@ enum iwl_mvm_dqa_txq {
         IWL_MVM_DQA_CMD_QUEUE = 0,
         IWL_MVM_DQA_AUX_QUEUE = 1,
         IWL_MVM_DQA_P2P_DEVICE_QUEUE = 2,
+        IWL_MVM_DQA_INJECT_MONITOR_QUEUE = 2,
         IWL_MVM_DQA_GCAST_QUEUE = 3,
         IWL_MVM_DQA_BSS_CLIENT_QUEUE = 4,
         IWL_MVM_DQA_MIN_MGMT_QUEUE = 5,
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
index 9c889a32fe24..223fb77a3aa9 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h
@@ -209,8 +209,6 @@ static inline void iwl_fw_dbg_stop_recording(struct iwl_fw_runtime *fwrt)
 
 static inline void iwl_fw_dump_conf_clear(struct iwl_fw_runtime *fwrt)
 {
-        iwl_fw_dbg_stop_recording(fwrt);
-
         fwrt->dump.conf = FW_DBG_INVALID;
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
index ca0b5536a8a6..921cab9e2d73 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
@@ -117,6 +117,7 @@
 #define FH_RSCSR_FRAME_INVALID          0x55550000
 #define FH_RSCSR_FRAME_ALIGN            0x40
 #define FH_RSCSR_RPA_EN                 BIT(25)
+#define FH_RSCSR_RADA_EN                BIT(26)
 #define FH_RSCSR_RXQ_POS                16
 #define FH_RSCSR_RXQ_MASK               0x3F0000
 
@@ -128,7 +129,8 @@ struct iwl_rx_packet {
          * 31:    flag flush RB request
          * 30:    flag ignore TC (terminal counter) request
          * 29:    flag fast IRQ request
-         * 28-26: Reserved
+         * 28-27: Reserved
+         * 26:    RADA enabled
          * 25:    Offload enabled
          * 24:    RPF enabled
          * 23:    RSS enabled
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index a2bf530eeae4..2f22e14e00fe 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -787,7 +787,7 @@ static int iwl_mvm_mac_ctxt_cmd_listener(struct iwl_mvm *mvm,
                                          u32 action)
 {
         struct iwl_mac_ctx_cmd cmd = {};
-        u32 tfd_queue_msk = 0;
+        u32 tfd_queue_msk = BIT(mvm->snif_queue);
         int ret;
 
         WARN_ON(vif->type != NL80211_IFTYPE_MONITOR);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 4575595ab022..55ab5349dd40 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -972,6 +972,7 @@ struct iwl_mvm {
 
         /* Tx queues */
         u16 aux_queue;
+        u16 snif_queue;
         u16 probe_queue;
         u16 p2p_dev_queue;
 
@@ -1060,6 +1061,7 @@ struct iwl_mvm {
  * @IWL_MVM_STATUS_ROC_AUX_RUNNING: AUX remain-on-channel is running
  * @IWL_MVM_STATUS_D3_RECONFIG: D3 reconfiguration is being done
  * @IWL_MVM_STATUS_FIRMWARE_RUNNING: firmware is running
+ * @IWL_MVM_STATUS_NEED_FLUSH_P2P: need to flush P2P bcast STA
  */
 enum iwl_mvm_status {
         IWL_MVM_STATUS_HW_RFKILL,
@@ -1071,6 +1073,7 @@ enum iwl_mvm_status {
         IWL_MVM_STATUS_ROC_AUX_RUNNING,
         IWL_MVM_STATUS_D3_RECONFIG,
         IWL_MVM_STATUS_FIRMWARE_RUNNING,
+        IWL_MVM_STATUS_NEED_FLUSH_P2P,
 };
 
 /* Keep track of completed init configuration */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 7078b7e458be..45470b6b351a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -624,6 +624,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         mvm->fw_restart = iwlwifi_mod_params.fw_restart ? -1 : 0;
 
         mvm->aux_queue = IWL_MVM_DQA_AUX_QUEUE;
+        mvm->snif_queue = IWL_MVM_DQA_INJECT_MONITOR_QUEUE;
         mvm->probe_queue = IWL_MVM_DQA_AP_PROBE_RESP_QUEUE;
         mvm->p2p_dev_queue = IWL_MVM_DQA_P2P_DEVICE_QUEUE;
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 76dc58381e1c..3b8d44361380 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -213,6 +213,7 @@ static void iwl_mvm_get_signal_strength(struct iwl_mvm *mvm,
                                         struct ieee80211_rx_status *rx_status)
 {
         int energy_a, energy_b, max_energy;
+        u32 rate_flags = le32_to_cpu(desc->rate_n_flags);
 
         energy_a = desc->energy_a;
         energy_a = energy_a ? -energy_a : S8_MIN;
@@ -224,7 +225,8 @@ static void iwl_mvm_get_signal_strength(struct iwl_mvm *mvm,
                         energy_a, energy_b, max_energy);
 
         rx_status->signal = max_energy;
-        rx_status->chains = 0; /* TODO: phy info */
+        rx_status->chains =
+                (rate_flags & RATE_MCS_ANT_AB_MSK) >> RATE_MCS_ANT_POS;
         rx_status->chain_signal[0] = energy_a;
         rx_status->chain_signal[1] = energy_b;
         rx_status->chain_signal[2] = S8_MIN;
@@ -232,8 +234,8 @@ static void iwl_mvm_get_signal_strength(struct iwl_mvm *mvm,
 
 static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
                              struct ieee80211_rx_status *stats,
-                             struct iwl_rx_mpdu_desc *desc, int queue,
-                             u8 *crypt_len)
+                             struct iwl_rx_mpdu_desc *desc, u32 pkt_flags,
+                             int queue, u8 *crypt_len)
 {
         u16 status = le16_to_cpu(desc->status);
 
@@ -253,6 +255,8 @@ static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
                         return -1;
 
                 stats->flag |= RX_FLAG_DECRYPTED;
+                if (pkt_flags & FH_RSCSR_RADA_EN)
+                        stats->flag |= RX_FLAG_MIC_STRIPPED;
                 *crypt_len = IEEE80211_CCMP_HDR_LEN;
                 return 0;
         case IWL_RX_MPDU_STATUS_SEC_TKIP:
@@ -270,6 +274,10 @@ static int iwl_mvm_rx_crypto(struct iwl_mvm *mvm, struct ieee80211_hdr *hdr,
                 if ((status & IWL_RX_MPDU_STATUS_SEC_MASK) ==
                                 IWL_RX_MPDU_STATUS_SEC_WEP)
                         *crypt_len = IEEE80211_WEP_IV_LEN;
+
+                if (pkt_flags & FH_RSCSR_RADA_EN)
+                        stats->flag |= RX_FLAG_ICV_STRIPPED;
+
                 return 0;
         case IWL_RX_MPDU_STATUS_SEC_EXT_ENC:
                 if (!(status & IWL_RX_MPDU_STATUS_MIC_OK))
@@ -848,7 +856,9 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
 
         rx_status = IEEE80211_SKB_RXCB(skb);
 
-        if (iwl_mvm_rx_crypto(mvm, hdr, rx_status, desc, queue, &crypt_len)) {
+        if (iwl_mvm_rx_crypto(mvm, hdr, rx_status, desc,
+                              le32_to_cpu(pkt->len_n_flags), queue,
+                              &crypt_len)) {
                 kfree_skb(skb);
                 return;
         }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index c19f98489d4e..1add5615fc3a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -1709,29 +1709,29 @@ void iwl_mvm_dealloc_int_sta(struct iwl_mvm *mvm, struct iwl_mvm_int_sta *sta)
         sta->sta_id = IWL_MVM_INVALID_STA;
 }
 
-static void iwl_mvm_enable_aux_queue(struct iwl_mvm *mvm)
+static void iwl_mvm_enable_aux_snif_queue(struct iwl_mvm *mvm, u16 *queue,
+                                          u8 sta_id, u8 fifo)
 {
         unsigned int wdg_timeout = iwlmvm_mod_params.tfd_q_hang_detect ?
                                         mvm->cfg->base_params->wd_timeout :
                                         IWL_WATCHDOG_DISABLED;
 
         if (iwl_mvm_has_new_tx_api(mvm)) {
-                int queue = iwl_mvm_tvqm_enable_txq(mvm, mvm->aux_queue,
-                                                    mvm->aux_sta.sta_id,
-                                                    IWL_MAX_TID_COUNT,
-                                                    wdg_timeout);
-                mvm->aux_queue = queue;
+                int tvqm_queue =
+                        iwl_mvm_tvqm_enable_txq(mvm, *queue, sta_id,
+                                                IWL_MAX_TID_COUNT,
+                                                wdg_timeout);
+                *queue = tvqm_queue;
         } else {
                 struct iwl_trans_txq_scd_cfg cfg = {
-                        .fifo = IWL_MVM_TX_FIFO_MCAST,
-                        .sta_id = mvm->aux_sta.sta_id,
+                        .fifo = fifo,
+                        .sta_id = sta_id,
                         .tid = IWL_MAX_TID_COUNT,
                         .aggregate = false,
                         .frame_limit = IWL_FRAME_LIMIT,
                 };
 
-                iwl_mvm_enable_txq(mvm, mvm->aux_queue, mvm->aux_queue, 0, &cfg,
-                                   wdg_timeout);
+                iwl_mvm_enable_txq(mvm, *queue, *queue, 0, &cfg, wdg_timeout);
         }
 }
 
@@ -1750,7 +1750,9 @@ int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm)
 
         /* Map Aux queue to fifo - needs to happen before adding Aux station */
         if (!iwl_mvm_has_new_tx_api(mvm))
-                iwl_mvm_enable_aux_queue(mvm);
+                iwl_mvm_enable_aux_snif_queue(mvm, &mvm->aux_queue,
+                                              mvm->aux_sta.sta_id,
+                                              IWL_MVM_TX_FIFO_MCAST);
 
         ret = iwl_mvm_add_int_sta_common(mvm, &mvm->aux_sta, NULL,
                                          MAC_INDEX_AUX, 0);
@@ -1764,7 +1766,9 @@ int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm)
          * to firmware so enable queue here - after the station was added
          */
         if (iwl_mvm_has_new_tx_api(mvm))
-                iwl_mvm_enable_aux_queue(mvm);
+                iwl_mvm_enable_aux_snif_queue(mvm, &mvm->aux_queue,
+                                              mvm->aux_sta.sta_id,
+                                              IWL_MVM_TX_FIFO_MCAST);
 
         return 0;
 }
@@ -1772,10 +1776,31 @@ int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm)
 int iwl_mvm_add_snif_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        int ret;
 
         lockdep_assert_held(&mvm->mutex);
-        return iwl_mvm_add_int_sta_common(mvm, &mvm->snif_sta, vif->addr,
+
+        /* Map snif queue to fifo - must happen before adding snif station */
+        if (!iwl_mvm_has_new_tx_api(mvm))
+                iwl_mvm_enable_aux_snif_queue(mvm, &mvm->snif_queue,
+                                              mvm->snif_sta.sta_id,
+                                              IWL_MVM_TX_FIFO_BE);
+
+        ret = iwl_mvm_add_int_sta_common(mvm, &mvm->snif_sta, vif->addr,
                                          mvmvif->id, 0);
+        if (ret)
+                return ret;
+
+        /*
+         * For 22000 firmware and on we cannot add queue to a station unknown
+         * to firmware so enable queue here - after the station was added
+         */
+        if (iwl_mvm_has_new_tx_api(mvm))
+                iwl_mvm_enable_aux_snif_queue(mvm, &mvm->snif_queue,
+                                              mvm->snif_sta.sta_id,
+                                              IWL_MVM_TX_FIFO_BE);
+
+        return 0;
 }
 
 int iwl_mvm_rm_snif_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
@@ -1784,6 +1809,8 @@ int iwl_mvm_rm_snif_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 
         lockdep_assert_held(&mvm->mutex);
 
+        iwl_mvm_disable_txq(mvm, mvm->snif_queue, mvm->snif_queue,
+                            IWL_MAX_TID_COUNT, 0);
         ret = iwl_mvm_rm_sta_common(mvm, mvm->snif_sta.sta_id);
         if (ret)
                 IWL_WARN(mvm, "Failed sending remove station\n");
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
index 4d0314912e94..e25cda9fbf6c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
@@ -132,6 +132,24 @@ void iwl_mvm_roc_done_wk(struct work_struct *wk)
          * executed, and a new time event means a new command.
          */
         iwl_mvm_flush_sta(mvm, &mvm->aux_sta, true, CMD_ASYNC);
+
+        /* Do the same for the P2P device queue (STA) */
+        if (test_and_clear_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status)) {
+                struct iwl_mvm_vif *mvmvif;
+
+                /*
+                 * NB: access to this pointer would be racy, but the flush bit
+                 * can only be set when we had a P2P-Device VIF, and we have a
+                 * flush of this work in iwl_mvm_prepare_mac_removal() so it's
+                 * not really racy.
+                 */
+
+                if (!WARN_ON(!mvm->p2p_device_vif)) {
+                        mvmvif = iwl_mvm_vif_from_mac80211(mvm->p2p_device_vif);
+                        iwl_mvm_flush_sta(mvm, &mvmvif->bcast_sta, true,
+                                          CMD_ASYNC);
+                }
+        }
 }
 
 static void iwl_mvm_roc_finished(struct iwl_mvm *mvm)
@@ -855,10 +873,12 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
 
         mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
 
-        if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE)
+        if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
                 iwl_mvm_remove_time_event(mvm, mvmvif, te_data);
-        else
+                set_bit(IWL_MVM_STATUS_NEED_FLUSH_P2P, &mvm->status);
+        } else {
                 iwl_mvm_remove_aux_roc_te(mvm, mvmvif, te_data);
+        }
 
         iwl_mvm_roc_finished(mvm);
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 593b7f97b29c..333bcb75b8af 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -657,7 +657,8 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
                         if (ap_sta_id != IWL_MVM_INVALID_STA)
                                 sta_id = ap_sta_id;
                 } else if (info.control.vif->type == NL80211_IFTYPE_MONITOR) {
-                        queue = mvm->aux_queue;
+                        queue = mvm->snif_queue;
+                        sta_id = mvm->snif_sta.sta_id;
                 }
         }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
index d46115e2d69e..03ffd84786ca 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
@@ -1134,9 +1134,18 @@ unsigned int iwl_mvm_get_wd_timeout(struct iwl_mvm *mvm,
         unsigned int default_timeout =
                 cmd_q ? IWL_DEF_WD_TIMEOUT : mvm->cfg->base_params->wd_timeout;
 
-        if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_TXQ_TIMERS))
+        if (!iwl_fw_dbg_trigger_enabled(mvm->fw, FW_DBG_TRIGGER_TXQ_TIMERS)) {
+                /*
+                 * We can't know when the station is asleep or awake, so we
+                 * must disable the queue hang detection.
+                 */
+                if (fw_has_capa(&mvm->fw->ucode_capa,
+                                IWL_UCODE_TLV_CAPA_STA_PM_NOTIF) &&
+                    vif && vif->type == NL80211_IFTYPE_AP)
+                        return IWL_WATCHDOG_DISABLED;
                 return iwlmvm_mod_params.tfd_q_hang_detect ?
                         default_timeout : IWL_WATCHDOG_DISABLED;
+        }
 
         trigger = iwl_fw_dbg_get_trigger(mvm->fw, FW_DBG_TRIGGER_TXQ_TIMERS);
         txq_timer = (void *)trigger->data;
@@ -1163,6 +1172,8 @@ unsigned int iwl_mvm_get_wd_timeout(struct iwl_mvm *mvm,
                 return le32_to_cpu(txq_timer->p2p_go);
         case NL80211_IFTYPE_P2P_DEVICE:
                 return le32_to_cpu(txq_timer->p2p_device);
+        case NL80211_IFTYPE_MONITOR:
+                return default_timeout;
         default:
                 WARN_ON(1);
                 return mvm->cfg->base_params->wd_timeout;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index f21fe59faccf..ccd7c33c4c28 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -553,6 +553,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x271B, 0x0214, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x271C, 0x0214, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2720, 0x0034, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2720, 0x0038, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2720, 0x003C, iwl9560_2ac_cfg)},
@@ -664,6 +665,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x2720, 0x0310, iwla000_2ac_cfg_hr_cdb)},
         {IWL_PCI_DEVICE(0x40C0, 0x0000, iwla000_2ax_cfg_hr)},
         {IWL_PCI_DEVICE(0x40C0, 0x0A10, iwla000_2ax_cfg_hr)},
+        {IWL_PCI_DEVICE(0xA0F0, 0x0000, iwla000_2ax_cfg_hr)},
 
 #endif /* CONFIG_IWLMVM */
 
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
index d749abeca3ae..403e65c309d0 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
@@ -670,11 +670,15 @@ static inline u8 iwl_pcie_get_cmd_index(struct iwl_txq *q, u32 index)
         return index & (q->n_window - 1);
 }
 
-static inline void *iwl_pcie_get_tfd(struct iwl_trans_pcie *trans_pcie,
+static inline void *iwl_pcie_get_tfd(struct iwl_trans *trans,
                                      struct iwl_txq *txq, int idx)
 {
-        return txq->tfds + trans_pcie->tfd_size * iwl_pcie_get_cmd_index(txq,
-                                                                         idx);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+
+        if (trans->cfg->use_tfh)
+                idx = iwl_pcie_get_cmd_index(txq, idx);
+
+        return txq->tfds + trans_pcie->tfd_size * idx;
 }
 
 static inline void iwl_enable_rfkill_int(struct iwl_trans *trans)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
index c59f4581e972..ac05fd1e74c4 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
@@ -49,6 +49,7 @@
  *
  *****************************************************************************/
 #include "iwl-trans.h"
+#include "iwl-prph.h"
 #include "iwl-context-info.h"
 #include "internal.h"
 
@@ -156,6 +157,11 @@ void _iwl_trans_pcie_gen2_stop_device(struct iwl_trans *trans, bool low_power)
 
         trans_pcie->is_down = true;
 
+        /* Stop dbgc before stopping device */
+        iwl_write_prph(trans, DBGC_IN_SAMPLE, 0);
+        udelay(100);
+        iwl_write_prph(trans, DBGC_OUT_CTRL, 0);
+
         /* tell the device to stop sending interrupts */
         iwl_disable_interrupts(trans);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index b7a51603465b..4541c86881d6 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -166,6 +166,7 @@ static void iwl_trans_pcie_dump_regs(struct iwl_trans *trans)
                 print_hex_dump(KERN_ERR, prefix, DUMP_PREFIX_OFFSET, 32,
                                4, buf, i, 0);
         }
+        goto out;
 
 err_read:
         print_hex_dump(KERN_ERR, prefix, DUMP_PREFIX_OFFSET, 32, 4, buf, i, 0);
@@ -1226,6 +1227,15 @@ static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power)
 
         trans_pcie->is_down = true;
 
+        /* Stop dbgc before stopping device */
+        if (trans->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
+                iwl_set_bits_prph(trans, MON_BUFF_SAMPLE_CTL, 0x100);
+        } else {
+                iwl_write_prph(trans, DBGC_IN_SAMPLE, 0);
+                udelay(100);
+                iwl_write_prph(trans, DBGC_OUT_CTRL, 0);
+        }
+
         /* tell the device to stop sending interrupts */
         iwl_disable_interrupts(trans);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index 16b345f54ff0..6d0a907d5ba5 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -171,8 +171,6 @@ static void iwl_pcie_gen2_tfd_unmap(struct iwl_trans *trans,
 
 static void iwl_pcie_gen2_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-
         /* rd_ptr is bounded by TFD_QUEUE_SIZE_MAX and
          * idx is bounded by n_window
          */
@@ -181,7 +179,7 @@ static void iwl_pcie_gen2_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq)
         lockdep_assert_held(&txq->lock);
 
         iwl_pcie_gen2_tfd_unmap(trans, &txq->entries[idx].meta,
-                                iwl_pcie_get_tfd(trans_pcie, txq, idx));
+                                iwl_pcie_get_tfd(trans, txq, idx));
 
         /* free SKB */
         if (txq->entries) {
@@ -364,11 +362,9 @@ struct iwl_tfh_tfd *iwl_pcie_gen2_build_tfd(struct iwl_trans *trans,
                                             struct sk_buff *skb,
                                             struct iwl_cmd_meta *out_meta)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         int idx = iwl_pcie_get_cmd_index(txq, txq->write_ptr);
-        struct iwl_tfh_tfd *tfd =
-                iwl_pcie_get_tfd(trans_pcie, txq, idx);
+        struct iwl_tfh_tfd *tfd = iwl_pcie_get_tfd(trans, txq, idx);
         dma_addr_t tb_phys;
         bool amsdu;
         int i, len, tb1_len, tb2_len, hdr_len;
@@ -565,8 +561,7 @@ static int iwl_pcie_gen2_enqueue_hcmd(struct iwl_trans *trans,
         u8 group_id = iwl_cmd_groupid(cmd->id);
         const u8 *cmddata[IWL_MAX_CMD_TBS_PER_TFD];
         u16 cmdlen[IWL_MAX_CMD_TBS_PER_TFD];
-        struct iwl_tfh_tfd *tfd =
-                iwl_pcie_get_tfd(trans_pcie, txq, txq->write_ptr);
+        struct iwl_tfh_tfd *tfd = iwl_pcie_get_tfd(trans, txq, txq->write_ptr);
 
         memset(tfd, 0, sizeof(*tfd));
 
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
index fed6d842a5e1..3f85713c41dc 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -373,7 +373,7 @@ static void iwl_pcie_tfd_unmap(struct iwl_trans *trans,
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int i, num_tbs;
-        void *tfd = iwl_pcie_get_tfd(trans_pcie, txq, index);
+        void *tfd = iwl_pcie_get_tfd(trans, txq, index);
 
         /* Sanity check on number of chunks */
         num_tbs = iwl_pcie_tfd_get_num_tbs(trans, tfd);
@@ -2018,7 +2018,7 @@ static int iwl_fill_data_tbs(struct iwl_trans *trans, struct sk_buff *skb,
         }
 
         trace_iwlwifi_dev_tx(trans->dev, skb,
-                             iwl_pcie_get_tfd(trans_pcie, txq, txq->write_ptr),
+                             iwl_pcie_get_tfd(trans, txq, txq->write_ptr),
                              trans_pcie->tfd_size,
                              &dev_cmd->hdr, IWL_FIRST_TB_SIZE + tb1_len,
                              hdr_len);
@@ -2092,7 +2092,7 @@ static int iwl_fill_data_tbs_amsdu(struct iwl_trans *trans, struct sk_buff *skb,
                 IEEE80211_CCMP_HDR_LEN : 0;
 
         trace_iwlwifi_dev_tx(trans->dev, skb,
-                             iwl_pcie_get_tfd(trans_pcie, txq, txq->write_ptr),
+                             iwl_pcie_get_tfd(trans, txq, txq->write_ptr),
                              trans_pcie->tfd_size,
                              &dev_cmd->hdr, IWL_FIRST_TB_SIZE + tb1_len, 0);
 
@@ -2425,7 +2425,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
         memcpy(&txq->first_tb_bufs[txq->write_ptr], &dev_cmd->hdr,
                IWL_FIRST_TB_SIZE);
 
-        tfd = iwl_pcie_get_tfd(trans_pcie, txq, txq->write_ptr);
+        tfd = iwl_pcie_get_tfd(trans, txq, txq->write_ptr);
         /* Set up entry for this TFD in Tx byte-count array */
         iwl_pcie_txq_update_byte_cnt_tbl(trans, txq, le16_to_cpu(tx_cmd->len),
                                          iwl_pcie_tfd_get_num_tbs(trans, tfd));
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 10b075a46b26..f6d4a50f1bdb 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -489,6 +489,7 @@ static const struct ieee80211_iface_combination hwsim_if_comb_p2p_dev[] = {
 
 static spinlock_t hwsim_radio_lock;
 static LIST_HEAD(hwsim_radios);
+static struct workqueue_struct *hwsim_wq;
 static int hwsim_radio_idx;
 
 static struct platform_driver mac80211_hwsim_driver = {
@@ -684,6 +685,7 @@ static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
         hdr = skb_put(skb, sizeof(*hdr) - ETH_ALEN);
         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
                                          IEEE80211_STYPE_NULLFUNC |
+                                         IEEE80211_FCTL_TODS |
                                          (ps ? IEEE80211_FCTL_PM : 0));
         hdr->duration_id = cpu_to_le16(0);
         memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
@@ -3119,6 +3121,11 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
         if (info->attrs[HWSIM_ATTR_CHANNELS])
                 param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
 
+        if (param.channels > CFG80211_MAX_NUM_DIFFERENT_CHANNELS) {
+                GENL_SET_ERR_MSG(info, "too many channels specified");
+                return -EINVAL;
+        }
+
         if (info->attrs[HWSIM_ATTR_NO_VIF])
                 param.no_vif = true;
 
@@ -3215,7 +3222,7 @@ static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
                 if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
                         continue;
 
-                skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+                skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
                 if (!skb) {
                         res = -ENOMEM;
                         goto out_err;
@@ -3341,7 +3348,7 @@ static void remove_user_radios(u32 portid)
                 if (entry->destroy_on_close && entry->portid == portid) {
                         list_del(&entry->list);
                         INIT_WORK(&entry->destroy_work, destroy_radio);
-                        schedule_work(&entry->destroy_work);
+                        queue_work(hwsim_wq, &entry->destroy_work);
                 }
         }
         spin_unlock_bh(&hwsim_radio_lock);
@@ -3416,7 +3423,7 @@ static void __net_exit hwsim_exit_net(struct net *net)
 
                 list_del(&data->list);
                 INIT_WORK(&data->destroy_work, destroy_radio);
-                schedule_work(&data->destroy_work);
+                queue_work(hwsim_wq, &data->destroy_work);
         }
         spin_unlock_bh(&hwsim_radio_lock);
 }
@@ -3448,6 +3455,10 @@ static int __init init_mac80211_hwsim(void)
 
         spin_lock_init(&hwsim_radio_lock);
 
+        hwsim_wq = alloc_workqueue("hwsim_wq",WQ_MEM_RECLAIM,0);
+        if (!hwsim_wq)
+                return -ENOMEM;
+
         err = register_pernet_device(&hwsim_net_ops);
         if (err)
                 return err;
@@ -3586,8 +3597,11 @@ static void __exit exit_mac80211_hwsim(void)
         hwsim_exit_netlink();
 
         mac80211_hwsim_free();
+        flush_workqueue(hwsim_wq);
+
         unregister_netdev(hwsim_mon);
         platform_driver_unregister(&mac80211_hwsim_driver);
         unregister_pernet_device(&hwsim_net_ops);
+        destroy_workqueue(hwsim_wq);
 }
 module_exit(exit_mac80211_hwsim);
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index d6dff347f896..78ebe494fef0 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -186,7 +186,7 @@ static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
         /* Obtain the queue to be used to transmit this packet */
         index = skb_get_queue_mapping(skb);
         if (index >= num_queues) {
-                pr_warn_ratelimited("Invalid queue %hu for packet on interface %s\n.",
+                pr_warn_ratelimited("Invalid queue %hu for packet on interface %s\n",
                                     index, vif->dev->name);
                 index %= num_queues;
         }
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index c5a34671abda..9bd7ddeeb6a5 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1326,6 +1326,7 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
 
         netif_carrier_off(netdev);
 
+        xenbus_switch_state(dev, XenbusStateInitialising);
         return netdev;
 
  exit:
diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c
index e949e3302af4..c586bcdb5190 100644
--- a/drivers/nvdimm/btt.c
+++ b/drivers/nvdimm/btt.c
@@ -211,12 +211,12 @@ static int btt_map_read(struct arena_info *arena, u32 lba, u32 *mapping,
         return ret;
 }
 
-static int btt_log_read_pair(struct arena_info *arena, u32 lane,
-                        struct log_entry *ent)
+static int btt_log_group_read(struct arena_info *arena, u32 lane,
+                        struct log_group *log)
 {
         return arena_read_bytes(arena,
-                        arena->logoff + (2 * lane * LOG_ENT_SIZE), ent,
-                        2 * LOG_ENT_SIZE, 0);
+                        arena->logoff + (lane * LOG_GRP_SIZE), log,
+                        LOG_GRP_SIZE, 0);
 }
 
 static struct dentry *debugfs_root;
@@ -256,6 +256,8 @@ static void arena_debugfs_init(struct arena_info *a, struct dentry *parent,
         debugfs_create_x64("logoff", S_IRUGO, d, &a->logoff);
         debugfs_create_x64("info2off", S_IRUGO, d, &a->info2off);
         debugfs_create_x32("flags", S_IRUGO, d, &a->flags);
+        debugfs_create_u32("log_index_0", S_IRUGO, d, &a->log_index[0]);
+        debugfs_create_u32("log_index_1", S_IRUGO, d, &a->log_index[1]);
 }
 
 static void btt_debugfs_init(struct btt *btt)
@@ -274,6 +276,11 @@ static void btt_debugfs_init(struct btt *btt)
         }
 }
 
+static u32 log_seq(struct log_group *log, int log_idx)
+{
+        return le32_to_cpu(log->ent[log_idx].seq);
+}
+
 /*
  * This function accepts two log entries, and uses the
  * sequence number to find the 'older' entry.
@@ -283,8 +290,10 @@ static void btt_debugfs_init(struct btt *btt)
  *
  * TODO The logic feels a bit kludge-y. make it better..
  */
-static int btt_log_get_old(struct log_entry *ent)
+static int btt_log_get_old(struct arena_info *a, struct log_group *log)
 {
+        int idx0 = a->log_index[0];
+        int idx1 = a->log_index[1];
         int old;
 
         /*
@@ -292,23 +301,23 @@ static int btt_log_get_old(struct log_entry *ent)
          * the next time, the following logic works out to put this
          * (next) entry into [1]
          */
-        if (ent[0].seq == 0) {
-                ent[0].seq = cpu_to_le32(1);
+        if (log_seq(log, idx0) == 0) {
+                log->ent[idx0].seq = cpu_to_le32(1);
                 return 0;
         }
 
-        if (ent[0].seq == ent[1].seq)
+        if (log_seq(log, idx0) == log_seq(log, idx1))
                 return -EINVAL;
-        if (le32_to_cpu(ent[0].seq) + le32_to_cpu(ent[1].seq) > 5)
+        if (log_seq(log, idx0) + log_seq(log, idx1) > 5)
                 return -EINVAL;
 
-        if (le32_to_cpu(ent[0].seq) < le32_to_cpu(ent[1].seq)) {
-                if (le32_to_cpu(ent[1].seq) - le32_to_cpu(ent[0].seq) == 1)
+        if (log_seq(log, idx0) < log_seq(log, idx1)) {
+                if ((log_seq(log, idx1) - log_seq(log, idx0)) == 1)
                         old = 0;
                 else
                         old = 1;
         } else {
-                if (le32_to_cpu(ent[0].seq) - le32_to_cpu(ent[1].seq) == 1)
+                if ((log_seq(log, idx0) - log_seq(log, idx1)) == 1)
                         old = 1;
                 else
                         old = 0;
@@ -328,17 +337,18 @@ static int btt_log_read(struct arena_info *arena, u32 lane,
 {
         int ret;
         int old_ent, ret_ent;
-        struct log_entry log[2];
+        struct log_group log;
 
-        ret = btt_log_read_pair(arena, lane, log);
+        ret = btt_log_group_read(arena, lane, &log);
         if (ret)
                 return -EIO;
 
-        old_ent = btt_log_get_old(log);
+        old_ent = btt_log_get_old(arena, &log);
         if (old_ent < 0 || old_ent > 1) {
                 dev_err(to_dev(arena),
                                 "log corruption (%d): lane %d seq [%d, %d]\n",
-                        old_ent, lane, log[0].seq, log[1].seq);
+                                old_ent, lane, log.ent[arena->log_index[0]].seq,
+                                log.ent[arena->log_index[1]].seq);
                 /* TODO set error state? */
                 return -EIO;
         }
@@ -346,7 +356,7 @@ static int btt_log_read(struct arena_info *arena, u32 lane,
         ret_ent = (old_flag ? old_ent : (1 - old_ent));
 
         if (ent != NULL)
-                memcpy(ent, &log[ret_ent], LOG_ENT_SIZE);
+                memcpy(ent, &log.ent[arena->log_index[ret_ent]], LOG_ENT_SIZE);
 
         return ret_ent;
 }
@@ -360,17 +370,13 @@ static int __btt_log_write(struct arena_info *arena, u32 lane,
                         u32 sub, struct log_entry *ent, unsigned long flags)
 {
         int ret;
-        /*
-         * Ignore the padding in log_entry for calculating log_half.
-         * The entry is 'committed' when we write the sequence number,
-         * and we want to ensure that that is the last thing written.
-         * We don't bother writing the padding as that would be extra
-         * media wear and write amplification
-         */
-        unsigned int log_half = (LOG_ENT_SIZE - 2 * sizeof(u64)) / 2;
-        u64 ns_off = arena->logoff + (((2 * lane) + sub) * LOG_ENT_SIZE);
+        u32 group_slot = arena->log_index[sub];
+        unsigned int log_half = LOG_ENT_SIZE / 2;
         void *src = ent;
+        u64 ns_off;
 
+        ns_off = arena->logoff + (lane * LOG_GRP_SIZE) +
+                (group_slot * LOG_ENT_SIZE);
         /* split the 16B write into atomic, durable halves */
         ret = arena_write_bytes(arena, ns_off, src, log_half, flags);
         if (ret)
@@ -453,7 +459,7 @@ static int btt_log_init(struct arena_info *arena)
 {
         size_t logsize = arena->info2off - arena->logoff;
         size_t chunk_size = SZ_4K, offset = 0;
-        struct log_entry log;
+        struct log_entry ent;
         void *zerobuf;
         int ret;
         u32 i;
@@ -485,11 +491,11 @@ static int btt_log_init(struct arena_info *arena)
         }
 
         for (i = 0; i < arena->nfree; i++) {
-                log.lba = cpu_to_le32(i);
-                log.old_map = cpu_to_le32(arena->external_nlba + i);
-                log.new_map = cpu_to_le32(arena->external_nlba + i);
-                log.seq = cpu_to_le32(LOG_SEQ_INIT);
-                ret = __btt_log_write(arena, i, 0, &log, 0);
+                ent.lba = cpu_to_le32(i);
+                ent.old_map = cpu_to_le32(arena->external_nlba + i);
+                ent.new_map = cpu_to_le32(arena->external_nlba + i);
+                ent.seq = cpu_to_le32(LOG_SEQ_INIT);
+                ret = __btt_log_write(arena, i, 0, &ent, 0);
                 if (ret)
                         goto free;
         }
@@ -594,6 +600,123 @@ static int btt_freelist_init(struct arena_info *arena)
         return 0;
 }
 
+static bool ent_is_padding(struct log_entry *ent)
+{
+        return (ent->lba == 0) && (ent->old_map == 0) && (ent->new_map == 0)
+                && (ent->seq == 0);
+}
+
+/*
+ * Detecting valid log indices: We read a log group (see the comments in btt.h
+ * for a description of a 'log_group' and its 'slots'), and iterate over its
+ * four slots. We expect that a padding slot will be all-zeroes, and use this
+ * to detect a padding slot vs. an actual entry.
+ *
+ * If a log_group is in the initial state, i.e. hasn't been used since the
+ * creation of this BTT layout, it will have three of the four slots with
+ * zeroes. We skip over these log_groups for the detection of log_index. If
+ * all log_groups are in the initial state (i.e. the BTT has never been
+ * written to), it is safe to assume the 'new format' of log entries in slots
+ * (0, 1).
+ */
+static int log_set_indices(struct arena_info *arena)
+{
+        bool idx_set = false, initial_state = true;
+        int ret, log_index[2] = {-1, -1};
+        u32 i, j, next_idx = 0;
+        struct log_group log;
+        u32 pad_count = 0;
+
+        for (i = 0; i < arena->nfree; i++) {
+                ret = btt_log_group_read(arena, i, &log);
+                if (ret < 0)
+                        return ret;
+
+                for (j = 0; j < 4; j++) {
+                        if (!idx_set) {
+                                if (ent_is_padding(&log.ent[j])) {
+                                        pad_count++;
+                                        continue;
+                                } else {
+                                        /* Skip if index has been recorded */
+                                        if ((next_idx == 1) &&
+                                                (j == log_index[0]))
+                                                continue;
+                                        /* valid entry, record index */
+                                        log_index[next_idx] = j;
+                                        next_idx++;
+                                }
+                                if (next_idx == 2) {
+                                        /* two valid entries found */
+                                        idx_set = true;
+                                } else if (next_idx > 2) {
+                                        /* too many valid indices */
+                                        return -ENXIO;
+                                }
+                        } else {
+                                /*
+                                 * once the indices have been set, just verify
+                                 * that all subsequent log groups are either in
+                                 * their initial state or follow the same
+                                 * indices.
+                                 */
+                                if (j == log_index[0]) {
+                                        /* entry must be 'valid' */
+                                        if (ent_is_padding(&log.ent[j]))
+                                                return -ENXIO;
+                                } else if (j == log_index[1]) {
+                                        ;
+                                        /*
+                                         * log_index[1] can be padding if the
+                                         * lane never got used and it is still
+                                         * in the initial state (three 'padding'
+                                         * entries)
+                                         */
+                                } else {
+                                        /* entry must be invalid (padding) */
+                                        if (!ent_is_padding(&log.ent[j]))
+                                                return -ENXIO;
+                                }
+                        }
+                }
+                /*
+                 * If any of the log_groups have more than one valid,
+                 * non-padding entry, then the we are no longer in the
+                 * initial_state
+                 */
+                if (pad_count < 3)
+                        initial_state = false;
+                pad_count = 0;
+        }
+
+        if (!initial_state && !idx_set)
+                return -ENXIO;
+
+        /*
+         * If all the entries in the log were in the initial state,
+         * assume new padding scheme
+         */
+        if (initial_state)
+                log_index[1] = 1;
+
+        /*
+         * Only allow the known permutations of log/padding indices,
+         * i.e. (0, 1), and (0, 2)
+         */
+        if ((log_index[0] == 0) && ((log_index[1] == 1) || (log_index[1] == 2)))
+                ; /* known index possibilities */
+        else {
+                dev_err(to_dev(arena), "Found an unknown padding scheme\n");
+                return -ENXIO;
+        }
+
+        arena->log_index[0] = log_index[0];
+        arena->log_index[1] = log_index[1];
+        dev_dbg(to_dev(arena), "log_index_0 = %d\n", log_index[0]);
+        dev_dbg(to_dev(arena), "log_index_1 = %d\n", log_index[1]);
+        return 0;
+}
+
 static int btt_rtt_init(struct arena_info *arena)
 {
         arena->rtt = kcalloc(arena->nfree, sizeof(u32), GFP_KERNEL);
@@ -650,8 +773,7 @@ static struct arena_info *alloc_arena(struct btt *btt, size_t size,
         available -= 2 * BTT_PG_SIZE;
 
         /* The log takes a fixed amount of space based on nfree */
-        logsize = roundup(2 * arena->nfree * sizeof(struct log_entry),
-                                BTT_PG_SIZE);
+        logsize = roundup(arena->nfree * LOG_GRP_SIZE, BTT_PG_SIZE);
         available -= logsize;
 
         /* Calculate optimal split between map and data area */
@@ -668,6 +790,10 @@ static struct arena_info *alloc_arena(struct btt *btt, size_t size,
         arena->mapoff = arena->dataoff + datasize;
         arena->logoff = arena->mapoff + mapsize;
         arena->info2off = arena->logoff + logsize;
+
+        /* Default log indices are (0,1) */
+        arena->log_index[0] = 0;
+        arena->log_index[1] = 1;
         return arena;
 }
 
@@ -758,6 +884,13 @@ static int discover_arenas(struct btt *btt)
                 arena->external_lba_start = cur_nlba;
                 parse_arena_meta(arena, super, cur_off);
 
+                ret = log_set_indices(arena);
+                if (ret) {
+                        dev_err(to_dev(arena),
+                                "Unable to deduce log/padding indices\n");
+                        goto out;
+                }
+
                 mutex_init(&arena->err_lock);
                 ret = btt_freelist_init(arena);
                 if (ret)
diff --git a/drivers/nvdimm/btt.h b/drivers/nvdimm/btt.h
index 578c2057524d..db3cb6d4d0d4 100644
--- a/drivers/nvdimm/btt.h
+++ b/drivers/nvdimm/btt.h
@@ -27,6 +27,7 @@
 #define MAP_ERR_MASK (1 << MAP_ERR_SHIFT)
 #define MAP_LBA_MASK (~((1 << MAP_TRIM_SHIFT) | (1 << MAP_ERR_SHIFT)))
 #define MAP_ENT_NORMAL 0xC0000000
+#define LOG_GRP_SIZE sizeof(struct log_group)
 #define LOG_ENT_SIZE sizeof(struct log_entry)
 #define ARENA_MIN_SIZE (1UL << 24)      /* 16 MB */
 #define ARENA_MAX_SIZE (1ULL << 39)     /* 512 GB */
@@ -50,12 +51,52 @@ enum btt_init_state {
         INIT_READY
 };
 
+/*
+ * A log group represents one log 'lane', and consists of four log entries.
+ * Two of the four entries are valid entries, and the remaining two are
+ * padding. Due to an old bug in the padding location, we need to perform a
+ * test to determine the padding scheme being used, and use that scheme
+ * thereafter.
+ *
+ * In kernels prior to 4.15, 'log group' would have actual log entries at
+ * indices (0, 2) and padding at indices (1, 3), where as the correct/updated
+ * format has log entries at indices (0, 1) and padding at indices (2, 3).
+ *
+ * Old (pre 4.15) format:
+ * +-----------------+-----------------+
+ * |      ent[0]     |      ent[1]     |
+ * |       16B       |       16B       |
+ * | lba/old/new/seq |       pad       |
+ * +-----------------------------------+
+ * |      ent[2]     |      ent[3]     |
+ * |       16B       |       16B       |
+ * | lba/old/new/seq |       pad       |
+ * +-----------------+-----------------+
+ *
+ * New format:
+ * +-----------------+-----------------+
+ * |      ent[0]     |      ent[1]     |
+ * |       16B       |       16B       |
+ * | lba/old/new/seq | lba/old/new/seq |
+ * +-----------------------------------+
+ * |      ent[2]     |      ent[3]     |
+ * |       16B       |       16B       |
+ * |       pad       |       pad       |
+ * +-----------------+-----------------+
+ *
+ * We detect during start-up which format is in use, and set
+ * arena->log_index[(0, 1)] with the detected format.
+ */
+
 struct log_entry {
         __le32 lba;
         __le32 old_map;
         __le32 new_map;
         __le32 seq;
-        __le64 padding[2];
+};
+
+struct log_group {
+        struct log_entry ent[4];
 };
 
 struct btt_sb {
@@ -125,6 +166,8 @@ struct aligned_lock {
  * @list:               List head for list of arenas
  * @debugfs_dir:        Debugfs dentry
  * @flags:              Arena flags - may signify error states.
+ * @err_lock:           Mutex for synchronizing error clearing.
+ * @log_index:          Indices of the valid log entries in a log_group
  *
  * arena_info is a per-arena handle. Once an arena is narrowed down for an
  * IO, this struct is passed around for the duration of the IO.
@@ -157,6 +200,7 @@ struct arena_info {
         /* Arena flags */
         u32 flags;
         struct mutex err_lock;
+        int log_index[2];
 };
 
 /**
@@ -176,6 +220,7 @@ struct arena_info {
  * @init_lock:          Mutex used for the BTT initialization
  * @init_state:         Flag describing the initialization state for the BTT
  * @num_arenas:         Number of arenas in the BTT instance
+ * @phys_bb:            Pointer to the namespace's badblocks structure
  */
 struct btt {
         struct gendisk *btt_disk;
diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
index 65cc171c721d..2adada1a5855 100644
--- a/drivers/nvdimm/pfn_devs.c
+++ b/drivers/nvdimm/pfn_devs.c
@@ -364,9 +364,9 @@ struct device *nd_pfn_create(struct nd_region *nd_region)
 int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
 {
         u64 checksum, offset;
-        unsigned long align;
         enum nd_pfn_mode mode;
         struct nd_namespace_io *nsio;
+        unsigned long align, start_pad;
         struct nd_pfn_sb *pfn_sb = nd_pfn->pfn_sb;
         struct nd_namespace_common *ndns = nd_pfn->ndns;
         const u8 *parent_uuid = nd_dev_to_uuid(&ndns->dev);
@@ -410,6 +410,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
 
         align = le32_to_cpu(pfn_sb->align);
         offset = le64_to_cpu(pfn_sb->dataoff);
+        start_pad = le32_to_cpu(pfn_sb->start_pad);
         if (align == 0)
                 align = 1UL << ilog2(offset);
         mode = le32_to_cpu(pfn_sb->mode);
@@ -468,7 +469,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
                 return -EBUSY;
         }
 
-        if ((align && !IS_ALIGNED(offset, align))
+        if ((align && !IS_ALIGNED(nsio->res.start + offset + start_pad, align))
                         || !IS_ALIGNED(offset, PAGE_SIZE)) {
                 dev_err(&nd_pfn->dev,
                                 "bad offset: %#llx dax disabled align: %#lx\n",
@@ -582,6 +583,12 @@ static struct vmem_altmap *__nvdimm_setup_pfn(struct nd_pfn *nd_pfn,
         return altmap;
 }
 
+static u64 phys_pmem_align_down(struct nd_pfn *nd_pfn, u64 phys)
+{
+        return min_t(u64, PHYS_SECTION_ALIGN_DOWN(phys),
+                        ALIGN_DOWN(phys, nd_pfn->align));
+}
+
 static int nd_pfn_init(struct nd_pfn *nd_pfn)
 {
         u32 dax_label_reserve = is_nd_dax(&nd_pfn->dev) ? SZ_128K : 0;
@@ -637,13 +644,16 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
         start = nsio->res.start;
         size = PHYS_SECTION_ALIGN_UP(start + size) - start;
         if (region_intersects(start, size, IORESOURCE_SYSTEM_RAM,
-                                IORES_DESC_NONE) == REGION_MIXED) {
+                                IORES_DESC_NONE) == REGION_MIXED
+                        || !IS_ALIGNED(start + resource_size(&nsio->res),
+                                nd_pfn->align)) {
                 size = resource_size(&nsio->res);
-                end_trunc = start + size - PHYS_SECTION_ALIGN_DOWN(start + size);
+                end_trunc = start + size - phys_pmem_align_down(nd_pfn,
+                                start + size);
         }
 
         if (start_pad + end_trunc)
-                dev_info(&nd_pfn->dev, "%s section collision, truncate %d bytes\n",
+                dev_info(&nd_pfn->dev, "%s alignment collision, truncate %d bytes\n",
                                 dev_name(&ndns->dev), start_pad + end_trunc);
 
         /*
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index f837d666cbd4..839650e0926a 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1287,7 +1287,7 @@ static void nvme_config_discard(struct nvme_ctrl *ctrl,
         BUILD_BUG_ON(PAGE_SIZE / sizeof(struct nvme_dsm_range) <
                         NVME_DSM_MAX_RANGES);
 
-        queue->limits.discard_alignment = size;
+        queue->limits.discard_alignment = 0;
         queue->limits.discard_granularity = size;
 
         blk_queue_max_discard_sectors(queue, UINT_MAX);
@@ -1335,6 +1335,7 @@ static void nvme_update_disk_info(struct gendisk *disk,
                 struct nvme_ns *ns, struct nvme_id_ns *id)
 {
         sector_t capacity = le64_to_cpup(&id->nsze) << (ns->lba_shift - 9);
+        unsigned short bs = 1 << ns->lba_shift;
         unsigned stream_alignment = 0;
 
         if (ns->ctrl->nr_streams && ns->sws && ns->sgs)
@@ -1343,7 +1344,10 @@ static void nvme_update_disk_info(struct gendisk *disk,
         blk_mq_freeze_queue(disk->queue);
         blk_integrity_unregister(disk);
 
-        blk_queue_logical_block_size(disk->queue, 1 << ns->lba_shift);
+        blk_queue_logical_block_size(disk->queue, bs);
+        blk_queue_physical_block_size(disk->queue, bs);
+        blk_queue_io_min(disk->queue, bs);
+
         if (ns->ms && !ns->ext &&
             (ns->ctrl->ops->flags & NVME_F_METADATA_SUPPORTED))
                 nvme_init_integrity(disk, ns->ms, ns->pi_type);
@@ -1705,7 +1709,8 @@ static void nvme_set_queue_limits(struct nvme_ctrl *ctrl,
                 blk_queue_max_hw_sectors(q, ctrl->max_hw_sectors);
                 blk_queue_max_segments(q, min_t(u32, max_segments, USHRT_MAX));
         }
-        if (ctrl->quirks & NVME_QUIRK_STRIPE_SIZE)
+        if ((ctrl->quirks & NVME_QUIRK_STRIPE_SIZE) &&
+            is_power_of_2(ctrl->max_hw_sectors))
                 blk_queue_chunk_sectors(q, ctrl->max_hw_sectors);
         blk_queue_virt_boundary(q, ctrl->page_size - 1);
         if (ctrl->vwc & NVME_CTRL_VWC_PRESENT)
@@ -2869,7 +2874,6 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
 
         blk_queue_logical_block_size(ns->queue, 1 << ns->lba_shift);
         nvme_set_queue_limits(ctrl, ns->queue);
-        nvme_setup_streams_ns(ctrl, ns);
 
         id = nvme_identify_ns(ctrl, nsid);
         if (!id)
@@ -2880,6 +2884,7 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
 
         if (nvme_init_ns_head(ns, nsid, id, &new))
                 goto out_free_id;
+        nvme_setup_streams_ns(ctrl, ns);
         
 #ifdef CONFIG_NVME_MULTIPATH
         /*
@@ -2965,8 +2970,6 @@ static void nvme_ns_remove(struct nvme_ns *ns)
                 return;
 
         if (ns->disk && ns->disk->flags & GENHD_FL_UP) {
-                if (blk_get_integrity(ns->disk))
-                        blk_integrity_unregister(ns->disk);
                 nvme_mpath_remove_disk_links(ns);
                 sysfs_remove_group(&disk_to_dev(ns->disk)->kobj,
                                         &nvme_ns_id_attr_group);
@@ -2974,6 +2977,8 @@ static void nvme_ns_remove(struct nvme_ns *ns)
                         nvme_nvm_unregister_sysfs(ns);
                 del_gendisk(ns->disk);
                 blk_cleanup_queue(ns->queue);
+                if (blk_get_integrity(ns->disk))
+                        blk_integrity_unregister(ns->disk);
         }
 
         mutex_lock(&ns->ctrl->subsys->lock);
@@ -2986,6 +2991,7 @@ static void nvme_ns_remove(struct nvme_ns *ns)
         mutex_unlock(&ns->ctrl->namespaces_mutex);
 
         synchronize_srcu(&ns->head->srcu);
+        nvme_mpath_check_last_path(ns);
         nvme_put_ns(ns);
 }
 
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 76b4fe6816a0..894c2ccb3891 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -74,6 +74,7 @@ static struct nvmf_host *nvmf_host_default(void)
                 return NULL;
 
         kref_init(&host->ref);
+        uuid_gen(&host->id);
         snprintf(host->nqn, NVMF_NQN_SIZE,
                 "nqn.2014-08.org.nvmexpress:uuid:%pUb", &host->id);
 
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 0a8af4daef89..794e66e4aa20 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -3221,7 +3221,6 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
 
                 /* initiate nvme ctrl ref counting teardown */
                 nvme_uninit_ctrl(&ctrl->ctrl);
-                nvme_put_ctrl(&ctrl->ctrl);
 
                 /* Remove core ctrl ref. */
                 nvme_put_ctrl(&ctrl->ctrl);
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index ea1aa5283e8e..a00eabd06427 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -417,6 +417,15 @@ static inline void nvme_mpath_clear_current_path(struct nvme_ns *ns)
                 rcu_assign_pointer(head->current_path, NULL);
 }
 struct nvme_ns *nvme_find_path(struct nvme_ns_head *head);
+
+static inline void nvme_mpath_check_last_path(struct nvme_ns *ns)
+{
+        struct nvme_ns_head *head = ns->head;
+
+        if (head->disk && list_empty(&head->list))
+                kblockd_schedule_work(&head->requeue_work);
+}
+
 #else
 static inline void nvme_failover_req(struct request *req)
 {
@@ -448,6 +457,9 @@ static inline void nvme_mpath_remove_disk_links(struct nvme_ns *ns)
 static inline void nvme_mpath_clear_current_path(struct nvme_ns *ns)
 {
 }
+static inline void nvme_mpath_check_last_path(struct nvme_ns *ns)
+{
+}
 #endif /* CONFIG_NVME_MULTIPATH */
 
 #ifdef CONFIG_NVM
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index f5800c3c9082..4276ebfff22b 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -448,12 +448,34 @@ static void **nvme_pci_iod_list(struct request *req)
         return (void **)(iod->sg + blk_rq_nr_phys_segments(req));
 }
 
+static inline bool nvme_pci_use_sgls(struct nvme_dev *dev, struct request *req)
+{
+        struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
+        int nseg = blk_rq_nr_phys_segments(req);
+        unsigned int avg_seg_size;
+
+        if (nseg == 0)
+                return false;
+
+        avg_seg_size = DIV_ROUND_UP(blk_rq_payload_bytes(req), nseg);
+
+        if (!(dev->ctrl.sgls & ((1 << 0) | (1 << 1))))
+                return false;
+        if (!iod->nvmeq->qid)
+                return false;
+        if (!sgl_threshold || avg_seg_size < sgl_threshold)
+                return false;
+        return true;
+}
+
 static blk_status_t nvme_init_iod(struct request *rq, struct nvme_dev *dev)
 {
         struct nvme_iod *iod = blk_mq_rq_to_pdu(rq);
         int nseg = blk_rq_nr_phys_segments(rq);
         unsigned int size = blk_rq_payload_bytes(rq);
 
+        iod->use_sgl = nvme_pci_use_sgls(dev, rq);
+
         if (nseg > NVME_INT_PAGES || size > NVME_INT_BYTES(dev)) {
                 size_t alloc_size = nvme_pci_iod_alloc_size(dev, size, nseg,
                                 iod->use_sgl);
@@ -604,8 +626,6 @@ static blk_status_t nvme_pci_setup_prps(struct nvme_dev *dev,
         dma_addr_t prp_dma;
         int nprps, i;
 
-        iod->use_sgl = false;
-
         length -= (page_size - offset);
         if (length <= 0) {
                 iod->first_dma = 0;
@@ -705,22 +725,19 @@ static void nvme_pci_sgl_set_seg(struct nvme_sgl_desc *sge,
 }
 
 static blk_status_t nvme_pci_setup_sgls(struct nvme_dev *dev,
-                struct request *req, struct nvme_rw_command *cmd)
+                struct request *req, struct nvme_rw_command *cmd, int entries)
 {
         struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
-        int length = blk_rq_payload_bytes(req);
         struct dma_pool *pool;
         struct nvme_sgl_desc *sg_list;
         struct scatterlist *sg = iod->sg;
-        int entries = iod->nents, i = 0;
         dma_addr_t sgl_dma;
-
-        iod->use_sgl = true;
+        int i = 0;
 
         /* setting the transfer type as SGL */
         cmd->flags = NVME_CMD_SGL_METABUF;
 
-        if (length == sg_dma_len(sg)) {
+        if (entries == 1) {
                 nvme_pci_sgl_set_data(&cmd->dptr.sgl, sg);
                 return BLK_STS_OK;
         }
@@ -760,33 +777,12 @@ static blk_status_t nvme_pci_setup_sgls(struct nvme_dev *dev,
                 }
 
                 nvme_pci_sgl_set_data(&sg_list[i++], sg);
-
-                length -= sg_dma_len(sg);
                 sg = sg_next(sg);
-                entries--;
-        } while (length > 0);
+        } while (--entries > 0);
 
-        WARN_ON(entries > 0);
         return BLK_STS_OK;
 }
 
-static inline bool nvme_pci_use_sgls(struct nvme_dev *dev, struct request *req)
-{
-        struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
-        unsigned int avg_seg_size;
-
-        avg_seg_size = DIV_ROUND_UP(blk_rq_payload_bytes(req),
-                        blk_rq_nr_phys_segments(req));
-
-        if (!(dev->ctrl.sgls & ((1 << 0) | (1 << 1))))
-                return false;
-        if (!iod->nvmeq->qid)
-                return false;
-        if (!sgl_threshold || avg_seg_size < sgl_threshold)
-                return false;
-        return true;
-}
-
 static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
                 struct nvme_command *cmnd)
 {
@@ -795,6 +791,7 @@ static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
         enum dma_data_direction dma_dir = rq_data_dir(req) ?
                         DMA_TO_DEVICE : DMA_FROM_DEVICE;
         blk_status_t ret = BLK_STS_IOERR;
+        int nr_mapped;
 
         sg_init_table(iod->sg, blk_rq_nr_phys_segments(req));
         iod->nents = blk_rq_map_sg(q, req, iod->sg);
@@ -802,12 +799,13 @@ static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
                 goto out;
 
         ret = BLK_STS_RESOURCE;
-        if (!dma_map_sg_attrs(dev->dev, iod->sg, iod->nents, dma_dir,
-                                DMA_ATTR_NO_WARN))
+        nr_mapped = dma_map_sg_attrs(dev->dev, iod->sg, iod->nents, dma_dir,
+                        DMA_ATTR_NO_WARN);
+        if (!nr_mapped)
                 goto out;
 
-        if (nvme_pci_use_sgls(dev, req))
-                ret = nvme_pci_setup_sgls(dev, req, &cmnd->rw);
+        if (iod->use_sgl)
+                ret = nvme_pci_setup_sgls(dev, req, &cmnd->rw, nr_mapped);
         else
                 ret = nvme_pci_setup_prps(dev, req, &cmnd->rw);
 
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 37af56596be6..2a0bba7f50cf 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -974,12 +974,18 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
         blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
         nvme_start_queues(&ctrl->ctrl);
 
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
+                /* state change failure should never happen */
+                WARN_ON_ONCE(1);
+                return;
+        }
+
         nvme_rdma_reconnect_or_remove(ctrl);
 }
 
 static void nvme_rdma_error_recovery(struct nvme_rdma_ctrl *ctrl)
 {
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING))
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RESETTING))
                 return;
 
         queue_work(nvme_wq, &ctrl->err_work);
@@ -1753,6 +1759,12 @@ static void nvme_rdma_reset_ctrl_work(struct work_struct *work)
         nvme_stop_ctrl(&ctrl->ctrl);
         nvme_rdma_shutdown_ctrl(ctrl, false);
 
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
+                /* state change failure should never happen */
+                WARN_ON_ONCE(1);
+                return;
+        }
+
         ret = nvme_rdma_configure_admin_queue(ctrl, false);
         if (ret)
                 goto out_fail;
diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
index 7b75d9de55ab..6a018a0bd6ce 100644
--- a/drivers/nvme/target/fcloop.c
+++ b/drivers/nvme/target/fcloop.c
@@ -1085,7 +1085,7 @@ fcloop_delete_target_port(struct device *dev, struct device_attribute *attr,
                 const char *buf, size_t count)
 {
         struct fcloop_nport *nport = NULL, *tmpport;
-        struct fcloop_tport *tport;
+        struct fcloop_tport *tport = NULL;
         u64 nodename, portname;
         unsigned long flags;
         int ret;
diff --git a/drivers/nvmem/meson-mx-efuse.c b/drivers/nvmem/meson-mx-efuse.c
index a346b4923550..41d3a3c1104e 100644
--- a/drivers/nvmem/meson-mx-efuse.c
+++ b/drivers/nvmem/meson-mx-efuse.c
@@ -156,8 +156,8 @@ static int meson_mx_efuse_read(void *context, unsigned int offset,
                                  MESON_MX_EFUSE_CNTL1_AUTO_RD_ENABLE,
                                  MESON_MX_EFUSE_CNTL1_AUTO_RD_ENABLE);
 
-        for (i = offset; i < offset + bytes; i += efuse->config.word_size) {
-                addr = i / efuse->config.word_size;
+        for (i = 0; i < bytes; i += efuse->config.word_size) {
+                addr = (offset + i) / efuse->config.word_size;
 
                 err = meson_mx_efuse_read_addr(efuse, addr, &tmp);
                 if (err)
diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
index c454941b34ec..ab988d88704d 100644
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -695,7 +695,7 @@ int __of_changeset_apply_entries(struct of_changeset *ocs, int *ret_revert)
 /*
  * Returns 0 on success, a negative error value in case of an error.
  *
- * If multiple changset entry notification errors occur then only the
+ * If multiple changeset entry notification errors occur then only the
  * final notification error is reported.
  */
 int __of_changeset_apply_notify(struct of_changeset *ocs)
@@ -795,7 +795,7 @@ int __of_changeset_revert_entries(struct of_changeset *ocs, int *ret_apply)
 }
 
 /*
- * If multiple changset entry notification errors occur then only the
+ * If multiple changeset entry notification errors occur then only the
  * final notification error is reported.
  */
 int __of_changeset_revert_notify(struct of_changeset *ocs)
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 98258583abb0..a327be1d264b 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -81,6 +81,7 @@ static int of_mdiobus_register_phy(struct mii_bus *mdio,
          * can be looked up later */
         of_node_get(child);
         phy->mdio.dev.of_node = child;
+        phy->mdio.dev.fwnode = of_fwnode_handle(child);
 
         /* All data is now stored in the phy struct;
          * register it */
@@ -111,6 +112,7 @@ static int of_mdiobus_register_device(struct mii_bus *mdio,
          */
         of_node_get(child);
         mdiodev->dev.of_node = child;
+        mdiodev->dev.fwnode = of_fwnode_handle(child);
 
         /* All data is now stored in the mdiodev struct; register it. */
         rc = mdio_device_register(mdiodev);
@@ -206,6 +208,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
         mdio->phy_mask = ~0;
 
         mdio->dev.of_node = np;
+        mdio->dev.fwnode = of_fwnode_handle(np);
 
         /* Get bus level PHY reset GPIO details */
         mdio->reset_delay_us = DEFAULT_GPIO_RESET_DELAY;
@@ -228,7 +231,12 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
                         rc = of_mdiobus_register_phy(mdio, child, addr);
                 else
                         rc = of_mdiobus_register_device(mdio, child, addr);
-                if (rc)
+
+                if (rc == -ENODEV)
+                        dev_err(&mdio->dev,
+                                "MDIO device at address %d is missing.\n",
+                                addr);
+                else if (rc)
                         goto unregister;
         }
 
@@ -252,7 +260,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
 
                         if (of_mdiobus_child_is_phy(child)) {
                                 rc = of_mdiobus_register_phy(mdio, child, addr);
-                                if (rc)
+                                if (rc && rc != -ENODEV)
                                         goto unregister;
                         }
                 }
diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index c150abb9049d..3981b7da4fa9 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -522,7 +522,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs,
         struct device_node *node, *overlay_node;
         struct fragment *fragment;
         struct fragment *fragments;
-        int cnt, ret;
+        int cnt, id, ret;
 
         /*
          * Warn for some issues.  Can not return -EINVAL for these until
@@ -543,9 +543,9 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs,
 
         of_changeset_init(&ovcs->cset);
 
-        ovcs->id = idr_alloc(&ovcs_idr, ovcs, 1, 0, GFP_KERNEL);
-        if (ovcs->id <= 0)
-                return ovcs->id;
+        id = idr_alloc(&ovcs_idr, ovcs, 1, 0, GFP_KERNEL);
+        if (id <= 0)
+                return id;
 
         cnt = 0;
 
@@ -572,18 +572,20 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs,
 
         cnt = 0;
         for_each_child_of_node(tree, node) {
+                overlay_node = of_get_child_by_name(node, "__overlay__");
+                if (!overlay_node)
+                        continue;
+
                 fragment = &fragments[cnt];
-                fragment->overlay = of_get_child_by_name(node, "__overlay__");
-                if (fragment->overlay) {
-                        fragment->target = find_target_node(node);
-                        if (!fragment->target) {
-                                of_node_put(fragment->overlay);
-                                ret = -EINVAL;
-                                goto err_free_fragments;
-                        } else {
-                                cnt++;
-                        }
+                fragment->overlay = overlay_node;
+                fragment->target = find_target_node(node);
+                if (!fragment->target) {
+                        of_node_put(fragment->overlay);
+                        ret = -EINVAL;
+                        goto err_free_fragments;
                 }
+
+                cnt++;
         }
 
         /*
@@ -611,6 +613,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs,
                 goto err_free_fragments;
         }
 
+        ovcs->id = id;
         ovcs->count = cnt;
         ovcs->fragments = fragments;
 
@@ -619,7 +622,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs,
 err_free_fragments:
         kfree(fragments);
 err_free_idr:
-        idr_remove(&ovcs_idr, ovcs->id);
+        idr_remove(&ovcs_idr, id);
 
         pr_err("%s() failed, ret = %d\n", __func__, ret);
 
@@ -630,9 +633,8 @@ static void free_overlay_changeset(struct overlay_changeset *ovcs)
 {
         int i;
 
-        if (!ovcs->cset.entries.next)
-                return;
-        of_changeset_destroy(&ovcs->cset);
+        if (ovcs->cset.entries.next)
+                of_changeset_destroy(&ovcs->cset);
 
         if (ovcs->id)
                 idr_remove(&ovcs_idr, ovcs->id);
@@ -660,14 +662,14 @@ static void free_overlay_changeset(struct overlay_changeset *ovcs)
  * A non-zero return value will not have created the changeset if error is from:
  *   - parameter checks
  *   - building the changeset
- *   - overlay changset pre-apply notifier
+ *   - overlay changeset pre-apply notifier
  *
  * If an error is returned by an overlay changeset pre-apply notifier
  * then no further overlay changeset pre-apply notifier will be called.
  *
  * A non-zero return value will have created the changeset if error is from:
  *   - overlay changeset entry notifier
- *   - overlay changset post-apply notifier
+ *   - overlay changeset post-apply notifier
  *
  * If an error is returned by an overlay changeset post-apply notifier
  * then no further overlay changeset post-apply notifier will be called.
@@ -706,12 +708,11 @@ int of_overlay_apply(struct device_node *tree, int *ovcs_id)
         }
 
         of_overlay_mutex_lock();
+        mutex_lock(&of_mutex);
 
         ret = of_resolve_phandles(tree);
         if (ret)
-                goto err_overlay_unlock;
-
-        mutex_lock(&of_mutex);
+                goto err_free_overlay_changeset;
 
         ret = init_overlay_changeset(ovcs, tree);
         if (ret)
@@ -736,14 +737,13 @@ int of_overlay_apply(struct device_node *tree, int *ovcs_id)
                         devicetree_state_flags |= DTSF_APPLY_FAIL;
                 }
                 goto err_free_overlay_changeset;
-        } else {
-                ret = __of_changeset_apply_notify(&ovcs->cset);
-                if (ret)
-                        pr_err("overlay changeset entry notify error %d\n",
-                               ret);
-                /* fall through */
         }
 
+        ret = __of_changeset_apply_notify(&ovcs->cset);
+        if (ret)
+                pr_err("overlay changeset entry notify error %d\n", ret);
+        /* notify failure is not fatal, continue */
+
         list_add_tail(&ovcs->ovcs_list, &ovcs_list);
         *ovcs_id = ovcs->id;
 
@@ -755,18 +755,14 @@ int of_overlay_apply(struct device_node *tree, int *ovcs_id)
                         ret = ret_tmp;
         }
 
-        mutex_unlock(&of_mutex);
-        of_overlay_mutex_unlock();
-
-        goto out;
-
-err_overlay_unlock:
-        of_overlay_mutex_unlock();
+        goto out_unlock;
 
 err_free_overlay_changeset:
         free_overlay_changeset(ovcs);
 
+out_unlock:
         mutex_unlock(&of_mutex);
+        of_overlay_mutex_unlock();
 
 out:
         pr_debug("%s() err=%d\n", __func__, ret);
@@ -871,7 +867,7 @@ static int overlay_removal_is_ok(struct overlay_changeset *remove_ovcs)
  *
  * A non-zero return value will not revert the changeset if error is from:
  *   - parameter checks
- *   - overlay changset pre-remove notifier
+ *   - overlay changeset pre-remove notifier
  *   - overlay changeset entry revert
  *
  * If an error is returned by an overlay changeset pre-remove notifier
@@ -882,7 +878,7 @@ static int overlay_removal_is_ok(struct overlay_changeset *remove_ovcs)
  *
  * A non-zero return value will revert the changeset if error is from:
  *   - overlay changeset entry notifier
- *   - overlay changset post-remove notifier
+ *   - overlay changeset post-remove notifier
  *
  * If an error is returned by an overlay changeset post-remove notifier
  * then no further overlay changeset post-remove notifier will be called.
@@ -931,15 +927,13 @@ int of_overlay_remove(int *ovcs_id)
                 if (ret_apply)
                         devicetree_state_flags |= DTSF_REVERT_FAIL;
                 goto out_unlock;
-        } else {
-                ret = __of_changeset_revert_notify(&ovcs->cset);
-                if (ret) {
-                        pr_err("overlay changeset entry notify error %d\n",
-                               ret);
-                        /* fall through - changeset was reverted */
-                }
         }
 
+        ret = __of_changeset_revert_notify(&ovcs->cset);
+        if (ret)
+                pr_err("overlay changeset entry notify error %d\n", ret);
+        /* notify failure is not fatal, continue */
+
         *ovcs_id = 0;
 
         ret_tmp = overlay_notify(ovcs, OF_OVERLAY_POST_REMOVE);
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index e568b1e82501..0f8052f1355c 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -2165,7 +2165,6 @@ static int __init overlay_data_add(int onum)
         ret = of_overlay_apply(info->np_overlay, &info->overlay_id);
         if (ret < 0) {
                 pr_err("of_overlay_apply() (ret=%d), %d\n", ret, onum);
-                of_overlay_mutex_unlock();
                 goto out_free_np_overlay;
         }
 
diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index 0b3fb99d9b89..7390fb8ca9d1 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -303,7 +303,7 @@ static void dino_mask_irq(struct irq_data *d)
         struct dino_device *dino_dev = irq_data_get_irq_chip_data(d);
         int local_irq = gsc_find_local_irq(d->irq, dino_dev->global_irq, DINO_LOCAL_IRQS);
 
-        DBG(KERN_WARNING "%s(0x%p, %d)\n", __func__, dino_dev, d->irq);
+        DBG(KERN_WARNING "%s(0x%px, %d)\n", __func__, dino_dev, d->irq);
 
         /* Clear the matching bit in the IMR register */
         dino_dev->imr &= ~(DINO_MASK_IRQ(local_irq));
@@ -316,7 +316,7 @@ static void dino_unmask_irq(struct irq_data *d)
         int local_irq = gsc_find_local_irq(d->irq, dino_dev->global_irq, DINO_LOCAL_IRQS);
         u32 tmp;
 
-        DBG(KERN_WARNING "%s(0x%p, %d)\n", __func__, dino_dev, d->irq);
+        DBG(KERN_WARNING "%s(0x%px, %d)\n", __func__, dino_dev, d->irq);
 
         /*
         ** clear pending IRQ bits
@@ -396,7 +396,7 @@ ilr_again:
         if (mask) {
                 if (--ilr_loop > 0)
                         goto ilr_again;
-                printk(KERN_ERR "Dino 0x%p: stuck interrupt %d\n", 
+                printk(KERN_ERR "Dino 0x%px: stuck interrupt %d\n",
                        dino_dev->hba.base_addr, mask);
                 return IRQ_NONE;
         }
@@ -553,7 +553,7 @@ dino_fixup_bus(struct pci_bus *bus)
         struct pci_dev *dev;
         struct dino_device *dino_dev = DINO_DEV(parisc_walk_tree(bus->bridge));
 
-        DBG(KERN_WARNING "%s(0x%p) bus %d platform_data 0x%p\n",
+        DBG(KERN_WARNING "%s(0x%px) bus %d platform_data 0x%px\n",
             __func__, bus, bus->busn_res.start,
             bus->bridge->platform_data);
 
@@ -854,7 +854,7 @@ static int __init dino_common_init(struct parisc_device *dev,
         res->flags = IORESOURCE_IO; /* do not mark it busy ! */
         if (request_resource(&ioport_resource, res) < 0) {
                 printk(KERN_ERR "%s: request I/O Port region failed "
-                       "0x%lx/%lx (hpa 0x%p)\n",
+                       "0x%lx/%lx (hpa 0x%px)\n",
                        name, (unsigned long)res->start, (unsigned long)res->end,
                        dino_dev->hba.base_addr);
                 return 1;
diff --git a/drivers/parisc/eisa_eeprom.c b/drivers/parisc/eisa_eeprom.c
index 4dd9b1308128..99a80da6fd2e 100644
--- a/drivers/parisc/eisa_eeprom.c
+++ b/drivers/parisc/eisa_eeprom.c
@@ -106,7 +106,7 @@ static int __init eisa_eeprom_init(void)
                 return retval;
         }
 
-        printk(KERN_INFO "EISA EEPROM at 0x%p\n", eisa_eeprom_addr);
+        printk(KERN_INFO "EISA EEPROM at 0x%px\n", eisa_eeprom_addr);
         return 0;
 }
 
diff --git a/drivers/parisc/lba_pci.c b/drivers/parisc/lba_pci.c
index a25fed52f7e9..41b740aed3a3 100644
--- a/drivers/parisc/lba_pci.c
+++ b/drivers/parisc/lba_pci.c
@@ -1692,3 +1692,36 @@ void lba_set_iregs(struct parisc_device *lba, u32 ibase, u32 imask)
         iounmap(base_addr);
 }
 
+
+/*
+ * The design of the Diva management card in rp34x0 machines (rp3410, rp3440)
+ * seems rushed, so that many built-in components simply don't work.
+ * The following quirks disable the serial AUX port and the built-in ATI RV100
+ * Radeon 7000 graphics card which both don't have any external connectors and
+ * thus are useless, and even worse, e.g. the AUX port occupies ttyS0 and as
+ * such makes those machines the only PARISC machines on which we can't use
+ * ttyS0 as boot console.
+ */
+static void quirk_diva_ati_card(struct pci_dev *dev)
+{
+        if (dev->subsystem_vendor != PCI_VENDOR_ID_HP ||
+            dev->subsystem_device != 0x1292)
+                return;
+
+        dev_info(&dev->dev, "Hiding Diva built-in ATI card");
+        dev->device = 0;
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QY,
+        quirk_diva_ati_card);
+
+static void quirk_diva_aux_disable(struct pci_dev *dev)
+{
+        if (dev->subsystem_vendor != PCI_VENDOR_ID_HP ||
+            dev->subsystem_device != 0x1291)
+                return;
+
+        dev_info(&dev->dev, "Hiding Diva built-in AUX serial device");
+        dev->device = 0;
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_DIVA_AUX,
+        quirk_diva_aux_disable);
diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c
index 04dac6a42c9f..6b8d060d07de 100644
--- a/drivers/pci/host/pci-hyperv.c
+++ b/drivers/pci/host/pci-hyperv.c
@@ -985,9 +985,7 @@ static u32 hv_compose_msi_req_v1(
         int_pkt->wslot.slot = slot;
         int_pkt->int_desc.vector = vector;
         int_pkt->int_desc.vector_count = 1;
-        int_pkt->int_desc.delivery_mode =
-                (apic->irq_delivery_mode == dest_LowestPrio) ?
-                        dest_LowestPrio : dest_Fixed;
+        int_pkt->int_desc.delivery_mode = dest_Fixed;
 
         /*
          * Create MSI w/ dummy vCPU set, overwritten by subsequent retarget in
@@ -1008,9 +1006,7 @@ static u32 hv_compose_msi_req_v2(
         int_pkt->wslot.slot = slot;
         int_pkt->int_desc.vector = vector;
         int_pkt->int_desc.vector_count = 1;
-        int_pkt->int_desc.delivery_mode =
-                (apic->irq_delivery_mode == dest_LowestPrio) ?
-                        dest_LowestPrio : dest_Fixed;
+        int_pkt->int_desc.delivery_mode = dest_Fixed;
 
         /*
          * Create MSI w/ dummy vCPU set targeting just one vCPU, overwritten
diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c
index 12796eccb2be..52ab3cb0a0bf 100644
--- a/drivers/pci/host/pcie-rcar.c
+++ b/drivers/pci/host/pcie-rcar.c
@@ -1128,12 +1128,12 @@ static int rcar_pcie_probe(struct platform_device *pdev)
         err = rcar_pcie_get_resources(pcie);
         if (err < 0) {
                 dev_err(dev, "failed to request resources: %d\n", err);
-                goto err_free_bridge;
+                goto err_free_resource_list;
         }
 
         err = rcar_pcie_parse_map_dma_ranges(pcie, dev->of_node);
         if (err)
-                goto err_free_bridge;
+                goto err_free_resource_list;
 
         pm_runtime_enable(dev);
         err = pm_runtime_get_sync(dev);
@@ -1176,9 +1176,9 @@ err_pm_put:
 err_pm_disable:
         pm_runtime_disable(dev);
 
-err_free_bridge:
-        pci_free_host_bridge(bridge);
+err_free_resource_list:
         pci_free_resource_list(&pcie->resources);
+        pci_free_host_bridge(bridge);
 
         return err;
 }
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 7f47bb72bf30..14fd865a5120 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -999,7 +999,7 @@ static int pci_pm_thaw_noirq(struct device *dev)
          * the subsequent "thaw" callbacks for the device.
          */
         if (dev_pm_smart_suspend_and_suspended(dev)) {
-                dev->power.direct_complete = true;
+                dev_pm_skip_next_resume_phases(dev);
                 return 0;
         }
 
@@ -1012,7 +1012,12 @@ static int pci_pm_thaw_noirq(struct device *dev)
         if (pci_has_legacy_pm_support(pci_dev))
                 return pci_legacy_resume_early(dev);
 
-        pci_update_current_state(pci_dev, PCI_D0);
+        /*
+         * pci_restore_state() requires the device to be in D0 (because of MSI
+         * restoration among other things), so force it into D0 in case the
+         * driver's "freeze" callbacks put it into a low-power state directly.
+         */
+        pci_set_power_state(pci_dev, PCI_D0);
         pci_restore_state(pci_dev);
 
         if (drv && drv->pm && drv->pm->thaw_noirq)
diff --git a/drivers/phy/motorola/phy-cpcap-usb.c b/drivers/phy/motorola/phy-cpcap-usb.c
index accaaaccb662..6601ad0dfb3a 100644
--- a/drivers/phy/motorola/phy-cpcap-usb.c
+++ b/drivers/phy/motorola/phy-cpcap-usb.c
@@ -310,7 +310,7 @@ static int cpcap_usb_init_irq(struct platform_device *pdev,
         int irq, error;
 
         irq = platform_get_irq_byname(pdev, name);
-        if (!irq)
+        if (irq < 0)
                 return -ENODEV;
 
         error = devm_request_threaded_irq(ddata->dev, irq, NULL,
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index b4964b067aec..8f6e8e28996d 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -410,6 +410,10 @@ static struct phy *_of_phy_get(struct device_node *np, int index)
         if (ret)
                 return ERR_PTR(-ENODEV);
 
+        /* This phy type handled by the usb-phy subsystem for now */
+        if (of_device_is_compatible(args.np, "usb-nop-xceiv"))
+                return ERR_PTR(-ENODEV);
+
         mutex_lock(&phy_provider_mutex);
         phy_provider = of_phy_provider_lookup(args.np);
         if (IS_ERR(phy_provider) || !try_module_get(phy_provider->owner)) {
diff --git a/drivers/phy/renesas/Kconfig b/drivers/phy/renesas/Kconfig
index cb09245e9b4c..c845facacb06 100644
--- a/drivers/phy/renesas/Kconfig
+++ b/drivers/phy/renesas/Kconfig
@@ -12,7 +12,9 @@ config PHY_RCAR_GEN3_USB2
         tristate "Renesas R-Car generation 3 USB 2.0 PHY driver"
         depends on ARCH_RENESAS
         depends on EXTCON
+        depends on USB_SUPPORT
         select GENERIC_PHY
+        select USB_COMMON
         help
           Support for USB 2.0 PHY found on Renesas R-Car generation 3 SoCs.
 
diff --git a/drivers/phy/rockchip/phy-rockchip-typec.c b/drivers/phy/rockchip/phy-rockchip-typec.c
index ee85fa0ca4b0..7492c8978217 100644
--- a/drivers/phy/rockchip/phy-rockchip-typec.c
+++ b/drivers/phy/rockchip/phy-rockchip-typec.c
@@ -1137,6 +1137,7 @@ static int rockchip_typec_phy_probe(struct platform_device *pdev)
                 if (IS_ERR(phy)) {
                         dev_err(dev, "failed to create phy: %s\n",
                                 child_np->name);
+                        pm_runtime_disable(dev);
                         return PTR_ERR(phy);
                 }
 
@@ -1146,6 +1147,7 @@ static int rockchip_typec_phy_probe(struct platform_device *pdev)
         phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
         if (IS_ERR(phy_provider)) {
                 dev_err(dev, "Failed to register phy provider\n");
+                pm_runtime_disable(dev);
                 return PTR_ERR(phy_provider);
         }
 
diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
index 4307bf0013e1..63e916d4d069 100644
--- a/drivers/phy/tegra/xusb.c
+++ b/drivers/phy/tegra/xusb.c
@@ -75,14 +75,14 @@ MODULE_DEVICE_TABLE(of, tegra_xusb_padctl_of_match);
 static struct device_node *
 tegra_xusb_find_pad_node(struct tegra_xusb_padctl *padctl, const char *name)
 {
-        /*
-         * of_find_node_by_name() drops a reference, so make sure to grab one.
-         */
-        struct device_node *np = of_node_get(padctl->dev->of_node);
+        struct device_node *pads, *np;
+
+        pads = of_get_child_by_name(padctl->dev->of_node, "pads");
+        if (!pads)
+                return NULL;
 
-        np = of_find_node_by_name(np, "pads");
-        if (np)
-                np = of_find_node_by_name(np, name);
+        np = of_get_child_by_name(pads, name);
+        of_node_put(pads);
 
         return np;
 }
@@ -90,16 +90,16 @@ tegra_xusb_find_pad_node(struct tegra_xusb_padctl *padctl, const char *name)
 static struct device_node *
 tegra_xusb_pad_find_phy_node(struct tegra_xusb_pad *pad, unsigned int index)
 {
-        /*
-         * of_find_node_by_name() drops a reference, so make sure to grab one.
-         */
-        struct device_node *np = of_node_get(pad->dev.of_node);
+        struct device_node *np, *lanes;
 
-        np = of_find_node_by_name(np, "lanes");
-        if (!np)
+        lanes = of_get_child_by_name(pad->dev.of_node, "lanes");
+        if (!lanes)
                 return NULL;
 
-        return of_find_node_by_name(np, pad->soc->lanes[index].name);
+        np = of_get_child_by_name(lanes, pad->soc->lanes[index].name);
+        of_node_put(lanes);
+
+        return np;
 }
 
 static int
@@ -195,7 +195,7 @@ int tegra_xusb_pad_register(struct tegra_xusb_pad *pad,
         unsigned int i;
         int err;
 
-        children = of_find_node_by_name(pad->dev.of_node, "lanes");
+        children = of_get_child_by_name(pad->dev.of_node, "lanes");
         if (!children)
                 return -ENODEV;
 
@@ -444,21 +444,21 @@ static struct device_node *
 tegra_xusb_find_port_node(struct tegra_xusb_padctl *padctl, const char *type,
                           unsigned int index)
 {
-        /*
-         * of_find_node_by_name() drops a reference, so make sure to grab one.
-         */
-        struct device_node *np = of_node_get(padctl->dev->of_node);
+        struct device_node *ports, *np;
+        char *name;
 
-        np = of_find_node_by_name(np, "ports");
-        if (np) {
-                char *name;
+        ports = of_get_child_by_name(padctl->dev->of_node, "ports");
+        if (!ports)
+                return NULL;
 
-                name = kasprintf(GFP_KERNEL, "%s-%u", type, index);
-                if (!name)
-                        return ERR_PTR(-ENOMEM);
-                np = of_find_node_by_name(np, name);
-                kfree(name);
+        name = kasprintf(GFP_KERNEL, "%s-%u", type, index);
+        if (!name) {
+                of_node_put(ports);
+                return ERR_PTR(-ENOMEM);
         }
+        np = of_get_child_by_name(ports, name);
+        kfree(name);
+        of_node_put(ports);
 
         return np;
 }
@@ -847,7 +847,7 @@ static void tegra_xusb_remove_ports(struct tegra_xusb_padctl *padctl)
 
 static int tegra_xusb_padctl_probe(struct platform_device *pdev)
 {
-        struct device_node *np = of_node_get(pdev->dev.of_node);
+        struct device_node *np = pdev->dev.of_node;
         const struct tegra_xusb_padctl_soc *soc;
         struct tegra_xusb_padctl *padctl;
         const struct of_device_id *match;
@@ -855,7 +855,7 @@ static int tegra_xusb_padctl_probe(struct platform_device *pdev)
         int err;
 
         /* for backwards compatibility with old device trees */
-        np = of_find_node_by_name(np, "pads");
+        np = of_get_child_by_name(np, "pads");
         if (!np) {
                 dev_warn(&pdev->dev, "deprecated DT, using legacy driver\n");
                 return tegra_xusb_padctl_legacy_probe(pdev);
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index bdedb6325c72..4471fd94e1fe 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1620,6 +1620,22 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
                         clear_bit(i, chip->irq.valid_mask);
         }
 
+        /*
+         * The same set of machines in chv_no_valid_mask[] have incorrectly
+         * configured GPIOs that generate spurious interrupts so we use
+         * this same list to apply another quirk for them.
+         *
+         * See also https://bugzilla.kernel.org/show_bug.cgi?id=197953.
+         */
+        if (!need_valid_mask) {
+                /*
+                 * Mask all interrupts the community is able to generate
+                 * but leave the ones that can only generate GPEs unmasked.
+                 */
+                chv_writel(GENMASK(31, pctrl->community->nirqs),
+                           pctrl->regs + CHV_INTMASK);
+        }
+
         /* Clear all interrupts */
         chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
 
diff --git a/drivers/pinctrl/intel/pinctrl-denverton.c b/drivers/pinctrl/intel/pinctrl-denverton.c
index 4500880240f2..6572550cfe78 100644
--- a/drivers/pinctrl/intel/pinctrl-denverton.c
+++ b/drivers/pinctrl/intel/pinctrl-denverton.c
@@ -207,7 +207,7 @@ static const unsigned int dnv_uart0_pins[] = { 60, 61, 64, 65 };
 static const unsigned int dnv_uart0_modes[] = { 2, 3, 1, 1 };
 static const unsigned int dnv_uart1_pins[] = { 94, 95, 96, 97 };
 static const unsigned int dnv_uart2_pins[] = { 60, 61, 62, 63 };
-static const unsigned int dnv_uart2_modes[] = { 1, 1, 2, 2 };
+static const unsigned int dnv_uart2_modes[] = { 1, 2, 2, 2 };
 static const unsigned int dnv_emmc_pins[] = {
         142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152,
 };
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
index d45af31b86b4..bdb8d174efef 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
@@ -408,12 +408,21 @@ static int armada_37xx_gpio_direction_output(struct gpio_chip *chip,
 {
         struct armada_37xx_pinctrl *info = gpiochip_get_data(chip);
         unsigned int reg = OUTPUT_EN;
-        unsigned int mask;
+        unsigned int mask, val, ret;
 
         armada_37xx_update_reg(&reg, offset);
         mask = BIT(offset);
 
-        return regmap_update_bits(info->regmap, reg, mask, mask);
+        ret = regmap_update_bits(info->regmap, reg, mask, mask);
+
+        if (ret)
+                return ret;
+
+        reg = OUTPUT_VAL;
+        val = value ? mask : 0;
+        regmap_update_bits(info->regmap, reg, mask, val);
+
+        return 0;
 }
 
 static int armada_37xx_gpio_get(struct gpio_chip *chip, unsigned int offset)
diff --git a/drivers/pinctrl/pinctrl-gemini.c b/drivers/pinctrl/pinctrl-gemini.c
index e9b83e291edf..c11b8f14d841 100644
--- a/drivers/pinctrl/pinctrl-gemini.c
+++ b/drivers/pinctrl/pinctrl-gemini.c
@@ -2322,7 +2322,7 @@ static const struct gemini_pin_conf *gemini_get_pin_conf(struct gemini_pmx *pmx,
         int i;
 
         for (i = 0; i < pmx->nconfs; i++) {
-                retconf = &gemini_confs_3516[i];
+                retconf = &pmx->confs[i];
                 if (retconf->pin == pin)
                         return retconf;
         }
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index e6cd8de793e2..3501491e5bfc 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -222,6 +222,9 @@ static enum pin_config_param pcs_bias[] = {
  */
 static struct lock_class_key pcs_lock_class;
 
+/* Class for the IRQ request mutex */
+static struct lock_class_key pcs_request_class;
+
 /*
  * REVISIT: Reads and writes could eventually use regmap or something
  * generic. But at least on omaps, some mux registers are performance
@@ -1486,7 +1489,7 @@ static int pcs_irqdomain_map(struct irq_domain *d, unsigned int irq,
         irq_set_chip_data(irq, pcs_soc);
         irq_set_chip_and_handler(irq, &pcs->chip,
                                  handle_level_irq);
-        irq_set_lockdep_class(irq, &pcs_lock_class);
+        irq_set_lockdep_class(irq, &pcs_lock_class, &pcs_request_class);
         irq_set_noprobe(irq);
 
         return 0;
diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
index a276c61be217..e62ab087bfd8 100644
--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
@@ -290,7 +290,7 @@ static int stm32_gpio_domain_translate(struct irq_domain *d,
 }
 
 static int stm32_gpio_domain_activate(struct irq_domain *d,
-                                      struct irq_data *irq_data, bool early)
+                                      struct irq_data *irq_data, bool reserve)
 {
         struct stm32_gpio_bank *bank = d->host_data;
         struct stm32_pinctrl *pctl = dev_get_drvdata(bank->gpio_chip.parent);
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c b/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c
index 4f2a726bbaeb..f5f77432ce6f 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c
@@ -428,7 +428,7 @@ static const struct sunxi_desc_pin a64_pins[] = {
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
                   SUNXI_FUNCTION(0x2, "mmc0"),          /* D3 */
-                  SUNXI_FUNCTION(0x4, "uart0")),        /* RX */
+                  SUNXI_FUNCTION(0x3, "uart0")),        /* RX */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(F, 5),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun50i-h5.c b/drivers/pinctrl/sunxi/pinctrl-sun50i-h5.c
index 97b48336f84a..a78d7b922ef4 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-h5.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-h5.c
@@ -535,14 +535,16 @@ static const struct sunxi_pinctrl_desc sun50i_h5_pinctrl_data_broken = {
         .pins = sun50i_h5_pins,
         .npins = ARRAY_SIZE(sun50i_h5_pins),
         .irq_banks = 2,
-        .irq_read_needs_mux = true
+        .irq_read_needs_mux = true,
+        .disable_strict_mode = true,
 };
 
 static const struct sunxi_pinctrl_desc sun50i_h5_pinctrl_data = {
         .pins = sun50i_h5_pins,
         .npins = ARRAY_SIZE(sun50i_h5_pins),
         .irq_banks = 3,
-        .irq_read_needs_mux = true
+        .irq_read_needs_mux = true,
+        .disable_strict_mode = true,
 };
 
 static int sun50i_h5_pinctrl_probe(struct platform_device *pdev)
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c b/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c
index 472ef0d91b99..5553c0eb0f41 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c
@@ -145,19 +145,19 @@ static const struct sunxi_desc_pin sun9i_a80_pins[] = {
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
                   SUNXI_FUNCTION(0x3, "mcsi"),          /* MCLK */
-                  SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 14)), /* PB_EINT14 */
+                  SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 14)), /* PB_EINT14 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 15),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
                   SUNXI_FUNCTION(0x3, "mcsi"),          /* SCK */
                   SUNXI_FUNCTION(0x4, "i2c4"),          /* SCK */
-                  SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 15)), /* PB_EINT15 */
+                  SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 15)), /* PB_EINT15 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 16),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
                   SUNXI_FUNCTION(0x3, "mcsi"),          /* SDA */
                   SUNXI_FUNCTION(0x4, "i2c4"),          /* SDA */
-                  SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 16)), /* PB_EINT16 */
+                  SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 16)), /* PB_EINT16 */
 
         /* Hole */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 0),
diff --git a/drivers/platform/x86/asus-wireless.c b/drivers/platform/x86/asus-wireless.c
index f3796164329e..d4aeac3477f5 100644
--- a/drivers/platform/x86/asus-wireless.c
+++ b/drivers/platform/x86/asus-wireless.c
@@ -118,6 +118,7 @@ static void asus_wireless_notify(struct acpi_device *adev, u32 event)
                 return;
         }
         input_report_key(data->idev, KEY_RFKILL, 1);
+        input_sync(data->idev);
         input_report_key(data->idev, KEY_RFKILL, 0);
         input_sync(data->idev);
 }
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index bf897b1832b1..cd4725e7e0b5 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -37,6 +37,7 @@
 
 struct quirk_entry {
         u8 touchpad_led;
+        u8 kbd_led_levels_off_1;
 
         int needs_kbd_timeouts;
         /*
@@ -67,6 +68,10 @@ static struct quirk_entry quirk_dell_xps13_9333 = {
         .kbd_timeouts = { 0, 5, 15, 60, 5 * 60, 15 * 60, -1 },
 };
 
+static struct quirk_entry quirk_dell_latitude_e6410 = {
+        .kbd_led_levels_off_1 = 1,
+};
+
 static struct platform_driver platform_driver = {
         .driver = {
                 .name = "dell-laptop",
@@ -269,6 +274,15 @@ static const struct dmi_system_id dell_quirks[] __initconst = {
                 },
                 .driver_data = &quirk_dell_xps13_9333,
         },
+        {
+                .callback = dmi_matched,
+                .ident = "Dell Latitude E6410",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6410"),
+                },
+                .driver_data = &quirk_dell_latitude_e6410,
+        },
         { }
 };
 
@@ -1149,6 +1163,9 @@ static int kbd_get_info(struct kbd_info *info)
         units = (buffer->output[2] >> 8) & 0xFF;
         info->levels = (buffer->output[2] >> 16) & 0xFF;
 
+        if (quirks && quirks->kbd_led_levels_off_1 && info->levels)
+                info->levels--;
+
         if (units & BIT(0))
                 info->seconds = (buffer->output[3] >> 0) & 0xFF;
         if (units & BIT(1))
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index 39d2f4518483..fb25b20df316 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -639,6 +639,8 @@ static int dell_wmi_events_set_enabled(bool enable)
         int ret;
 
         buffer = kzalloc(sizeof(struct calling_interface_buffer), GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
         buffer->cmd_class = CLASS_INFO;
         buffer->cmd_select = SELECT_APP_REGISTRATION;
         buffer->input[0] = 0x10000;
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 791449a2370f..daa68acbc900 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -1458,5 +1458,5 @@ static void __exit acpi_wmi_exit(void)
         class_unregister(&wmi_bus_class);
 }
 
-subsys_initcall(acpi_wmi_init);
+subsys_initcall_sync(acpi_wmi_init);
 module_exit(acpi_wmi_exit);
diff --git a/drivers/s390/Makefile b/drivers/s390/Makefile
index e5225ad9c5b1..2fdab400c1fe 100644
--- a/drivers/s390/Makefile
+++ b/drivers/s390/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Makefile for the S/390 specific device drivers
 #
diff --git a/drivers/s390/block/Kconfig b/drivers/s390/block/Kconfig
index 31f014b57bfc..bc27d716aa6b 100644
--- a/drivers/s390/block/Kconfig
+++ b/drivers/s390/block/Kconfig
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 comment "S/390 block device drivers"
         depends on S390 && BLOCK
 
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 66e008f7adb6..d4e8dff673cc 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -759,7 +759,7 @@ static void dasd_profile_end_add_data(struct dasd_profile_info *data,
         /* in case of an overflow, reset the whole profile */
         if (data->dasd_io_reqs == UINT_MAX) {
                         memset(data, 0, sizeof(*data));
-                        getnstimeofday(&data->starttod);
+                        ktime_get_real_ts64(&data->starttod);
         }
         data->dasd_io_reqs++;
         data->dasd_io_sects += sectors;
@@ -894,7 +894,7 @@ void dasd_profile_reset(struct dasd_profile *profile)
                 return;
         }
         memset(data, 0, sizeof(*data));
-        getnstimeofday(&data->starttod);
+        ktime_get_real_ts64(&data->starttod);
         spin_unlock_bh(&profile->lock);
 }
 
@@ -911,7 +911,7 @@ int dasd_profile_on(struct dasd_profile *profile)
                 kfree(data);
                 return 0;
         }
-        getnstimeofday(&data->starttod);
+        ktime_get_real_ts64(&data->starttod);
         profile->data = data;
         spin_unlock_bh(&profile->lock);
         return 0;
@@ -995,8 +995,8 @@ static void dasd_stats_array(struct seq_file *m, unsigned int *array)
 static void dasd_stats_seq_print(struct seq_file *m,
                                  struct dasd_profile_info *data)
 {
-        seq_printf(m, "start_time %ld.%09ld\n",
-                   data->starttod.tv_sec, data->starttod.tv_nsec);
+        seq_printf(m, "start_time %lld.%09ld\n",
+                   (s64)data->starttod.tv_sec, data->starttod.tv_nsec);
         seq_printf(m, "total_requests %u\n", data->dasd_io_reqs);
         seq_printf(m, "total_sectors %u\n", data->dasd_io_sects);
         seq_printf(m, "total_pav %u\n", data->dasd_io_alias);
diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c
index c94b606e0df8..ee14d8e45c97 100644
--- a/drivers/s390/block/dasd_3990_erp.c
+++ b/drivers/s390/block/dasd_3990_erp.c
@@ -2803,6 +2803,16 @@ dasd_3990_erp_action(struct dasd_ccw_req * cqr)
                 erp = dasd_3990_erp_handle_match_erp(cqr, erp);
         }
 
+
+        /*
+         * For path verification work we need to stick with the path that was
+         * originally chosen so that the per path configuration data is
+         * assigned correctly.
+         */
+        if (test_bit(DASD_CQR_VERIFY_PATH, &erp->flags) && cqr->lpm) {
+                erp->lpm = cqr->lpm;
+        }
+
         if (device->features & DASD_FEATURE_ERPLOG) {
                 /* print current erp_chain */
                 dev_err(&device->cdev->dev,
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 1a41ef496338..a2edf2a7ace9 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -531,10 +531,12 @@ static int prefix_LRE(struct ccw1 *ccw, struct PFX_eckd_data *pfxdata,
         pfxdata->validity.define_extent = 1;
 
         /* private uid is kept up to date, conf_data may be outdated */
-        if (startpriv->uid.type != UA_BASE_DEVICE) {
+        if (startpriv->uid.type == UA_BASE_PAV_ALIAS)
                 pfxdata->validity.verify_base = 1;
-                if (startpriv->uid.type == UA_HYPER_PAV_ALIAS)
-                        pfxdata->validity.hyper_pav = 1;
+
+        if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) {
+                pfxdata->validity.verify_base = 1;
+                pfxdata->validity.hyper_pav = 1;
         }
 
         rc = define_extent(NULL, dedata, trk, totrk, cmd, basedev, blksize);
@@ -3415,10 +3417,12 @@ static int prepare_itcw(struct itcw *itcw,
         pfxdata.validity.define_extent = 1;
 
         /* private uid is kept up to date, conf_data may be outdated */
-        if (startpriv->uid.type != UA_BASE_DEVICE) {
+        if (startpriv->uid.type == UA_BASE_PAV_ALIAS)
+                pfxdata.validity.verify_base = 1;
+
+        if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) {
                 pfxdata.validity.verify_base = 1;
-                if (startpriv->uid.type == UA_HYPER_PAV_ALIAS)
-                        pfxdata.validity.hyper_pav = 1;
+                pfxdata.validity.hyper_pav = 1;
         }
 
         switch (cmd) {
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index b095a23bcc0c..96709b1a7bf8 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -441,7 +441,7 @@ struct dasd_profile_info {
         unsigned int dasd_io_nr_req[32]; /* hist. of # of requests in chanq */
 
         /* new data */
-        struct timespec starttod;          /* time of start or last reset */
+        struct timespec64 starttod;        /* time of start or last reset */
         unsigned int dasd_io_alias;        /* requests using an alias */
         unsigned int dasd_io_tpm;          /* requests using transport mode */
         unsigned int dasd_read_reqs;       /* total number of read  requests */
diff --git a/drivers/s390/char/Kconfig b/drivers/s390/char/Kconfig
index 97c4c9fdd53d..ab0b243a947d 100644
--- a/drivers/s390/char/Kconfig
+++ b/drivers/s390/char/Kconfig
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 comment "S/390 character device drivers"
         depends on S390
 
diff --git a/drivers/s390/char/Makefile b/drivers/s390/char/Makefile
index 05ac6ba15a53..614b44e70a28 100644
--- a/drivers/s390/char/Makefile
+++ b/drivers/s390/char/Makefile
@@ -17,6 +17,8 @@ CFLAGS_REMOVE_sclp_early_core.o	+= $(CC_FLAGS_MARCH)
 CFLAGS_sclp_early_core.o                += -march=z900
 endif
 
+CFLAGS_sclp_early_core.o                += -D__NO_FORTIFY
+
 obj-y += ctrlchar.o keyboard.o defkeymap.o sclp.o sclp_rw.o sclp_quiesce.o \
          sclp_cmd.o sclp_config.o sclp_cpi_sys.o sclp_ocf.o sclp_ctl.o \
          sclp_early.o sclp_early_core.o
diff --git a/drivers/s390/char/defkeymap.map b/drivers/s390/char/defkeymap.map
index 353b3f268824..f4c095612a02 100644
--- a/drivers/s390/char/defkeymap.map
+++ b/drivers/s390/char/defkeymap.map
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 # Default keymap for 3270 (ebcdic codepage 037).
 keymaps 0-1,4-5
 
diff --git a/drivers/s390/cio/blacklist.h b/drivers/s390/cio/blacklist.h
index 95e25c1df922..140e3e4ee2fd 100644
--- a/drivers/s390/cio/blacklist.h
+++ b/drivers/s390/cio/blacklist.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 #ifndef S390_BLACKLIST_H
 #define S390_BLACKLIST_H
 
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 59b4a3370cd5..95b0efe28afb 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -431,8 +431,8 @@ static void process_buffer_error(struct qdio_q *q, int count)
         q->qdio_error = QDIO_ERROR_SLSB_STATE;
 
         /* special handling for no target buffer empty */
-        if ((!q->is_input_q &&
-            (q->sbal[q->first_to_check]->element[15].sflags) == 0x10)) {
+        if (queue_type(q) == QDIO_IQDIO_QFMT && !q->is_input_q &&
+            q->sbal[q->first_to_check]->element[15].sflags == 0x10) {
                 qperf_inc(q, target_full);
                 DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "OUTFULL FTC:%02x",
                               q->first_to_check);
@@ -536,7 +536,8 @@ static int get_inbound_buffer_frontier(struct qdio_q *q)
         case SLSB_P_INPUT_ERROR:
                 process_buffer_error(q, count);
                 q->first_to_check = add_buf(q->first_to_check, count);
-                atomic_sub(count, &q->nr_buf_used);
+                if (atomic_sub_return(count, &q->nr_buf_used) == 0)
+                        qperf_inc(q, inbound_queue_full);
                 if (q->irq_ptr->perf_stat_enabled)
                         account_sbals_error(q, count);
                 break;
diff --git a/drivers/s390/net/Kconfig b/drivers/s390/net/Kconfig
index b2837b1c70b7..a782a207ad31 100644
--- a/drivers/s390/net/Kconfig
+++ b/drivers/s390/net/Kconfig
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 menu "S/390 network device drivers"
         depends on NETDEVICES && S390
 
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index 9cd569ef43ec..badf42acbf95 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -565,9 +565,9 @@ enum qeth_cq {
 };
 
 struct qeth_ipato {
-        int enabled;
-        int invert4;
-        int invert6;
+        bool enabled;
+        bool invert4;
+        bool invert6;
         struct list_head entries;
 };
 
@@ -987,6 +987,9 @@ struct qeth_cmd_buffer *qeth_get_setassparms_cmd(struct qeth_card *,
 int qeth_set_features(struct net_device *, netdev_features_t);
 void qeth_recover_features(struct net_device *dev);
 netdev_features_t qeth_fix_features(struct net_device *, netdev_features_t);
+netdev_features_t qeth_features_check(struct sk_buff *skb,
+                                      struct net_device *dev,
+                                      netdev_features_t features);
 int qeth_vm_request_mac(struct qeth_card *card);
 int qeth_push_hdr(struct sk_buff *skb, struct qeth_hdr **hdr, unsigned int len);
 
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 98a7f84540ab..3614df68830f 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -20,6 +20,11 @@
 #include <linux/mii.h>
 #include <linux/kthread.h>
 #include <linux/slab.h>
+#include <linux/if_vlan.h>
+#include <linux/netdevice.h>
+#include <linux/netdev_features.h>
+#include <linux/skbuff.h>
+
 #include <net/iucv/af_iucv.h>
 #include <net/dsfield.h>
 
@@ -1475,9 +1480,9 @@ static int qeth_setup_card(struct qeth_card *card)
         qeth_set_intial_options(card);
         /* IP address takeover */
         INIT_LIST_HEAD(&card->ipato.entries);
-        card->ipato.enabled = 0;
-        card->ipato.invert4 = 0;
-        card->ipato.invert6 = 0;
+        card->ipato.enabled = false;
+        card->ipato.invert4 = false;
+        card->ipato.invert6 = false;
         /* init QDIO stuff */
         qeth_init_qdio_info(card);
         INIT_DELAYED_WORK(&card->buffer_reclaim_work, qeth_buffer_reclaim_work);
@@ -5381,6 +5386,13 @@ out:
 }
 EXPORT_SYMBOL_GPL(qeth_poll);
 
+static int qeth_setassparms_inspect_rc(struct qeth_ipa_cmd *cmd)
+{
+        if (!cmd->hdr.return_code)
+                cmd->hdr.return_code = cmd->data.setassparms.hdr.return_code;
+        return cmd->hdr.return_code;
+}
+
 int qeth_setassparms_cb(struct qeth_card *card,
                         struct qeth_reply *reply, unsigned long data)
 {
@@ -6237,7 +6249,7 @@ static int qeth_ipa_checksum_run_cmd_cb(struct qeth_card *card,
                                 (struct qeth_checksum_cmd *)reply->param;
 
         QETH_CARD_TEXT(card, 4, "chkdoccb");
-        if (cmd->hdr.return_code)
+        if (qeth_setassparms_inspect_rc(cmd))
                 return 0;
 
         memset(chksum_cb, 0, sizeof(*chksum_cb));
@@ -6439,6 +6451,32 @@ netdev_features_t qeth_fix_features(struct net_device *dev,
 }
 EXPORT_SYMBOL_GPL(qeth_fix_features);
 
+netdev_features_t qeth_features_check(struct sk_buff *skb,
+                                      struct net_device *dev,
+                                      netdev_features_t features)
+{
+        /* GSO segmentation builds skbs with
+         *      a (small) linear part for the headers, and
+         *      page frags for the data.
+         * Compared to a linear skb, the header-only part consumes an
+         * additional buffer element. This reduces buffer utilization, and
+         * hurts throughput. So compress small segments into one element.
+         */
+        if (netif_needs_gso(skb, features)) {
+                /* match skb_segment(): */
+                unsigned int doffset = skb->data - skb_mac_header(skb);
+                unsigned int hsize = skb_shinfo(skb)->gso_size;
+                unsigned int hroom = skb_headroom(skb);
+
+                /* linearize only if resulting skb allocations are order-0: */
+                if (SKB_DATA_ALIGN(hroom + doffset + hsize) <= SKB_MAX_HEAD(0))
+                        features &= ~NETIF_F_SG;
+        }
+
+        return vlan_features_check(skb, features);
+}
+EXPORT_SYMBOL_GPL(qeth_features_check);
+
 static int __init qeth_core_init(void)
 {
         int rc;
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 93d7e345d180..5863ea170ff2 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -961,6 +961,7 @@ static const struct net_device_ops qeth_l2_netdev_ops = {
         .ndo_stop               = qeth_l2_stop,
         .ndo_get_stats          = qeth_get_stats,
         .ndo_start_xmit         = qeth_l2_hard_start_xmit,
+        .ndo_features_check     = qeth_features_check,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_rx_mode        = qeth_l2_set_rx_mode,
         .ndo_do_ioctl           = qeth_do_ioctl,
@@ -1011,6 +1012,7 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
         if (card->info.type == QETH_CARD_TYPE_OSD && !card->info.guestlan) {
                 card->dev->hw_features = NETIF_F_SG;
                 card->dev->vlan_features = NETIF_F_SG;
+                card->dev->features |= NETIF_F_SG;
                 /* OSA 3S and earlier has no RX/TX support */
                 if (qeth_is_supported(card, IPA_OUTBOUND_CHECKSUM)) {
                         card->dev->hw_features |= NETIF_F_IP_CSUM;
@@ -1029,8 +1031,6 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
 
         card->info.broadcast_capable = 1;
         qeth_l2_request_initial_mac(card);
-        card->dev->gso_max_size = (QETH_MAX_BUFFER_ELEMENTS(card) - 1) *
-                                  PAGE_SIZE;
         SET_NETDEV_DEV(card->dev, &card->gdev->dev);
         netif_napi_add(card->dev, &card->napi, qeth_poll, QETH_NAPI_WEIGHT);
         netif_carrier_off(card->dev);
diff --git a/drivers/s390/net/qeth_l3.h b/drivers/s390/net/qeth_l3.h
index 194ae9b577cc..e5833837b799 100644
--- a/drivers/s390/net/qeth_l3.h
+++ b/drivers/s390/net/qeth_l3.h
@@ -82,7 +82,7 @@ void qeth_l3_del_vipa(struct qeth_card *, enum qeth_prot_versions, const u8 *);
 int qeth_l3_add_rxip(struct qeth_card *, enum qeth_prot_versions, const u8 *);
 void qeth_l3_del_rxip(struct qeth_card *card, enum qeth_prot_versions,
                         const u8 *);
-int qeth_l3_is_addr_covered_by_ipato(struct qeth_card *, struct qeth_ipaddr *);
+void qeth_l3_update_ipato(struct qeth_card *card);
 struct qeth_ipaddr *qeth_l3_get_addr_buffer(enum qeth_prot_versions);
 int qeth_l3_add_ip(struct qeth_card *, struct qeth_ipaddr *);
 int qeth_l3_delete_ip(struct qeth_card *, struct qeth_ipaddr *);
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 0f8c12738b06..ef0961e18686 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -164,8 +164,8 @@ static void qeth_l3_convert_addr_to_bits(u8 *addr, u8 *bits, int len)
         }
 }
 
-int qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card,
-                                                struct qeth_ipaddr *addr)
+static bool qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card,
+                                             struct qeth_ipaddr *addr)
 {
         struct qeth_ipato_entry *ipatoe;
         u8 addr_bits[128] = {0, };
@@ -174,6 +174,8 @@ int qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card,
 
         if (!card->ipato.enabled)
                 return 0;
+        if (addr->type != QETH_IP_TYPE_NORMAL)
+                return 0;
 
         qeth_l3_convert_addr_to_bits((u8 *) &addr->u, addr_bits,
                                   (addr->proto == QETH_PROT_IPV4)? 4:16);
@@ -290,8 +292,7 @@ int qeth_l3_add_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr)
                 memcpy(addr, tmp_addr, sizeof(struct qeth_ipaddr));
                 addr->ref_counter = 1;
 
-                if (addr->type == QETH_IP_TYPE_NORMAL  &&
-                                qeth_l3_is_addr_covered_by_ipato(card, addr)) {
+                if (qeth_l3_is_addr_covered_by_ipato(card, addr)) {
                         QETH_CARD_TEXT(card, 2, "tkovaddr");
                         addr->set_flags |= QETH_IPA_SETIP_TAKEOVER_FLAG;
                 }
@@ -605,6 +606,27 @@ int qeth_l3_setrouting_v6(struct qeth_card *card)
 /*
  * IP address takeover related functions
  */
+
+/**
+ * qeth_l3_update_ipato() - Update 'takeover' property, for all NORMAL IPs.
+ *
+ * Caller must hold ip_lock.
+ */
+void qeth_l3_update_ipato(struct qeth_card *card)
+{
+        struct qeth_ipaddr *addr;
+        unsigned int i;
+
+        hash_for_each(card->ip_htable, i, addr, hnode) {
+                if (addr->type != QETH_IP_TYPE_NORMAL)
+                        continue;
+                if (qeth_l3_is_addr_covered_by_ipato(card, addr))
+                        addr->set_flags |= QETH_IPA_SETIP_TAKEOVER_FLAG;
+                else
+                        addr->set_flags &= ~QETH_IPA_SETIP_TAKEOVER_FLAG;
+        }
+}
+
 static void qeth_l3_clear_ipato_list(struct qeth_card *card)
 {
         struct qeth_ipato_entry *ipatoe, *tmp;
@@ -616,6 +638,7 @@ static void qeth_l3_clear_ipato_list(struct qeth_card *card)
                 kfree(ipatoe);
         }
 
+        qeth_l3_update_ipato(card);
         spin_unlock_bh(&card->ip_lock);
 }
 
@@ -640,8 +663,10 @@ int qeth_l3_add_ipato_entry(struct qeth_card *card,
                 }
         }
 
-        if (!rc)
+        if (!rc) {
                 list_add_tail(&new->entry, &card->ipato.entries);
+                qeth_l3_update_ipato(card);
+        }
 
         spin_unlock_bh(&card->ip_lock);
 
@@ -664,6 +689,7 @@ void qeth_l3_del_ipato_entry(struct qeth_card *card,
                             (proto == QETH_PROT_IPV4)? 4:16) &&
                     (ipatoe->mask_bits == mask_bits)) {
                         list_del(&ipatoe->entry);
+                        qeth_l3_update_ipato(card);
                         kfree(ipatoe);
                 }
         }
@@ -1377,6 +1403,7 @@ qeth_l3_add_mc_to_hash(struct qeth_card *card, struct in_device *in4_dev)
 
                 tmp->u.a4.addr = be32_to_cpu(im4->multiaddr);
                 memcpy(tmp->mac, buf, sizeof(tmp->mac));
+                tmp->is_multicast = 1;
 
                 ipm = qeth_l3_ip_from_hash(card, tmp);
                 if (ipm) {
@@ -2918,6 +2945,7 @@ static const struct net_device_ops qeth_l3_osa_netdev_ops = {
         .ndo_stop               = qeth_l3_stop,
         .ndo_get_stats          = qeth_get_stats,
         .ndo_start_xmit         = qeth_l3_hard_start_xmit,
+        .ndo_features_check     = qeth_features_check,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_rx_mode        = qeth_l3_set_multicast_list,
         .ndo_do_ioctl           = qeth_do_ioctl,
@@ -2958,6 +2986,7 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
                                 card->dev->vlan_features = NETIF_F_SG |
                                         NETIF_F_RXCSUM | NETIF_F_IP_CSUM |
                                         NETIF_F_TSO;
+                                card->dev->features |= NETIF_F_SG;
                         }
                 }
         } else if (card->info.type == QETH_CARD_TYPE_IQD) {
@@ -2985,8 +3014,8 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
                                 NETIF_F_HW_VLAN_CTAG_RX |
                                 NETIF_F_HW_VLAN_CTAG_FILTER;
         netif_keep_dst(card->dev);
-        card->dev->gso_max_size = (QETH_MAX_BUFFER_ELEMENTS(card) - 1) *
-                                  PAGE_SIZE;
+        netif_set_gso_max_size(card->dev, (QETH_MAX_BUFFER_ELEMENTS(card) - 1) *
+                                          PAGE_SIZE);
 
         SET_NETDEV_DEV(card->dev, &card->gdev->dev);
         netif_napi_add(card->dev, &card->napi, qeth_poll, QETH_NAPI_WEIGHT);
diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
index bd12fdf678be..6ea2b528a64e 100644
--- a/drivers/s390/net/qeth_l3_sys.c
+++ b/drivers/s390/net/qeth_l3_sys.c
@@ -370,8 +370,8 @@ static ssize_t qeth_l3_dev_ipato_enable_store(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
         struct qeth_card *card = dev_get_drvdata(dev);
-        struct qeth_ipaddr *addr;
-        int i, rc = 0;
+        bool enable;
+        int rc = 0;
 
         if (!card)
                 return -EINVAL;
@@ -384,25 +384,18 @@ static ssize_t qeth_l3_dev_ipato_enable_store(struct device *dev,
         }
 
         if (sysfs_streq(buf, "toggle")) {
-                card->ipato.enabled = (card->ipato.enabled)? 0 : 1;
-        } else if (sysfs_streq(buf, "1")) {
-                card->ipato.enabled = 1;
-                hash_for_each(card->ip_htable, i, addr, hnode) {
-                                if ((addr->type == QETH_IP_TYPE_NORMAL) &&
-                                qeth_l3_is_addr_covered_by_ipato(card, addr))
-                                        addr->set_flags |=
-                                        QETH_IPA_SETIP_TAKEOVER_FLAG;
-                        }
-        } else if (sysfs_streq(buf, "0")) {
-                card->ipato.enabled = 0;
-                hash_for_each(card->ip_htable, i, addr, hnode) {
-                        if (addr->set_flags &
-                        QETH_IPA_SETIP_TAKEOVER_FLAG)
-                                addr->set_flags &=
-                                ~QETH_IPA_SETIP_TAKEOVER_FLAG;
-                        }
-        } else
+                enable = !card->ipato.enabled;
+        } else if (kstrtobool(buf, &enable)) {
                 rc = -EINVAL;
+                goto out;
+        }
+
+        if (card->ipato.enabled != enable) {
+                card->ipato.enabled = enable;
+                spin_lock_bh(&card->ip_lock);
+                qeth_l3_update_ipato(card);
+                spin_unlock_bh(&card->ip_lock);
+        }
 out:
         mutex_unlock(&card->conf_mutex);
         return rc ? rc : count;
@@ -428,20 +421,27 @@ static ssize_t qeth_l3_dev_ipato_invert4_store(struct device *dev,
                                 const char *buf, size_t count)
 {
         struct qeth_card *card = dev_get_drvdata(dev);
+        bool invert;
         int rc = 0;
 
         if (!card)
                 return -EINVAL;
 
         mutex_lock(&card->conf_mutex);
-        if (sysfs_streq(buf, "toggle"))
-                card->ipato.invert4 = (card->ipato.invert4)? 0 : 1;
-        else if (sysfs_streq(buf, "1"))
-                card->ipato.invert4 = 1;
-        else if (sysfs_streq(buf, "0"))
-                card->ipato.invert4 = 0;
-        else
+        if (sysfs_streq(buf, "toggle")) {
+                invert = !card->ipato.invert4;
+        } else if (kstrtobool(buf, &invert)) {
                 rc = -EINVAL;
+                goto out;
+        }
+
+        if (card->ipato.invert4 != invert) {
+                card->ipato.invert4 = invert;
+                spin_lock_bh(&card->ip_lock);
+                qeth_l3_update_ipato(card);
+                spin_unlock_bh(&card->ip_lock);
+        }
+out:
         mutex_unlock(&card->conf_mutex);
         return rc ? rc : count;
 }
@@ -607,20 +607,27 @@ static ssize_t qeth_l3_dev_ipato_invert6_store(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
         struct qeth_card *card = dev_get_drvdata(dev);
+        bool invert;
         int rc = 0;
 
         if (!card)
                 return -EINVAL;
 
         mutex_lock(&card->conf_mutex);
-        if (sysfs_streq(buf, "toggle"))
-                card->ipato.invert6 = (card->ipato.invert6)? 0 : 1;
-        else if (sysfs_streq(buf, "1"))
-                card->ipato.invert6 = 1;
-        else if (sysfs_streq(buf, "0"))
-                card->ipato.invert6 = 0;
-        else
+        if (sysfs_streq(buf, "toggle")) {
+                invert = !card->ipato.invert6;
+        } else if (kstrtobool(buf, &invert)) {
                 rc = -EINVAL;
+                goto out;
+        }
+
+        if (card->ipato.invert6 != invert) {
+                card->ipato.invert6 = invert;
+                spin_lock_bh(&card->ip_lock);
+                qeth_l3_update_ipato(card);
+                spin_unlock_bh(&card->ip_lock);
+        }
+out:
         mutex_unlock(&card->conf_mutex);
         return rc ? rc : count;
 }
diff --git a/drivers/s390/scsi/Makefile b/drivers/s390/scsi/Makefile
index 9259039e886d..9dda431ec8f3 100644
--- a/drivers/s390/scsi/Makefile
+++ b/drivers/s390/scsi/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Makefile for the S/390 specific device drivers
 #
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index 403a639574e5..d52265416da2 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -1673,6 +1673,7 @@ struct aac_dev
         struct aac_hba_map_info hba_map[AAC_MAX_BUSES][AAC_MAX_TARGETS];
         u8                      adapter_shutdown;
         u32                     handle_pci_error;
+        bool                    init_reset;
 };
 
 #define aac_adapter_interrupt(dev) \
@@ -1724,6 +1725,7 @@ struct aac_dev
 #define FIB_CONTEXT_FLAG_NATIVE_HBA             (0x00000010)
 #define FIB_CONTEXT_FLAG_NATIVE_HBA_TMF (0x00000020)
 #define FIB_CONTEXT_FLAG_SCSI_CMD       (0x00000040)
+#define FIB_CONTEXT_FLAG_EH_RESET       (0x00000080)
 
 /*
  *      Define the command values
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index 525a652dab48..80a8cb26cdea 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -467,35 +467,6 @@ int aac_queue_get(struct aac_dev * dev, u32 * index, u32 qid, struct hw_fib * hw
         return 0;
 }
 
-#ifdef CONFIG_EEH
-static inline int aac_check_eeh_failure(struct aac_dev *dev)
-{
-        /* Check for an EEH failure for the given
-         * device node. Function eeh_dev_check_failure()
-         * returns 0 if there has not been an EEH error
-         * otherwise returns a non-zero value.
-         *
-         * Need to be called before any PCI operation,
-         * i.e.,before aac_adapter_check_health()
-         */
-        struct eeh_dev *edev = pci_dev_to_eeh_dev(dev->pdev);
-
-        if (eeh_dev_check_failure(edev)) {
-                /* The EEH mechanisms will handle this
-                 * error and reset the device if
-                 * necessary.
-                 */
-                return 1;
-        }
-        return 0;
-}
-#else
-static inline int aac_check_eeh_failure(struct aac_dev *dev)
-{
-        return 0;
-}
-#endif
-
 /*
  *      Define the highest level of host to adapter communication routines.
  *      These routines will support host to adapter FS commuication. These
@@ -701,7 +672,7 @@ int aac_fib_send(u16 command, struct fib *fibptr, unsigned long size,
                                         return -ETIMEDOUT;
                                 }
 
-                                if (aac_check_eeh_failure(dev))
+                                if (unlikely(pci_channel_offline(dev->pdev)))
                                         return -EFAULT;
 
                                 if ((blink = aac_adapter_check_health(dev)) > 0) {
@@ -801,7 +772,7 @@ int aac_hba_send(u8 command, struct fib *fibptr, fib_callback callback,
 
                 spin_unlock_irqrestore(&fibptr->event_lock, flags);
 
-                if (aac_check_eeh_failure(dev))
+                if (unlikely(pci_channel_offline(dev->pdev)))
                         return -EFAULT;
 
                 fibptr->flags |= FIB_CONTEXT_FLAG_WAIT;
@@ -1583,6 +1554,7 @@ static int _aac_reset_adapter(struct aac_dev *aac, int forced, u8 reset_type)
          * will ensure that i/o is queisced and the card is flushed in that
          * case.
          */
+        aac_free_irq(aac);
         aac_fib_map_free(aac);
         dma_free_coherent(&aac->pdev->dev, aac->comm_size, aac->comm_addr,
                           aac->comm_phys);
@@ -1590,7 +1562,6 @@ static int _aac_reset_adapter(struct aac_dev *aac, int forced, u8 reset_type)
         aac->comm_phys = 0;
         kfree(aac->queues);
         aac->queues = NULL;
-        aac_free_irq(aac);
         kfree(aac->fsa_dev);
         aac->fsa_dev = NULL;
 
@@ -2511,8 +2482,8 @@ int aac_command_thread(void *data)
                         /* Synchronize our watches */
                         if (((NSEC_PER_SEC - (NSEC_PER_SEC / HZ)) > now.tv_nsec)
                          && (now.tv_nsec > (NSEC_PER_SEC / HZ)))
-                                difference = (((NSEC_PER_SEC - now.tv_nsec) * HZ)
-                                  + NSEC_PER_SEC / 2) / NSEC_PER_SEC;
+                                difference = HZ + HZ / 2 -
+                                             now.tv_nsec / (NSEC_PER_SEC / HZ);
                         else {
                                 if (now.tv_nsec > NSEC_PER_SEC / 2)
                                         ++now.tv_sec;
@@ -2536,6 +2507,10 @@ int aac_command_thread(void *data)
                 if (kthread_should_stop())
                         break;
 
+                /*
+                 * we probably want usleep_range() here instead of the
+                 * jiffies computation
+                 */
                 schedule_timeout(difference);
 
                 if (kthread_should_stop())
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index c9252b138c1f..d55332de08f9 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1037,7 +1037,7 @@ static int aac_eh_bus_reset(struct scsi_cmnd* cmd)
                         info = &aac->hba_map[bus][cid];
                         if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
                             info->devtype != AAC_DEVTYPE_NATIVE_RAW) {
-                                fib->flags |= FIB_CONTEXT_FLAG_TIMED_OUT;
+                                fib->flags |= FIB_CONTEXT_FLAG_EH_RESET;
                                 cmd->SCp.phase = AAC_OWNER_ERROR_HANDLER;
                         }
                 }
@@ -1680,6 +1680,9 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
         aac->cardtype = index;
         INIT_LIST_HEAD(&aac->entry);
 
+        if (aac_reset_devices || reset_devices)
+                aac->init_reset = true;
+
         aac->fibs = kzalloc(sizeof(struct fib) * (shost->can_queue + AAC_NUM_MGT_FIB), GFP_KERNEL);
         if (!aac->fibs)
                 goto out_free_host;
diff --git a/drivers/scsi/aacraid/rx.c b/drivers/scsi/aacraid/rx.c
index 93ef7c37e568..620166694171 100644
--- a/drivers/scsi/aacraid/rx.c
+++ b/drivers/scsi/aacraid/rx.c
@@ -561,11 +561,16 @@ int _aac_rx_init(struct aac_dev *dev)
         dev->a_ops.adapter_sync_cmd = rx_sync_cmd;
         dev->a_ops.adapter_enable_int = aac_rx_disable_interrupt;
         dev->OIMR = status = rx_readb (dev, MUnit.OIMR);
-        if ((((status & 0x0c) != 0x0c) || aac_reset_devices || reset_devices) &&
-          !aac_rx_restart_adapter(dev, 0, IOP_HWSOFT_RESET))
-                /* Make sure the Hardware FIFO is empty */
-                while ((++restart < 512) &&
-                  (rx_readl(dev, MUnit.OutboundQueue) != 0xFFFFFFFFL));
+
+        if (((status & 0x0c) != 0x0c) || dev->init_reset) {
+                dev->init_reset = false;
+                if (!aac_rx_restart_adapter(dev, 0, IOP_HWSOFT_RESET)) {
+                        /* Make sure the Hardware FIFO is empty */
+                        while ((++restart < 512) &&
+                               (rx_readl(dev, MUnit.OutboundQueue) != 0xFFFFFFFFL));
+                }
+        }
+
         /*
          *      Check to see if the board panic'd while booting.
          */
diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c
index 0c9361c87ec8..fde6b6aa86e3 100644
--- a/drivers/scsi/aacraid/src.c
+++ b/drivers/scsi/aacraid/src.c
@@ -868,9 +868,13 @@ int aac_src_init(struct aac_dev *dev)
         /* Failure to reset here is an option ... */
         dev->a_ops.adapter_sync_cmd = src_sync_cmd;
         dev->a_ops.adapter_enable_int = aac_src_disable_interrupt;
-        if ((aac_reset_devices || reset_devices) &&
-                !aac_src_restart_adapter(dev, 0, IOP_HWSOFT_RESET))
-                ++restart;
+
+        if (dev->init_reset) {
+                dev->init_reset = false;
+                if (!aac_src_restart_adapter(dev, 0, IOP_HWSOFT_RESET))
+                        ++restart;
+        }
+
         /*
          *      Check to see if the board panic'd while booting.
          */
@@ -1014,9 +1018,13 @@ int aac_srcv_init(struct aac_dev *dev)
         /* Failure to reset here is an option ... */
         dev->a_ops.adapter_sync_cmd = src_sync_cmd;
         dev->a_ops.adapter_enable_int = aac_src_disable_interrupt;
-        if ((aac_reset_devices || reset_devices) &&
-                !aac_src_restart_adapter(dev, 0, IOP_HWSOFT_RESET))
-                ++restart;
+
+        if (dev->init_reset) {
+                dev->init_reset = false;
+                if (!aac_src_restart_adapter(dev, 0, IOP_HWSOFT_RESET))
+                        ++restart;
+        }
+
         /*
          *      Check to see if flash update is running.
          *      Wait for the adapter to be up and running. Wait up to 5 minutes
diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c
index 72ca2a2e08e2..b2fa195adc7a 100644
--- a/drivers/scsi/bfa/bfad_bsg.c
+++ b/drivers/scsi/bfa/bfad_bsg.c
@@ -3135,7 +3135,8 @@ bfad_im_bsg_vendor_request(struct bsg_job *job)
         struct fc_bsg_request *bsg_request = job->request;
         struct fc_bsg_reply *bsg_reply = job->reply;
         uint32_t vendor_cmd = bsg_request->rqst_data.h_vendor.vendor_cmd[0];
-        struct bfad_im_port_s *im_port = shost_priv(fc_bsg_to_shost(job));
+        struct Scsi_Host *shost = fc_bsg_to_shost(job);
+        struct bfad_im_port_s *im_port = bfad_get_im_port(shost);
         struct bfad_s *bfad = im_port->bfad;
         void *payload_kbuf;
         int rc = -EINVAL;
@@ -3350,7 +3351,8 @@ int
 bfad_im_bsg_els_ct_request(struct bsg_job *job)
 {
         struct bfa_bsg_data *bsg_data;
-        struct bfad_im_port_s *im_port = shost_priv(fc_bsg_to_shost(job));
+        struct Scsi_Host *shost = fc_bsg_to_shost(job);
+        struct bfad_im_port_s *im_port = bfad_get_im_port(shost);
         struct bfad_s *bfad = im_port->bfad;
         bfa_bsg_fcpt_t *bsg_fcpt;
         struct bfad_fcxp    *drv_fcxp;
diff --git a/drivers/scsi/bfa/bfad_im.c b/drivers/scsi/bfa/bfad_im.c
index 24e657a4ec80..c05d6e91e4bd 100644
--- a/drivers/scsi/bfa/bfad_im.c
+++ b/drivers/scsi/bfa/bfad_im.c
@@ -546,6 +546,7 @@ int
 bfad_im_scsi_host_alloc(struct bfad_s *bfad, struct bfad_im_port_s *im_port,
                         struct device *dev)
 {
+        struct bfad_im_port_pointer *im_portp;
         int error = 1;
 
         mutex_lock(&bfad_mutex);
@@ -564,7 +565,8 @@ bfad_im_scsi_host_alloc(struct bfad_s *bfad, struct bfad_im_port_s *im_port,
                 goto out_free_idr;
         }
 
-        im_port->shost->hostdata[0] = (unsigned long)im_port;
+        im_portp = shost_priv(im_port->shost);
+        im_portp->p = im_port;
         im_port->shost->unique_id = im_port->idr_id;
         im_port->shost->this_id = -1;
         im_port->shost->max_id = MAX_FCP_TARGET;
@@ -748,7 +750,7 @@ bfad_scsi_host_alloc(struct bfad_im_port_s *im_port, struct bfad_s *bfad)
 
         sht->sg_tablesize = bfad->cfg_data.io_max_sge;
 
-        return scsi_host_alloc(sht, sizeof(unsigned long));
+        return scsi_host_alloc(sht, sizeof(struct bfad_im_port_pointer));
 }
 
 void
diff --git a/drivers/scsi/bfa/bfad_im.h b/drivers/scsi/bfa/bfad_im.h
index c81ec2a77ef5..06ce4ba2b7bc 100644
--- a/drivers/scsi/bfa/bfad_im.h
+++ b/drivers/scsi/bfa/bfad_im.h
@@ -69,6 +69,16 @@ struct bfad_im_port_s {
         struct fc_vport *fc_vport;
 };
 
+struct bfad_im_port_pointer {
+        struct bfad_im_port_s *p;
+};
+
+static inline struct bfad_im_port_s *bfad_get_im_port(struct Scsi_Host *host)
+{
+        struct bfad_im_port_pointer *im_portp = shost_priv(host);
+        return im_portp->p;
+}
+
 enum bfad_itnim_state {
         ITNIM_STATE_NONE,
         ITNIM_STATE_ONLINE,
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index 5da46052e179..21be672679fb 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -904,10 +904,14 @@ static void fc_lport_recv_els_req(struct fc_lport *lport,
                 case ELS_FLOGI:
                         if (!lport->point_to_multipoint)
                                 fc_lport_recv_flogi_req(lport, fp);
+                        else
+                                fc_rport_recv_req(lport, fp);
                         break;
                 case ELS_LOGO:
                         if (fc_frame_sid(fp) == FC_FID_FLOGI)
                                 fc_lport_recv_logo_req(lport, fp);
+                        else
+                                fc_rport_recv_req(lport, fp);
                         break;
                 case ELS_RSCN:
                         lport->tt.disc_recv_req(lport, fp);
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index ca1566237ae7..3183d63de4da 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -2145,7 +2145,7 @@ void sas_smp_handler(struct bsg_job *job, struct Scsi_Host *shost,
                 struct sas_rphy *rphy)
 {
         struct domain_device *dev;
-        unsigned int reslen = 0;
+        unsigned int rcvlen = 0;
         int ret = -EINVAL;
 
         /* no rphy means no smp target support (ie aic94xx host) */
@@ -2179,12 +2179,12 @@ void sas_smp_handler(struct bsg_job *job, struct Scsi_Host *shost,
 
         ret = smp_execute_task_sg(dev, job->request_payload.sg_list,
                         job->reply_payload.sg_list);
-        if (ret > 0) {
-                /* positive number is the untransferred residual */
-                reslen = ret;
+        if (ret >= 0) {
+                /* bsg_job_done() requires the length received  */
+                rcvlen = job->reply_payload.payload_len - ret;
                 ret = 0;
         }
 
 out:
-        bsg_job_done(job, ret, reslen);
+        bsg_job_done(job, ret, rcvlen);
 }
diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
index 58476b728c57..c9406852c3e9 100644
--- a/drivers/scsi/libsas/sas_scsi_host.c
+++ b/drivers/scsi/libsas/sas_scsi_host.c
@@ -486,15 +486,28 @@ static int sas_queue_reset(struct domain_device *dev, int reset_type,
 
 int sas_eh_abort_handler(struct scsi_cmnd *cmd)
 {
-        int res;
+        int res = TMF_RESP_FUNC_FAILED;
         struct sas_task *task = TO_SAS_TASK(cmd);
         struct Scsi_Host *host = cmd->device->host;
+        struct domain_device *dev = cmd_to_domain_dev(cmd);
         struct sas_internal *i = to_sas_internal(host->transportt);
+        unsigned long flags;
 
         if (!i->dft->lldd_abort_task)
                 return FAILED;
 
-        res = i->dft->lldd_abort_task(task);
+        spin_lock_irqsave(host->host_lock, flags);
+        /* We cannot do async aborts for SATA devices */
+        if (dev_is_sata(dev) && !host->host_eh_scheduled) {
+                spin_unlock_irqrestore(host->host_lock, flags);
+                return FAILED;
+        }
+        spin_unlock_irqrestore(host->host_lock, flags);
+
+        if (task)
+                res = i->dft->lldd_abort_task(task);
+        else
+                SAS_DPRINTK("no task to abort\n");
         if (res == TMF_RESP_FUNC_SUCC || res == TMF_RESP_FUNC_COMPLETE)
                 return SUCCESS;
 
diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index 56faeb049b4a..87c08ff37ddd 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -753,12 +753,12 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, struct lpfc_dmabuf *mp)
         drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys);
         rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
         if (rc < 0) {
-                (rqbp->rqb_free_buffer)(phba, rqb_entry);
                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                 "6409 Cannot post to RQ %d: %x %x\n",
                                 rqb_entry->hrq->queue_id,
                                 rqb_entry->hrq->host_index,
                                 rqb_entry->hrq->hba_index);
+                (rqbp->rqb_free_buffer)(phba, rqb_entry);
         } else {
                 list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
                 rqbp->buffer_count++;
diff --git a/drivers/scsi/osd/osd_initiator.c b/drivers/scsi/osd/osd_initiator.c
index a4f28b7e4c65..e18877177f1b 100644
--- a/drivers/scsi/osd/osd_initiator.c
+++ b/drivers/scsi/osd/osd_initiator.c
@@ -1576,7 +1576,9 @@ static struct request *_make_request(struct request_queue *q, bool has_write,
                 return req;
 
         for_each_bio(bio) {
-                ret = blk_rq_append_bio(req, bio);
+                struct bio *bounce_bio = bio;
+
+                ret = blk_rq_append_bio(req, &bounce_bio);
                 if (ret)
                         return ERR_PTR(ret);
         }
diff --git a/drivers/scsi/scsi_debugfs.c b/drivers/scsi/scsi_debugfs.c
index 01f08c03f2c1..c3765d29fd3f 100644
--- a/drivers/scsi/scsi_debugfs.c
+++ b/drivers/scsi/scsi_debugfs.c
@@ -8,9 +8,11 @@ void scsi_show_rq(struct seq_file *m, struct request *rq)
 {
         struct scsi_cmnd *cmd = container_of(scsi_req(rq), typeof(*cmd), req);
         int msecs = jiffies_to_msecs(jiffies - cmd->jiffies_at_alloc);
-        char buf[80];
+        const u8 *const cdb = READ_ONCE(cmd->cmnd);
+        char buf[80] = "(?)";
 
-        __scsi_format_command(buf, sizeof(buf), cmd->cmnd, cmd->cmd_len);
+        if (cdb)
+                __scsi_format_command(buf, sizeof(buf), cdb, cmd->cmd_len);
         seq_printf(m, ", .cmd=%s, .retries=%d, allocated %d.%03d s ago", buf,
                    cmd->retries, msecs / 1000, msecs % 1000);
 }
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 78d4aa8df675..dfb8da83fa50 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -34,7 +34,6 @@ struct scsi_dev_info_list_table {
 };
 
 
-static const char spaces[] = "                "; /* 16 of them */
 static blist_flags_t scsi_default_dev_flags;
 static LIST_HEAD(scsi_dev_info_list);
 static char scsi_dev_flags[256];
@@ -298,20 +297,13 @@ static void scsi_strcpy_devinfo(char *name, char *to, size_t to_length,
         size_t from_length;
 
         from_length = strlen(from);
-        strncpy(to, from, min(to_length, from_length));
-        if (from_length < to_length) {
-                if (compatible) {
-                        /*
-                         * NUL terminate the string if it is short.
-                         */
-                        to[from_length] = '\0';
-                } else {
-                        /*
-                         * space pad the string if it is short.
-                         */
-                        strncpy(&to[from_length], spaces,
-                                to_length - from_length);
-                }
+        /* This zero-pads the destination */
+        strncpy(to, from, to_length);
+        if (from_length < to_length && !compatible) {
+                /*
+                 * space pad the string if it is short.
+                 */
+                memset(&to[from_length], ' ', to_length - from_length);
         }
         if (from_length > to_length)
                  printk(KERN_WARNING "%s: %s string '%s' is too long\n",
@@ -382,10 +374,8 @@ int scsi_dev_info_list_add_keyed(int compatible, char *vendor, char *model,
                             model, compatible);
 
         if (strflags)
-                devinfo->flags = simple_strtoul(strflags, NULL, 0);
-        else
-                devinfo->flags = flags;
-
+                flags = (__force blist_flags_t)simple_strtoul(strflags, NULL, 0);
+        devinfo->flags = flags;
         devinfo->compatible = compatible;
 
         if (compatible)
@@ -458,7 +448,8 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
                         /*
                          * vendor strings must be an exact match
                          */
-                        if (vmax != strlen(devinfo->vendor) ||
+                        if (vmax != strnlen(devinfo->vendor,
+                                            sizeof(devinfo->vendor)) ||
                             memcmp(devinfo->vendor, vskip, vmax))
                                 continue;
 
@@ -466,7 +457,7 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
                          * @model specifies the full string, and
                          * must be larger or equal to devinfo->model
                          */
-                        mlen = strlen(devinfo->model);
+                        mlen = strnlen(devinfo->model, sizeof(devinfo->model));
                         if (mmax < mlen || memcmp(devinfo->model, mskip, mlen))
                                 continue;
                         return devinfo;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 1cbc497e00bd..d9ca1dfab154 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1967,6 +1967,8 @@ static bool scsi_mq_get_budget(struct blk_mq_hw_ctx *hctx)
 out_put_device:
         put_device(&sdev->sdev_gendev);
 out:
+        if (atomic_read(&sdev->device_busy) == 0 && !scsi_device_blocked(sdev))
+                blk_mq_delay_run_hw_queue(hctx, SCSI_QUEUE_DELAY);
         return false;
 }
 
@@ -2148,11 +2150,13 @@ void __scsi_init_queue(struct Scsi_Host *shost, struct request_queue *q)
                 q->limits.cluster = 0;
 
         /*
-         * set a reasonable default alignment on word boundaries: the
-         * host and device may alter it using
-         * blk_queue_update_dma_alignment() later.
+         * Set a reasonable default alignment:  The larger of 32-byte (dword),
+         * which is a common minimum for HBAs, and the minimum DMA alignment,
+         * which is set by the platform.
+         *
+         * Devices that require a bigger alignment can increase it later.
          */
-        blk_queue_dma_alignment(q, 0x03);
+        blk_queue_dma_alignment(q, max(4, dma_get_cache_alignment()) - 1);
 }
 EXPORT_SYMBOL_GPL(__scsi_init_queue);
 
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index be5e919db0e8..0880d975eed3 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -770,7 +770,7 @@ static int scsi_probe_lun(struct scsi_device *sdev, unsigned char *inq_result,
  *     SCSI_SCAN_LUN_PRESENT: a new scsi_device was allocated and initialized
  **/
 static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
-                int *bflags, int async)
+                blist_flags_t *bflags, int async)
 {
         int ret;
 
@@ -1049,14 +1049,15 @@ static unsigned char *scsi_inq_str(unsigned char *buf, unsigned char *inq,
  *   - SCSI_SCAN_LUN_PRESENT: a new scsi_device was allocated and initialized
  **/
 static int scsi_probe_and_add_lun(struct scsi_target *starget,
-                                  u64 lun, int *bflagsp,
+                                  u64 lun, blist_flags_t *bflagsp,
                                   struct scsi_device **sdevp,
                                   enum scsi_scan_mode rescan,
                                   void *hostdata)
 {
         struct scsi_device *sdev;
         unsigned char *result;
-        int bflags, res = SCSI_SCAN_NO_RESPONSE, result_len = 256;
+        blist_flags_t bflags;
+        int res = SCSI_SCAN_NO_RESPONSE, result_len = 256;
         struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
 
         /*
@@ -1201,7 +1202,7 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget,
  *     Modifies sdevscan->lun.
  **/
 static void scsi_sequential_lun_scan(struct scsi_target *starget,
-                                     int bflags, int scsi_level,
+                                     blist_flags_t bflags, int scsi_level,
                                      enum scsi_scan_mode rescan)
 {
         uint max_dev_lun;
@@ -1292,7 +1293,7 @@ static void scsi_sequential_lun_scan(struct scsi_target *starget,
  *     0: scan completed (or no memory, so further scanning is futile)
  *     1: could not scan with REPORT LUN
  **/
-static int scsi_report_lun_scan(struct scsi_target *starget, int bflags,
+static int scsi_report_lun_scan(struct scsi_target *starget, blist_flags_t bflags,
                                 enum scsi_scan_mode rescan)
 {
         unsigned char scsi_cmd[MAX_COMMAND_SIZE];
@@ -1538,7 +1539,7 @@ static void __scsi_scan_target(struct device *parent, unsigned int channel,
                 unsigned int id, u64 lun, enum scsi_scan_mode rescan)
 {
         struct Scsi_Host *shost = dev_to_shost(parent);
-        int bflags = 0;
+        blist_flags_t bflags = 0;
         int res;
         struct scsi_target *starget;
 
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 50e7d7e4a861..26ce17178401 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -967,7 +967,8 @@ sdev_show_wwid(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR(wwid, S_IRUGO, sdev_show_wwid, NULL);
 
-#define BLIST_FLAG_NAME(name) [ilog2(BLIST_##name)] = #name
+#define BLIST_FLAG_NAME(name)                                   \
+        [ilog2((__force unsigned int)BLIST_##name)] = #name
 static const char *const sdev_bflags_name[] = {
 #include "scsi_devinfo_tbl.c"
 };
@@ -984,7 +985,7 @@ sdev_show_blacklist(struct device *dev, struct device_attribute *attr,
         for (i = 0; i < sizeof(sdev->sdev_bflags) * BITS_PER_BYTE; i++) {
                 const char *name = NULL;
 
-                if (!(sdev->sdev_bflags & BIT(i)))
+                if (!(sdev->sdev_bflags & (__force blist_flags_t)BIT(i)))
                         continue;
                 if (i < ARRAY_SIZE(sdev_bflags_name) && sdev_bflags_name[i])
                         name = sdev_bflags_name[i];
@@ -1414,7 +1415,10 @@ static void __scsi_remove_target(struct scsi_target *starget)
                  * check.
                  */
                 if (sdev->channel != starget->channel ||
-                    sdev->id != starget->id ||
+                    sdev->id != starget->id)
+                        continue;
+                if (sdev->sdev_state == SDEV_DEL ||
+                    sdev->sdev_state == SDEV_CANCEL ||
                     !get_device(&sdev->sdev_gendev))
                         continue;
                 spin_unlock_irqrestore(shost->host_lock, flags);
diff --git a/drivers/scsi/scsi_transport_spi.c b/drivers/scsi/scsi_transport_spi.c
index d0219e36080c..10ebb213ddb3 100644
--- a/drivers/scsi/scsi_transport_spi.c
+++ b/drivers/scsi/scsi_transport_spi.c
@@ -50,14 +50,14 @@
 
 /* Our blacklist flags */
 enum {
-        SPI_BLIST_NOIUS = 0x1,
+        SPI_BLIST_NOIUS = (__force blist_flags_t)0x1,
 };
 
 /* blacklist table, modelled on scsi_devinfo.c */
 static struct {
         char *vendor;
         char *model;
-        unsigned flags;
+        blist_flags_t flags;
 } spi_static_device_list[] __initdata = {
         {"HP", "Ultrium 3-SCSI", SPI_BLIST_NOIUS },
         {"IBM", "ULTRIUM-TD3", SPI_BLIST_NOIUS },
@@ -221,9 +221,11 @@ static int spi_device_configure(struct transport_container *tc,
 {
         struct scsi_device *sdev = to_scsi_device(dev);
         struct scsi_target *starget = sdev->sdev_target;
-        unsigned bflags = scsi_get_device_flags_keyed(sdev, &sdev->inquiry[8],
-                                                      &sdev->inquiry[16],
-                                                      SCSI_DEVINFO_SPI);
+        blist_flags_t bflags;
+
+        bflags = scsi_get_device_flags_keyed(sdev, &sdev->inquiry[8],
+                                             &sdev->inquiry[16],
+                                             SCSI_DEVINFO_SPI);
 
         /* Populate the target capability fields with the values
          * gleaned from the device inquiry */
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 24fe68522716..a028ab3322a9 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1312,6 +1312,7 @@ static int sd_init_command(struct scsi_cmnd *cmd)
 static void sd_uninit_command(struct scsi_cmnd *SCpnt)
 {
         struct request *rq = SCpnt->request;
+        u8 *cmnd;
 
         if (SCpnt->flags & SCMD_ZONE_WRITE_LOCK)
                 sd_zbc_write_unlock_zone(SCpnt);
@@ -1320,9 +1321,10 @@ static void sd_uninit_command(struct scsi_cmnd *SCpnt)
                 __free_page(rq->special_vec.bv_page);
 
         if (SCpnt->cmnd != scsi_req(rq)->cmd) {
-                mempool_free(SCpnt->cmnd, sd_cdb_pool);
+                cmnd = SCpnt->cmnd;
                 SCpnt->cmnd = NULL;
                 SCpnt->cmd_len = 0;
+                mempool_free(cmnd, sd_cdb_pool);
         }
 }
 
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 1b06cf0375dc..3b3d1d050cac 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -953,10 +953,11 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb,
                 case TEST_UNIT_READY:
                         break;
                 default:
-                        set_host_byte(scmnd, DID_TARGET_FAILURE);
+                        set_host_byte(scmnd, DID_ERROR);
                 }
                 break;
         case SRB_STATUS_INVALID_LUN:
+                set_host_byte(scmnd, DID_NO_CONNECT);
                 do_work = true;
                 process_err_fn = storvsc_remove_lun;
                 break;
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 011c3369082c..a355d989b414 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -6559,12 +6559,15 @@ static int ufshcd_config_vreg(struct device *dev,
                 struct ufs_vreg *vreg, bool on)
 {
         int ret = 0;
-        struct regulator *reg = vreg->reg;
-        const char *name = vreg->name;
+        struct regulator *reg;
+        const char *name;
         int min_uV, uA_load;
 
         BUG_ON(!vreg);
 
+        reg = vreg->reg;
+        name = vreg->name;
+
         if (regulator_count_voltages(reg) > 0) {
                 min_uV = on ? vreg->min_uV : 0;
                 ret = regulator_set_voltage(reg, min_uV, vreg->max_uV);
diff --git a/drivers/soc/amlogic/meson-gx-socinfo.c b/drivers/soc/amlogic/meson-gx-socinfo.c
index 89f4cf507be6..f2d8c3c53ea4 100644
--- a/drivers/soc/amlogic/meson-gx-socinfo.c
+++ b/drivers/soc/amlogic/meson-gx-socinfo.c
@@ -20,8 +20,8 @@
 #define AO_SEC_SOCINFO_OFFSET   AO_SEC_SD_CFG8
 
 #define SOCINFO_MAJOR   GENMASK(31, 24)
-#define SOCINFO_MINOR   GENMASK(23, 16)
-#define SOCINFO_PACK    GENMASK(15, 8)
+#define SOCINFO_PACK    GENMASK(23, 16)
+#define SOCINFO_MINOR   GENMASK(15, 8)
 #define SOCINFO_MISC    GENMASK(7, 0)
 
 static const struct meson_gx_soc_id {
diff --git a/drivers/spi/spi-armada-3700.c b/drivers/spi/spi-armada-3700.c
index 77fe55ce790c..d65345312527 100644
--- a/drivers/spi/spi-armada-3700.c
+++ b/drivers/spi/spi-armada-3700.c
@@ -79,6 +79,7 @@
 #define A3700_SPI_BYTE_LEN              BIT(5)
 #define A3700_SPI_CLK_PRESCALE          BIT(0)
 #define A3700_SPI_CLK_PRESCALE_MASK     (0x1f)
+#define A3700_SPI_CLK_EVEN_OFFS         (0x10)
 
 #define A3700_SPI_WFIFO_THRS_BIT        28
 #define A3700_SPI_RFIFO_THRS_BIT        24
@@ -220,6 +221,13 @@ static void a3700_spi_clock_set(struct a3700_spi *a3700_spi,
 
         prescale = DIV_ROUND_UP(clk_get_rate(a3700_spi->clk), speed_hz);
 
+        /* For prescaler values over 15, we can only set it by steps of 2.
+         * Starting from A3700_SPI_CLK_EVEN_OFFS, we set values from 0 up to
+         * 30. We only use this range from 16 to 30.
+         */
+        if (prescale > 15)
+                prescale = A3700_SPI_CLK_EVEN_OFFS + DIV_ROUND_UP(prescale, 2);
+
         val = spireg_read(a3700_spi, A3700_SPI_IF_CFG_REG);
         val = val & ~A3700_SPI_CLK_PRESCALE_MASK;
 
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index f95da364c283..669470971023 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1661,12 +1661,12 @@ static int atmel_spi_remove(struct platform_device *pdev)
         pm_runtime_get_sync(&pdev->dev);
 
         /* reset the hardware and block queue progress */
-        spin_lock_irq(&as->lock);
         if (as->use_dma) {
                 atmel_spi_stop_dma(master);
                 atmel_spi_release_dma(master);
         }
 
+        spin_lock_irq(&as->lock);
         spi_writel(as, CR, SPI_BIT(SWRST));
         spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */
         spi_readl(as, SR);
diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
index 2ce875764ca6..0835a8d88fb8 100644
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -377,8 +377,8 @@ static int qspi_set_config_register(struct rspi_data *rspi, int access_size)
         /* Sets SPCMD */
         rspi_write16(rspi, rspi->spcmd, RSPI_SPCMD0);
 
-        /* Enables SPI function in master mode */
-        rspi_write8(rspi, SPCR_SPE | SPCR_MSTR, RSPI_SPCR);
+        /* Sets RSPI mode */
+        rspi_write8(rspi, SPCR_MSTR, RSPI_SPCR);
 
         return 0;
 }
diff --git a/drivers/spi/spi-sun4i.c b/drivers/spi/spi-sun4i.c
index c5cd635c28f3..41410031f8e9 100644
--- a/drivers/spi/spi-sun4i.c
+++ b/drivers/spi/spi-sun4i.c
@@ -525,7 +525,7 @@ err_free_master:
 
 static int sun4i_spi_remove(struct platform_device *pdev)
 {
-        pm_runtime_disable(&pdev->dev);
+        pm_runtime_force_suspend(&pdev->dev);
 
         return 0;
 }
diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
index bc7100b93dfc..e0b9fe1d0e37 100644
--- a/drivers/spi/spi-xilinx.c
+++ b/drivers/spi/spi-xilinx.c
@@ -271,6 +271,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
         while (remaining_words) {
                 int n_words, tx_words, rx_words;
                 u32 sr;
+                int stalled;
 
                 n_words = min(remaining_words, xspi->buffer_size);
 
@@ -299,7 +300,17 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
 
                 /* Read out all the data from the Rx FIFO */
                 rx_words = n_words;
+                stalled = 10;
                 while (rx_words) {
+                        if (rx_words == n_words && !(stalled--) &&
+                            !(sr & XSPI_SR_TX_EMPTY_MASK) &&
+                            (sr & XSPI_SR_RX_EMPTY_MASK)) {
+                                dev_err(&spi->dev,
+                                        "Detected stall. Check C_SPI_MODE and C_SPI_MEMORY\n");
+                                xspi_init_hw(xspi);
+                                return -EIO;
+                        }
+
                         if ((sr & XSPI_SR_TX_EMPTY_MASK) && (rx_words > 1)) {
                                 xilinx_spi_rx(xspi);
                                 rx_words--;
diff --git a/drivers/ssb/Kconfig b/drivers/ssb/Kconfig
index d8e4219c2324..71c73766ee22 100644
--- a/drivers/ssb/Kconfig
+++ b/drivers/ssb/Kconfig
@@ -32,7 +32,7 @@ config SSB_BLOCKIO
 
 config SSB_PCIHOST_POSSIBLE
         bool
-        depends on SSB && (PCI = y || PCI = SSB)
+        depends on SSB && (PCI = y || PCI = SSB) && PCI_DRIVERS_LEGACY
         default y
 
 config SSB_PCIHOST
diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index 0f695df14c9d..372ce9913e6d 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -765,10 +765,12 @@ static long ashmem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 break;
         case ASHMEM_SET_SIZE:
                 ret = -EINVAL;
+                mutex_lock(&ashmem_mutex);
                 if (!asma->file) {
                         ret = 0;
                         asma->size = (size_t)arg;
                 }
+                mutex_unlock(&ashmem_mutex);
                 break;
         case ASHMEM_GET_SIZE:
                 ret = asma->size;
diff --git a/drivers/staging/android/ion/Kconfig b/drivers/staging/android/ion/Kconfig
index a517b2d29f1b..8f6494158d3d 100644
--- a/drivers/staging/android/ion/Kconfig
+++ b/drivers/staging/android/ion/Kconfig
@@ -37,7 +37,7 @@ config ION_CHUNK_HEAP
 
 config ION_CMA_HEAP
         bool "Ion CMA heap support"
-        depends on ION && CMA
+        depends on ION && DMA_CMA
         help
           Choose this option to enable CMA heaps with Ion. This heap is backed
           by the Contiguous Memory Allocator (CMA). If your system has these
diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
index a7d9b0e98572..f480885e346b 100644
--- a/drivers/staging/android/ion/ion.c
+++ b/drivers/staging/android/ion/ion.c
@@ -346,7 +346,7 @@ static int ion_dma_buf_begin_cpu_access(struct dma_buf *dmabuf,
         mutex_lock(&buffer->lock);
         list_for_each_entry(a, &buffer->attachments, list) {
                 dma_sync_sg_for_cpu(a->dev, a->table->sgl, a->table->nents,
-                                    DMA_BIDIRECTIONAL);
+                                    direction);
         }
         mutex_unlock(&buffer->lock);
 
@@ -368,7 +368,7 @@ static int ion_dma_buf_end_cpu_access(struct dma_buf *dmabuf,
         mutex_lock(&buffer->lock);
         list_for_each_entry(a, &buffer->attachments, list) {
                 dma_sync_sg_for_device(a->dev, a->table->sgl, a->table->nents,
-                                       DMA_BIDIRECTIONAL);
+                                       direction);
         }
         mutex_unlock(&buffer->lock);
 
diff --git a/drivers/staging/android/ion/ion_cma_heap.c b/drivers/staging/android/ion/ion_cma_heap.c
index dd5545d9990a..86196ffd2faf 100644
--- a/drivers/staging/android/ion/ion_cma_heap.c
+++ b/drivers/staging/android/ion/ion_cma_heap.c
@@ -39,9 +39,15 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer,
         struct ion_cma_heap *cma_heap = to_cma_heap(heap);
         struct sg_table *table;
         struct page *pages;
+        unsigned long size = PAGE_ALIGN(len);
+        unsigned long nr_pages = size >> PAGE_SHIFT;
+        unsigned long align = get_order(size);
         int ret;
 
-        pages = cma_alloc(cma_heap->cma, len, 0, GFP_KERNEL);
+        if (align > CONFIG_CMA_ALIGNMENT)
+                align = CONFIG_CMA_ALIGNMENT;
+
+        pages = cma_alloc(cma_heap->cma, nr_pages, align, GFP_KERNEL);
         if (!pages)
                 return -ENOMEM;
 
@@ -53,7 +59,7 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer,
         if (ret)
                 goto free_mem;
 
-        sg_set_page(table->sgl, pages, len, 0);
+        sg_set_page(table->sgl, pages, size, 0);
 
         buffer->priv_virt = pages;
         buffer->sg_table = table;
@@ -62,7 +68,7 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer,
 free_mem:
         kfree(table);
 err:
-        cma_release(cma_heap->cma, pages, buffer->size);
+        cma_release(cma_heap->cma, pages, nr_pages);
         return -ENOMEM;
 }
 
@@ -70,9 +76,10 @@ static void ion_cma_free(struct ion_buffer *buffer)
 {
         struct ion_cma_heap *cma_heap = to_cma_heap(buffer->heap);
         struct page *pages = buffer->priv_virt;
+        unsigned long nr_pages = PAGE_ALIGN(buffer->size) >> PAGE_SHIFT;
 
         /* release memory */
-        cma_release(cma_heap->cma, pages, buffer->size);
+        cma_release(cma_heap->cma, pages, nr_pages);
         /* release sg table */
         sg_free_table(buffer->sg_table);
         kfree(buffer->sg_table);
diff --git a/drivers/staging/ccree/ssi_hash.c b/drivers/staging/ccree/ssi_hash.c
index d79090ed7f9c..2035835b62dc 100644
--- a/drivers/staging/ccree/ssi_hash.c
+++ b/drivers/staging/ccree/ssi_hash.c
@@ -1769,7 +1769,7 @@ static int ssi_ahash_import(struct ahash_request *req, const void *in)
         struct device *dev = drvdata_to_dev(ctx->drvdata);
         struct ahash_req_ctx *state = ahash_request_ctx(req);
         u32 tmp;
-        int rc;
+        int rc = 0;
 
         memcpy(&tmp, in, sizeof(u32));
         if (tmp != CC_EXPORT_MAGIC) {
@@ -1778,9 +1778,12 @@ static int ssi_ahash_import(struct ahash_request *req, const void *in)
         }
         in += sizeof(u32);
 
-        rc = ssi_hash_init(state, ctx);
-        if (rc)
-                goto out;
+        /* call init() to allocate bufs if the user hasn't */
+        if (!state->digest_buff) {
+                rc = ssi_hash_init(state, ctx);
+                if (rc)
+                        goto out;
+        }
 
         dma_sync_single_for_cpu(dev, state->digest_buff_dma_addr,
                                 ctx->inter_digestsize, DMA_BIDIRECTIONAL);
diff --git a/drivers/staging/comedi/drivers/ni_atmio.c b/drivers/staging/comedi/drivers/ni_atmio.c
index 2d62a8c57332..ae6ed96d7874 100644
--- a/drivers/staging/comedi/drivers/ni_atmio.c
+++ b/drivers/staging/comedi/drivers/ni_atmio.c
@@ -361,3 +361,8 @@ static struct comedi_driver ni_atmio_driver = {
         .detach         = ni_atmio_detach,
 };
 module_comedi_driver(ni_atmio_driver);
+
+MODULE_AUTHOR("Comedi http://www.comedi.org");
+MODULE_DESCRIPTION("Comedi low-level driver");
+MODULE_LICENSE("GPL");
+
diff --git a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.c b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.c
index 986c2a40d978..8267119ccc8e 100644
--- a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.c
+++ b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.c
@@ -487,21 +487,18 @@ ksocknal_add_peer(struct lnet_ni *ni, struct lnet_process_id id, __u32 ipaddr,
                               ksocknal_nid2peerlist(id.nid));
         }
 
-        route2 = NULL;
         list_for_each_entry(route2, &peer->ksnp_routes, ksnr_list) {
-                if (route2->ksnr_ipaddr == ipaddr)
-                        break;
-
-                route2 = NULL;
-        }
-        if (!route2) {
-                ksocknal_add_route_locked(peer, route);
-                route->ksnr_share_count++;
-        } else {
-                ksocknal_route_decref(route);
-                route2->ksnr_share_count++;
+                if (route2->ksnr_ipaddr == ipaddr) {
+                        /* Route already exists, use the old one */
+                        ksocknal_route_decref(route);
+                        route2->ksnr_share_count++;
+                        goto out;
+                }
         }
-
+        /* Route doesn't already exist, add the new one */
+        ksocknal_add_route_locked(peer, route);
+        route->ksnr_share_count++;
+out:
         write_unlock_bh(&ksocknal_data.ksnd_global_lock);
 
         return 0;
diff --git a/drivers/staging/lustre/lnet/lnet/lib-socket.c b/drivers/staging/lustre/lnet/lnet/lib-socket.c
index 539a26444f31..7d49d4865298 100644
--- a/drivers/staging/lustre/lnet/lnet/lib-socket.c
+++ b/drivers/staging/lustre/lnet/lnet/lib-socket.c
@@ -71,16 +71,12 @@ lnet_sock_ioctl(int cmd, unsigned long arg)
         }
 
         sock_filp = sock_alloc_file(sock, 0, NULL);
-        if (IS_ERR(sock_filp)) {
-                sock_release(sock);
-                rc = PTR_ERR(sock_filp);
-                goto out;
-        }
+        if (IS_ERR(sock_filp))
+                return PTR_ERR(sock_filp);
 
         rc = kernel_sock_unlocked_ioctl(sock_filp, cmd, arg);
 
         fput(sock_filp);
-out:
         return rc;
 }
 
diff --git a/drivers/staging/media/atomisp/include/linux/atomisp.h b/drivers/staging/media/atomisp/include/linux/atomisp.h
index b5533197226d..15fa5679bae7 100644
--- a/drivers/staging/media/atomisp/include/linux/atomisp.h
+++ b/drivers/staging/media/atomisp/include/linux/atomisp.h
@@ -208,14 +208,14 @@ struct atomisp_dis_vector {
 };
 
 
-/** DVS 2.0 Coefficient types. This structure contains 4 pointers to
+/* DVS 2.0 Coefficient types. This structure contains 4 pointers to
  *  arrays that contain the coeffients for each type.
  */
 struct atomisp_dvs2_coef_types {
-        short __user *odd_real; /**< real part of the odd coefficients*/
-        short __user *odd_imag; /**< imaginary part of the odd coefficients*/
-        short __user *even_real;/**< real part of the even coefficients*/
-        short __user *even_imag;/**< imaginary part of the even coefficients*/
+        short __user *odd_real; /** real part of the odd coefficients*/
+        short __user *odd_imag; /** imaginary part of the odd coefficients*/
+        short __user *even_real;/** real part of the even coefficients*/
+        short __user *even_imag;/** imaginary part of the even coefficients*/
 };
 
 /*
@@ -223,10 +223,10 @@ struct atomisp_dvs2_coef_types {
  * arrays that contain the statistics for each type.
  */
 struct atomisp_dvs2_stat_types {
-        int __user *odd_real; /**< real part of the odd statistics*/
-        int __user *odd_imag; /**< imaginary part of the odd statistics*/
-        int __user *even_real;/**< real part of the even statistics*/
-        int __user *even_imag;/**< imaginary part of the even statistics*/
+        int __user *odd_real; /** real part of the odd statistics*/
+        int __user *odd_imag; /** imaginary part of the odd statistics*/
+        int __user *even_real;/** real part of the even statistics*/
+        int __user *even_imag;/** imaginary part of the even statistics*/
 };
 
 struct atomisp_dis_coefficients {
@@ -390,16 +390,16 @@ struct atomisp_metadata_config {
  * Generic resolution structure.
  */
 struct atomisp_resolution {
-        uint32_t width;  /**< Width */
-        uint32_t height; /**< Height */
+        uint32_t width;  /** Width */
+        uint32_t height; /** Height */
 };
 
 /*
  * This specifies the coordinates (x,y)
  */
 struct atomisp_zoom_point {
-        int32_t x; /**< x coordinate */
-        int32_t y; /**< y coordinate */
+        int32_t x; /** x coordinate */
+        int32_t y; /** y coordinate */
 };
 
 /*
@@ -411,9 +411,9 @@ struct atomisp_zoom_region {
 };
 
 struct atomisp_dz_config {
-        uint32_t dx; /**< Horizontal zoom factor */
-        uint32_t dy; /**< Vertical zoom factor */
-        struct atomisp_zoom_region zoom_region; /**< region for zoom */
+        uint32_t dx; /** Horizontal zoom factor */
+        uint32_t dy; /** Vertical zoom factor */
+        struct atomisp_zoom_region zoom_region; /** region for zoom */
 };
 
 struct atomisp_parm {
@@ -758,7 +758,7 @@ enum atomisp_acc_arg_type {
         ATOMISP_ACC_ARG_FRAME        /* Frame argument */
 };
 
-/** ISP memories, isp2400 */
+/* ISP memories, isp2400 */
 enum atomisp_acc_memory {
         ATOMISP_ACC_MEMORY_PMEM0 = 0,
         ATOMISP_ACC_MEMORY_DMEM0,
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_cmd.c
index 8a18c528cad4..debf0e3853ff 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_cmd.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_cmd.c
@@ -5187,7 +5187,7 @@ int get_frame_info_nop(struct atomisp_sub_device *asd,
         return 0;
 }
 
-/**
+/*
  * Resets CSS parameters that depend on input resolution.
  *
  * Update params like CSS RAW binning, 2ppc mode and pp_input
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_css20.c b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_css20.c
index 6e87aa5aab4c..b7f9da014641 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_css20.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_css20.c
@@ -4051,7 +4051,7 @@ int atomisp_css_get_formats_config(struct atomisp_sub_device *asd,
 int atomisp_css_get_zoom_factor(struct atomisp_sub_device *asd,
                                         unsigned int *zoom)
 {
-        struct ia_css_dz_config dz_config;  /**< Digital Zoom */
+        struct ia_css_dz_config dz_config;  /** Digital Zoom */
         struct ia_css_isp_config isp_config;
         struct atomisp_device *isp = asd->isp;
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.h b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.h
index 685da0f48bab..95669eedaad1 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.h
@@ -28,17 +28,17 @@ struct atomisp_histogram32 {
 };
 
 struct atomisp_dvs2_stat_types32 {
-        compat_uptr_t odd_real; /**< real part of the odd statistics*/
-        compat_uptr_t odd_imag; /**< imaginary part of the odd statistics*/
-        compat_uptr_t even_real;/**< real part of the even statistics*/
-        compat_uptr_t even_imag;/**< imaginary part of the even statistics*/
+        compat_uptr_t odd_real; /** real part of the odd statistics*/
+        compat_uptr_t odd_imag; /** imaginary part of the odd statistics*/
+        compat_uptr_t even_real;/** real part of the even statistics*/
+        compat_uptr_t even_imag;/** imaginary part of the even statistics*/
 };
 
 struct atomisp_dvs2_coef_types32 {
-        compat_uptr_t odd_real; /**< real part of the odd coefficients*/
-        compat_uptr_t odd_imag; /**< imaginary part of the odd coefficients*/
-        compat_uptr_t even_real;/**< real part of the even coefficients*/
-        compat_uptr_t even_imag;/**< imaginary part of the even coefficients*/
+        compat_uptr_t odd_real; /** real part of the odd coefficients*/
+        compat_uptr_t odd_imag; /** imaginary part of the odd coefficients*/
+        compat_uptr_t even_real;/** real part of the even coefficients*/
+        compat_uptr_t even_imag;/** imaginary part of the even coefficients*/
 };
 
 struct atomisp_dvs2_statistics32 {
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_subdev.h b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_subdev.h
index f3d61827ae8c..c3eba675da06 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_subdev.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_subdev.h
@@ -223,7 +223,7 @@ struct atomisp_subdev_params {
 
         bool dis_proj_data_valid;
 
-        struct ia_css_dz_config   dz_config;  /**< Digital Zoom */
+        struct ia_css_dz_config   dz_config;  /** Digital Zoom */
         struct ia_css_capture_config   capture_config;
 
         struct atomisp_css_isp_config config;
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/base/circbuf/src/circbuf.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/base/circbuf/src/circbuf.c
index 19bae1610fb6..050d60f0894f 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/base/circbuf/src/circbuf.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/base/circbuf/src/circbuf.c
@@ -21,7 +21,7 @@
  * Forward declarations.
  *
  **********************************************************************/
-/**
+/*
  * @brief Read the oldest element from the circular buffer.
  * Read the oldest element WITHOUT checking whehter the
  * circular buffer is empty or not. The oldest element is
@@ -34,7 +34,7 @@
 static inline ia_css_circbuf_elem_t
 ia_css_circbuf_read(ia_css_circbuf_t *cb);
 
-/**
+/*
  * @brief Shift a chunk of elements in the circular buffer.
  * A chunk of elements (i.e. the ones from the "start" position
  * to the "chunk_src" position) are shifted in the circular buffer,
@@ -48,7 +48,7 @@ static inline void ia_css_circbuf_shift_chunk(ia_css_circbuf_t *cb,
                                                    uint32_t chunk_src,
                                                    uint32_t chunk_dest);
 
-/**
+/*
  * @brief Get the "val" field in the element.
  *
  * @param elem The pointer to the element.
@@ -63,7 +63,7 @@ ia_css_circbuf_elem_get_val(ia_css_circbuf_elem_t *elem);
  * Non-inline functions.
  *
  **********************************************************************/
-/**
+/*
  * @brief Create the circular buffer.
  * Refer to "ia_css_circbuf.h" for details.
  */
@@ -88,7 +88,7 @@ ia_css_circbuf_create(ia_css_circbuf_t *cb,
         cb->elems = elems;
 }
 
-/**
+/*
  * @brief Destroy the circular buffer.
  * Refer to "ia_css_circbuf.h" for details.
  */
@@ -99,7 +99,7 @@ void ia_css_circbuf_destroy(ia_css_circbuf_t *cb)
         cb->elems = NULL;
 }
 
-/**
+/*
  * @brief Pop a value out of the circular buffer.
  * Refer to "ia_css_circbuf.h" for details.
  */
@@ -116,7 +116,7 @@ uint32_t ia_css_circbuf_pop(ia_css_circbuf_t *cb)
         return ret;
 }
 
-/**
+/*
  * @brief Extract a value out of the circular buffer.
  * Refer to "ia_css_circbuf.h" for details.
  */
@@ -166,7 +166,7 @@ uint32_t ia_css_circbuf_extract(ia_css_circbuf_t *cb, int offset)
         return val;
 }
 
-/**
+/*
  * @brief Peek an element from the circular buffer.
  * Refer to "ia_css_circbuf.h" for details.
  */
@@ -180,7 +180,7 @@ uint32_t ia_css_circbuf_peek(ia_css_circbuf_t *cb, int offset)
         return cb->elems[pos].val;
 }
 
-/**
+/*
  * @brief Get the value of an element from the circular buffer.
  * Refer to "ia_css_circbuf.h" for details.
  */
@@ -194,7 +194,7 @@ uint32_t ia_css_circbuf_peek_from_start(ia_css_circbuf_t *cb, int offset)
         return cb->elems[pos].val;
 }
 
-/** @brief increase size of a circular buffer.
+/* @brief increase size of a circular buffer.
  * Use 'CAUTION' before using this function. This was added to
  * support / fix issue with increasing size for tagger only
  * Please refer to "ia_css_circbuf.h" for details.
@@ -252,7 +252,7 @@ bool ia_css_circbuf_increase_size(
  * Inline functions.
  *
  ****************************************************************/
-/**
+/*
  * @brief Get the "val" field in the element.
  * Refer to "Forward declarations" for details.
  */
@@ -262,7 +262,7 @@ ia_css_circbuf_elem_get_val(ia_css_circbuf_elem_t *elem)
         return elem->val;
 }
 
-/**
+/*
  * @brief Read the oldest element from the circular buffer.
  * Refer to "Forward declarations" for details.
  */
@@ -282,7 +282,7 @@ ia_css_circbuf_read(ia_css_circbuf_t *cb)
         return elem;
 }
 
-/**
+/*
  * @brief Shift a chunk of elements in the circular buffer.
  * Refer to "Forward declarations" for details.
  */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/camera/pipe/interface/ia_css_pipe_binarydesc.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/camera/pipe/interface/ia_css_pipe_binarydesc.h
index 616789d9b3f6..a6d650a9a1f4 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/camera/pipe/interface/ia_css_pipe_binarydesc.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/camera/pipe/interface/ia_css_pipe_binarydesc.h
@@ -19,7 +19,7 @@
 #include <ia_css_frame_public.h>        /* ia_css_frame_info */
 #include <ia_css_binary.h>              /* ia_css_binary_descr */
 
-/** @brief Get a binary descriptor for copy.
+/* @brief Get a binary descriptor for copy.
  *
  * @param[in] pipe
  * @param[out] copy_desc
@@ -36,7 +36,7 @@ extern void ia_css_pipe_get_copy_binarydesc(
         struct ia_css_frame_info *out_info,
         struct ia_css_frame_info *vf_info);
 
-/** @brief Get a binary descriptor for vfpp.
+/* @brief Get a binary descriptor for vfpp.
  *
  * @param[in] pipe
  * @param[out] vfpp_descr
@@ -51,7 +51,7 @@ extern void ia_css_pipe_get_vfpp_binarydesc(
                 struct ia_css_frame_info *in_info,
                 struct ia_css_frame_info *out_info);
 
-/** @brief Get numerator and denominator of bayer downscaling factor.
+/* @brief Get numerator and denominator of bayer downscaling factor.
  *
  * @param[in] bds_factor: The bayer downscaling factor.
  *              (= The bds_factor member in the sh_css_bds_factor structure.)
@@ -67,7 +67,7 @@ extern enum ia_css_err sh_css_bds_factor_get_numerator_denominator(
         unsigned int *bds_factor_numerator,
         unsigned int *bds_factor_denominator);
 
-/** @brief Get a binary descriptor for preview stage.
+/* @brief Get a binary descriptor for preview stage.
  *
  * @param[in] pipe
  * @param[out] preview_descr
@@ -86,7 +86,7 @@ extern enum ia_css_err ia_css_pipe_get_preview_binarydesc(
         struct ia_css_frame_info *out_info,
         struct ia_css_frame_info *vf_info);
 
-/** @brief Get a binary descriptor for video stage.
+/* @brief Get a binary descriptor for video stage.
  *
  * @param[in/out] pipe
  * @param[out] video_descr
@@ -105,7 +105,7 @@ extern enum ia_css_err ia_css_pipe_get_video_binarydesc(
         struct ia_css_frame_info *vf_info,
         int stream_config_left_padding);
 
-/** @brief Get a binary descriptor for yuv scaler stage.
+/* @brief Get a binary descriptor for yuv scaler stage.
  *
  * @param[in/out] pipe
  * @param[out] yuv_scaler_descr
@@ -124,7 +124,7 @@ void ia_css_pipe_get_yuvscaler_binarydesc(
         struct ia_css_frame_info *internal_out_info,
         struct ia_css_frame_info *vf_info);
 
-/** @brief Get a binary descriptor for capture pp stage.
+/* @brief Get a binary descriptor for capture pp stage.
  *
  * @param[in/out] pipe
  * @param[out] capture_pp_descr
@@ -140,7 +140,7 @@ extern void ia_css_pipe_get_capturepp_binarydesc(
         struct ia_css_frame_info *out_info,
         struct ia_css_frame_info *vf_info);
 
-/** @brief Get a binary descriptor for primary capture.
+/* @brief Get a binary descriptor for primary capture.
  *
  * @param[in] pipe
  * @param[out] prim_descr
@@ -158,7 +158,7 @@ extern void ia_css_pipe_get_primary_binarydesc(
         struct ia_css_frame_info *vf_info,
         unsigned int stage_idx);
 
-/** @brief Get a binary descriptor for pre gdc stage.
+/* @brief Get a binary descriptor for pre gdc stage.
  *
  * @param[in] pipe
  * @param[out] pre_gdc_descr
@@ -173,7 +173,7 @@ extern void ia_css_pipe_get_pre_gdc_binarydesc(
         struct ia_css_frame_info *in_info,
         struct ia_css_frame_info *out_info);
 
-/** @brief Get a binary descriptor for gdc stage.
+/* @brief Get a binary descriptor for gdc stage.
  *
  * @param[in] pipe
  * @param[out] gdc_descr
@@ -188,7 +188,7 @@ extern void ia_css_pipe_get_gdc_binarydesc(
         struct ia_css_frame_info *in_info,
         struct ia_css_frame_info *out_info);
 
-/** @brief Get a binary descriptor for post gdc.
+/* @brief Get a binary descriptor for post gdc.
  *
  * @param[in] pipe
  * @param[out] post_gdc_descr
@@ -205,7 +205,7 @@ extern void ia_css_pipe_get_post_gdc_binarydesc(
         struct ia_css_frame_info *out_info,
         struct ia_css_frame_info *vf_info);
 
-/** @brief Get a binary descriptor for de.
+/* @brief Get a binary descriptor for de.
  *
  * @param[in] pipe
  * @param[out] pre_de_descr
@@ -220,7 +220,7 @@ extern void ia_css_pipe_get_pre_de_binarydesc(
         struct ia_css_frame_info *in_info,
         struct ia_css_frame_info *out_info);
 
-/** @brief Get a binary descriptor for pre anr stage.
+/* @brief Get a binary descriptor for pre anr stage.
  *
  * @param[in] pipe
  * @param[out] pre_anr_descr
@@ -235,7 +235,7 @@ extern void ia_css_pipe_get_pre_anr_binarydesc(
         struct ia_css_frame_info *in_info,
         struct ia_css_frame_info *out_info);
 
-/** @brief Get a binary descriptor for ANR stage.
+/* @brief Get a binary descriptor for ANR stage.
  *
  * @param[in] pipe
  * @param[out] anr_descr
@@ -250,7 +250,7 @@ extern void ia_css_pipe_get_anr_binarydesc(
         struct ia_css_frame_info *in_info,
         struct ia_css_frame_info *out_info);
 
-/** @brief Get a binary descriptor for post anr stage.
+/* @brief Get a binary descriptor for post anr stage.
  *
  * @param[in] pipe
  * @param[out] post_anr_descr
@@ -267,7 +267,7 @@ extern void ia_css_pipe_get_post_anr_binarydesc(
         struct ia_css_frame_info *out_info,
         struct ia_css_frame_info *vf_info);
 
-/** @brief Get a binary descriptor for ldc stage.
+/* @brief Get a binary descriptor for ldc stage.
  *
  * @param[in/out] pipe
  * @param[out] capture_pp_descr
@@ -282,7 +282,7 @@ extern void ia_css_pipe_get_ldc_binarydesc(
         struct ia_css_frame_info *in_info,
         struct ia_css_frame_info *out_info);
 
-/** @brief Calculates the required BDS factor
+/* @brief Calculates the required BDS factor
  *
  * @param[in] input_res
  * @param[in] output_res
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/camera/pipe/interface/ia_css_pipe_util.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/camera/pipe/interface/ia_css_pipe_util.h
index ba8858759b30..155b6fb4722b 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/camera/pipe/interface/ia_css_pipe_util.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/camera/pipe/interface/ia_css_pipe_util.h
@@ -18,7 +18,7 @@
 #include <ia_css_types.h>
 #include <ia_css_frame_public.h>
 
-/** @brief Get Input format bits per pixel based on stream configuration of this
+/* @brief Get Input format bits per pixel based on stream configuration of this
  * pipe.
  *
  * @param[in] pipe
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/camera/util/interface/ia_css_util.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/camera/util/interface/ia_css_util.h
index f8b2e458f876..a8c27676a38b 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/camera/util/interface/ia_css_util.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/camera/util/interface/ia_css_util.h
@@ -22,7 +22,7 @@
 #include <ia_css_stream_public.h>
 #include <ia_css_stream_format.h>
 
-/** @brief convert "errno" error code to "ia_css_err" error code
+/* @brief convert "errno" error code to "ia_css_err" error code
  *
  * @param[in]   "errno" error code
  * @return      "ia_css_err" error code
@@ -31,7 +31,7 @@
 enum ia_css_err ia_css_convert_errno(
         int in_err);
 
-/** @brief check vf frame info.
+/* @brief check vf frame info.
  *
  * @param[in] info
  * @return      IA_CSS_SUCCESS or error code upon error.
@@ -40,7 +40,7 @@ enum ia_css_err ia_css_convert_errno(
 extern enum ia_css_err ia_css_util_check_vf_info(
         const struct ia_css_frame_info * const info);
 
-/** @brief check input configuration.
+/* @brief check input configuration.
  *
  * @param[in] stream_config
  * @param[in] must_be_raw
@@ -52,7 +52,7 @@ extern enum ia_css_err ia_css_util_check_input(
         bool must_be_raw,
         bool must_be_yuv);
 
-/** @brief check vf and out frame info.
+/* @brief check vf and out frame info.
  *
  * @param[in] out_info
  * @param[in] vf_info
@@ -63,7 +63,7 @@ extern enum ia_css_err ia_css_util_check_vf_out_info(
         const struct ia_css_frame_info * const out_info,
         const struct ia_css_frame_info * const vf_info);
 
-/** @brief check width and height
+/* @brief check width and height
  *
  * @param[in] width
  * @param[in] height
@@ -75,7 +75,7 @@ extern enum ia_css_err ia_css_util_check_res(
         unsigned int height);
 
 #ifdef ISP2401
-/** @brief compare resolutions (less or equal)
+/* @brief compare resolutions (less or equal)
  *
  * @param[in] a resolution
  * @param[in] b resolution
@@ -108,7 +108,7 @@ extern bool ia_css_util_resolution_is_even(
                 const struct ia_css_resolution resolution);
 
 #endif
-/** @brief check width and height
+/* @brief check width and height
  *
  * @param[in] stream_format
  * @param[in] two_ppc
@@ -119,7 +119,7 @@ extern unsigned int ia_css_util_input_format_bpp(
         enum ia_css_stream_format stream_format,
         bool two_ppc);
 
-/** @brief check if input format it raw
+/* @brief check if input format it raw
  *
  * @param[in] stream_format
  * @return true if the input format is raw or false otherwise
@@ -128,7 +128,7 @@ extern unsigned int ia_css_util_input_format_bpp(
 extern bool ia_css_util_is_input_format_raw(
         enum ia_css_stream_format stream_format);
 
-/** @brief check if input format it yuv
+/* @brief check if input format it yuv
  *
  * @param[in] stream_format
  * @return true if the input format is yuv or false otherwise
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/csi_rx_private.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/csi_rx_private.h
index 6720ab55d6f5..9c0cb4a63862 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/csi_rx_private.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/csi_rx_private.h
@@ -277,6 +277,6 @@ static inline void csi_rx_be_ctrl_reg_store(
 
         ia_css_device_store_uint32(CSI_RX_BE_CTRL_BASE[ID] + reg*sizeof(hrt_data), value);
 }
-/** end of DLI */
+/* end of DLI */
 
 #endif /* __CSI_RX_PRIVATE_H_INCLUDED__ */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/ibuf_ctrl_private.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/ibuf_ctrl_private.h
index 470c92d287fe..4d07c2fe1469 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/ibuf_ctrl_private.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/ibuf_ctrl_private.h
@@ -192,7 +192,7 @@ STORAGE_CLASS_IBUF_CTRL_C void ibuf_ctrl_dump_state(
                 ia_css_print("IBUF controller ID %d Process ID %d isp_sync_state 0x%x\n", ID, i, state->proc_state[i].isp_sync_state);
         }
 }
-/** end of NCI */
+/* end of NCI */
 
 /*****************************************************
  *
@@ -227,7 +227,7 @@ STORAGE_CLASS_IBUF_CTRL_C void ibuf_ctrl_reg_store(
 
         ia_css_device_store_uint32(IBUF_CTRL_BASE[ID] + reg*sizeof(hrt_data), value);
 }
-/** end of DLI */
+/* end of DLI */
 
 
 #endif /* __IBUF_CTRL_PRIVATE_H_INCLUDED__ */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/isys_irq.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/isys_irq.c
index 14d1d3b627a9..842ae340ae13 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/isys_irq.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/isys_irq.c
@@ -26,7 +26,7 @@
 #include "isys_irq_private.h"
 #endif
 
-/** Public interface */
+/* Public interface */
 STORAGE_CLASS_ISYS2401_IRQ_C void isys_irqc_status_enable(
         const isys_irq_ID_t     isys_irqc_id)
 {
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/isys_irq_private.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/isys_irq_private.h
index c17ce131c9e1..e69f39893bd2 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/isys_irq_private.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/isys_irq_private.h
@@ -59,7 +59,7 @@ STORAGE_CLASS_ISYS2401_IRQ_C void isys_irqc_state_dump(
                 state->status, state->edge, state->mask, state->enable, state->level_no);
 }
 
-/** end of NCI */
+/* end of NCI */
 
 /* -------------------------------------------------------+
  |              Device level interface (DLI)              |
@@ -101,7 +101,7 @@ STORAGE_CLASS_ISYS2401_IRQ_C hrt_data isys_irqc_reg_load(
         return value;
 }
 
-/** end of DLI */
+/* end of DLI */
 
 #endif /* defined(USE_INPUT_SYSTEM_VERSION_2401) */
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/isys_stream2mmio_private.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/isys_stream2mmio_private.h
index 1603a09b621a..f946105ddf43 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/isys_stream2mmio_private.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/isys_stream2mmio_private.h
@@ -122,7 +122,7 @@ STORAGE_CLASS_STREAM2MMIO_C void stream2mmio_dump_state(
                 stream2mmio_print_sid_state(&(state->sid_state[i]));
         }
 }
-/** end of NCI */
+/* end of NCI */
 
 /*****************************************************
  *
@@ -163,6 +163,6 @@ STORAGE_CLASS_STREAM2MMIO_C void stream2mmio_reg_store(
         ia_css_device_store_uint32(STREAM2MMIO_CTRL_BASE[ID] +
                 reg * sizeof(hrt_data), value);
 }
-/** end of DLI */
+/* end of DLI */
 
 #endif /* __ISYS_STREAM2MMIO_PRIVATE_H_INCLUDED__ */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/pixelgen_private.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/pixelgen_private.h
index 3f34b508f0bf..c5bf540eadf1 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/pixelgen_private.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/host/pixelgen_private.h
@@ -160,5 +160,5 @@ STORAGE_CLASS_PIXELGEN_C void pixelgen_ctrl_reg_store(
 
         ia_css_device_store_uint32(PIXELGEN_CTRL_BASE[ID] + reg*sizeof(hrt_data), value);
 }
-/** end of DLI */
+/* end of DLI */
 #endif /* __PIXELGEN_PRIVATE_H_INCLUDED__ */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/isys_dma_global.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/isys_dma_global.h
index e7a734a9fc43..1be5c6956d65 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/isys_dma_global.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/isys_dma_global.h
@@ -46,7 +46,7 @@ struct isys2401_dma_port_cfg_s {
         uint32_t cropping;
         uint32_t width;
  };
-/** end of DMA Port */
+/* end of DMA Port */
 
 /************************************************
  *
@@ -79,7 +79,7 @@ struct isys2401_dma_cfg_s {
         isys2401_dma_extension  extension;
         uint32_t                height;
 };
-/** end of DMA Device */
+/* end of DMA Device */
 
 /* isys2401_dma_channel limits per DMA ID */
 extern const isys2401_dma_channel N_ISYS2401_DMA_CHANNEL_PROCS[N_ISYS2401_DMA_ID];
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/pixelgen_global.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/pixelgen_global.h
index 216813e42a0a..0bf2feb8bbfb 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/pixelgen_global.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/pixelgen_global.h
@@ -86,6 +86,6 @@ struct pixelgen_prbs_cfg_s {
         sync_generator_cfg_t    sync_gen_cfg;
 };
 
-/** end of Pixel-generator: TPG. ("pixelgen_global.h") */
+/* end of Pixel-generator: TPG. ("pixelgen_global.h") */
 #endif /* __PIXELGEN_GLOBAL_H_INCLUDED__ */
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/system_global.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/system_global.h
index 9f7ecac46273..d2e3a2deea2e 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/system_global.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_2401_csi2p_system/system_global.h
@@ -331,7 +331,7 @@ typedef enum {
         IBUF_CTRL2_ID,          /* map ISYS2401_IBUF_CNTRL_C */
         N_IBUF_CTRL_ID
 } ibuf_ctrl_ID_t;
-/** end of Input-buffer Controller */
+/* end of Input-buffer Controller */
 
 /*
  * Stream2MMIO.
@@ -364,7 +364,7 @@ typedef enum {
         STREAM2MMIO_SID7_ID,
         N_STREAM2MMIO_SID_ID
 } stream2mmio_sid_ID_t;
-/** end of Stream2MMIO */
+/* end of Stream2MMIO */
 
 /**
  * Input System 2401: CSI-MIPI recevier.
@@ -390,7 +390,7 @@ typedef enum {
         CSI_RX_DLANE3_ID,               /* map to DLANE3 in CSI RX */
         N_CSI_RX_DLANE_ID
 } csi_rx_fe_dlane_ID_t;
-/** end of CSI-MIPI receiver */
+/* end of CSI-MIPI receiver */
 
 typedef enum {
         ISYS2401_DMA0_ID = 0,
@@ -406,7 +406,7 @@ typedef enum {
         PIXELGEN2_ID,
         N_PIXELGEN_ID
 } pixelgen_ID_t;
-/** end of pixel-generator. ("system_global.h") */
+/* end of pixel-generator. ("system_global.h") */
 
 typedef enum {
         INPUT_SYSTEM_CSI_PORT0_ID = 0,
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_api_version.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_api_version.h
index 1f6a55ff5db8..efcd6e1679e8 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_api_version.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/css_api_version.h
@@ -31,7 +31,7 @@ more details.
 #ifndef __CSS_API_VERSION_H
 #define __CSS_API_VERSION_H
 
-/** @file
+/* @file
  * CSS API version file. This file contains the version number of the CSS-API.
  *
  * This file is generated from a set of input files describing the CSS-API
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_common/host/gp_timer.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_common/host/gp_timer.c
index 5a4eabf79ee2..bcfd443f5202 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_common/host/gp_timer.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_common/host/gp_timer.c
@@ -21,7 +21,7 @@
 #endif /* __INLINE_GP_TIMER__ */
 #include "system_local.h"
 
-/** FIXME: not sure if reg_load(), reg_store() should be API.
+/* FIXME: not sure if reg_load(), reg_store() should be API.
  */
 static uint32_t
 gp_timer_reg_load(uint32_t reg);
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/csi_rx_public.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/csi_rx_public.h
index 3b5df85fc510..426d022d3a26 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/csi_rx_public.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/csi_rx_public.h
@@ -73,7 +73,7 @@ extern void csi_rx_be_ctrl_get_state(
 extern void csi_rx_be_ctrl_dump_state(
                 const csi_rx_backend_ID_t ID,
                 csi_rx_be_ctrl_state_t *state);
-/** end of NCI */
+/* end of NCI */
 
 /*****************************************************
  *
@@ -130,6 +130,6 @@ extern void csi_rx_be_ctrl_reg_store(
         const csi_rx_backend_ID_t ID,
         const hrt_address reg,
         const hrt_data value);
-/** end of DLI */
+/* end of DLI */
 #endif /* USE_INPUT_SYSTEM_VERSION_2401 */
 #endif /* __CSI_RX_PUBLIC_H_INCLUDED__ */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/ibuf_ctrl_public.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/ibuf_ctrl_public.h
index 1ac0e64e539c..98ee9947fb8e 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/ibuf_ctrl_public.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/ibuf_ctrl_public.h
@@ -54,7 +54,7 @@ STORAGE_CLASS_IBUF_CTRL_H void ibuf_ctrl_get_proc_state(
 STORAGE_CLASS_IBUF_CTRL_H void ibuf_ctrl_dump_state(
                 const ibuf_ctrl_ID_t ID,
                 ibuf_ctrl_state_t *state);
-/** end of NCI */
+/* end of NCI */
 
 /*****************************************************
  *
@@ -87,7 +87,7 @@ STORAGE_CLASS_IBUF_CTRL_H void ibuf_ctrl_reg_store(
         const ibuf_ctrl_ID_t ID,
         const hrt_address reg,
         const hrt_data value);
-/** end of DLI */
+/* end of DLI */
 
 #endif /* USE_INPUT_SYSTEM_VERSION_2401 */
 #endif /* __IBUF_CTRL_PUBLIC_H_INCLUDED__ */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/isp_op1w.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/isp_op1w.h
index a025ad562bd2..0d978e5911c0 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/isp_op1w.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/isp_op1w.h
@@ -49,7 +49,7 @@
 
 /* Arithmetic */
 
-/** @brief bitwise AND
+/* @brief bitwise AND
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -63,7 +63,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_and(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief bitwise OR
+/* @brief bitwise OR
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -77,7 +77,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_or(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief bitwise XOR
+/* @brief bitwise XOR
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -91,7 +91,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_xor(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief bitwise inverse
+/* @brief bitwise inverse
  *
  * @param[in] _a        first argument
  *
@@ -105,7 +105,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_inv(
 
 /* Additive */
 
-/** @brief addition
+/* @brief addition
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -120,7 +120,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_add(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief subtraction
+/* @brief subtraction
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -135,7 +135,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_sub(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief saturated addition
+/* @brief saturated addition
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -150,7 +150,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_addsat(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief saturated subtraction
+/* @brief saturated subtraction
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -166,7 +166,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_subsat(
     const tvector1w     _b);
 
 #ifdef ISP2401
-/** @brief Unsigned saturated subtraction
+/* @brief Unsigned saturated subtraction
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -182,7 +182,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w_unsigned OP_1w_subsat_u(
     const tvector1w_unsigned _b);
 
 #endif
-/** @brief subtraction with shift right and rounding
+/* @brief subtraction with shift right and rounding
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -202,7 +202,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_subasr1(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief Subtraction with shift right and rounding
+/* @brief Subtraction with shift right and rounding
  *
  * @param[in] _a        first operand
  * @param[in] _b        second operand
@@ -217,7 +217,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_subhalfrnd(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief Subtraction with shift right and no rounding
+/* @brief Subtraction with shift right and no rounding
  *
  * @param[in] _a        first operand
  * @param[in] _b        second operand
@@ -233,7 +233,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_subhalf(
     const tvector1w     _b);
 
 
-/** @brief saturated absolute value
+/* @brief saturated absolute value
  *
  * @param[in] _a        input
  *
@@ -247,7 +247,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_subhalf(
 STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_abs(
     const tvector1w     _a);
 
-/** @brief saturated absolute difference
+/* @brief saturated absolute difference
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -264,7 +264,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_subabssat(
 
 /* Multiplicative */
 
-/** @brief doubling multiply
+/* @brief doubling multiply
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -281,7 +281,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector2w OP_1w_muld(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief integer multiply
+/* @brief integer multiply
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -298,7 +298,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_mul(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief fractional saturating multiply
+/* @brief fractional saturating multiply
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -316,7 +316,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_qmul(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief fractional saturating multiply with rounding
+/* @brief fractional saturating multiply with rounding
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -337,7 +337,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_qrmul(
 
 /* Comparative */
 
-/** @brief equal
+/* @brief equal
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -351,7 +351,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tflags OP_1w_eq(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief not equal
+/* @brief not equal
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -365,7 +365,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tflags OP_1w_ne(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief less or equal
+/* @brief less or equal
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -379,7 +379,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tflags OP_1w_le(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief less then
+/* @brief less then
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -393,7 +393,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tflags OP_1w_lt(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief greater or equal
+/* @brief greater or equal
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -407,7 +407,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tflags OP_1w_ge(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief greater than
+/* @brief greater than
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -423,7 +423,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tflags OP_1w_gt(
 
 /* Shift */
 
-/** @brief aritmetic shift right
+/* @brief aritmetic shift right
  *
  * @param[in] _a        input
  * @param[in] _b        shift amount
@@ -441,7 +441,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_asr(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief aritmetic shift right with rounding
+/* @brief aritmetic shift right with rounding
  *
  * @param[in] _a        input
  * @param[in] _b        shift amount
@@ -460,7 +460,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_asrrnd(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief saturating arithmetic shift left
+/* @brief saturating arithmetic shift left
  *
  * @param[in] _a        input
  * @param[in] _b        shift amount
@@ -480,7 +480,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_asl(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief saturating aritmetic shift left
+/* @brief saturating aritmetic shift left
  *
  * @param[in] _a        input
  * @param[in] _b        shift amount
@@ -493,7 +493,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_aslsat(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief logical shift left
+/* @brief logical shift left
  *
  * @param[in] _a        input
  * @param[in] _b        shift amount
@@ -510,7 +510,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_lsl(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief logical shift right
+/* @brief logical shift right
  *
  * @param[in] _a        input
  * @param[in] _b        shift amount
@@ -528,7 +528,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_lsr(
     const tvector1w     _b);
 
 #ifdef ISP2401
-/** @brief bidirectional saturating arithmetic shift
+/* @brief bidirectional saturating arithmetic shift
  *
  * @param[in] _a        input
  * @param[in] _b        shift amount
@@ -546,7 +546,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_ashift_sat(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief bidirectional non-saturating arithmetic shift
+/* @brief bidirectional non-saturating arithmetic shift
  *
  * @param[in] _a        input
  * @param[in] _b        shift amount
@@ -565,7 +565,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_ashift(
     const tvector1w     _b);
 
 
-/** @brief bidirectional logical shift
+/* @brief bidirectional logical shift
  *
  * @param[in] _a        input
  * @param[in] _b        shift amount
@@ -588,7 +588,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_lshift(
 #endif
 /* Cast */
 
-/** @brief Cast from int to 1w
+/* @brief Cast from int to 1w
  *
  * @param[in] _a        input
  *
@@ -601,7 +601,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_lshift(
 STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_int_cast_to_1w(
     const int           _a);
 
-/** @brief Cast from 1w to int
+/* @brief Cast from 1w to int
  *
  * @param[in] _a        input
  *
@@ -614,7 +614,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_int_cast_to_1w(
 STORAGE_CLASS_ISP_OP1W_FUNC_H int OP_1w_cast_to_int(
     const tvector1w      _a);
 
-/** @brief Cast from 1w to 2w
+/* @brief Cast from 1w to 2w
  *
  * @param[in] _a        input
  *
@@ -627,7 +627,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H int OP_1w_cast_to_int(
 STORAGE_CLASS_ISP_OP1W_FUNC_H tvector2w OP_1w_cast_to_2w(
     const tvector1w     _a);
 
-/** @brief Cast from 2w to 1w
+/* @brief Cast from 2w to 1w
  *
  * @param[in] _a        input
  *
@@ -641,7 +641,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_2w_cast_to_1w(
     const tvector2w    _a);
 
 
-/** @brief Cast from 2w to 1w with saturation
+/* @brief Cast from 2w to 1w with saturation
  *
  * @param[in] _a        input
  *
@@ -657,7 +657,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_2w_sat_cast_to_1w(
 
 /* clipping */
 
-/** @brief Clip asymmetrical
+/* @brief Clip asymmetrical
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -673,7 +673,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_clip_asym(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief Clip zero
+/* @brief Clip zero
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -691,7 +691,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_clipz(
 
 /* division */
 
-/** @brief Truncated division
+/* @brief Truncated division
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -708,7 +708,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_div(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief Fractional saturating divide
+/* @brief Fractional saturating divide
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -726,7 +726,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_qdiv(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief Modulo
+/* @brief Modulo
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -741,7 +741,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_mod(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief Unsigned integer Square root
+/* @brief Unsigned integer Square root
  *
  * @param[in] _a        input
  *
@@ -754,7 +754,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w_unsigned OP_1w_sqrt_u(
 
 /* Miscellaneous */
 
-/** @brief Multiplexer
+/* @brief Multiplexer
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -770,7 +770,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_mux(
     const tvector1w     _b,
     const tflags           _c);
 
-/** @brief Average without rounding
+/* @brief Average without rounding
  *
  * @param[in] _a        first operand
  * @param[in] _b        second operand
@@ -786,7 +786,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w  OP_1w_avg(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief Average with rounding
+/* @brief Average with rounding
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -802,7 +802,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_avgrnd(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief Minimum
+/* @brief Minimum
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -816,7 +816,7 @@ STORAGE_CLASS_ISP_OP1W_FUNC_H tvector1w OP_1w_min(
     const tvector1w     _a,
     const tvector1w     _b);
 
-/** @brief Maximum
+/* @brief Maximum
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/isp_op2w.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/isp_op2w.h
index cf7e7314842d..7575d260b837 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/isp_op2w.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/isp_op2w.h
@@ -48,7 +48,7 @@
 
 /* Arithmetic */
 
-/** @brief bitwise AND
+/* @brief bitwise AND
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -62,7 +62,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_and(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief bitwise OR
+/* @brief bitwise OR
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -76,7 +76,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_or(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief bitwise XOR
+/* @brief bitwise XOR
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -90,7 +90,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_xor(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief bitwise inverse
+/* @brief bitwise inverse
  *
  * @param[in] _a        first argument
  *
@@ -104,7 +104,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_inv(
 
 /* Additive */
 
-/** @brief addition
+/* @brief addition
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -119,7 +119,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_add(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief subtraction
+/* @brief subtraction
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -134,7 +134,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_sub(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief saturated addition
+/* @brief saturated addition
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -149,7 +149,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_addsat(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief saturated subtraction
+/* @brief saturated subtraction
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -164,7 +164,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_subsat(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief subtraction with shift right and rounding
+/* @brief subtraction with shift right and rounding
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -184,7 +184,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_subasr1(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief Subtraction with shift right and rounding
+/* @brief Subtraction with shift right and rounding
  *
  * @param[in] _a        first operand
  * @param[in] _b        second operand
@@ -199,7 +199,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_subhalfrnd(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief Subtraction with shift right and no rounding
+/* @brief Subtraction with shift right and no rounding
  *
  * @param[in] _a        first operand
  * @param[in] _b        second operand
@@ -214,7 +214,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_subhalf(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief saturated absolute value
+/* @brief saturated absolute value
  *
  * @param[in] _a        input
  *
@@ -228,7 +228,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_subhalf(
 STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_abs(
     const tvector2w     _a);
 
-/** @brief saturated absolute difference
+/* @brief saturated absolute difference
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -245,7 +245,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_subabssat(
 
 /* Multiplicative */
 
-/** @brief integer multiply
+/* @brief integer multiply
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -262,7 +262,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_mul(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief fractional saturating multiply
+/* @brief fractional saturating multiply
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -279,7 +279,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_qmul(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief fractional saturating multiply with rounding
+/* @brief fractional saturating multiply with rounding
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -301,7 +301,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_qrmul(
 
 /* Comparative */
 
-/** @brief equal
+/* @brief equal
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -315,7 +315,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tflags OP_2w_eq(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief not equal
+/* @brief not equal
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -329,7 +329,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tflags OP_2w_ne(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief less or equal
+/* @brief less or equal
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -343,7 +343,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tflags OP_2w_le(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief less then
+/* @brief less then
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -357,7 +357,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tflags OP_2w_lt(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief greater or equal
+/* @brief greater or equal
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -371,7 +371,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tflags OP_2w_ge(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief greater than
+/* @brief greater than
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -387,7 +387,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tflags OP_2w_gt(
 
 /* Shift */
 
-/** @brief aritmetic shift right
+/* @brief aritmetic shift right
  *
  * @param[in] _a        input
  * @param[in] _b        shift amount
@@ -404,7 +404,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_asr(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief aritmetic shift right with rounding
+/* @brief aritmetic shift right with rounding
  *
  * @param[in] _a        input
  * @param[in] _b        shift amount
@@ -423,7 +423,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_asrrnd(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief saturating aritmetic shift left
+/* @brief saturating aritmetic shift left
  *
  * @param[in] _a        input
  * @param[in] _b        shift amount
@@ -443,7 +443,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_asl(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief saturating aritmetic shift left
+/* @brief saturating aritmetic shift left
  *
  * @param[in] _a        input
  * @param[in] _b        shift amount
@@ -456,7 +456,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_aslsat(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief logical shift left
+/* @brief logical shift left
  *
  * @param[in] _a        input
  * @param[in] _b        shift amount
@@ -473,7 +473,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_lsl(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief logical shift right
+/* @brief logical shift right
  *
  * @param[in] _a        input
  * @param[in] _b        shift amount
@@ -492,7 +492,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_lsr(
 
 /* clipping */
 
-/** @brief Clip asymmetrical
+/* @brief Clip asymmetrical
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -507,7 +507,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_clip_asym(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief Clip zero
+/* @brief Clip zero
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -524,7 +524,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_clipz(
 
 /* division */
 
-/** @brief Truncated division
+/* @brief Truncated division
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -541,7 +541,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_div(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief Saturating truncated division
+/* @brief Saturating truncated division
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -559,7 +559,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector1w OP_2w_divh(
     const tvector2w     _a,
     const tvector1w     _b);
 
-/** @brief Modulo
+/* @brief Modulo
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -572,7 +572,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_mod(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief Unsigned Integer Square root
+/* @brief Unsigned Integer Square root
  *
  * @param[in] _a        input
  *
@@ -585,7 +585,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector1w_unsigned OP_2w_sqrt_u(
 
 /* Miscellaneous */
 
-/** @brief Multiplexer
+/* @brief Multiplexer
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -601,7 +601,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_mux(
     const tvector2w     _b,
     const tflags           _c);
 
-/** @brief Average without rounding
+/* @brief Average without rounding
  *
  * @param[in] _a        first operand
  * @param[in] _b        second operand
@@ -617,7 +617,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w  OP_2w_avg(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief Average with rounding
+/* @brief Average with rounding
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -633,7 +633,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_avgrnd(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief Minimum
+/* @brief Minimum
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
@@ -647,7 +647,7 @@ STORAGE_CLASS_ISP_OP2W_FUNC_H tvector2w OP_2w_min(
     const tvector2w     _a,
     const tvector2w     _b);
 
-/** @brief Maximum
+/* @brief Maximum
  *
  * @param[in] _a        first argument
  * @param[in] _b        second argument
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/isys_stream2mmio_public.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/isys_stream2mmio_public.h
index 5624cfcfa015..6c53ca9df96c 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/isys_stream2mmio_public.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/isys_stream2mmio_public.h
@@ -43,7 +43,7 @@ STORAGE_CLASS_STREAM2MMIO_H void stream2mmio_get_sid_state(
                 const stream2mmio_ID_t ID,
                 const stream2mmio_sid_ID_t sid_id,
                 stream2mmio_sid_state_t *state);
-/** end of NCI */
+/* end of NCI */
 
 /*****************************************************
  *
@@ -96,6 +96,6 @@ STORAGE_CLASS_STREAM2MMIO_H void stream2mmio_reg_store(
                 const stream2mmio_ID_t ID,
                 const hrt_address reg,
                 const hrt_data value);
-/** end of DLI */
+/* end of DLI */
 
 #endif /* __ISYS_STREAM2MMIO_PUBLIC_H_INCLUDED__ */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/pixelgen_public.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/pixelgen_public.h
index c0f3f3ea32d7..f597e07d7c4f 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/pixelgen_public.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/pixelgen_public.h
@@ -41,7 +41,7 @@ STORAGE_CLASS_PIXELGEN_H void pixelgen_ctrl_get_state(
 STORAGE_CLASS_PIXELGEN_H void pixelgen_ctrl_dump_state(
                 const pixelgen_ID_t ID,
                 pixelgen_ctrl_state_t *state);
-/** end of NCI */
+/* end of NCI */
 
 /*****************************************************
  *
@@ -73,7 +73,7 @@ STORAGE_CLASS_PIXELGEN_H void pixelgen_ctrl_reg_store(
         const pixelgen_ID_t ID,
         const hrt_address reg,
         const hrt_data value);
-/** end of DLI */
+/* end of DLI */
 
 #endif /* USE_INPUT_SYSTEM_VERSION_2401 */
 #endif /* __PIXELGEN_PUBLIC_H_INCLUDED__ */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/ref_vector_func.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/ref_vector_func.h
index a202d6dce106..c1638c06407d 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/ref_vector_func.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/host/ref_vector_func.h
@@ -27,7 +27,7 @@
 
 #include "ref_vector_func_types.h"
 
-/** @brief Doubling multiply accumulate with saturation
+/* @brief Doubling multiply accumulate with saturation
  *
  * @param[in] acc accumulator
  * @param[in] a multiply input
@@ -44,7 +44,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector2w OP_1w_maccd_sat(
         tvector1w a,
         tvector1w b );
 
-/** @brief Doubling multiply accumulate
+/* @brief Doubling multiply accumulate
  *
  * @param[in] acc accumulator
  * @param[in] a multiply input
@@ -61,7 +61,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector2w OP_1w_maccd(
         tvector1w a,
         tvector1w b );
 
-/** @brief Re-aligning multiply
+/* @brief Re-aligning multiply
  *
  * @param[in] a multiply input
  * @param[in] b multiply input
@@ -78,7 +78,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w OP_1w_mul_realigning(
         tvector1w b,
         tscalar1w shift );
 
-/** @brief Leading bit index
+/* @brief Leading bit index
  *
  * @param[in] a         input
  *
@@ -92,7 +92,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w OP_1w_mul_realigning(
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w OP_1w_lod(
                 tvector1w a);
 
-/** @brief Config Unit Input Processing
+/* @brief Config Unit Input Processing
  *
  * @param[in] a             input
  * @param[in] input_scale   input scaling factor
@@ -111,7 +111,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w OP_1w_input_scaling_offset_clamping(
         tscalar1w_5bit_signed input_scale,
         tscalar1w_5bit_signed input_offset);
 
-/** @brief Config Unit Output Processing
+/* @brief Config Unit Output Processing
  *
  * @param[in] a              output
  * @param[in] output_scale   output scaling factor
@@ -127,7 +127,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w OP_1w_output_scaling_clamping(
         tvector1w a,
         tscalar1w_5bit_signed output_scale);
 
-/** @brief Config Unit Piecewiselinear estimation
+/* @brief Config Unit Piecewiselinear estimation
  *
  * @param[in] a                   input
  * @param[in] config_points   config parameter structure
@@ -143,7 +143,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w OP_1w_piecewise_estimation(
         tvector1w a,
         ref_config_points config_points);
 
-/** @brief Fast Config Unit
+/* @brief Fast Config Unit
  *
  * @param[in] x                 input
  * @param[in] init_vectors      LUT data structure
@@ -161,7 +161,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H  tvector1w OP_1w_XCU(
         xcu_ref_init_vectors init_vectors);
 
 
-/** @brief LXCU
+/* @brief LXCU
  *
  * @param[in] x                 input
  * @param[in] init_vectors      LUT data structure
@@ -180,7 +180,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w OP_1w_LXCU(
         tvector1w x,
         xcu_ref_init_vectors init_vectors);
 
-/** @brief Coring
+/* @brief Coring
  *
  * @param[in] coring_vec   Amount of coring based on brightness level
  * @param[in] filt_input   Vector of input pixels on which Coring is applied
@@ -196,7 +196,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w coring(
         tvector1w filt_input,
         tscalar1w m_CnrCoring0 );
 
-/** @brief Normalised FIR with coefficients [3,4,1]
+/* @brief Normalised FIR with coefficients [3,4,1]
  *
  * @param[in] m 1x3 matrix with pixels
  *
@@ -209,7 +209,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w coring(
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_5dB_m90_nrm (
         const s_1w_1x3_matrix           m);
 
-/** @brief Normalised FIR with coefficients [1,4,3]
+/* @brief Normalised FIR with coefficients [1,4,3]
  *
  * @param[in] m 1x3 matrix with pixels
  *
@@ -222,7 +222,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_5dB_m90_nrm (
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_5dB_p90_nrm (
         const s_1w_1x3_matrix           m);
 
-/** @brief Normalised FIR with coefficients [1,2,1]
+/* @brief Normalised FIR with coefficients [1,2,1]
  *
  * @param[in] m 1x3 matrix with pixels
  *
@@ -234,7 +234,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_5dB_p90_nrm (
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_6dB_nrm (
         const s_1w_1x3_matrix           m);
 
-/** @brief Normalised FIR with coefficients [13,16,3]
+/* @brief Normalised FIR with coefficients [13,16,3]
  *
  * @param[in] m 1x3 matrix with pixels
  *
@@ -246,7 +246,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_6dB_nrm (
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_6dB_nrm_ph0 (
         const s_1w_1x3_matrix           m);
 
-/** @brief Normalised FIR with coefficients [9,16,7]
+/* @brief Normalised FIR with coefficients [9,16,7]
  *
  * @param[in] m 1x3 matrix with pixels
  *
@@ -258,7 +258,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_6dB_nrm_ph0 (
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_6dB_nrm_ph1 (
         const s_1w_1x3_matrix           m);
 
-/** @brief Normalised FIR with coefficients [5,16,11]
+/* @brief Normalised FIR with coefficients [5,16,11]
  *
  * @param[in] m 1x3 matrix with pixels
  *
@@ -270,7 +270,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_6dB_nrm_ph1 (
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_6dB_nrm_ph2 (
         const s_1w_1x3_matrix           m);
 
-/** @brief Normalised FIR with coefficients [1,16,15]
+/* @brief Normalised FIR with coefficients [1,16,15]
  *
  * @param[in] m 1x3 matrix with pixels
  *
@@ -282,7 +282,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_6dB_nrm_ph2 (
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_6dB_nrm_ph3 (
         const s_1w_1x3_matrix           m);
 
-/** @brief Normalised FIR with programable phase shift
+/* @brief Normalised FIR with programable phase shift
  *
  * @param[in] m 1x3 matrix with pixels
  * @param[in] coeff     phase shift
@@ -295,7 +295,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_6dB_nrm_ph3 (
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_6dB_nrm_calc_coeff (
         const s_1w_1x3_matrix           m, tscalar1w_3bit coeff);
 
-/** @brief 3 tap FIR with coefficients [1,1,1]
+/* @brief 3 tap FIR with coefficients [1,1,1]
  *
  * @param[in] m 1x3 matrix with pixels
  *
@@ -308,7 +308,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x3m_9dB_nrm (
         const s_1w_1x3_matrix           m);
 
 #ifdef ISP2401
-/** @brief      symmetric 3 tap FIR acts as LPF or BSF
+/* @brief      symmetric 3 tap FIR acts as LPF or BSF
  *
  * @param[in] m 1x3 matrix with pixels
  * @param[in] k filter coefficient shift
@@ -336,7 +336,7 @@ sym_fir1x3m_lpf_bsf(s_1w_1x3_matrix m,
                     tscalar_bool bsf_flag);
 #endif
 
-/** @brief Normalised 2D FIR with coefficients  [1;2;1] * [1,2,1]
+/* @brief Normalised 2D FIR with coefficients  [1;2;1] * [1,2,1]
  *
  * @param[in] m 3x3 matrix with pixels
  *
@@ -353,7 +353,7 @@ sym_fir1x3m_lpf_bsf(s_1w_1x3_matrix m,
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir3x3m_6dB_nrm (
         const s_1w_3x3_matrix           m);
 
-/** @brief Normalised 2D FIR with coefficients  [1;1;1] * [1,1,1]
+/* @brief Normalised 2D FIR with coefficients  [1;1;1] * [1,1,1]
  *
  * @param[in] m 3x3 matrix with pixels
  *
@@ -371,7 +371,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir3x3m_6dB_nrm (
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir3x3m_9dB_nrm (
         const s_1w_3x3_matrix           m);
 
-/** @brief Normalised dual output 2D FIR with coefficients  [1;2;1] * [1,2,1]
+/* @brief Normalised dual output 2D FIR with coefficients  [1;2;1] * [1,2,1]
  *
  * @param[in] m 4x3 matrix with pixels
  *
@@ -391,7 +391,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir3x3m_9dB_nrm (
  STORAGE_CLASS_REF_VECTOR_FUNC_H s_1w_2x1_matrix fir3x3m_6dB_out2x1_nrm (
         const s_1w_4x3_matrix           m);
 
-/** @brief Normalised dual output 2D FIR with coefficients [1;1;1] * [1,1,1]
+/* @brief Normalised dual output 2D FIR with coefficients [1;1;1] * [1,1,1]
  *
  * @param[in] m 4x3 matrix with pixels
  *
@@ -411,7 +411,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir3x3m_9dB_nrm (
 STORAGE_CLASS_REF_VECTOR_FUNC_H s_1w_2x1_matrix fir3x3m_9dB_out2x1_nrm (
         const s_1w_4x3_matrix           m);
 
-/** @brief Normalised 2D FIR 5x5
+/* @brief Normalised 2D FIR 5x5
  *
  * @param[in] m 5x5 matrix with pixels
  *
@@ -429,7 +429,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H s_1w_2x1_matrix fir3x3m_9dB_out2x1_nrm (
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir5x5m_15dB_nrm (
         const s_1w_5x5_matrix   m);
 
-/** @brief Normalised FIR 1x5
+/* @brief Normalised FIR 1x5
  *
  * @param[in] m 1x5 matrix with pixels
  *
@@ -447,7 +447,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir5x5m_15dB_nrm (
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x5m_12dB_nrm (
         const s_1w_1x5_matrix m);
 
-/** @brief Normalised 2D FIR 5x5
+/* @brief Normalised 2D FIR 5x5
  *
  * @param[in] m 5x5 matrix with pixels
  *
@@ -465,7 +465,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x5m_12dB_nrm (
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir5x5m_12dB_nrm (
         const s_1w_5x5_matrix m);
 
-/** @brief Approximate averaging FIR 1x5
+/* @brief Approximate averaging FIR 1x5
  *
  * @param[in] m 1x5 matrix with pixels
  *
@@ -479,7 +479,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir5x5m_12dB_nrm (
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x5m_box (
         s_1w_1x5_matrix m);
 
-/** @brief Approximate averaging FIR 1x9
+/* @brief Approximate averaging FIR 1x9
  *
  * @param[in] m 1x9 matrix with pixels
  *
@@ -493,7 +493,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x5m_box (
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x9m_box (
         s_1w_1x9_matrix m);
 
-/** @brief Approximate averaging FIR 1x11
+/* @brief Approximate averaging FIR 1x11
  *
  * @param[in] m 1x11 matrix with pixels
  *
@@ -507,7 +507,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x9m_box (
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w fir1x11m_box (
         s_1w_1x11_matrix m);
 
-/** @brief Symmetric 7 tap filter with normalization
+/* @brief Symmetric 7 tap filter with normalization
  *
  *  @param[in] in 1x7 matrix with pixels
  *  @param[in] coeff 1x4 matrix with coefficients
@@ -528,7 +528,7 @@ fir1x7m_sym_nrm(s_1w_1x7_matrix in,
                 s_1w_1x4_matrix coeff,
                 tvector1w out_shift);
 
-/** @brief Symmetric 7 tap filter with normalization at input side
+/* @brief Symmetric 7 tap filter with normalization at input side
  *
  *  @param[in] in 1x7 matrix with pixels
  *  @param[in] coeff 1x4 matrix with coefficients
@@ -549,7 +549,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w
 fir1x7m_sym_innrm_approx(s_1w_1x7_matrix in,
                          s_1w_1x4_matrix coeff);
 
-/** @brief Symmetric 7 tap filter with normalization at output side
+/* @brief Symmetric 7 tap filter with normalization at output side
  *
  *  @param[in] in 1x7 matrix with pixels
  *  @param[in] coeff 1x4 matrix with coefficients
@@ -571,7 +571,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w
 fir1x7m_sym_outnrm_approx(s_1w_1x7_matrix in,
                          s_1w_1x4_matrix coeff);
 
-/** @brief 4 tap filter with normalization
+/* @brief 4 tap filter with normalization
  *
  *  @param[in] in 1x4 matrix with pixels
  *  @param[in] coeff 1x4 matrix with coefficients
@@ -588,7 +588,7 @@ fir1x4m_nrm(s_1w_1x4_matrix in,
                 s_1w_1x4_matrix coeff,
                 tvector1w out_shift);
 
-/** @brief 4 tap filter with normalization for half pixel interpolation
+/* @brief 4 tap filter with normalization for half pixel interpolation
  *
  *  @param[in] in 1x4 matrix with pixels
  *
@@ -604,7 +604,7 @@ fir1x4m_nrm(s_1w_1x4_matrix in,
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w
 fir1x4m_bicubic_bezier_half(s_1w_1x4_matrix in);
 
-/** @brief 4 tap filter with normalization for quarter pixel interpolation
+/* @brief 4 tap filter with normalization for quarter pixel interpolation
  *
  *  @param[in] in 1x4 matrix with pixels
  *  @param[in] coeff 1x4 matrix with coefficients
@@ -626,7 +626,7 @@ fir1x4m_bicubic_bezier_quarter(s_1w_1x4_matrix in,
                         s_1w_1x4_matrix coeff);
 
 
-/** @brief Symmetric 3 tap filter with normalization
+/* @brief Symmetric 3 tap filter with normalization
  *
  *  @param[in] in 1x3 matrix with pixels
  *  @param[in] coeff 1x2 matrix with coefficients
@@ -646,7 +646,7 @@ fir1x3m_sym_nrm(s_1w_1x3_matrix in,
                 s_1w_1x2_matrix coeff,
                 tvector1w out_shift);
 
-/** @brief Symmetric 3 tap filter with normalization
+/* @brief Symmetric 3 tap filter with normalization
  *
  *  @param[in] in 1x3 matrix with pixels
  *  @param[in] coeff 1x2 matrix with coefficients
@@ -666,7 +666,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w
 fir1x3m_sym_nrm_approx(s_1w_1x3_matrix in,
                        s_1w_1x2_matrix coeff);
 
-/** @brief Mean of 1x3 matrix
+/* @brief Mean of 1x3 matrix
  *
  *  @param[in] m 1x3 matrix with pixels
  *
@@ -678,7 +678,7 @@ fir1x3m_sym_nrm_approx(s_1w_1x3_matrix in,
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean1x3m(
         s_1w_1x3_matrix m);
 
-/** @brief Mean of 3x3 matrix
+/* @brief Mean of 3x3 matrix
  *
  *  @param[in] m 3x3 matrix with pixels
  *
@@ -690,7 +690,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean1x3m(
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean3x3m(
         s_1w_3x3_matrix m);
 
-/** @brief Mean of 1x4 matrix
+/* @brief Mean of 1x4 matrix
  *
  *  @param[in] m 1x4 matrix with pixels
  *
@@ -701,7 +701,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean3x3m(
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean1x4m(
         s_1w_1x4_matrix m);
 
-/** @brief Mean of 4x4 matrix
+/* @brief Mean of 4x4 matrix
  *
  *  @param[in] m 4x4 matrix with pixels
  *
@@ -712,7 +712,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean1x4m(
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean4x4m(
         s_1w_4x4_matrix m);
 
-/** @brief Mean of 2x3 matrix
+/* @brief Mean of 2x3 matrix
  *
  *  @param[in] m 2x3 matrix with pixels
  *
@@ -724,7 +724,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean4x4m(
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean2x3m(
         s_1w_2x3_matrix m);
 
-/** @brief Mean of 1x5 matrix
+/* @brief Mean of 1x5 matrix
  *
  *  @param[in] m 1x5 matrix with pixels
  *
@@ -735,7 +735,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean2x3m(
 */
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean1x5m(s_1w_1x5_matrix m);
 
-/** @brief Mean of 1x6 matrix
+/* @brief Mean of 1x6 matrix
  *
  *  @param[in] m 1x6 matrix with pixels
  *
@@ -747,7 +747,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean1x5m(s_1w_1x5_matrix m);
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean1x6m(
         s_1w_1x6_matrix m);
 
-/** @brief Mean of 5x5 matrix
+/* @brief Mean of 5x5 matrix
  *
  *  @param[in] m 5x5 matrix with pixels
  *
@@ -759,7 +759,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean1x6m(
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean5x5m(
         s_1w_5x5_matrix m);
 
-/** @brief Mean of 6x6 matrix
+/* @brief Mean of 6x6 matrix
  *
  *  @param[in] m 6x6 matrix with pixels
  *
@@ -771,7 +771,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean5x5m(
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean6x6m(
         s_1w_6x6_matrix m);
 
-/** @brief Minimum of 4x4 matrix
+/* @brief Minimum of 4x4 matrix
  *
  *  @param[in] m 4x4 matrix with pixels
  *
@@ -783,7 +783,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w mean6x6m(
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w min4x4m(
         s_1w_4x4_matrix m);
 
-/** @brief Maximum of 4x4 matrix
+/* @brief Maximum of 4x4 matrix
  *
  *  @param[in] m 4x4 matrix with pixels
  *
@@ -795,7 +795,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w min4x4m(
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w max4x4m(
         s_1w_4x4_matrix m);
 
-/** @brief SAD between two 3x3 matrices
+/* @brief SAD between two 3x3 matrices
  *
  *  @param[in] a 3x3 matrix with pixels
  *
@@ -813,7 +813,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w sad3x3m_precise(
         s_1w_3x3_matrix a,
         s_1w_3x3_matrix b);
 
-/** @brief SAD between two 3x3 matrices
+/* @brief SAD between two 3x3 matrices
  *
  *  @param[in] a 3x3 matrix with pixels
  *
@@ -833,7 +833,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w sad3x3m(
         s_1w_3x3_matrix a,
         s_1w_3x3_matrix b);
 
-/** @brief SAD between two 5x5 matrices
+/* @brief SAD between two 5x5 matrices
  *
  *  @param[in] a 5x5 matrix with pixels
  *
@@ -847,7 +847,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w sad5x5m(
         s_1w_5x5_matrix a,
         s_1w_5x5_matrix b);
 
-/** @brief Absolute gradient between two sets of 1x5 matrices
+/* @brief Absolute gradient between two sets of 1x5 matrices
  *
  *  @param[in] m0 first set of 1x5 matrix with pixels
  *  @param[in] m1 second set of 1x5 matrix with pixels
@@ -860,7 +860,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w sad5x5m(
 STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w
 absgrad1x5m(s_1w_1x5_matrix m0, s_1w_1x5_matrix m1);
 
-/** @brief Bi-linear Interpolation optimized(approximate)
+/* @brief Bi-linear Interpolation optimized(approximate)
  *
  * @param[in] a input0
  * @param[in] b input1
@@ -882,7 +882,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w OP_1w_bilinear_interpol_approx_c(
         tvector1w b,
         tscalar1w_weight c);
 
-/** @brief Bi-linear Interpolation optimized(approximate)
+/* @brief Bi-linear Interpolation optimized(approximate)
  *
  * @param[in] a input0
  * @param[in] b input1
@@ -904,7 +904,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w OP_1w_bilinear_interpol_approx(
         tvector1w b,
         tvector1w_weight c);
 
-/** @brief Bi-linear Interpolation
+/* @brief Bi-linear Interpolation
  *
  * @param[in] a input0
  * @param[in] b input1
@@ -925,7 +925,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w OP_1w_bilinear_interpol(
         tvector1w b,
         tscalar1w_weight c);
 
-/** @brief Generic Block Matching Algorithm
+/* @brief Generic Block Matching Algorithm
  * @param[in] search_window pointer to input search window of 16x16 pixels
  * @param[in] ref_block pointer to input reference block of 8x8 pixels, where N<=M
  * @param[in] output pointer to output sads
@@ -954,9 +954,9 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H int generic_block_matching_algorithm(
         tscalar1w_4bit_bma_shift shift);
 
 #ifndef ISP2401
-/** @brief OP_1w_asp_bma_16_1_32way
+/* @brief OP_1w_asp_bma_16_1_32way
 #else
-/** @brief OP_1w_asp_bma_16_1_32way_nomask
+/* @brief OP_1w_asp_bma_16_1_32way_nomask
 #endif
  *
  * @param[in] search_area input search window of 16x16 pixels
@@ -984,9 +984,9 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H bma_output_16_1 OP_1w_asp_bma_16_1_32way_nomask(
         tscalar1w_4bit_bma_shift shift);
 
 #ifndef ISP2401
-/** @brief OP_1w_asp_bma_16_2_32way
+/* @brief OP_1w_asp_bma_16_2_32way
 #else
-/** @brief OP_1w_asp_bma_16_2_32way_nomask
+/* @brief OP_1w_asp_bma_16_2_32way_nomask
 #endif
  *
  * @param[in] search_area input search window of 16x16 pixels
@@ -1011,9 +1011,9 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H bma_output_16_2 OP_1w_asp_bma_16_2_32way_nomask(
         ref_block_8x8 input_block,
         tscalar1w_4bit_bma_shift shift);
 #ifndef ISP2401
-/** @brief OP_1w_asp_bma_14_1_32way
+/* @brief OP_1w_asp_bma_14_1_32way
 #else
-/** @brief OP_1w_asp_bma_14_1_32way_nomask
+/* @brief OP_1w_asp_bma_14_1_32way_nomask
 #endif
  *
  * @param[in] search_area input search block of 16x16 pixels with search window of 14x14 pixels
@@ -1041,9 +1041,9 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H bma_output_14_1 OP_1w_asp_bma_14_1_32way_nomask(
         tscalar1w_4bit_bma_shift shift);
 
 #ifndef ISP2401
-/** @brief OP_1w_asp_bma_14_2_32way
+/* @brief OP_1w_asp_bma_14_2_32way
 #else
-/** @brief OP_1w_asp_bma_14_2_32way_nomask
+/* @brief OP_1w_asp_bma_14_2_32way_nomask
 #endif
  *
  * @param[in] search_area input search block of 16x16 pixels with search window of 14x14 pixels
@@ -1069,7 +1069,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H bma_output_14_2 OP_1w_asp_bma_14_2_32way_nomask(
         tscalar1w_4bit_bma_shift shift);
 
 #ifdef ISP2401
-/** @brief multiplex addition and passing
+/* @brief multiplex addition and passing
  *
  *  @param[in] _a first pixel
  *  @param[in] _b second pixel
@@ -1087,7 +1087,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H tvector1w OP_1w_cond_add(
 
 #endif
 #ifdef HAS_bfa_unit
-/** @brief OP_1w_single_bfa_7x7
+/* @brief OP_1w_single_bfa_7x7
  *
  * @param[in] weights - spatial and range weight lut
  * @param[in] threshold - threshold plane, for range weight scaling
@@ -1115,7 +1115,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H bfa_7x7_output OP_1w_single_bfa_7x7(
         tvector1w central_pix,
         s_1w_7x7_matrix src_plane);
 
-/** @brief OP_1w_joint_bfa_7x7
+/* @brief OP_1w_joint_bfa_7x7
  *
  * @param[in] weights - spatial and range weight lut
  * @param[in] threshold0 - 1st threshold plane, for range weight scaling
@@ -1149,7 +1149,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H bfa_7x7_output OP_1w_joint_bfa_7x7(
         tvector1w central_pix1,
         s_1w_7x7_matrix src1_plane);
 
-/** @brief bbb_bfa_gen_spatial_weight_lut
+/* @brief bbb_bfa_gen_spatial_weight_lut
  *
  * @param[in] in - 7x7 matrix of spatial weights
  * @param[in] out - generated LUT
@@ -1163,7 +1163,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H void bbb_bfa_gen_spatial_weight_lut(
         s_1w_7x7_matrix in,
         tvector1w out[BFA_MAX_KWAY]);
 
-/** @brief bbb_bfa_gen_range_weight_lut
+/* @brief bbb_bfa_gen_range_weight_lut
  *
  * @param[in] in - input range weight,
  * @param[in] out - generated LUT
@@ -1184,7 +1184,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H void bbb_bfa_gen_range_weight_lut(
 #endif
 
 #ifdef ISP2401
-/** @brief OP_1w_imax32
+/* @brief OP_1w_imax32
  *
  * @param[in] src - structure that holds an array of 32 elements.
  *
@@ -1195,7 +1195,7 @@ STORAGE_CLASS_REF_VECTOR_FUNC_H void bbb_bfa_gen_range_weight_lut(
 STORAGE_CLASS_REF_VECTOR_FUNC_H int OP_1w_imax32(
         imax32_ref_in_vector src);
 
-/** @brief OP_1w_imaxidx32
+/* @brief OP_1w_imaxidx32
  *
  * @param[in] src - structure that holds a vector of elements.
  *
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/math_support.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/math_support.h
index e85e5c889c15..6436dae0007e 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/math_support.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/math_support.h
@@ -168,7 +168,7 @@ static inline unsigned int round_half_down_mul(unsigned int a, unsigned int b)
 }
 #endif
 
-/** @brief Next Power of Two
+/* @brief Next Power of Two
  *
  *  @param[in] unsigned number
  *
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/string_support.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/string_support.h
index d80437c58bde..f4d9674cdab6 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/string_support.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_include/string_support.h
@@ -23,7 +23,7 @@
  */
 
 
-/** @brief Copy from src_buf to dest_buf.
+/* @brief Copy from src_buf to dest_buf.
  *
  * @param[out] dest_buf. Destination buffer to copy to
  * @param[in]  dest_size. The size of the destination buffer in bytes
@@ -53,7 +53,7 @@ static inline int memcpy_s(
         return 0;
 }
 
-/** @brief Get the length of the string, excluding the null terminator
+/* @brief Get the length of the string, excluding the null terminator
  *
  * @param[in]  src_str. The source string
  * @param[in]  max_len. Look only for max_len bytes in the string
@@ -78,7 +78,7 @@ static size_t strnlen_s(
         return ix;
 }
 
-/** @brief Copy string from src_str to dest_str
+/* @brief Copy string from src_str to dest_str
  *
  * @param[out] dest_str. Destination buffer to copy to
  * @param[in]  dest_size. The size of the destination buffer in bytes
@@ -120,7 +120,7 @@ static inline int strncpy_s(
         return 0;
 }
 
-/** @brief Copy string from src_str to dest_str
+/* @brief Copy string from src_str to dest_str
  *
  * @param[out] dest_str. Destination buffer to copy to
  * @param[in]  dest_size. The size of the destination buffer in bytes
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_shared/host/tag.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_shared/host/tag.c
index 9aa8c168a803..2cf1d58941bf 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_shared/host/tag.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_shared/host/tag.c
@@ -17,7 +17,7 @@
 #include <assert_support.h>
 #include "tag_local.h"
 
-/**
+/*
  * @brief       Creates the tag description from the given parameters.
  * @param[in]   num_captures
  * @param[in]   skip
@@ -39,7 +39,7 @@ sh_css_create_tag_descr(int num_captures,
         tag_descr->exp_id       = exp_id;
 }
 
-/**
+/*
  * @brief       Encodes the members of tag description into a 32-bit value.
  * @param[in]   tag             Pointer to the tag description
  * @return      (unsigned int)  Encoded 32-bit tag-info
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css.h
index 2458b3767c90..e44df6916d90 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css.h
@@ -16,7 +16,7 @@
 #ifndef _IA_CSS_H_
 #define _IA_CSS_H_
 
-/** @file
+/* @file
  * This file is the starting point of the CSS-API. It includes all CSS-API
  * header files.
  */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_3a.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_3a.h
index a80a7dbaf712..080198796ad0 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_3a.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_3a.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_3A_H
 #define __IA_CSS_3A_H
 
-/** @file
+/* @file
  * This file contains types used for 3A statistics
  */
 
@@ -31,7 +31,7 @@ enum ia_css_3a_tables {
         IA_CSS_NUM_3A_TABLES
 };
 
-/** Structure that holds 3A statistics in the ISP internal
+/* Structure that holds 3A statistics in the ISP internal
  * format. Use ia_css_get_3a_statistics() to translate
  * this to the format used on the host (3A library).
  * */
@@ -48,13 +48,13 @@ struct ia_css_isp_3a_statistics {
         struct {
                 ia_css_ptr rgby_tbl;
         } data_hmem;
-        uint32_t exp_id;     /**< exposure id, to match statistics to a frame,
+        uint32_t exp_id;     /** exposure id, to match statistics to a frame,
                                   see ia_css_event_public.h for more detail. */
-        uint32_t isp_config_id;/**< Unique ID to track which config was actually applied to a particular frame */
-        ia_css_ptr data_ptr; /**< pointer to base of all data */
-        uint32_t   size;     /**< total size of all data */
+        uint32_t isp_config_id;/** Unique ID to track which config was actually applied to a particular frame */
+        ia_css_ptr data_ptr; /** pointer to base of all data */
+        uint32_t   size;     /** total size of all data */
         uint32_t   dmem_size;
-        uint32_t   vmem_size; /**< both lo and hi have this size */
+        uint32_t   vmem_size; /** both lo and hi have this size */
         uint32_t   hmem_size;
 };
 #define SIZE_OF_DMEM_STRUCT                                             \
@@ -77,7 +77,7 @@ struct ia_css_isp_3a_statistics {
          SIZE_OF_IA_CSS_PTR +                                           \
          4 * sizeof(uint32_t))
 
-/** Map with host-side pointers to ISP-format statistics.
+/* Map with host-side pointers to ISP-format statistics.
  * These pointers can either be copies of ISP data or memory mapped
  * ISP pointers.
  * All of the data behind these pointers is allocated contiguously, the
@@ -85,17 +85,17 @@ struct ia_css_isp_3a_statistics {
  * point into this one block of data.
  */
 struct ia_css_isp_3a_statistics_map {
-        void                    *data_ptr; /**< Pointer to start of memory */
+        void                    *data_ptr; /** Pointer to start of memory */
         struct ia_css_3a_output *dmem_stats;
         uint16_t                *vmem_stats_hi;
         uint16_t                *vmem_stats_lo;
         struct ia_css_bh_table  *hmem_stats;
-        uint32_t                 size; /**< total size in bytes of data_ptr */
-        uint32_t                 data_allocated; /**< indicate whether data_ptr
+        uint32_t                 size; /** total size in bytes of data_ptr */
+        uint32_t                 data_allocated; /** indicate whether data_ptr
                                                     was allocated or not. */
 };
 
-/** @brief Copy and translate 3A statistics from an ISP buffer to a host buffer
+/* @brief Copy and translate 3A statistics from an ISP buffer to a host buffer
  * @param[out]  host_stats Host buffer.
  * @param[in]   isp_stats ISP buffer.
  * @return      error value if temporary memory cannot be allocated
@@ -109,7 +109,7 @@ enum ia_css_err
 ia_css_get_3a_statistics(struct ia_css_3a_statistics           *host_stats,
                          const struct ia_css_isp_3a_statistics *isp_stats);
 
-/** @brief Translate 3A statistics from ISP format to host format.
+/* @brief Translate 3A statistics from ISP format to host format.
  * @param[out]  host_stats host-format statistics
  * @param[in]   isp_stats  ISP-format statistics
  * @return      None
@@ -125,35 +125,35 @@ ia_css_translate_3a_statistics(
 
 /* Convenience functions for alloc/free of certain datatypes */
 
-/** @brief Allocate memory for the 3a statistics on the ISP
+/* @brief Allocate memory for the 3a statistics on the ISP
  * @param[in]   grid The grid.
  * @return              Pointer to the allocated 3a statistics buffer on the ISP
 */
 struct ia_css_isp_3a_statistics *
 ia_css_isp_3a_statistics_allocate(const struct ia_css_3a_grid_info *grid);
 
-/** @brief Free the 3a statistics memory on the isp
+/* @brief Free the 3a statistics memory on the isp
  * @param[in]   me Pointer to the 3a statistics buffer on the ISP.
  * @return              None
 */
 void
 ia_css_isp_3a_statistics_free(struct ia_css_isp_3a_statistics *me);
 
-/** @brief Allocate memory for the 3a statistics on the host
+/* @brief Allocate memory for the 3a statistics on the host
  * @param[in]   grid The grid.
  * @return              Pointer to the allocated 3a statistics buffer on the host
 */
 struct ia_css_3a_statistics *
 ia_css_3a_statistics_allocate(const struct ia_css_3a_grid_info *grid);
 
-/** @brief Free the 3a statistics memory on the host
+/* @brief Free the 3a statistics memory on the host
  * @param[in]   me Pointer to the 3a statistics buffer on the host.
  * @return              None
  */
 void
 ia_css_3a_statistics_free(struct ia_css_3a_statistics *me);
 
-/** @brief Allocate a 3a statistics map structure
+/* @brief Allocate a 3a statistics map structure
  * @param[in]   isp_stats pointer to ISP 3a statistis struct
  * @param[in]   data_ptr  host-side pointer to ISP 3a statistics.
  * @return              Pointer to the allocated 3a statistics map
@@ -174,7 +174,7 @@ ia_css_isp_3a_statistics_map_allocate(
         const struct ia_css_isp_3a_statistics *isp_stats,
         void *data_ptr);
 
-/** @brief Free the 3a statistics map
+/* @brief Free the 3a statistics map
  * @param[in]   me Pointer to the 3a statistics map
  * @return              None
  *
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_acc_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_acc_types.h
index a2a1873aca83..138bc3bb4627 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_acc_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_acc_types.h
@@ -15,7 +15,7 @@
 #ifndef _IA_CSS_ACC_TYPES_H
 #define _IA_CSS_ACC_TYPES_H
 
-/** @file
+/* @file
  * This file contains types used for acceleration
  */
 
@@ -40,16 +40,16 @@
  * in the kernel and HAL.
 */
 
-/** Type of acceleration.
+/* Type of acceleration.
  */
 enum ia_css_acc_type {
-        IA_CSS_ACC_NONE,        /**< Normal binary */
-        IA_CSS_ACC_OUTPUT,      /**< Accelerator stage on output frame */
-        IA_CSS_ACC_VIEWFINDER,  /**< Accelerator stage on viewfinder frame */
-        IA_CSS_ACC_STANDALONE,  /**< Stand-alone acceleration */
+        IA_CSS_ACC_NONE,        /** Normal binary */
+        IA_CSS_ACC_OUTPUT,      /** Accelerator stage on output frame */
+        IA_CSS_ACC_VIEWFINDER,  /** Accelerator stage on viewfinder frame */
+        IA_CSS_ACC_STANDALONE,  /** Stand-alone acceleration */
 };
 
-/** Cells types
+/* Cells types
  */
 enum ia_css_cell_type {
         IA_CSS_SP0 = 0,
@@ -58,45 +58,45 @@ enum ia_css_cell_type {
         MAX_NUM_OF_CELLS
 };
 
-/** Firmware types.
+/* Firmware types.
  */
 enum ia_css_fw_type {
-        ia_css_sp_firmware,             /**< Firmware for the SP */
-        ia_css_isp_firmware,    /**< Firmware for the ISP */
-        ia_css_bootloader_firmware, /**< Firmware for the BootLoader */
-        ia_css_acc_firmware             /**< Firmware for accelrations */
+        ia_css_sp_firmware,             /** Firmware for the SP */
+        ia_css_isp_firmware,    /** Firmware for the ISP */
+        ia_css_bootloader_firmware, /** Firmware for the BootLoader */
+        ia_css_acc_firmware             /** Firmware for accelrations */
 };
 
 struct ia_css_blob_descr;
 
-/** Blob descriptor.
+/* Blob descriptor.
  * This structure describes an SP or ISP blob.
  * It describes the test, data and bss sections as well as position in a
  * firmware file.
  * For convenience, it contains dynamic data after loading.
  */
 struct ia_css_blob_info {
-        /**< Static blob data */
-        uint32_t offset;                /**< Blob offset in fw file */
-        struct ia_css_isp_param_memory_offsets memory_offsets;  /**< offset wrt hdr in bytes */
-        uint32_t prog_name_offset;  /**< offset wrt hdr in bytes */
-        uint32_t size;                  /**< Size of blob */
-        uint32_t padding_size;  /**< total cummulative of bytes added due to section alignment */
-        uint32_t icache_source; /**< Position of icache in blob */
-        uint32_t icache_size;   /**< Size of icache section */
-        uint32_t icache_padding;/**< bytes added due to icache section alignment */
-        uint32_t text_source;   /**< Position of text in blob */
-        uint32_t text_size;             /**< Size of text section */
-        uint32_t text_padding;  /**< bytes added due to text section alignment */
-        uint32_t data_source;   /**< Position of data in blob */
-        uint32_t data_target;   /**< Start of data in SP dmem */
-        uint32_t data_size;             /**< Size of text section */
-        uint32_t data_padding;  /**< bytes added due to data section alignment */
-        uint32_t bss_target;    /**< Start position of bss in SP dmem */
-        uint32_t bss_size;              /**< Size of bss section */
-        /**< Dynamic data filled by loader */
-        CSS_ALIGN(const void  *code, 8);                /**< Code section absolute pointer within fw, code = icache + text */
-        CSS_ALIGN(const void  *data, 8);                /**< Data section absolute pointer within fw, data = data + bss */
+        /** Static blob data */
+        uint32_t offset;                /** Blob offset in fw file */
+        struct ia_css_isp_param_memory_offsets memory_offsets;  /** offset wrt hdr in bytes */
+        uint32_t prog_name_offset;  /** offset wrt hdr in bytes */
+        uint32_t size;                  /** Size of blob */
+        uint32_t padding_size;  /** total cummulative of bytes added due to section alignment */
+        uint32_t icache_source; /** Position of icache in blob */
+        uint32_t icache_size;   /** Size of icache section */
+        uint32_t icache_padding;/** bytes added due to icache section alignment */
+        uint32_t text_source;   /** Position of text in blob */
+        uint32_t text_size;             /** Size of text section */
+        uint32_t text_padding;  /** bytes added due to text section alignment */
+        uint32_t data_source;   /** Position of data in blob */
+        uint32_t data_target;   /** Start of data in SP dmem */
+        uint32_t data_size;             /** Size of text section */
+        uint32_t data_padding;  /** bytes added due to data section alignment */
+        uint32_t bss_target;    /** Start position of bss in SP dmem */
+        uint32_t bss_size;              /** Size of bss section */
+        /** Dynamic data filled by loader */
+        CSS_ALIGN(const void  *code, 8);                /** Code section absolute pointer within fw, code = icache + text */
+        CSS_ALIGN(const void  *data, 8);                /** Data section absolute pointer within fw, data = data + bss */
 };
 
 struct ia_css_binary_input_info {
@@ -140,9 +140,9 @@ struct ia_css_binary_s3a_info {
         uint32_t                fixed_s3a_deci_log;
 };
 
-/** DPC related binary info */
+/* DPC related binary info */
 struct ia_css_binary_dpc_info {
-        uint32_t                bnr_lite; /**< bnr lite enable flag */
+        uint32_t                bnr_lite; /** bnr lite enable flag */
 };
 
 struct ia_css_binary_iterator_info {
@@ -193,7 +193,7 @@ struct ia_css_binary_block_info {
         uint32_t        output_block_height;
 };
 
-/** Structure describing an ISP binary.
+/* Structure describing an ISP binary.
  * It describes the capabilities of a binary, like the maximum resolution,
  * support features, dma channels, uds features, etc.
  * This part is to be used by the SP.
@@ -210,7 +210,7 @@ struct ia_css_binary_info {
         struct ia_css_binary_dvs_info           dvs;
         struct ia_css_binary_vf_dec_info        vf_dec;
         struct ia_css_binary_s3a_info           s3a;
-        struct ia_css_binary_dpc_info           dpc_bnr; /**< DPC related binary info */
+        struct ia_css_binary_dpc_info           dpc_bnr; /** DPC related binary info */
         struct ia_css_binary_iterator_info      iterator;
         struct ia_css_binary_address_info       addresses;
         struct ia_css_binary_uds_info           uds;
@@ -269,7 +269,7 @@ struct ia_css_binary_info {
         } dma;
 };
 
-/** Structure describing an ISP binary.
+/* Structure describing an ISP binary.
  * It describes the capabilities of a binary, like the maximum resolution,
  * support features, dma channels, uds features, etc.
  */
@@ -281,8 +281,8 @@ struct ia_css_binary_xinfo {
         enum ia_css_acc_type         type;
         CSS_ALIGN(int32_t            num_output_formats, 8);
         enum ia_css_frame_format     output_formats[IA_CSS_FRAME_FORMAT_NUM];
-        CSS_ALIGN(int32_t            num_vf_formats, 8); /**< number of supported vf formats */
-        enum ia_css_frame_format     vf_formats[IA_CSS_FRAME_FORMAT_NUM]; /**< types of supported vf formats */
+        CSS_ALIGN(int32_t            num_vf_formats, 8); /** number of supported vf formats */
+        enum ia_css_frame_format     vf_formats[IA_CSS_FRAME_FORMAT_NUM]; /** types of supported vf formats */
         uint8_t                      num_output_pins;
         ia_css_ptr                   xmem_addr;
         CSS_ALIGN(const struct ia_css_blob_descr *blob, 8);
@@ -291,55 +291,55 @@ struct ia_css_binary_xinfo {
         CSS_ALIGN(struct ia_css_binary_xinfo *next, 8);
 };
 
-/** Structure describing the Bootloader (an ISP binary).
+/* Structure describing the Bootloader (an ISP binary).
  * It contains several address, either in ddr, isp_dmem or
  * the entry function in icache.
  */
 struct ia_css_bl_info {
-        uint32_t num_dma_cmds;  /**< Number of cmds sent by CSS */
-        uint32_t dma_cmd_list;  /**< Dma command list sent by CSS */
-        uint32_t sw_state;      /**< Polled from css */
+        uint32_t num_dma_cmds;  /** Number of cmds sent by CSS */
+        uint32_t dma_cmd_list;  /** Dma command list sent by CSS */
+        uint32_t sw_state;      /** Polled from css */
         /* Entry functions */
-        uint32_t bl_entry;      /**< The SP entry function */
+        uint32_t bl_entry;      /** The SP entry function */
 };
 
-/** Structure describing the SP binary.
+/* Structure describing the SP binary.
  * It contains several address, either in ddr, sp_dmem or
  * the entry function in pmem.
  */
 struct ia_css_sp_info {
-        uint32_t init_dmem_data; /**< data sect config, stored to dmem */
-        uint32_t per_frame_data; /**< Per frame data, stored to dmem */
-        uint32_t group;         /**< Per pipeline data, loaded by dma */
-        uint32_t output;                /**< SP output data, loaded by dmem */
-        uint32_t host_sp_queue; /**< Host <-> SP queues */
-        uint32_t host_sp_com;/**< Host <-> SP commands */
-        uint32_t isp_started;   /**< Polled from sensor thread, csim only */
-        uint32_t sw_state;      /**< Polled from css */
-        uint32_t host_sp_queues_initialized; /**< Polled from the SP */
-        uint32_t sleep_mode;  /**< different mode to halt SP */
-        uint32_t invalidate_tlb;                /**< inform SP to invalidate mmu TLB */
+        uint32_t init_dmem_data; /** data sect config, stored to dmem */
+        uint32_t per_frame_data; /** Per frame data, stored to dmem */
+        uint32_t group;         /** Per pipeline data, loaded by dma */
+        uint32_t output;                /** SP output data, loaded by dmem */
+        uint32_t host_sp_queue; /** Host <-> SP queues */
+        uint32_t host_sp_com;/** Host <-> SP commands */
+        uint32_t isp_started;   /** Polled from sensor thread, csim only */
+        uint32_t sw_state;      /** Polled from css */
+        uint32_t host_sp_queues_initialized; /** Polled from the SP */
+        uint32_t sleep_mode;  /** different mode to halt SP */
+        uint32_t invalidate_tlb;                /** inform SP to invalidate mmu TLB */
 #ifndef ISP2401
-        uint32_t stop_copy_preview;       /**< suspend copy and preview pipe when capture */
+        uint32_t stop_copy_preview;       /** suspend copy and preview pipe when capture */
 #endif
-        uint32_t debug_buffer_ddr_address;      /**< inform SP the address
+        uint32_t debug_buffer_ddr_address;      /** inform SP the address
         of DDR debug queue */
-        uint32_t perf_counter_input_system_error; /**< input system perf
+        uint32_t perf_counter_input_system_error; /** input system perf
         counter array */
 #ifdef HAS_WATCHDOG_SP_THREAD_DEBUG
-        uint32_t debug_wait; /**< thread/pipe post mortem debug */
-        uint32_t debug_stage; /**< thread/pipe post mortem debug */
-        uint32_t debug_stripe; /**< thread/pipe post mortem debug */
+        uint32_t debug_wait; /** thread/pipe post mortem debug */
+        uint32_t debug_stage; /** thread/pipe post mortem debug */
+        uint32_t debug_stripe; /** thread/pipe post mortem debug */
 #endif
-        uint32_t threads_stack; /**< sp thread's stack pointers */
-        uint32_t threads_stack_size; /**< sp thread's stack sizes */
-        uint32_t curr_binary_id;        /**< current binary id */
-        uint32_t raw_copy_line_count;   /**< raw copy line counter */
-        uint32_t ddr_parameter_address; /**< acc param ddrptr, sp dmem */
-        uint32_t ddr_parameter_size;    /**< acc param size, sp dmem */
+        uint32_t threads_stack; /** sp thread's stack pointers */
+        uint32_t threads_stack_size; /** sp thread's stack sizes */
+        uint32_t curr_binary_id;        /** current binary id */
+        uint32_t raw_copy_line_count;   /** raw copy line counter */
+        uint32_t ddr_parameter_address; /** acc param ddrptr, sp dmem */
+        uint32_t ddr_parameter_size;    /** acc param size, sp dmem */
         /* Entry functions */
-        uint32_t sp_entry;      /**< The SP entry function */
-        uint32_t tagger_frames_addr;   /**< Base address of tagger state */
+        uint32_t sp_entry;      /** The SP entry function */
+        uint32_t tagger_frames_addr;   /** Base address of tagger state */
 };
 
 /* The following #if is there because this header file is also included
@@ -348,37 +348,37 @@ struct ia_css_sp_info {
    More permanent solution will be to refactor this include.
 */
 #if !defined(__ISP)
-/** Accelerator firmware information.
+/* Accelerator firmware information.
  */
 struct ia_css_acc_info {
-        uint32_t per_frame_data; /**< Dummy for now */
+        uint32_t per_frame_data; /** Dummy for now */
 };
 
-/** Firmware information.
+/* Firmware information.
  */
 union ia_css_fw_union {
-        struct ia_css_binary_xinfo      isp; /**< ISP info */
-        struct ia_css_sp_info           sp;  /**< SP info */
-        struct ia_css_bl_info           bl;  /**< Bootloader info */
-        struct ia_css_acc_info          acc; /**< Accelerator info */
+        struct ia_css_binary_xinfo      isp; /** ISP info */
+        struct ia_css_sp_info           sp;  /** SP info */
+        struct ia_css_bl_info           bl;  /** Bootloader info */
+        struct ia_css_acc_info          acc; /** Accelerator info */
 };
 
-/** Firmware information.
+/* Firmware information.
  */
 struct ia_css_fw_info {
-        size_t                   header_size; /**< size of fw header */
+        size_t                   header_size; /** size of fw header */
         CSS_ALIGN(uint32_t type, 8);
-        union ia_css_fw_union    info; /**< Binary info */
-        struct ia_css_blob_info  blob; /**< Blob info */
+        union ia_css_fw_union    info; /** Binary info */
+        struct ia_css_blob_info  blob; /** Blob info */
         /* Dynamic part */
         struct ia_css_fw_info   *next;
-        CSS_ALIGN(uint32_t       loaded, 8);    /**< Firmware has been loaded */
-        CSS_ALIGN(const uint8_t *isp_code, 8);  /**< ISP pointer to code */
-        /**< Firmware handle between user space and kernel */
+        CSS_ALIGN(uint32_t       loaded, 8);    /** Firmware has been loaded */
+        CSS_ALIGN(const uint8_t *isp_code, 8);  /** ISP pointer to code */
+        /** Firmware handle between user space and kernel */
         CSS_ALIGN(uint32_t      handle, 8);
-        /**< Sections to copy from/to ISP */
+        /** Sections to copy from/to ISP */
         struct ia_css_isp_param_css_segments mem_initializers;
-        /**< Initializer for local ISP memories */
+        /** Initializer for local ISP memories */
 };
 
 struct ia_css_blob_descr {
@@ -390,39 +390,39 @@ struct ia_css_blob_descr {
 
 struct ia_css_acc_fw;
 
-/** Structure describing the SP binary of a stand-alone accelerator.
+/* Structure describing the SP binary of a stand-alone accelerator.
  */
 struct ia_css_acc_sp {
-        void (*init)(struct ia_css_acc_fw *);   /**< init for crun */
-        uint32_t sp_prog_name_offset;           /**< program name offset wrt hdr in bytes */
-        uint32_t sp_blob_offset;                /**< blob offset wrt hdr in bytes */
-        void     *entry;                        /**< Address of sp entry point */
-        uint32_t *css_abort;                    /**< SP dmem abort flag */
-        void     *isp_code;                     /**< SP dmem address holding xmem
+        void (*init)(struct ia_css_acc_fw *);   /** init for crun */
+        uint32_t sp_prog_name_offset;           /** program name offset wrt hdr in bytes */
+        uint32_t sp_blob_offset;                /** blob offset wrt hdr in bytes */
+        void     *entry;                        /** Address of sp entry point */
+        uint32_t *css_abort;                    /** SP dmem abort flag */
+        void     *isp_code;                     /** SP dmem address holding xmem
                                                      address of isp code */
-        struct ia_css_fw_info fw;               /**< SP fw descriptor */
-        const uint8_t *code;                    /**< ISP pointer of allocated SP code */
+        struct ia_css_fw_info fw;               /** SP fw descriptor */
+        const uint8_t *code;                    /** ISP pointer of allocated SP code */
 };
 
-/** Acceleration firmware descriptor.
+/* Acceleration firmware descriptor.
   * This descriptor descibes either SP code (stand-alone), or
   * ISP code (a separate pipeline stage).
   */
 struct ia_css_acc_fw_hdr {
-        enum ia_css_acc_type type;      /**< Type of accelerator */
-        uint32_t        isp_prog_name_offset; /**< program name offset wrt
+        enum ia_css_acc_type type;      /** Type of accelerator */
+        uint32_t        isp_prog_name_offset; /** program name offset wrt
                                                    header in bytes */
-        uint32_t        isp_blob_offset;      /**< blob offset wrt header
+        uint32_t        isp_blob_offset;      /** blob offset wrt header
                                                    in bytes */
-        uint32_t        isp_size;             /**< Size of isp blob */
-        const uint8_t  *isp_code;             /**< ISP pointer to code */
-        struct ia_css_acc_sp  sp;  /**< Standalone sp code */
-        /**< Firmware handle between user space and kernel */
+        uint32_t        isp_size;             /** Size of isp blob */
+        const uint8_t  *isp_code;             /** ISP pointer to code */
+        struct ia_css_acc_sp  sp;  /** Standalone sp code */
+        /** Firmware handle between user space and kernel */
         uint32_t        handle;
-        struct ia_css_data parameters; /**< Current SP parameters */
+        struct ia_css_data parameters; /** Current SP parameters */
 };
 
-/** Firmware structure.
+/* Firmware structure.
   * This contains the header and actual blobs.
   * For standalone, it contains SP and ISP blob.
   * For a pipeline stage accelerator, it contains ISP code only.
@@ -430,7 +430,7 @@ struct ia_css_acc_fw_hdr {
   * header and computed using the access macros below.
   */
 struct ia_css_acc_fw {
-        struct ia_css_acc_fw_hdr header; /**< firmware header */
+        struct ia_css_acc_fw_hdr header; /** firmware header */
         /*
         int8_t   isp_progname[];          **< ISP program name
         int8_t   sp_progname[];   **< SP program name, stand-alone only
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_buffer.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_buffer.h
index b2ecf3618c15..a0058eac7d5a 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_buffer.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_buffer.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_BUFFER_H
 #define __IA_CSS_BUFFER_H
 
-/** @file
+/* @file
  * This file contains datastructures and types for buffers used in CSS
  */
 
@@ -23,7 +23,7 @@
 #include "ia_css_types.h"
 #include "ia_css_timer.h"
 
-/** Enumeration of buffer types. Buffers can be queued and de-queued
+/* Enumeration of buffer types. Buffers can be queued and de-queued
  *  to hand them over between IA and ISP.
  */
 enum ia_css_buffer_type {
@@ -48,28 +48,28 @@ enum ia_css_buffer_type {
 
 /* Driver API is not SP/ISP visible, 64 bit types not supported on hivecc */
 #if !defined(__ISP)
-/** Buffer structure. This is a container structure that enables content
+/* Buffer structure. This is a container structure that enables content
  *  independent buffer queues and access functions.
  */
 struct ia_css_buffer {
-        enum ia_css_buffer_type type; /**< Buffer type. */
+        enum ia_css_buffer_type type; /** Buffer type. */
         unsigned int exp_id;
-        /**< exposure id for this buffer; 0 = not available
+        /** exposure id for this buffer; 0 = not available
              see ia_css_event_public.h for more detail. */
         union {
-                struct ia_css_isp_3a_statistics  *stats_3a;    /**< 3A statistics & optionally RGBY statistics. */
-                struct ia_css_isp_dvs_statistics *stats_dvs;   /**< DVS statistics. */
-                struct ia_css_isp_skc_dvs_statistics *stats_skc_dvs;  /**< SKC DVS statistics. */
-                struct ia_css_frame              *frame;       /**< Frame buffer. */
-                struct ia_css_acc_param          *custom_data; /**< Custom buffer. */
-                struct ia_css_metadata           *metadata;    /**< Sensor metadata. */
-        } data; /**< Buffer data pointer. */
-        uint64_t driver_cookie; /**< cookie for the driver */
-        struct ia_css_time_meas timing_data; /**< timing data (readings from the timer) */
-        struct ia_css_clock_tick isys_eof_clock_tick; /**< ISYS's end of frame timer tick*/
+                struct ia_css_isp_3a_statistics  *stats_3a;    /** 3A statistics & optionally RGBY statistics. */
+                struct ia_css_isp_dvs_statistics *stats_dvs;   /** DVS statistics. */
+                struct ia_css_isp_skc_dvs_statistics *stats_skc_dvs;  /** SKC DVS statistics. */
+                struct ia_css_frame              *frame;       /** Frame buffer. */
+                struct ia_css_acc_param          *custom_data; /** Custom buffer. */
+                struct ia_css_metadata           *metadata;    /** Sensor metadata. */
+        } data; /** Buffer data pointer. */
+        uint64_t driver_cookie; /** cookie for the driver */
+        struct ia_css_time_meas timing_data; /** timing data (readings from the timer) */
+        struct ia_css_clock_tick isys_eof_clock_tick; /** ISYS's end of frame timer tick*/
 };
 
-/** @brief Dequeue param buffers from sp2host_queue
+/* @brief Dequeue param buffers from sp2host_queue
  *
  * @return                                       None
  *
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_control.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_control.h
index a15d3e368341..021a313fab85 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_control.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_control.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_CONTROL_H
 #define __IA_CSS_CONTROL_H
 
-/** @file
+/* @file
  * This file contains functionality for starting and controlling CSS
  */
 
@@ -24,7 +24,7 @@
 #include <ia_css_firmware.h>
 #include <ia_css_irq.h>
 
-/** @brief Initialize the CSS API.
+/* @brief Initialize the CSS API.
  * @param[in]   env             Environment, provides functions to access the
  *                              environment in which the CSS code runs. This is
  *                              used for host side memory access and message
@@ -51,7 +51,7 @@ enum ia_css_err ia_css_init(
         uint32_t                 l1_base,
         enum ia_css_irq_type     irq_type);
 
-/** @brief Un-initialize the CSS API.
+/* @brief Un-initialize the CSS API.
  * @return      None
  *
  * This function deallocates all memory that has been allocated by the CSS API
@@ -66,7 +66,7 @@ enum ia_css_err ia_css_init(
 void
 ia_css_uninit(void);
 
-/** @brief Suspend CSS API for power down
+/* @brief Suspend CSS API for power down
  * @return      success or faulure code
  *
  * suspend shuts down the system by:
@@ -80,7 +80,7 @@ ia_css_uninit(void);
 enum ia_css_err
 ia_css_suspend(void);
 
-/** @brief Resume CSS API from power down
+/* @brief Resume CSS API from power down
  * @return      success or failure code
  *
  * After a power cycle, this function will bring the CSS API back into
@@ -91,7 +91,7 @@ ia_css_suspend(void);
 enum ia_css_err
 ia_css_resume(void);
 
-/** @brief Enable use of a separate queue for ISYS events.
+/* @brief Enable use of a separate queue for ISYS events.
  *
  * @param[in]   enable: enable or disable use of separate ISYS event queues.
  * @return              error if called when SP is running.
@@ -105,7 +105,7 @@ ia_css_resume(void);
 enum ia_css_err
 ia_css_enable_isys_event_queue(bool enable);
 
-/** @brief Test whether the ISP has started.
+/* @brief Test whether the ISP has started.
  *
  * @return      Boolean flag true if the ISP has started or false otherwise.
  *
@@ -114,7 +114,7 @@ ia_css_enable_isys_event_queue(bool enable);
 bool
 ia_css_isp_has_started(void);
 
-/** @brief Test whether the SP has initialized.
+/* @brief Test whether the SP has initialized.
  *
  * @return      Boolean flag true if the SP has initialized or false otherwise.
  *
@@ -123,7 +123,7 @@ ia_css_isp_has_started(void);
 bool
 ia_css_sp_has_initialized(void);
 
-/** @brief Test whether the SP has terminated.
+/* @brief Test whether the SP has terminated.
  *
  * @return      Boolean flag true if the SP has terminated or false otherwise.
  *
@@ -132,7 +132,7 @@ ia_css_sp_has_initialized(void);
 bool
 ia_css_sp_has_terminated(void);
 
-/** @brief start SP hardware
+/* @brief start SP hardware
  *
  * @return                      IA_CSS_SUCCESS or error code upon error.
  *
@@ -144,7 +144,7 @@ enum ia_css_err
 ia_css_start_sp(void);
 
 
-/** @brief stop SP hardware
+/* @brief stop SP hardware
  *
  * @return                      IA_CSS_SUCCESS or error code upon error.
  *
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_device_access.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_device_access.h
index 59459f7a9876..84a960b7abbc 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_device_access.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_device_access.h
@@ -15,7 +15,7 @@
 #ifndef _IA_CSS_DEVICE_ACCESS_H
 #define _IA_CSS_DEVICE_ACCESS_H
 
-/** @file
+/* @file
  * File containing internal functions for the CSS-API to access the CSS device.
  */
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_dvs.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_dvs.h
index 147bf81959d3..1f01534964e3 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_dvs.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_dvs.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_DVS_H
 #define __IA_CSS_DVS_H
 
-/** @file
+/* @file
  * This file contains types for DVS statistics
  */
 
@@ -31,7 +31,7 @@ enum dvs_statistics_type {
 };
 
 
-/** Structure that holds DVS statistics in the ISP internal
+/* Structure that holds DVS statistics in the ISP internal
  * format. Use ia_css_get_dvs_statistics() to translate
  * this to the format used on the host (DVS engine).
  * */
@@ -40,12 +40,12 @@ struct ia_css_isp_dvs_statistics {
         ia_css_ptr ver_proj;
         uint32_t   hor_size;
         uint32_t   ver_size;
-        uint32_t   exp_id;   /**< see ia_css_event_public.h for more detail */
+        uint32_t   exp_id;   /** see ia_css_event_public.h for more detail */
         ia_css_ptr data_ptr; /* base pointer containing all memory */
         uint32_t   size;     /* size of allocated memory in data_ptr */
 };
 
-/** Structure that holds SKC DVS statistics in the ISP internal
+/* Structure that holds SKC DVS statistics in the ISP internal
  * format. Use ia_css_dvs_statistics_get() to translate this to
  * the format used on the host.
  * */
@@ -82,7 +82,7 @@ union ia_css_dvs_statistics_host {
         struct ia_css_skc_dvs_statistics *p_skc_dvs_statistics_host;
 };
 
-/** @brief Copy DVS statistics from an ISP buffer to a host buffer.
+/* @brief Copy DVS statistics from an ISP buffer to a host buffer.
  * @param[in]   host_stats Host buffer
  * @param[in]   isp_stats ISP buffer
  * @return      error value if temporary memory cannot be allocated
@@ -100,7 +100,7 @@ enum ia_css_err
 ia_css_get_dvs_statistics(struct ia_css_dvs_statistics *host_stats,
                           const struct ia_css_isp_dvs_statistics *isp_stats);
 
-/** @brief Translate DVS statistics from ISP format to host format
+/* @brief Translate DVS statistics from ISP format to host format
  * @param[in]   host_stats Host buffer
  * @param[in]   isp_stats ISP buffer
  * @return      None
@@ -116,7 +116,7 @@ ia_css_translate_dvs_statistics(
                 struct ia_css_dvs_statistics *host_stats,
                 const struct ia_css_isp_dvs_statistics_map *isp_stats);
 
-/** @brief Copy DVS 2.0 statistics from an ISP buffer to a host buffer.
+/* @brief Copy DVS 2.0 statistics from an ISP buffer to a host buffer.
  * @param[in]   host_stats Host buffer
  * @param[in]   isp_stats ISP buffer
  * @return      error value if temporary memory cannot be allocated
@@ -134,7 +134,7 @@ enum ia_css_err
 ia_css_get_dvs2_statistics(struct ia_css_dvs2_statistics *host_stats,
                            const struct ia_css_isp_dvs_statistics *isp_stats);
 
-/** @brief Translate DVS2 statistics from ISP format to host format
+/* @brief Translate DVS2 statistics from ISP format to host format
  * @param[in]   host_stats Host buffer
  * @param[in]   isp_stats ISP buffer
  * @return              None
@@ -150,7 +150,7 @@ ia_css_translate_dvs2_statistics(
                 struct ia_css_dvs2_statistics      *host_stats,
                 const struct ia_css_isp_dvs_statistics_map *isp_stats);
 
-/** @brief Copy DVS statistics from an ISP buffer to a host buffer.
+/* @brief Copy DVS statistics from an ISP buffer to a host buffer.
  * @param[in] type - DVS statistics type
  * @param[in] host_stats Host buffer
  * @param[in] isp_stats ISP buffer
@@ -161,105 +161,105 @@ ia_css_dvs_statistics_get(enum dvs_statistics_type type,
                           union ia_css_dvs_statistics_host  *host_stats,
                           const union ia_css_dvs_statistics_isp *isp_stats);
 
-/** @brief Allocate the DVS statistics memory on the ISP
+/* @brief Allocate the DVS statistics memory on the ISP
  * @param[in]   grid The grid.
  * @return      Pointer to the allocated DVS statistics buffer on the ISP
 */
 struct ia_css_isp_dvs_statistics *
 ia_css_isp_dvs_statistics_allocate(const struct ia_css_dvs_grid_info *grid);
 
-/** @brief Free the DVS statistics memory on the ISP
+/* @brief Free the DVS statistics memory on the ISP
  * @param[in]   me Pointer to the DVS statistics buffer on the ISP.
  * @return      None
 */
 void
 ia_css_isp_dvs_statistics_free(struct ia_css_isp_dvs_statistics *me);
 
-/** @brief Allocate the DVS 2.0 statistics memory
+/* @brief Allocate the DVS 2.0 statistics memory
  * @param[in]   grid The grid.
  * @return      Pointer to the allocated DVS statistics buffer on the ISP
 */
 struct ia_css_isp_dvs_statistics *
 ia_css_isp_dvs2_statistics_allocate(const struct ia_css_dvs_grid_info *grid);
 
-/** @brief Free the DVS 2.0 statistics memory
+/* @brief Free the DVS 2.0 statistics memory
  * @param[in]   me Pointer to the DVS statistics buffer on the ISP.
  * @return      None
 */
 void
 ia_css_isp_dvs2_statistics_free(struct ia_css_isp_dvs_statistics *me);
 
-/** @brief Allocate the DVS statistics memory on the host
+/* @brief Allocate the DVS statistics memory on the host
  * @param[in]   grid The grid.
  * @return      Pointer to the allocated DVS statistics buffer on the host
 */
 struct ia_css_dvs_statistics *
 ia_css_dvs_statistics_allocate(const struct ia_css_dvs_grid_info *grid);
 
-/** @brief Free the DVS statistics memory on the host
+/* @brief Free the DVS statistics memory on the host
  * @param[in]   me Pointer to the DVS statistics buffer on the host.
  * @return      None
 */
 void
 ia_css_dvs_statistics_free(struct ia_css_dvs_statistics *me);
 
-/** @brief Allocate the DVS coefficients memory
+/* @brief Allocate the DVS coefficients memory
  * @param[in]   grid The grid.
  * @return      Pointer to the allocated DVS coefficients buffer
 */
 struct ia_css_dvs_coefficients *
 ia_css_dvs_coefficients_allocate(const struct ia_css_dvs_grid_info *grid);
 
-/** @brief Free the DVS coefficients memory
+/* @brief Free the DVS coefficients memory
  * @param[in]   me Pointer to the DVS coefficients buffer.
  * @return      None
  */
 void
 ia_css_dvs_coefficients_free(struct ia_css_dvs_coefficients *me);
 
-/** @brief Allocate the DVS 2.0 statistics memory on the host
+/* @brief Allocate the DVS 2.0 statistics memory on the host
  * @param[in]   grid The grid.
  * @return      Pointer to the allocated DVS 2.0 statistics buffer on the host
  */
 struct ia_css_dvs2_statistics *
 ia_css_dvs2_statistics_allocate(const struct ia_css_dvs_grid_info *grid);
 
-/** @brief Free the DVS 2.0 statistics memory
+/* @brief Free the DVS 2.0 statistics memory
  * @param[in]   me Pointer to the DVS 2.0 statistics buffer on the host.
  * @return      None
 */
 void
 ia_css_dvs2_statistics_free(struct ia_css_dvs2_statistics *me);
 
-/** @brief Allocate the DVS 2.0 coefficients memory
+/* @brief Allocate the DVS 2.0 coefficients memory
  * @param[in]   grid The grid.
  * @return      Pointer to the allocated DVS 2.0 coefficients buffer
 */
 struct ia_css_dvs2_coefficients *
 ia_css_dvs2_coefficients_allocate(const struct ia_css_dvs_grid_info *grid);
 
-/** @brief Free the DVS 2.0 coefficients memory
+/* @brief Free the DVS 2.0 coefficients memory
  * @param[in]   me Pointer to the DVS 2.0 coefficients buffer.
  * @return      None
 */
 void
 ia_css_dvs2_coefficients_free(struct ia_css_dvs2_coefficients *me);
 
-/** @brief Allocate the DVS 2.0 6-axis config memory
+/* @brief Allocate the DVS 2.0 6-axis config memory
  * @param[in]   stream The stream.
  * @return      Pointer to the allocated DVS 6axis configuration buffer
 */
 struct ia_css_dvs_6axis_config *
 ia_css_dvs2_6axis_config_allocate(const struct ia_css_stream *stream);
 
-/** @brief Free the DVS 2.0 6-axis config memory
+/* @brief Free the DVS 2.0 6-axis config memory
  * @param[in]   dvs_6axis_config Pointer to the DVS 6axis configuration buffer
  * @return      None
  */
 void
 ia_css_dvs2_6axis_config_free(struct ia_css_dvs_6axis_config *dvs_6axis_config);
 
-/** @brief Allocate a dvs statistics map structure
+/* @brief Allocate a dvs statistics map structure
  * @param[in]   isp_stats pointer to ISP dvs statistis struct
  * @param[in]   data_ptr  host-side pointer to ISP dvs statistics.
  * @return      Pointer to the allocated dvs statistics map
@@ -280,7 +280,7 @@ ia_css_isp_dvs_statistics_map_allocate(
         const struct ia_css_isp_dvs_statistics *isp_stats,
         void *data_ptr);
 
-/** @brief Free the dvs statistics map
+/* @brief Free the dvs statistics map
  * @param[in]   me Pointer to the dvs statistics map
  * @return      None
  *
@@ -291,7 +291,7 @@ ia_css_isp_dvs_statistics_map_allocate(
 void
 ia_css_isp_dvs_statistics_map_free(struct ia_css_isp_dvs_statistics_map *me);
 
-/** @brief Allocate memory for the SKC DVS statistics on the ISP
+/* @brief Allocate memory for the SKC DVS statistics on the ISP
  * @return              Pointer to the allocated ACC DVS statistics buffer on the ISP
 */
 struct ia_css_isp_skc_dvs_statistics *ia_css_skc_dvs_statistics_allocate(void);
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_env.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_env.h
index 1ae9daf0be76..8b0218ee658d 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_env.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_env.h
@@ -20,12 +20,12 @@
 #include "ia_css_types.h"
 #include "ia_css_acc_types.h"
 
-/** @file
+/* @file
  * This file contains prototypes for functions that need to be provided to the
  * CSS-API host-code by the environment in which the CSS-API code runs.
  */
 
-/** Memory allocation attributes, for use in ia_css_css_mem_env. */
+/* Memory allocation attributes, for use in ia_css_css_mem_env. */
 enum ia_css_mem_attr {
         IA_CSS_MEM_ATTR_CACHED = 1 << 0,
         IA_CSS_MEM_ATTR_ZEROED = 1 << 1,
@@ -33,62 +33,62 @@ enum ia_css_mem_attr {
         IA_CSS_MEM_ATTR_CONTIGUOUS = 1 << 3,
 };
 
-/** Environment with function pointers for local IA memory allocation.
+/* Environment with function pointers for local IA memory allocation.
  *  This provides the CSS code with environment specific functionality
  *  for memory allocation of small local buffers such as local data structures.
  *  This is never expected to allocate more than one page of memory (4K bytes).
  */
 struct ia_css_cpu_mem_env {
         void (*flush)(struct ia_css_acc_fw *fw);
-        /**< Flush function to flush the cache for given accelerator. */
+        /** Flush function to flush the cache for given accelerator. */
 };
 
-/** Environment with function pointers to access the CSS hardware. This includes
+/* Environment with function pointers to access the CSS hardware. This includes
  *  registers and local memories.
  */
 struct ia_css_hw_access_env {
         void (*store_8)(hrt_address addr, uint8_t data);
-        /**< Store an 8 bit value into an address in the CSS HW address space.
+        /** Store an 8 bit value into an address in the CSS HW address space.
              The address must be an 8 bit aligned address. */
         void (*store_16)(hrt_address addr, uint16_t data);
-        /**< Store a 16 bit value into an address in the CSS HW address space.
+        /** Store a 16 bit value into an address in the CSS HW address space.
              The address must be a 16 bit aligned address. */
         void (*store_32)(hrt_address addr, uint32_t data);
-        /**< Store a 32 bit value into an address in the CSS HW address space.
+        /** Store a 32 bit value into an address in the CSS HW address space.
              The address must be a 32 bit aligned address. */
         uint8_t (*load_8)(hrt_address addr);
-        /**< Load an 8 bit value from an address in the CSS HW address
+        /** Load an 8 bit value from an address in the CSS HW address
              space. The address must be an 8 bit aligned address. */
         uint16_t (*load_16)(hrt_address addr);
-        /**< Load a 16 bit value from an address in the CSS HW address
+        /** Load a 16 bit value from an address in the CSS HW address
              space. The address must be a 16 bit aligned address. */
         uint32_t (*load_32)(hrt_address addr);
-        /**< Load a 32 bit value from an address in the CSS HW address
+        /** Load a 32 bit value from an address in the CSS HW address
              space. The address must be a 32 bit aligned address. */
         void (*store)(hrt_address addr, const void *data, uint32_t bytes);
-        /**< Store a number of bytes into a byte-aligned address in the CSS HW address space. */
+        /** Store a number of bytes into a byte-aligned address in the CSS HW address space. */
         void (*load)(hrt_address addr, void *data, uint32_t bytes);
-        /**< Load a number of bytes from a byte-aligned address in the CSS HW address space. */
+        /** Load a number of bytes from a byte-aligned address in the CSS HW address space. */
 };
 
-/** Environment with function pointers to print error and debug messages.
+/* Environment with function pointers to print error and debug messages.
  */
 struct ia_css_print_env {
         int (*debug_print)(const char *fmt, va_list args);
-        /**< Print a debug message. */
+        /** Print a debug message. */
         int (*error_print)(const char *fmt, va_list args);
-        /**< Print an error message.*/
+        /** Print an error message.*/
 };
 
-/** Environment structure. This includes function pointers to access several
+/* Environment structure. This includes function pointers to access several
  *  features provided by the environment in which the CSS API is used.
  *  This is used to run the camera IP in multiple platforms such as Linux,
  *  Windows and several simulation environments.
  */
 struct ia_css_env {
-        struct ia_css_cpu_mem_env   cpu_mem_env;   /**< local flush. */
-        struct ia_css_hw_access_env hw_access_env; /**< CSS HW access functions */
-        struct ia_css_print_env     print_env;     /**< Message printing env. */
+        struct ia_css_cpu_mem_env   cpu_mem_env;   /** local flush. */
+        struct ia_css_hw_access_env hw_access_env; /** CSS HW access functions */
+        struct ia_css_print_env     print_env;     /** Message printing env. */
 };
 
 #endif /* __IA_CSS_ENV_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_err.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_err.h
index 572e4e55c69e..cf895815ea31 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_err.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_err.h
@@ -15,12 +15,12 @@
 #ifndef __IA_CSS_ERR_H
 #define __IA_CSS_ERR_H
 
-/** @file
+/* @file
  * This file contains possible return values for most
  * functions in the CSS-API.
  */
 
-/** Errors, these values are used as the return value for most
+/* Errors, these values are used as the return value for most
  *  functions in this API.
  */
 enum ia_css_err {
@@ -41,22 +41,22 @@ enum ia_css_err {
         IA_CSS_ERR_NOT_SUPPORTED
 };
 
-/** FW warnings. This enum contains a value for each warning that
+/* FW warnings. This enum contains a value for each warning that
  * the SP FW could indicate potential performance issue
  */
 enum ia_css_fw_warning {
         IA_CSS_FW_WARNING_NONE,
-        IA_CSS_FW_WARNING_ISYS_QUEUE_FULL, /** < CSS system delayed because of insufficient space in the ISys queue.
+        IA_CSS_FW_WARNING_ISYS_QUEUE_FULL, /* < CSS system delayed because of insufficient space in the ISys queue.
                 This warning can be avoided by de-queing ISYS buffers more timely. */
-        IA_CSS_FW_WARNING_PSYS_QUEUE_FULL, /** < CSS system delayed because of insufficient space in the PSys queue.
+        IA_CSS_FW_WARNING_PSYS_QUEUE_FULL, /* < CSS system delayed because of insufficient space in the PSys queue.
                 This warning can be avoided by de-queing PSYS buffers more timely. */
-        IA_CSS_FW_WARNING_CIRCBUF_ALL_LOCKED, /** < CSS system delayed because of insufficient available buffers.
+        IA_CSS_FW_WARNING_CIRCBUF_ALL_LOCKED, /* < CSS system delayed because of insufficient available buffers.
                 This warning can be avoided by unlocking locked frame-buffers more timely. */
-        IA_CSS_FW_WARNING_EXP_ID_LOCKED, /** < Exposure ID skipped because the frame associated to it was still locked.
+        IA_CSS_FW_WARNING_EXP_ID_LOCKED, /* < Exposure ID skipped because the frame associated to it was still locked.
                 This warning can be avoided by unlocking locked frame-buffers more timely. */
-        IA_CSS_FW_WARNING_TAG_EXP_ID_FAILED, /** < Exposure ID cannot be found on the circular buffer.
+        IA_CSS_FW_WARNING_TAG_EXP_ID_FAILED, /* < Exposure ID cannot be found on the circular buffer.
                 This warning can be avoided by unlocking locked frame-buffers more timely. */
-        IA_CSS_FW_WARNING_FRAME_PARAM_MISMATCH, /** < Frame and param pair mismatched in tagger.
+        IA_CSS_FW_WARNING_FRAME_PARAM_MISMATCH, /* < Frame and param pair mismatched in tagger.
                 This warning can be avoided by providing a param set for each frame. */
 };
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_event_public.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_event_public.h
index aaf349772abe..036a2f03d3bd 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_event_public.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_event_public.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_EVENT_PUBLIC_H
 #define __IA_CSS_EVENT_PUBLIC_H
 
-/** @file
+/* @file
  * This file contains CSS-API events functionality
  */
 
@@ -24,7 +24,7 @@
 #include <ia_css_types.h>       /* ia_css_pipe */
 #include <ia_css_timer.h>       /* ia_css_timer */
 
-/** The event type, distinguishes the kind of events that
+/* The event type, distinguishes the kind of events that
  * can are generated by the CSS system.
  *
  * !!!IMPORTANT!!! KEEP THE FOLLOWING IN SYNC:
@@ -35,43 +35,43 @@
  */
 enum ia_css_event_type {
         IA_CSS_EVENT_TYPE_OUTPUT_FRAME_DONE             = 1 << 0,
-        /**< Output frame ready. */
+        /** Output frame ready. */
         IA_CSS_EVENT_TYPE_SECOND_OUTPUT_FRAME_DONE      = 1 << 1,
-        /**< Second output frame ready. */
+        /** Second output frame ready. */
         IA_CSS_EVENT_TYPE_VF_OUTPUT_FRAME_DONE          = 1 << 2,
-        /**< Viewfinder Output frame ready. */
+        /** Viewfinder Output frame ready. */
         IA_CSS_EVENT_TYPE_SECOND_VF_OUTPUT_FRAME_DONE   = 1 << 3,
-        /**< Second viewfinder Output frame ready. */
+        /** Second viewfinder Output frame ready. */
         IA_CSS_EVENT_TYPE_3A_STATISTICS_DONE            = 1 << 4,
-        /**< Indication that 3A statistics are available. */
+        /** Indication that 3A statistics are available. */
         IA_CSS_EVENT_TYPE_DIS_STATISTICS_DONE           = 1 << 5,
-        /**< Indication that DIS statistics are available. */
+        /** Indication that DIS statistics are available. */
         IA_CSS_EVENT_TYPE_PIPELINE_DONE                 = 1 << 6,
-        /**< Pipeline Done event, sent after last pipeline stage. */
+        /** Pipeline Done event, sent after last pipeline stage. */
         IA_CSS_EVENT_TYPE_FRAME_TAGGED                  = 1 << 7,
-        /**< Frame tagged. */
+        /** Frame tagged. */
         IA_CSS_EVENT_TYPE_INPUT_FRAME_DONE              = 1 << 8,
-        /**< Input frame ready. */
+        /** Input frame ready. */
         IA_CSS_EVENT_TYPE_METADATA_DONE                 = 1 << 9,
-        /**< Metadata ready. */
+        /** Metadata ready. */
         IA_CSS_EVENT_TYPE_LACE_STATISTICS_DONE          = 1 << 10,
-        /**< Indication that LACE statistics are available. */
+        /** Indication that LACE statistics are available. */
         IA_CSS_EVENT_TYPE_ACC_STAGE_COMPLETE            = 1 << 11,
-        /**< Extension stage complete. */
+        /** Extension stage complete. */
         IA_CSS_EVENT_TYPE_TIMER                         = 1 << 12,
-        /**< Timer event for measuring the SP side latencies. It contains the
+        /** Timer event for measuring the SP side latencies. It contains the
              32-bit timer value from the SP */
         IA_CSS_EVENT_TYPE_PORT_EOF                      = 1 << 13,
-        /**< End Of Frame event, sent when in buffered sensor mode. */
+        /** End Of Frame event, sent when in buffered sensor mode. */
         IA_CSS_EVENT_TYPE_FW_WARNING                    = 1 << 14,
-        /**< Performance warning encounter by FW */
+        /** Performance warning encounter by FW */
         IA_CSS_EVENT_TYPE_FW_ASSERT                     = 1 << 15,
-        /**< Assertion hit by FW */
+        /** Assertion hit by FW */
 };
 
 #define IA_CSS_EVENT_TYPE_NONE 0
 
-/** IA_CSS_EVENT_TYPE_ALL is a mask for all pipe related events.
+/* IA_CSS_EVENT_TYPE_ALL is a mask for all pipe related events.
  * The other events (such as PORT_EOF) cannot be enabled/disabled
  * and are hence excluded from this macro.
  */
@@ -89,7 +89,7 @@ enum ia_css_event_type {
          IA_CSS_EVENT_TYPE_LACE_STATISTICS_DONE         | \
          IA_CSS_EVENT_TYPE_ACC_STAGE_COMPLETE)
 
-/** The event struct, container for the event type and its related values.
+/* The event struct, container for the event type and its related values.
  * Depending on the event type, either pipe or port will be filled.
  * Pipeline related events (like buffer/frame events) will return a valid and filled pipe handle.
  * For non pipeline related events (but i.e. stream specific, like EOF event), the port will be
@@ -97,14 +97,14 @@ enum ia_css_event_type {
  */
 struct ia_css_event {
         struct ia_css_pipe    *pipe;
-        /**< Pipe handle on which event happened, NULL for non pipe related
+        /** Pipe handle on which event happened, NULL for non pipe related
              events. */
         enum ia_css_event_type type;
-        /**< Type of Event, always valid/filled. */
+        /** Type of Event, always valid/filled. */
         uint8_t                port;
-        /**< Port number for EOF event (not valid for other events). */
+        /** Port number for EOF event (not valid for other events). */
         uint8_t                exp_id;
-        /**< Exposure id for EOF/FRAME_TAGGED/FW_WARNING event (not valid for other events)
+        /** Exposure id for EOF/FRAME_TAGGED/FW_WARNING event (not valid for other events)
              The exposure ID is unique only within a logical stream and it is
              only generated on systems that have an input system (such as 2400
              and 2401).
@@ -120,26 +120,26 @@ struct ia_css_event {
              in the exposure IDs. Therefor applications should not use this
              to detect frame drops. */
         uint32_t               fw_handle;
-        /**< Firmware Handle for ACC_STAGE_COMPLETE event (not valid for other
+        /** Firmware Handle for ACC_STAGE_COMPLETE event (not valid for other
              events). */
         enum ia_css_fw_warning fw_warning;
-        /**< Firmware warning code, only for WARNING events. */
+        /** Firmware warning code, only for WARNING events. */
         uint8_t                fw_assert_module_id;
-        /**< Firmware module id, only for ASSERT events, should be logged by driver. */
+        /** Firmware module id, only for ASSERT events, should be logged by driver. */
         uint16_t               fw_assert_line_no;
-        /**< Firmware line number, only for ASSERT events, should be logged by driver. */
+        /** Firmware line number, only for ASSERT events, should be logged by driver. */
         clock_value_t          timer_data;
-        /**< For storing the full 32-bit of the timer value. Valid only for TIMER
+        /** For storing the full 32-bit of the timer value. Valid only for TIMER
              event */
         uint8_t                timer_code;
-        /**< For storing the code of the TIMER event. Valid only for
+        /** For storing the code of the TIMER event. Valid only for
              TIMER event */
         uint8_t                timer_subcode;
-        /**< For storing the subcode of the TIMER event. Valid only
+        /** For storing the subcode of the TIMER event. Valid only
              for TIMER event */
 };
 
-/** @brief Dequeue a PSYS event from the CSS system.
+/* @brief Dequeue a PSYS event from the CSS system.
  *
  * @param[out]  event   Pointer to the event struct which will be filled by
  *                      this function if an event is available.
@@ -156,7 +156,7 @@ struct ia_css_event {
 enum ia_css_err
 ia_css_dequeue_psys_event(struct ia_css_event *event);
 
-/** @brief Dequeue an event from the CSS system.
+/* @brief Dequeue an event from the CSS system.
  *
  * @param[out]  event   Pointer to the event struct which will be filled by
  *                      this function if an event is available.
@@ -171,7 +171,7 @@ ia_css_dequeue_psys_event(struct ia_css_event *event);
 enum ia_css_err
 ia_css_dequeue_event(struct ia_css_event *event);
 
-/** @brief Dequeue an ISYS event from the CSS system.
+/* @brief Dequeue an ISYS event from the CSS system.
  *
  * @param[out]  event   Pointer to the event struct which will be filled by
  *                      this function if an event is available.
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_firmware.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_firmware.h
index 06d375a09be2..d7d7f0a995e5 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_firmware.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_firmware.h
@@ -15,21 +15,21 @@
 #ifndef __IA_CSS_FIRMWARE_H
 #define __IA_CSS_FIRMWARE_H
 
-/** @file
+/* @file
  * This file contains firmware loading/unloading support functionality
  */
 
 #include "ia_css_err.h"
 #include "ia_css_env.h"
 
-/** CSS firmware package structure.
+/* CSS firmware package structure.
  */
 struct ia_css_fw {
-        void        *data;  /**< pointer to the firmware data */
-        unsigned int bytes; /**< length in bytes of firmware data */
+        void        *data;  /** pointer to the firmware data */
+        unsigned int bytes; /** length in bytes of firmware data */
 };
 
-/** @brief Loads the firmware
+/* @brief Loads the firmware
  * @param[in]   env             Environment, provides functions to access the
  *                              environment in which the CSS code runs. This is
  *                              used for host side memory access and message
@@ -51,7 +51,7 @@ enum ia_css_err
 ia_css_load_firmware(const struct ia_css_env *env,
             const struct ia_css_fw  *fw);
 
-/** @brief Unloads the firmware
+/* @brief Unloads the firmware
  * @return      None
  *
  * This function unloads the firmware loaded by ia_css_load_firmware.
@@ -61,7 +61,7 @@ ia_css_load_firmware(const struct ia_css_env *env,
 void
 ia_css_unload_firmware(void);
 
-/** @brief Checks firmware version
+/* @brief Checks firmware version
  * @param[in]   fw      Firmware package containing the firmware for all
  *                      predefined ISP binaries.
  * @return              Returns true when the firmware version matches with the CSS
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_frac.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_frac.h
index da9c60144c6d..e5ffc579aef1 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_frac.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_frac.h
@@ -15,7 +15,7 @@
 #ifndef _IA_CSS_FRAC_H
 #define _IA_CSS_FRAC_H
 
-/** @file
+/* @file
  * This file contains typedefs used for fractional numbers
  */
 
@@ -25,13 +25,13 @@
  * NOTE: the 16 bit fixed point types actually occupy 32 bits
  * to save on extension operations in the ISP code.
  */
-/** Unsigned fixed point value, 0 integer bits, 16 fractional bits */
+/* Unsigned fixed point value, 0 integer bits, 16 fractional bits */
 typedef uint32_t ia_css_u0_16;
-/** Unsigned fixed point value, 5 integer bits, 11 fractional bits */
+/* Unsigned fixed point value, 5 integer bits, 11 fractional bits */
 typedef uint32_t ia_css_u5_11;
-/** Unsigned fixed point value, 8 integer bits, 8 fractional bits */
+/* Unsigned fixed point value, 8 integer bits, 8 fractional bits */
 typedef uint32_t ia_css_u8_8;
-/** Signed fixed point value, 0 integer bits, 15 fractional bits */
+/* Signed fixed point value, 0 integer bits, 15 fractional bits */
 typedef int32_t ia_css_s0_15;
 
 #endif /* _IA_CSS_FRAC_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_frame_format.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_frame_format.h
index d534fbd91380..2f177edc36ac 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_frame_format.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_frame_format.h
@@ -15,11 +15,11 @@
 #ifndef __IA_CSS_FRAME_FORMAT_H
 #define __IA_CSS_FRAME_FORMAT_H
 
-/** @file
+/* @file
  * This file contains information about formats supported in the ISP
  */
 
-/** Frame formats, some of these come from fourcc.org, others are
+/* Frame formats, some of these come from fourcc.org, others are
    better explained by video4linux2. The NV11 seems to be described only
    on MSDN pages, but even those seem to be gone now.
    Frames can come in many forms, the main categories are RAW, RGB and YUV
@@ -48,45 +48,45 @@
         - css/bxt_sandbox/isysapi/interface/ia_css_isysapi_fw_types.h
 */
 enum ia_css_frame_format {
-        IA_CSS_FRAME_FORMAT_NV11 = 0,   /**< 12 bit YUV 411, Y, UV plane */
-        IA_CSS_FRAME_FORMAT_NV12,       /**< 12 bit YUV 420, Y, UV plane */
-        IA_CSS_FRAME_FORMAT_NV12_16,    /**< 16 bit YUV 420, Y, UV plane */
-        IA_CSS_FRAME_FORMAT_NV12_TILEY, /**< 12 bit YUV 420, Intel proprietary tiled format, TileY */
-        IA_CSS_FRAME_FORMAT_NV16,       /**< 16 bit YUV 422, Y, UV plane */
-        IA_CSS_FRAME_FORMAT_NV21,       /**< 12 bit YUV 420, Y, VU plane */
-        IA_CSS_FRAME_FORMAT_NV61,       /**< 16 bit YUV 422, Y, VU plane */
-        IA_CSS_FRAME_FORMAT_YV12,       /**< 12 bit YUV 420, Y, V, U plane */
-        IA_CSS_FRAME_FORMAT_YV16,       /**< 16 bit YUV 422, Y, V, U plane */
-        IA_CSS_FRAME_FORMAT_YUV420,     /**< 12 bit YUV 420, Y, U, V plane */
-        IA_CSS_FRAME_FORMAT_YUV420_16,  /**< yuv420, 16 bits per subpixel */
-        IA_CSS_FRAME_FORMAT_YUV422,     /**< 16 bit YUV 422, Y, U, V plane */
-        IA_CSS_FRAME_FORMAT_YUV422_16,  /**< yuv422, 16 bits per subpixel */
-        IA_CSS_FRAME_FORMAT_UYVY,       /**< 16 bit YUV 422, UYVY interleaved */
-        IA_CSS_FRAME_FORMAT_YUYV,       /**< 16 bit YUV 422, YUYV interleaved */
-        IA_CSS_FRAME_FORMAT_YUV444,     /**< 24 bit YUV 444, Y, U, V plane */
-        IA_CSS_FRAME_FORMAT_YUV_LINE,   /**< Internal format, 2 y lines followed
+        IA_CSS_FRAME_FORMAT_NV11 = 0,   /** 12 bit YUV 411, Y, UV plane */
+        IA_CSS_FRAME_FORMAT_NV12,       /** 12 bit YUV 420, Y, UV plane */
+        IA_CSS_FRAME_FORMAT_NV12_16,    /** 16 bit YUV 420, Y, UV plane */
+        IA_CSS_FRAME_FORMAT_NV12_TILEY, /** 12 bit YUV 420, Intel proprietary tiled format, TileY */
+        IA_CSS_FRAME_FORMAT_NV16,       /** 16 bit YUV 422, Y, UV plane */
+        IA_CSS_FRAME_FORMAT_NV21,       /** 12 bit YUV 420, Y, VU plane */
+        IA_CSS_FRAME_FORMAT_NV61,       /** 16 bit YUV 422, Y, VU plane */
+        IA_CSS_FRAME_FORMAT_YV12,       /** 12 bit YUV 420, Y, V, U plane */
+        IA_CSS_FRAME_FORMAT_YV16,       /** 16 bit YUV 422, Y, V, U plane */
+        IA_CSS_FRAME_FORMAT_YUV420,     /** 12 bit YUV 420, Y, U, V plane */
+        IA_CSS_FRAME_FORMAT_YUV420_16,  /** yuv420, 16 bits per subpixel */
+        IA_CSS_FRAME_FORMAT_YUV422,     /** 16 bit YUV 422, Y, U, V plane */
+        IA_CSS_FRAME_FORMAT_YUV422_16,  /** yuv422, 16 bits per subpixel */
+        IA_CSS_FRAME_FORMAT_UYVY,       /** 16 bit YUV 422, UYVY interleaved */
+        IA_CSS_FRAME_FORMAT_YUYV,       /** 16 bit YUV 422, YUYV interleaved */
+        IA_CSS_FRAME_FORMAT_YUV444,     /** 24 bit YUV 444, Y, U, V plane */
+        IA_CSS_FRAME_FORMAT_YUV_LINE,   /** Internal format, 2 y lines followed
                                              by a uvinterleaved line */
-        IA_CSS_FRAME_FORMAT_RAW,        /**< RAW, 1 plane */
-        IA_CSS_FRAME_FORMAT_RGB565,     /**< 16 bit RGB, 1 plane. Each 3 sub
+        IA_CSS_FRAME_FORMAT_RAW,        /** RAW, 1 plane */
+        IA_CSS_FRAME_FORMAT_RGB565,     /** 16 bit RGB, 1 plane. Each 3 sub
                                              pixels are packed into one 16 bit
                                              value, 5 bits for R, 6 bits for G
                                              and 5 bits for B. */
-        IA_CSS_FRAME_FORMAT_PLANAR_RGB888, /**< 24 bit RGB, 3 planes */
-        IA_CSS_FRAME_FORMAT_RGBA888,    /**< 32 bit RGBA, 1 plane, A=Alpha
+        IA_CSS_FRAME_FORMAT_PLANAR_RGB888, /** 24 bit RGB, 3 planes */
+        IA_CSS_FRAME_FORMAT_RGBA888,    /** 32 bit RGBA, 1 plane, A=Alpha
                                              (alpha is unused) */
-        IA_CSS_FRAME_FORMAT_QPLANE6, /**< Internal, for advanced ISP */
-        IA_CSS_FRAME_FORMAT_BINARY_8,   /**< byte stream, used for jpeg. For
+        IA_CSS_FRAME_FORMAT_QPLANE6, /** Internal, for advanced ISP */
+        IA_CSS_FRAME_FORMAT_BINARY_8,   /** byte stream, used for jpeg. For
                                              frames of this type, we set the
                                              height to 1 and the width to the
                                              number of allocated bytes. */
-        IA_CSS_FRAME_FORMAT_MIPI,       /**< MIPI frame, 1 plane */
-        IA_CSS_FRAME_FORMAT_RAW_PACKED, /**< RAW, 1 plane, packed */
-        IA_CSS_FRAME_FORMAT_CSI_MIPI_YUV420_8,        /**< 8 bit per Y/U/V.
+        IA_CSS_FRAME_FORMAT_MIPI,       /** MIPI frame, 1 plane */
+        IA_CSS_FRAME_FORMAT_RAW_PACKED, /** RAW, 1 plane, packed */
+        IA_CSS_FRAME_FORMAT_CSI_MIPI_YUV420_8,        /** 8 bit per Y/U/V.
                                                            Y odd line; UYVY
                                                            interleaved even line */
-        IA_CSS_FRAME_FORMAT_CSI_MIPI_LEGACY_YUV420_8, /**< Legacy YUV420. UY odd
+        IA_CSS_FRAME_FORMAT_CSI_MIPI_LEGACY_YUV420_8, /** Legacy YUV420. UY odd
                                                            line; VY even line */
-        IA_CSS_FRAME_FORMAT_CSI_MIPI_YUV420_10       /**< 10 bit per Y/U/V. Y odd
+        IA_CSS_FRAME_FORMAT_CSI_MIPI_YUV420_10       /** 10 bit per Y/U/V. Y odd
                                                            line; UYVY interleaved
                                                            even line */
 };
@@ -95,7 +95,7 @@ enum ia_css_frame_format {
 /*       because of issues this would cause with the Clockwork code checking tool.               */
 #define IA_CSS_FRAME_FORMAT_NUM (IA_CSS_FRAME_FORMAT_CSI_MIPI_YUV420_10 + 1)
 
-/** Number of valid output frame formats for ISP **/
+/* Number of valid output frame formats for ISP **/
 #define IA_CSS_FRAME_OUT_FORMAT_NUM     (IA_CSS_FRAME_FORMAT_RGBA888 + 1)
 
 #endif /* __IA_CSS_FRAME_FORMAT_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_frame_public.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_frame_public.h
index 92f2389176b2..ba7a076c3afa 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_frame_public.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_frame_public.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_FRAME_PUBLIC_H
 #define __IA_CSS_FRAME_PUBLIC_H
 
-/** @file
+/* @file
  * This file contains structs to describe various frame-formats supported by the ISP.
  */
 
@@ -25,73 +25,73 @@
 #include "ia_css_frame_format.h"
 #include "ia_css_buffer.h"
 
-/** For RAW input, the bayer order needs to be specified separately. There
+/* For RAW input, the bayer order needs to be specified separately. There
  *  are 4 possible orders. The name is constructed by taking the first two
  *  colors on the first line and the first two colors from the second line.
  */
 enum ia_css_bayer_order {
-        IA_CSS_BAYER_ORDER_GRBG, /**< GRGRGRGRGR .. BGBGBGBGBG */
-        IA_CSS_BAYER_ORDER_RGGB, /**< RGRGRGRGRG .. GBGBGBGBGB */
-        IA_CSS_BAYER_ORDER_BGGR, /**< BGBGBGBGBG .. GRGRGRGRGR */
-        IA_CSS_BAYER_ORDER_GBRG, /**< GBGBGBGBGB .. RGRGRGRGRG */
+        IA_CSS_BAYER_ORDER_GRBG, /** GRGRGRGRGR .. BGBGBGBGBG */
+        IA_CSS_BAYER_ORDER_RGGB, /** RGRGRGRGRG .. GBGBGBGBGB */
+        IA_CSS_BAYER_ORDER_BGGR, /** BGBGBGBGBG .. GRGRGRGRGR */
+        IA_CSS_BAYER_ORDER_GBRG, /** GBGBGBGBGB .. RGRGRGRGRG */
 };
 #define IA_CSS_BAYER_ORDER_NUM (IA_CSS_BAYER_ORDER_GBRG + 1)
 
-/** Frame plane structure. This describes one plane in an image
+/* Frame plane structure. This describes one plane in an image
  *  frame buffer.
  */
 struct ia_css_frame_plane {
-        unsigned int height; /**< height of a plane in lines */
-        unsigned int width;  /**< width of a line, in DMA elements, note that
+        unsigned int height; /** height of a plane in lines */
+        unsigned int width;  /** width of a line, in DMA elements, note that
                                   for RGB565 the three subpixels are stored in
                                   one element. For all other formats this is
                                   the number of subpixels per line. */
-        unsigned int stride; /**< stride of a line in bytes */
-        unsigned int offset; /**< offset in bytes to start of frame data.
+        unsigned int stride; /** stride of a line in bytes */
+        unsigned int offset; /** offset in bytes to start of frame data.
                                   offset is wrt data field in ia_css_frame */
 };
 
-/** Binary "plane". This is used to story binary streams such as jpeg
+/* Binary "plane". This is used to story binary streams such as jpeg
  *  images. This is not actually a real plane.
  */
 struct ia_css_frame_binary_plane {
-        unsigned int              size; /**< number of bytes in the stream */
-        struct ia_css_frame_plane data; /**< plane */
+        unsigned int              size; /** number of bytes in the stream */
+        struct ia_css_frame_plane data; /** plane */
 };
 
-/** Container for planar YUV frames. This contains 3 planes.
+/* Container for planar YUV frames. This contains 3 planes.
  */
 struct ia_css_frame_yuv_planes {
-        struct ia_css_frame_plane y; /**< Y plane */
-        struct ia_css_frame_plane u; /**< U plane */
-        struct ia_css_frame_plane v; /**< V plane */
+        struct ia_css_frame_plane y; /** Y plane */
+        struct ia_css_frame_plane u; /** U plane */
+        struct ia_css_frame_plane v; /** V plane */
 };
 
-/** Container for semi-planar YUV frames.
+/* Container for semi-planar YUV frames.
   */
 struct ia_css_frame_nv_planes {
-        struct ia_css_frame_plane y;  /**< Y plane */
-        struct ia_css_frame_plane uv; /**< UV plane */
+        struct ia_css_frame_plane y;  /** Y plane */
+        struct ia_css_frame_plane uv; /** UV plane */
 };
 
-/** Container for planar RGB frames. Each color has its own plane.
+/* Container for planar RGB frames. Each color has its own plane.
  */
 struct ia_css_frame_rgb_planes {
-        struct ia_css_frame_plane r; /**< Red plane */
-        struct ia_css_frame_plane g; /**< Green plane */
-        struct ia_css_frame_plane b; /**< Blue plane */
+        struct ia_css_frame_plane r; /** Red plane */
+        struct ia_css_frame_plane g; /** Green plane */
+        struct ia_css_frame_plane b; /** Blue plane */
 };
 
-/** Container for 6-plane frames. These frames are used internally
+/* Container for 6-plane frames. These frames are used internally
  *  in the advanced ISP only.
  */
 struct ia_css_frame_plane6_planes {
-        struct ia_css_frame_plane r;      /**< Red plane */
-        struct ia_css_frame_plane r_at_b; /**< Red at blue plane */
-        struct ia_css_frame_plane gr;     /**< Red-green plane */
-        struct ia_css_frame_plane gb;     /**< Blue-green plane */
-        struct ia_css_frame_plane b;      /**< Blue plane */
-        struct ia_css_frame_plane b_at_r; /**< Blue at red plane */
+        struct ia_css_frame_plane r;      /** Red plane */
+        struct ia_css_frame_plane r_at_b; /** Red at blue plane */
+        struct ia_css_frame_plane gr;     /** Red-green plane */
+        struct ia_css_frame_plane gb;     /** Blue-green plane */
+        struct ia_css_frame_plane b;      /** Blue plane */
+        struct ia_css_frame_plane b_at_r; /** Blue at red plane */
 };
 
 /* Crop info struct - stores the lines to be cropped in isp */
@@ -103,15 +103,15 @@ struct ia_css_crop_info {
         unsigned int start_line;
 };
 
-/** Frame info struct. This describes the contents of an image frame buffer.
+/* Frame info struct. This describes the contents of an image frame buffer.
   */
 struct ia_css_frame_info {
-        struct ia_css_resolution res; /**< Frame resolution (valid data) */
-        unsigned int padded_width; /**< stride of line in memory (in pixels) */
-        enum ia_css_frame_format format; /**< format of the frame data */
-        unsigned int raw_bit_depth; /**< number of valid bits per pixel,
+        struct ia_css_resolution res; /** Frame resolution (valid data) */
+        unsigned int padded_width; /** stride of line in memory (in pixels) */
+        enum ia_css_frame_format format; /** format of the frame data */
+        unsigned int raw_bit_depth; /** number of valid bits per pixel,
                                          only valid for RAW bayer frames */
-        enum ia_css_bayer_order raw_bayer_order; /**< bayer order, only valid
+        enum ia_css_bayer_order raw_bayer_order; /** bayer order, only valid
                                                       for RAW bayer frames */
         /* the params below are computed based on bayer_order
          * we can remove the raw_bayer_order if it is redundant
@@ -136,9 +136,9 @@ struct ia_css_frame_info {
  *  Specifies the DVS loop delay in "frame periods"
  */
 enum ia_css_frame_delay {
-        IA_CSS_FRAME_DELAY_0, /**< Frame delay = 0 */
-        IA_CSS_FRAME_DELAY_1, /**< Frame delay = 1 */
-        IA_CSS_FRAME_DELAY_2  /**< Frame delay = 2 */
+        IA_CSS_FRAME_DELAY_0, /** Frame delay = 0 */
+        IA_CSS_FRAME_DELAY_1, /** Frame delay = 1 */
+        IA_CSS_FRAME_DELAY_2  /** Frame delay = 2 */
 };
 
 enum ia_css_frame_flash_state {
@@ -147,13 +147,13 @@ enum ia_css_frame_flash_state {
         IA_CSS_FRAME_FLASH_STATE_FULL
 };
 
-/** Frame structure. This structure describes an image buffer or frame.
+/* Frame structure. This structure describes an image buffer or frame.
  *  This is the main structure used for all input and output images.
  */
 struct ia_css_frame {
-        struct ia_css_frame_info info; /**< info struct describing the frame */
-        ia_css_ptr   data;             /**< pointer to start of image data */
-        unsigned int data_bytes;       /**< size of image data in bytes */
+        struct ia_css_frame_info info; /** info struct describing the frame */
+        ia_css_ptr   data;             /** pointer to start of image data */
+        unsigned int data_bytes;       /** size of image data in bytes */
         /* LA: move this to ia_css_buffer */
         /*
          * -1 if data address is static during life time of pipeline
@@ -171,10 +171,10 @@ struct ia_css_frame {
         enum ia_css_buffer_type buf_type;
         enum ia_css_frame_flash_state flash_state;
         unsigned int exp_id;
-        /**< exposure id, see ia_css_event_public.h for more detail */
-        uint32_t isp_config_id; /**< Unique ID to track which config was actually applied to a particular frame */
-        bool valid; /**< First video output frame is not valid */
-        bool contiguous; /**< memory is allocated physically contiguously */
+        /** exposure id, see ia_css_event_public.h for more detail */
+        uint32_t isp_config_id; /** Unique ID to track which config was actually applied to a particular frame */
+        bool valid; /** First video output frame is not valid */
+        bool contiguous; /** memory is allocated physically contiguously */
         union {
                 unsigned int    _initialisation_dummy;
                 struct ia_css_frame_plane raw;
@@ -185,7 +185,7 @@ struct ia_css_frame {
                 struct ia_css_frame_nv_planes nv;
                 struct ia_css_frame_plane6_planes plane6;
                 struct ia_css_frame_binary_plane binary;
-        } planes; /**< frame planes, select the right one based on
+        } planes; /** frame planes, select the right one based on
                        info.format */
 };
 
@@ -204,7 +204,7 @@ struct ia_css_frame {
         { 0 }                                   /* planes */ \
 }
 
-/** @brief Fill a frame with zeros
+/* @brief Fill a frame with zeros
  *
  * @param       frame           The frame.
  * @return      None
@@ -213,7 +213,7 @@ struct ia_css_frame {
  */
 void ia_css_frame_zero(struct ia_css_frame *frame);
 
-/** @brief Allocate a CSS frame structure
+/* @brief Allocate a CSS frame structure
  *
  * @param       frame           The allocated frame.
  * @param       width           The width (in pixels) of the frame.
@@ -234,7 +234,7 @@ ia_css_frame_allocate(struct ia_css_frame **frame,
                       unsigned int stride,
                       unsigned int raw_bit_depth);
 
-/** @brief Allocate a CSS frame structure using a frame info structure.
+/* @brief Allocate a CSS frame structure using a frame info structure.
  *
  * @param       frame   The allocated frame.
  * @param[in]   info    The frame info structure.
@@ -247,7 +247,7 @@ ia_css_frame_allocate(struct ia_css_frame **frame,
 enum ia_css_err
 ia_css_frame_allocate_from_info(struct ia_css_frame **frame,
                                 const struct ia_css_frame_info *info);
-/** @brief Free a CSS frame structure.
+/* @brief Free a CSS frame structure.
  *
  * @param[in]   frame   Pointer to the frame.
  * @return      None
@@ -258,7 +258,7 @@ ia_css_frame_allocate_from_info(struct ia_css_frame **frame,
 void
 ia_css_frame_free(struct ia_css_frame *frame);
 
-/** @brief Allocate a contiguous CSS frame structure
+/* @brief Allocate a contiguous CSS frame structure
  *
  * @param       frame           The allocated frame.
  * @param       width           The width (in pixels) of the frame.
@@ -280,7 +280,7 @@ ia_css_frame_allocate_contiguous(struct ia_css_frame **frame,
                                  unsigned int stride,
                                  unsigned int raw_bit_depth);
 
-/** @brief Allocate a contiguous CSS frame from a frame info structure.
+/* @brief Allocate a contiguous CSS frame from a frame info structure.
  *
  * @param       frame   The allocated frame.
  * @param[in]   info    The frame info structure.
@@ -296,7 +296,7 @@ enum ia_css_err
 ia_css_frame_allocate_contiguous_from_info(struct ia_css_frame **frame,
                                           const struct ia_css_frame_info *info);
 
-/** @brief Allocate a CSS frame structure using a frame info structure.
+/* @brief Allocate a CSS frame structure using a frame info structure.
  *
  * @param       frame   The allocated frame.
  * @param[in]   info    The frame info structure.
@@ -309,7 +309,7 @@ enum ia_css_err
 ia_css_frame_create_from_info(struct ia_css_frame **frame,
         const struct ia_css_frame_info *info);
 
-/** @brief Set a mapped data buffer to a CSS frame
+/* @brief Set a mapped data buffer to a CSS frame
  *
  * @param[in]   frame       Valid CSS frame pointer
  * @param[in]   mapped_data  Mapped data buffer to be assigned to the CSS frame
@@ -327,7 +327,7 @@ ia_css_frame_set_data(struct ia_css_frame *frame,
         const ia_css_ptr   mapped_data,
         size_t data_size_bytes);
 
-/** @brief Map an existing frame data pointer to a CSS frame.
+/* @brief Map an existing frame data pointer to a CSS frame.
  *
  * @param       frame           Pointer to the frame to be initialized
  * @param[in]   info            The frame info.
@@ -350,7 +350,7 @@ ia_css_frame_map(struct ia_css_frame **frame,
                  uint16_t attribute,
                  void *context);
 
-/** @brief Unmap a CSS frame structure.
+/* @brief Unmap a CSS frame structure.
  *
  * @param[in]   frame   Pointer to the CSS frame.
  * @return      None
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_input_port.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_input_port.h
index 8a17c3346caa..f415570a3da9 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_input_port.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_input_port.h
@@ -15,11 +15,11 @@
 #ifndef __IA_CSS_INPUT_PORT_H
 #define __IA_CSS_INPUT_PORT_H
 
-/** @file
+/* @file
  * This file contains information about the possible input ports for CSS
  */
 
-/** Enumeration of the physical input ports on the CSS hardware.
+/* Enumeration of the physical input ports on the CSS hardware.
  *  There are 3 MIPI CSI-2 ports.
  */
 enum ia_css_csi2_port {
@@ -28,39 +28,39 @@ enum ia_css_csi2_port {
         IA_CSS_CSI2_PORT2  /* Implicitly map to MIPI_PORT2_ID */
 };
 
-/** Backward compatible for CSS API 2.0 only
+/* Backward compatible for CSS API 2.0 only
  *  TO BE REMOVED when all drivers move to CSS  API 2.1
  */
 #define IA_CSS_CSI2_PORT_4LANE IA_CSS_CSI2_PORT0
 #define IA_CSS_CSI2_PORT_1LANE IA_CSS_CSI2_PORT1
 #define IA_CSS_CSI2_PORT_2LANE IA_CSS_CSI2_PORT2
 
-/** The CSI2 interface supports 2 types of compression or can
+/* The CSI2 interface supports 2 types of compression or can
  *  be run without compression.
  */
 enum ia_css_csi2_compression_type {
-        IA_CSS_CSI2_COMPRESSION_TYPE_NONE, /**< No compression */
-        IA_CSS_CSI2_COMPRESSION_TYPE_1,    /**< Compression scheme 1 */
-        IA_CSS_CSI2_COMPRESSION_TYPE_2     /**< Compression scheme 2 */
+        IA_CSS_CSI2_COMPRESSION_TYPE_NONE, /** No compression */
+        IA_CSS_CSI2_COMPRESSION_TYPE_1,    /** Compression scheme 1 */
+        IA_CSS_CSI2_COMPRESSION_TYPE_2     /** Compression scheme 2 */
 };
 
 struct ia_css_csi2_compression {
         enum ia_css_csi2_compression_type type;
-        /**< Compression used */
+        /** Compression used */
         unsigned int                      compressed_bits_per_pixel;
-        /**< Compressed bits per pixel (only when compression is enabled) */
+        /** Compressed bits per pixel (only when compression is enabled) */
         unsigned int                      uncompressed_bits_per_pixel;
-        /**< Uncompressed bits per pixel (only when compression is enabled) */
+        /** Uncompressed bits per pixel (only when compression is enabled) */
 };
 
-/** Input port structure.
+/* Input port structure.
  */
 struct ia_css_input_port {
-        enum ia_css_csi2_port port; /**< Physical CSI-2 port */
-        unsigned int num_lanes; /**< Number of lanes used (4-lane port only) */
-        unsigned int timeout;   /**< Timeout value */
-        unsigned int rxcount;   /**< Register value, should include all lanes */
-        struct ia_css_csi2_compression compression; /**< Compression used */
+        enum ia_css_csi2_port port; /** Physical CSI-2 port */
+        unsigned int num_lanes; /** Number of lanes used (4-lane port only) */
+        unsigned int timeout;   /** Timeout value */
+        unsigned int rxcount;   /** Register value, should include all lanes */
+        struct ia_css_csi2_compression compression; /** Compression used */
 };
 
 #endif /* __IA_CSS_INPUT_PORT_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_irq.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_irq.h
index 416ca4d28732..10ef61178bb2 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_irq.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_irq.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_IRQ_H
 #define __IA_CSS_IRQ_H
 
-/** @file
+/* @file
  * This file contains information for Interrupts/IRQs from CSS
  */
 
@@ -23,14 +23,14 @@
 #include "ia_css_pipe_public.h"
 #include "ia_css_input_port.h"
 
-/** Interrupt types, these enumerate all supported interrupt types.
+/* Interrupt types, these enumerate all supported interrupt types.
  */
 enum ia_css_irq_type {
-        IA_CSS_IRQ_TYPE_EDGE,  /**< Edge (level) sensitive interrupt */
-        IA_CSS_IRQ_TYPE_PULSE  /**< Pulse-shaped interrupt */
+        IA_CSS_IRQ_TYPE_EDGE,  /** Edge (level) sensitive interrupt */
+        IA_CSS_IRQ_TYPE_PULSE  /** Pulse-shaped interrupt */
 };
 
-/** Interrupt request type.
+/* Interrupt request type.
  *  When the CSS hardware generates an interrupt, a function in this API
  *  needs to be called to retrieve information about the interrupt.
  *  This interrupt type is part of this information and indicates what
@@ -46,55 +46,55 @@ enum ia_css_irq_type {
  */
 enum ia_css_irq_info {
         IA_CSS_IRQ_INFO_CSS_RECEIVER_ERROR            = 1 << 0,
-        /**< the css receiver has encountered an error */
+        /** the css receiver has encountered an error */
         IA_CSS_IRQ_INFO_CSS_RECEIVER_FIFO_OVERFLOW    = 1 << 1,
-        /**< the FIFO in the csi receiver has overflown */
+        /** the FIFO in the csi receiver has overflown */
         IA_CSS_IRQ_INFO_CSS_RECEIVER_SOF              = 1 << 2,
-        /**< the css receiver received the start of frame */
+        /** the css receiver received the start of frame */
         IA_CSS_IRQ_INFO_CSS_RECEIVER_EOF              = 1 << 3,
-        /**< the css receiver received the end of frame */
+        /** the css receiver received the end of frame */
         IA_CSS_IRQ_INFO_CSS_RECEIVER_SOL              = 1 << 4,
-        /**< the css receiver received the start of line */
+        /** the css receiver received the start of line */
         IA_CSS_IRQ_INFO_PSYS_EVENTS_READY             = 1 << 5,
-        /**< One or more events are available in the PSYS event queue */
+        /** One or more events are available in the PSYS event queue */
         IA_CSS_IRQ_INFO_EVENTS_READY = IA_CSS_IRQ_INFO_PSYS_EVENTS_READY,
-        /**< deprecated{obsolete version of IA_CSS_IRQ_INFO_PSYS_EVENTS_READY,
+        /** deprecated{obsolete version of IA_CSS_IRQ_INFO_PSYS_EVENTS_READY,
          * same functionality.} */
         IA_CSS_IRQ_INFO_CSS_RECEIVER_EOL              = 1 << 6,
-        /**< the css receiver received the end of line */
+        /** the css receiver received the end of line */
         IA_CSS_IRQ_INFO_CSS_RECEIVER_SIDEBAND_CHANGED = 1 << 7,
-        /**< the css receiver received a change in side band signals */
+        /** the css receiver received a change in side band signals */
         IA_CSS_IRQ_INFO_CSS_RECEIVER_GEN_SHORT_0      = 1 << 8,
-        /**< generic short packets (0) */
+        /** generic short packets (0) */
         IA_CSS_IRQ_INFO_CSS_RECEIVER_GEN_SHORT_1      = 1 << 9,
-        /**< generic short packets (1) */
+        /** generic short packets (1) */
         IA_CSS_IRQ_INFO_IF_PRIM_ERROR                 = 1 << 10,
-        /**< the primary input formatter (A) has encountered an error */
+        /** the primary input formatter (A) has encountered an error */
         IA_CSS_IRQ_INFO_IF_PRIM_B_ERROR               = 1 << 11,
-        /**< the primary input formatter (B) has encountered an error */
+        /** the primary input formatter (B) has encountered an error */
         IA_CSS_IRQ_INFO_IF_SEC_ERROR                  = 1 << 12,
-        /**< the secondary input formatter has encountered an error */
+        /** the secondary input formatter has encountered an error */
         IA_CSS_IRQ_INFO_STREAM_TO_MEM_ERROR           = 1 << 13,
-        /**< the stream-to-memory device has encountered an error */
+        /** the stream-to-memory device has encountered an error */
         IA_CSS_IRQ_INFO_SW_0                          = 1 << 14,
-        /**< software interrupt 0 */
+        /** software interrupt 0 */
         IA_CSS_IRQ_INFO_SW_1                          = 1 << 15,
-        /**< software interrupt 1 */
+        /** software interrupt 1 */
         IA_CSS_IRQ_INFO_SW_2                          = 1 << 16,
-        /**< software interrupt 2 */
+        /** software interrupt 2 */
         IA_CSS_IRQ_INFO_ISP_BINARY_STATISTICS_READY   = 1 << 17,
-        /**< ISP binary statistics are ready */
+        /** ISP binary statistics are ready */
         IA_CSS_IRQ_INFO_INPUT_SYSTEM_ERROR            = 1 << 18,
-        /**< the input system in in error */
+        /** the input system in in error */
         IA_CSS_IRQ_INFO_IF_ERROR                      = 1 << 19,
-        /**< the input formatter in in error */
+        /** the input formatter in in error */
         IA_CSS_IRQ_INFO_DMA_ERROR                     = 1 << 20,
-        /**< the dma in in error */
+        /** the dma in in error */
         IA_CSS_IRQ_INFO_ISYS_EVENTS_READY             = 1 << 21,
-        /**< end-of-frame events are ready in the isys_event queue */
+        /** end-of-frame events are ready in the isys_event queue */
 };
 
-/** CSS receiver error types. Whenever the CSS receiver has encountered
+/* CSS receiver error types. Whenever the CSS receiver has encountered
  *  an error, this enumeration is used to indicate which errors have occurred.
  *
  *  Note that multiple error flags can be enabled at once and that this is in
@@ -105,39 +105,39 @@ enum ia_css_irq_info {
  * different receiver types, or possibly none in case of tests systems.
  */
 enum ia_css_rx_irq_info {
-        IA_CSS_RX_IRQ_INFO_BUFFER_OVERRUN   = 1U << 0, /**< buffer overrun */
-        IA_CSS_RX_IRQ_INFO_ENTER_SLEEP_MODE = 1U << 1, /**< entering sleep mode */
-        IA_CSS_RX_IRQ_INFO_EXIT_SLEEP_MODE  = 1U << 2, /**< exited sleep mode */
-        IA_CSS_RX_IRQ_INFO_ECC_CORRECTED    = 1U << 3, /**< ECC corrected */
+        IA_CSS_RX_IRQ_INFO_BUFFER_OVERRUN   = 1U << 0, /** buffer overrun */
+        IA_CSS_RX_IRQ_INFO_ENTER_SLEEP_MODE = 1U << 1, /** entering sleep mode */
+        IA_CSS_RX_IRQ_INFO_EXIT_SLEEP_MODE  = 1U << 2, /** exited sleep mode */
+        IA_CSS_RX_IRQ_INFO_ECC_CORRECTED    = 1U << 3, /** ECC corrected */
         IA_CSS_RX_IRQ_INFO_ERR_SOT          = 1U << 4,
-                                                /**< Start of transmission */
-        IA_CSS_RX_IRQ_INFO_ERR_SOT_SYNC     = 1U << 5, /**< SOT sync (??) */
-        IA_CSS_RX_IRQ_INFO_ERR_CONTROL      = 1U << 6, /**< Control (??) */
-        IA_CSS_RX_IRQ_INFO_ERR_ECC_DOUBLE   = 1U << 7, /**< Double ECC */
-        IA_CSS_RX_IRQ_INFO_ERR_CRC          = 1U << 8, /**< CRC error */
-        IA_CSS_RX_IRQ_INFO_ERR_UNKNOWN_ID   = 1U << 9, /**< Unknown ID */
-        IA_CSS_RX_IRQ_INFO_ERR_FRAME_SYNC   = 1U << 10,/**< Frame sync error */
-        IA_CSS_RX_IRQ_INFO_ERR_FRAME_DATA   = 1U << 11,/**< Frame data error */
-        IA_CSS_RX_IRQ_INFO_ERR_DATA_TIMEOUT = 1U << 12,/**< Timeout occurred */
-        IA_CSS_RX_IRQ_INFO_ERR_UNKNOWN_ESC  = 1U << 13,/**< Unknown escape seq. */
-        IA_CSS_RX_IRQ_INFO_ERR_LINE_SYNC    = 1U << 14,/**< Line Sync error */
+                                                /** Start of transmission */
+        IA_CSS_RX_IRQ_INFO_ERR_SOT_SYNC     = 1U << 5, /** SOT sync (??) */
+        IA_CSS_RX_IRQ_INFO_ERR_CONTROL      = 1U << 6, /** Control (??) */
+        IA_CSS_RX_IRQ_INFO_ERR_ECC_DOUBLE   = 1U << 7, /** Double ECC */
+        IA_CSS_RX_IRQ_INFO_ERR_CRC          = 1U << 8, /** CRC error */
+        IA_CSS_RX_IRQ_INFO_ERR_UNKNOWN_ID   = 1U << 9, /** Unknown ID */
+        IA_CSS_RX_IRQ_INFO_ERR_FRAME_SYNC   = 1U << 10,/** Frame sync error */
+        IA_CSS_RX_IRQ_INFO_ERR_FRAME_DATA   = 1U << 11,/** Frame data error */
+        IA_CSS_RX_IRQ_INFO_ERR_DATA_TIMEOUT = 1U << 12,/** Timeout occurred */
+        IA_CSS_RX_IRQ_INFO_ERR_UNKNOWN_ESC  = 1U << 13,/** Unknown escape seq. */
+        IA_CSS_RX_IRQ_INFO_ERR_LINE_SYNC    = 1U << 14,/** Line Sync error */
         IA_CSS_RX_IRQ_INFO_INIT_TIMEOUT     = 1U << 15,
 };
 
-/** Interrupt info structure. This structure contains information about an
+/* Interrupt info structure. This structure contains information about an
  *  interrupt. This needs to be used after an interrupt is received on the IA
  *  to perform the correct action.
  */
 struct ia_css_irq {
-        enum ia_css_irq_info type; /**< Interrupt type. */
-        unsigned int sw_irq_0_val; /**< In case of SW interrupt 0, value. */
-        unsigned int sw_irq_1_val; /**< In case of SW interrupt 1, value. */
-        unsigned int sw_irq_2_val; /**< In case of SW interrupt 2, value. */
+        enum ia_css_irq_info type; /** Interrupt type. */
+        unsigned int sw_irq_0_val; /** In case of SW interrupt 0, value. */
+        unsigned int sw_irq_1_val; /** In case of SW interrupt 1, value. */
+        unsigned int sw_irq_2_val; /** In case of SW interrupt 2, value. */
         struct ia_css_pipe *pipe;
-        /**< The image pipe that generated the interrupt. */
+        /** The image pipe that generated the interrupt. */
 };
 
-/** @brief Obtain interrupt information.
+/* @brief Obtain interrupt information.
  *
  * @param[out] info     Pointer to the interrupt info. The interrupt
  *                      information wil be written to this info.
@@ -154,7 +154,7 @@ struct ia_css_irq {
 enum ia_css_err
 ia_css_irq_translate(unsigned int *info);
 
-/** @brief Get CSI receiver error info.
+/* @brief Get CSI receiver error info.
  *
  * @param[out] irq_bits Pointer to the interrupt bits. The interrupt
  *                      bits will be written this info.
@@ -172,7 +172,7 @@ ia_css_irq_translate(unsigned int *info);
 void
 ia_css_rx_get_irq_info(unsigned int *irq_bits);
 
-/** @brief Get CSI receiver error info.
+/* @brief Get CSI receiver error info.
  *
  * @param[in]  port     Input port identifier.
  * @param[out] irq_bits Pointer to the interrupt bits. The interrupt
@@ -188,7 +188,7 @@ ia_css_rx_get_irq_info(unsigned int *irq_bits);
 void
 ia_css_rx_port_get_irq_info(enum ia_css_csi2_port port, unsigned int *irq_bits);
 
-/** @brief Clear CSI receiver error info.
+/* @brief Clear CSI receiver error info.
  *
  * @param[in] irq_bits  The bits that should be cleared from the CSI receiver
  *                      interrupt bits register.
@@ -205,7 +205,7 @@ ia_css_rx_port_get_irq_info(enum ia_css_csi2_port port, unsigned int *irq_bits);
 void
 ia_css_rx_clear_irq_info(unsigned int irq_bits);
 
-/** @brief Clear CSI receiver error info.
+/* @brief Clear CSI receiver error info.
  *
  * @param[in] port      Input port identifier.
  * @param[in] irq_bits  The bits that should be cleared from the CSI receiver
@@ -220,7 +220,7 @@ ia_css_rx_clear_irq_info(unsigned int irq_bits);
 void
 ia_css_rx_port_clear_irq_info(enum ia_css_csi2_port port, unsigned int irq_bits);
 
-/** @brief Enable or disable specific interrupts.
+/* @brief Enable or disable specific interrupts.
  *
  * @param[in] type      The interrupt type that will be enabled/disabled.
  * @param[in] enable    enable or disable.
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_metadata.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_metadata.h
index c40c5a19bfe1..8b674c98224c 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_metadata.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_metadata.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_METADATA_H
 #define __IA_CSS_METADATA_H
 
-/** @file
+/* @file
  * This file contains structure for processing sensor metadata.
  */
 
@@ -23,32 +23,32 @@
 #include "ia_css_types.h"
 #include "ia_css_stream_format.h"
 
-/** Metadata configuration. This data structure contains necessary info
+/* Metadata configuration. This data structure contains necessary info
  *  to process sensor metadata.
  */
 struct ia_css_metadata_config {
-        enum ia_css_stream_format data_type; /**< Data type of CSI-2 embedded
+        enum ia_css_stream_format data_type; /** Data type of CSI-2 embedded
                         data. The default value is IA_CSS_STREAM_FORMAT_EMBEDDED. For
                         certain sensors, user can choose non-default data type for embedded
                         data. */
-        struct ia_css_resolution  resolution; /**< Resolution */
+        struct ia_css_resolution  resolution; /** Resolution */
 };
 
 struct ia_css_metadata_info {
-        struct ia_css_resolution resolution; /**< Resolution */
-        uint32_t                 stride;     /**< Stride in bytes */
-        uint32_t                 size;       /**< Total size in bytes */
+        struct ia_css_resolution resolution; /** Resolution */
+        uint32_t                 stride;     /** Stride in bytes */
+        uint32_t                 size;       /** Total size in bytes */
 };
 
 struct ia_css_metadata {
-        struct ia_css_metadata_info info;    /**< Layout info */
-        ia_css_ptr                  address; /**< CSS virtual address */
+        struct ia_css_metadata_info info;    /** Layout info */
+        ia_css_ptr                  address; /** CSS virtual address */
         uint32_t                    exp_id;
-        /**< Exposure ID, see ia_css_event_public.h for more detail */
+        /** Exposure ID, see ia_css_event_public.h for more detail */
 };
 #define SIZE_OF_IA_CSS_METADATA_STRUCT sizeof(struct ia_css_metadata)
 
-/** @brief Allocate a metadata buffer.
+/* @brief Allocate a metadata buffer.
  * @param[in]   metadata_info Metadata info struct, contains details on metadata buffers.
  * @return      Pointer of metadata buffer or NULL (if error)
  *
@@ -58,7 +58,7 @@ struct ia_css_metadata {
 struct ia_css_metadata *
 ia_css_metadata_allocate(const struct ia_css_metadata_info *metadata_info);
 
-/** @brief Free a metadata buffer.
+/* @brief Free a metadata buffer.
  *
  * @param[in]   metadata        Pointer of metadata buffer.
  * @return      None
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_mipi.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_mipi.h
index fd2c01b60b28..f9c9cd76be97 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_mipi.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_mipi.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_MIPI_H
 #define __IA_CSS_MIPI_H
 
-/** @file
+/* @file
  * This file contains MIPI support functionality
  */
 
@@ -24,10 +24,10 @@
 #include "ia_css_stream_format.h"
 #include "ia_css_input_port.h"
 
-/** Backward compatible for CSS API 2.0 only
+/* Backward compatible for CSS API 2.0 only
  * TO BE REMOVED when all drivers move to CSS API 2.1.
  */
-/** @brief Specify a CSS MIPI frame buffer.
+/* @brief Specify a CSS MIPI frame buffer.
  *
  * @param[in]   size_mem_words  The frame size in memory words (32B).
  * @param[in]   contiguous      Allocate memory physically contiguously or not.
@@ -42,7 +42,7 @@ ia_css_mipi_frame_specify(const unsigned int	size_mem_words,
                                 const bool contiguous);
 
 #if !defined(HAS_NO_INPUT_SYSTEM)
-/** @brief Register size of a CSS MIPI frame for check during capturing.
+/* @brief Register size of a CSS MIPI frame for check during capturing.
  *
  * @param[in]   port    CSI-2 port this check is registered.
  * @param[in]   size_mem_words  The frame size in memory words (32B).
@@ -59,7 +59,7 @@ ia_css_mipi_frame_enable_check_on_size(const enum ia_css_csi2_port port,
                                 const unsigned int      size_mem_words);
 #endif
 
-/** @brief Calculate the size of a mipi frame.
+/* @brief Calculate the size of a mipi frame.
  *
  * @param[in]   width           The width (in pixels) of the frame.
  * @param[in]   height          The height (in lines) of the frame.
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_mmu.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_mmu.h
index 48f8855d61f6..13c21056bfbf 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_mmu.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_mmu.h
@@ -15,11 +15,11 @@
 #ifndef __IA_CSS_MMU_H
 #define __IA_CSS_MMU_H
 
-/** @file
+/* @file
  * This file contains one support function for invalidating the CSS MMU cache
  */
 
-/** @brief Invalidate the MMU internal cache.
+/* @brief Invalidate the MMU internal cache.
  * @return      None
  *
  * This function triggers an invalidation of the translate-look-aside
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_morph.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_morph.h
index 969840da52b2..de409638d009 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_morph.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_morph.h
@@ -15,13 +15,13 @@
 #ifndef __IA_CSS_MORPH_H
 #define __IA_CSS_MORPH_H
 
-/** @file
+/* @file
  * This file contains supporting for morphing table
  */
 
 #include <ia_css_types.h>
 
-/** @brief Morphing table
+/* @brief Morphing table
  * @param[in]   width Width of the morphing table.
  * @param[in]   height Height of the morphing table.
  * @return              Pointer to the morphing table
@@ -29,7 +29,7 @@
 struct ia_css_morph_table *
 ia_css_morph_table_allocate(unsigned int width, unsigned int height);
 
-/** @brief Free the morph table
+/* @brief Free the morph table
  * @param[in]   me Pointer to the morph table.
  * @return              None
 */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_pipe_public.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_pipe_public.h
index 733e0ef3afe8..df0aad9a6ab9 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_pipe_public.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_pipe_public.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_PIPE_PUBLIC_H
 #define __IA_CSS_PIPE_PUBLIC_H
 
-/** @file
+/* @file
  * This file contains the public interface for CSS pipes.
  */
 
@@ -34,7 +34,7 @@ enum {
         IA_CSS_PIPE_MAX_OUTPUT_STAGE,
 };
 
-/** Enumeration of pipe modes. This mode can be used to create
+/* Enumeration of pipe modes. This mode can be used to create
  *  an image pipe for this mode. These pipes can be combined
  *  to configure and run streams on the ISP.
  *
@@ -42,12 +42,12 @@ enum {
  *  create a continuous capture stream.
  */
 enum ia_css_pipe_mode {
-        IA_CSS_PIPE_MODE_PREVIEW,       /**< Preview pipe */
-        IA_CSS_PIPE_MODE_VIDEO,         /**< Video pipe */
-        IA_CSS_PIPE_MODE_CAPTURE,       /**< Still capture pipe */
-        IA_CSS_PIPE_MODE_ACC,           /**< Accelerated pipe */
-        IA_CSS_PIPE_MODE_COPY,          /**< Copy pipe, only used for embedded/image data copying */
-        IA_CSS_PIPE_MODE_YUVPP,         /**< YUV post processing pipe, used for all use cases with YUV input,
+        IA_CSS_PIPE_MODE_PREVIEW,       /** Preview pipe */
+        IA_CSS_PIPE_MODE_VIDEO,         /** Video pipe */
+        IA_CSS_PIPE_MODE_CAPTURE,       /** Still capture pipe */
+        IA_CSS_PIPE_MODE_ACC,           /** Accelerated pipe */
+        IA_CSS_PIPE_MODE_COPY,          /** Copy pipe, only used for embedded/image data copying */
+        IA_CSS_PIPE_MODE_YUVPP,         /** YUV post processing pipe, used for all use cases with YUV input,
                                                                         for SoC sensor and external ISP */
 };
 /* Temporary define  */
@@ -58,10 +58,10 @@ enum ia_css_pipe_mode {
  * the order should match with definition in sh_css_defs.h
  */
 enum ia_css_pipe_version {
-        IA_CSS_PIPE_VERSION_1 = 1,              /**< ISP1.0 pipe */
-        IA_CSS_PIPE_VERSION_2_2 = 2,            /**< ISP2.2 pipe */
-        IA_CSS_PIPE_VERSION_2_6_1 = 3,          /**< ISP2.6.1 pipe */
-        IA_CSS_PIPE_VERSION_2_7 = 4             /**< ISP2.7 pipe */
+        IA_CSS_PIPE_VERSION_1 = 1,              /** ISP1.0 pipe */
+        IA_CSS_PIPE_VERSION_2_2 = 2,            /** ISP2.2 pipe */
+        IA_CSS_PIPE_VERSION_2_6_1 = 3,          /** ISP2.6.1 pipe */
+        IA_CSS_PIPE_VERSION_2_7 = 4             /** ISP2.7 pipe */
 };
 
 /**
@@ -71,79 +71,79 @@ enum ia_css_pipe_version {
  */
 struct ia_css_pipe_config {
         enum ia_css_pipe_mode mode;
-        /**< mode, indicates which mode the pipe should use. */
+        /** mode, indicates which mode the pipe should use. */
         enum ia_css_pipe_version isp_pipe_version;
-        /**< pipe version, indicates which imaging pipeline the pipe should use. */
+        /** pipe version, indicates which imaging pipeline the pipe should use. */
         struct ia_css_resolution input_effective_res;
-        /**< input effective resolution */
+        /** input effective resolution */
         struct ia_css_resolution bayer_ds_out_res;
-        /**< bayer down scaling */
+        /** bayer down scaling */
         struct ia_css_resolution capt_pp_in_res;
 #ifndef ISP2401
-        /**< bayer down scaling */
+        /** bayer down scaling */
 #else
-        /**< capture post processing input resolution */
+        /** capture post processing input resolution */
 #endif
         struct ia_css_resolution vf_pp_in_res;
 #ifndef ISP2401
-        /**< bayer down scaling */
+        /** bayer down scaling */
 #else
-        /**< view finder post processing input resolution */
+        /** view finder post processing input resolution */
         struct ia_css_resolution output_system_in_res;
-        /**< For IPU3 only: use output_system_in_res to specify what input resolution
+        /** For IPU3 only: use output_system_in_res to specify what input resolution
              will OSYS receive, this resolution is equal to the output resolution of GDC
              if not determined CSS will set output_system_in_res with main osys output pin resolution
              All other IPUs may ignore this property */
 #endif
         struct ia_css_resolution dvs_crop_out_res;
-        /**< dvs crop, video only, not in use yet. Use dvs_envelope below. */
+        /** dvs crop, video only, not in use yet. Use dvs_envelope below. */
         struct ia_css_frame_info output_info[IA_CSS_PIPE_MAX_OUTPUT_STAGE];
-        /**< output of YUV scaling */
+        /** output of YUV scaling */
         struct ia_css_frame_info vf_output_info[IA_CSS_PIPE_MAX_OUTPUT_STAGE];
-        /**< output of VF YUV scaling */
+        /** output of VF YUV scaling */
         struct ia_css_fw_info *acc_extension;
-        /**< Pipeline extension accelerator */
+        /** Pipeline extension accelerator */
         struct ia_css_fw_info **acc_stages;
-        /**< Standalone accelerator stages */
+        /** Standalone accelerator stages */
         uint32_t num_acc_stages;
-        /**< Number of standalone accelerator stages */
+        /** Number of standalone accelerator stages */
         struct ia_css_capture_config default_capture_config;
-        /**< Default capture config for initial capture pipe configuration. */
-        struct ia_css_resolution dvs_envelope; /**< temporary */
+        /** Default capture config for initial capture pipe configuration. */
+        struct ia_css_resolution dvs_envelope; /** temporary */
         enum ia_css_frame_delay dvs_frame_delay;
-        /**< indicates the DVS loop delay in frame periods */
+        /** indicates the DVS loop delay in frame periods */
         int acc_num_execs;
-        /**< For acceleration pipes only: determine how many times the pipe
+        /** For acceleration pipes only: determine how many times the pipe
              should be run. Setting this to -1 means it will run until
              stopped. */
         bool enable_dz;
-        /**< Disabling digital zoom for a pipeline, if this is set to false,
+        /** Disabling digital zoom for a pipeline, if this is set to false,
              then setting a zoom factor will have no effect.
              In some use cases this provides better performance. */
         bool enable_dpc;
-        /**< Disabling "Defect Pixel Correction" for a pipeline, if this is set
+        /** Disabling "Defect Pixel Correction" for a pipeline, if this is set
              to false. In some use cases this provides better performance. */
         bool enable_vfpp_bci;
-        /**< Enabling BCI mode will cause yuv_scale binary to be picked up
+        /** Enabling BCI mode will cause yuv_scale binary to be picked up
              instead of vf_pp. This only applies to viewfinder post
              processing stages. */
 #ifdef ISP2401
         bool enable_luma_only;
-        /**< Enabling of monochrome mode for a pipeline. If enabled only luma processing
+        /** Enabling of monochrome mode for a pipeline. If enabled only luma processing
              will be done. */
         bool enable_tnr;
-        /**< Enabling of TNR (temporal noise reduction). This is only applicable to video
+        /** Enabling of TNR (temporal noise reduction). This is only applicable to video
              pipes. Non video-pipes should always set this parameter to false. */
 #endif
         struct ia_css_isp_config *p_isp_config;
-        /**< Pointer to ISP configuration */
+        /** Pointer to ISP configuration */
         struct ia_css_resolution gdc_in_buffer_res;
-        /**< GDC in buffer resolution. */
+        /** GDC in buffer resolution. */
         struct ia_css_point gdc_in_buffer_offset;
-        /**< GDC in buffer offset - indicates the pixel coordinates of the first valid pixel inside the buffer */
+        /** GDC in buffer offset - indicates the pixel coordinates of the first valid pixel inside the buffer */
 #ifdef ISP2401
         struct ia_css_coordinate internal_frame_origin_bqs_on_sctbl;
-        /**< Origin of internal frame positioned on shading table at shading correction in ISP.
+        /** Origin of internal frame positioned on shading table at shading correction in ISP.
              NOTE: Shading table is larger than or equal to internal frame.
                    Shading table has shading gains and internal frame has bayer data.
                    The origin of internal frame is used in shading correction in ISP
@@ -228,20 +228,20 @@ struct ia_css_pipe_config {
 
 #endif
 
-/** Pipe info, this struct describes properties of a pipe after it's stream has
+/* Pipe info, this struct describes properties of a pipe after it's stream has
  * been created.
  * ~~~** DO NOT ADD NEW FIELD **~~~ This structure will be deprecated.
  *           - On the Behalf of CSS-API Committee.
  */
 struct ia_css_pipe_info {
         struct ia_css_frame_info output_info[IA_CSS_PIPE_MAX_OUTPUT_STAGE];
-        /**< Info about output resolution. This contains the stride which
+        /** Info about output resolution. This contains the stride which
              should be used for memory allocation. */
         struct ia_css_frame_info vf_output_info[IA_CSS_PIPE_MAX_OUTPUT_STAGE];
-        /**< Info about viewfinder output resolution (optional). This contains
+        /** Info about viewfinder output resolution (optional). This contains
              the stride that should be used for memory allocation. */
         struct ia_css_frame_info raw_output_info;
-        /**< Raw output resolution. This indicates the resolution of the
+        /** Raw output resolution. This indicates the resolution of the
              RAW bayer output for pipes that support this. Currently, only the
              still capture pipes support this feature. When this resolution is
              smaller than the input resolution, cropping will be performed by
@@ -252,17 +252,17 @@ struct ia_css_pipe_info {
              the input resolution - 8x8. */
 #ifdef ISP2401
         struct ia_css_resolution output_system_in_res_info;
-        /**< For IPU3 only. Info about output system in resolution which is considered
+        /** For IPU3 only. Info about output system in resolution which is considered
              as gdc out resolution. */
 #endif
         struct ia_css_shading_info shading_info;
-        /**< After an image pipe is created, this field will contain the info
+        /** After an image pipe is created, this field will contain the info
              for the shading correction. */
         struct ia_css_grid_info  grid_info;
-        /**< After an image pipe is created, this field will contain the grid
+        /** After an image pipe is created, this field will contain the grid
              info for 3A and DVS. */
         int num_invalid_frames;
-        /**< The very first frames in a started stream do not contain valid data.
+        /** The very first frames in a started stream do not contain valid data.
              In this field, the CSS-firmware communicates to the host-driver how
              many initial frames will contain invalid data; this allows the
              host-driver to discard those initial invalid frames and start it's
@@ -299,7 +299,7 @@ struct ia_css_pipe_info {
 
 #endif
 
-/** @brief Load default pipe configuration
+/* @brief Load default pipe configuration
  * @param[out]  pipe_config The pipe configuration.
  * @return      None
  *
@@ -334,7 +334,7 @@ struct ia_css_pipe_info {
  */
 void ia_css_pipe_config_defaults(struct ia_css_pipe_config *pipe_config);
 
-/** @brief Create a pipe
+/* @brief Create a pipe
  * @param[in]   config The pipe configuration.
  * @param[out]  pipe The pipe.
  * @return      IA_CSS_SUCCESS or the error code.
@@ -346,7 +346,7 @@ enum ia_css_err
 ia_css_pipe_create(const struct ia_css_pipe_config *config,
                    struct ia_css_pipe **pipe);
 
-/** @brief Destroy a pipe
+/* @brief Destroy a pipe
  * @param[in]   pipe The pipe.
  * @return      IA_CSS_SUCCESS or the error code.
  *
@@ -355,7 +355,7 @@ ia_css_pipe_create(const struct ia_css_pipe_config *config,
 enum ia_css_err
 ia_css_pipe_destroy(struct ia_css_pipe *pipe);
 
-/** @brief Provides information about a pipe
+/* @brief Provides information about a pipe
  * @param[in]   pipe The pipe.
  * @param[out]  pipe_info The pipe information.
  * @return      IA_CSS_SUCCESS or IA_CSS_ERR_INVALID_ARGUMENTS.
@@ -366,7 +366,7 @@ enum ia_css_err
 ia_css_pipe_get_info(const struct ia_css_pipe *pipe,
                      struct ia_css_pipe_info *pipe_info);
 
-/** @brief Configure a pipe with filter coefficients.
+/* @brief Configure a pipe with filter coefficients.
  * @param[in]   pipe    The pipe.
  * @param[in]   config  The pointer to ISP configuration.
  * @return              IA_CSS_SUCCESS or error code upon error.
@@ -378,7 +378,7 @@ enum ia_css_err
 ia_css_pipe_set_isp_config(struct ia_css_pipe *pipe,
                                                    struct ia_css_isp_config *config);
 
-/** @brief Controls when the Event generator raises an IRQ to the Host.
+/* @brief Controls when the Event generator raises an IRQ to the Host.
  *
  * @param[in]   pipe    The pipe.
  * @param[in]   or_mask Binary or of enum ia_css_event_irq_mask_type. Each pipe
@@ -455,7 +455,7 @@ ia_css_pipe_set_irq_mask(struct ia_css_pipe *pipe,
                          unsigned int or_mask,
                          unsigned int and_mask);
 
-/** @brief Reads the current event IRQ mask from the CSS.
+/* @brief Reads the current event IRQ mask from the CSS.
  *
  * @param[in]   pipe The pipe.
  * @param[out]  or_mask Current or_mask. The bits in this mask are a binary or
@@ -476,7 +476,7 @@ ia_css_event_get_irq_mask(const struct ia_css_pipe *pipe,
                           unsigned int *or_mask,
                           unsigned int *and_mask);
 
-/** @brief Queue a buffer for an image pipe.
+/* @brief Queue a buffer for an image pipe.
  *
  * @param[in] pipe      The pipe that will own the buffer.
  * @param[in] buffer    Pointer to the buffer.
@@ -498,7 +498,7 @@ enum ia_css_err
 ia_css_pipe_enqueue_buffer(struct ia_css_pipe *pipe,
                            const struct ia_css_buffer *buffer);
 
-/** @brief Dequeue a buffer from an image pipe.
+/* @brief Dequeue a buffer from an image pipe.
  *
  * @param[in]    pipe    The pipeline that the buffer queue belongs to.
  * @param[in,out] buffer The buffer is used to lookup the type which determines
@@ -519,7 +519,7 @@ ia_css_pipe_dequeue_buffer(struct ia_css_pipe *pipe,
                            struct ia_css_buffer *buffer);
 
 
-/** @brief  Set the state (Enable or Disable) of the Extension stage in the
+/* @brief  Set the state (Enable or Disable) of the Extension stage in the
  *          given pipe.
  * @param[in] pipe         Pipe handle.
  * @param[in] fw_handle    Extension firmware Handle (ia_css_fw_info.handle)
@@ -546,7 +546,7 @@ ia_css_pipe_set_qos_ext_state (struct ia_css_pipe *pipe,
                            uint32_t fw_handle,
                            bool  enable);
 
-/** @brief  Get the state (Enable or Disable) of the Extension stage in the
+/* @brief  Get the state (Enable or Disable) of the Extension stage in the
  *          given pipe.
  * @param[in]  pipe        Pipe handle.
  * @param[in]  fw_handle   Extension firmware Handle (ia_css_fw_info.handle)
@@ -573,7 +573,7 @@ ia_css_pipe_get_qos_ext_state (struct ia_css_pipe *pipe,
                            bool * enable);
 
 #ifdef ISP2401
-/** @brief  Update mapped CSS and ISP arguments for QoS pipe during SP runtime.
+/* @brief  Update mapped CSS and ISP arguments for QoS pipe during SP runtime.
  * @param[in] pipe      Pipe handle.
  * @param[in] fw_handle Extension firmware Handle (ia_css_fw_info.handle).
  * @param[in] css_seg   Parameter memory descriptors for CSS segments.
@@ -595,7 +595,7 @@ ia_css_pipe_update_qos_ext_mapped_arg(struct ia_css_pipe *pipe, uint32_t fw_hand
                         struct ia_css_isp_param_isp_segments *isp_seg);
 
 #endif
-/** @brief Get selected configuration settings
+/* @brief Get selected configuration settings
  * @param[in]   pipe    The pipe.
  * @param[out]  config  Configuration settings.
  * @return              None
@@ -604,7 +604,7 @@ void
 ia_css_pipe_get_isp_config(struct ia_css_pipe *pipe,
                              struct ia_css_isp_config *config);
 
-/** @brief Set the scaler lut on this pipe. A copy of lut is made in the inuit
+/* @brief Set the scaler lut on this pipe. A copy of lut is made in the inuit
  *         address space. So the LUT can be freed by caller.
  * @param[in]  pipe        Pipe handle.
  * @param[in]  lut         Look up tabel
@@ -623,7 +623,7 @@ ia_css_pipe_get_isp_config(struct ia_css_pipe *pipe,
 enum ia_css_err
 ia_css_pipe_set_bci_scaler_lut( struct ia_css_pipe *pipe,
                                 const void *lut);
-/** @brief Checking of DVS statistics ability
+/* @brief Checking of DVS statistics ability
  * @param[in]   pipe_info       The pipe info.
  * @return              true - has DVS statistics ability
  *                      false - otherwise
@@ -631,7 +631,7 @@ ia_css_pipe_set_bci_scaler_lut( struct ia_css_pipe *pipe,
 bool ia_css_pipe_has_dvs_stats(struct ia_css_pipe_info *pipe_info);
 
 #ifdef ISP2401
-/** @brief Override the frameformat set on the output pins.
+/* @brief Override the frameformat set on the output pins.
  * @param[in]  pipe        Pipe handle.
  * @param[in]  output_pin  Pin index to set the format on
  *                         0 - main output pin
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_prbs.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_prbs.h
index 9b0eeb08ca04..6f24656b6cb4 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_prbs.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_prbs.h
@@ -15,11 +15,11 @@
 #ifndef __IA_CSS_PRBS_H
 #define __IA_CSS_PRBS_H
 
-/** @file
+/* @file
  * This file contains support for Pseudo Random Bit Sequence (PRBS) inputs
  */
 
-/** Enumerate the PRBS IDs.
+/* Enumerate the PRBS IDs.
  */
 enum ia_css_prbs_id {
         IA_CSS_PRBS_ID0,
@@ -44,10 +44,10 @@ enum ia_css_prbs_id {
  */
 struct ia_css_prbs_config {
         enum ia_css_prbs_id     id;
-        unsigned int            h_blank;        /**< horizontal blank */
-        unsigned int            v_blank;        /**< vertical blank */
-        int                     seed;   /**< random seed for the 1st 2-pixel-components/clock */
-        int                     seed1;  /**< random seed for the 2nd 2-pixel-components/clock */
+        unsigned int            h_blank;        /** horizontal blank */
+        unsigned int            v_blank;        /** vertical blank */
+        int                     seed;   /** random seed for the 1st 2-pixel-components/clock */
+        int                     seed1;  /** random seed for the 2nd 2-pixel-components/clock */
 };
 
 #endif /* __IA_CSS_PRBS_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_properties.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_properties.h
index 19af4021b24c..9a167306611c 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_properties.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_properties.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_PROPERTIES_H
 #define __IA_CSS_PROPERTIES_H
 
-/** @file
+/* @file
  * This file contains support for retrieving properties of some hardware the CSS system
  */
 
@@ -24,12 +24,12 @@
 
 struct ia_css_properties {
         int  gdc_coord_one;
-        bool l1_base_is_index; /**< Indicate whether the L1 page base
+        bool l1_base_is_index; /** Indicate whether the L1 page base
                                     is a page index or a byte address. */
         enum ia_css_vamem_type vamem_type;
 };
 
-/** @brief Get hardware properties
+/* @brief Get hardware properties
  * @param[in,out]       properties The hardware properties
  * @return      None
  *
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_shading.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_shading.h
index cb0f249e98c8..588f53d32b72 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_shading.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_shading.h
@@ -15,13 +15,13 @@
 #ifndef __IA_CSS_SHADING_H
 #define __IA_CSS_SHADING_H
 
-/** @file
+/* @file
  * This file contains support for setting the shading table for CSS
  */
 
 #include <ia_css_types.h>
 
-/** @brief Shading table
+/* @brief Shading table
  * @param[in]   width Width of the shading table.
  * @param[in]   height Height of the shading table.
  * @return              Pointer to the shading table
@@ -30,7 +30,7 @@ struct ia_css_shading_table *
 ia_css_shading_table_alloc(unsigned int width,
                            unsigned int height);
 
-/** @brief Free shading table
+/* @brief Free shading table
  * @param[in]   table Pointer to the shading table.
  * @return              None
 */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_stream.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_stream.h
index 453fe4db0133..fb6e8c2ca8bf 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_stream.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_stream.h
@@ -48,7 +48,7 @@ struct ia_css_stream {
         bool                           started;
 };
 
-/** @brief Get a binary in the stream, which binary has the shading correction.
+/* @brief Get a binary in the stream, which binary has the shading correction.
  *
  * @param[in] stream: The stream.
  * @return      The binary which has the shading correction.
@@ -76,7 +76,7 @@ sh_css_invalidate_params(struct ia_css_stream *stream);
 const struct ia_css_fpn_table *
 ia_css_get_fpn_table(struct ia_css_stream *stream);
 
-/** @brief Get a pointer to the shading table.
+/* @brief Get a pointer to the shading table.
  *
  * @param[in] stream: The stream.
  * @return      The pointer to the shading table.
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_stream_format.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_stream_format.h
index ae608a9c9051..f7e9020a86e1 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_stream_format.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_stream_format.h
@@ -15,74 +15,74 @@
 #ifndef __IA_CSS_STREAM_FORMAT_H
 #define __IA_CSS_STREAM_FORMAT_H
 
-/** @file
+/* @file
  * This file contains formats usable for ISP streaming input
  */
 
 #include <type_support.h> /* bool */
 
-/** The ISP streaming input interface supports the following formats.
+/* The ISP streaming input interface supports the following formats.
  *  These match the corresponding MIPI formats.
  */
 enum ia_css_stream_format {
-        IA_CSS_STREAM_FORMAT_YUV420_8_LEGACY,    /**< 8 bits per subpixel */
-        IA_CSS_STREAM_FORMAT_YUV420_8,  /**< 8 bits per subpixel */
-        IA_CSS_STREAM_FORMAT_YUV420_10, /**< 10 bits per subpixel */
-        IA_CSS_STREAM_FORMAT_YUV420_16, /**< 16 bits per subpixel */
-        IA_CSS_STREAM_FORMAT_YUV422_8,  /**< UYVY..UYVY, 8 bits per subpixel */
-        IA_CSS_STREAM_FORMAT_YUV422_10, /**< UYVY..UYVY, 10 bits per subpixel */
-        IA_CSS_STREAM_FORMAT_YUV422_16, /**< UYVY..UYVY, 16 bits per subpixel */
-        IA_CSS_STREAM_FORMAT_RGB_444,  /**< BGR..BGR, 4 bits per subpixel */
-        IA_CSS_STREAM_FORMAT_RGB_555,  /**< BGR..BGR, 5 bits per subpixel */
-        IA_CSS_STREAM_FORMAT_RGB_565,  /**< BGR..BGR, 5 bits B and R, 6 bits G */
-        IA_CSS_STREAM_FORMAT_RGB_666,  /**< BGR..BGR, 6 bits per subpixel */
-        IA_CSS_STREAM_FORMAT_RGB_888,  /**< BGR..BGR, 8 bits per subpixel */
-        IA_CSS_STREAM_FORMAT_RAW_6,    /**< RAW data, 6 bits per pixel */
-        IA_CSS_STREAM_FORMAT_RAW_7,    /**< RAW data, 7 bits per pixel */
-        IA_CSS_STREAM_FORMAT_RAW_8,    /**< RAW data, 8 bits per pixel */
-        IA_CSS_STREAM_FORMAT_RAW_10,   /**< RAW data, 10 bits per pixel */
-        IA_CSS_STREAM_FORMAT_RAW_12,   /**< RAW data, 12 bits per pixel */
-        IA_CSS_STREAM_FORMAT_RAW_14,   /**< RAW data, 14 bits per pixel */
-        IA_CSS_STREAM_FORMAT_RAW_16,   /**< RAW data, 16 bits per pixel, which is
+        IA_CSS_STREAM_FORMAT_YUV420_8_LEGACY,    /** 8 bits per subpixel */
+        IA_CSS_STREAM_FORMAT_YUV420_8,  /** 8 bits per subpixel */
+        IA_CSS_STREAM_FORMAT_YUV420_10, /** 10 bits per subpixel */
+        IA_CSS_STREAM_FORMAT_YUV420_16, /** 16 bits per subpixel */
+        IA_CSS_STREAM_FORMAT_YUV422_8,  /** UYVY..UYVY, 8 bits per subpixel */
+        IA_CSS_STREAM_FORMAT_YUV422_10, /** UYVY..UYVY, 10 bits per subpixel */
+        IA_CSS_STREAM_FORMAT_YUV422_16, /** UYVY..UYVY, 16 bits per subpixel */
+        IA_CSS_STREAM_FORMAT_RGB_444,  /** BGR..BGR, 4 bits per subpixel */
+        IA_CSS_STREAM_FORMAT_RGB_555,  /** BGR..BGR, 5 bits per subpixel */
+        IA_CSS_STREAM_FORMAT_RGB_565,  /** BGR..BGR, 5 bits B and R, 6 bits G */
+        IA_CSS_STREAM_FORMAT_RGB_666,  /** BGR..BGR, 6 bits per subpixel */
+        IA_CSS_STREAM_FORMAT_RGB_888,  /** BGR..BGR, 8 bits per subpixel */
+        IA_CSS_STREAM_FORMAT_RAW_6,    /** RAW data, 6 bits per pixel */
+        IA_CSS_STREAM_FORMAT_RAW_7,    /** RAW data, 7 bits per pixel */
+        IA_CSS_STREAM_FORMAT_RAW_8,    /** RAW data, 8 bits per pixel */
+        IA_CSS_STREAM_FORMAT_RAW_10,   /** RAW data, 10 bits per pixel */
+        IA_CSS_STREAM_FORMAT_RAW_12,   /** RAW data, 12 bits per pixel */
+        IA_CSS_STREAM_FORMAT_RAW_14,   /** RAW data, 14 bits per pixel */
+        IA_CSS_STREAM_FORMAT_RAW_16,   /** RAW data, 16 bits per pixel, which is
                                             not specified in CSI-MIPI standard*/
-        IA_CSS_STREAM_FORMAT_BINARY_8, /**< Binary byte stream, which is target at
+        IA_CSS_STREAM_FORMAT_BINARY_8, /** Binary byte stream, which is target at
                                             JPEG. */
 
-        /** CSI2-MIPI specific format: Generic short packet data. It is used to
+        /* CSI2-MIPI specific format: Generic short packet data. It is used to
          *  keep the timing information for the opening/closing of shutters,
          *  triggering of flashes and etc.
          */
-        IA_CSS_STREAM_FORMAT_GENERIC_SHORT1,  /**< Generic Short Packet Code 1 */
-        IA_CSS_STREAM_FORMAT_GENERIC_SHORT2,  /**< Generic Short Packet Code 2 */
-        IA_CSS_STREAM_FORMAT_GENERIC_SHORT3,  /**< Generic Short Packet Code 3 */
-        IA_CSS_STREAM_FORMAT_GENERIC_SHORT4,  /**< Generic Short Packet Code 4 */
-        IA_CSS_STREAM_FORMAT_GENERIC_SHORT5,  /**< Generic Short Packet Code 5 */
-        IA_CSS_STREAM_FORMAT_GENERIC_SHORT6,  /**< Generic Short Packet Code 6 */
-        IA_CSS_STREAM_FORMAT_GENERIC_SHORT7,  /**< Generic Short Packet Code 7 */
-        IA_CSS_STREAM_FORMAT_GENERIC_SHORT8,  /**< Generic Short Packet Code 8 */
+        IA_CSS_STREAM_FORMAT_GENERIC_SHORT1,  /** Generic Short Packet Code 1 */
+        IA_CSS_STREAM_FORMAT_GENERIC_SHORT2,  /** Generic Short Packet Code 2 */
+        IA_CSS_STREAM_FORMAT_GENERIC_SHORT3,  /** Generic Short Packet Code 3 */
+        IA_CSS_STREAM_FORMAT_GENERIC_SHORT4,  /** Generic Short Packet Code 4 */
+        IA_CSS_STREAM_FORMAT_GENERIC_SHORT5,  /** Generic Short Packet Code 5 */
+        IA_CSS_STREAM_FORMAT_GENERIC_SHORT6,  /** Generic Short Packet Code 6 */
+        IA_CSS_STREAM_FORMAT_GENERIC_SHORT7,  /** Generic Short Packet Code 7 */
+        IA_CSS_STREAM_FORMAT_GENERIC_SHORT8,  /** Generic Short Packet Code 8 */
 
-        /** CSI2-MIPI specific format: YUV data.
+        /* CSI2-MIPI specific format: YUV data.
          */
-        IA_CSS_STREAM_FORMAT_YUV420_8_SHIFT,  /**< YUV420 8-bit (Chroma Shifted Pixel Sampling) */
-        IA_CSS_STREAM_FORMAT_YUV420_10_SHIFT, /**< YUV420 8-bit (Chroma Shifted Pixel Sampling) */
+        IA_CSS_STREAM_FORMAT_YUV420_8_SHIFT,  /** YUV420 8-bit (Chroma Shifted Pixel Sampling) */
+        IA_CSS_STREAM_FORMAT_YUV420_10_SHIFT, /** YUV420 8-bit (Chroma Shifted Pixel Sampling) */
 
-        /** CSI2-MIPI specific format: Generic long packet data
+        /* CSI2-MIPI specific format: Generic long packet data
          */
-        IA_CSS_STREAM_FORMAT_EMBEDDED, /**< Embedded 8-bit non Image Data */
+        IA_CSS_STREAM_FORMAT_EMBEDDED, /** Embedded 8-bit non Image Data */
 
-        /** CSI2-MIPI specific format: User defined byte-based data. For example,
+        /* CSI2-MIPI specific format: User defined byte-based data. For example,
          *  the data transmitter (e.g. the SoC sensor) can keep the JPEG data as
          *  the User Defined Data Type 4 and the MPEG data as the
          *  User Defined Data Type 7.
          */
-        IA_CSS_STREAM_FORMAT_USER_DEF1,  /**< User defined 8-bit data type 1 */
-        IA_CSS_STREAM_FORMAT_USER_DEF2,  /**< User defined 8-bit data type 2 */
-        IA_CSS_STREAM_FORMAT_USER_DEF3,  /**< User defined 8-bit data type 3 */
-        IA_CSS_STREAM_FORMAT_USER_DEF4,  /**< User defined 8-bit data type 4 */
-        IA_CSS_STREAM_FORMAT_USER_DEF5,  /**< User defined 8-bit data type 5 */
-        IA_CSS_STREAM_FORMAT_USER_DEF6,  /**< User defined 8-bit data type 6 */
-        IA_CSS_STREAM_FORMAT_USER_DEF7,  /**< User defined 8-bit data type 7 */
-        IA_CSS_STREAM_FORMAT_USER_DEF8,  /**< User defined 8-bit data type 8 */
+        IA_CSS_STREAM_FORMAT_USER_DEF1,  /** User defined 8-bit data type 1 */
+        IA_CSS_STREAM_FORMAT_USER_DEF2,  /** User defined 8-bit data type 2 */
+        IA_CSS_STREAM_FORMAT_USER_DEF3,  /** User defined 8-bit data type 3 */
+        IA_CSS_STREAM_FORMAT_USER_DEF4,  /** User defined 8-bit data type 4 */
+        IA_CSS_STREAM_FORMAT_USER_DEF5,  /** User defined 8-bit data type 5 */
+        IA_CSS_STREAM_FORMAT_USER_DEF6,  /** User defined 8-bit data type 6 */
+        IA_CSS_STREAM_FORMAT_USER_DEF7,  /** User defined 8-bit data type 7 */
+        IA_CSS_STREAM_FORMAT_USER_DEF8,  /** User defined 8-bit data type 8 */
 };
 
 #define IA_CSS_STREAM_FORMAT_NUM        IA_CSS_STREAM_FORMAT_USER_DEF8
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_stream_public.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_stream_public.h
index 2c8d9de10a59..ca3203357ff5 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_stream_public.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_stream_public.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_STREAM_PUBLIC_H
 #define __IA_CSS_STREAM_PUBLIC_H
 
-/** @file
+/* @file
  * This file contains support for configuring and controlling streams
  */
 
@@ -27,26 +27,26 @@
 #include "ia_css_prbs.h"
 #include "ia_css_input_port.h"
 
-/** Input modes, these enumerate all supported input modes.
+/* Input modes, these enumerate all supported input modes.
  *  Note that not all ISP modes support all input modes.
  */
 enum ia_css_input_mode {
-        IA_CSS_INPUT_MODE_SENSOR, /**< data from sensor */
-        IA_CSS_INPUT_MODE_FIFO,   /**< data from input-fifo */
-        IA_CSS_INPUT_MODE_TPG,    /**< data from test-pattern generator */
-        IA_CSS_INPUT_MODE_PRBS,   /**< data from pseudo-random bit stream */
-        IA_CSS_INPUT_MODE_MEMORY, /**< data from a frame in memory */
-        IA_CSS_INPUT_MODE_BUFFERED_SENSOR /**< data is sent through mipi buffer */
+        IA_CSS_INPUT_MODE_SENSOR, /** data from sensor */
+        IA_CSS_INPUT_MODE_FIFO,   /** data from input-fifo */
+        IA_CSS_INPUT_MODE_TPG,    /** data from test-pattern generator */
+        IA_CSS_INPUT_MODE_PRBS,   /** data from pseudo-random bit stream */
+        IA_CSS_INPUT_MODE_MEMORY, /** data from a frame in memory */
+        IA_CSS_INPUT_MODE_BUFFERED_SENSOR /** data is sent through mipi buffer */
 };
 
-/** Structure of the MIPI buffer configuration
+/* Structure of the MIPI buffer configuration
  */
 struct ia_css_mipi_buffer_config {
-        unsigned int size_mem_words; /**< The frame size in the system memory
+        unsigned int size_mem_words; /** The frame size in the system memory
                                           words (32B) */
-        bool contiguous;             /**< Allocated memory physically
+        bool contiguous;             /** Allocated memory physically
                                           contiguously or not. \deprecated{Will be false always.}*/
-        unsigned int nof_mipi_buffers; /**< The number of MIPI buffers required for this
+        unsigned int nof_mipi_buffers; /** The number of MIPI buffers required for this
                                         stream */
 };
 
@@ -57,44 +57,44 @@ enum {
         IA_CSS_STREAM_MAX_ISYS_STREAM_PER_CH
 };
 
-/** This is input data configuration for one MIPI data type. We can have
+/* This is input data configuration for one MIPI data type. We can have
  *  multiple of this in one virtual channel.
  */
 struct ia_css_stream_isys_stream_config {
-        struct ia_css_resolution  input_res; /**< Resolution of input data */
-        enum ia_css_stream_format format; /**< Format of input stream. This data
+        struct ia_css_resolution  input_res; /** Resolution of input data */
+        enum ia_css_stream_format format; /** Format of input stream. This data
                                                format will be mapped to MIPI data
                                                type internally. */
-        int linked_isys_stream_id; /**< default value is -1, other value means
+        int linked_isys_stream_id; /** default value is -1, other value means
                                                         current isys_stream shares the same buffer with
                                                         indicated isys_stream*/
-        bool valid; /**< indicate whether other fields have valid value */
+        bool valid; /** indicate whether other fields have valid value */
 };
 
 struct ia_css_stream_input_config {
-        struct ia_css_resolution  input_res; /**< Resolution of input data */
-        struct ia_css_resolution  effective_res; /**< Resolution of input data.
+        struct ia_css_resolution  input_res; /** Resolution of input data */
+        struct ia_css_resolution  effective_res; /** Resolution of input data.
                                                         Used for CSS 2400/1 System and deprecated for other
                                                         systems (replaced by input_effective_res in
                                                         ia_css_pipe_config) */
-        enum ia_css_stream_format format; /**< Format of input stream. This data
+        enum ia_css_stream_format format; /** Format of input stream. This data
                                                format will be mapped to MIPI data
                                                type internally. */
-        enum ia_css_bayer_order bayer_order; /**< Bayer order for RAW streams */
+        enum ia_css_bayer_order bayer_order; /** Bayer order for RAW streams */
 };
 
 
-/** Input stream description. This describes how input will flow into the
+/* Input stream description. This describes how input will flow into the
  *  CSS. This is used to program the CSS hardware.
  */
 struct ia_css_stream_config {
-        enum ia_css_input_mode    mode; /**< Input mode */
+        enum ia_css_input_mode    mode; /** Input mode */
         union {
-                struct ia_css_input_port  port; /**< Port, for sensor only. */
-                struct ia_css_tpg_config  tpg;  /**< TPG configuration */
-                struct ia_css_prbs_config prbs; /**< PRBS configuration */
-        } source; /**< Source of input data */
-        unsigned int          channel_id; /**< Channel on which input data
+                struct ia_css_input_port  port; /** Port, for sensor only. */
+                struct ia_css_tpg_config  tpg;  /** TPG configuration */
+                struct ia_css_prbs_config prbs; /** PRBS configuration */
+        } source; /** Source of input data */
+        unsigned int          channel_id; /** Channel on which input data
                                                    will arrive. Use this field
                                                    to specify virtual channel id.
                                                    Valid values are: 0, 1, 2, 3 */
@@ -110,29 +110,29 @@ struct ia_css_stream_config {
          * and will be deprecated. In the future,all platforms will use the N*N method
          */
 #endif
-        unsigned int sensor_binning_factor; /**< Binning factor used by sensor
+        unsigned int sensor_binning_factor; /** Binning factor used by sensor
                                                  to produce image data. This is
                                                  used for shading correction. */
-        unsigned int pixels_per_clock; /**< Number of pixels per clock, which can be
+        unsigned int pixels_per_clock; /** Number of pixels per clock, which can be
                                             1, 2 or 4. */
-        bool online; /**< offline will activate RAW copy on SP, use this for
+        bool online; /** offline will activate RAW copy on SP, use this for
                           continuous capture. */
                 /* ISYS2401 usage: ISP receives data directly from sensor, no copy. */
-        unsigned init_num_cont_raw_buf; /**< initial number of raw buffers to
+        unsigned init_num_cont_raw_buf; /** initial number of raw buffers to
                                              allocate */
-        unsigned target_num_cont_raw_buf; /**< total number of raw buffers to
+        unsigned target_num_cont_raw_buf; /** total number of raw buffers to
                                              allocate */
-        bool pack_raw_pixels; /**< Pack pixels in the raw buffers */
-        bool continuous; /**< Use SP copy feature to continuously capture frames
+        bool pack_raw_pixels; /** Pack pixels in the raw buffers */
+        bool continuous; /** Use SP copy feature to continuously capture frames
                               to system memory and run pipes in offline mode */
-        bool disable_cont_viewfinder; /**< disable continous viewfinder for ZSL use case */
-        int32_t flash_gpio_pin; /**< pin on which the flash is connected, -1 for no flash */
-        int left_padding; /**< The number of input-formatter left-paddings, -1 for default from binary.*/
-        struct ia_css_mipi_buffer_config mipi_buffer_config; /**< mipi buffer configuration */
-        struct ia_css_metadata_config   metadata_config;     /**< Metadata configuration. */
-        bool ia_css_enable_raw_buffer_locking; /**< Enable Raw Buffer Locking for HALv3 Support */
+        bool disable_cont_viewfinder; /** disable continous viewfinder for ZSL use case */
+        int32_t flash_gpio_pin; /** pin on which the flash is connected, -1 for no flash */
+        int left_padding; /** The number of input-formatter left-paddings, -1 for default from binary.*/
+        struct ia_css_mipi_buffer_config mipi_buffer_config; /** mipi buffer configuration */
+        struct ia_css_metadata_config   metadata_config;     /** Metadata configuration. */
+        bool ia_css_enable_raw_buffer_locking; /** Enable Raw Buffer Locking for HALv3 Support */
         bool lock_all;
-        /**< Lock all RAW buffers (true) or lock only buffers processed by
+        /** Lock all RAW buffers (true) or lock only buffers processed by
              video or preview pipe (false).
              This setting needs to be enabled to allow raw buffer locking
              without continuous viewfinder. */
@@ -140,15 +140,15 @@ struct ia_css_stream_config {
 
 struct ia_css_stream;
 
-/** Stream info, this struct describes properties of a stream after it has been
+/* Stream info, this struct describes properties of a stream after it has been
  *  created.
  */
 struct ia_css_stream_info {
         struct ia_css_metadata_info metadata_info;
-        /**< Info about the metadata layout, this contains the stride. */
+        /** Info about the metadata layout, this contains the stride. */
 };
 
-/** @brief Load default stream configuration
+/* @brief Load default stream configuration
  * @param[in,out]       stream_config The stream configuration.
  * @return      None
  *
@@ -165,7 +165,7 @@ void ia_css_stream_config_defaults(struct ia_css_stream_config *stream_config);
  * create the internal structures and fill in the configuration data and pipes
  */
 
- /** @brief Creates a stream
+ /* @brief Creates a stream
  * @param[in]   stream_config The stream configuration.
  * @param[in]   num_pipes The number of pipes to incorporate in the stream.
  * @param[in]   pipes The pipes.
@@ -180,7 +180,7 @@ ia_css_stream_create(const struct ia_css_stream_config *stream_config,
                                          struct ia_css_pipe *pipes[],
                                          struct ia_css_stream **stream);
 
-/** @brief Destroys a stream
+/* @brief Destroys a stream
  * @param[in]   stream The stream.
  * @return      IA_CSS_SUCCESS or the error code.
  *
@@ -189,7 +189,7 @@ ia_css_stream_create(const struct ia_css_stream_config *stream_config,
 enum ia_css_err
 ia_css_stream_destroy(struct ia_css_stream *stream);
 
-/** @brief Provides information about a stream
+/* @brief Provides information about a stream
  * @param[in]   stream The stream.
  * @param[out]  stream_info The information about the stream.
  * @return      IA_CSS_SUCCESS or the error code.
@@ -200,7 +200,7 @@ enum ia_css_err
 ia_css_stream_get_info(const struct ia_css_stream *stream,
                        struct ia_css_stream_info *stream_info);
 
-/** @brief load (rebuild) a stream that was unloaded.
+/* @brief load (rebuild) a stream that was unloaded.
  * @param[in]   stream The stream
  * @return              IA_CSS_SUCCESS or the error code
  *
@@ -210,7 +210,7 @@ ia_css_stream_get_info(const struct ia_css_stream *stream,
 enum ia_css_err
 ia_css_stream_load(struct ia_css_stream *stream);
 
-/** @brief Starts the stream.
+/* @brief Starts the stream.
  * @param[in]   stream The stream.
  * @return IA_CSS_SUCCESS or the error code.
  *
@@ -223,7 +223,7 @@ ia_css_stream_load(struct ia_css_stream *stream);
 enum ia_css_err
 ia_css_stream_start(struct ia_css_stream *stream);
 
-/** @brief Stop the stream.
+/* @brief Stop the stream.
  * @param[in]   stream The stream.
  * @return      IA_CSS_SUCCESS or the error code.
  *
@@ -233,7 +233,7 @@ ia_css_stream_start(struct ia_css_stream *stream);
 enum ia_css_err
 ia_css_stream_stop(struct ia_css_stream *stream);
 
-/** @brief Check if a stream has stopped
+/* @brief Check if a stream has stopped
  * @param[in]   stream The stream.
  * @return      boolean flag
  *
@@ -242,7 +242,7 @@ ia_css_stream_stop(struct ia_css_stream *stream);
 bool
 ia_css_stream_has_stopped(struct ia_css_stream *stream);
 
-/** @brief      destroy a stream according to the stream seed previosly saved in the seed array.
+/* @brief       destroy a stream according to the stream seed previosly saved in the seed array.
  * @param[in]   stream The stream.
  * @return      IA_CSS_SUCCESS (no other errors are generated now)
  *
@@ -251,7 +251,7 @@ ia_css_stream_has_stopped(struct ia_css_stream *stream);
 enum ia_css_err
 ia_css_stream_unload(struct ia_css_stream *stream);
 
-/** @brief Returns stream format
+/* @brief Returns stream format
  * @param[in]   stream The stream.
  * @return      format of the string
  *
@@ -260,7 +260,7 @@ ia_css_stream_unload(struct ia_css_stream *stream);
 enum ia_css_stream_format
 ia_css_stream_get_format(const struct ia_css_stream *stream);
 
-/** @brief Check if the stream is configured for 2 pixels per clock
+/* @brief Check if the stream is configured for 2 pixels per clock
  * @param[in]   stream The stream.
  * @return      boolean flag
  *
@@ -270,7 +270,7 @@ ia_css_stream_get_format(const struct ia_css_stream *stream);
 bool
 ia_css_stream_get_two_pixels_per_clock(const struct ia_css_stream *stream);
 
-/** @brief Sets the output frame stride (at the last pipe)
+/* @brief Sets the output frame stride (at the last pipe)
  * @param[in]   stream The stream
  * @param[in]   output_padded_width - the output buffer stride.
  * @return      ia_css_err
@@ -280,7 +280,7 @@ ia_css_stream_get_two_pixels_per_clock(const struct ia_css_stream *stream);
 enum ia_css_err
 ia_css_stream_set_output_padded_width(struct ia_css_stream *stream, unsigned int output_padded_width);
 
-/** @brief Return max number of continuous RAW frames.
+/* @brief Return max number of continuous RAW frames.
  * @param[in]   stream The stream.
  * @param[out]  buffer_depth The maximum number of continuous RAW frames.
  * @return      IA_CSS_SUCCESS or IA_CSS_ERR_INVALID_ARGUMENTS
@@ -291,7 +291,7 @@ ia_css_stream_set_output_padded_width(struct ia_css_stream *stream, unsigned int
 enum ia_css_err
 ia_css_stream_get_max_buffer_depth(struct ia_css_stream *stream, int *buffer_depth);
 
-/** @brief Set nr of continuous RAW frames to use.
+/* @brief Set nr of continuous RAW frames to use.
  *
  * @param[in]   stream The stream.
  * @param[in]   buffer_depth    Number of frames to set.
@@ -302,7 +302,7 @@ ia_css_stream_get_max_buffer_depth(struct ia_css_stream *stream, int *buffer_dep
 enum ia_css_err
 ia_css_stream_set_buffer_depth(struct ia_css_stream *stream, int buffer_depth);
 
-/** @brief Get number of continuous RAW frames to use.
+/* @brief Get number of continuous RAW frames to use.
  * @param[in]   stream The stream.
  * @param[out]  buffer_depth The number of frames to use
  * @return      IA_CSS_SUCCESS or IA_CSS_ERR_INVALID_ARGUMENTS
@@ -315,7 +315,7 @@ ia_css_stream_get_buffer_depth(struct ia_css_stream *stream, int *buffer_depth);
 
 /* ===== CAPTURE ===== */
 
-/** @brief Configure the continuous capture
+/* @brief Configure the continuous capture
  *
  * @param[in]   stream          The stream.
  * @param[in]   num_captures    The number of RAW frames to be processed to
@@ -347,7 +347,7 @@ ia_css_stream_capture(struct ia_css_stream *stream,
                         unsigned int skip,
                         int offset);
 
-/** @brief Specify which raw frame to tag based on exp_id found in frame info
+/* @brief Specify which raw frame to tag based on exp_id found in frame info
  *
  * @param[in]   stream The stream.
  * @param[in]   exp_id  The exposure id of the raw frame to tag.
@@ -363,7 +363,7 @@ ia_css_stream_capture_frame(struct ia_css_stream *stream,
 
 /* ===== VIDEO ===== */
 
-/** @brief Send streaming data into the css input FIFO
+/* @brief Send streaming data into the css input FIFO
  *
  * @param[in]   stream  The stream.
  * @param[in]   data    Pointer to the pixels to be send.
@@ -395,7 +395,7 @@ ia_css_stream_send_input_frame(const struct ia_css_stream *stream,
                                unsigned int width,
                                unsigned int height);
 
-/** @brief Start an input frame on the CSS input FIFO.
+/* @brief Start an input frame on the CSS input FIFO.
  *
  * @param[in]   stream The stream.
  * @return      None
@@ -411,7 +411,7 @@ ia_css_stream_send_input_frame(const struct ia_css_stream *stream,
 void
 ia_css_stream_start_input_frame(const struct ia_css_stream *stream);
 
-/** @brief Send a line of input data into the CSS input FIFO.
+/* @brief Send a line of input data into the CSS input FIFO.
  *
  * @param[in]   stream          The stream.
  * @param[in]   data    Array of the first line of image data.
@@ -435,7 +435,7 @@ ia_css_stream_send_input_line(const struct ia_css_stream *stream,
                               const unsigned short *data2,
                               unsigned int width2);
 
-/** @brief Send a line of input embedded data into the CSS input FIFO.
+/* @brief Send a line of input embedded data into the CSS input FIFO.
  *
  * @param[in]   stream     Pointer of the stream.
  * @param[in]   format     Format of the embedded data.
@@ -457,7 +457,7 @@ ia_css_stream_send_input_embedded_line(const struct ia_css_stream *stream,
                               const unsigned short *data,
                               unsigned int width);
 
-/** @brief End an input frame on the CSS input FIFO.
+/* @brief End an input frame on the CSS input FIFO.
  *
  * @param[in]   stream  The stream.
  * @return      None
@@ -467,7 +467,7 @@ ia_css_stream_send_input_embedded_line(const struct ia_css_stream *stream,
 void
 ia_css_stream_end_input_frame(const struct ia_css_stream *stream);
 
-/** @brief send a request flash command to SP
+/* @brief send a request flash command to SP
  *
  * @param[in]   stream The stream.
  * @return      None
@@ -481,7 +481,7 @@ ia_css_stream_end_input_frame(const struct ia_css_stream *stream);
 void
 ia_css_stream_request_flash(struct ia_css_stream *stream);
 
-/** @brief Configure a stream with filter coefficients.
+/* @brief Configure a stream with filter coefficients.
  *         @deprecated {Replaced by
  *                                 ia_css_pipe_set_isp_config_on_pipe()}
  *
@@ -503,7 +503,7 @@ ia_css_stream_set_isp_config_on_pipe(struct ia_css_stream *stream,
                              const struct ia_css_isp_config *config,
                              struct ia_css_pipe *pipe);
 
-/** @brief Configure a stream with filter coefficients.
+/* @brief Configure a stream with filter coefficients.
  *         @deprecated {Replaced by
  *                                 ia_css_pipe_set_isp_config()}
  * @param[in]   stream  The stream.
@@ -523,7 +523,7 @@ ia_css_stream_set_isp_config(
         struct ia_css_stream *stream,
         const struct ia_css_isp_config *config);
 
-/** @brief Get selected configuration settings
+/* @brief Get selected configuration settings
  * @param[in]   stream  The stream.
  * @param[out]  config  Configuration settings.
  * @return              None
@@ -532,7 +532,7 @@ void
 ia_css_stream_get_isp_config(const struct ia_css_stream *stream,
                              struct ia_css_isp_config *config);
 
-/** @brief allocate continuous raw frames for continuous capture
+/* @brief allocate continuous raw frames for continuous capture
  * @param[in]   stream The stream.
  * @return IA_CSS_SUCCESS or error code.
  *
@@ -544,7 +544,7 @@ ia_css_stream_get_isp_config(const struct ia_css_stream *stream,
 enum ia_css_err
 ia_css_alloc_continuous_frame_remain(struct ia_css_stream *stream);
 
-/** @brief allocate continuous raw frames for continuous capture
+/* @brief allocate continuous raw frames for continuous capture
  * @param[in]   stream The stream.
  * @return      IA_CSS_SUCCESS or error code.
  *
@@ -555,7 +555,7 @@ ia_css_alloc_continuous_frame_remain(struct ia_css_stream *stream);
 enum ia_css_err
 ia_css_update_continuous_frames(struct ia_css_stream *stream);
 
-/** @brief ia_css_unlock_raw_frame . unlock a raw frame (HALv3 Support)
+/* @brief ia_css_unlock_raw_frame . unlock a raw frame (HALv3 Support)
  * @param[in]   stream The stream.
  * @param[in]   exp_id exposure id that uniquely identifies the locked Raw Frame Buffer
  * @return      ia_css_err IA_CSS_SUCCESS or error code
@@ -567,7 +567,7 @@ ia_css_update_continuous_frames(struct ia_css_stream *stream);
 enum ia_css_err
 ia_css_unlock_raw_frame(struct ia_css_stream *stream, uint32_t exp_id);
 
-/** @brief ia_css_en_dz_capt_pipe . Enable/Disable digital zoom for capture pipe
+/* @brief ia_css_en_dz_capt_pipe . Enable/Disable digital zoom for capture pipe
  * @param[in]   stream The stream.
  * @param[in]   enable - true, disable - false
  * @return      None
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_timer.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_timer.h
index 575bb28b4bec..b256d7c88716 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_timer.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_timer.h
@@ -31,47 +31,47 @@ more details.
 #ifndef __IA_CSS_TIMER_H
 #define __IA_CSS_TIMER_H
 
-/** @file
+/* @file
  * Timer interface definitions
  */
 #include <type_support.h>               /* for uint32_t */
 #include "ia_css_err.h"
 
-/** @brief timer reading definition */
+/* @brief timer reading definition */
 typedef uint32_t clock_value_t;
 
-/** @brief 32 bit clock tick,(timestamp based on timer-value of CSS-internal timer)*/
+/* @brief 32 bit clock tick,(timestamp based on timer-value of CSS-internal timer)*/
 struct ia_css_clock_tick {
-        clock_value_t ticks; /**< measured time in ticks.*/
+        clock_value_t ticks; /** measured time in ticks.*/
 };
 
-/** @brief TIMER event codes */
+/* @brief TIMER event codes */
 enum ia_css_tm_event {
         IA_CSS_TM_EVENT_AFTER_INIT,
-        /**< Timer Event after Initialization */
+        /** Timer Event after Initialization */
         IA_CSS_TM_EVENT_MAIN_END,
-        /**< Timer Event after end of Main */
+        /** Timer Event after end of Main */
         IA_CSS_TM_EVENT_THREAD_START,
-        /**< Timer Event after thread start */
+        /** Timer Event after thread start */
         IA_CSS_TM_EVENT_FRAME_PROC_START,
-        /**< Timer Event after Frame Process Start */
+        /** Timer Event after Frame Process Start */
         IA_CSS_TM_EVENT_FRAME_PROC_END
-        /**< Timer Event after Frame Process End */
+        /** Timer Event after Frame Process End */
 };
 
-/** @brief code measurement common struct */
+/* @brief code measurement common struct */
 struct ia_css_time_meas {
-        clock_value_t   start_timer_value;      /**< measured time in ticks */
-        clock_value_t   end_timer_value;        /**< measured time in ticks */
+        clock_value_t   start_timer_value;      /** measured time in ticks */
+        clock_value_t   end_timer_value;        /** measured time in ticks */
 };
 
 /**@brief SIZE_OF_IA_CSS_CLOCK_TICK_STRUCT checks to ensure correct alignment for struct ia_css_clock_tick. */
 #define SIZE_OF_IA_CSS_CLOCK_TICK_STRUCT sizeof(clock_value_t)
-/** @brief checks to ensure correct alignment for ia_css_time_meas. */
+/* @brief checks to ensure correct alignment for ia_css_time_meas. */
 #define SIZE_OF_IA_CSS_TIME_MEAS_STRUCT (sizeof(clock_value_t) \
                                         + sizeof(clock_value_t))
 
-/** @brief API to fetch timer count directly
+/* @brief API to fetch timer count directly
 *
 * @param curr_ts [out] measured count value
 * @return IA_CSS_SUCCESS if success
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_tpg.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_tpg.h
index 9238a3317a46..81498bd7485b 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_tpg.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_tpg.h
@@ -15,11 +15,11 @@
 #ifndef __IA_CSS_TPG_H
 #define __IA_CSS_TPG_H
 
-/** @file
+/* @file
  * This file contains support for the test pattern generator (TPG)
  */
 
-/** Enumerate the TPG IDs.
+/* Enumerate the TPG IDs.
  */
 enum ia_css_tpg_id {
         IA_CSS_TPG_ID0,
@@ -35,7 +35,7 @@ enum ia_css_tpg_id {
  */
 #define N_CSS_TPG_IDS (IA_CSS_TPG_ID2+1)
 
-/** Enumerate the TPG modes.
+/* Enumerate the TPG modes.
  */
 enum ia_css_tpg_mode {
         IA_CSS_TPG_MODE_RAMP,
@@ -44,7 +44,7 @@ enum ia_css_tpg_mode {
         IA_CSS_TPG_MODE_MONO
 };
 
-/** @brief Configure the test pattern generator.
+/* @brief Configure the test pattern generator.
  *
  * Configure the Test Pattern Generator, the way these values are used to
  * generate the pattern can be seen in the HRT extension for the test pattern
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_types.h
index 5fec3d5c89d8..725b90072cfe 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_types.h
@@ -16,7 +16,7 @@
 #ifndef _IA_CSS_TYPES_H
 #define _IA_CSS_TYPES_H
 
-/** @file
+/* @file
  * This file contains types used for the ia_css parameters.
  * These types are in a separate file because they are expected
  * to be used in software layers that do not access the CSS API
@@ -58,7 +58,7 @@
 #include "isp/kernels/output/output_1.0/ia_css_output_types.h"
 
 #define IA_CSS_DVS_STAT_GRID_INFO_SUPPORTED
-/**< Should be removed after Driver adaptation will be done */
+/** Should be removed after Driver adaptation will be done */
 
 #define IA_CSS_VERSION_MAJOR    2
 #define IA_CSS_VERSION_MINOR    0
@@ -69,8 +69,8 @@
 /* Min and max exposure IDs. These macros are here to allow
  * the drivers to get this information. Changing these macros
  * constitutes a CSS API change. */
-#define IA_CSS_ISYS_MIN_EXPOSURE_ID 1   /**< Minimum exposure ID */
-#define IA_CSS_ISYS_MAX_EXPOSURE_ID 250 /**< Maximum exposure ID */
+#define IA_CSS_ISYS_MIN_EXPOSURE_ID 1   /** Minimum exposure ID */
+#define IA_CSS_ISYS_MAX_EXPOSURE_ID 250 /** Maximum exposure ID */
 
 /* opaque types */
 struct ia_css_isp_parameters;
@@ -79,72 +79,72 @@ struct ia_css_memory_offsets;
 struct ia_css_config_memory_offsets;
 struct ia_css_state_memory_offsets;
 
-/** Virtual address within the CSS address space. */
+/* Virtual address within the CSS address space. */
 typedef uint32_t ia_css_ptr;
 
-/** Generic resolution structure.
+/* Generic resolution structure.
  */
 struct ia_css_resolution {
-        uint32_t width;  /**< Width */
-        uint32_t height; /**< Height */
+        uint32_t width;  /** Width */
+        uint32_t height; /** Height */
 };
 
-/** Generic coordinate structure.
+/* Generic coordinate structure.
  */
 struct ia_css_coordinate {
-        int32_t x;      /**< Value of a coordinate on the horizontal axis */
-        int32_t y;      /**< Value of a coordinate on the vertical axis */
+        int32_t x;      /** Value of a coordinate on the horizontal axis */
+        int32_t y;      /** Value of a coordinate on the vertical axis */
 };
 
-/** Vector with signed values. This is used to indicate motion for
+/* Vector with signed values. This is used to indicate motion for
  * Digital Image Stabilization.
  */
 struct ia_css_vector {
-        int32_t x; /**< horizontal motion (in pixels) */
-        int32_t y; /**< vertical motion (in pixels) */
+        int32_t x; /** horizontal motion (in pixels) */
+        int32_t y; /** vertical motion (in pixels) */
 };
 
 /* Short hands */
 #define IA_CSS_ISP_DMEM IA_CSS_ISP_DMEM0
 #define IA_CSS_ISP_VMEM IA_CSS_ISP_VMEM0
 
-/** CSS data descriptor */
+/* CSS data descriptor */
 struct ia_css_data {
-        ia_css_ptr address; /**< CSS virtual address */
-        uint32_t   size;    /**< Disabled if 0 */
+        ia_css_ptr address; /** CSS virtual address */
+        uint32_t   size;    /** Disabled if 0 */
 };
 
-/** Host data descriptor */
+/* Host data descriptor */
 struct ia_css_host_data {
-        char      *address; /**< Host address */
-        uint32_t   size;    /**< Disabled if 0 */
+        char      *address; /** Host address */
+        uint32_t   size;    /** Disabled if 0 */
 };
 
-/** ISP data descriptor */
+/* ISP data descriptor */
 struct ia_css_isp_data {
-        uint32_t   address; /**< ISP address */
-        uint32_t   size;    /**< Disabled if 0 */
+        uint32_t   address; /** ISP address */
+        uint32_t   size;    /** Disabled if 0 */
 };
 
-/** Shading Correction types. */
+/* Shading Correction types. */
 enum ia_css_shading_correction_type {
 #ifndef ISP2401
-        IA_CSS_SHADING_CORRECTION_TYPE_1 /**< Shading Correction 1.0 (pipe 1.0 on ISP2300, pipe 2.2 on ISP2400) */
+        IA_CSS_SHADING_CORRECTION_TYPE_1 /** Shading Correction 1.0 (pipe 1.0 on ISP2300, pipe 2.2 on ISP2400) */
 #else
-        IA_CSS_SHADING_CORRECTION_NONE,  /**< Shading Correction is not processed in the pipe. */
-        IA_CSS_SHADING_CORRECTION_TYPE_1 /**< Shading Correction 1.0 (pipe 1.0 on ISP2300, pipe 2.2 on ISP2400/2401) */
+        IA_CSS_SHADING_CORRECTION_NONE,  /** Shading Correction is not processed in the pipe. */
+        IA_CSS_SHADING_CORRECTION_TYPE_1 /** Shading Correction 1.0 (pipe 1.0 on ISP2300, pipe 2.2 on ISP2400/2401) */
 #endif
 
-        /**< More shading correction types can be added in the future. */
+        /** More shading correction types can be added in the future. */
 };
 
-/** Shading Correction information. */
+/* Shading Correction information. */
 struct ia_css_shading_info {
-        enum ia_css_shading_correction_type type; /**< Shading Correction type. */
+        enum ia_css_shading_correction_type type; /** Shading Correction type. */
 
-        union { /** Shading Correction information of each Shading Correction types. */
+        union { /* Shading Correction information of each Shading Correction types. */
 
-                /** Shading Correction information of IA_CSS_SHADING_CORRECTION_TYPE_1.
+                /* Shading Correction information of IA_CSS_SHADING_CORRECTION_TYPE_1.
                  *
                  *  This structure contains the information necessary to generate
                  *  the shading table required in the isp.
@@ -288,20 +288,20 @@ struct ia_css_shading_info {
                  */
                 struct {
 #ifndef ISP2401
-                        uint32_t enable;        /**< Shading correction enabled.
+                        uint32_t enable;        /** Shading correction enabled.
                                                      0:disabled, 1:enabled */
-                        uint32_t num_hor_grids; /**< Number of data points per line
+                        uint32_t num_hor_grids; /** Number of data points per line
                                                      per color on shading table. */
-                        uint32_t num_ver_grids; /**< Number of lines of data points
+                        uint32_t num_ver_grids; /** Number of lines of data points
                                                      per color on shading table. */
-                        uint32_t bqs_per_grid_cell; /**< Grid cell size
+                        uint32_t bqs_per_grid_cell; /** Grid cell size
                                                 in BQ(Bayer Quad) unit.
                                                 (1BQ means {Gr,R,B,Gb}(2x2 pixels).)
                                                 Valid values are 8,16,32,64. */
 #else
-                        uint32_t num_hor_grids; /**< Number of data points per line per color on shading table. */
-                        uint32_t num_ver_grids; /**< Number of lines of data points per color on shading table. */
-                        uint32_t bqs_per_grid_cell; /**< Grid cell size in BQ unit.
+                        uint32_t num_hor_grids; /** Number of data points per line per color on shading table. */
+                        uint32_t num_ver_grids; /** Number of lines of data points per color on shading table. */
+                        uint32_t bqs_per_grid_cell; /** Grid cell size in BQ unit.
                                                          NOTE: bqs = size in BQ(Bayer Quad) unit.
                                                                1BQ means {Gr,R,B,Gb} (2x2 pixels).
                                                                Horizontal 1 bqs corresponds to horizontal 2 pixels.
@@ -310,13 +310,13 @@ struct ia_css_shading_info {
                         uint32_t bayer_scale_hor_ratio_in;
                         uint32_t bayer_scale_hor_ratio_out;
 #ifndef ISP2401
-                        /**< Horizontal ratio of bayer scaling
+                        /** Horizontal ratio of bayer scaling
                         between input width and output width, for the scaling
                         which should be done before shading correction.
                           output_width = input_width * bayer_scale_hor_ratio_out
                                                 / bayer_scale_hor_ratio_in */
 #else
-                                /**< Horizontal ratio of bayer scaling between input width and output width,
+                                /** Horizontal ratio of bayer scaling between input width and output width,
                                      for the scaling which should be done before shading correction.
                                         output_width = input_width * bayer_scale_hor_ratio_out
                                                                         / bayer_scale_hor_ratio_in + 0.5 */
@@ -324,30 +324,30 @@ struct ia_css_shading_info {
                         uint32_t bayer_scale_ver_ratio_in;
                         uint32_t bayer_scale_ver_ratio_out;
 #ifndef ISP2401
-                        /**< Vertical ratio of bayer scaling
+                        /** Vertical ratio of bayer scaling
                         between input height and output height, for the scaling
                         which should be done before shading correction.
                           output_height = input_height * bayer_scale_ver_ratio_out
                                                 / bayer_scale_ver_ratio_in */
                         uint32_t sc_bayer_origin_x_bqs_on_shading_table;
-                        /**< X coordinate (in bqs) of bayer origin on shading table.
+                        /** X coordinate (in bqs) of bayer origin on shading table.
                         This indicates the left-most pixel of bayer
                         (not include margin) inputted to the shading correction.
                         This corresponds to the left-most pixel of bayer
                         inputted to isp from sensor. */
                         uint32_t sc_bayer_origin_y_bqs_on_shading_table;
-                        /**< Y coordinate (in bqs) of bayer origin on shading table.
+                        /** Y coordinate (in bqs) of bayer origin on shading table.
                         This indicates the top pixel of bayer
                         (not include margin) inputted to the shading correction.
                         This corresponds to the top pixel of bayer
                         inputted to isp from sensor. */
 #else
-                                /**< Vertical ratio of bayer scaling between input height and output height,
+                                /** Vertical ratio of bayer scaling between input height and output height,
                                      for the scaling which should be done before shading correction.
                                         output_height = input_height * bayer_scale_ver_ratio_out
                                                                         / bayer_scale_ver_ratio_in + 0.5 */
                         struct ia_css_resolution isp_input_sensor_data_res_bqs;
-                                /**< Sensor data size (in bqs) inputted to ISP. This is the size BEFORE bayer scaling.
+                                /** Sensor data size (in bqs) inputted to ISP. This is the size BEFORE bayer scaling.
                                      NOTE: This is NOT the size of the physical sensor size.
                                            CSS requests the driver that ISP inputs sensor data
                                            by the size of isp_input_sensor_data_res_bqs.
@@ -357,22 +357,22 @@ struct ia_css_shading_info {
                                            ISP assumes the area of isp_input_sensor_data_res_bqs
                                            is centered on the physical sensor. */
                         struct ia_css_resolution sensor_data_res_bqs;
-                                /**< Sensor data size (in bqs) at shading correction.
+                                /** Sensor data size (in bqs) at shading correction.
                                      This is the size AFTER bayer scaling. */
                         struct ia_css_coordinate sensor_data_origin_bqs_on_sctbl;
-                                /**< Origin of sensor data area positioned on shading table at shading correction.
+                                /** Origin of sensor data area positioned on shading table at shading correction.
                                      The coordinate x,y should be positive values. */
 #endif
                 } type_1;
 
-                /**< More structures can be added here when more shading correction types will be added
+                /** More structures can be added here when more shading correction types will be added
                      in the future. */
         } info;
 };
 
 #ifndef ISP2401
 
-/** Default Shading Correction information of Shading Correction Type 1. */
+/* Default Shading Correction information of Shading Correction Type 1. */
 #define DEFAULT_SHADING_INFO_TYPE_1 \
 { \
         IA_CSS_SHADING_CORRECTION_TYPE_1,       /* type */ \
@@ -394,7 +394,7 @@ struct ia_css_shading_info {
 
 #else
 
-/** Default Shading Correction information of Shading Correction Type 1. */
+/* Default Shading Correction information of Shading Correction Type 1. */
 #define DEFAULT_SHADING_INFO_TYPE_1 \
 { \
         IA_CSS_SHADING_CORRECTION_TYPE_1,       /* type */ \
@@ -416,27 +416,27 @@ struct ia_css_shading_info {
 
 #endif
 
-/** Default Shading Correction information. */
+/* Default Shading Correction information. */
 #define DEFAULT_SHADING_INFO    DEFAULT_SHADING_INFO_TYPE_1
 
-/** structure that describes the 3A and DIS grids */
+/* structure that describes the 3A and DIS grids */
 struct ia_css_grid_info {
-        /** \name ISP input size
+        /* \name ISP input size
           * that is visible for user
           * @{
           */
         uint32_t isp_in_width;
         uint32_t isp_in_height;
-        /** @}*/
+        /* @}*/
 
-        struct ia_css_3a_grid_info  s3a_grid; /**< 3A grid info */
+        struct ia_css_3a_grid_info  s3a_grid; /** 3A grid info */
         union ia_css_dvs_grid_u dvs_grid;
-                /**< All types of DVS statistics grid info union */
+                /** All types of DVS statistics grid info union */
 
         enum ia_css_vamem_type vamem_type;
 };
 
-/** defaults for ia_css_grid_info structs */
+/* defaults for ia_css_grid_info structs */
 #define DEFAULT_GRID_INFO \
 { \
         0,                              /* isp_in_width */ \
@@ -446,25 +446,25 @@ struct ia_css_grid_info {
         IA_CSS_VAMEM_TYPE_1             /* vamem_type */ \
 }
 
-/** Morphing table, used for geometric distortion and chromatic abberration
+/* Morphing table, used for geometric distortion and chromatic abberration
  *  correction (GDCAC, also called GDC).
  *  This table describes the imperfections introduced by the lens, the
  *  advanced ISP can correct for these imperfections using this table.
  */
 struct ia_css_morph_table {
-        uint32_t enable; /**< To disable GDC, set this field to false. The
+        uint32_t enable; /** To disable GDC, set this field to false. The
                           coordinates fields can be set to NULL in this case. */
-        uint32_t height; /**< Table height */
-        uint32_t width;  /**< Table width */
+        uint32_t height; /** Table height */
+        uint32_t width;  /** Table width */
         uint16_t *coordinates_x[IA_CSS_MORPH_TABLE_NUM_PLANES];
-        /**< X coordinates that describe the sensor imperfection */
+        /** X coordinates that describe the sensor imperfection */
         uint16_t *coordinates_y[IA_CSS_MORPH_TABLE_NUM_PLANES];
-        /**< Y coordinates that describe the sensor imperfection */
+        /** Y coordinates that describe the sensor imperfection */
 };
 
 struct ia_css_dvs_6axis_config {
         unsigned int exp_id;
-        /**< Exposure ID, see ia_css_event_public.h for more detail */
+        /** Exposure ID, see ia_css_event_public.h for more detail */
         uint32_t width_y;
         uint32_t height_y;
         uint32_t width_uv;
@@ -479,16 +479,16 @@ struct ia_css_dvs_6axis_config {
  * This specifies the coordinates (x,y)
  */
 struct ia_css_point {
-        int32_t x; /**< x coordinate */
-        int32_t y; /**< y coordinate */
+        int32_t x; /** x coordinate */
+        int32_t y; /** y coordinate */
 };
 
 /**
  * This specifies the region
  */
 struct ia_css_region {
-        struct ia_css_point origin; /**< Starting point coordinates for the region */
-        struct ia_css_resolution resolution; /**< Region resolution */
+        struct ia_css_point origin; /** Starting point coordinates for the region */
+        struct ia_css_resolution resolution; /** Region resolution */
 };
 
 /**
@@ -509,30 +509,30 @@ struct ia_css_region {
  * y + height <= effective input height
  */
 struct ia_css_dz_config {
-        uint32_t dx; /**< Horizontal zoom factor */
-        uint32_t dy; /**< Vertical zoom factor */
-        struct ia_css_region zoom_region; /**< region for zoom */
+        uint32_t dx; /** Horizontal zoom factor */
+        uint32_t dy; /** Vertical zoom factor */
+        struct ia_css_region zoom_region; /** region for zoom */
 };
 
-/** The still capture mode, this can be RAW (simply copy sensor input to DDR),
+/* The still capture mode, this can be RAW (simply copy sensor input to DDR),
  *  Primary ISP, the Advanced ISP (GDC) or the low-light ISP (ANR).
  */
 enum ia_css_capture_mode {
-        IA_CSS_CAPTURE_MODE_RAW,      /**< no processing, copy data only */
-        IA_CSS_CAPTURE_MODE_BAYER,    /**< bayer processing, up to demosaic */
-        IA_CSS_CAPTURE_MODE_PRIMARY,  /**< primary ISP */
-        IA_CSS_CAPTURE_MODE_ADVANCED, /**< advanced ISP (GDC) */
-        IA_CSS_CAPTURE_MODE_LOW_LIGHT /**< low light ISP (ANR) */
+        IA_CSS_CAPTURE_MODE_RAW,      /** no processing, copy data only */
+        IA_CSS_CAPTURE_MODE_BAYER,    /** bayer processing, up to demosaic */
+        IA_CSS_CAPTURE_MODE_PRIMARY,  /** primary ISP */
+        IA_CSS_CAPTURE_MODE_ADVANCED, /** advanced ISP (GDC) */
+        IA_CSS_CAPTURE_MODE_LOW_LIGHT /** low light ISP (ANR) */
 };
 
 struct ia_css_capture_config {
-        enum ia_css_capture_mode mode; /**< Still capture mode */
-        uint32_t enable_xnr;           /**< Enable/disable XNR */
+        enum ia_css_capture_mode mode; /** Still capture mode */
+        uint32_t enable_xnr;           /** Enable/disable XNR */
         uint32_t enable_raw_output;
-        bool enable_capture_pp_bli;    /**< Enable capture_pp_bli mode */
+        bool enable_capture_pp_bli;    /** Enable capture_pp_bli mode */
 };
 
-/** default settings for ia_css_capture_config structs */
+/* default settings for ia_css_capture_config structs */
 #define DEFAULT_CAPTURE_CONFIG \
 { \
         IA_CSS_CAPTURE_MODE_PRIMARY,    /* mode (capture) */ \
@@ -542,7 +542,7 @@ struct ia_css_capture_config {
 }
 
 
-/** ISP filter configuration. This is a collection of configurations
+/* ISP filter configuration. This is a collection of configurations
  *  for each of the ISP filters (modules).
  *
  *  NOTE! The contents of all pointers is copied when get or set with the
@@ -557,98 +557,98 @@ struct ia_css_capture_config {
  *    ["ISP block", 2only] : ISP block is used only for ISP2.
  */
 struct ia_css_isp_config {
-        struct ia_css_wb_config   *wb_config;   /**< White Balance
+        struct ia_css_wb_config   *wb_config;   /** White Balance
                                                         [WB1, 1&2] */
-        struct ia_css_cc_config   *cc_config;   /**< Color Correction
+        struct ia_css_cc_config   *cc_config;   /** Color Correction
                                                         [CSC1, 1only] */
-        struct ia_css_tnr_config  *tnr_config;  /**< Temporal Noise Reduction
+        struct ia_css_tnr_config  *tnr_config;  /** Temporal Noise Reduction
                                                         [TNR1, 1&2] */
-        struct ia_css_ecd_config  *ecd_config;  /**< Eigen Color Demosaicing
+        struct ia_css_ecd_config  *ecd_config;  /** Eigen Color Demosaicing
                                                         [DE2, 2only] */
-        struct ia_css_ynr_config  *ynr_config;  /**< Y(Luma) Noise Reduction
+        struct ia_css_ynr_config  *ynr_config;  /** Y(Luma) Noise Reduction
                                                         [YNR2&YEE2, 2only] */
-        struct ia_css_fc_config   *fc_config;   /**< Fringe Control
+        struct ia_css_fc_config   *fc_config;   /** Fringe Control
                                                         [FC2, 2only] */
-        struct ia_css_formats_config   *formats_config; /**< Formats Control for main output
+        struct ia_css_formats_config   *formats_config; /** Formats Control for main output
                                                         [FORMATS, 1&2] */
-        struct ia_css_cnr_config  *cnr_config;  /**< Chroma Noise Reduction
+        struct ia_css_cnr_config  *cnr_config;  /** Chroma Noise Reduction
                                                         [CNR2, 2only] */
-        struct ia_css_macc_config *macc_config; /**< MACC
+        struct ia_css_macc_config *macc_config; /** MACC
                                                         [MACC2, 2only] */
-        struct ia_css_ctc_config  *ctc_config;  /**< Chroma Tone Control
+        struct ia_css_ctc_config  *ctc_config;  /** Chroma Tone Control
                                                         [CTC2, 2only] */
-        struct ia_css_aa_config   *aa_config;   /**< YUV Anti-Aliasing
+        struct ia_css_aa_config   *aa_config;   /** YUV Anti-Aliasing
                                                         [AA2, 2only]
                                                         (not used currently) */
-        struct ia_css_aa_config   *baa_config;  /**< Bayer Anti-Aliasing
+        struct ia_css_aa_config   *baa_config;  /** Bayer Anti-Aliasing
                                                         [BAA2, 1&2] */
-        struct ia_css_ce_config   *ce_config;   /**< Chroma Enhancement
+        struct ia_css_ce_config   *ce_config;   /** Chroma Enhancement
                                                         [CE1, 1only] */
         struct ia_css_dvs_6axis_config *dvs_6axis_config;
-        struct ia_css_ob_config   *ob_config;  /**< Objective Black
+        struct ia_css_ob_config   *ob_config;  /** Objective Black
                                                         [OB1, 1&2] */
-        struct ia_css_dp_config   *dp_config;  /**< Defect Pixel Correction
+        struct ia_css_dp_config   *dp_config;  /** Defect Pixel Correction
                                                         [DPC1/DPC2, 1&2] */
-        struct ia_css_nr_config   *nr_config;  /**< Noise Reduction
+        struct ia_css_nr_config   *nr_config;  /** Noise Reduction
                                                         [BNR1&YNR1&CNR1, 1&2]*/
-        struct ia_css_ee_config   *ee_config;  /**< Edge Enhancement
+        struct ia_css_ee_config   *ee_config;  /** Edge Enhancement
                                                         [YEE1, 1&2] */
-        struct ia_css_de_config   *de_config;  /**< Demosaic
+        struct ia_css_de_config   *de_config;  /** Demosaic
                                                         [DE1, 1only] */
-        struct ia_css_gc_config   *gc_config;  /**< Gamma Correction (for YUV)
+        struct ia_css_gc_config   *gc_config;  /** Gamma Correction (for YUV)
                                                         [GC1, 1only] */
-        struct ia_css_anr_config  *anr_config; /**< Advanced Noise Reduction */
-        struct ia_css_3a_config   *s3a_config; /**< 3A Statistics config */
-        struct ia_css_xnr_config  *xnr_config; /**< eXtra Noise Reduction */
-        struct ia_css_dz_config   *dz_config;  /**< Digital Zoom */
-        struct ia_css_cc_config *yuv2rgb_cc_config; /**< Color Correction
+        struct ia_css_anr_config  *anr_config; /** Advanced Noise Reduction */
+        struct ia_css_3a_config   *s3a_config; /** 3A Statistics config */
+        struct ia_css_xnr_config  *xnr_config; /** eXtra Noise Reduction */
+        struct ia_css_dz_config   *dz_config;  /** Digital Zoom */
+        struct ia_css_cc_config *yuv2rgb_cc_config; /** Color Correction
                                                         [CCM2, 2only] */
-        struct ia_css_cc_config *rgb2yuv_cc_config; /**< Color Correction
+        struct ia_css_cc_config *rgb2yuv_cc_config; /** Color Correction
                                                         [CSC2, 2only] */
-        struct ia_css_macc_table  *macc_table;  /**< MACC
+        struct ia_css_macc_table  *macc_table;  /** MACC
                                                         [MACC1/MACC2, 1&2]*/
-        struct ia_css_gamma_table *gamma_table; /**< Gamma Correction (for YUV)
+        struct ia_css_gamma_table *gamma_table; /** Gamma Correction (for YUV)
                                                         [GC1, 1only] */
-        struct ia_css_ctc_table   *ctc_table;   /**< Chroma Tone Control
+        struct ia_css_ctc_table   *ctc_table;   /** Chroma Tone Control
                                                         [CTC1, 1only] */
 
-        /** \deprecated */
-        struct ia_css_xnr_table   *xnr_table;   /**< eXtra Noise Reduction
+        /* \deprecated */
+        struct ia_css_xnr_table   *xnr_table;   /** eXtra Noise Reduction
                                                         [XNR1, 1&2] */
-        struct ia_css_rgb_gamma_table *r_gamma_table;/**< sRGB Gamma Correction
+        struct ia_css_rgb_gamma_table *r_gamma_table;/** sRGB Gamma Correction
                                                         [GC2, 2only] */
-        struct ia_css_rgb_gamma_table *g_gamma_table;/**< sRGB Gamma Correction
+        struct ia_css_rgb_gamma_table *g_gamma_table;/** sRGB Gamma Correction
                                                         [GC2, 2only] */
-        struct ia_css_rgb_gamma_table *b_gamma_table;/**< sRGB Gamma Correction
+        struct ia_css_rgb_gamma_table *b_gamma_table;/** sRGB Gamma Correction
                                                         [GC2, 2only] */
-        struct ia_css_vector      *motion_vector; /**< For 2-axis DVS */
+        struct ia_css_vector      *motion_vector; /** For 2-axis DVS */
         struct ia_css_shading_table *shading_table;
         struct ia_css_morph_table   *morph_table;
-        struct ia_css_dvs_coefficients *dvs_coefs; /**< DVS 1.0 coefficients */
-        struct ia_css_dvs2_coefficients *dvs2_coefs; /**< DVS 2.0 coefficients */
+        struct ia_css_dvs_coefficients *dvs_coefs; /** DVS 1.0 coefficients */
+        struct ia_css_dvs2_coefficients *dvs2_coefs; /** DVS 2.0 coefficients */
         struct ia_css_capture_config   *capture_config;
         struct ia_css_anr_thres   *anr_thres;
-        /** @deprecated{Old shading settings, see bugzilla bz675 for details} */
+        /* @deprecated{Old shading settings, see bugzilla bz675 for details} */
         struct ia_css_shading_settings *shading_settings;
-        struct ia_css_xnr3_config *xnr3_config; /**< eXtreme Noise Reduction v3 */
-        /** comment from Lasse: Be aware how this feature will affect coordinate
+        struct ia_css_xnr3_config *xnr3_config; /** eXtreme Noise Reduction v3 */
+        /* comment from Lasse: Be aware how this feature will affect coordinate
          *  normalization in different parts of the system. (e.g. face detection,
          *  touch focus, 3A statistics and windows of interest, shading correction,
          *  DVS, GDC) from IQ tool level and application level down-to ISP FW level.
          *  the risk for regression is not in the individual blocks, but how they
          *  integrate together. */
-        struct ia_css_output_config   *output_config;   /**< Main Output Mirroring, flipping */
+        struct ia_css_output_config   *output_config;   /** Main Output Mirroring, flipping */
 
 #ifdef ISP2401
-        struct ia_css_tnr3_kernel_config         *tnr3_config;           /**< TNR3 config */
+        struct ia_css_tnr3_kernel_config         *tnr3_config;           /** TNR3 config */
 #endif
-        struct ia_css_scaler_config              *scaler_config;         /**< Skylake: scaler config (optional) */
-        struct ia_css_formats_config             *formats_config_display;/**< Formats control for viewfinder/display output (optional)
+        struct ia_css_scaler_config              *scaler_config;         /** Skylake: scaler config (optional) */
+        struct ia_css_formats_config             *formats_config_display;/** Formats control for viewfinder/display output (optional)
                                                                                 [OSYS, n/a] */
-        struct ia_css_output_config              *output_config_display; /**< Viewfinder/display output mirroring, flipping (optional) */
+        struct ia_css_output_config              *output_config_display; /** Viewfinder/display output mirroring, flipping (optional) */
 
-        struct ia_css_frame                      *output_frame;          /**< Output frame the config is to be applied to (optional) */
-        uint32_t                        isp_config_id;  /**< Unique ID to track which config was actually applied to a particular frame */
+        struct ia_css_frame                      *output_frame;          /** Output frame the config is to be applied to (optional) */
+        uint32_t                        isp_config_id;  /** Unique ID to track which config was actually applied to a particular frame */
 };
 
 #endif /* _IA_CSS_TYPES_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_version.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_version.h
index 48c59896e847..1e88901e0b82 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_version.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/ia_css_version.h
@@ -15,16 +15,16 @@
 #ifndef __IA_CSS_VERSION_H
 #define __IA_CSS_VERSION_H
 
-/** @file
+/* @file
  * This file contains functions to retrieve CSS-API version information
  */
 
 #include <ia_css_err.h>
 
-/** a common size for the version arrays */
+/* a common size for the version arrays */
 #define MAX_VERSION_SIZE        500
 
-/** @brief Retrieves the current CSS version
+/* @brief Retrieves the current CSS version
  * @param[out]  version         A pointer to a buffer where to put the generated
  *                              version string. NULL is ignored.
  * @param[in]   max_size        Size of the version buffer. If version string
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/aa/aa_2/ia_css_aa2_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/aa/aa_2/ia_css_aa2_types.h
index 834eedbbeeff..0b95bf9b9aaf 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/aa/aa_2/ia_css_aa2_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/aa/aa_2/ia_css_aa2_types.h
@@ -15,12 +15,12 @@
 #ifndef __IA_CSS_AA2_TYPES_H
 #define __IA_CSS_AA2_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Anti-Aliasing parameters.
 */
 
 
-/** Anti-Aliasing configuration.
+/* Anti-Aliasing configuration.
  *
  *  This structure is used both for YUV AA and Bayer AA.
  *
@@ -39,7 +39,7 @@
  *     ISP2: BAA2 is used.
  */
 struct ia_css_aa_config {
-        uint16_t strength;      /**< Strength of the filter.
+        uint16_t strength;      /** Strength of the filter.
                                         u0.13, [0,8191],
                                         default/ineffective 0 */
 };
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/anr/anr_1.0/ia_css_anr_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/anr/anr_1.0/ia_css_anr_types.h
index e205574098f2..dc317a857369 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/anr/anr_1.0/ia_css_anr_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/anr/anr_1.0/ia_css_anr_types.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_ANR_TYPES_H
 #define __IA_CSS_ANR_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Advanced Noise Reduction kernel v1
 */
 
@@ -23,11 +23,11 @@
 #define ANR_BPP                 10
 #define ANR_ELEMENT_BITS        ((CEIL_DIV(ANR_BPP, 8))*8)
 
-/** Advanced Noise Reduction configuration.
+/* Advanced Noise Reduction configuration.
  *  This is also known as Low-Light.
  */
 struct ia_css_anr_config {
-        int32_t threshold; /**< Threshold */
+        int32_t threshold; /** Threshold */
         int32_t thresholds[4*4*4];
         int32_t factors[3];
 };
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/anr/anr_2/ia_css_anr2_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/anr/anr_2/ia_css_anr2_types.h
index 3832ada433ec..9b611315392c 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/anr/anr_2/ia_css_anr2_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/anr/anr_2/ia_css_anr2_types.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_ANR2_TYPES_H
 #define __IA_CSS_ANR2_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Advanced Noise Reduction kernel v2
 */
 
@@ -23,7 +23,7 @@
 
 #define ANR_PARAM_SIZE          13
 
-/** Advanced Noise Reduction (ANR) thresholds */
+/* Advanced Noise Reduction (ANR) thresholds */
 struct ia_css_anr_thres {
         int16_t data[13*64];
 };
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/anr/anr_2/ia_css_anr_param.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/anr/anr_2/ia_css_anr_param.h
index 4a289853367a..312141793fd2 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/anr/anr_2/ia_css_anr_param.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/anr/anr_2/ia_css_anr_param.h
@@ -18,7 +18,7 @@
 #include "vmem.h"
 #include "ia_css_anr2_types.h"
 
-/** Advanced Noise Reduction (ANR) thresholds */
+/* Advanced Noise Reduction (ANR) thresholds */
 
 struct ia_css_isp_anr2_params {
         VMEM_ARRAY(data, ANR_PARAM_SIZE*ISP_VEC_NELEMS);
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bayer_ls/bayer_ls_1.0/ia_css_bayer_ls_param.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bayer_ls/bayer_ls_1.0/ia_css_bayer_ls_param.h
index 75ca7606b95c..a0d355454aa3 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bayer_ls/bayer_ls_1.0/ia_css_bayer_ls_param.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bayer_ls/bayer_ls_1.0/ia_css_bayer_ls_param.h
@@ -27,7 +27,7 @@
 #define BAYER_QUAD_HEIGHT 2
 #define NOF_BAYER_VECTORS 4
 
-/** bayer load/store */
+/* bayer load/store */
 struct sh_css_isp_bayer_ls_isp_config {
         uint32_t base_address[NUM_BAYER_LS];
         uint32_t width[NUM_BAYER_LS];
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bh/bh_2/ia_css_bh_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bh/bh_2/ia_css_bh_types.h
index 9ae27a9e0baa..ec1688e7352d 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bh/bh_2/ia_css_bh_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bh/bh_2/ia_css_bh_types.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_BH_TYPES_H
 #define __IA_CSS_BH_TYPES_H
 
-/** Number of elements in the BH table.
+/* Number of elements in the BH table.
   * Should be consistent with hmem.h
   */
 #define IA_CSS_HMEM_BH_TABLE_SIZE       ISP_HIST_DEPTH
@@ -27,7 +27,7 @@
 #define BH_COLOR_Y      (3)
 #define BH_COLOR_NUM    (4)
 
-/** BH table */
+/* BH table */
 struct ia_css_bh_table {
         uint32_t hmem[ISP_HIST_COMPONENTS][IA_CSS_HMEM_BH_UNIT_SIZE];
 };
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bnlm/ia_css_bnlm_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bnlm/ia_css_bnlm_types.h
index 219fb835cb26..87e0f19c856b 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bnlm/ia_css_bnlm_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bnlm/ia_css_bnlm_types.h
@@ -15,13 +15,13 @@
 #ifndef __IA_CSS_BNLM_TYPES_H
 #define __IA_CSS_BNLM_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Bayer Non-Linear Mean parameters.
 */
 
 #include "type_support.h" /* int32_t */
 
-/** Bayer Non-Linear Mean configuration
+/* Bayer Non-Linear Mean configuration
  *
  * \brief BNLM public parameters.
  * \details Struct with all parameters for the BNLM kernel that can be set
@@ -30,16 +30,16 @@
  * ISP2.6.1: BNLM is used.
  */
 struct ia_css_bnlm_config {
-        bool            rad_enable;     /**< Enable a radial dependency in a weight calculation */
-        int32_t         rad_x_origin;   /**< Initial x coordinate for a radius calculation */
-        int32_t         rad_y_origin;   /**< Initial x coordinate for a radius calculation */
+        bool            rad_enable;     /** Enable a radial dependency in a weight calculation */
+        int32_t         rad_x_origin;   /** Initial x coordinate for a radius calculation */
+        int32_t         rad_y_origin;   /** Initial x coordinate for a radius calculation */
         /* a threshold for average of weights if this < Th, do not denoise pixel */
         int32_t         avg_min_th;
         /* minimum weight for denoising if max < th, do not denoise pixel */
         int32_t         max_min_th;
 
         /**@{*/
-        /** Coefficient for approximation, in the form of (1 + x / N)^N,
+        /* Coefficient for approximation, in the form of (1 + x / N)^N,
          * that fits the first-order exp() to default exp_lut in BNLM sheet
          * */
         int32_t         exp_coeff_a;
@@ -48,55 +48,55 @@ struct ia_css_bnlm_config {
         uint32_t        exp_exponent;
         /**@}*/
 
-        int32_t nl_th[3];       /**< Detail thresholds */
+        int32_t nl_th[3];       /** Detail thresholds */
 
-        /** Index for n-th maximum candidate weight for each detail group */
+        /* Index for n-th maximum candidate weight for each detail group */
         int32_t match_quality_max_idx[4];
 
         /**@{*/
-        /** A lookup table for 1/sqrt(1+mu) approximation */
+        /* A lookup table for 1/sqrt(1+mu) approximation */
         int32_t mu_root_lut_thr[15];
         int32_t mu_root_lut_val[16];
         /**@}*/
         /**@{*/
-        /** A lookup table for SAD normalization */
+        /* A lookup table for SAD normalization */
         int32_t sad_norm_lut_thr[15];
         int32_t sad_norm_lut_val[16];
         /**@}*/
         /**@{*/
-        /** A lookup table that models a weight's dependency on textures */
+        /* A lookup table that models a weight's dependency on textures */
         int32_t sig_detail_lut_thr[15];
         int32_t sig_detail_lut_val[16];
         /**@}*/
         /**@{*/
-        /** A lookup table that models a weight's dependency on a pixel's radial distance */
+        /* A lookup table that models a weight's dependency on a pixel's radial distance */
         int32_t sig_rad_lut_thr[15];
         int32_t sig_rad_lut_val[16];
         /**@}*/
         /**@{*/
-        /** A lookup table to control denoise power depending on a pixel's radial distance */
+        /* A lookup table to control denoise power depending on a pixel's radial distance */
         int32_t rad_pow_lut_thr[15];
         int32_t rad_pow_lut_val[16];
         /**@}*/
         /**@{*/
-        /** Non linear transfer functions to calculate the blending coefficient depending on detail group */
-        /** detail group 0 */
+        /* Non linear transfer functions to calculate the blending coefficient depending on detail group */
+        /* detail group 0 */
         /**@{*/
         int32_t nl_0_lut_thr[15];
         int32_t nl_0_lut_val[16];
         /**@}*/
         /**@{*/
-        /** detail group 1 */
+        /* detail group 1 */
         int32_t nl_1_lut_thr[15];
         int32_t nl_1_lut_val[16];
         /**@}*/
         /**@{*/
-        /** detail group 2 */
+        /* detail group 2 */
         int32_t nl_2_lut_thr[15];
         int32_t nl_2_lut_val[16];
         /**@}*/
         /**@{*/
-        /** detail group 3 */
+        /* detail group 3 */
         int32_t nl_3_lut_thr[15];
         int32_t nl_3_lut_val[16];
         /**@}*/
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bnr/bnr2_2/ia_css_bnr2_2_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bnr/bnr2_2/ia_css_bnr2_2_types.h
index be80f705d8a1..551bd0ed3bac 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bnr/bnr2_2/ia_css_bnr2_2_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/bnr/bnr2_2/ia_css_bnr2_2_types.h
@@ -15,13 +15,13 @@
 #ifndef __IA_CSS_BNR2_2_TYPES_H
 #define __IA_CSS_BNR2_2_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Bayer Noise Reduction parameters.
 */
 
 #include "type_support.h" /* int32_t */
 
-/** Bayer Noise Reduction 2.2 configuration
+/* Bayer Noise Reduction 2.2 configuration
  *
  * \brief BNR2_2 public parameters.
  * \details Struct with all parameters for the BNR2.2 kernel that can be set
@@ -31,41 +31,41 @@
  */
 struct ia_css_bnr2_2_config {
         /**@{*/
-        /** Directional variance gain for R/G/B components in dark region */
+        /* Directional variance gain for R/G/B components in dark region */
         int32_t d_var_gain_r;
         int32_t d_var_gain_g;
         int32_t d_var_gain_b;
         /**@}*/
         /**@{*/
-        /** Slope of Directional variance gain between dark and bright region */
+        /* Slope of Directional variance gain between dark and bright region */
         int32_t d_var_gain_slope_r;
         int32_t d_var_gain_slope_g;
         int32_t d_var_gain_slope_b;
         /**@}*/
         /**@{*/
-        /** Non-Directional variance gain for R/G/B components in dark region */
+        /* Non-Directional variance gain for R/G/B components in dark region */
         int32_t n_var_gain_r;
         int32_t n_var_gain_g;
         int32_t n_var_gain_b;
         /**@}*/
         /**@{*/
-        /** Slope of Non-Directional variance gain between dark and bright region */
+        /* Slope of Non-Directional variance gain between dark and bright region */
         int32_t n_var_gain_slope_r;
         int32_t n_var_gain_slope_g;
         int32_t n_var_gain_slope_b;
         /**@}*/
 
-        int32_t dir_thres;              /**< Threshold for directional filtering */
-        int32_t dir_thres_w;            /**< Threshold width for directional filtering */
-        int32_t var_offset_coef;        /**< Variance offset coefficient */
-        int32_t dir_gain;               /**< Gain for directional coefficient */
-        int32_t detail_gain;            /**< Gain for low contrast texture control */
-        int32_t detail_gain_divisor;    /**< Gain divisor for low contrast texture control */
-        int32_t detail_level_offset;    /**< Bias value for low contrast texture control */
-        int32_t d_var_th_min;           /**< Minimum clipping value for directional variance*/
-        int32_t d_var_th_max;           /**< Maximum clipping value for diretional variance*/
-        int32_t n_var_th_min;           /**< Minimum clipping value for non-directional variance*/
-        int32_t n_var_th_max;           /**< Maximum clipping value for non-directional variance*/
+        int32_t dir_thres;              /** Threshold for directional filtering */
+        int32_t dir_thres_w;            /** Threshold width for directional filtering */
+        int32_t var_offset_coef;        /** Variance offset coefficient */
+        int32_t dir_gain;               /** Gain for directional coefficient */
+        int32_t detail_gain;            /** Gain for low contrast texture control */
+        int32_t detail_gain_divisor;    /** Gain divisor for low contrast texture control */
+        int32_t detail_level_offset;    /** Bias value for low contrast texture control */
+        int32_t d_var_th_min;           /** Minimum clipping value for directional variance*/
+        int32_t d_var_th_max;           /** Maximum clipping value for diretional variance*/
+        int32_t n_var_th_min;           /** Minimum clipping value for non-directional variance*/
+        int32_t n_var_th_max;           /** Maximum clipping value for non-directional variance*/
 };
 
 #endif /* __IA_CSS_BNR2_2_TYPES_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/cnr/cnr_2/ia_css_cnr2_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/cnr/cnr_2/ia_css_cnr2_types.h
index 6df6c2be9a70..3ebc069d8ada 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/cnr/cnr_2/ia_css_cnr2_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/cnr/cnr_2/ia_css_cnr2_types.h
@@ -15,11 +15,11 @@
 #ifndef __IA_CSS_CNR2_TYPES_H
 #define __IA_CSS_CNR2_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Chroma Noise Reduction (CNR) parameters
 */
 
-/** Chroma Noise Reduction configuration.
+/* Chroma Noise Reduction configuration.
  *
  *  Small sensitivity of edge means strong smoothness and NR performance.
  *  If you see blurred color on vertical edges,
@@ -33,21 +33,21 @@
  *  ISP2: CNR2 is used for Still.
  */
 struct ia_css_cnr_config {
-        uint16_t coring_u;      /**< Coring level of U.
+        uint16_t coring_u;      /** Coring level of U.
                                 u0.13, [0,8191], default/ineffective 0 */
-        uint16_t coring_v;      /**< Coring level of V.
+        uint16_t coring_v;      /** Coring level of V.
                                 u0.13, [0,8191], default/ineffective 0 */
-        uint16_t sense_gain_vy; /**< Sensitivity of horizontal edge of Y.
+        uint16_t sense_gain_vy; /** Sensitivity of horizontal edge of Y.
                                 u13.0, [0,8191], default 100, ineffective 8191 */
-        uint16_t sense_gain_vu; /**< Sensitivity of horizontal edge of U.
+        uint16_t sense_gain_vu; /** Sensitivity of horizontal edge of U.
                                 u13.0, [0,8191], default 100, ineffective 8191 */
-        uint16_t sense_gain_vv; /**< Sensitivity of horizontal edge of V.
+        uint16_t sense_gain_vv; /** Sensitivity of horizontal edge of V.
                                 u13.0, [0,8191], default 100, ineffective 8191 */
-        uint16_t sense_gain_hy; /**< Sensitivity of vertical edge of Y.
+        uint16_t sense_gain_hy; /** Sensitivity of vertical edge of Y.
                                 u13.0, [0,8191], default 50, ineffective 8191 */
-        uint16_t sense_gain_hu; /**< Sensitivity of vertical edge of U.
+        uint16_t sense_gain_hu; /** Sensitivity of vertical edge of U.
                                 u13.0, [0,8191], default 50, ineffective 8191 */
-        uint16_t sense_gain_hv; /**< Sensitivity of vertical edge of V.
+        uint16_t sense_gain_hv; /** Sensitivity of vertical edge of V.
                                 u13.0, [0,8191], default 50, ineffective 8191 */
 };
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/conversion/conversion_1.0/ia_css_conversion_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/conversion/conversion_1.0/ia_css_conversion_types.h
index 3f11442500f0..47a38fd65950 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/conversion/conversion_1.0/ia_css_conversion_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/conversion/conversion_1.0/ia_css_conversion_types.h
@@ -23,10 +23,10 @@
  *
  */
 struct ia_css_conversion_config {
-        uint32_t en;     /**< en parameter */
-        uint32_t dummy0; /**< dummy0 dummy parameter 0 */
-        uint32_t dummy1; /**< dummy1 dummy parameter 1 */
-        uint32_t dummy2; /**< dummy2 dummy parameter 2 */
+        uint32_t en;     /** en parameter */
+        uint32_t dummy0; /** dummy0 dummy parameter 0 */
+        uint32_t dummy1; /** dummy1 dummy parameter 1 */
+        uint32_t dummy2; /** dummy2 dummy parameter 2 */
 };
 
 #endif /* __IA_CSS_CONVERSION_TYPES_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/crop/crop_1.0/ia_css_crop_param.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/crop/crop_1.0/ia_css_crop_param.h
index 8bfc8dad37a8..0f1812cdd92a 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/crop/crop_1.0/ia_css_crop_param.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/crop/crop_1.0/ia_css_crop_param.h
@@ -19,7 +19,7 @@
 #include "dma.h"
 #include "sh_css_internal.h" /* sh_css_crop_pos */
 
-/** Crop frame */
+/* Crop frame */
 struct sh_css_isp_crop_isp_config {
         uint32_t width_a_over_b;
         struct dma_port_config port_b;
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/crop/crop_1.0/ia_css_crop_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/crop/crop_1.0/ia_css_crop_types.h
index 8091ad4d4602..b5d454225f89 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/crop/crop_1.0/ia_css_crop_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/crop/crop_1.0/ia_css_crop_types.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_CROP_TYPES_H
 #define __IA_CSS_CROP_TYPES_H
 
-/** Crop frame
+/* Crop frame
  *
  *  ISP block: crop frame
  */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/csc/csc_1.0/ia_css_csc_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/csc/csc_1.0/ia_css_csc_types.h
index 54ced072467f..10404380c637 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/csc/csc_1.0/ia_css_csc_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/csc/csc_1.0/ia_css_csc_types.h
@@ -15,11 +15,11 @@
 #ifndef __IA_CSS_CSC_TYPES_H
 #define __IA_CSS_CSC_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Color Space Conversion parameters.
 */
 
-/** Color Correction configuration.
+/* Color Correction configuration.
  *
  *  This structure is used for 3 cases.
  *  ("YCgCo" is the output format of Demosaic.)
@@ -68,9 +68,9 @@
  *      4096    -3430   -666
  */
 struct ia_css_cc_config {
-        uint32_t fraction_bits;/**< Fractional bits of matrix.
+        uint32_t fraction_bits;/** Fractional bits of matrix.
                                         u8.0, [0,13] */
-        int32_t matrix[3 * 3]; /**< Conversion matrix.
+        int32_t matrix[3 * 3]; /** Conversion matrix.
                                         s[13-fraction_bits].[fraction_bits],
                                         [-8192,8191] */
 };
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ctc/ctc2/ia_css_ctc2_param.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ctc/ctc2/ia_css_ctc2_param.h
index c66e823618f6..ad7040c9d7cb 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ctc/ctc2/ia_css_ctc2_param.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ctc/ctc2/ia_css_ctc2_param.h
@@ -22,11 +22,11 @@
 
 /*VMEM Luma params*/
 struct ia_css_isp_ctc2_vmem_params {
-        /**< Gains by Y(Luma) at Y = 0.0,Y_X1, Y_X2, Y_X3, Y_X4*/
+        /** Gains by Y(Luma) at Y = 0.0,Y_X1, Y_X2, Y_X3, Y_X4*/
         VMEM_ARRAY(y_x, ISP_VEC_NELEMS);
-        /** kneepoints by Y(Luma) 0.0, y_x1, y_x2, y _x3, y_x4*/
+        /* kneepoints by Y(Luma) 0.0, y_x1, y_x2, y _x3, y_x4*/
         VMEM_ARRAY(y_y, ISP_VEC_NELEMS);
-        /** Slopes of lines interconnecting
+        /* Slopes of lines interconnecting
          *  0.0 -> y_x1 -> y_x2 -> y _x3 -> y_x4 -> 1.0*/
         VMEM_ARRAY(e_y_slope, ISP_VEC_NELEMS);
 };
@@ -34,15 +34,15 @@ struct ia_css_isp_ctc2_vmem_params {
 /*DMEM Chroma params*/
 struct ia_css_isp_ctc2_dmem_params {
 
-        /** Gains by UV(Chroma) under kneepoints uv_x0 and uv_x1*/
+        /* Gains by UV(Chroma) under kneepoints uv_x0 and uv_x1*/
         int32_t uv_y0;
         int32_t uv_y1;
 
-        /** Kneepoints by UV(Chroma)- uv_x0 and uv_x1*/
+        /* Kneepoints by UV(Chroma)- uv_x0 and uv_x1*/
         int32_t uv_x0;
         int32_t uv_x1;
 
-        /** Slope of line interconnecting uv_x0 -> uv_x1*/
+        /* Slope of line interconnecting uv_x0 -> uv_x1*/
         int32_t uv_dydx;
 
 };
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ctc/ctc2/ia_css_ctc2_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ctc/ctc2/ia_css_ctc2_types.h
index 7b75f01e2ad2..1222cf33e851 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ctc/ctc2/ia_css_ctc2_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ctc/ctc2/ia_css_ctc2_types.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_CTC2_TYPES_H
 #define __IA_CSS_CTC2_TYPES_H
 
-/** Chroma Tone Control configuration.
+/* Chroma Tone Control configuration.
 *
 *  ISP block: CTC2 (CTC by polygonal approximation)
 * (ISP1: CTC1 (CTC by look-up table) is used.)
@@ -24,7 +24,7 @@
 */
 struct ia_css_ctc2_config {
 
-        /**< Gains by Y(Luma) at Y =0.0,Y_X1, Y_X2, Y_X3, Y_X4 and Y_X5
+        /** Gains by Y(Luma) at Y =0.0,Y_X1, Y_X2, Y_X3, Y_X4 and Y_X5
         *   --default/ineffective value: 4096(0.5f)
         */
         int32_t y_y0;
@@ -33,19 +33,19 @@ struct ia_css_ctc2_config {
         int32_t y_y3;
         int32_t y_y4;
         int32_t y_y5;
-        /** 1st-4th  kneepoints by Y(Luma) --default/ineffective value:n/a
+        /* 1st-4th  kneepoints by Y(Luma) --default/ineffective value:n/a
         *   requirement: 0.0 < y_x1 < y_x2 <y _x3 < y_x4 < 1.0
         */
         int32_t y_x1;
         int32_t y_x2;
         int32_t y_x3;
         int32_t y_x4;
-        /** Gains by UV(Chroma) under threholds uv_x0 and uv_x1
+        /* Gains by UV(Chroma) under threholds uv_x0 and uv_x1
         *   --default/ineffective value: 4096(0.5f)
         */
         int32_t uv_y0;
         int32_t uv_y1;
-        /** Minimum and Maximum Thresholds by UV(Chroma)- uv_x0 and uv_x1
+        /* Minimum and Maximum Thresholds by UV(Chroma)- uv_x0 and uv_x1
         *   --default/ineffective value: n/a
         */
         int32_t uv_x0;
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ctc/ctc_1.0/ia_css_ctc_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ctc/ctc_1.0/ia_css_ctc_types.h
index 1da215bb966d..4ac47ce10566 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ctc/ctc_1.0/ia_css_ctc_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ctc/ctc_1.0/ia_css_ctc_types.h
@@ -15,11 +15,11 @@
 #ifndef __IA_CSS_CTC_TYPES_H
 #define __IA_CSS_CTC_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Chroma Tone Control parameters.
 */
 
-/** Fractional bits for CTC gain (used only for ISP1).
+/* Fractional bits for CTC gain (used only for ISP1).
  *
  *  IA_CSS_CTC_COEF_SHIFT(=13) includes not only the fractional bits
  *  of gain(=8), but also the bits(=5) to convert chroma
@@ -32,14 +32,14 @@
  */
 #define IA_CSS_CTC_COEF_SHIFT          13
 
-/** Number of elements in the CTC table. */
+/* Number of elements in the CTC table. */
 #define IA_CSS_VAMEM_1_CTC_TABLE_SIZE_LOG2      10
-/** Number of elements in the CTC table. */
+/* Number of elements in the CTC table. */
 #define IA_CSS_VAMEM_1_CTC_TABLE_SIZE           (1U<<IA_CSS_VAMEM_1_CTC_TABLE_SIZE_LOG2)
 
-/** Number of elements in the CTC table. */
+/* Number of elements in the CTC table. */
 #define IA_CSS_VAMEM_2_CTC_TABLE_SIZE_LOG2      8
-/** Number of elements in the CTC table. */
+/* Number of elements in the CTC table. */
 #define IA_CSS_VAMEM_2_CTC_TABLE_SIZE           ((1U<<IA_CSS_VAMEM_2_CTC_TABLE_SIZE_LOG2) + 1)
 
 enum ia_css_vamem_type {
@@ -47,44 +47,44 @@ enum ia_css_vamem_type {
         IA_CSS_VAMEM_TYPE_2
 };
 
-/** Chroma Tone Control configuration.
+/* Chroma Tone Control configuration.
  *
  *  ISP block: CTC2 (CTC by polygonal line approximation)
  * (ISP1: CTC1 (CTC by look-up table) is used.)
  *  ISP2: CTC2 is used.
  */
 struct ia_css_ctc_config {
-        uint16_t y0;    /**< 1st kneepoint gain.
+        uint16_t y0;    /** 1st kneepoint gain.
                                 u[ce_gain_exp].[13-ce_gain_exp], [0,8191],
                                 default/ineffective 4096(0.5) */
-        uint16_t y1;    /**< 2nd kneepoint gain.
+        uint16_t y1;    /** 2nd kneepoint gain.
                                 u[ce_gain_exp].[13-ce_gain_exp], [0,8191],
                                 default/ineffective 4096(0.5) */
-        uint16_t y2;    /**< 3rd kneepoint gain.
+        uint16_t y2;    /** 3rd kneepoint gain.
                                 u[ce_gain_exp].[13-ce_gain_exp], [0,8191],
                                 default/ineffective 4096(0.5) */
-        uint16_t y3;    /**< 4th kneepoint gain.
+        uint16_t y3;    /** 4th kneepoint gain.
                                 u[ce_gain_exp].[13-ce_gain_exp], [0,8191],
                                 default/ineffective 4096(0.5) */
-        uint16_t y4;    /**< 5th kneepoint gain.
+        uint16_t y4;    /** 5th kneepoint gain.
                                 u[ce_gain_exp].[13-ce_gain_exp], [0,8191],
                                 default/ineffective 4096(0.5) */
-        uint16_t y5;    /**< 6th kneepoint gain.
+        uint16_t y5;    /** 6th kneepoint gain.
                                 u[ce_gain_exp].[13-ce_gain_exp], [0,8191],
                                 default/ineffective 4096(0.5) */
-        uint16_t ce_gain_exp;   /**< Common exponent of y-axis gain.
+        uint16_t ce_gain_exp;   /** Common exponent of y-axis gain.
                                 u8.0, [0,13],
                                 default/ineffective 1 */
-        uint16_t x1;    /**< 2nd kneepoint luma.
+        uint16_t x1;    /** 2nd kneepoint luma.
                                 u0.13, [0,8191], constraints: 0<x1<x2,
                                 default/ineffective 1024 */
-        uint16_t x2;    /**< 3rd kneepoint luma.
+        uint16_t x2;    /** 3rd kneepoint luma.
                                 u0.13, [0,8191], constraints: x1<x2<x3,
                                 default/ineffective 2048 */
-        uint16_t x3;    /**< 4th kneepoint luma.
+        uint16_t x3;    /** 4th kneepoint luma.
                                 u0.13, [0,8191], constraints: x2<x3<x4,
                                 default/ineffective 6144 */
-        uint16_t x4;    /**< 5tn kneepoint luma.
+        uint16_t x4;    /** 5tn kneepoint luma.
                                 u0.13, [0,8191], constraints: x3<x4<8191,
                                 default/ineffective 7168 */
 };
@@ -94,7 +94,7 @@ union ia_css_ctc_data {
         uint16_t vamem_2[IA_CSS_VAMEM_2_CTC_TABLE_SIZE];
 };
 
-/** CTC table, used for Chroma Tone Control.
+/* CTC table, used for Chroma Tone Control.
  *
  *  ISP block: CTC1 (CTC by look-up table)
  *  ISP1: CTC1 is used.
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/de/de_1.0/ia_css_de_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/de/de_1.0/ia_css_de_types.h
index 525c838d5a99..803be68abc54 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/de/de_1.0/ia_css_de_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/de/de_1.0/ia_css_de_types.h
@@ -15,25 +15,25 @@
 #ifndef __IA_CSS_DE_TYPES_H
 #define __IA_CSS_DE_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Demosaic (bayer-to-YCgCo) parameters.
 */
 
-/** Demosaic (bayer-to-YCgCo) configuration.
+/* Demosaic (bayer-to-YCgCo) configuration.
  *
  *  ISP block: DE1
  *  ISP1: DE1 is used.
  * (ISP2: DE2 is used.)
  */
 struct ia_css_de_config {
-        ia_css_u0_16 pixelnoise; /**< Pixel noise used in moire elimination.
+        ia_css_u0_16 pixelnoise; /** Pixel noise used in moire elimination.
                                 u0.16, [0,65535],
                                 default 0, ineffective 0 */
-        ia_css_u0_16 c1_coring_threshold; /**< Coring threshold for C1.
+        ia_css_u0_16 c1_coring_threshold; /** Coring threshold for C1.
                                 This is the same as nr_config.threshold_cb.
                                 u0.16, [0,65535],
                                 default 128(0.001953125), ineffective 0 */
-        ia_css_u0_16 c2_coring_threshold; /**< Coring threshold for C2.
+        ia_css_u0_16 c2_coring_threshold; /** Coring threshold for C2.
                                 This is the same as nr_config.threshold_cr.
                                 u0.16, [0,65535],
                                 default 128(0.001953125), ineffective 0 */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/de/de_2/ia_css_de2_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/de/de_2/ia_css_de2_types.h
index eac1b2779857..50bdde419bb1 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/de/de_2/ia_css_de2_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/de/de_2/ia_css_de2_types.h
@@ -15,24 +15,24 @@
 #ifndef __IA_CSS_DE2_TYPES_H
 #define __IA_CSS_DE2_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Demosaicing parameters.
 */
 
-/** Eigen Color Demosaicing configuration.
+/* Eigen Color Demosaicing configuration.
  *
  *  ISP block: DE2
  * (ISP1: DE1 is used.)
  *  ISP2: DE2 is used.
  */
 struct ia_css_ecd_config {
-        uint16_t zip_strength;  /**< Strength of zipper reduction.
+        uint16_t zip_strength;  /** Strength of zipper reduction.
                                 u0.13, [0,8191],
                                 default 5489(0.67), ineffective 0 */
-        uint16_t fc_strength;   /**< Strength of false color reduction.
+        uint16_t fc_strength;   /** Strength of false color reduction.
                                 u0.13, [0,8191],
                                 default 8191(almost 1.0), ineffective 0 */
-        uint16_t fc_debias;     /**< Prevent color change
+        uint16_t fc_debias;     /** Prevent color change
                                      on noise or Gr/Gb imbalance.
                                 u0.13, [0,8191],
                                 default 0, ineffective 0 */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dp/dp_1.0/ia_css_dp_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dp/dp_1.0/ia_css_dp_types.h
index b5d7b6b175b6..1bf6dcef7dc7 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dp/dp_1.0/ia_css_dp_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dp/dp_1.0/ia_css_dp_types.h
@@ -15,12 +15,12 @@
 #ifndef __IA_CSS_DP_TYPES_H
 #define __IA_CSS_DP_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Defect Pixel Correction (DPC) parameters.
 */
 
 
-/** Defect Pixel Correction configuration.
+/* Defect Pixel Correction configuration.
  *
  *  ISP block: DPC1 (DPC after WB)
  *             DPC2 (DPC before WB)
@@ -28,14 +28,14 @@
  *  ISP2: DPC2 is used.
  */
 struct ia_css_dp_config {
-        ia_css_u0_16 threshold; /**< The threshold of defect pixel correction,
+        ia_css_u0_16 threshold; /** The threshold of defect pixel correction,
                               representing the permissible difference of
                               intensity between one pixel and its
                               surrounding pixels. Smaller values result
                                 in more frequent pixel corrections.
                                 u0.16, [0,65535],
                                 default 8192, ineffective 65535 */
-        ia_css_u8_8 gain;        /**< The sensitivity of mis-correction. ISP will
+        ia_css_u8_8 gain;        /** The sensitivity of mis-correction. ISP will
                               miss a lot of defects if the value is set
                                 too large.
                                 u8.8, [0,65535],
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dpc2/ia_css_dpc2_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dpc2/ia_css_dpc2_types.h
index b2c974196ce8..6727682d287f 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dpc2/ia_css_dpc2_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dpc2/ia_css_dpc2_types.h
@@ -15,14 +15,14 @@
 #ifndef __IA_CSS_DPC2_TYPES_H
 #define __IA_CSS_DPC2_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Defect Pixel Correction 2 (DPC2) parameters.
 */
 
 #include "type_support.h"
 
 /**@{*/
-/** Floating point constants for different metrics. */
+/* Floating point constants for different metrics. */
 #define METRIC1_ONE_FP  (1<<12)
 #define METRIC2_ONE_FP  (1<<5)
 #define METRIC3_ONE_FP  (1<<12)
@@ -30,7 +30,7 @@
 /**@}*/
 
 /**@{*/
-/** Defect Pixel Correction 2 configuration.
+/* Defect Pixel Correction 2 configuration.
  *
  * \brief DPC2 public parameters.
  * \details Struct with all parameters for the Defect Pixel Correction 2
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dvs/dvs_1.0/ia_css_dvs_param.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dvs/dvs_1.0/ia_css_dvs_param.h
index 4d0abfe4d0fd..66a7e58659c0 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dvs/dvs_1.0/ia_css_dvs_param.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dvs/dvs_1.0/ia_css_dvs_param.h
@@ -30,7 +30,7 @@
 #ifdef ISP2401
 
 #endif
-/** dvserence frame */
+/* dvserence frame */
 struct sh_css_isp_dvs_isp_config {
         uint32_t num_horizontal_blocks;
         uint32_t num_vertical_blocks;
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dvs/dvs_1.0/ia_css_dvs_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dvs/dvs_1.0/ia_css_dvs_types.h
index 216c54a21ea5..30772d217fb2 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dvs/dvs_1.0/ia_css_dvs_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/dvs/dvs_1.0/ia_css_dvs_types.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_DVS_TYPES_H
 #define __IA_CSS_DVS_TYPES_H
 
-/** DVS frame
+/* DVS frame
  *
  *  ISP block: dvs frame
  */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/eed1_8/ia_css_eed1_8_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/eed1_8/ia_css_eed1_8_types.h
index 07651f0ac558..32e91824a5e5 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/eed1_8/ia_css_eed1_8_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/eed1_8/ia_css_eed1_8_types.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_EED1_8_TYPES_H
 #define __IA_CSS_EED1_8_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Edge Enhanced Demosaic parameters.
 */
 
@@ -36,51 +36,51 @@
  */
 #define IA_CSS_NUMBER_OF_DEW_ENHANCE_SEGMENTS   9
 
-/** Edge Enhanced Demosaic configuration
+/* Edge Enhanced Demosaic configuration
  *
  * ISP2.6.1: EED1_8 is used.
  */
 
 struct ia_css_eed1_8_config {
-        int32_t rbzp_strength;  /**< Strength of zipper reduction. */
-
-        int32_t fcstrength;     /**< Strength of false color reduction. */
-        int32_t fcthres_0;      /**< Threshold to prevent chroma coring due to noise or green disparity in dark region. */
-        int32_t fcthres_1;      /**< Threshold to prevent chroma coring due to noise or green disparity in bright region. */
-        int32_t fc_sat_coef;    /**< How much color saturation to maintain in high color saturation region. */
-        int32_t fc_coring_prm;  /**< Chroma coring coefficient for tint color suppression. */
-
-        int32_t aerel_thres0;   /**< Threshold for Non-Directional Reliability at dark region. */
-        int32_t aerel_gain0;    /**< Gain for Non-Directional Reliability at dark region. */
-        int32_t aerel_thres1;   /**< Threshold for Non-Directional Reliability at bright region. */
-        int32_t aerel_gain1;    /**< Gain for Non-Directional Reliability at bright region. */
-
-        int32_t derel_thres0;   /**< Threshold for Directional Reliability at dark region. */
-        int32_t derel_gain0;    /**< Gain for Directional Reliability at dark region. */
-        int32_t derel_thres1;   /**< Threshold for Directional Reliability at bright region. */
-        int32_t derel_gain1;    /**< Gain for Directional Reliability at bright region. */
-
-        int32_t coring_pos0;    /**< Positive Edge Coring Threshold in dark region. */
-        int32_t coring_pos1;    /**< Positive Edge Coring Threshold in bright region. */
-        int32_t coring_neg0;    /**< Negative Edge Coring Threshold in dark region. */
-        int32_t coring_neg1;    /**< Negative Edge Coring Threshold in bright region. */
-
-        int32_t gain_exp;       /**< Common Exponent of Gain. */
-        int32_t gain_pos0;      /**< Gain for Positive Edge in dark region. */
-        int32_t gain_pos1;      /**< Gain for Positive Edge in bright region. */
-        int32_t gain_neg0;      /**< Gain for Negative Edge in dark region. */
-        int32_t gain_neg1;      /**< Gain for Negative Edge in bright region. */
-
-        int32_t pos_margin0;    /**< Margin for Positive Edge in dark region. */
-        int32_t pos_margin1;    /**< Margin for Positive Edge in bright region. */
-        int32_t neg_margin0;    /**< Margin for Negative Edge in dark region. */
-        int32_t neg_margin1;    /**< Margin for Negative Edge in bright region. */
-
-        int32_t dew_enhance_seg_x[IA_CSS_NUMBER_OF_DEW_ENHANCE_SEGMENTS];               /**< Segment data for directional edge weight: X. */
-        int32_t dew_enhance_seg_y[IA_CSS_NUMBER_OF_DEW_ENHANCE_SEGMENTS];               /**< Segment data for directional edge weight: Y. */
-        int32_t dew_enhance_seg_slope[(IA_CSS_NUMBER_OF_DEW_ENHANCE_SEGMENTS - 1)];     /**< Segment data for directional edge weight: Slope. */
-        int32_t dew_enhance_seg_exp[(IA_CSS_NUMBER_OF_DEW_ENHANCE_SEGMENTS - 1)];       /**< Segment data for directional edge weight: Exponent. */
-        int32_t dedgew_max;     /**< Max Weight for Directional Edge. */
+        int32_t rbzp_strength;  /** Strength of zipper reduction. */
+
+        int32_t fcstrength;     /** Strength of false color reduction. */
+        int32_t fcthres_0;      /** Threshold to prevent chroma coring due to noise or green disparity in dark region. */
+        int32_t fcthres_1;      /** Threshold to prevent chroma coring due to noise or green disparity in bright region. */
+        int32_t fc_sat_coef;    /** How much color saturation to maintain in high color saturation region. */
+        int32_t fc_coring_prm;  /** Chroma coring coefficient for tint color suppression. */
+
+        int32_t aerel_thres0;   /** Threshold for Non-Directional Reliability at dark region. */
+        int32_t aerel_gain0;    /** Gain for Non-Directional Reliability at dark region. */
+        int32_t aerel_thres1;   /** Threshold for Non-Directional Reliability at bright region. */
+        int32_t aerel_gain1;    /** Gain for Non-Directional Reliability at bright region. */
+
+        int32_t derel_thres0;   /** Threshold for Directional Reliability at dark region. */
+        int32_t derel_gain0;    /** Gain for Directional Reliability at dark region. */
+        int32_t derel_thres1;   /** Threshold for Directional Reliability at bright region. */
+        int32_t derel_gain1;    /** Gain for Directional Reliability at bright region. */
+
+        int32_t coring_pos0;    /** Positive Edge Coring Threshold in dark region. */
+        int32_t coring_pos1;    /** Positive Edge Coring Threshold in bright region. */
+        int32_t coring_neg0;    /** Negative Edge Coring Threshold in dark region. */
+        int32_t coring_neg1;    /** Negative Edge Coring Threshold in bright region. */
+
+        int32_t gain_exp;       /** Common Exponent of Gain. */
+        int32_t gain_pos0;      /** Gain for Positive Edge in dark region. */
+        int32_t gain_pos1;      /** Gain for Positive Edge in bright region. */
+        int32_t gain_neg0;      /** Gain for Negative Edge in dark region. */
+        int32_t gain_neg1;      /** Gain for Negative Edge in bright region. */
+
+        int32_t pos_margin0;    /** Margin for Positive Edge in dark region. */
+        int32_t pos_margin1;    /** Margin for Positive Edge in bright region. */
+        int32_t neg_margin0;    /** Margin for Negative Edge in dark region. */
+        int32_t neg_margin1;    /** Margin for Negative Edge in bright region. */
+
+        int32_t dew_enhance_seg_x[IA_CSS_NUMBER_OF_DEW_ENHANCE_SEGMENTS];               /** Segment data for directional edge weight: X. */
+        int32_t dew_enhance_seg_y[IA_CSS_NUMBER_OF_DEW_ENHANCE_SEGMENTS];               /** Segment data for directional edge weight: Y. */
+        int32_t dew_enhance_seg_slope[(IA_CSS_NUMBER_OF_DEW_ENHANCE_SEGMENTS - 1)];     /** Segment data for directional edge weight: Slope. */
+        int32_t dew_enhance_seg_exp[(IA_CSS_NUMBER_OF_DEW_ENHANCE_SEGMENTS - 1)];       /** Segment data for directional edge weight: Exponent. */
+        int32_t dedgew_max;     /** Max Weight for Directional Edge. */
 };
 
 #endif /* __IA_CSS_EED1_8_TYPES_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/fc/fc_1.0/ia_css_formats_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/fc/fc_1.0/ia_css_formats_types.h
index df1565a5914c..49479572b40d 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/fc/fc_1.0/ia_css_formats_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/fc/fc_1.0/ia_css_formats_types.h
@@ -15,20 +15,20 @@
 #ifndef __IA_CSS_FORMATS_TYPES_H
 #define __IA_CSS_FORMATS_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for output format parameters.
 */
 
 #include "type_support.h"
 
-/** Formats configuration.
+/* Formats configuration.
  *
  *  ISP block: FORMATS
  *  ISP1: FORMATS is used.
  *  ISP2: FORMATS is used.
  */
 struct ia_css_formats_config {
-        uint32_t video_full_range_flag; /**< selects the range of YUV output.
+        uint32_t video_full_range_flag; /** selects the range of YUV output.
                                 u8.0, [0,1],
                                 default 1, ineffective n/a\n
                                 1 - full range, luma 0-255, chroma 0-255\n
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/fpn/fpn_1.0/ia_css_fpn_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/fpn/fpn_1.0/ia_css_fpn_types.h
index 5a2f0c06a80d..ef287fa3c428 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/fpn/fpn_1.0/ia_css_fpn_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/fpn/fpn_1.0/ia_css_fpn_types.h
@@ -15,11 +15,11 @@
 #ifndef __IA_CSS_FPN_TYPES_H
 #define __IA_CSS_FPN_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Fixed Pattern Noise parameters.
 */
 
-/** Fixed Pattern Noise table.
+/* Fixed Pattern Noise table.
  *
  *  This contains the fixed patterns noise values
  *  obtained from a black frame capture.
@@ -33,15 +33,15 @@
  */
 
 struct ia_css_fpn_table {
-        int16_t *data;          /**< Table content (fixed patterns noise).
+        int16_t *data;          /** Table content (fixed patterns noise).
                                         u0.[13-shift], [0,63] */
-        uint32_t width;         /**< Table width (in pixels).
+        uint32_t width;         /** Table width (in pixels).
                                         This is the input frame width. */
-        uint32_t height;        /**< Table height (in pixels).
+        uint32_t height;        /** Table height (in pixels).
                                         This is the input frame height. */
-        uint32_t shift;         /**< Common exponent of table content.
+        uint32_t shift;         /** Common exponent of table content.
                                         u8.0, [0,13] */
-        uint32_t enabled;       /**< Fpn is enabled.
+        uint32_t enabled;       /** Fpn is enabled.
                                         bool */
 };
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/gc/gc_1.0/ia_css_gc_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/gc/gc_1.0/ia_css_gc_types.h
index dd9f0eda3353..594807fe2925 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/gc/gc_1.0/ia_css_gc_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/gc/gc_1.0/ia_css_gc_types.h
@@ -15,36 +15,36 @@
 #ifndef __IA_CSS_GC_TYPES_H
 #define __IA_CSS_GC_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Gamma Correction parameters.
 */
 
 #include "isp/kernels/ctc/ctc_1.0/ia_css_ctc_types.h"  /* FIXME: Needed for ia_css_vamem_type */
 
-/** Fractional bits for GAMMA gain */
+/* Fractional bits for GAMMA gain */
 #define IA_CSS_GAMMA_GAIN_K_SHIFT      13
 
-/** Number of elements in the gamma table. */
+/* Number of elements in the gamma table. */
 #define IA_CSS_VAMEM_1_GAMMA_TABLE_SIZE_LOG2    10
 #define IA_CSS_VAMEM_1_GAMMA_TABLE_SIZE         (1U<<IA_CSS_VAMEM_1_GAMMA_TABLE_SIZE_LOG2)
 
-/** Number of elements in the gamma table. */
+/* Number of elements in the gamma table. */
 #define IA_CSS_VAMEM_2_GAMMA_TABLE_SIZE_LOG2    8
 #define IA_CSS_VAMEM_2_GAMMA_TABLE_SIZE         ((1U<<IA_CSS_VAMEM_2_GAMMA_TABLE_SIZE_LOG2) + 1)
 
-/** Gamma table, used for Y(Luma) Gamma Correction.
+/* Gamma table, used for Y(Luma) Gamma Correction.
  *
  *  ISP block: GC1 (YUV Gamma Correction)
  *  ISP1: GC1 is used.
  * (ISP2: GC2(sRGB Gamma Correction) is used.)
  */
-/**< IA_CSS_VAMEM_TYPE_1(ISP2300) or
+/** IA_CSS_VAMEM_TYPE_1(ISP2300) or
      IA_CSS_VAMEM_TYPE_2(ISP2400) */
 union ia_css_gc_data {
         uint16_t vamem_1[IA_CSS_VAMEM_1_GAMMA_TABLE_SIZE];
-        /**< Y(Luma) Gamma table on vamem type 1. u0.8, [0,255] */
+        /** Y(Luma) Gamma table on vamem type 1. u0.8, [0,255] */
         uint16_t vamem_2[IA_CSS_VAMEM_2_GAMMA_TABLE_SIZE];
-        /**< Y(Luma) Gamma table on vamem type 2. u0.8, [0,255] */
+        /** Y(Luma) Gamma table on vamem type 2. u0.8, [0,255] */
 };
 
 struct ia_css_gamma_table {
@@ -52,22 +52,22 @@ struct ia_css_gamma_table {
         union ia_css_gc_data data;
 };
 
-/** Gamma Correction configuration (used only for YUV Gamma Correction).
+/* Gamma Correction configuration (used only for YUV Gamma Correction).
  *
  *  ISP block: GC1 (YUV Gamma Correction)
  *  ISP1: GC1 is used.
  * (ISP2: GC2 (sRGB Gamma Correction) is used.)
   */
 struct ia_css_gc_config {
-        uint16_t gain_k1; /**< Gain to adjust U after YUV Gamma Correction.
+        uint16_t gain_k1; /** Gain to adjust U after YUV Gamma Correction.
                                 u0.16, [0,65535],
                                 default/ineffective 19000(0.29) */
-        uint16_t gain_k2; /**< Gain to adjust V after YUV Gamma Correction.
+        uint16_t gain_k2; /** Gain to adjust V after YUV Gamma Correction.
                                 u0.16, [0,65535],
                                 default/ineffective 19000(0.29) */
 };
 
-/** Chroma Enhancement configuration.
+/* Chroma Enhancement configuration.
  *
  *  This parameter specifies range of chroma output level.
  *  The standard range is [0,255] or [16,240].
@@ -77,20 +77,20 @@ struct ia_css_gc_config {
  * (ISP2: CE1 is not used.)
  */
 struct ia_css_ce_config {
-        uint8_t uv_level_min; /**< Minimum of chroma output level.
+        uint8_t uv_level_min; /** Minimum of chroma output level.
                                 u0.8, [0,255], default/ineffective 0 */
-        uint8_t uv_level_max; /**< Maximum of chroma output level.
+        uint8_t uv_level_max; /** Maximum of chroma output level.
                                 u0.8, [0,255], default/ineffective 255 */
 };
 
-/** Multi-Axes Color Correction (MACC) configuration.
+/* Multi-Axes Color Correction (MACC) configuration.
  *
  *  ISP block: MACC2 (MACC by matrix and exponent(ia_css_macc_config))
  * (ISP1: MACC1 (MACC by only matrix) is used.)
  *  ISP2: MACC2 is used.
  */
 struct ia_css_macc_config {
-        uint8_t exp;    /**< Common exponent of ia_css_macc_table.
+        uint8_t exp;    /** Common exponent of ia_css_macc_table.
                                 u8.0, [0,13], default 1, ineffective 1 */
 };
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/gc/gc_2/ia_css_gc2_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/gc/gc_2/ia_css_gc2_types.h
index e439583bdfb6..fab7467d30a5 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/gc/gc_2/ia_css_gc2_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/gc/gc_2/ia_css_gc2_types.h
@@ -17,33 +17,33 @@
 
 #include "isp/kernels/ctc/ctc_1.0/ia_css_ctc_types.h"  /* FIXME: needed for ia_css_vamem_type */
 
-/** @file
+/* @file
 * CSS-API header file for Gamma Correction parameters.
 */
 
-/** sRGB Gamma table, used for sRGB Gamma Correction.
+/* sRGB Gamma table, used for sRGB Gamma Correction.
  *
  *  ISP block: GC2 (sRGB Gamma Correction)
  * (ISP1: GC1(YUV Gamma Correction) is used.)
  *  ISP2: GC2 is used.
  */
 
-/** Number of elements in the sRGB gamma table. */
+/* Number of elements in the sRGB gamma table. */
 #define IA_CSS_VAMEM_1_RGB_GAMMA_TABLE_SIZE_LOG2 8
 #define IA_CSS_VAMEM_1_RGB_GAMMA_TABLE_SIZE      (1U<<IA_CSS_VAMEM_1_RGB_GAMMA_TABLE_SIZE_LOG2)
 
-/** Number of elements in the sRGB gamma table. */
+/* Number of elements in the sRGB gamma table. */
 #define IA_CSS_VAMEM_2_RGB_GAMMA_TABLE_SIZE_LOG2    8
 #define IA_CSS_VAMEM_2_RGB_GAMMA_TABLE_SIZE     ((1U<<IA_CSS_VAMEM_2_RGB_GAMMA_TABLE_SIZE_LOG2) + 1)
 
-/**< IA_CSS_VAMEM_TYPE_1(ISP2300) or
+/** IA_CSS_VAMEM_TYPE_1(ISP2300) or
      IA_CSS_VAMEM_TYPE_2(ISP2400) */
 union ia_css_rgb_gamma_data {
         uint16_t vamem_1[IA_CSS_VAMEM_1_RGB_GAMMA_TABLE_SIZE];
-        /**< RGB Gamma table on vamem type1. This table is not used,
+        /** RGB Gamma table on vamem type1. This table is not used,
                 because sRGB Gamma Correction is not implemented for ISP2300. */
         uint16_t vamem_2[IA_CSS_VAMEM_2_RGB_GAMMA_TABLE_SIZE];
-                /**< RGB Gamma table on vamem type2. u0.12, [0,4095] */
+                /** RGB Gamma table on vamem type2. u0.12, [0,4095] */
 };
 
 struct ia_css_rgb_gamma_table {
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/hdr/ia_css_hdr_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/hdr/ia_css_hdr_types.h
index c3345b32e3e6..26464421b077 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/hdr/ia_css_hdr_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/hdr/ia_css_hdr_types.h
@@ -24,14 +24,14 @@
  * \detail Currently HDR paramters are used only for testing purposes
  */
 struct ia_css_hdr_irradiance_params {
-        int test_irr;                                          /**< Test parameter */
-        int match_shift[IA_CSS_HDR_MAX_NUM_INPUT_FRAMES - 1];  /**< Histogram matching shift parameter */
-        int match_mul[IA_CSS_HDR_MAX_NUM_INPUT_FRAMES - 1];    /**< Histogram matching multiplication parameter */
-        int thr_low[IA_CSS_HDR_MAX_NUM_INPUT_FRAMES - 1];      /**< Weight map soft threshold low bound parameter */
-        int thr_high[IA_CSS_HDR_MAX_NUM_INPUT_FRAMES - 1];     /**< Weight map soft threshold high bound parameter */
-        int thr_coeff[IA_CSS_HDR_MAX_NUM_INPUT_FRAMES - 1];    /**< Soft threshold linear function coefficien */
-        int thr_shift[IA_CSS_HDR_MAX_NUM_INPUT_FRAMES - 1];    /**< Soft threshold precision shift parameter */
-        int weight_bpp;                                        /**< Weight map bits per pixel */
+        int test_irr;                                          /** Test parameter */
+        int match_shift[IA_CSS_HDR_MAX_NUM_INPUT_FRAMES - 1];  /** Histogram matching shift parameter */
+        int match_mul[IA_CSS_HDR_MAX_NUM_INPUT_FRAMES - 1];    /** Histogram matching multiplication parameter */
+        int thr_low[IA_CSS_HDR_MAX_NUM_INPUT_FRAMES - 1];      /** Weight map soft threshold low bound parameter */
+        int thr_high[IA_CSS_HDR_MAX_NUM_INPUT_FRAMES - 1];     /** Weight map soft threshold high bound parameter */
+        int thr_coeff[IA_CSS_HDR_MAX_NUM_INPUT_FRAMES - 1];    /** Soft threshold linear function coefficien */
+        int thr_shift[IA_CSS_HDR_MAX_NUM_INPUT_FRAMES - 1];    /** Soft threshold precision shift parameter */
+        int weight_bpp;                                        /** Weight map bits per pixel */
 };
 
 /**
@@ -39,7 +39,7 @@ struct ia_css_hdr_irradiance_params {
  * \detail Currently HDR paramters are used only for testing purposes
  */
 struct ia_css_hdr_deghost_params {
-        int test_deg; /**< Test parameter */
+        int test_deg; /** Test parameter */
 };
 
 /**
@@ -47,7 +47,7 @@ struct ia_css_hdr_deghost_params {
  * \detail Currently HDR paramters are used only for testing purposes
  */
 struct ia_css_hdr_exclusion_params {
-        int test_excl; /**< Test parameter */
+        int test_excl; /** Test parameter */
 };
 
 /**
@@ -56,9 +56,9 @@ struct ia_css_hdr_exclusion_params {
  * the CSS API. Currenly, only test paramters are defined.
  */
 struct ia_css_hdr_config {
-        struct ia_css_hdr_irradiance_params irradiance; /**< HDR irradiance paramaters */
-        struct ia_css_hdr_deghost_params    deghost;    /**< HDR deghosting parameters */
-        struct ia_css_hdr_exclusion_params  exclusion; /**< HDR exclusion parameters */
+        struct ia_css_hdr_irradiance_params irradiance; /** HDR irradiance paramaters */
+        struct ia_css_hdr_deghost_params    deghost;    /** HDR deghosting parameters */
+        struct ia_css_hdr_exclusion_params  exclusion; /** HDR exclusion parameters */
 };
 
 #endif /* __IA_CSS_HDR_TYPES_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ipu2_io_ls/bayer_io_ls/ia_css_bayer_io.host.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ipu2_io_ls/bayer_io_ls/ia_css_bayer_io.host.c
index 78e159c04851..f80480cf9de2 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ipu2_io_ls/bayer_io_ls/ia_css_bayer_io.host.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ipu2_io_ls/bayer_io_ls/ia_css_bayer_io.host.c
@@ -1,5 +1,5 @@
 #ifdef ISP2401
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ipu2_io_ls/yuv444_io_ls/ia_css_yuv444_io.host.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ipu2_io_ls/yuv444_io_ls/ia_css_yuv444_io.host.c
index f7e1a632c47e..eb9e9439cc21 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ipu2_io_ls/yuv444_io_ls/ia_css_yuv444_io.host.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ipu2_io_ls/yuv444_io_ls/ia_css_yuv444_io.host.c
@@ -1,5 +1,5 @@
 #ifdef ISP2401
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/macc/macc1_5/ia_css_macc1_5_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/macc/macc1_5/ia_css_macc1_5_types.h
index 3d510bf5886a..9cd31c2c0253 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/macc/macc1_5/ia_css_macc1_5_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/macc/macc1_5/ia_css_macc1_5_types.h
@@ -15,22 +15,22 @@
 #ifndef __IA_CSS_MACC1_5_TYPES_H
 #define __IA_CSS_MACC1_5_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Multi-Axis Color Conversion algorithm parameters.
 */
 
-/** Multi-Axis Color Conversion configuration
+/* Multi-Axis Color Conversion configuration
  *
  * ISP2.6.1: MACC1_5 is used.
  */
 
 
-/** Number of axes in the MACC table. */
+/* Number of axes in the MACC table. */
 #define IA_CSS_MACC_NUM_AXES           16
-/** Number of coefficients per MACC axes. */
+/* Number of coefficients per MACC axes. */
 #define IA_CSS_MACC_NUM_COEFS          4
 
-/** Multi-Axes Color Correction (MACC) table.
+/* Multi-Axes Color Correction (MACC) table.
  *
  *  ISP block: MACC (MACC by only matrix)
  *             MACC1_5 (MACC by matrix and exponent(ia_css_macc_config))
@@ -55,19 +55,19 @@
  */
 struct ia_css_macc1_5_table {
         int16_t data[IA_CSS_MACC_NUM_COEFS * IA_CSS_MACC_NUM_AXES];
-        /**< 16 of 2x2 matix
+        /** 16 of 2x2 matix
           MACC1_5: s[macc_config.exp].[13-macc_config.exp], [-8192,8191]
             default/ineffective: (s1.12)
                 16 of "identity 2x2 matix" {4096,0,0,4096} */
 };
 
-/** Multi-Axes Color Correction (MACC) configuration.
+/* Multi-Axes Color Correction (MACC) configuration.
  *
  *  ISP block: MACC1_5 (MACC by matrix and exponent(ia_css_macc_config))
  *  ISP2: MACC1_5 is used.
  */
 struct ia_css_macc1_5_config {
-        uint8_t exp;    /**< Common exponent of ia_css_macc_table.
+        uint8_t exp;    /** Common exponent of ia_css_macc_table.
                                 u8.0, [0,13], default 1, ineffective 1 */
 };
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/macc/macc_1.0/ia_css_macc_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/macc/macc_1.0/ia_css_macc_types.h
index a25581c6f3ac..2c9e5a8ceb98 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/macc/macc_1.0/ia_css_macc_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/macc/macc_1.0/ia_css_macc_types.h
@@ -15,17 +15,17 @@
 #ifndef __IA_CSS_MACC_TYPES_H
 #define __IA_CSS_MACC_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Multi-Axis Color Correction (MACC) parameters.
 */
 
-/** Number of axes in the MACC table. */
+/* Number of axes in the MACC table. */
 #define IA_CSS_MACC_NUM_AXES           16
-/** Number of coefficients per MACC axes. */
+/* Number of coefficients per MACC axes. */
 #define IA_CSS_MACC_NUM_COEFS          4
-/** The number of planes in the morphing table. */
+/* The number of planes in the morphing table. */
 
-/** Multi-Axis Color Correction (MACC) table.
+/* Multi-Axis Color Correction (MACC) table.
  *
  *  ISP block: MACC1 (MACC by only matrix)
  *             MACC2 (MACC by matrix and exponent(ia_css_macc_config))
@@ -51,7 +51,7 @@
 
 struct ia_css_macc_table {
         int16_t data[IA_CSS_MACC_NUM_COEFS * IA_CSS_MACC_NUM_AXES];
-        /**< 16 of 2x2 matix
+        /** 16 of 2x2 matix
           MACC1: s2.13, [-65536,65535]
             default/ineffective:
                 16 of "identity 2x2 matix" {8192,0,0,8192}
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ob/ob2/ia_css_ob2_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ob/ob2/ia_css_ob2_types.h
index eeaadfeb5a1e..d981394c1c11 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ob/ob2/ia_css_ob2_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ob/ob2/ia_css_ob2_types.h
@@ -15,11 +15,11 @@
 #ifndef __IA_CSS_OB2_TYPES_H
 #define __IA_CSS_OB2_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Optical Black algorithm parameters.
 */
 
-/** Optical Black configuration
+/* Optical Black configuration
  *
  * ISP2.6.1: OB2 is used.
  */
@@ -27,16 +27,16 @@
 #include "ia_css_frac.h"
 
 struct ia_css_ob2_config {
-        ia_css_u0_16 level_gr;    /**< Black level for GR pixels.
+        ia_css_u0_16 level_gr;    /** Black level for GR pixels.
                                         u0.16, [0,65535],
                                         default/ineffective 0 */
-        ia_css_u0_16  level_r;     /**< Black level for R pixels.
+        ia_css_u0_16  level_r;     /** Black level for R pixels.
                                         u0.16, [0,65535],
                                         default/ineffective 0 */
-        ia_css_u0_16  level_b;     /**< Black level for B pixels.
+        ia_css_u0_16  level_b;     /** Black level for B pixels.
                                         u0.16, [0,65535],
                                         default/ineffective 0 */
-        ia_css_u0_16  level_gb;    /**< Black level for GB pixels.
+        ia_css_u0_16  level_gb;    /** Black level for GB pixels.
                                         u0.16, [0,65535],
                                         default/ineffective 0 */
 };
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ob/ob_1.0/ia_css_ob_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ob/ob_1.0/ia_css_ob_types.h
index 88459b6c003d..a9717b8f44ac 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ob/ob_1.0/ia_css_ob_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ob/ob_1.0/ia_css_ob_types.h
@@ -15,51 +15,51 @@
 #ifndef __IA_CSS_OB_TYPES_H
 #define __IA_CSS_OB_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Optical Black level parameters.
 */
 
 #include "ia_css_frac.h"
 
-/** Optical black mode.
+/* Optical black mode.
  */
 enum ia_css_ob_mode {
-        IA_CSS_OB_MODE_NONE,    /**< OB has no effect. */
-        IA_CSS_OB_MODE_FIXED,   /**< Fixed OB */
-        IA_CSS_OB_MODE_RASTER   /**< Raster OB */
+        IA_CSS_OB_MODE_NONE,    /** OB has no effect. */
+        IA_CSS_OB_MODE_FIXED,   /** Fixed OB */
+        IA_CSS_OB_MODE_RASTER   /** Raster OB */
 };
 
-/** Optical Black level configuration.
+/* Optical Black level configuration.
  *
  *  ISP block: OB1
  *  ISP1: OB1 is used.
  *  ISP2: OB1 is used.
  */
 struct ia_css_ob_config {
-        enum ia_css_ob_mode mode; /**< Mode (None / Fixed / Raster).
+        enum ia_css_ob_mode mode; /** Mode (None / Fixed / Raster).
                                         enum, [0,2],
                                         default 1, ineffective 0 */
-        ia_css_u0_16 level_gr;    /**< Black level for GR pixels
+        ia_css_u0_16 level_gr;    /** Black level for GR pixels
                                         (used for Fixed Mode only).
                                         u0.16, [0,65535],
                                         default/ineffective 0 */
-        ia_css_u0_16 level_r;     /**< Black level for R pixels
+        ia_css_u0_16 level_r;     /** Black level for R pixels
                                         (used for Fixed Mode only).
                                         u0.16, [0,65535],
                                         default/ineffective 0 */
-        ia_css_u0_16 level_b;     /**< Black level for B pixels
+        ia_css_u0_16 level_b;     /** Black level for B pixels
                                         (used for Fixed Mode only).
                                         u0.16, [0,65535],
                                         default/ineffective 0 */
-        ia_css_u0_16 level_gb;    /**< Black level for GB pixels
+        ia_css_u0_16 level_gb;    /** Black level for GB pixels
                                         (used for Fixed Mode only).
                                         u0.16, [0,65535],
                                         default/ineffective 0 */
-        uint16_t start_position; /**< Start position of OB area
+        uint16_t start_position; /** Start position of OB area
                                         (used for Raster Mode only).
                                         u16.0, [0,63],
                                         default/ineffective 0 */
-        uint16_t end_position;  /**< End position of OB area
+        uint16_t end_position;  /** End position of OB area
                                         (used for Raster Mode only).
                                         u16.0, [0,63],
                                         default/ineffective 0 */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/output/output_1.0/ia_css_output_param.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/output/output_1.0/ia_css_output_param.h
index 26ec27e085c1..eb7defa41145 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/output/output_1.0/ia_css_output_param.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/output/output_1.0/ia_css_output_param.h
@@ -19,7 +19,7 @@
 #include "dma.h"
 #include "ia_css_frame_comm.h" /* ia_css_frame_sp_info */
 
-/** output frame */
+/* output frame */
 struct sh_css_isp_output_isp_config {
         uint32_t width_a_over_b;
         uint32_t height;
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/output/output_1.0/ia_css_output_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/output/output_1.0/ia_css_output_types.h
index 4335ac28b31d..9c7342fb8145 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/output/output_1.0/ia_css_output_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/output/output_1.0/ia_css_output_types.h
@@ -15,11 +15,11 @@
 #ifndef __IA_CSS_OUTPUT_TYPES_H
 #define __IA_CSS_OUTPUT_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for parameters of output frames.
 */
 
-/** Output frame
+/* Output frame
  *
  *  ISP block: output frame
  */
@@ -40,8 +40,8 @@ struct ia_css_output1_configuration {
 };
 
 struct ia_css_output_config {
-        uint8_t enable_hflip;  /**< enable horizontal output mirroring */
-        uint8_t enable_vflip;  /**< enable vertical output mirroring */
+        uint8_t enable_hflip;  /** enable horizontal output mirroring */
+        uint8_t enable_vflip;  /** enable vertical output mirroring */
 };
 
 #endif /* __IA_CSS_OUTPUT_TYPES_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/qplane/qplane_2/ia_css_qplane_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/qplane/qplane_2/ia_css_qplane_types.h
index 955fd472a241..62d371841619 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/qplane/qplane_2/ia_css_qplane_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/qplane/qplane_2/ia_css_qplane_types.h
@@ -18,7 +18,7 @@
 #include <ia_css_frame_public.h>
 #include "sh_css_internal.h"
 
-/** qplane frame
+/* qplane frame
  *
  *  ISP block: qplane frame
  */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/raw/raw_1.0/ia_css_raw_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/raw/raw_1.0/ia_css_raw_types.h
index 54f8c299d227..5c0b8febd79a 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/raw/raw_1.0/ia_css_raw_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/raw/raw_1.0/ia_css_raw_types.h
@@ -18,7 +18,7 @@
 #include <ia_css_frame_public.h>
 #include "sh_css_internal.h"
 
-/** Raw frame
+/* Raw frame
  *
  *  ISP block: Raw frame
  */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ref/ref_1.0/ia_css_ref_param.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ref/ref_1.0/ia_css_ref_param.h
index 1f1b72a417d1..026443b999a6 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ref/ref_1.0/ia_css_ref_param.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ref/ref_1.0/ia_css_ref_param.h
@@ -19,7 +19,7 @@
 #include "sh_css_defs.h"
 #include "dma.h"
 
-/** Reference frame */
+/* Reference frame */
 struct ia_css_ref_configuration {
         const struct ia_css_frame *ref_frames[MAX_NUM_VIDEO_DELAY_FRAMES];
         uint32_t dvs_frame_delay;
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ref/ref_1.0/ia_css_ref_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ref/ref_1.0/ia_css_ref_types.h
index ce0eaeeee9c6..4750fba268b9 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ref/ref_1.0/ia_css_ref_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ref/ref_1.0/ia_css_ref_types.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_REF_TYPES_H
 #define __IA_CSS_REF_TYPES_H
 
-/** Reference frame
+/* Reference frame
  *
  *  ISP block: reference frame
  */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/s3a/s3a_1.0/ia_css_s3a_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/s3a/s3a_1.0/ia_css_s3a_types.h
index f57ed1ec5981..8d674d2c6427 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/s3a/s3a_1.0/ia_css_s3a_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/s3a/s3a_1.0/ia_css_s3a_types.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_S3A_TYPES_H
 #define __IA_CSS_S3A_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for 3A statistics parameters.
 */
 
@@ -25,11 +25,11 @@
 #include "../../../../components/stats_3a/src/stats_3a_public.h"
 #endif
 
-/** 3A configuration. This configures the 3A statistics collection
+/* 3A configuration. This configures the 3A statistics collection
  *  module.
  */
  
-/** 3A statistics grid
+/* 3A statistics grid
  *
  *  ISP block: S3A1 (3A Support for 3A ver.1 (Histogram is not used for AE))
  *             S3A2 (3A Support for 3A ver.2 (Histogram is used for AE))
@@ -39,23 +39,23 @@
 struct ia_css_3a_grid_info {
 
 #if defined(SYSTEM_css_skycam_c0_system)
-        uint32_t ae_enable;                                     /**< ae enabled in binary,
+        uint32_t ae_enable;                                     /** ae enabled in binary,
                                                                    0:disabled, 1:enabled */
-        struct ae_public_config_grid_config     ae_grd_info;    /**< see description in ae_public.h*/
+        struct ae_public_config_grid_config     ae_grd_info;    /** see description in ae_public.h*/
 
-        uint32_t awb_enable;                                    /**< awb enabled in binary,
+        uint32_t awb_enable;                                    /** awb enabled in binary,
                                                                    0:disabled, 1:enabled */
-        struct awb_public_config_grid_config    awb_grd_info;   /**< see description in awb_public.h*/
+        struct awb_public_config_grid_config    awb_grd_info;   /** see description in awb_public.h*/
 
-        uint32_t af_enable;                                     /**< af enabled in binary,
+        uint32_t af_enable;                                     /** af enabled in binary,
                                                                    0:disabled, 1:enabled */
-        struct af_public_grid_config            af_grd_info;    /**< see description in af_public.h*/
+        struct af_public_grid_config            af_grd_info;    /** see description in af_public.h*/
 
-        uint32_t awb_fr_enable;                                 /**< awb_fr enabled in binary,
+        uint32_t awb_fr_enable;                                 /** awb_fr enabled in binary,
                                                                    0:disabled, 1:enabled */
-        struct awb_fr_public_grid_config        awb_fr_grd_info;/**< see description in awb_fr_public.h*/
+        struct awb_fr_public_grid_config        awb_fr_grd_info;/** see description in awb_fr_public.h*/
   
-        uint32_t elem_bit_depth;    /**< TODO:Taken from BYT  - need input from AIQ
+        uint32_t elem_bit_depth;    /** TODO:Taken from BYT  - need input from AIQ
                                         if needed for SKC
                                         Bit depth of element used
                                         to calculate 3A statistics.
@@ -63,34 +63,34 @@ struct ia_css_3a_grid_info {
                                         bayer bit depth in DSP. */
 
 #else
-        uint32_t enable;            /**< 3A statistics enabled.
+        uint32_t enable;            /** 3A statistics enabled.
                                         0:disabled, 1:enabled */
-        uint32_t use_dmem;          /**< DMEM or VMEM determines layout.
+        uint32_t use_dmem;          /** DMEM or VMEM determines layout.
                                         0:3A statistics are stored to VMEM,
                                         1:3A statistics are stored to DMEM */
-        uint32_t has_histogram;     /**< Statistics include histogram.
+        uint32_t has_histogram;     /** Statistics include histogram.
                                         0:no histogram, 1:has histogram */
-        uint32_t width;             /**< Width of 3A grid table.
+        uint32_t width;             /** Width of 3A grid table.
                                         (= Horizontal number of grid cells
                                         in table, which cells have effective
                                         statistics.) */
-        uint32_t height;            /**< Height of 3A grid table.
+        uint32_t height;            /** Height of 3A grid table.
                                         (= Vertical number of grid cells
                                         in table, which cells have effective
                                         statistics.) */
-        uint32_t aligned_width;     /**< Horizontal stride (for alloc).
+        uint32_t aligned_width;     /** Horizontal stride (for alloc).
                                         (= Horizontal number of grid cells
                                         in table, which means
                                         the allocated width.) */
-        uint32_t aligned_height;    /**< Vertical stride (for alloc).
+        uint32_t aligned_height;    /** Vertical stride (for alloc).
                                         (= Vertical number of grid cells
                                         in table, which means
                                         the allocated height.) */
-        uint32_t bqs_per_grid_cell; /**< Grid cell size in BQ(Bayer Quad) unit.
+        uint32_t bqs_per_grid_cell; /** Grid cell size in BQ(Bayer Quad) unit.
                                         (1BQ means {Gr,R,B,Gb}(2x2 pixels).)
                                         Valid values are 8,16,32,64. */
-        uint32_t deci_factor_log2;  /**< log2 of bqs_per_grid_cell. */
-        uint32_t elem_bit_depth;    /**< Bit depth of element used
+        uint32_t deci_factor_log2;  /** log2 of bqs_per_grid_cell. */
+        uint32_t elem_bit_depth;    /** Bit depth of element used
                                         to calculate 3A statistics.
                                         This is 13, which is the normalized
                                         bayer bit depth in DSP. */
@@ -148,7 +148,7 @@ struct ia_css_3a_grid_info {
  * However, that will require driver/ 3A lib modifications.
  */
 
-/** 3A configuration. This configures the 3A statistics collection
+/* 3A configuration. This configures the 3A statistics collection
  *  module.
  *
  *  ae_y_*: Coefficients to calculate luminance from bayer.
@@ -167,38 +167,38 @@ struct ia_css_3a_grid_info {
  *  ISP2: S3A2 and SDVS2 are used.
  */
 struct ia_css_3a_config {
-        ia_css_u0_16 ae_y_coef_r;       /**< Weight of R for Y.
+        ia_css_u0_16 ae_y_coef_r;       /** Weight of R for Y.
                                                 u0.16, [0,65535],
                                                 default/ineffective 25559 */
-        ia_css_u0_16 ae_y_coef_g;       /**< Weight of G for Y.
+        ia_css_u0_16 ae_y_coef_g;       /** Weight of G for Y.
                                                 u0.16, [0,65535],
                                                 default/ineffective 32768 */
-        ia_css_u0_16 ae_y_coef_b;       /**< Weight of B for Y.
+        ia_css_u0_16 ae_y_coef_b;       /** Weight of B for Y.
                                                 u0.16, [0,65535],
                                                 default/ineffective 7209 */
-        ia_css_u0_16 awb_lg_high_raw;   /**< AWB level gate high for raw.
+        ia_css_u0_16 awb_lg_high_raw;   /** AWB level gate high for raw.
                                                 u0.16, [0,65535],
                                                 default 65472(=1023*64),
                                                 ineffective 65535 */
-        ia_css_u0_16 awb_lg_low;        /**< AWB level gate low.
+        ia_css_u0_16 awb_lg_low;        /** AWB level gate low.
                                                 u0.16, [0,65535],
                                                 default 64(=1*64),
                                                 ineffective 0 */
-        ia_css_u0_16 awb_lg_high;       /**< AWB level gate high.
+        ia_css_u0_16 awb_lg_high;       /** AWB level gate high.
                                                 u0.16, [0,65535],
                                                 default 65535,
                                                 ineffective 65535 */
-        ia_css_s0_15 af_fir1_coef[7];   /**< AF FIR coefficients of fir1.
+        ia_css_s0_15 af_fir1_coef[7];   /** AF FIR coefficients of fir1.
                                                 s0.15, [-32768,32767],
                                 default/ineffective
                                 -6689,-12207,-32768,32767,12207,6689,0 */
-        ia_css_s0_15 af_fir2_coef[7];   /**< AF FIR coefficients of fir2.
+        ia_css_s0_15 af_fir2_coef[7];   /** AF FIR coefficients of fir2.
                                                 s0.15, [-32768,32767],
                                 default/ineffective
                                 2053,0,-18437,32767,-18437,2053,0 */
 };
 
-/** 3A statistics. This structure describes the data stored
+/* 3A statistics. This structure describes the data stored
  *  in each 3A grid point.
  *
  *  ISP block: S3A1 (3A Support for 3A ver.1) (Histogram is not used for AE)
@@ -209,43 +209,43 @@ struct ia_css_3a_config {
  *  ISP2: S3A2 is used.
  */
 struct ia_css_3a_output {
-        int32_t ae_y;    /**< Sum of Y in a statistics window, for AE.
+        int32_t ae_y;    /** Sum of Y in a statistics window, for AE.
                                 (u19.13) */
-        int32_t awb_cnt; /**< Number of effective pixels
+        int32_t awb_cnt; /** Number of effective pixels
                                 in a statistics window.
                                 Pixels passed by the AWB level gate check are
                                 judged as "effective". (u32) */
-        int32_t awb_gr;  /**< Sum of Gr in a statistics window, for AWB.
+        int32_t awb_gr;  /** Sum of Gr in a statistics window, for AWB.
                                 All Gr pixels (not only for effective pixels)
                                 are summed. (u19.13) */
-        int32_t awb_r;   /**< Sum of R in a statistics window, for AWB.
+        int32_t awb_r;   /** Sum of R in a statistics window, for AWB.
                                 All R pixels (not only for effective pixels)
                                 are summed. (u19.13) */
-        int32_t awb_b;   /**< Sum of B in a statistics window, for AWB.
+        int32_t awb_b;   /** Sum of B in a statistics window, for AWB.
                                 All B pixels (not only for effective pixels)
                                 are summed. (u19.13) */
-        int32_t awb_gb;  /**< Sum of Gb in a statistics window, for AWB.
+        int32_t awb_gb;  /** Sum of Gb in a statistics window, for AWB.
                                 All Gb pixels (not only for effective pixels)
                                 are summed. (u19.13) */
-        int32_t af_hpf1; /**< Sum of |Y| following high pass filter af_fir1
+        int32_t af_hpf1; /** Sum of |Y| following high pass filter af_fir1
                                 within a statistics window, for AF. (u19.13) */
-        int32_t af_hpf2; /**< Sum of |Y| following high pass filter af_fir2
+        int32_t af_hpf2; /** Sum of |Y| following high pass filter af_fir2
                                 within a statistics window, for AF. (u19.13) */
 };
 
 
-/** 3A Statistics. This structure describes the statistics that are generated
+/* 3A Statistics. This structure describes the statistics that are generated
  *  using the provided configuration (ia_css_3a_config).
  */
 struct ia_css_3a_statistics {
-        struct ia_css_3a_grid_info    grid;     /**< grid info contains the dimensions of the 3A grid */
-        struct ia_css_3a_output      *data;     /**< the pointer to 3a_output[grid.width * grid.height]
+        struct ia_css_3a_grid_info    grid;     /** grid info contains the dimensions of the 3A grid */
+        struct ia_css_3a_output      *data;     /** the pointer to 3a_output[grid.width * grid.height]
                                                      containing the 3A statistics */
-        struct ia_css_3a_rgby_output *rgby_data;/**< the pointer to 3a_rgby_output[256]
+        struct ia_css_3a_rgby_output *rgby_data;/** the pointer to 3a_rgby_output[256]
                                                      containing the histogram */
 };
 
-/** Histogram (Statistics for AE).
+/* Histogram (Statistics for AE).
  *
  *  4 histograms(r,g,b,y),
  *  256 bins for each histogram, unsigned 24bit value for each bin.
@@ -256,10 +256,10 @@ struct ia_css_3a_statistics {
  *  ISP2: HIST2 is used.
  */
 struct ia_css_3a_rgby_output {
-        uint32_t r;     /**< Number of R of one bin of the histogram R. (u24) */
-        uint32_t g;     /**< Number of G of one bin of the histogram G. (u24) */
-        uint32_t b;     /**< Number of B of one bin of the histogram B. (u24) */
-        uint32_t y;     /**< Number of Y of one bin of the histogram Y. (u24) */
+        uint32_t r;     /** Number of R of one bin of the histogram R. (u24) */
+        uint32_t g;     /** Number of G of one bin of the histogram G. (u24) */
+        uint32_t b;     /** Number of B of one bin of the histogram B. (u24) */
+        uint32_t y;     /** Number of Y of one bin of the histogram Y. (u24) */
 };
 
 #endif /* __IA_CSS_S3A_TYPES_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/s3a_stat_ls/ia_css_s3a_stat_ls_param.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/s3a_stat_ls/ia_css_s3a_stat_ls_param.h
index 8b2b56b0310b..9aa019539f47 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/s3a_stat_ls/ia_css_s3a_stat_ls_param.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/s3a_stat_ls/ia_css_s3a_stat_ls_param.h
@@ -22,7 +22,7 @@
 
 #define NUM_S3A_LS 1
 
-/** s3a statistics store */
+/* s3a statistics store */
 #ifdef ISP2401
 struct ia_css_s3a_stat_ls_configuration {
         uint32_t s3a_grid_size_log2;
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sc/sc_1.0/ia_css_sc.host.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sc/sc_1.0/ia_css_sc.host.h
index 44e3c43a5d4a..b35ac3e4009b 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sc/sc_1.0/ia_css_sc.host.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sc/sc_1.0/ia_css_sc.host.h
@@ -32,7 +32,7 @@ ia_css_sc_dump(
         unsigned level);
 
 #ifdef ISP2401
-/** @brief Configure the shading correction.
+/* @brief Configure the shading correction.
  * @param[out]  to      Parameters used in the shading correction kernel in the isp.
  * @param[in]   from    Parameters passed from the host.
  * @param[in]   size    Size of the sh_css_isp_sc_isp_config structure.
@@ -45,7 +45,7 @@ ia_css_sc_config(
         const struct ia_css_sc_configuration *from,
         unsigned size);
 
-/** @brief Configure the shading correction.
+/* @brief Configure the shading correction.
  * @param[in]   binary  The binary, which has the shading correction.
  * @param[in]   internal_frame_origin_x_bqs_on_sctbl
  *                      X coordinate (in bqs) of the origin of the internal frame on the shading table.
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sc/sc_1.0/ia_css_sc_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sc/sc_1.0/ia_css_sc_types.h
index 5a833bc48af1..30ce499ac8cf 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sc/sc_1.0/ia_css_sc_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sc/sc_1.0/ia_css_sc_types.h
@@ -15,25 +15,25 @@
 #ifndef __IA_CSS_SC_TYPES_H
 #define __IA_CSS_SC_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Lens Shading Correction (SC) parameters.
 */
 
 
-/** Number of color planes in the shading table. */
+/* Number of color planes in the shading table. */
 #define IA_CSS_SC_NUM_COLORS           4
 
-/** The 4 colors that a shading table consists of.
+/* The 4 colors that a shading table consists of.
  *  For each color we store a grid of values.
  */
 enum ia_css_sc_color {
-        IA_CSS_SC_COLOR_GR, /**< Green on a green-red line */
-        IA_CSS_SC_COLOR_R,  /**< Red */
-        IA_CSS_SC_COLOR_B,  /**< Blue */
-        IA_CSS_SC_COLOR_GB  /**< Green on a green-blue line */
+        IA_CSS_SC_COLOR_GR, /** Green on a green-red line */
+        IA_CSS_SC_COLOR_R,  /** Red */
+        IA_CSS_SC_COLOR_B,  /** Blue */
+        IA_CSS_SC_COLOR_GB  /** Green on a green-blue line */
 };
 
-/** Lens Shading Correction table.
+/* Lens Shading Correction table.
  *
  *  This describes the color shading artefacts
  *  introduced by lens imperfections. To correct artefacts,
@@ -64,39 +64,39 @@ enum ia_css_sc_color {
  *  ISP2: SC1 is used.
  */
 struct ia_css_shading_table {
-        uint32_t enable; /**< Set to false for no shading correction.
+        uint32_t enable; /** Set to false for no shading correction.
                           The data field can be NULL when enable == true */
 /* ------ deprecated(bz675) : from ------ */
-        uint32_t sensor_width;  /**< Native sensor width in pixels. */
-        uint32_t sensor_height; /**< Native sensor height in lines.
+        uint32_t sensor_width;  /** Native sensor width in pixels. */
+        uint32_t sensor_height; /** Native sensor height in lines.
                 When shading_settings.enable_shading_table_conversion is set
                 as 0, sensor_width and sensor_height are NOT used.
                 These are used only in the legacy shading table conversion
                 in the css, when shading_settings.
                 enable_shading_table_conversion is set as 1. */
 /* ------ deprecated(bz675) : to ------ */
-        uint32_t width;  /**< Number of data points per line per color.
+        uint32_t width;  /** Number of data points per line per color.
                                 u8.0, [0,81] */
-        uint32_t height; /**< Number of lines of data points per color.
+        uint32_t height; /** Number of lines of data points per color.
                                 u8.0, [0,61] */
-        uint32_t fraction_bits; /**< Bits of fractional part in the data
+        uint32_t fraction_bits; /** Bits of fractional part in the data
                                 points.
                                 u8.0, [0,13] */
         uint16_t *data[IA_CSS_SC_NUM_COLORS];
-        /**< Table data, one array for each color.
+        /** Table data, one array for each color.
              Use ia_css_sc_color to index this array.
              u[13-fraction_bits].[fraction_bits], [0,8191] */
 };
 
 /* ------ deprecated(bz675) : from ------ */
-/** Shading Correction settings.
+/* Shading Correction settings.
  *
  *  NOTE:
  *  This structure should be removed when the shading table conversion is
  *  removed from the css.
  */
 struct ia_css_shading_settings {
-        uint32_t enable_shading_table_conversion; /**< Set to 0,
+        uint32_t enable_shading_table_conversion; /** Set to 0,
                 if the conversion of the shading table should be disabled
                 in the css. (default 1)
                   0: The shading table is directly sent to the isp.
@@ -119,14 +119,14 @@ struct ia_css_shading_settings {
 
 #ifdef ISP2401
 
-/** Shading Correction configuration.
+/* Shading Correction configuration.
  *
  *  NOTE: The shading table size is larger than or equal to the internal frame size.
  */
 struct ia_css_sc_configuration {
-        uint32_t internal_frame_origin_x_bqs_on_sctbl; /**< Origin X (in bqs) of internal frame on shading table. */
-        uint32_t internal_frame_origin_y_bqs_on_sctbl; /**< Origin Y (in bqs) of internal frame on shading table. */
-                                                /**< NOTE: bqs = size in BQ(Bayer Quad) unit.
+        uint32_t internal_frame_origin_x_bqs_on_sctbl; /** Origin X (in bqs) of internal frame on shading table. */
+        uint32_t internal_frame_origin_y_bqs_on_sctbl; /** Origin Y (in bqs) of internal frame on shading table. */
+                                                /** NOTE: bqs = size in BQ(Bayer Quad) unit.
                                                         1BQ means {Gr,R,B,Gb}(2x2 pixels).
                                                         Horizontal 1 bqs corresponds to horizontal 2 pixels.
                                                         Vertical 1 bqs corresponds to vertical 2 pixels. */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sdis/common/ia_css_sdis_common_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sdis/common/ia_css_sdis_common_types.h
index 295dc60b778c..031983c357e4 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sdis/common/ia_css_sdis_common_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sdis/common/ia_css_sdis_common_types.h
@@ -15,21 +15,21 @@
 #ifndef __IA_CSS_SDIS_COMMON_TYPES_H
 #define __IA_CSS_SDIS_COMMON_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for DVS statistics parameters.
 */
 
 #include <type_support.h>
 
-/** DVS statistics grid dimensions in number of cells.
+/* DVS statistics grid dimensions in number of cells.
  */
 
 struct ia_css_dvs_grid_dim {
-        uint32_t width;         /**< Width of DVS grid table in cells */
-        uint32_t height;        /**< Height of DVS grid table in cells */
+        uint32_t width;         /** Width of DVS grid table in cells */
+        uint32_t height;        /** Height of DVS grid table in cells */
 };
 
-/** DVS statistics dimensions in number of cells for
+/* DVS statistics dimensions in number of cells for
  * grid, coeffieicient and projection.
  */
 
@@ -55,7 +55,7 @@ struct ia_css_sdis_info {
                 0,      /* dis_deci_factor_log2 */ \
         }
 
-/** DVS statistics grid
+/* DVS statistics grid
  *
  *  ISP block: SDVS1 (DIS/DVS Support for DIS/DVS ver.1 (2-axes))
  *             SDVS2 (DVS Support for DVS ver.2 (6-axes))
@@ -63,23 +63,23 @@ struct ia_css_sdis_info {
  *  ISP2: SDVS2 is used.
  */
 struct ia_css_dvs_grid_res {
-        uint32_t width;         /**< Width of DVS grid table.
+        uint32_t width;         /** Width of DVS grid table.
                                         (= Horizontal number of grid cells
                                         in table, which cells have effective
                                         statistics.)
                                         For DVS1, this is equal to
                                          the number of vertical statistics. */
-        uint32_t aligned_width; /**< Stride of each grid line.
+        uint32_t aligned_width; /** Stride of each grid line.
                                         (= Horizontal number of grid cells
                                         in table, which means
                                         the allocated width.) */
-        uint32_t height;        /**< Height of DVS grid table.
+        uint32_t height;        /** Height of DVS grid table.
                                         (= Vertical number of grid cells
                                         in table, which cells have effective
                                         statistics.)
                                         For DVS1, This is equal to
                                         the number of horizontal statistics. */
-        uint32_t aligned_height;/**< Stride of each grid column.
+        uint32_t aligned_height;/** Stride of each grid column.
                                         (= Vertical number of grid cells
                                         in table, which means
                                         the allocated height.) */
@@ -89,125 +89,125 @@ struct ia_css_dvs_grid_res {
  * However, that implies driver I/F changes
  */
 struct ia_css_dvs_grid_info {
-        uint32_t enable;        /**< DVS statistics enabled.
+        uint32_t enable;        /** DVS statistics enabled.
                                         0:disabled, 1:enabled */
-        uint32_t width;         /**< Width of DVS grid table.
+        uint32_t width;         /** Width of DVS grid table.
                                         (= Horizontal number of grid cells
                                         in table, which cells have effective
                                         statistics.)
                                         For DVS1, this is equal to
                                          the number of vertical statistics. */
-        uint32_t aligned_width; /**< Stride of each grid line.
+        uint32_t aligned_width; /** Stride of each grid line.
                                         (= Horizontal number of grid cells
                                         in table, which means
                                         the allocated width.) */
-        uint32_t height;        /**< Height of DVS grid table.
+        uint32_t height;        /** Height of DVS grid table.
                                         (= Vertical number of grid cells
                                         in table, which cells have effective
                                         statistics.)
                                         For DVS1, This is equal to
                                         the number of horizontal statistics. */
-        uint32_t aligned_height;/**< Stride of each grid column.
+        uint32_t aligned_height;/** Stride of each grid column.
                                         (= Vertical number of grid cells
                                         in table, which means
                                         the allocated height.) */
-        uint32_t bqs_per_grid_cell; /**< Grid cell size in BQ(Bayer Quad) unit.
+        uint32_t bqs_per_grid_cell; /** Grid cell size in BQ(Bayer Quad) unit.
                                         (1BQ means {Gr,R,B,Gb}(2x2 pixels).)
                                         For DVS1, valid value is 64.
                                         For DVS2, valid value is only 64,
                                         currently. */
-        uint32_t num_hor_coefs; /**< Number of horizontal coefficients. */
-        uint32_t num_ver_coefs; /**< Number of vertical coefficients. */
+        uint32_t num_hor_coefs; /** Number of horizontal coefficients. */
+        uint32_t num_ver_coefs; /** Number of vertical coefficients. */
 };
 
-/** Number of DVS statistics levels
+/* Number of DVS statistics levels
  */
 #define IA_CSS_DVS_STAT_NUM_OF_LEVELS   3
 
-/** DVS statistics generated by accelerator global configuration
+/* DVS statistics generated by accelerator global configuration
  */
 struct dvs_stat_public_dvs_global_cfg {
         unsigned char kappa;
-        /**< DVS statistics global configuration - kappa */
+        /** DVS statistics global configuration - kappa */
         unsigned char match_shift;
-        /**< DVS statistics global configuration - match_shift */
+        /** DVS statistics global configuration - match_shift */
         unsigned char ybin_mode;
-        /**< DVS statistics global configuration - y binning mode */
+        /** DVS statistics global configuration - y binning mode */
 };
 
-/** DVS statistics generated by accelerator level grid
+/* DVS statistics generated by accelerator level grid
  *  configuration
  */
 struct dvs_stat_public_dvs_level_grid_cfg {
         unsigned char grid_width;
-        /**< DVS statistics grid width */
+        /** DVS statistics grid width */
         unsigned char grid_height;
-        /**< DVS statistics grid height */
+        /** DVS statistics grid height */
         unsigned char block_width;
-        /**< DVS statistics block width */
+        /** DVS statistics block width */
         unsigned char block_height;
-        /**< DVS statistics block  height */
+        /** DVS statistics block  height */
 };
 
-/** DVS statistics generated by accelerator level grid start
+/* DVS statistics generated by accelerator level grid start
  *  configuration
  */
 struct dvs_stat_public_dvs_level_grid_start {
         unsigned short x_start;
-        /**< DVS statistics level x start */
+        /** DVS statistics level x start */
         unsigned short y_start;
-        /**< DVS statistics level y start */
+        /** DVS statistics level y start */
         unsigned char enable;
-        /**< DVS statistics level enable */
+        /** DVS statistics level enable */
 };
 
-/** DVS statistics generated by accelerator level grid end
+/* DVS statistics generated by accelerator level grid end
  *  configuration
  */
 struct dvs_stat_public_dvs_level_grid_end {
         unsigned short x_end;
-        /**< DVS statistics level x end */
+        /** DVS statistics level x end */
         unsigned short y_end;
-        /**< DVS statistics level y end */
+        /** DVS statistics level y end */
 };
 
-/** DVS statistics generated by accelerator Feature Extraction
+/* DVS statistics generated by accelerator Feature Extraction
  *  Region Of Interest (FE-ROI) configuration
  */
 struct dvs_stat_public_dvs_level_fe_roi_cfg {
         unsigned char x_start;
-        /**< DVS statistics fe-roi level x start */
+        /** DVS statistics fe-roi level x start */
         unsigned char y_start;
-        /**< DVS statistics fe-roi level y start */
+        /** DVS statistics fe-roi level y start */
         unsigned char x_end;
-        /**< DVS statistics fe-roi level x end */
+        /** DVS statistics fe-roi level x end */
         unsigned char y_end;
-        /**< DVS statistics fe-roi level y end */
+        /** DVS statistics fe-roi level y end */
 };
 
-/** DVS statistics generated by accelerator public configuration
+/* DVS statistics generated by accelerator public configuration
  */
 struct dvs_stat_public_dvs_grd_cfg {
         struct dvs_stat_public_dvs_level_grid_cfg    grd_cfg;
-        /**< DVS statistics level grid configuration */
+        /** DVS statistics level grid configuration */
         struct dvs_stat_public_dvs_level_grid_start  grd_start;
-        /**< DVS statistics level grid start configuration */
+        /** DVS statistics level grid start configuration */
         struct dvs_stat_public_dvs_level_grid_end    grd_end;
-        /**< DVS statistics level grid end configuration */
+        /** DVS statistics level grid end configuration */
 };
 
-/** DVS statistics grid generated by accelerator
+/* DVS statistics grid generated by accelerator
  */
 struct ia_css_dvs_stat_grid_info {
         struct dvs_stat_public_dvs_global_cfg       dvs_gbl_cfg;
-        /**< DVS statistics global configuration (kappa, match, binning) */
+        /** DVS statistics global configuration (kappa, match, binning) */
         struct dvs_stat_public_dvs_grd_cfg       grd_cfg[IA_CSS_DVS_STAT_NUM_OF_LEVELS];
-        /**< DVS statistics grid configuration (blocks and grids) */
+        /** DVS statistics grid configuration (blocks and grids) */
         struct dvs_stat_public_dvs_level_fe_roi_cfg fe_roi_cfg[IA_CSS_DVS_STAT_NUM_OF_LEVELS];
-        /**< DVS statistics FE ROI (region of interest) configuration */
+        /** DVS statistics FE ROI (region of interest) configuration */
 };
 
-/** DVS statistics generated by accelerator default grid info
+/* DVS statistics generated by accelerator default grid info
  */
 #define DEFAULT_DVS_GRID_INFO { \
 { \
@@ -219,14 +219,14 @@ struct ia_css_dvs_stat_grid_info {
 }
 
 
-/** Union that holds all types of DVS statistics grid info in
+/* Union that holds all types of DVS statistics grid info in
  *  CSS format
  * */
 union ia_css_dvs_grid_u {
         struct ia_css_dvs_stat_grid_info dvs_stat_grid_info;
-        /**< DVS statistics produced by accelerator grid info */
+        /** DVS statistics produced by accelerator grid info */
         struct ia_css_dvs_grid_info dvs_grid_info;
-        /**< DVS (DVS1/DVS2) grid info */
+        /** DVS (DVS1/DVS2) grid info */
 };
 
 #endif /* __IA_CSS_SDIS_COMMON_TYPES_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sdis/sdis_1.0/ia_css_sdis_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sdis/sdis_1.0/ia_css_sdis_types.h
index d408b58a027d..d2ee57008fb6 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sdis/sdis_1.0/ia_css_sdis_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sdis/sdis_1.0/ia_css_sdis_types.h
@@ -15,38 +15,38 @@
 #ifndef __IA_CSS_SDIS_TYPES_H
 #define __IA_CSS_SDIS_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for DVS statistics parameters.
 */
 
-/** Number of DVS coefficient types */
+/* Number of DVS coefficient types */
 #define IA_CSS_DVS_NUM_COEF_TYPES      6
 
 #ifndef PIPE_GENERATION
 #include "isp/kernels/sdis/common/ia_css_sdis_common_types.h"
 #endif
 
-/** DVS 1.0 Coefficients.
+/* DVS 1.0 Coefficients.
  *  This structure describes the coefficients that are needed for the dvs statistics.
  */
 
 struct ia_css_dvs_coefficients {
-        struct ia_css_dvs_grid_info grid;/**< grid info contains the dimensions of the dvs grid */
-        int16_t *hor_coefs;     /**< the pointer to int16_t[grid.num_hor_coefs * IA_CSS_DVS_NUM_COEF_TYPES]
+        struct ia_css_dvs_grid_info grid;/** grid info contains the dimensions of the dvs grid */
+        int16_t *hor_coefs;     /** the pointer to int16_t[grid.num_hor_coefs * IA_CSS_DVS_NUM_COEF_TYPES]
                                      containing the horizontal coefficients */
-        int16_t *ver_coefs;     /**< the pointer to int16_t[grid.num_ver_coefs * IA_CSS_DVS_NUM_COEF_TYPES]
+        int16_t *ver_coefs;     /** the pointer to int16_t[grid.num_ver_coefs * IA_CSS_DVS_NUM_COEF_TYPES]
                                      containing the vertical coefficients */
 };
 
-/** DVS 1.0 Statistics.
+/* DVS 1.0 Statistics.
  *  This structure describes the statistics that are generated using the provided coefficients.
  */
 
 struct ia_css_dvs_statistics {
-        struct ia_css_dvs_grid_info grid;/**< grid info contains the dimensions of the dvs grid */
-        int32_t *hor_proj;      /**< the pointer to int16_t[grid.height * IA_CSS_DVS_NUM_COEF_TYPES]
+        struct ia_css_dvs_grid_info grid;/** grid info contains the dimensions of the dvs grid */
+        int32_t *hor_proj;      /** the pointer to int16_t[grid.height * IA_CSS_DVS_NUM_COEF_TYPES]
                                      containing the horizontal projections */
-        int32_t *ver_proj;      /**< the pointer to int16_t[grid.width * IA_CSS_DVS_NUM_COEF_TYPES]
+        int32_t *ver_proj;      /** the pointer to int16_t[grid.width * IA_CSS_DVS_NUM_COEF_TYPES]
                                      containing the vertical projections */
 };
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sdis/sdis_2/ia_css_sdis2_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sdis/sdis_2/ia_css_sdis2_types.h
index 7db7dd10fe00..2a0bc4031746 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sdis/sdis_2/ia_css_sdis2_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/sdis/sdis_2/ia_css_sdis2_types.h
@@ -15,55 +15,55 @@
 #ifndef __IA_CSS_SDIS2_TYPES_H
 #define __IA_CSS_SDIS2_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for DVS statistics parameters.
 */
 
-/** Number of DVS coefficient types */
+/* Number of DVS coefficient types */
 #define IA_CSS_DVS2_NUM_COEF_TYPES     4
 
 #ifndef PIPE_GENERATION
 #include "isp/kernels/sdis/common/ia_css_sdis_common_types.h"
 #endif
 
-/** DVS 2.0 Coefficient types. This structure contains 4 pointers to
+/* DVS 2.0 Coefficient types. This structure contains 4 pointers to
  *  arrays that contain the coeffients for each type.
  */
 struct ia_css_dvs2_coef_types {
-        int16_t *odd_real; /**< real part of the odd coefficients*/
-        int16_t *odd_imag; /**< imaginary part of the odd coefficients*/
-        int16_t *even_real;/**< real part of the even coefficients*/
-        int16_t *even_imag;/**< imaginary part of the even coefficients*/
+        int16_t *odd_real; /** real part of the odd coefficients*/
+        int16_t *odd_imag; /** imaginary part of the odd coefficients*/
+        int16_t *even_real;/** real part of the even coefficients*/
+        int16_t *even_imag;/** imaginary part of the even coefficients*/
 };
 
-/** DVS 2.0 Coefficients. This structure describes the coefficients that are needed for the dvs statistics.
+/* DVS 2.0 Coefficients. This structure describes the coefficients that are needed for the dvs statistics.
  *  e.g. hor_coefs.odd_real is the pointer to int16_t[grid.num_hor_coefs] containing the horizontal odd real 
  *  coefficients.
  */
 struct ia_css_dvs2_coefficients {
-        struct ia_css_dvs_grid_info grid;        /**< grid info contains the dimensions of the dvs grid */
-        struct ia_css_dvs2_coef_types hor_coefs; /**< struct with pointers that contain the horizontal coefficients */
-        struct ia_css_dvs2_coef_types ver_coefs; /**< struct with pointers that contain the vertical coefficients */
+        struct ia_css_dvs_grid_info grid;        /** grid info contains the dimensions of the dvs grid */
+        struct ia_css_dvs2_coef_types hor_coefs; /** struct with pointers that contain the horizontal coefficients */
+        struct ia_css_dvs2_coef_types ver_coefs; /** struct with pointers that contain the vertical coefficients */
 };
 
-/** DVS 2.0 Statistic types. This structure contains 4 pointers to
+/* DVS 2.0 Statistic types. This structure contains 4 pointers to
  *  arrays that contain the statistics for each type.
  */
 struct ia_css_dvs2_stat_types {
-        int32_t *odd_real; /**< real part of the odd statistics*/
-        int32_t *odd_imag; /**< imaginary part of the odd statistics*/
-        int32_t *even_real;/**< real part of the even statistics*/
-        int32_t *even_imag;/**< imaginary part of the even statistics*/
+        int32_t *odd_real; /** real part of the odd statistics*/
+        int32_t *odd_imag; /** imaginary part of the odd statistics*/
+        int32_t *even_real;/** real part of the even statistics*/
+        int32_t *even_imag;/** imaginary part of the even statistics*/
 };
 
-/** DVS 2.0 Statistics. This structure describes the statistics that are generated using the provided coefficients.
+/* DVS 2.0 Statistics. This structure describes the statistics that are generated using the provided coefficients.
  *  e.g. hor_prod.odd_real is the pointer to int16_t[grid.aligned_height][grid.aligned_width] containing 
  *  the horizontal odd real statistics. Valid statistics data area is int16_t[0..grid.height-1][0..grid.width-1]
  */
 struct ia_css_dvs2_statistics {
-        struct ia_css_dvs_grid_info grid;       /**< grid info contains the dimensions of the dvs grid */
-        struct ia_css_dvs2_stat_types hor_prod; /**< struct with pointers that contain the horizontal statistics */
-        struct ia_css_dvs2_stat_types ver_prod; /**< struct with pointers that contain the vertical statistics */
+        struct ia_css_dvs_grid_info grid;       /** grid info contains the dimensions of the dvs grid */
+        struct ia_css_dvs2_stat_types hor_prod; /** struct with pointers that contain the horizontal statistics */
+        struct ia_css_dvs2_stat_types ver_prod; /** struct with pointers that contain the vertical statistics */
 };
 
 #endif /* __IA_CSS_SDIS2_TYPES_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/tdf/tdf_1.0/ia_css_tdf_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/tdf/tdf_1.0/ia_css_tdf_types.h
index cc47a50e5ad5..91ea8dd4651d 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/tdf/tdf_1.0/ia_css_tdf_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/tdf/tdf_1.0/ia_css_tdf_types.h
@@ -15,13 +15,13 @@
 #ifndef __IA_CSS_TDF_TYPES_H
 #define __IA_CSS_TDF_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Transform Domain Filter parameters.
 */
 
 #include "type_support.h"
 
-/** Transform Domain Filter configuration
+/* Transform Domain Filter configuration
  *
  * \brief TDF public parameters.
  * \details Struct with all parameters for the TDF kernel that can be set
@@ -30,23 +30,23 @@
  * ISP2.6.1: TDF is used.
  */
 struct ia_css_tdf_config {
-        int32_t thres_flat_table[64];   /**< Final optimized strength table of NR for flat region. */
-        int32_t thres_detail_table[64]; /**< Final optimized strength table of NR for detail region. */
-        int32_t epsilon_0;              /**< Coefficient to control variance for dark area (for flat region). */
-        int32_t epsilon_1;              /**< Coefficient to control variance for bright area (for flat region). */
-        int32_t eps_scale_text;         /**< Epsilon scaling coefficient for texture region. */
-        int32_t eps_scale_edge;         /**< Epsilon scaling coefficient for edge region. */
-        int32_t sepa_flat;              /**< Threshold to judge flat (edge < m_Flat_thre). */
-        int32_t sepa_edge;              /**< Threshold to judge edge (edge > m_Edge_thre). */
-        int32_t blend_flat;             /**< Blending ratio at flat region. */
-        int32_t blend_text;             /**< Blending ratio at texture region. */
-        int32_t blend_edge;             /**< Blending ratio at edge region. */
-        int32_t shading_gain;           /**< Gain of Shading control. */
-        int32_t shading_base_gain;      /**< Base Gain of Shading control. */
-        int32_t local_y_gain;           /**< Gain of local luminance control. */
-        int32_t local_y_base_gain;      /**< Base gain of local luminance control. */
-        int32_t rad_x_origin;           /**< Initial x coord. for radius computation. */
-        int32_t rad_y_origin;           /**< Initial y coord. for radius computation. */
+        int32_t thres_flat_table[64];   /** Final optimized strength table of NR for flat region. */
+        int32_t thres_detail_table[64]; /** Final optimized strength table of NR for detail region. */
+        int32_t epsilon_0;              /** Coefficient to control variance for dark area (for flat region). */
+        int32_t epsilon_1;              /** Coefficient to control variance for bright area (for flat region). */
+        int32_t eps_scale_text;         /** Epsilon scaling coefficient for texture region. */
+        int32_t eps_scale_edge;         /** Epsilon scaling coefficient for edge region. */
+        int32_t sepa_flat;              /** Threshold to judge flat (edge < m_Flat_thre). */
+        int32_t sepa_edge;              /** Threshold to judge edge (edge > m_Edge_thre). */
+        int32_t blend_flat;             /** Blending ratio at flat region. */
+        int32_t blend_text;             /** Blending ratio at texture region. */
+        int32_t blend_edge;             /** Blending ratio at edge region. */
+        int32_t shading_gain;           /** Gain of Shading control. */
+        int32_t shading_base_gain;      /** Base Gain of Shading control. */
+        int32_t local_y_gain;           /** Gain of local luminance control. */
+        int32_t local_y_base_gain;      /** Base gain of local luminance control. */
+        int32_t rad_x_origin;           /** Initial x coord. for radius computation. */
+        int32_t rad_y_origin;           /** Initial y coord. for radius computation. */
 };
 
 #endif /* __IA_CSS_TDF_TYPES_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/tnr/tnr3/ia_css_tnr3_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/tnr/tnr3/ia_css_tnr3_types.h
index 135563f52174..223423f8c40b 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/tnr/tnr3/ia_css_tnr3_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/tnr/tnr3/ia_css_tnr3_types.h
@@ -16,7 +16,7 @@ more details.
 #ifndef _IA_CSS_TNR3_TYPES_H
 #define _IA_CSS_TNR3_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Temporal Noise Reduction v3 (TNR3) kernel
 */
 
@@ -27,7 +27,7 @@ more details.
  */
 #define TNR3_NUM_SEGMENTS    3
 
-/** Temporal Noise Reduction v3 (TNR3) configuration.
+/* Temporal Noise Reduction v3 (TNR3) configuration.
  * The parameter to this kernel is fourfold
  * 1. Three piecewise linear graphs (one for each plane) with three segments
  * each. Each line graph has Luma values on the x axis and sigma values for
@@ -44,17 +44,17 @@ more details.
  * 4. Selection of the reference frame buffer to be used for noise reduction.
  */
 struct ia_css_tnr3_kernel_config {
-        unsigned int maxfb_y;                        /**< Maximum Feedback Gain for Y */
-        unsigned int maxfb_u;                        /**< Maximum Feedback Gain for U */
-        unsigned int maxfb_v;                        /**< Maximum Feedback Gain for V */
-        unsigned int round_adj_y;                    /**< Rounding Adjust for Y */
-        unsigned int round_adj_u;                    /**< Rounding Adjust for U */
-        unsigned int round_adj_v;                    /**< Rounding Adjust for V */
-        unsigned int knee_y[TNR3_NUM_SEGMENTS - 1];  /**< Knee points */
-        unsigned int sigma_y[TNR3_NUM_SEGMENTS + 1]; /**< Standard deviation for Y at points Y0, Y1, Y2, Y3 */
-        unsigned int sigma_u[TNR3_NUM_SEGMENTS + 1]; /**< Standard deviation for U at points U0, U1, U2, U3 */
-        unsigned int sigma_v[TNR3_NUM_SEGMENTS + 1]; /**< Standard deviation for V at points V0, V1, V2, V3 */
-        unsigned int ref_buf_select;                 /**< Selection of the reference buffer */
+        unsigned int maxfb_y;                        /** Maximum Feedback Gain for Y */
+        unsigned int maxfb_u;                        /** Maximum Feedback Gain for U */
+        unsigned int maxfb_v;                        /** Maximum Feedback Gain for V */
+        unsigned int round_adj_y;                    /** Rounding Adjust for Y */
+        unsigned int round_adj_u;                    /** Rounding Adjust for U */
+        unsigned int round_adj_v;                    /** Rounding Adjust for V */
+        unsigned int knee_y[TNR3_NUM_SEGMENTS - 1];  /** Knee points */
+        unsigned int sigma_y[TNR3_NUM_SEGMENTS + 1]; /** Standard deviation for Y at points Y0, Y1, Y2, Y3 */
+        unsigned int sigma_u[TNR3_NUM_SEGMENTS + 1]; /** Standard deviation for U at points U0, U1, U2, U3 */
+        unsigned int sigma_v[TNR3_NUM_SEGMENTS + 1]; /** Standard deviation for V at points V0, V1, V2, V3 */
+        unsigned int ref_buf_select;                 /** Selection of the reference buffer */
 };
 
 #endif
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/tnr/tnr_1.0/ia_css_tnr_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/tnr/tnr_1.0/ia_css_tnr_types.h
index 4fd35e6ccd70..9bbc9ab2e6c0 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/tnr/tnr_1.0/ia_css_tnr_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/tnr/tnr_1.0/ia_css_tnr_types.h
@@ -15,11 +15,11 @@
 #ifndef __IA_CSS_TNR_TYPES_H
 #define __IA_CSS_TNR_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Temporal Noise Reduction (TNR) parameters.
 */
 
-/** Temporal Noise Reduction (TNR) configuration.
+/* Temporal Noise Reduction (TNR) configuration.
  *
  *  When difference between current frame and previous frame is less than or
  *  equal to threshold, TNR works and current frame is mixed
@@ -36,18 +36,18 @@
 
 
 struct ia_css_tnr_config {
-        ia_css_u0_16 gain; /**< Interpolation ratio of current frame
+        ia_css_u0_16 gain; /** Interpolation ratio of current frame
                                 and previous frame.
                                 gain=0.0 -> previous frame is outputted.
                                 gain=1.0 -> current frame is outputted.
                                 u0.16, [0,65535],
                         default 32768(0.5), ineffective 65535(almost 1.0) */
-        ia_css_u0_16 threshold_y; /**< Threshold to enable interpolation of Y.
+        ia_css_u0_16 threshold_y; /** Threshold to enable interpolation of Y.
                                 If difference between current frame and
                                 previous frame is greater than threshold_y,
                                 TNR for Y is disabled.
                                 u0.16, [0,65535], default/ineffective 0 */
-        ia_css_u0_16 threshold_uv; /**< Threshold to enable interpolation of
+        ia_css_u0_16 threshold_uv; /** Threshold to enable interpolation of
                                 U/V.
                                 If difference between current frame and
                                 previous frame is greater than threshold_uv,
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/vf/vf_1.0/ia_css_vf_param.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/vf/vf_1.0/ia_css_vf_param.h
index df5d37c8c946..9df4e12f6c2c 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/vf/vf_1.0/ia_css_vf_param.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/vf/vf_1.0/ia_css_vf_param.h
@@ -23,9 +23,9 @@
 
 #define VFDEC_BITS_PER_PIXEL    GAMMA_OUTPUT_BITS
 
-/** Viewfinder decimation */
+/* Viewfinder decimation */
 struct sh_css_isp_vf_isp_config {
-        uint32_t vf_downscale_bits; /**< Log VF downscale value */
+        uint32_t vf_downscale_bits; /** Log VF downscale value */
         uint32_t enable;
         struct ia_css_frame_sp_info info;
         struct {
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/vf/vf_1.0/ia_css_vf_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/vf/vf_1.0/ia_css_vf_types.h
index d8cfdfbc8c0b..e3efafa279ff 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/vf/vf_1.0/ia_css_vf_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/vf/vf_1.0/ia_css_vf_types.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_VF_TYPES_H
 #define __IA_CSS_VF_TYPES_H
 
-/** Viewfinder decimation
+/* Viewfinder decimation
  *
  *  ISP block: vfeven_horizontal_downscale
  */
@@ -24,7 +24,7 @@
 #include <type_support.h>
 
 struct ia_css_vf_configuration {
-        uint32_t vf_downscale_bits; /**< Log VF downscale value */
+        uint32_t vf_downscale_bits; /** Log VF downscale value */
         const struct ia_css_frame_info *info;
 };
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/wb/wb_1.0/ia_css_wb_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/wb/wb_1.0/ia_css_wb_types.h
index 6bcfa274be88..bf98734d057e 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/wb/wb_1.0/ia_css_wb_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/wb/wb_1.0/ia_css_wb_types.h
@@ -15,31 +15,31 @@
 #ifndef __IA_CSS_WB_TYPES_H
 #define __IA_CSS_WB_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for White Balance parameters.
 */
 
 
-/** White Balance configuration (Gain Adjust).
+/* White Balance configuration (Gain Adjust).
  *
  *  ISP block: WB1
  *  ISP1: WB1 is used.
  *  ISP2: WB1 is used.
  */
 struct ia_css_wb_config {
-        uint32_t integer_bits; /**< Common exponent of gains.
+        uint32_t integer_bits; /** Common exponent of gains.
                                 u8.0, [0,3],
                                 default 1, ineffective 1 */
-        uint32_t gr;    /**< Significand of Gr gain.
+        uint32_t gr;    /** Significand of Gr gain.
                                 u[integer_bits].[16-integer_bits], [0,65535],
                                 default/ineffective 32768(u1.15, 1.0) */
-        uint32_t r;     /**< Significand of R gain.
+        uint32_t r;     /** Significand of R gain.
                                 u[integer_bits].[16-integer_bits], [0,65535],
                                 default/ineffective 32768(u1.15, 1.0) */
-        uint32_t b;     /**< Significand of B gain.
+        uint32_t b;     /** Significand of B gain.
                                 u[integer_bits].[16-integer_bits], [0,65535],
                                 default/ineffective 32768(u1.15, 1.0) */
-        uint32_t gb;    /**< Significand of Gb gain.
+        uint32_t gb;    /** Significand of Gb gain.
                                 u[integer_bits].[16-integer_bits], [0,65535],
                                 default/ineffective 32768(u1.15, 1.0) */
 };
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_1.0/ia_css_xnr.host.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_1.0/ia_css_xnr.host.c
index 3018100f6f76..abcb531f51cc 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_1.0/ia_css_xnr.host.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_1.0/ia_css_xnr.host.c
@@ -21,7 +21,7 @@
 #include "ia_css_xnr.host.h"
 
 const struct ia_css_xnr_config default_xnr_config = {
-        /** default threshold 6400 translates to 25 on ISP. */
+        /* default threshold 6400 translates to 25 on ISP. */
         6400
 };
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_1.0/ia_css_xnr_param.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_1.0/ia_css_xnr_param.h
index 806c9f8f0e2e..a5caebbe2f84 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_1.0/ia_css_xnr_param.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_1.0/ia_css_xnr_param.h
@@ -41,7 +41,7 @@ struct sh_css_isp_xnr_vamem_params {
 };
 
 struct sh_css_isp_xnr_params {
-        /** XNR threshold.
+        /* XNR threshold.
          * type:u0.16 but actual valid range is:[0,255]
          * valid range is dependent on SH_CSS_ISP_YUV_BITS (currently 8bits)
          * default: 25 */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_1.0/ia_css_xnr_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_1.0/ia_css_xnr_types.h
index 89e8b0f17e8c..d2b634211a3f 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_1.0/ia_css_xnr_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_1.0/ia_css_xnr_types.h
@@ -15,11 +15,11 @@
 #ifndef __IA_CSS_XNR_TYPES_H
 #define __IA_CSS_XNR_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Extra Noise Reduction (XNR) parameters.
 */
 
-/** XNR table.
+/* XNR table.
  *
  *  NOTE: The driver does not need to set this table,
  *        because the default values are set inside the css.
@@ -36,23 +36,23 @@
  *
  */
 
-/** Number of elements in the xnr table. */
+/* Number of elements in the xnr table. */
 #define IA_CSS_VAMEM_1_XNR_TABLE_SIZE_LOG2      6
-/** Number of elements in the xnr table. */
+/* Number of elements in the xnr table. */
 #define IA_CSS_VAMEM_1_XNR_TABLE_SIZE           (1U<<IA_CSS_VAMEM_1_XNR_TABLE_SIZE_LOG2)
 
-/** Number of elements in the xnr table. */
+/* Number of elements in the xnr table. */
 #define IA_CSS_VAMEM_2_XNR_TABLE_SIZE_LOG2      6
-/** Number of elements in the xnr table. */
+/* Number of elements in the xnr table. */
 #define IA_CSS_VAMEM_2_XNR_TABLE_SIZE           (1U<<IA_CSS_VAMEM_2_XNR_TABLE_SIZE_LOG2)
 
-/**< IA_CSS_VAMEM_TYPE_1(ISP2300) or
+/** IA_CSS_VAMEM_TYPE_1(ISP2300) or
      IA_CSS_VAMEM_TYPE_2(ISP2400) */
 union ia_css_xnr_data {
         uint16_t vamem_1[IA_CSS_VAMEM_1_XNR_TABLE_SIZE];
-        /**< Coefficients table on vamem type1. u0.12, [0,4095] */
+        /** Coefficients table on vamem type1. u0.12, [0,4095] */
         uint16_t vamem_2[IA_CSS_VAMEM_2_XNR_TABLE_SIZE];
-        /**< Coefficients table on vamem type2. u0.12, [0,4095] */
+        /** Coefficients table on vamem type2. u0.12, [0,4095] */
 };
 
 struct ia_css_xnr_table {
@@ -61,7 +61,7 @@ struct ia_css_xnr_table {
 };
 
 struct ia_css_xnr_config {
-        /** XNR threshold.
+        /* XNR threshold.
          * type:u0.16 valid range:[0,65535]
          * default: 6400 */
         uint16_t threshold;
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_3.0/ia_css_xnr3_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_3.0/ia_css_xnr3_types.h
index 8f14d1080651..669200caf72e 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_3.0/ia_css_xnr3_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/xnr/xnr_3.0/ia_css_xnr3_types.h
@@ -15,7 +15,7 @@
 #ifndef __IA_CSS_XNR3_TYPES_H
 #define __IA_CSS_XNR3_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Extra Noise Reduction (XNR) parameters.
 */
 
@@ -47,12 +47,12 @@
  * IA_CSS_XNR3_SIGMA_SCALE.
  */
 struct ia_css_xnr3_sigma_params {
-        int y0;     /**< Sigma for Y range similarity in dark area */
-        int y1;     /**< Sigma for Y range similarity in bright area */
-        int u0;     /**< Sigma for U range similarity in dark area */
-        int u1;     /**< Sigma for U range similarity in bright area */
-        int v0;     /**< Sigma for V range similarity in dark area */
-        int v1;     /**< Sigma for V range similarity in bright area */
+        int y0;     /** Sigma for Y range similarity in dark area */
+        int y1;     /** Sigma for Y range similarity in bright area */
+        int u0;     /** Sigma for U range similarity in dark area */
+        int u1;     /** Sigma for U range similarity in bright area */
+        int v0;     /** Sigma for V range similarity in dark area */
+        int v1;     /** Sigma for V range similarity in bright area */
 };
 
 /**
@@ -64,10 +64,10 @@ struct ia_css_xnr3_sigma_params {
  * with IA_CSS_XNR3_CORING_SCALE. The ineffective value is 0.
  */
 struct ia_css_xnr3_coring_params {
-        int u0;     /**< Coring threshold of U channel in dark area */
-        int u1;     /**< Coring threshold of U channel in bright area */
-        int v0;     /**< Coring threshold of V channel in dark area */
-        int v1;     /**< Coring threshold of V channel in bright area */
+        int u0;     /** Coring threshold of U channel in dark area */
+        int u1;     /** Coring threshold of U channel in bright area */
+        int v0;     /** Coring threshold of V channel in dark area */
+        int v1;     /** Coring threshold of V channel in bright area */
 };
 
 /**
@@ -81,7 +81,7 @@ struct ia_css_xnr3_coring_params {
  * value of 0.0 bypasses the entire xnr3 filter.
  */
 struct ia_css_xnr3_blending_params {
-        int strength;   /**< Blending strength */
+        int strength;   /** Blending strength */
 };
 
 /**
@@ -90,9 +90,9 @@ struct ia_css_xnr3_blending_params {
  * from the CSS API.
  */
 struct ia_css_xnr3_config {
-        struct ia_css_xnr3_sigma_params    sigma;    /**< XNR3 sigma parameters */
-        struct ia_css_xnr3_coring_params   coring;   /**< XNR3 coring parameters */
-        struct ia_css_xnr3_blending_params blending; /**< XNR3 blending parameters */
+        struct ia_css_xnr3_sigma_params    sigma;    /** XNR3 sigma parameters */
+        struct ia_css_xnr3_coring_params   coring;   /** XNR3 coring parameters */
+        struct ia_css_xnr3_blending_params blending; /** XNR3 blending parameters */
 };
 
 #endif /* __IA_CSS_XNR3_TYPES_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ynr/ynr_1.0/ia_css_ynr_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ynr/ynr_1.0/ia_css_ynr_types.h
index 3f46655bee57..3f8589a5a43a 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ynr/ynr_1.0/ia_css_ynr_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ynr/ynr_1.0/ia_css_ynr_types.h
@@ -15,11 +15,11 @@
 #ifndef __IA_CSS_YNR_TYPES_H
 #define __IA_CSS_YNR_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Noise Reduction (BNR) and YCC Noise Reduction (YNR,CNR).
 */
 
-/** Configuration used by Bayer Noise Reduction (BNR) and
+/* Configuration used by Bayer Noise Reduction (BNR) and
  *  YCC Noise Reduction (YNR,CNR).
  *
  *  ISP block: BNR1, YNR1, CNR1
@@ -28,28 +28,28 @@
  *        BNR1,YNR2,CNR2 are used for Still.
  */
 struct ia_css_nr_config {
-        ia_css_u0_16 bnr_gain;     /**< Strength of noise reduction (BNR).
+        ia_css_u0_16 bnr_gain;     /** Strength of noise reduction (BNR).
                                 u0.16, [0,65535],
                                 default 14336(0.21875), ineffective 0 */
-        ia_css_u0_16 ynr_gain;     /**< Strength of noise reduction (YNR).
+        ia_css_u0_16 ynr_gain;     /** Strength of noise reduction (YNR).
                                 u0.16, [0,65535],
                                 default 14336(0.21875), ineffective 0 */
-        ia_css_u0_16 direction;    /**< Sensitivity of edge (BNR).
+        ia_css_u0_16 direction;    /** Sensitivity of edge (BNR).
                                 u0.16, [0,65535],
                                 default 512(0.0078125), ineffective 0 */
-        ia_css_u0_16 threshold_cb; /**< Coring threshold for Cb (CNR).
+        ia_css_u0_16 threshold_cb; /** Coring threshold for Cb (CNR).
                                 This is the same as
                                 de_config.c1_coring_threshold.
                                 u0.16, [0,65535],
                                 default 0(0), ineffective 0 */
-        ia_css_u0_16 threshold_cr; /**< Coring threshold for Cr (CNR).
+        ia_css_u0_16 threshold_cr; /** Coring threshold for Cr (CNR).
                                 This is the same as
                                 de_config.c2_coring_threshold.
                                 u0.16, [0,65535],
                                 default 0(0), ineffective 0 */
 };
 
-/** Edge Enhancement (sharpen) configuration.
+/* Edge Enhancement (sharpen) configuration.
  *
  *  ISP block: YEE1
  *  ISP1: YEE1 is used.
@@ -57,24 +57,24 @@ struct ia_css_nr_config {
  *       (YEE2 is used for Still.)
  */
 struct ia_css_ee_config {
-        ia_css_u5_11 gain;        /**< The strength of sharpness.
+        ia_css_u5_11 gain;        /** The strength of sharpness.
                                         u5.11, [0,65535],
                                         default 8192(4.0), ineffective 0 */
-        ia_css_u8_8 threshold;    /**< The threshold that divides noises from
+        ia_css_u8_8 threshold;    /** The threshold that divides noises from
                                         edge.
                                         u8.8, [0,65535],
                                         default 256(1.0), ineffective 65535 */
-        ia_css_u5_11 detail_gain; /**< The strength of sharpness in pell-mell
+        ia_css_u5_11 detail_gain; /** The strength of sharpness in pell-mell
                                         area.
                                         u5.11, [0,65535],
                                         default 2048(1.0), ineffective 0 */
 };
 
-/** YNR and YEE (sharpen) configuration.
+/* YNR and YEE (sharpen) configuration.
  */
 struct ia_css_yee_config {
-        struct ia_css_nr_config nr; /**< The NR configuration. */
-        struct ia_css_ee_config ee; /**< The EE configuration. */
+        struct ia_css_nr_config nr; /** The NR configuration. */
+        struct ia_css_ee_config ee; /** The EE configuration. */
 };
 
 #endif /* __IA_CSS_YNR_TYPES_H */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ynr/ynr_2/ia_css_ynr2_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ynr/ynr_2/ia_css_ynr2_types.h
index e0a0b10ac5fa..83161a24207d 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ynr/ynr_2/ia_css_ynr2_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/ynr/ynr_2/ia_css_ynr2_types.h
@@ -15,11 +15,11 @@
 #ifndef __IA_CSS_YNR2_TYPES_H
 #define __IA_CSS_YNR2_TYPES_H
 
-/** @file
+/* @file
 * CSS-API header file for Y(Luma) Noise Reduction.
 */
 
-/** Y(Luma) Noise Reduction configuration.
+/* Y(Luma) Noise Reduction configuration.
  *
  *  ISP block: YNR2 & YEE2
  * (ISP1: YNR1 and YEE1 are used.)
@@ -27,21 +27,21 @@
  *  ISP2: YNR2 and YEE2 are used for Still.
  */
 struct ia_css_ynr_config {
-        uint16_t edge_sense_gain_0;   /**< Sensitivity of edge in dark area.
+        uint16_t edge_sense_gain_0;   /** Sensitivity of edge in dark area.
                                         u13.0, [0,8191],
                                         default 1000, ineffective 0 */
-        uint16_t edge_sense_gain_1;   /**< Sensitivity of edge in bright area.
+        uint16_t edge_sense_gain_1;   /** Sensitivity of edge in bright area.
                                         u13.0, [0,8191],
                                         default 1000, ineffective 0 */
-        uint16_t corner_sense_gain_0; /**< Sensitivity of corner in dark area.
+        uint16_t corner_sense_gain_0; /** Sensitivity of corner in dark area.
                                         u13.0, [0,8191],
                                         default 1000, ineffective 0 */
-        uint16_t corner_sense_gain_1; /**< Sensitivity of corner in bright area.
+        uint16_t corner_sense_gain_1; /** Sensitivity of corner in bright area.
                                         u13.0, [0,8191],
                                         default 1000, ineffective 0 */
 };
 
-/** Fringe Control configuration.
+/* Fringe Control configuration.
  *
  *  ISP block: FC2 (FC2 is used with YNR2/YEE2.)
  * (ISP1: FC2 is not used.)
@@ -49,43 +49,43 @@ struct ia_css_ynr_config {
  *  ISP2: FC2 is used for Still.
  */
 struct ia_css_fc_config {
-        uint8_t  gain_exp;   /**< Common exponent of gains.
+        uint8_t  gain_exp;   /** Common exponent of gains.
                                 u8.0, [0,13],
                                 default 1, ineffective 0 */
-        uint16_t coring_pos_0; /**< Coring threshold for positive edge in dark area.
+        uint16_t coring_pos_0; /** Coring threshold for positive edge in dark area.
                                 u0.13, [0,8191],
                                 default 0(0), ineffective 0 */
-        uint16_t coring_pos_1; /**< Coring threshold for positive edge in bright area.
+        uint16_t coring_pos_1; /** Coring threshold for positive edge in bright area.
                                 u0.13, [0,8191],
                                 default 0(0), ineffective 0 */
-        uint16_t coring_neg_0; /**< Coring threshold for negative edge in dark area.
+        uint16_t coring_neg_0; /** Coring threshold for negative edge in dark area.
                                 u0.13, [0,8191],
                                 default 0(0), ineffective 0 */
-        uint16_t coring_neg_1; /**< Coring threshold for negative edge in bright area.
+        uint16_t coring_neg_1; /** Coring threshold for negative edge in bright area.
                                 u0.13, [0,8191],
                                 default 0(0), ineffective 0 */
-        uint16_t gain_pos_0; /**< Gain for positive edge in dark area.
+        uint16_t gain_pos_0; /** Gain for positive edge in dark area.
                                 u0.13, [0,8191],
                                 default 4096(0.5), ineffective 0 */
-        uint16_t gain_pos_1; /**< Gain for positive edge in bright area.
+        uint16_t gain_pos_1; /** Gain for positive edge in bright area.
                                 u0.13, [0,8191],
                                 default 4096(0.5), ineffective 0 */
-        uint16_t gain_neg_0; /**< Gain for negative edge in dark area.
+        uint16_t gain_neg_0; /** Gain for negative edge in dark area.
                                 u0.13, [0,8191],
                                 default 4096(0.5), ineffective 0 */
-        uint16_t gain_neg_1; /**< Gain for negative edge in bright area.
+        uint16_t gain_neg_1; /** Gain for negative edge in bright area.
                                 u0.13, [0,8191],
                                 default 4096(0.5), ineffective 0 */
-        uint16_t crop_pos_0; /**< Limit for positive edge in dark area.
+        uint16_t crop_pos_0; /** Limit for positive edge in dark area.
                                 u0.13, [0,8191],
                                 default/ineffective 8191(almost 1.0) */
-        uint16_t crop_pos_1; /**< Limit for positive edge in bright area.
+        uint16_t crop_pos_1; /** Limit for positive edge in bright area.
                                 u0.13, [0,8191],
                                 default/ineffective 8191(almost 1.0) */
-        int16_t  crop_neg_0; /**< Limit for negative edge in dark area.
+        int16_t  crop_neg_0; /** Limit for negative edge in dark area.
                                 s0.13, [-8192,0],
                                 default/ineffective -8192(-1.0) */
-        int16_t  crop_neg_1; /**< Limit for negative edge in bright area.
+        int16_t  crop_neg_1; /** Limit for negative edge in bright area.
                                 s0.13, [-8192,0],
                                 default/ineffective -8192(-1.0) */
 };
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/yuv_ls/yuv_ls_1.0/ia_css_yuv_ls_param.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/yuv_ls/yuv_ls_1.0/ia_css_yuv_ls_param.h
index 63a8703c9c44..c9ff0cb2493a 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/yuv_ls/yuv_ls_1.0/ia_css_yuv_ls_param.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/yuv_ls/yuv_ls_1.0/ia_css_yuv_ls_param.h
@@ -24,7 +24,7 @@
  */
 #define NUM_YUV_LS 2
 
-/** YUV load/store */
+/* YUV load/store */
 struct sh_css_isp_yuv_ls_isp_config {
         unsigned base_address[NUM_YUV_LS];
         unsigned width[NUM_YUV_LS];
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/memory_realloc.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/memory_realloc.c
index e814f1bf19f7..6512a1ceb9d3 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/memory_realloc.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/memory_realloc.c
@@ -1,4 +1,4 @@
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/binary/interface/ia_css_binary.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/binary/interface/ia_css_binary.h
index c65194619a34..5a58abe2b233 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/binary/interface/ia_css_binary.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/binary/interface/ia_css_binary.h
@@ -269,7 +269,7 @@ enum ia_css_err
 ia_css_binary_find(struct ia_css_binary_descr *descr,
                    struct ia_css_binary *binary);
 
-/** @brief Get the shading information of the specified shading correction type.
+/* @brief Get the shading information of the specified shading correction type.
  *
  * @param[in] binary: The isp binary which has the shading correction.
  * @param[in] type: The shading correction type.
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/binary/src/binary.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/binary/src/binary.c
index e028e460ae4c..295e07049393 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/binary/src/binary.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/binary/src/binary.c
@@ -972,7 +972,7 @@ ia_css_binary_uninit(void)
         return IA_CSS_SUCCESS;
 }
 
-/** @brief Compute decimation factor for 3A statistics and shading correction.
+/* @brief Compute decimation factor for 3A statistics and shading correction.
  *
  * @param[in]   width   Frame width in pixels.
  * @param[in]   height  Frame height in pixels.
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/bufq/src/bufq.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/bufq/src/bufq.c
index 42d9a8508858..e50d9f2e2609 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/bufq/src/bufq.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/bufq/src/bufq.c
@@ -152,7 +152,7 @@ void ia_css_queue_map(
                 unmap_buffer_type_to_queue_id(thread_id, buf_type);
 }
 
-/**
+/*
  * @brief Query the internal queue ID.
  */
 bool ia_css_query_internal_queue_id(
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/debug/interface/ia_css_debug.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/debug/interface/ia_css_debug.h
index 3c8dcfd4bbc6..4b28b2a0863a 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/debug/interface/ia_css_debug.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/debug/interface/ia_css_debug.h
@@ -54,21 +54,21 @@ extern unsigned int ia_css_debug_trace_level;
  *  Values can be combined to dump a combination of sets.
  */
 enum ia_css_debug_enable_param_dump {
-        IA_CSS_DEBUG_DUMP_FPN = 1 << 0, /**< FPN table */
-        IA_CSS_DEBUG_DUMP_OB = 1 << 1,  /**< OB table */
-        IA_CSS_DEBUG_DUMP_SC = 1 << 2,  /**< Shading table */
-        IA_CSS_DEBUG_DUMP_WB = 1 << 3,  /**< White balance */
-        IA_CSS_DEBUG_DUMP_DP = 1 << 4,  /**< Defect Pixel */
-        IA_CSS_DEBUG_DUMP_BNR = 1 << 5,  /**< Bayer Noise Reductions */
-        IA_CSS_DEBUG_DUMP_S3A = 1 << 6,  /**< 3A Statistics */
-        IA_CSS_DEBUG_DUMP_DE = 1 << 7,  /**< De Mosaicing */
-        IA_CSS_DEBUG_DUMP_YNR = 1 << 8,  /**< Luma Noise Reduction */
-        IA_CSS_DEBUG_DUMP_CSC = 1 << 9,  /**< Color Space Conversion */
-        IA_CSS_DEBUG_DUMP_GC = 1 << 10,  /**< Gamma Correction */
-        IA_CSS_DEBUG_DUMP_TNR = 1 << 11,  /**< Temporal Noise Reduction */
-        IA_CSS_DEBUG_DUMP_ANR = 1 << 12,  /**< Advanced Noise Reduction */
-        IA_CSS_DEBUG_DUMP_CE = 1 << 13,  /**< Chroma Enhancement */
-        IA_CSS_DEBUG_DUMP_ALL = 1 << 14  /**< Dump all device parameters */
+        IA_CSS_DEBUG_DUMP_FPN = 1 << 0, /** FPN table */
+        IA_CSS_DEBUG_DUMP_OB = 1 << 1,  /** OB table */
+        IA_CSS_DEBUG_DUMP_SC = 1 << 2,  /** Shading table */
+        IA_CSS_DEBUG_DUMP_WB = 1 << 3,  /** White balance */
+        IA_CSS_DEBUG_DUMP_DP = 1 << 4,  /** Defect Pixel */
+        IA_CSS_DEBUG_DUMP_BNR = 1 << 5,  /** Bayer Noise Reductions */
+        IA_CSS_DEBUG_DUMP_S3A = 1 << 6,  /** 3A Statistics */
+        IA_CSS_DEBUG_DUMP_DE = 1 << 7,  /** De Mosaicing */
+        IA_CSS_DEBUG_DUMP_YNR = 1 << 8,  /** Luma Noise Reduction */
+        IA_CSS_DEBUG_DUMP_CSC = 1 << 9,  /** Color Space Conversion */
+        IA_CSS_DEBUG_DUMP_GC = 1 << 10,  /** Gamma Correction */
+        IA_CSS_DEBUG_DUMP_TNR = 1 << 11,  /** Temporal Noise Reduction */
+        IA_CSS_DEBUG_DUMP_ANR = 1 << 12,  /** Advanced Noise Reduction */
+        IA_CSS_DEBUG_DUMP_CE = 1 << 13,  /** Chroma Enhancement */
+        IA_CSS_DEBUG_DUMP_ALL = 1 << 14  /** Dump all device parameters */
 };
 
 #define IA_CSS_ERROR(fmt, ...) \
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/debug/src/ia_css_debug.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/debug/src/ia_css_debug.c
index 0fa7cb2423d8..dd1127a21494 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/debug/src/ia_css_debug.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/debug/src/ia_css_debug.c
@@ -1617,7 +1617,7 @@ void ia_css_debug_print_sp_debug_state(const struct sh_css_sp_debug_state
 
 #elif SP_DEBUG == SP_DEBUG_TRACE
 
-/**
+/*
  * This is just an example how TRACE_FILE_ID (see ia_css_debug.sp.h) will
  * me mapped on the file name string.
  *
@@ -2267,7 +2267,7 @@ void ia_css_debug_dump_debug_info(const char *context)
         return;
 }
 
-/** this function is for debug use, it can make SP go to sleep
+/* this function is for debug use, it can make SP go to sleep
   state after each frame, then user can dump the stable SP dmem.
   this function can be called after ia_css_start_sp()
   and before sh_css_init_buffer_queues()
@@ -2526,7 +2526,7 @@ void ia_css_debug_dump_ddr_debug_queue(void)
 }
 */
 
-/**
+/*
  * @brief Initialize the debug mode.
  * Refer to "ia_css_debug.h" for more details.
  */
@@ -2537,7 +2537,7 @@ bool ia_css_debug_mode_init(void)
         return rc;
 }
 
-/**
+/*
  * @brief Disable the DMA channel.
  * Refer to "ia_css_debug.h" for more details.
  */
@@ -2552,7 +2552,7 @@ ia_css_debug_mode_disable_dma_channel(int dma_id,
         return rc;
 }
 
-/**
+/*
  * @brief Enable the DMA channel.
  * Refer to "ia_css_debug.h" for more details.
  */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/event/src/event.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/event/src/event.c
index 2698c3e1adb0..239c06730bf4 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/event/src/event.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/event/src/event.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
@@ -52,7 +52,7 @@ more details.
 
 #include "ia_css_queue.h"       /* host_sp_enqueue_XXX */
 #include "ia_css_event.h"       /* ia_css_event_encode */
-/**
+/*
  * @brief Encode the information into the software-event.
  * Refer to "sw_event_public.h" for details.
  */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/eventq/src/eventq.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/eventq/src/eventq.c
index 56d6858890ec..913a4bf7a34f 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/eventq/src/eventq.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/eventq/src/eventq.c
@@ -37,7 +37,7 @@ int ia_css_eventq_recv(
         return error;
 }
 
-/**
+/*
  * @brief The Host sends the event to the SP.
  * Refer to "sh_css_sp.h" for details.
  */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/frame/interface/ia_css_frame.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/frame/interface/ia_css_frame.h
index c7e07b79f4e5..89ad8080ceb1 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/frame/interface/ia_css_frame.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/frame/interface/ia_css_frame.h
@@ -41,7 +41,7 @@ more details.
 /*********************************************************************
 ****    Frame INFO APIs
 **********************************************************************/
-/** @brief Sets the given width and alignment to the frame info
+/* @brief Sets the given width and alignment to the frame info
  *
  * @param
  * @param[in]   info        The info to which parameters would set
@@ -53,7 +53,7 @@ void ia_css_frame_info_set_width(struct ia_css_frame_info *info,
         unsigned int width,
         unsigned int min_padded_width);
 
-/** @brief Sets the given format to the frame info
+/* @brief Sets the given format to the frame info
  *
  * @param
  * @param[in]   info        The info to which parameters would set
@@ -63,7 +63,7 @@ void ia_css_frame_info_set_width(struct ia_css_frame_info *info,
 void ia_css_frame_info_set_format(struct ia_css_frame_info *info,
         enum ia_css_frame_format format);
 
-/** @brief Sets the frame info with the given parameters
+/* @brief Sets the frame info with the given parameters
  *
  * @param
  * @param[in]   info        The info to which parameters would set
@@ -79,7 +79,7 @@ void ia_css_frame_info_init(struct ia_css_frame_info *info,
         enum ia_css_frame_format format,
         unsigned int aligned);
 
-/** @brief Checks whether 2 frame infos has the same resolution
+/* @brief Checks whether 2 frame infos has the same resolution
  *
  * @param
  * @param[in]   frame_a         The first frame to be compared
@@ -90,7 +90,7 @@ bool ia_css_frame_info_is_same_resolution(
         const struct ia_css_frame_info *info_a,
         const struct ia_css_frame_info *info_b);
 
-/** @brief Check the frame info is valid
+/* @brief Check the frame info is valid
  *
  * @param
  * @param[in]   info       The frame attributes to be initialized
@@ -102,7 +102,7 @@ enum ia_css_err ia_css_frame_check_info(const struct ia_css_frame_info *info);
 ****    Frame APIs
 **********************************************************************/
 
-/** @brief Initialize the plane depending on the frame type
+/* @brief Initialize the plane depending on the frame type
  *
  * @param
  * @param[in]   frame           The frame attributes to be initialized
@@ -110,7 +110,7 @@ enum ia_css_err ia_css_frame_check_info(const struct ia_css_frame_info *info);
  */
 enum ia_css_err ia_css_frame_init_planes(struct ia_css_frame *frame);
 
-/** @brief Free an array of frames
+/* @brief Free an array of frames
  *
  * @param
  * @param[in]   num_frames      The number of frames to be freed in the array
@@ -120,7 +120,7 @@ enum ia_css_err ia_css_frame_init_planes(struct ia_css_frame *frame);
 void ia_css_frame_free_multiple(unsigned int num_frames,
         struct ia_css_frame **frames_array);
 
-/** @brief Allocate a CSS frame structure of given size in bytes..
+/* @brief Allocate a CSS frame structure of given size in bytes..
  *
  * @param       frame   The allocated frame.
  * @param[in]   size_bytes      The frame size in bytes.
@@ -135,7 +135,7 @@ enum ia_css_err ia_css_frame_allocate_with_buffer_size(
         const unsigned int size_bytes,
         const bool contiguous);
 
-/** @brief Check whether 2 frames are same type
+/* @brief Check whether 2 frames are same type
  *
  * @param
  * @param[in]   frame_a         The first frame to be compared
@@ -146,7 +146,7 @@ bool ia_css_frame_is_same_type(
         const struct ia_css_frame *frame_a,
         const struct ia_css_frame *frame_b);
 
-/** @brief Configure a dma port from frame info
+/* @brief Configure a dma port from frame info
  *
  * @param
  * @param[in]   config         The DAM port configuration
@@ -158,7 +158,7 @@ void ia_css_dma_configure_from_info(
         const struct ia_css_frame_info *info);
 
 #ifdef ISP2401
-/** @brief Finds the cropping resolution
+/* @brief Finds the cropping resolution
  * This function finds the maximum cropping resolution in an input image keeping
  * the aspect ratio for the given output resolution.Calculates the coordinates
  * for cropping from the center and returns the starting pixel location of the
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/frame/src/frame.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/frame/src/frame.c
index f1a943cf04c0..5faa89ad8a23 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/frame/src/frame.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/frame/src/frame.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/ifmtr/src/ifmtr.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/ifmtr/src/ifmtr.c
index 11d3995ba0db..adefa57820a4 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/ifmtr/src/ifmtr.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/ifmtr/src/ifmtr.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/inputfifo/src/inputfifo.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/inputfifo/src/inputfifo.c
index d9a5f3e9283a..8dc74927e9a2 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/inputfifo/src/inputfifo.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/inputfifo/src/inputfifo.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isp_param/interface/ia_css_isp_param_types.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isp_param/interface/ia_css_isp_param_types.h
index 8e651b80345a..2283dd1c1c9b 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isp_param/interface/ia_css_isp_param_types.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isp_param/interface/ia_css_isp_param_types.h
@@ -53,7 +53,7 @@ enum ia_css_param_class {
 };
 #define IA_CSS_NUM_PARAM_CLASSES (IA_CSS_PARAM_CLASS_STATE + 1)
 
-/** ISP parameter descriptor */
+/* ISP parameter descriptor */
 struct ia_css_isp_parameter {
         uint32_t offset; /* Offset in isp_<mem>)parameters, etc. */
         uint32_t size;   /* Disabled if 0 */
@@ -77,10 +77,10 @@ struct ia_css_isp_param_isp_segments {
 
 /* Memory offsets in binary info */
 struct ia_css_isp_param_memory_offsets {
-        uint32_t offsets[IA_CSS_NUM_PARAM_CLASSES];  /**< offset wrt hdr in bytes */
+        uint32_t offsets[IA_CSS_NUM_PARAM_CLASSES];  /** offset wrt hdr in bytes */
 };
 
-/** Offsets for ISP kernel parameters per isp memory.
+/* Offsets for ISP kernel parameters per isp memory.
  * Only relevant for standard ISP binaries, not ACC or SP.
  */
 union ia_css_all_memory_offsets {
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isp_param/src/isp_param.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isp_param/src/isp_param.c
index 832d9e16edeb..f793ce125f02 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isp_param/src/isp_param.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isp_param/src/isp_param.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/interface/ia_css_isys.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/interface/ia_css_isys.h
index 02bf908d94e6..4cf2defe9ef0 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/interface/ia_css_isys.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/interface/ia_css_isys.h
@@ -44,7 +44,7 @@ more details.
  * Virtual Input System. (Input System 2401)
  */
 typedef input_system_cfg_t      ia_css_isys_descr_t;
-/** end of Virtual Input System */
+/* end of Virtual Input System */
 #endif
 
 #if defined(USE_INPUT_SYSTEM_VERSION_2) || defined(USE_INPUT_SYSTEM_VERSION_2401)
@@ -112,7 +112,7 @@ unsigned int ia_css_isys_rx_translate_irq_infos(unsigned int bits);
 
 #endif /* #if !defined(USE_INPUT_SYSTEM_VERSION_2401) */
 
-/** @brief Translate format and compression to format type.
+/* @brief Translate format and compression to format type.
  *
  * @param[in]   input_format    The input format.
  * @param[in]   compression     The compression scheme.
@@ -195,7 +195,7 @@ extern void ia_css_isys_stream2mmio_sid_rmgr_release(
         stream2mmio_ID_t        stream2mmio,
         stream2mmio_sid_ID_t    *sid);
 
-/** end of Virtual Input System */
+/* end of Virtual Input System */
 #endif
 
 #endif                          /* __IA_CSS_ISYS_H__ */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/csi_rx_rmgr.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/csi_rx_rmgr.c
index d1d4f79c00f1..3b04dc51335a 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/csi_rx_rmgr.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/csi_rx_rmgr.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/ibuf_ctrl_rmgr.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/ibuf_ctrl_rmgr.c
index faef97672eac..d8c3b75d7fac 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/ibuf_ctrl_rmgr.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/ibuf_ctrl_rmgr.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
  * Support for Intel Camera Imaging ISP subsystem.
  * Copyright (c) 2010 - 2015, Intel Corporation.
  *
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/isys_dma_rmgr.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/isys_dma_rmgr.c
index 5032627342d9..4def4a542b7d 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/isys_dma_rmgr.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/isys_dma_rmgr.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/isys_init.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/isys_init.c
index 239ef310bdeb..4122084fd237 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/isys_init.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/isys_init.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/isys_stream2mmio_rmgr.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/isys_stream2mmio_rmgr.c
index a93c7f44ff12..222b294c0ab0 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/isys_stream2mmio_rmgr.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/isys_stream2mmio_rmgr.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/rx.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/rx.c
index 46a157f64343..70f6cb5e5918 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/rx.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/rx.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/virtual_isys.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/virtual_isys.c
index 0f1e8a2f6b10..90922a7acefd 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/virtual_isys.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/isys/src/virtual_isys.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
@@ -166,7 +166,7 @@ static int32_t calculate_stride(
         bool    raw_packed,
         int32_t align_in_bytes);
 
-/** end of Forwarded Declaration */
+/* end of Forwarded Declaration */
 
 /**************************************************
  *
@@ -292,7 +292,7 @@ ia_css_isys_error_t ia_css_isys_stream_calculate_cfg(
         return rc;
 }
 
-/** end of Public Methods */
+/* end of Public Methods */
 
 /**************************************************
  *
@@ -894,5 +894,5 @@ static csi_mipi_packet_type_t get_csi_mipi_packet_type(
 
         return packet_type;
 }
-/** end of Private Methods */
+/* end of Private Methods */
 #endif
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/pipeline/interface/ia_css_pipeline.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/pipeline/interface/ia_css_pipeline.h
index 90646f5f8885..e64936e2d46e 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/pipeline/interface/ia_css_pipeline.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/pipeline/interface/ia_css_pipeline.h
@@ -103,7 +103,7 @@ struct ia_css_pipeline_stage_desc {
         struct ia_css_frame *vf_frame;
 };
 
-/** @brief initialize the pipeline module
+/* @brief initialize the pipeline module
  *
  * @return    None
  *
@@ -112,7 +112,7 @@ struct ia_css_pipeline_stage_desc {
  */
 void ia_css_pipeline_init(void);
 
-/** @brief initialize the pipeline structure with default values
+/* @brief initialize the pipeline structure with default values
  *
  * @param[out] pipeline  structure to be initialized with defaults
  * @param[in] pipe_id
@@ -129,7 +129,7 @@ enum ia_css_err ia_css_pipeline_create(
         unsigned int pipe_num,
         unsigned int dvs_frame_delay);
 
-/** @brief destroy a pipeline
+/* @brief destroy a pipeline
  *
  * @param[in] pipeline
  * @return    None
@@ -138,7 +138,7 @@ enum ia_css_err ia_css_pipeline_create(
 void ia_css_pipeline_destroy(struct ia_css_pipeline *pipeline);
 
 
-/** @brief Starts a pipeline
+/* @brief Starts a pipeline
  *
  * @param[in] pipe_id
  * @param[in] pipeline
@@ -148,7 +148,7 @@ void ia_css_pipeline_destroy(struct ia_css_pipeline *pipeline);
 void ia_css_pipeline_start(enum ia_css_pipe_id pipe_id,
                            struct ia_css_pipeline *pipeline);
 
-/** @brief Request to stop a pipeline
+/* @brief Request to stop a pipeline
  *
  * @param[in] pipeline
  * @return                     IA_CSS_SUCCESS or error code upon error.
@@ -156,7 +156,7 @@ void ia_css_pipeline_start(enum ia_css_pipe_id pipe_id,
  */
 enum ia_css_err ia_css_pipeline_request_stop(struct ia_css_pipeline *pipeline);
 
-/** @brief Check whether pipeline has stopped
+/* @brief Check whether pipeline has stopped
  *
  * @param[in] pipeline
  * @return    true if the pipeline has stopped
@@ -164,7 +164,7 @@ enum ia_css_err ia_css_pipeline_request_stop(struct ia_css_pipeline *pipeline);
  */
 bool ia_css_pipeline_has_stopped(struct ia_css_pipeline *pipe);
 
-/** @brief clean all the stages pipeline and make it as new
+/* @brief clean all the stages pipeline and make it as new
  *
  * @param[in] pipeline
  * @return    None
@@ -172,7 +172,7 @@ bool ia_css_pipeline_has_stopped(struct ia_css_pipeline *pipe);
  */
 void ia_css_pipeline_clean(struct ia_css_pipeline *pipeline);
 
-/** @brief Add a stage to pipeline.
+/* @brief Add a stage to pipeline.
  *
  * @param     pipeline               Pointer to the pipeline to be added to.
  * @param[in] stage_desc       The description of the stage
@@ -188,7 +188,7 @@ enum ia_css_err ia_css_pipeline_create_and_add_stage(
                         struct ia_css_pipeline_stage_desc *stage_desc,
                         struct ia_css_pipeline_stage **stage);
 
-/** @brief Finalize the stages in a pipeline
+/* @brief Finalize the stages in a pipeline
  *
  * @param     pipeline               Pointer to the pipeline to be added to.
  * @return                     None
@@ -198,7 +198,7 @@ enum ia_css_err ia_css_pipeline_create_and_add_stage(
 void ia_css_pipeline_finalize_stages(struct ia_css_pipeline *pipeline,
                         bool continuous);
 
-/** @brief gets a stage from the pipeline
+/* @brief gets a stage from the pipeline
  *
  * @param[in] pipeline
  * @return                     IA_CSS_SUCCESS or error code upon error.
@@ -208,7 +208,7 @@ enum ia_css_err ia_css_pipeline_get_stage(struct ia_css_pipeline *pipeline,
                           int mode,
                           struct ia_css_pipeline_stage **stage);
 
-/** @brief Gets a pipeline stage corresponding Firmware handle from the pipeline
+/* @brief Gets a pipeline stage corresponding Firmware handle from the pipeline
  *
  * @param[in] pipeline
  * @param[in] fw_handle
@@ -221,7 +221,7 @@ enum ia_css_err ia_css_pipeline_get_stage_from_fw(struct ia_css_pipeline *pipeli
                           uint32_t fw_handle,
                           struct ia_css_pipeline_stage **stage);
 
-/** @brief Gets the Firmware handle correponding the stage num from the pipeline
+/* @brief Gets the Firmware handle correponding the stage num from the pipeline
  *
  * @param[in] pipeline
  * @param[in] stage_num
@@ -234,7 +234,7 @@ enum ia_css_err ia_css_pipeline_get_fw_from_stage(struct ia_css_pipeline *pipeli
                           uint32_t stage_num,
                           uint32_t *fw_handle);
 
-/** @brief gets the output stage from the pipeline
+/* @brief gets the output stage from the pipeline
  *
  * @param[in] pipeline
  * @return                     IA_CSS_SUCCESS or error code upon error.
@@ -245,7 +245,7 @@ enum ia_css_err ia_css_pipeline_get_output_stage(
                         int mode,
                         struct ia_css_pipeline_stage **stage);
 
-/** @brief Checks whether the pipeline uses params
+/* @brief Checks whether the pipeline uses params
  *
  * @param[in] pipeline
  * @return    true if the pipeline uses params
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/pipeline/src/pipeline.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/pipeline/src/pipeline.c
index 62d13978475d..8f93d29d1c51 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/pipeline/src/pipeline.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/pipeline/src/pipeline.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
@@ -114,7 +114,7 @@ void ia_css_pipeline_map(unsigned int pipe_num, bool map)
         IA_CSS_LEAVE_PRIVATE("void");
 }
 
-/** @brief destroy a pipeline
+/* @brief destroy a pipeline
  *
  * @param[in] pipeline
  * @return    None
@@ -187,7 +187,7 @@ void ia_css_pipeline_start(enum ia_css_pipe_id pipe_id,
               "ia_css_pipeline_start() leave: return_void\n");
 }
 
-/**
+/*
  * @brief Query the SP thread ID.
  * Refer to "sh_css_internal.h" for details.
  */
@@ -285,7 +285,7 @@ void ia_css_pipeline_clean(struct ia_css_pipeline *pipeline)
         IA_CSS_LEAVE_PRIVATE("void");
 }
 
-/** @brief Add a stage to pipeline.
+/* @brief Add a stage to pipeline.
  *
  * @param       pipeline      Pointer to the pipeline to be added to.
  * @param[in]   stage_desc    The description of the stage
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/queue/interface/ia_css_queue.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/queue/interface/ia_css_queue.h
index e50a0f813753..aaf2e247cafb 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/queue/interface/ia_css_queue.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/queue/interface/ia_css_queue.h
@@ -51,7 +51,7 @@ typedef struct ia_css_queue ia_css_queue_t;
 /*****************************************************************************
  * Queue Public APIs
  *****************************************************************************/
-/** @brief Initialize a local queue instance.
+/* @brief Initialize a local queue instance.
  *
  * @param[out] qhandle. Handle to queue instance for use with API
  * @param[in]  desc.   Descriptor with queue properties filled-in
@@ -63,7 +63,7 @@ extern int ia_css_queue_local_init(
                         ia_css_queue_t *qhandle,
                         ia_css_queue_local_t *desc);
 
-/** @brief Initialize a remote queue instance
+/* @brief Initialize a remote queue instance
  *
  * @param[out] qhandle. Handle to queue instance for use with API
  * @param[in]  desc.   Descriptor with queue properties filled-in
@@ -74,7 +74,7 @@ extern int ia_css_queue_remote_init(
                         ia_css_queue_t *qhandle,
                         ia_css_queue_remote_t *desc);
 
-/** @brief Uninitialize a queue instance
+/* @brief Uninitialize a queue instance
  *
  * @param[in]  qhandle. Handle to queue instance
  * @return     0 - Successful uninit.
@@ -83,7 +83,7 @@ extern int ia_css_queue_remote_init(
 extern int ia_css_queue_uninit(
                         ia_css_queue_t *qhandle);
 
-/** @brief Enqueue an item in the queue instance
+/* @brief Enqueue an item in the queue instance
  *
  * @param[in]  qhandle. Handle to queue instance
  * @param[in]  item.    Object to be enqueued.
@@ -96,7 +96,7 @@ extern int ia_css_queue_enqueue(
                         ia_css_queue_t *qhandle,
                         uint32_t item);
 
-/** @brief Dequeue an item from the queue instance
+/* @brief Dequeue an item from the queue instance
  *
  * @param[in]  qhandle. Handle to queue instance
  * @param[out] item.    Object to be dequeued into this item.
@@ -110,7 +110,7 @@ extern int ia_css_queue_dequeue(
                         ia_css_queue_t *qhandle,
                         uint32_t *item);
 
-/** @brief Check if the queue is empty
+/* @brief Check if the queue is empty
  *
  * @param[in]  qhandle.  Handle to queue instance
  * @param[in]  is_empty  True if empty, False if not.
@@ -123,7 +123,7 @@ extern int ia_css_queue_is_empty(
                         ia_css_queue_t *qhandle,
                         bool *is_empty);
 
-/** @brief Check if the queue is full
+/* @brief Check if the queue is full
  *
  * @param[in]  qhandle.  Handle to queue instance
  * @param[in]  is_full   True if Full, False if not.
@@ -136,7 +136,7 @@ extern int ia_css_queue_is_full(
                         ia_css_queue_t *qhandle,
                         bool *is_full);
 
-/** @brief Get used space in the queue
+/* @brief Get used space in the queue
  *
  * @param[in]  qhandle.  Handle to queue instance
  * @param[in]  size      Number of available elements in the queue
@@ -148,7 +148,7 @@ extern int ia_css_queue_get_used_space(
                         ia_css_queue_t *qhandle,
                         uint32_t *size);
 
-/** @brief Get free space in the queue
+/* @brief Get free space in the queue
  *
  * @param[in]  qhandle.  Handle to queue instance
  * @param[in]  size      Number of free elements in the queue
@@ -160,7 +160,7 @@ extern int ia_css_queue_get_free_space(
                         ia_css_queue_t *qhandle,
                         uint32_t *size);
 
-/** @brief Peek at an element in the queue
+/* @brief Peek at an element in the queue
  *
  * @param[in]  qhandle.  Handle to queue instance
  * @param[in]  offset   Offset of element to peek,
@@ -175,7 +175,7 @@ extern int ia_css_queue_peek(
                 uint32_t offset,
                 uint32_t *element);
 
-/** @brief Get the usable size for the queue
+/* @brief Get the usable size for the queue
  *
  * @param[in]  qhandle. Handle to queue instance
  * @param[out] size     Size value to be returned here.
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/queue/src/queue_access.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/queue/src/queue_access.c
index 946d4f2d2108..7bb2b494836e 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/queue/src/queue_access.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/queue/src/queue_access.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/rmgr/src/rmgr.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/rmgr/src/rmgr.c
index efa9c140484f..370ff3816dbe 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/rmgr/src/rmgr.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/rmgr/src/rmgr.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
@@ -44,7 +44,7 @@ enum ia_css_err ia_css_rmgr_init(void)
         return err;
 }
 
-/**
+/*
  * @brief Uninitialize resource pool (host)
  */
 void ia_css_rmgr_uninit(void)
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/rmgr/src/rmgr_vbuf.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/rmgr/src/rmgr_vbuf.c
index e56006c07ee8..54239ac9d7c9 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/rmgr/src/rmgr_vbuf.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/rmgr/src/rmgr_vbuf.c
@@ -20,13 +20,13 @@
 #include <memory_access.h>    /* mmmgr_malloc, mhmm_free */
 #include <ia_css_debug.h>
 
-/**
+/*
  * @brief VBUF resource handles
  */
 #define NUM_HANDLES 1000
 struct ia_css_rmgr_vbuf_handle handle_table[NUM_HANDLES];
 
-/**
+/*
  * @brief VBUF resource pool - refpool
  */
 struct ia_css_rmgr_vbuf_pool refpool = {
@@ -37,7 +37,7 @@ struct ia_css_rmgr_vbuf_pool refpool = {
         NULL,                   /* handles */
 };
 
-/**
+/*
  * @brief VBUF resource pool - writepool
  */
 struct ia_css_rmgr_vbuf_pool writepool = {
@@ -48,7 +48,7 @@ struct ia_css_rmgr_vbuf_pool writepool = {
         NULL,                   /* handles */
 };
 
-/**
+/*
  * @brief VBUF resource pool - hmmbufferpool
  */
 struct ia_css_rmgr_vbuf_pool hmmbufferpool = {
@@ -63,7 +63,7 @@ struct ia_css_rmgr_vbuf_pool *vbuf_ref = &refpool;
 struct ia_css_rmgr_vbuf_pool *vbuf_write = &writepool;
 struct ia_css_rmgr_vbuf_pool *hmm_buffer_pool = &hmmbufferpool;
 
-/**
+/*
  * @brief Initialize the reference count (host, vbuf)
  */
 static void rmgr_refcount_init_vbuf(void)
@@ -72,7 +72,7 @@ static void rmgr_refcount_init_vbuf(void)
         memset(&handle_table, 0, sizeof(handle_table));
 }
 
-/**
+/*
  * @brief Retain the reference count for a handle (host, vbuf)
  *
  * @param handle        The pointer to the handle
@@ -109,7 +109,7 @@ void ia_css_rmgr_refcount_retain_vbuf(struct ia_css_rmgr_vbuf_handle **handle)
         (*handle)->count++;
 }
 
-/**
+/*
  * @brief Release the reference count for a handle (host, vbuf)
  *
  * @param handle        The pointer to the handle
@@ -131,7 +131,7 @@ void ia_css_rmgr_refcount_release_vbuf(struct ia_css_rmgr_vbuf_handle **handle)
         }
 }
 
-/**
+/*
  * @brief Initialize the resource pool (host, vbuf)
  *
  * @param pool  The pointer to the pool
@@ -163,7 +163,7 @@ enum ia_css_err ia_css_rmgr_init_vbuf(struct ia_css_rmgr_vbuf_pool *pool)
         return err;
 }
 
-/**
+/*
  * @brief Uninitialize the resource pool (host, vbuf)
  *
  * @param pool  The pointer to the pool
@@ -197,7 +197,7 @@ void ia_css_rmgr_uninit_vbuf(struct ia_css_rmgr_vbuf_pool *pool)
         }
 }
 
-/**
+/*
  * @brief Push a handle to the pool
  *
  * @param pool          The pointer to the pool
@@ -224,7 +224,7 @@ void rmgr_push_handle(struct ia_css_rmgr_vbuf_pool *pool,
         assert(succes);
 }
 
-/**
+/*
  * @brief Pop a handle from the pool
  *
  * @param pool          The pointer to the pool
@@ -254,7 +254,7 @@ void rmgr_pop_handle(struct ia_css_rmgr_vbuf_pool *pool,
         }
 }
 
-/**
+/*
  * @brief Acquire a handle from the pool (host, vbuf)
  *
  * @param pool          The pointer to the pool
@@ -302,7 +302,7 @@ void ia_css_rmgr_acq_vbuf(struct ia_css_rmgr_vbuf_pool *pool,
         ia_css_rmgr_refcount_retain_vbuf(handle);
 }
 
-/**
+/*
  * @brief Release a handle to the pool (host, vbuf)
  *
  * @param pool          The pointer to the pool
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/spctrl/interface/ia_css_spctrl.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/spctrl/interface/ia_css_spctrl.h
index 27e9eb1e2102..bc4b1723369e 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/spctrl/interface/ia_css_spctrl.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/spctrl/interface/ia_css_spctrl.h
@@ -37,17 +37,17 @@ more details.
 
 
 typedef struct {
-        uint32_t        ddr_data_offset;       /**<  posistion of data in DDR */
-        uint32_t        dmem_data_addr;        /**< data segment address in dmem */
-        uint32_t        dmem_bss_addr;         /**< bss segment address in dmem  */
-        uint32_t        data_size;             /**< data segment size            */
-        uint32_t        bss_size;              /**< bss segment size             */
-        uint32_t        spctrl_config_dmem_addr; /** <location of dmem_cfg  in SP dmem */
-        uint32_t        spctrl_state_dmem_addr;  /** < location of state  in SP dmem */
-        unsigned int    sp_entry;                /** < entry function ptr on SP */
-        const void      *code;                   /**< location of firmware */
+        uint32_t        ddr_data_offset;       /**  posistion of data in DDR */
+        uint32_t        dmem_data_addr;        /** data segment address in dmem */
+        uint32_t        dmem_bss_addr;         /** bss segment address in dmem  */
+        uint32_t        data_size;             /** data segment size            */
+        uint32_t        bss_size;              /** bss segment size             */
+        uint32_t        spctrl_config_dmem_addr; /* <location of dmem_cfg  in SP dmem */
+        uint32_t        spctrl_state_dmem_addr;  /* < location of state  in SP dmem */
+        unsigned int    sp_entry;                /* < entry function ptr on SP */
+        const void      *code;                   /** location of firmware */
         uint32_t         code_size;
-        char      *program_name;    /**< not used on hardware, only for simulation */
+        char      *program_name;    /** not used on hardware, only for simulation */
 } ia_css_spctrl_cfg;
 
 /* Get the code addr in DDR of SP */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/spctrl/interface/ia_css_spctrl_comm.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/spctrl/interface/ia_css_spctrl_comm.h
index 3af2891efca7..2620d7514f79 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/spctrl/interface/ia_css_spctrl_comm.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/spctrl/interface/ia_css_spctrl_comm.h
@@ -41,16 +41,16 @@ typedef enum {
         IA_CSS_SP_SW_RUNNING
 } ia_css_spctrl_sp_sw_state;
 
-/** Structure to encapsulate required arguments for
+/* Structure to encapsulate required arguments for
  * initialization of SP DMEM using the SP itself
  */
 struct ia_css_sp_init_dmem_cfg {
-        ia_css_ptr      ddr_data_addr;  /**< data segment address in ddr  */
-        uint32_t        dmem_data_addr; /**< data segment address in dmem */
-        uint32_t        dmem_bss_addr;  /**< bss segment address in dmem  */
-        uint32_t        data_size;      /**< data segment size            */
-        uint32_t        bss_size;       /**< bss segment size             */
-        sp_ID_t         sp_id;          /** <sp Id */
+        ia_css_ptr      ddr_data_addr;  /** data segment address in ddr  */
+        uint32_t        dmem_data_addr; /** data segment address in dmem */
+        uint32_t        dmem_bss_addr;  /** bss segment address in dmem  */
+        uint32_t        data_size;      /** data segment size            */
+        uint32_t        bss_size;       /** bss segment size             */
+        sp_ID_t         sp_id;          /* <sp Id */
 };
 
 #define SIZE_OF_IA_CSS_SP_INIT_DMEM_CFG_STRUCT  \
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/spctrl/src/spctrl.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/spctrl/src/spctrl.c
index 6d9bceb60196..844e4d536cec 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/spctrl/src/spctrl.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/spctrl/src/spctrl.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
@@ -39,7 +39,7 @@ more details.
 
 struct spctrl_context_info {
         struct ia_css_sp_init_dmem_cfg dmem_config;
-        uint32_t        spctrl_config_dmem_addr; /** location of dmem_cfg  in SP dmem */
+        uint32_t        spctrl_config_dmem_addr; /* location of dmem_cfg  in SP dmem */
         uint32_t        spctrl_state_dmem_addr;
         unsigned int    sp_entry;           /* entry function ptr on SP */
         hrt_vaddress    code_addr;          /* sp firmware location in host mem-DDR*/
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/timer/src/timer.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/timer/src/timer.c
index 49c69e60ca5c..b7dd18492a91 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/timer/src/timer.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/runtime/timer/src/timer.c
@@ -13,7 +13,7 @@
  * more details.
  */
 #else
-/**
+/*
 Support for Intel Camera Imaging ISP subsystem.
 Copyright (c) 2010 - 2015, Intel Corporation.
 
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css.c
index f92b6a9f77eb..322bb3de6098 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css.c
@@ -176,7 +176,7 @@ static struct sh_css_hmm_buffer_record hmm_buffer_record[MAX_HMM_BUFFER_NUM];
 
 static bool fw_explicitly_loaded = false;
 
-/**
+/*
  * Local prototypes
  */
 
@@ -187,7 +187,7 @@ static enum ia_css_err
 sh_css_pipe_start(struct ia_css_stream *stream);
 
 #ifdef ISP2401
-/**
+/*
  * @brief Stop all "ia_css_pipe" instances in the target
  * "ia_css_stream" instance.
  *
@@ -207,7 +207,7 @@ sh_css_pipe_start(struct ia_css_stream *stream);
 static enum ia_css_err
 sh_css_pipes_stop(struct ia_css_stream *stream);
 
-/**
+/*
  * @brief Check if all "ia_css_pipe" instances in the target
  * "ia_css_stream" instance have stopped.
  *
@@ -1649,7 +1649,7 @@ ia_css_init(const struct ia_css_env *env,
         void (*flush_func)(struct ia_css_acc_fw *fw);
         hrt_data select, enable;
 
-        /**
+        /*
          * The C99 standard does not specify the exact object representation of structs;
          * the representation is compiler dependent.
          *
@@ -4617,23 +4617,23 @@ ia_css_pipe_dequeue_buffer(struct ia_css_pipe *pipe,
  * 4) "enum ia_css_event_type convert_event_sp_to_host_domain"  (sh_css.c)
  */
 static enum ia_css_event_type convert_event_sp_to_host_domain[] = {
-        IA_CSS_EVENT_TYPE_OUTPUT_FRAME_DONE,    /**< Output frame ready. */
-        IA_CSS_EVENT_TYPE_SECOND_OUTPUT_FRAME_DONE,     /**< Second output frame ready. */
-        IA_CSS_EVENT_TYPE_VF_OUTPUT_FRAME_DONE, /**< Viewfinder Output frame ready. */
-        IA_CSS_EVENT_TYPE_SECOND_VF_OUTPUT_FRAME_DONE,  /**< Second viewfinder Output frame ready. */
-        IA_CSS_EVENT_TYPE_3A_STATISTICS_DONE,   /**< Indication that 3A statistics are available. */
-        IA_CSS_EVENT_TYPE_DIS_STATISTICS_DONE,  /**< Indication that DIS statistics are available. */
-        IA_CSS_EVENT_TYPE_PIPELINE_DONE,        /**< Pipeline Done event, sent after last pipeline stage. */
-        IA_CSS_EVENT_TYPE_FRAME_TAGGED,         /**< Frame tagged. */
-        IA_CSS_EVENT_TYPE_INPUT_FRAME_DONE,     /**< Input frame ready. */
-        IA_CSS_EVENT_TYPE_METADATA_DONE,        /**< Metadata ready. */
-        IA_CSS_EVENT_TYPE_LACE_STATISTICS_DONE, /**< Indication that LACE statistics are available. */
-        IA_CSS_EVENT_TYPE_ACC_STAGE_COMPLETE,   /**< Extension stage executed. */
-        IA_CSS_EVENT_TYPE_TIMER,                /**< Timing measurement data. */
-        IA_CSS_EVENT_TYPE_PORT_EOF,             /**< End Of Frame event, sent when in buffered sensor mode. */
-        IA_CSS_EVENT_TYPE_FW_WARNING,           /**< Performance warning encountered by FW */
-        IA_CSS_EVENT_TYPE_FW_ASSERT,            /**< Assertion hit by FW */
-        0,                                      /** error if sp passes  SH_CSS_SP_EVENT_NR_OF_TYPES as a valid event. */
+        IA_CSS_EVENT_TYPE_OUTPUT_FRAME_DONE,    /** Output frame ready. */
+        IA_CSS_EVENT_TYPE_SECOND_OUTPUT_FRAME_DONE,     /** Second output frame ready. */
+        IA_CSS_EVENT_TYPE_VF_OUTPUT_FRAME_DONE, /** Viewfinder Output frame ready. */
+        IA_CSS_EVENT_TYPE_SECOND_VF_OUTPUT_FRAME_DONE,  /** Second viewfinder Output frame ready. */
+        IA_CSS_EVENT_TYPE_3A_STATISTICS_DONE,   /** Indication that 3A statistics are available. */
+        IA_CSS_EVENT_TYPE_DIS_STATISTICS_DONE,  /** Indication that DIS statistics are available. */
+        IA_CSS_EVENT_TYPE_PIPELINE_DONE,        /** Pipeline Done event, sent after last pipeline stage. */
+        IA_CSS_EVENT_TYPE_FRAME_TAGGED,         /** Frame tagged. */
+        IA_CSS_EVENT_TYPE_INPUT_FRAME_DONE,     /** Input frame ready. */
+        IA_CSS_EVENT_TYPE_METADATA_DONE,        /** Metadata ready. */
+        IA_CSS_EVENT_TYPE_LACE_STATISTICS_DONE, /** Indication that LACE statistics are available. */
+        IA_CSS_EVENT_TYPE_ACC_STAGE_COMPLETE,   /** Extension stage executed. */
+        IA_CSS_EVENT_TYPE_TIMER,                /** Timing measurement data. */
+        IA_CSS_EVENT_TYPE_PORT_EOF,             /** End Of Frame event, sent when in buffered sensor mode. */
+        IA_CSS_EVENT_TYPE_FW_WARNING,           /** Performance warning encountered by FW */
+        IA_CSS_EVENT_TYPE_FW_ASSERT,            /** Assertion hit by FW */
+        0,                                      /* error if sp passes  SH_CSS_SP_EVENT_NR_OF_TYPES as a valid event. */
 };
 
 enum ia_css_err
@@ -5028,7 +5028,7 @@ sh_css_enable_cont_capt(bool enable, bool stop_copy_preview)
 bool
 sh_css_continuous_is_enabled(uint8_t pipe_num)
 #else
-/**
+/*
  * @brief Stop all "ia_css_pipe" instances in the target
  * "ia_css_stream" instance.
  *
@@ -5107,7 +5107,7 @@ ia_css_stream_set_buffer_depth(struct ia_css_stream *stream, int buffer_depth)
         return IA_CSS_SUCCESS;
 }
 #else
-        /**
+        /*
          * Stop all "ia_css_pipe" instances in this target
          * "ia_css_stream" instance.
          */
@@ -5146,7 +5146,7 @@ ia_css_stream_get_buffer_depth(struct ia_css_stream *stream, int *buffer_depth)
                 }
         }
 
-        /**
+        /*
          * In the CSS firmware use scenario "Continuous Preview"
          * as well as "Continuous Video", the "ia_css_pipe" instance
          * "Copy Pipe" is activated. This "Copy Pipe" is private to
@@ -5183,7 +5183,7 @@ ERR:
         return err;
 }
 
-/**
+/*
  * @brief Check if all "ia_css_pipe" instances in the target
  * "ia_css_stream" instance have stopped.
  *
@@ -5218,7 +5218,7 @@ sh_css_pipes_have_stopped(struct ia_css_stream *stream)
         main_pipe_id = main_pipe->mode;
         IA_CSS_ENTER_PRIVATE("main_pipe_id=%d", main_pipe_id);
 
-        /**
+        /*
          * Check if every "ia_css_pipe" instance in this target
          * "ia_css_stream" instance has stopped.
          */
@@ -5229,7 +5229,7 @@ sh_css_pipes_have_stopped(struct ia_css_stream *stream)
                                 rval);
         }
 
-        /**
+        /*
          * In the CSS firmware use scenario "Continuous Preview"
          * as well as "Continuous Video", the "ia_css_pipe" instance
          * "Copy Pipe" is activated. This "Copy Pipe" is private to
@@ -5474,7 +5474,7 @@ ERR:
 }
 
 #ifdef ISP2401
-/**
+/*
  * @brief Check if a format is supported by the pipe.
  *
  */
@@ -8626,7 +8626,7 @@ sh_css_pipeline_add_acc_stage(struct ia_css_pipeline *pipeline,
         return err;
 }
 
-/**
+/*
  * @brief Tag a specific frame in continuous capture.
  * Refer to "sh_css_internal.h" for details.
  */
@@ -8666,7 +8666,7 @@ enum ia_css_err ia_css_stream_capture_frame(struct ia_css_stream *stream,
         return err;
 }
 
-/**
+/*
  * @brief Configure the continuous capture.
  * Refer to "sh_css_internal.h" for details.
  */
@@ -8822,7 +8822,7 @@ sh_css_init_host_sp_control_vars(void)
                 "sh_css_init_host_sp_control_vars() leave: return_void\n");
 }
 
-/**
+/*
  * create the internal structures and fill in the configuration data
  */
 void ia_css_pipe_config_defaults(struct ia_css_pipe_config *pipe_config)
@@ -10435,7 +10435,7 @@ ia_css_start_sp(void)
         return err;
 }
 
-/**
+/*
  *      Time to wait SP for termincate. Only condition when this can happen
  *      is a fatal hw failure, but we must be able to detect this and emit
  *      a proper error trace.
@@ -10713,7 +10713,7 @@ ia_css_unlock_raw_frame(struct ia_css_stream *stream, uint32_t exp_id)
         return ret;
 }
 
-/** @brief      Set the state (Enable or Disable) of the Extension stage in the
+/* @brief       Set the state (Enable or Disable) of the Extension stage in the
  *              given pipe.
  */
 enum ia_css_err
@@ -10758,7 +10758,7 @@ ia_css_pipe_set_qos_ext_state(struct ia_css_pipe *pipe, uint32_t fw_handle, bool
         return err;
 }
 
-/**     @brief  Get the state (Enable or Disable) of the Extension stage in the
+/*      @brief  Get the state (Enable or Disable) of the Extension stage in the
  *      given pipe.
  */
 enum ia_css_err
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_internal.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_internal.h
index 0910021286a4..161122e1bcbc 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_internal.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_internal.h
@@ -188,7 +188,7 @@ enum host2sp_commands {
         N_host2sp_cmd
 };
 
-/** Enumeration used to indicate the events that are produced by
+/* Enumeration used to indicate the events that are produced by
  *  the SP and consumed by the Host.
  *
  * !!!IMPORTANT!!! KEEP THE FOLLOWING IN SYNC:
@@ -274,10 +274,10 @@ struct sh_css_ddr_address_map_compound {
 };
 
 struct ia_css_isp_parameter_set_info {
-        struct sh_css_ddr_address_map  mem_map;/**< pointers to Parameters in ISP format IMPT:
+        struct sh_css_ddr_address_map  mem_map;/** pointers to Parameters in ISP format IMPT:
                                                     This should be first member of this struct */
-        uint32_t                       isp_parameters_id;/**< Unique ID to track which config was actually applied to a particular frame */
-        ia_css_ptr                     output_frame_ptr;/**< Output frame to which this config has to be applied (optional) */
+        uint32_t                       isp_parameters_id;/** Unique ID to track which config was actually applied to a particular frame */
+        ia_css_ptr                     output_frame_ptr;/** Output frame to which this config has to be applied (optional) */
 };
 
 /* this struct contains all arguments that can be passed to
@@ -398,9 +398,9 @@ struct sh_css_sp_input_formatter_set {
 /* SP configuration information */
 struct sh_css_sp_config {
         uint8_t                 no_isp_sync; /* Signal host immediately after start */
-        uint8_t                 enable_raw_pool_locking; /**< Enable Raw Buffer Locking for HALv3 Support */
+        uint8_t                 enable_raw_pool_locking; /** Enable Raw Buffer Locking for HALv3 Support */
         uint8_t                 lock_all;
-        /**< If raw buffer locking is enabled, this flag indicates whether raw
+        /** If raw buffer locking is enabled, this flag indicates whether raw
              frames are locked when their EOF event is successfully sent to the
              host (true) or when they are passed to the preview/video pipe
              (false). */
@@ -458,13 +458,13 @@ struct sh_css_sp_pipeline_io {
         /*struct sh_css_sp_pipeline_terminal    output;*/
 };
 
-/** This struct tracks how many streams are registered per CSI port.
+/* This struct tracks how many streams are registered per CSI port.
  * This is used to track which streams have already been configured.
  * Only when all streams are configured, the CSI RX is started for that port.
  */
 struct sh_css_sp_pipeline_io_status {
-        uint32_t        active[N_INPUT_SYSTEM_CSI_PORT];        /**< registered streams */
-        uint32_t        running[N_INPUT_SYSTEM_CSI_PORT];       /**< configured streams */
+        uint32_t        active[N_INPUT_SYSTEM_CSI_PORT];        /** registered streams */
+        uint32_t        running[N_INPUT_SYSTEM_CSI_PORT];       /** configured streams */
 };
 
 #endif
@@ -500,7 +500,7 @@ enum sh_css_port_type {
 #define SH_CSS_METADATA_OFFLINE_MODE   0x04
 #define SH_CSS_METADATA_WAIT_INPUT     0x08
 
-/** @brief Free an array of metadata buffers.
+/* @brief Free an array of metadata buffers.
  *
  * @param[in]   num_bufs        Number of metadata buffers to be freed.
  * @param[in]   bufs            Pointer of array of metadata buffers.
@@ -764,7 +764,7 @@ struct sh_css_hmm_buffer {
                         hrt_vaddress    frame_data;
                         uint32_t        flashed;
                         uint32_t        exp_id;
-                        uint32_t        isp_parameters_id; /**< Unique ID to track which config was
+                        uint32_t        isp_parameters_id; /** Unique ID to track which config was
                                                                 actually applied to a particular frame */
 #if CONFIG_ON_FRAME_ENQUEUE()
                         struct sh_css_config_on_frame_enqueue config_on_frame_enqueue;
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_legacy.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_legacy.h
index e12789236bb9..4bcc35d219f8 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_legacy.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_legacy.h
@@ -22,7 +22,7 @@
 #include <ia_css_pipe_public.h>
 #include <ia_css_stream_public.h>
 
-/** The pipe id type, distinguishes the kind of pipes that
+/* The pipe id type, distinguishes the kind of pipes that
  *  can be run in parallel.
  */
 enum ia_css_pipe_id {
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_mipi.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_mipi.c
index 36aaa3019a15..883474e90c81 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_mipi.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_mipi.c
@@ -321,7 +321,7 @@ calculate_mipi_buff_size(
         height = stream_cfg->input_config.input_res.height;
         format = stream_cfg->input_config.format;
         pack_raw_pixels = stream_cfg->pack_raw_pixels;
-        /** end of NOTE */
+        /* end of NOTE */
 
         /**
 #ifndef ISP2401
@@ -341,7 +341,7 @@ calculate_mipi_buff_size(
          * in the non-continuous use scenario.
          */
         width_padded = width + (2 * ISP_VEC_NELEMS);
-        /** end of NOTE */
+        /* end of NOTE */
 
         IA_CSS_ENTER("padded_width=%d, height=%d, format=%d\n",
                      width_padded, height, format);
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_params.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_params.h
index a7ffe6d8331b..270ec2b60a3e 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_params.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_params.h
@@ -144,8 +144,8 @@ struct ia_css_isp_parameters {
         struct sh_css_ddr_address_map_size pipe_ddr_ptrs_size[IA_CSS_PIPE_ID_NUM];
         struct sh_css_ddr_address_map ddr_ptrs;
         struct sh_css_ddr_address_map_size ddr_ptrs_size;
-        struct ia_css_frame *output_frame; /**< Output frame the config is to be applied to (optional) */
-        uint32_t isp_parameters_id; /**< Unique ID to track which config was actually applied to a particular frame */
+        struct ia_css_frame *output_frame; /** Output frame the config is to be applied to (optional) */
+        uint32_t isp_parameters_id; /** Unique ID to track which config was actually applied to a particular frame */
 };
 
 void
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_sp.c b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_sp.c
index e6a345979ff1..6fc00fc402b1 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_sp.c
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_sp.c
@@ -261,7 +261,7 @@ sh_css_sp_start_raw_copy(struct ia_css_frame *out_frame,
         assert(out_frame != NULL);
 
         {
-                /**
+                /*
                  * Clear sh_css_sp_stage for easy debugging.
                  * program_input_circuit must be saved as it is set outside
                  * this function.
@@ -335,7 +335,7 @@ sh_css_sp_start_isys_copy(struct ia_css_frame *out_frame,
         assert(out_frame != NULL);
 
         {
-                /**
+                /*
                  * Clear sh_css_sp_stage for easy debugging.
                  * program_input_circuit must be saved as it is set outside
                  * this function.
@@ -909,7 +909,7 @@ sh_css_sp_init_stage(struct ia_css_binary *binary,
         xinfo = binary->info;
         info  = &xinfo->sp;
         {
-                /**
+                /*
                  * Clear sh_css_sp_stage for easy debugging.
                  * program_input_circuit must be saved as it is set outside
                  * this function.
@@ -980,7 +980,7 @@ sh_css_sp_init_stage(struct ia_css_binary *binary,
         sh_css_isp_stage.binary_name[SH_CSS_MAX_BINARY_NAME - 1] = 0;
         sh_css_isp_stage.mem_initializers = *isp_mem_if;
 
-        /**
+        /*
          * Even when a stage does not need uds and does not params,
          * ia_css_uds_sp_scale_params() seems to be called (needs
          * further investigation). This function can not deal with
@@ -1429,7 +1429,7 @@ sh_css_init_host2sp_frame_data(void)
 }
 
 
-/**
+/*
  * @brief Update the offline frame information in host_sp_communication.
  * Refer to "sh_css_sp.h" for more details.
  */
@@ -1461,7 +1461,7 @@ sh_css_update_host2sp_offline_frame(
 }
 
 #if defined(USE_INPUT_SYSTEM_VERSION_2) || defined(USE_INPUT_SYSTEM_VERSION_2401)
-/**
+/*
  * @brief Update the mipi frame information in host_sp_communication.
  * Refer to "sh_css_sp.h" for more details.
  */
@@ -1488,7 +1488,7 @@ sh_css_update_host2sp_mipi_frame(
                                 frame ? frame->data : 0);
 }
 
-/**
+/*
  * @brief Update the mipi metadata information in host_sp_communication.
  * Refer to "sh_css_sp.h" for more details.
  */
@@ -1735,7 +1735,7 @@ ia_css_isp_has_started(void)
 }
 
 
-/**
+/*
  * @brief Initialize the DMA software-mask in the debug mode.
  * Refer to "sh_css_sp.h" for more details.
  */
@@ -1761,7 +1761,7 @@ sh_css_sp_init_dma_sw_reg(int dma_id)
         return true;
 }
 
-/**
+/*
  * @brief Set the DMA software-mask in the debug mode.
  * Refer to "sh_css_sp.h" for more details.
  */
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_struct.h b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_struct.h
index e49e478ab354..0b8e3d872069 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_struct.h
+++ b/drivers/staging/media/atomisp/pci/atomisp2/css2400/sh_css_struct.h
@@ -61,7 +61,7 @@ struct sh_css {
 #endif
         hrt_vaddress                   sp_bin_addr;
         hrt_data                       page_table_base_index;
-        unsigned int                   size_mem_words; /** \deprecated{Use ia_css_mipi_buffer_config instead.}*/
+        unsigned int                   size_mem_words; /* \deprecated{Use ia_css_mipi_buffer_config instead.}*/
         enum ia_css_irq_type           irq_type;
         unsigned int                   pipe_counter;
         
diff --git a/drivers/staging/octeon-usb/octeon-hcd.c b/drivers/staging/octeon-usb/octeon-hcd.c
index 068aece25d37..cded30f145aa 100644
--- a/drivers/staging/octeon-usb/octeon-hcd.c
+++ b/drivers/staging/octeon-usb/octeon-hcd.c
@@ -394,7 +394,7 @@ struct octeon_hcd {
                                 result = -1;                                \
                                 break;                                      \
                         } else                                              \
-                                cvmx_wait(100);                             \
+                                __delay(100);                               \
                 }                                                           \
         } while (0);                                                        \
         result; })
@@ -774,7 +774,7 @@ retry:
         usbn_clk_ctl.s.hclk_rst = 1;
         cvmx_write64_uint64(CVMX_USBNX_CLK_CTL(usb->index), usbn_clk_ctl.u64);
         /* 2e.  Wait 64 core-clock cycles for HCLK to stabilize */
-        cvmx_wait(64);
+        __delay(64);
         /*
          * 3. Program the power-on reset field in the USBN clock-control
          *    register:
@@ -795,7 +795,7 @@ retry:
         cvmx_write64_uint64(CVMX_USBNX_USBP_CTL_STATUS(usb->index),
                             usbn_usbp_ctl_status.u64);
         /* 6. Wait 10 cycles */
-        cvmx_wait(10);
+        __delay(10);
         /*
          * 7. Clear ATE_RESET field in the USBN clock-control register:
          *    USBN_USBP_CTL_STATUS[ATE_RESET] = 0
diff --git a/drivers/staging/pi433/rf69.c b/drivers/staging/pi433/rf69.c
index e69a2153c999..12c9df9cddde 100644
--- a/drivers/staging/pi433/rf69.c
+++ b/drivers/staging/pi433/rf69.c
@@ -102,7 +102,7 @@ enum modulation rf69_get_modulation(struct spi_device *spi)
 
         currentValue = READ_REG(REG_DATAMODUL);
 
-        switch (currentValue & MASK_DATAMODUL_MODULATION_TYPE >> 3) { // TODO improvement: change 3 to define
+        switch (currentValue & MASK_DATAMODUL_MODULATION_TYPE) {
         case DATAMODUL_MODULATION_TYPE_OOK: return OOK;
         case DATAMODUL_MODULATION_TYPE_FSK: return FSK;
         default:                            return undefined;
diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
index c0664dc80bf2..446310775e90 100644
--- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
@@ -1395,19 +1395,13 @@ static int rtw_wx_get_essid(struct net_device *dev,
         if ((check_fwstate(pmlmepriv, _FW_LINKED)) ||
             (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE))) {
                 len = pcur_bss->Ssid.SsidLength;
-
-                wrqu->essid.length = len;
-
                 memcpy(extra, pcur_bss->Ssid.Ssid, len);
-
-                wrqu->essid.flags = 1;
         } else {
-                ret = -1;
-                goto exit;
+                len = 0;
+                *extra = 0;
         }
-
-exit:
-
+        wrqu->essid.length = len;
+        wrqu->essid.flags = 1;
 
         return ret;
 }
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 7c69b4a9694d..0d99b242e82e 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -920,7 +920,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                                         " %d i: %d bio: %p, allocating another"
                                         " bio\n", bio->bi_vcnt, i, bio);
 
-                                rc = blk_rq_append_bio(req, bio);
+                                rc = blk_rq_append_bio(req, &bio);
                                 if (rc) {
                                         pr_err("pSCSI: failed to append bio\n");
                                         goto fail;
@@ -938,7 +938,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
         }
 
         if (bio) {
-                rc = blk_rq_append_bio(req, bio);
+                rc = blk_rq_append_bio(req, &bio);
                 if (rc) {
                         pr_err("pSCSI: failed to append bio\n");
                         goto fail;
diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
index 7952357df9c8..edb6e4e9ef3a 100644
--- a/drivers/tee/optee/core.c
+++ b/drivers/tee/optee/core.c
@@ -590,7 +590,6 @@ static int __init optee_driver_init(void)
                 return -ENODEV;
 
         np = of_find_matching_node(fw_np, optee_match);
-        of_node_put(fw_np);
         if (!np)
                 return -ENODEV;
 
diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c
index 419a7a90bce0..f45bcbc63738 100644
--- a/drivers/thunderbolt/nhi.c
+++ b/drivers/thunderbolt/nhi.c
@@ -339,7 +339,7 @@ static void __ring_interrupt(struct tb_ring *ring)
                 return;
 
         if (ring->start_poll) {
-                __ring_interrupt_mask(ring, false);
+                __ring_interrupt_mask(ring, true);
                 ring->start_poll(ring->poll_data);
         } else {
                 schedule_work(&ring->work);
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 427e0d5d8f13..539b49adb6af 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -1762,7 +1762,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 {
         struct n_tty_data *ldata = tty->disc_data;
 
-        if (!old || (old->c_lflag ^ tty->termios.c_lflag) & ICANON) {
+        if (!old || (old->c_lflag ^ tty->termios.c_lflag) & (ICANON | EXTPROC)) {
                 bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
                 ldata->line_start = ldata->read_tail;
                 if (!L_ICANON(tty) || !read_cnt(ldata)) {
@@ -2425,7 +2425,7 @@ static int n_tty_ioctl(struct tty_struct *tty, struct file *file,
                 return put_user(tty_chars_in_buffer(tty), (int __user *) arg);
         case TIOCINQ:
                 down_write(&tty->termios_rwsem);
-                if (L_ICANON(tty))
+                if (L_ICANON(tty) && !L_EXTPROC(tty))
                         retval = inq_canon(ldata);
                 else
                         retval = read_cnt(ldata);
diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c
index ce7ad0acee7a..247788a16f0b 100644
--- a/drivers/tty/serdev/serdev-ttyport.c
+++ b/drivers/tty/serdev/serdev-ttyport.c
@@ -27,23 +27,41 @@ static int ttyport_receive_buf(struct tty_port *port, const unsigned char *cp,
 {
         struct serdev_controller *ctrl = port->client_data;
         struct serport *serport = serdev_controller_get_drvdata(ctrl);
+        int ret;
 
         if (!test_bit(SERPORT_ACTIVE, &serport->flags))
                 return 0;
 
-        return serdev_controller_receive_buf(ctrl, cp, count);
+        ret = serdev_controller_receive_buf(ctrl, cp, count);
+
+        dev_WARN_ONCE(&ctrl->dev, ret < 0 || ret > count,
+                                "receive_buf returns %d (count = %zu)\n",
+                                ret, count);
+        if (ret < 0)
+                return 0;
+        else if (ret > count)
+                return count;
+
+        return ret;
 }
 
 static void ttyport_write_wakeup(struct tty_port *port)
 {
         struct serdev_controller *ctrl = port->client_data;
         struct serport *serport = serdev_controller_get_drvdata(ctrl);
+        struct tty_struct *tty;
+
+        tty = tty_port_tty_get(port);
+        if (!tty)
+                return;
 
-        if (test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &port->tty->flags) &&
+        if (test_and_clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) &&
             test_bit(SERPORT_ACTIVE, &serport->flags))
                 serdev_controller_write_wakeup(ctrl);
 
-        wake_up_interruptible_poll(&port->tty->write_wait, POLLOUT);
+        wake_up_interruptible_poll(&tty->write_wait, POLLOUT);
+
+        tty_kref_put(tty);
 }
 
 static const struct tty_port_client_operations client_ops = {
@@ -136,8 +154,10 @@ static void ttyport_close(struct serdev_controller *ctrl)
 
         clear_bit(SERPORT_ACTIVE, &serport->flags);
 
+        tty_lock(tty);
         if (tty->ops->close)
                 tty->ops->close(tty, NULL);
+        tty_unlock(tty);
 
         tty_release_struct(tty, serport->tty_idx);
 }
diff --git a/drivers/tty/serial/8250/8250_early.c b/drivers/tty/serial/8250/8250_early.c
index 362c25ff188a..ae6a256524d8 100644
--- a/drivers/tty/serial/8250/8250_early.c
+++ b/drivers/tty/serial/8250/8250_early.c
@@ -122,12 +122,14 @@ static void __init init_port(struct earlycon_device *device)
         serial8250_early_out(port, UART_FCR, 0);        /* no fifo */
         serial8250_early_out(port, UART_MCR, 0x3);      /* DTR + RTS */
 
-        divisor = DIV_ROUND_CLOSEST(port->uartclk, 16 * device->baud);
-        c = serial8250_early_in(port, UART_LCR);
-        serial8250_early_out(port, UART_LCR, c | UART_LCR_DLAB);
-        serial8250_early_out(port, UART_DLL, divisor & 0xff);
-        serial8250_early_out(port, UART_DLM, (divisor >> 8) & 0xff);
-        serial8250_early_out(port, UART_LCR, c & ~UART_LCR_DLAB);
+        if (port->uartclk && device->baud) {
+                divisor = DIV_ROUND_CLOSEST(port->uartclk, 16 * device->baud);
+                c = serial8250_early_in(port, UART_LCR);
+                serial8250_early_out(port, UART_LCR, c | UART_LCR_DLAB);
+                serial8250_early_out(port, UART_DLL, divisor & 0xff);
+                serial8250_early_out(port, UART_DLM, (divisor >> 8) & 0xff);
+                serial8250_early_out(port, UART_LCR, c & ~UART_LCR_DLAB);
+        }
 }
 
 int __init early_serial8250_setup(struct earlycon_device *device,
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index b7e0e3416641..54adf8d56350 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -5135,6 +5135,9 @@ static const struct pci_device_id serial_pci_tbl[] = {
         { PCI_DEVICE(0x1601, 0x0800), .driver_data = pbn_b0_4_1250000 },
         { PCI_DEVICE(0x1601, 0xa801), .driver_data = pbn_b0_4_1250000 },
 
+        /* Amazon PCI serial device */
+        { PCI_DEVICE(0x1d0f, 0x8250), .driver_data = pbn_b0_1_115200 },
+
         /*
          * These entries match devices with class COMMUNICATION_SERIAL,
          * COMMUNICATION_MODEM or COMMUNICATION_MULTISERIAL
diff --git a/drivers/usb/chipidea/ci_hdrc_msm.c b/drivers/usb/chipidea/ci_hdrc_msm.c
index 3593ce0ec641..880009987460 100644
--- a/drivers/usb/chipidea/ci_hdrc_msm.c
+++ b/drivers/usb/chipidea/ci_hdrc_msm.c
@@ -247,7 +247,7 @@ static int ci_hdrc_msm_probe(struct platform_device *pdev)
         if (ret)
                 goto err_mux;
 
-        ulpi_node = of_find_node_by_name(of_node_get(pdev->dev.of_node), "ulpi");
+        ulpi_node = of_get_child_by_name(pdev->dev.of_node, "ulpi");
         if (ulpi_node) {
                 phy_node = of_get_next_available_child(ulpi_node, NULL);
                 ci->hsic = of_device_is_compatible(phy_node, "qcom,usb-hsic-phy");
diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c
index 8b351444cc40..9a2ab6751a23 100644
--- a/drivers/usb/common/ulpi.c
+++ b/drivers/usb/common/ulpi.c
@@ -180,9 +180,9 @@ static int ulpi_of_register(struct ulpi *ulpi)
         /* Find a ulpi bus underneath the parent or the grandparent */
         parent = ulpi->dev.parent;
         if (parent->of_node)
-                np = of_find_node_by_name(parent->of_node, "ulpi");
+                np = of_get_child_by_name(parent->of_node, "ulpi");
         else if (parent->parent && parent->parent->of_node)
-                np = of_find_node_by_name(parent->parent->of_node, "ulpi");
+                np = of_get_child_by_name(parent->parent->of_node, "ulpi");
         if (!np)
                 return 0;
 
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index da8acd980fc6..c821b4b9647e 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -555,6 +555,9 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
         unsigned iad_num = 0;
 
         memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
+        nintf = nintf_orig = config->desc.bNumInterfaces;
+        config->desc.bNumInterfaces = 0;        // Adjusted later
+
         if (config->desc.bDescriptorType != USB_DT_CONFIG ||
             config->desc.bLength < USB_DT_CONFIG_SIZE ||
             config->desc.bLength > size) {
@@ -568,7 +571,6 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
         buffer += config->desc.bLength;
         size -= config->desc.bLength;
 
-        nintf = nintf_orig = config->desc.bNumInterfaces;
         if (nintf > USB_MAXINTERFACES) {
                 dev_warn(ddev, "config %d has too many interfaces: %d, "
                     "using maximum allowed: %d\n",
@@ -905,14 +907,25 @@ void usb_release_bos_descriptor(struct usb_device *dev)
         }
 }
 
+static const __u8 bos_desc_len[256] = {
+        [USB_CAP_TYPE_WIRELESS_USB] = USB_DT_USB_WIRELESS_CAP_SIZE,
+        [USB_CAP_TYPE_EXT]          = USB_DT_USB_EXT_CAP_SIZE,
+        [USB_SS_CAP_TYPE]           = USB_DT_USB_SS_CAP_SIZE,
+        [USB_SSP_CAP_TYPE]          = USB_DT_USB_SSP_CAP_SIZE(1),
+        [CONTAINER_ID_TYPE]         = USB_DT_USB_SS_CONTN_ID_SIZE,
+        [USB_PTM_CAP_TYPE]          = USB_DT_USB_PTM_ID_SIZE,
+};
+
 /* Get BOS descriptor set */
 int usb_get_bos_descriptor(struct usb_device *dev)
 {
         struct device *ddev = &dev->dev;
         struct usb_bos_descriptor *bos;
         struct usb_dev_cap_header *cap;
+        struct usb_ssp_cap_descriptor *ssp_cap;
         unsigned char *buffer;
-        int length, total_len, num, i;
+        int length, total_len, num, i, ssac;
+        __u8 cap_type;
         int ret;
 
         bos = kzalloc(sizeof(struct usb_bos_descriptor), GFP_KERNEL);
@@ -965,7 +978,13 @@ int usb_get_bos_descriptor(struct usb_device *dev)
                         dev->bos->desc->bNumDeviceCaps = i;
                         break;
                 }
+                cap_type = cap->bDevCapabilityType;
                 length = cap->bLength;
+                if (bos_desc_len[cap_type] && length < bos_desc_len[cap_type]) {
+                        dev->bos->desc->bNumDeviceCaps = i;
+                        break;
+                }
+
                 total_len -= length;
 
                 if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
@@ -973,7 +992,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
                         continue;
                 }
 
-                switch (cap->bDevCapabilityType) {
+                switch (cap_type) {
                 case USB_CAP_TYPE_WIRELESS_USB:
                         /* Wireless USB cap descriptor is handled by wusb */
                         break;
@@ -986,8 +1005,11 @@ int usb_get_bos_descriptor(struct usb_device *dev)
                                 (struct usb_ss_cap_descriptor *)buffer;
                         break;
                 case USB_SSP_CAP_TYPE:
-                        dev->bos->ssp_cap =
-                                (struct usb_ssp_cap_descriptor *)buffer;
+                        ssp_cap = (struct usb_ssp_cap_descriptor *)buffer;
+                        ssac = (le32_to_cpu(ssp_cap->bmAttributes) &
+                                USB_SSP_SUBLINK_SPEED_ATTRIBS);
+                        if (length >= USB_DT_USB_SSP_CAP_SIZE(ssac))
+                                dev->bos->ssp_cap = ssp_cap;
                         break;
                 case CONTAINER_ID_TYPE:
                         dev->bos->ss_id =
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 705c573d0257..a3fad4ec9870 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1442,14 +1442,18 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
         int number_of_packets = 0;
         unsigned int stream_id = 0;
         void *buf;
-
-        if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP |
-                                USBDEVFS_URB_SHORT_NOT_OK |
+        unsigned long mask =    USBDEVFS_URB_SHORT_NOT_OK |
                                 USBDEVFS_URB_BULK_CONTINUATION |
                                 USBDEVFS_URB_NO_FSBR |
                                 USBDEVFS_URB_ZERO_PACKET |
-                                USBDEVFS_URB_NO_INTERRUPT))
-                return -EINVAL;
+                                USBDEVFS_URB_NO_INTERRUPT;
+        /* USBDEVFS_URB_ISO_ASAP is a special case */
+        if (uurb->type == USBDEVFS_URB_TYPE_ISO)
+                mask |= USBDEVFS_URB_ISO_ASAP;
+
+        if (uurb->flags & ~mask)
+                        return -EINVAL;
+
         if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)
                 return -EINVAL;
         if (uurb->buffer_length > 0 && !uurb->buffer)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 7ccdd3d4db84..cf7bbcb9a63c 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4948,6 +4948,15 @@ loop:
                 usb_put_dev(udev);
                 if ((status == -ENOTCONN) || (status == -ENOTSUPP))
                         break;
+
+                /* When halfway through our retry count, power-cycle the port */
+                if (i == (SET_CONFIG_TRIES / 2) - 1) {
+                        dev_info(&port_dev->dev, "attempt power cycle\n");
+                        usb_hub_set_port_power(hdev, hub, port1, false);
+                        msleep(2 * hub_power_on_good_delay(hub));
+                        usb_hub_set_port_power(hdev, hub, port1, true);
+                        msleep(hub_power_on_good_delay(hub));
+                }
         }
         if (hub->hdev->parent ||
                         !hcd->driver->port_handed_over ||
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index f1dbab6f798f..4024926c1d68 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -52,10 +52,11 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Microsoft LifeCam-VX700 v2.0 */
         { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
 
-        /* Logitech HD Pro Webcams C920, C920-C and C930e */
+        /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
         { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
         { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
         { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
+        { USB_DEVICE(0x046d, 0x085b), .driver_info = USB_QUIRK_DELAY_INIT },
 
         /* Logitech ConferenceCam CC3000e */
         { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },
@@ -146,6 +147,12 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* appletouch */
         { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Genesys Logic hub, internally used by KY-688 USB 3.1 Type-C Hub */
+        { USB_DEVICE(0x05e3, 0x0612), .driver_info = USB_QUIRK_NO_LPM },
+
+        /* ELSA MicroLink 56K */
+        { USB_DEVICE(0x05cc, 0x2267), .driver_info = USB_QUIRK_RESET_RESUME },
+
         /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */
         { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM },
 
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index f66c94130cac..31749c79045f 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -537,6 +537,7 @@ struct dwc2_core_params {
  *                       2 - Internal DMA
  * @power_optimized     Are power optimizations enabled?
  * @num_dev_ep          Number of device endpoints available
+ * @num_dev_in_eps      Number of device IN endpoints available
  * @num_dev_perio_in_ep Number of device periodic IN endpoints
  *                      available
  * @dev_token_q_depth   Device Mode IN Token Sequence Learning Queue
@@ -565,6 +566,7 @@ struct dwc2_core_params {
  *                       2 - 8 or 16 bits
  * @snpsid:             Value from SNPSID register
  * @dev_ep_dirs:        Direction of device endpoints (GHWCFG1)
+ * @g_tx_fifo_size[]    Power-on values of TxFIFO sizes
  */
 struct dwc2_hw_params {
         unsigned op_mode:3;
@@ -586,12 +588,14 @@ struct dwc2_hw_params {
         unsigned fs_phy_type:2;
         unsigned i2c_enable:1;
         unsigned num_dev_ep:4;
+        unsigned num_dev_in_eps : 4;
         unsigned num_dev_perio_in_ep:4;
         unsigned total_fifo_size:16;
         unsigned power_optimized:1;
         unsigned utmi_phy_data_width:2;
         u32 snpsid;
         u32 dev_ep_dirs;
+        u32 g_tx_fifo_size[MAX_EPS_CHANNELS];
 };
 
 /* Size of control and EP0 buffers */
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 88529d092503..e4c3ce0de5de 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -195,55 +195,18 @@ int dwc2_hsotg_tx_fifo_count(struct dwc2_hsotg *hsotg)
 {
         if (hsotg->hw_params.en_multiple_tx_fifo)
                 /* In dedicated FIFO mode we need count of IN EPs */
-                return (dwc2_readl(hsotg->regs + GHWCFG4)  &
-                        GHWCFG4_NUM_IN_EPS_MASK) >> GHWCFG4_NUM_IN_EPS_SHIFT;
+                return hsotg->hw_params.num_dev_in_eps;
         else
                 /* In shared FIFO mode we need count of Periodic IN EPs */
                 return hsotg->hw_params.num_dev_perio_in_ep;
 }
 
 /**
- * dwc2_hsotg_ep_info_size - return Endpoint Info Control block size in DWORDs
- */
-static int dwc2_hsotg_ep_info_size(struct dwc2_hsotg *hsotg)
-{
-        int val = 0;
-        int i;
-        u32 ep_dirs;
-
-        /*
-         * Don't need additional space for ep info control registers in
-         * slave mode.
-         */
-        if (!using_dma(hsotg)) {
-                dev_dbg(hsotg->dev, "Buffer DMA ep info size 0\n");
-                return 0;
-        }
-
-        /*
-         * Buffer DMA mode - 1 location per endpoit
-         * Descriptor DMA mode - 4 locations per endpoint
-         */
-        ep_dirs = hsotg->hw_params.dev_ep_dirs;
-
-        for (i = 0; i <= hsotg->hw_params.num_dev_ep; i++) {
-                val += ep_dirs & 3 ? 1 : 2;
-                ep_dirs >>= 2;
-        }
-
-        if (using_desc_dma(hsotg))
-                val = val * 4;
-
-        return val;
-}
-
-/**
  * dwc2_hsotg_tx_fifo_total_depth - return total FIFO depth available for
  * device mode TX FIFOs
  */
 int dwc2_hsotg_tx_fifo_total_depth(struct dwc2_hsotg *hsotg)
 {
-        int ep_info_size;
         int addr;
         int tx_addr_max;
         u32 np_tx_fifo_size;
@@ -252,8 +215,7 @@ int dwc2_hsotg_tx_fifo_total_depth(struct dwc2_hsotg *hsotg)
                                 hsotg->params.g_np_tx_fifo_size);
 
         /* Get Endpoint Info Control block size in DWORDs. */
-        ep_info_size = dwc2_hsotg_ep_info_size(hsotg);
-        tx_addr_max = hsotg->hw_params.total_fifo_size - ep_info_size;
+        tx_addr_max = hsotg->hw_params.total_fifo_size;
 
         addr = hsotg->params.g_rx_fifo_size + np_tx_fifo_size;
         if (tx_addr_max <= addr)
diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
index ef73af6e03a9..03fd20f0b496 100644
--- a/drivers/usb/dwc2/params.c
+++ b/drivers/usb/dwc2/params.c
@@ -484,8 +484,7 @@ static void dwc2_check_param_tx_fifo_sizes(struct dwc2_hsotg *hsotg)
         }
 
         for (fifo = 1; fifo <= fifo_count; fifo++) {
-                dptxfszn = (dwc2_readl(hsotg->regs + DPTXFSIZN(fifo)) &
-                        FIFOSIZE_DEPTH_MASK) >> FIFOSIZE_DEPTH_SHIFT;
+                dptxfszn = hsotg->hw_params.g_tx_fifo_size[fifo];
 
                 if (hsotg->params.g_tx_fifo_size[fifo] < min ||
                     hsotg->params.g_tx_fifo_size[fifo] >  dptxfszn) {
@@ -609,6 +608,7 @@ static void dwc2_get_dev_hwparams(struct dwc2_hsotg *hsotg)
         struct dwc2_hw_params *hw = &hsotg->hw_params;
         bool forced;
         u32 gnptxfsiz;
+        int fifo, fifo_count;
 
         if (hsotg->dr_mode == USB_DR_MODE_HOST)
                 return;
@@ -617,6 +617,14 @@ static void dwc2_get_dev_hwparams(struct dwc2_hsotg *hsotg)
 
         gnptxfsiz = dwc2_readl(hsotg->regs + GNPTXFSIZ);
 
+        fifo_count = dwc2_hsotg_tx_fifo_count(hsotg);
+
+        for (fifo = 1; fifo <= fifo_count; fifo++) {
+                hw->g_tx_fifo_size[fifo] =
+                        (dwc2_readl(hsotg->regs + DPTXFSIZN(fifo)) &
+                         FIFOSIZE_DEPTH_MASK) >> FIFOSIZE_DEPTH_SHIFT;
+        }
+
         if (forced)
                 dwc2_clear_force_mode(hsotg);
 
@@ -661,14 +669,6 @@ int dwc2_get_hwparams(struct dwc2_hsotg *hsotg)
         hwcfg4 = dwc2_readl(hsotg->regs + GHWCFG4);
         grxfsiz = dwc2_readl(hsotg->regs + GRXFSIZ);
 
-        /*
-         * Host specific hardware parameters. Reading these parameters
-         * requires the controller to be in host mode. The mode will
-         * be forced, if necessary, to read these values.
-         */
-        dwc2_get_host_hwparams(hsotg);
-        dwc2_get_dev_hwparams(hsotg);
-
         /* hwcfg1 */
         hw->dev_ep_dirs = hwcfg1;
 
@@ -711,6 +711,8 @@ int dwc2_get_hwparams(struct dwc2_hsotg *hsotg)
         hw->en_multiple_tx_fifo = !!(hwcfg4 & GHWCFG4_DED_FIFO_EN);
         hw->num_dev_perio_in_ep = (hwcfg4 & GHWCFG4_NUM_DEV_PERIO_IN_EP_MASK) >>
                                   GHWCFG4_NUM_DEV_PERIO_IN_EP_SHIFT;
+        hw->num_dev_in_eps = (hwcfg4 & GHWCFG4_NUM_IN_EPS_MASK) >>
+                             GHWCFG4_NUM_IN_EPS_SHIFT;
         hw->dma_desc_enable = !!(hwcfg4 & GHWCFG4_DESC_DMA);
         hw->power_optimized = !!(hwcfg4 & GHWCFG4_POWER_OPTIMIZ);
         hw->utmi_phy_data_width = (hwcfg4 & GHWCFG4_UTMI_PHY_DATA_WIDTH_MASK) >>
@@ -719,6 +721,13 @@ int dwc2_get_hwparams(struct dwc2_hsotg *hsotg)
         /* fifo sizes */
         hw->rx_fifo_size = (grxfsiz & GRXFSIZ_DEPTH_MASK) >>
                                 GRXFSIZ_DEPTH_SHIFT;
+        /*
+         * Host specific hardware parameters. Reading these parameters
+         * requires the controller to be in host mode. The mode will
+         * be forced, if necessary, to read these values.
+         */
+        dwc2_get_host_hwparams(hsotg);
+        dwc2_get_dev_hwparams(hsotg);
 
         return 0;
 }
diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index c4a4d7bd2766..7ae0eefc7cc7 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -51,8 +51,10 @@ static int dwc3_of_simple_clk_init(struct dwc3_of_simple *simple, int count)
 
                 clk = of_clk_get(np, i);
                 if (IS_ERR(clk)) {
-                        while (--i >= 0)
+                        while (--i >= 0) {
+                                clk_disable_unprepare(simple->clks[i]);
                                 clk_put(simple->clks[i]);
+                        }
                         return PTR_ERR(clk);
                 }
 
@@ -203,6 +205,7 @@ static struct platform_driver dwc3_of_simple_driver = {
         .driver         = {
                 .name   = "dwc3-of-simple",
                 .of_match_table = of_dwc3_simple_match,
+                .pm     = &dwc3_of_simple_dev_pm_ops,
         },
 };
 
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 981fd986cf82..639dd1b163a0 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -259,7 +259,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned cmd,
 {
         const struct usb_endpoint_descriptor *desc = dep->endpoint.desc;
         struct dwc3             *dwc = dep->dwc;
-        u32                     timeout = 500;
+        u32                     timeout = 1000;
         u32                     reg;
 
         int                     cmd_status = 0;
@@ -912,7 +912,7 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
                          */
                         if (speed == USB_SPEED_HIGH) {
                                 struct usb_ep *ep = &dep->endpoint;
-                                unsigned int mult = ep->mult - 1;
+                                unsigned int mult = 2;
                                 unsigned int maxp = usb_endpoint_maxp(ep->desc);
 
                                 if (length <= (2 * maxp))
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index eec14e6ed20b..77c7ecca816a 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -146,7 +146,6 @@ int config_ep_by_speed(struct usb_gadget *g,
                         struct usb_function *f,
                         struct usb_ep *_ep)
 {
-        struct usb_composite_dev        *cdev = get_gadget_data(g);
         struct usb_endpoint_descriptor *chosen_desc = NULL;
         struct usb_descriptor_header **speed_desc = NULL;
 
@@ -226,8 +225,12 @@ ep_found:
                         _ep->maxburst = comp_desc->bMaxBurst + 1;
                         break;
                 default:
-                        if (comp_desc->bMaxBurst != 0)
+                        if (comp_desc->bMaxBurst != 0) {
+                                struct usb_composite_dev *cdev;
+
+                                cdev = get_gadget_data(g);
                                 ERROR(cdev, "ep0 bMaxBurst must be 0\n");
+                        }
                         _ep->maxburst = 1;
                         break;
                 }
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 97ea059a7aa4..b6cf5ab5a0a1 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1012,7 +1012,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                 else
                         ret = ep->status;
                 goto error_mutex;
-        } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_KERNEL))) {
+        } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC))) {
                 ret = -ENOMEM;
         } else {
                 req->buf      = data;
@@ -2282,9 +2282,18 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
                 int i;
 
                 if (len < sizeof(*d) ||
-                    d->bFirstInterfaceNumber >= ffs->interfaces_count ||
-                    !d->Reserved1)
+                    d->bFirstInterfaceNumber >= ffs->interfaces_count)
                         return -EINVAL;
+                if (d->Reserved1 != 1) {
+                        /*
+                         * According to the spec, Reserved1 must be set to 1
+                         * but older kernels incorrectly rejected non-zero
+                         * values.  We fix it here to avoid returning EINVAL
+                         * in response to values we used to accept.
+                         */
+                        pr_debug("usb_ext_compat_desc::Reserved1 forced to 1\n");
+                        d->Reserved1 = 1;
+                }
                 for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
                         if (d->Reserved2[i])
                                 return -EINVAL;
diff --git a/drivers/usb/gadget/legacy/Kconfig b/drivers/usb/gadget/legacy/Kconfig
index a12fb459dbd9..784bf86dad4f 100644
--- a/drivers/usb/gadget/legacy/Kconfig
+++ b/drivers/usb/gadget/legacy/Kconfig
@@ -479,7 +479,7 @@ endif
 # or video class gadget drivers), or specific hardware, here.
 config USB_G_WEBCAM
         tristate "USB Webcam Gadget"
-        depends on VIDEO_DEV
+        depends on VIDEO_V4L2
         select USB_LIBCOMPOSITE
         select VIDEOBUF2_VMALLOC
         select USB_F_UVC
diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c
index d39f070acbd7..01b44e159623 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_core.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_core.c
@@ -642,7 +642,6 @@ static const struct of_device_id bdc_of_match[] = {
 static struct platform_driver bdc_driver = {
         .driver         = {
                 .name   = BRCM_BDC_NAME,
-                .owner  = THIS_MODULE,
                 .pm = &bdc_pm_ops,
                 .of_match_table = bdc_of_match,
         },
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 61422d624ad0..1b3efb14aec7 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1069,8 +1069,12 @@ static inline void usb_gadget_udc_stop(struct usb_udc *udc)
 static inline void usb_gadget_udc_set_speed(struct usb_udc *udc,
                                             enum usb_device_speed speed)
 {
-        if (udc->gadget->ops->udc_set_speed)
-                udc->gadget->ops->udc_set_speed(udc->gadget, speed);
+        if (udc->gadget->ops->udc_set_speed) {
+                enum usb_device_speed s;
+
+                s = min(speed, udc->gadget->max_speed);
+                udc->gadget->ops->udc_set_speed(udc->gadget, s);
+        }
 }
 
 /**
@@ -1143,11 +1147,7 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget,
 
         udc = kzalloc(sizeof(*udc), GFP_KERNEL);
         if (!udc)
-                goto err1;
-
-        ret = device_add(&gadget->dev);
-        if (ret)
-                goto err2;
+                goto err_put_gadget;
 
         device_initialize(&udc->dev);
         udc->dev.release = usb_udc_release;
@@ -1156,7 +1156,11 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget,
         udc->dev.parent = parent;
         ret = dev_set_name(&udc->dev, "%s", kobject_name(&parent->kobj));
         if (ret)
-                goto err3;
+                goto err_put_udc;
+
+        ret = device_add(&gadget->dev);
+        if (ret)
+                goto err_put_udc;
 
         udc->gadget = gadget;
         gadget->udc = udc;
@@ -1166,7 +1170,7 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget,
 
         ret = device_add(&udc->dev);
         if (ret)
-                goto err4;
+                goto err_unlist_udc;
 
         usb_gadget_set_state(gadget, USB_STATE_NOTATTACHED);
         udc->vbus = true;
@@ -1174,27 +1178,25 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget,
         /* pick up one of pending gadget drivers */
         ret = check_pending_gadget_drivers(udc);
         if (ret)
-                goto err5;
+                goto err_del_udc;
 
         mutex_unlock(&udc_lock);
 
         return 0;
 
-err5:
+ err_del_udc:
         device_del(&udc->dev);
 
-err4:
+ err_unlist_udc:
         list_del(&udc->list);
         mutex_unlock(&udc_lock);
 
-err3:
-        put_device(&udc->dev);
         device_del(&gadget->dev);
 
-err2:
-        kfree(udc);
+ err_put_udc:
+        put_device(&udc->dev);
 
-err1:
+ err_put_gadget:
         put_device(&gadget->dev);
         return ret;
 }
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index bc37f40baacf..6e87af248367 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -252,7 +252,7 @@
 #define USB3_EP0_SS_MAX_PACKET_SIZE     512
 #define USB3_EP0_HSFS_MAX_PACKET_SIZE   64
 #define USB3_EP0_BUF_SIZE               8
-#define USB3_MAX_NUM_PIPES              30
+#define USB3_MAX_NUM_PIPES              6       /* This includes PIPE 0 */
 #define USB3_WAIT_US                    3
 #define USB3_DMA_NUM_SETTING_AREA       4
 /*
diff --git a/drivers/usb/host/ehci-dbg.c b/drivers/usb/host/ehci-dbg.c
index 19f00424f53e..3ed75aaa09d9 100644
--- a/drivers/usb/host/ehci-dbg.c
+++ b/drivers/usb/host/ehci-dbg.c
@@ -827,7 +827,7 @@ static ssize_t fill_registers_buffer(struct debug_buffer *buf)
                         default:                /* unknown */
                                 break;
                         }
-                        temp = (cap >> 8) & 0xff;
+                        offset = (cap >> 8) & 0xff;
                 }
         }
 #endif
diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
index 4f7895dbcf88..e26e685d8a57 100644
--- a/drivers/usb/host/xhci-debugfs.c
+++ b/drivers/usb/host/xhci-debugfs.c
@@ -162,7 +162,7 @@ static void xhci_debugfs_extcap_regset(struct xhci_hcd *xhci, int cap_id,
 static int xhci_ring_enqueue_show(struct seq_file *s, void *unused)
 {
         dma_addr_t              dma;
-        struct xhci_ring        *ring = s->private;
+        struct xhci_ring        *ring = *(struct xhci_ring **)s->private;
 
         dma = xhci_trb_virt_to_dma(ring->enq_seg, ring->enqueue);
         seq_printf(s, "%pad\n", &dma);
@@ -173,7 +173,7 @@ static int xhci_ring_enqueue_show(struct seq_file *s, void *unused)
 static int xhci_ring_dequeue_show(struct seq_file *s, void *unused)
 {
         dma_addr_t              dma;
-        struct xhci_ring        *ring = s->private;
+        struct xhci_ring        *ring = *(struct xhci_ring **)s->private;
 
         dma = xhci_trb_virt_to_dma(ring->deq_seg, ring->dequeue);
         seq_printf(s, "%pad\n", &dma);
@@ -183,7 +183,7 @@ static int xhci_ring_dequeue_show(struct seq_file *s, void *unused)
 
 static int xhci_ring_cycle_show(struct seq_file *s, void *unused)
 {
-        struct xhci_ring        *ring = s->private;
+        struct xhci_ring        *ring = *(struct xhci_ring **)s->private;
 
         seq_printf(s, "%d\n", ring->cycle_state);
 
@@ -346,7 +346,7 @@ static void xhci_debugfs_create_files(struct xhci_hcd *xhci,
 }
 
 static struct dentry *xhci_debugfs_create_ring_dir(struct xhci_hcd *xhci,
-                                                   struct xhci_ring *ring,
+                                                   struct xhci_ring **ring,
                                                    const char *name,
                                                    struct dentry *parent)
 {
@@ -387,7 +387,7 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci,
 
         snprintf(epriv->name, sizeof(epriv->name), "ep%02d", ep_index);
         epriv->root = xhci_debugfs_create_ring_dir(xhci,
-                                                   dev->eps[ep_index].new_ring,
+                                                   &dev->eps[ep_index].new_ring,
                                                    epriv->name,
                                                    spriv->root);
         spriv->eps[ep_index] = epriv;
@@ -423,7 +423,7 @@ void xhci_debugfs_create_slot(struct xhci_hcd *xhci, int slot_id)
         priv->dev = dev;
         dev->debugfs_private = priv;
 
-        xhci_debugfs_create_ring_dir(xhci, dev->eps[0].ring,
+        xhci_debugfs_create_ring_dir(xhci, &dev->eps[0].ring,
                                      "ep00", priv->root);
 
         xhci_debugfs_create_context_files(xhci, priv->root, slot_id);
@@ -488,11 +488,11 @@ void xhci_debugfs_init(struct xhci_hcd *xhci)
                                    ARRAY_SIZE(xhci_extcap_dbc),
                                    "reg-ext-dbc");
 
-        xhci_debugfs_create_ring_dir(xhci, xhci->cmd_ring,
+        xhci_debugfs_create_ring_dir(xhci, &xhci->cmd_ring,
                                      "command-ring",
                                      xhci->debugfs_root);
 
-        xhci_debugfs_create_ring_dir(xhci, xhci->event_ring,
+        xhci_debugfs_create_ring_dir(xhci, &xhci->event_ring,
                                      "event-ring",
                                      xhci->debugfs_root);
 
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index e1fba4688509..3a29b32a3bd0 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -934,6 +934,12 @@ void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id)
         if (!vdev)
                 return;
 
+        if (vdev->real_port == 0 ||
+                        vdev->real_port > HCS_MAX_PORTS(xhci->hcs_params1)) {
+                xhci_dbg(xhci, "Bad vdev->real_port.\n");
+                goto out;
+        }
+
         tt_list_head = &(xhci->rh_bw[vdev->real_port - 1].tts);
         list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
                 /* is this a hub device that added a tt_info to the tts list */
@@ -947,6 +953,7 @@ void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id)
                         }
                 }
         }
+out:
         /* we are now at a leaf device */
         xhci_debugfs_remove_slot(xhci, slot_id);
         xhci_free_virt_device(xhci, slot_id);
@@ -964,10 +971,9 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
                 return 0;
         }
 
-        xhci->devs[slot_id] = kzalloc(sizeof(*xhci->devs[slot_id]), flags);
-        if (!xhci->devs[slot_id])
+        dev = kzalloc(sizeof(*dev), flags);
+        if (!dev)
                 return 0;
-        dev = xhci->devs[slot_id];
 
         /* Allocate the (output) device context that will be used in the HC. */
         dev->out_ctx = xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_DEVICE, flags);
@@ -1008,9 +1014,17 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
 
         trace_xhci_alloc_virt_device(dev);
 
+        xhci->devs[slot_id] = dev;
+
         return 1;
 fail:
-        xhci_free_virt_device(xhci, slot_id);
+
+        if (dev->in_ctx)
+                xhci_free_container_ctx(xhci, dev->in_ctx);
+        if (dev->out_ctx)
+                xhci_free_container_ctx(xhci, dev->out_ctx);
+        kfree(dev);
+
         return 0;
 }
 
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 7ef1274ef7f7..1aad89b8aba0 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -178,6 +178,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 xhci->quirks |= XHCI_BROKEN_STREAMS;
         }
         if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
+                        pdev->device == 0x0014)
+                xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+        if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
                         pdev->device == 0x0015)
                 xhci->quirks |= XHCI_RESET_ON_RESUME;
         if (pdev->vendor == PCI_VENDOR_ID_VIA)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index c239c688076c..c5cbc685c691 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2477,12 +2477,16 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                  */
                 if (list_empty(&ep_ring->td_list)) {
                         /*
-                         * A stopped endpoint may generate an extra completion
-                         * event if the device was suspended.  Don't print
-                         * warnings.
+                         * Don't print wanings if it's due to a stopped endpoint
+                         * generating an extra completion event if the device
+                         * was suspended. Or, a event for the last TRB of a
+                         * short TD we already got a short event for.
+                         * The short TD is already removed from the TD list.
                          */
+
                         if (!(trb_comp_code == COMP_STOPPED ||
-                                trb_comp_code == COMP_STOPPED_LENGTH_INVALID)) {
+                              trb_comp_code == COMP_STOPPED_LENGTH_INVALID ||
+                              ep_ring->last_td_was_short)) {
                                 xhci_warn(xhci, "WARN Event TRB for slot %d ep %d with no TDs queued?\n",
                                                 TRB_TO_SLOT_ID(le32_to_cpu(event->flags)),
                                                 ep_index);
@@ -3108,7 +3112,7 @@ static u32 xhci_td_remainder(struct xhci_hcd *xhci, int transferred,
 {
         u32 maxp, total_packet_count;
 
-        /* MTK xHCI is mostly 0.97 but contains some features from 1.0 */
+        /* MTK xHCI 0.96 contains some features from 1.0 */
         if (xhci->hci_version < 0x100 && !(xhci->quirks & XHCI_MTK_HOST))
                 return ((td_total_len - transferred) >> 10);
 
@@ -3117,8 +3121,8 @@ static u32 xhci_td_remainder(struct xhci_hcd *xhci, int transferred,
             trb_buff_len == td_total_len)
                 return 0;
 
-        /* for MTK xHCI, TD size doesn't include this TRB */
-        if (xhci->quirks & XHCI_MTK_HOST)
+        /* for MTK xHCI 0.96, TD size include this TRB, but not in 1.x */
+        if ((xhci->quirks & XHCI_MTK_HOST) && (xhci->hci_version < 0x100))
                 trb_buff_len = 0;
 
         maxp = usb_endpoint_maxp(&urb->ep->desc);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2424d3020ca3..da6dbe3ebd8b 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3525,8 +3525,6 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
         struct xhci_slot_ctx *slot_ctx;
         int i, ret;
 
-        xhci_debugfs_remove_slot(xhci, udev->slot_id);
-
 #ifndef CONFIG_USB_DEFAULT_PERSIST
         /*
          * We called pm_runtime_get_noresume when the device was attached.
@@ -3555,8 +3553,10 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
         }
 
         ret = xhci_disable_slot(xhci, udev->slot_id);
-        if (ret)
+        if (ret) {
+                xhci_debugfs_remove_slot(xhci, udev->slot_id);
                 xhci_free_virt_device(xhci, udev->slot_id);
+        }
 }
 
 int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
diff --git a/drivers/usb/misc/usb3503.c b/drivers/usb/misc/usb3503.c
index 465dbf68b463..f723f7b8c9ac 100644
--- a/drivers/usb/misc/usb3503.c
+++ b/drivers/usb/misc/usb3503.c
@@ -279,6 +279,8 @@ static int usb3503_probe(struct usb3503 *hub)
         if (gpio_is_valid(hub->gpio_reset)) {
                 err = devm_gpio_request_one(dev, hub->gpio_reset,
                                 GPIOF_OUT_INIT_LOW, "usb3503 reset");
+                /* Datasheet defines a hardware reset to be at least 100us */
+                usleep_range(100, 10000);
                 if (err) {
                         dev_err(dev,
                                 "unable to request GPIO %d as reset pin (%d)\n",
diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index f6ae753ab99b..f932f40302df 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -1004,7 +1004,9 @@ static long mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg
                 break;
 
         case MON_IOCQ_RING_SIZE:
+                mutex_lock(&rp->fetch_lock);
                 ret = rp->b_size;
+                mutex_unlock(&rp->fetch_lock);
                 break;
 
         case MON_IOCT_RING_SIZE:
@@ -1231,12 +1233,16 @@ static int mon_bin_vma_fault(struct vm_fault *vmf)
         unsigned long offset, chunk_idx;
         struct page *pageptr;
 
+        mutex_lock(&rp->fetch_lock);
         offset = vmf->pgoff << PAGE_SHIFT;
-        if (offset >= rp->b_size)
+        if (offset >= rp->b_size) {
+                mutex_unlock(&rp->fetch_lock);
                 return VM_FAULT_SIGBUS;
+        }
         chunk_idx = offset / CHUNK_SIZE;
         pageptr = rp->b_vec[chunk_idx].pg;
         get_page(pageptr);
+        mutex_unlock(&rp->fetch_lock);
         vmf->page = pageptr;
         return 0;
 }
diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c
index 0397606a211b..6c036de63272 100644
--- a/drivers/usb/musb/da8xx.c
+++ b/drivers/usb/musb/da8xx.c
@@ -284,7 +284,15 @@ static irqreturn_t da8xx_musb_interrupt(int irq, void *hci)
                         musb->xceiv->otg->state = OTG_STATE_A_WAIT_VRISE;
                         portstate(musb->port1_status |= USB_PORT_STAT_POWER);
                         del_timer(&musb->dev_timer);
-                } else {
+                } else if (!(musb->int_usb & MUSB_INTR_BABBLE)) {
+                        /*
+                         * When babble condition happens, drvvbus interrupt
+                         * is also generated. Ignore this drvvbus interrupt
+                         * and let babble interrupt handler recovers the
+                         * controller; otherwise, the host-mode flag is lost
+                         * due to the MUSB_DEV_MODE() call below and babble
+                         * recovery logic will not be called.
+                         */
                         musb->is_active = 0;
                         MUSB_DEV_MODE(musb);
                         otg->default_a = 0;
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 7c6273bf5beb..06d502b3e913 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -124,6 +124,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */
         { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
         { USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */
+        { USB_DEVICE(0x10C4, 0x85A7) }, /* LifeScan OneTouch Verio IQ */
         { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */
         { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */
         { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
@@ -174,6 +175,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
         { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
         { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */
+        { USB_DEVICE(0x18EF, 0xE030) }, /* ELV ALC 8xxx Battery Charger */
         { USB_DEVICE(0x18EF, 0xE032) }, /* ELV TFD500 Data Logger */
         { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */
         { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 1aba9105b369..fc68952c994a 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1013,6 +1013,7 @@ static const struct usb_device_id id_table_combined[] = {
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) },
         { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) },
+        { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 4faa09fe308c..8b4ecd2bd297 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -915,6 +915,12 @@
 #define ICPDAS_I7563U_PID               0x0105
 
 /*
+ * Airbus Defence and Space
+ */
+#define AIRBUS_DS_VID                   0x1e8e  /* Vendor ID */
+#define AIRBUS_DS_P8GR                  0x6001  /* Tetra P8GR */
+
+/*
  * RT Systems programming cables for various ham radios
  */
 #define RTSYSTEMS_VID           0x2100  /* Vendor ID */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index aaa7d901a06d..b6320e3be429 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -233,11 +233,14 @@ static void option_instat_callback(struct urb *urb);
 /* These Quectel products use Qualcomm's vendor ID */
 #define QUECTEL_PRODUCT_UC20                    0x9003
 #define QUECTEL_PRODUCT_UC15                    0x9090
+/* These Yuga products use Qualcomm's vendor ID */
+#define YUGA_PRODUCT_CLM920_NC5                 0x9625
 
 #define QUECTEL_VENDOR_ID                       0x2c7c
 /* These Quectel products use Quectel's vendor ID */
 #define QUECTEL_PRODUCT_EC21                    0x0121
 #define QUECTEL_PRODUCT_EC25                    0x0125
+#define QUECTEL_PRODUCT_BG96                    0x0296
 
 #define CMOTECH_VENDOR_ID                       0x16d8
 #define CMOTECH_PRODUCT_6001                    0x6001
@@ -279,6 +282,7 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_LE922_USBCFG3             0x1043
 #define TELIT_PRODUCT_LE922_USBCFG5             0x1045
 #define TELIT_PRODUCT_ME910                     0x1100
+#define TELIT_PRODUCT_ME910_DUAL_MODEM          0x1101
 #define TELIT_PRODUCT_LE920                     0x1200
 #define TELIT_PRODUCT_LE910                     0x1201
 #define TELIT_PRODUCT_LE910_USBCFG4             0x1206
@@ -644,6 +648,11 @@ static const struct option_blacklist_info telit_me910_blacklist = {
         .reserved = BIT(1) | BIT(3),
 };
 
+static const struct option_blacklist_info telit_me910_dual_modem_blacklist = {
+        .sendsetup = BIT(0),
+        .reserved = BIT(3),
+};
+
 static const struct option_blacklist_info telit_le910_blacklist = {
         .sendsetup = BIT(0),
         .reserved = BIT(1) | BIT(2),
@@ -673,6 +682,10 @@ static const struct option_blacklist_info cinterion_rmnet2_blacklist = {
         .reserved = BIT(4) | BIT(5),
 };
 
+static const struct option_blacklist_info yuga_clm920_nc5_blacklist = {
+        .reserved = BIT(1) | BIT(4),
+};
+
 static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -1177,11 +1190,16 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)},
         { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        /* Yuga products use Qualcomm vendor ID */
+        { USB_DEVICE(QUALCOMM_VENDOR_ID, YUGA_PRODUCT_CLM920_NC5),
+          .driver_info = (kernel_ulong_t)&yuga_clm920_nc5_blacklist },
         /* Quectel products using Quectel vendor ID */
         { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
@@ -1241,6 +1259,8 @@ static const struct usb_device_id option_ids[] = {
                 .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
                 .driver_info = (kernel_ulong_t)&telit_me910_blacklist },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
+                .driver_info = (kernel_ulong_t)&telit_me910_dual_modem_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
                 .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index e3892541a489..613f91add03d 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -162,6 +162,8 @@ static const struct usb_device_id id_table[] = {
         {DEVICE_SWI(0x1199, 0x9079)},   /* Sierra Wireless EM74xx */
         {DEVICE_SWI(0x1199, 0x907a)},   /* Sierra Wireless EM74xx QDL */
         {DEVICE_SWI(0x1199, 0x907b)},   /* Sierra Wireless EM74xx */
+        {DEVICE_SWI(0x1199, 0x9090)},   /* Sierra Wireless EM7565 QDL */
+        {DEVICE_SWI(0x1199, 0x9091)},   /* Sierra Wireless EM7565 */
         {DEVICE_SWI(0x413c, 0x81a2)},   /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a3)},   /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a4)},   /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
@@ -342,6 +344,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                         break;
                 case 2:
                         dev_dbg(dev, "NMEA GPS interface found\n");
+                        sendsetup = true;
                         break;
                 case 3:
                         dev_dbg(dev, "Modem port found\n");
diff --git a/drivers/usb/serial/usb_debug.c b/drivers/usb/serial/usb_debug.c
index ab5a2ac4993a..aaf4813e4971 100644
--- a/drivers/usb/serial/usb_debug.c
+++ b/drivers/usb/serial/usb_debug.c
@@ -31,12 +31,14 @@ static const struct usb_device_id id_table[] = {
 };
 
 static const struct usb_device_id dbc_id_table[] = {
+        { USB_DEVICE(0x1d6b, 0x0010) },
         { USB_DEVICE(0x1d6b, 0x0011) },
         { },
 };
 
 static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(0x0525, 0x127a) },
+        { USB_DEVICE(0x1d6b, 0x0010) },
         { USB_DEVICE(0x1d6b, 0x0011) },
         { },
 };
diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h
index 1fcd758a961f..3734a25e09e5 100644
--- a/drivers/usb/storage/uas-detect.h
+++ b/drivers/usb/storage/uas-detect.h
@@ -112,6 +112,10 @@ static int uas_use_uas_driver(struct usb_interface *intf,
                 }
         }
 
+        /* All Seagate disk enclosures have broken ATA pass-through support */
+        if (le16_to_cpu(udev->descriptor.idVendor) == 0x0bc2)
+                flags |= US_FL_NO_ATA_1X;
+
         usb_stor_adjust_quirks(udev, &flags);
 
         if (flags & US_FL_IGNORE_UAS) {
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 2968046e7c05..f72d045ee9ef 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2100,6 +2100,13 @@ UNUSUAL_DEV(  0x152d, 0x0567, 0x0114, 0x0116,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_BROKEN_FUA ),
 
+/* Reported by David Kozub <zub@linux.fjfi.cvut.cz> */
+UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
+                "JMicron",
+                "JMS567",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_BROKEN_FUA),
+
 /*
  * Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br>
  * JMicron responds to USN and several other SCSI ioctls with a
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index d520374a824e..a7d08ae0adad 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -129,6 +129,13 @@ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_BROKEN_FUA | US_FL_NO_REPORT_OPCODES),
 
+/* Reported-by: David Kozub <zub@linux.fjfi.cvut.cz> */
+UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999,
+                "JMicron",
+                "JMS567",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_BROKEN_FUA),
+
 /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
 UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
                 "VIA",
@@ -136,6 +143,13 @@ UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_NO_ATA_1X),
 
+/* Reported-by: Icenowy Zheng <icenowy@aosc.io> */
+UNUSUAL_DEV(0x2537, 0x1068, 0x0000, 0x9999,
+                "Norelsys",
+                "NS1068X",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_IGNORE_UAS),
+
 /* Reported-by: Takeo Nakayama <javhera@gmx.com> */
 UNUSUAL_DEV(0x357d, 0x7788, 0x0000, 0x9999,
                 "JMicron",
diff --git a/drivers/usb/typec/Kconfig b/drivers/usb/typec/Kconfig
index 465d7da849c3..bcb2744c5977 100644
--- a/drivers/usb/typec/Kconfig
+++ b/drivers/usb/typec/Kconfig
@@ -1,13 +1,53 @@
 
-menu "USB Power Delivery and Type-C drivers"
+menuconfig TYPEC
+        tristate "USB Type-C Support"
+        help
+          USB Type-C Specification defines a cable and connector for USB where
+          only one type of plug is supported on both ends, i.e. there will not
+          be Type-A plug on one end of the cable and Type-B plug on the other.
+          Determination of the host-to-device relationship happens through a
+          specific Configuration Channel (CC) which goes through the USB Type-C
+          cable. The Configuration Channel may also be used to detect optional
+          Accessory Modes - Analog Audio and Debug - and if USB Power Delivery
+          is supported, the Alternate Modes, where the connector is used for
+          something else then USB communication.
+
+          USB Power Delivery Specification defines a protocol that can be used
+          to negotiate the voltage and current levels with the connected
+          partners. USB Power Delivery allows higher voltages then the normal
+          5V, up to 20V, and current up to 5A over the cable. The USB Power
+          Delivery protocol is also used to negotiate the optional Alternate
+          Modes when they are supported. USB Power Delivery does not depend on
+          USB Type-C connector, however it is mostly used together with USB
+          Type-C connectors.
+
+          USB Type-C and USB Power Delivery Specifications define a set of state
+          machines that need to be implemented in either software or firmware.
+          Simple USB Type-C PHYs, for example USB Type-C Port Controller
+          Interface Specification compliant "Port Controllers" need the state
+          machines to be handled in the OS, but stand-alone USB Type-C and Power
+          Delivery controllers handle the state machines inside their firmware.
+          The USB Type-C and Power Delivery controllers usually function
+          autonomously, and do not necessarily require drivers.
+
+          Enable this configurations option if you have USB Type-C connectors on
+          your system and 1) you know your USB Type-C hardware requires OS
+          control (a driver) to function, or 2) if you need to be able to read
+          the status of the USB Type-C ports in your system, or 3) if you need
+          to be able to swap the power role (decide are you supplying or
+          consuming power over the cable) or data role (host or device) when
+          both roles are supported.
+
+          For more information, see the kernel documentation for USB Type-C
+          Connector Class API (Documentation/driver-api/usb/typec.rst)
+          <https://www.kernel.org/doc/html/latest/driver-api/usb/typec.html>
+          and ABI (Documentation/ABI/testing/sysfs-class-typec).
 
-config TYPEC
-        tristate
+if TYPEC
 
 config TYPEC_TCPM
         tristate "USB Type-C Port Controller Manager"
         depends on USB
-        select TYPEC
         help
           The Type-C Port Controller Manager provides a USB PD and USB Type-C
           state machine for use with Type-C Port Controllers.
@@ -22,7 +62,6 @@ config TYPEC_WCOVE
         depends on INTEL_SOC_PMIC
         depends on INTEL_PMC_IPC
         depends on BXT_WC_PMIC_OPREGION
-        select TYPEC
         help
           This driver adds support for USB Type-C detection on Intel Broxton
           platforms that have Intel Whiskey Cove PMIC. The driver can detect the
@@ -31,14 +70,13 @@ config TYPEC_WCOVE
           To compile this driver as module, choose M here: the module will be
           called typec_wcove
 
-endif
+endif # TYPEC_TCPM
 
 source "drivers/usb/typec/ucsi/Kconfig"
 
 config TYPEC_TPS6598X
         tristate "TI TPS6598x USB Power Delivery controller driver"
         depends on I2C
-        select TYPEC
         help
           Say Y or M here if your system has TI TPS65982 or TPS65983 USB Power
           Delivery controller.
@@ -46,4 +84,4 @@ config TYPEC_TPS6598X
           If you choose to build this driver as a dynamically linked module, the
           module will be called tps6598x.ko.
 
-endmenu
+endif # TYPEC
diff --git a/drivers/usb/typec/ucsi/Kconfig b/drivers/usb/typec/ucsi/Kconfig
index d0c31cee4720..e36d6c73c4a4 100644
--- a/drivers/usb/typec/ucsi/Kconfig
+++ b/drivers/usb/typec/ucsi/Kconfig
@@ -1,7 +1,6 @@
 config TYPEC_UCSI
         tristate "USB Type-C Connector System Software Interface driver"
         depends on !CPU_BIG_ENDIAN
-        select TYPEC
         help
           USB Type-C Connector System Software Interface (UCSI) is a
           specification for an interface that allows the operating system to
diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
index a3df8ee82faf..e31a6f204397 100644
--- a/drivers/usb/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -149,8 +149,7 @@ static void stub_shutdown_connection(struct usbip_device *ud)
          * step 1?
          */
         if (ud->tcp_socket) {
-                dev_dbg(&sdev->udev->dev, "shutdown tcp_socket %p\n",
-                        ud->tcp_socket);
+                dev_dbg(&sdev->udev->dev, "shutdown sockfd %d\n", ud->sockfd);
                 kernel_sock_shutdown(ud->tcp_socket, SHUT_RDWR);
         }
 
diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c
index 4f48b306713f..c31c8402a0c5 100644
--- a/drivers/usb/usbip/stub_main.c
+++ b/drivers/usb/usbip/stub_main.c
@@ -237,11 +237,12 @@ void stub_device_cleanup_urbs(struct stub_device *sdev)
         struct stub_priv *priv;
         struct urb *urb;
 
-        dev_dbg(&sdev->udev->dev, "free sdev %p\n", sdev);
+        dev_dbg(&sdev->udev->dev, "Stub device cleaning up urbs\n");
 
         while ((priv = stub_priv_pop(sdev))) {
                 urb = priv->urb;
-                dev_dbg(&sdev->udev->dev, "free urb %p\n", urb);
+                dev_dbg(&sdev->udev->dev, "free urb seqnum %lu\n",
+                        priv->seqnum);
                 usb_kill_urb(urb);
 
                 kmem_cache_free(stub_priv_cache, priv);
diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 536e037f541f..6c5a59313999 100644
--- a/drivers/usb/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
@@ -211,9 +211,6 @@ static int stub_recv_cmd_unlink(struct stub_device *sdev,
                 if (priv->seqnum != pdu->u.cmd_unlink.seqnum)
                         continue;
 
-                dev_info(&priv->urb->dev->dev, "unlink urb %p\n",
-                         priv->urb);
-
                 /*
                  * This matched urb is not completed yet (i.e., be in
                  * flight in usb hcd hardware/driver). Now we are
@@ -252,8 +249,8 @@ static int stub_recv_cmd_unlink(struct stub_device *sdev,
                 ret = usb_unlink_urb(priv->urb);
                 if (ret != -EINPROGRESS)
                         dev_err(&priv->urb->dev->dev,
-                                "failed to unlink a urb %p, ret %d\n",
-                                priv->urb, ret);
+                                "failed to unlink a urb # %lu, ret %d\n",
+                                priv->seqnum, ret);
 
                 return 0;
         }
@@ -322,23 +319,26 @@ static struct stub_priv *stub_priv_alloc(struct stub_device *sdev,
         return priv;
 }
 
-static int get_pipe(struct stub_device *sdev, int epnum, int dir)
+static int get_pipe(struct stub_device *sdev, struct usbip_header *pdu)
 {
         struct usb_device *udev = sdev->udev;
         struct usb_host_endpoint *ep;
         struct usb_endpoint_descriptor *epd = NULL;
+        int epnum = pdu->base.ep;
+        int dir = pdu->base.direction;
+
+        if (epnum < 0 || epnum > 15)
+                goto err_ret;
 
         if (dir == USBIP_DIR_IN)
                 ep = udev->ep_in[epnum & 0x7f];
         else
                 ep = udev->ep_out[epnum & 0x7f];
-        if (!ep) {
-                dev_err(&sdev->udev->dev, "no such endpoint?, %d\n",
-                        epnum);
-                BUG();
-        }
+        if (!ep)
+                goto err_ret;
 
         epd = &ep->desc;
+
         if (usb_endpoint_xfer_control(epd)) {
                 if (dir == USBIP_DIR_OUT)
                         return usb_sndctrlpipe(udev, epnum);
@@ -361,15 +361,31 @@ static int get_pipe(struct stub_device *sdev, int epnum, int dir)
         }
 
         if (usb_endpoint_xfer_isoc(epd)) {
+                /* validate packet size and number of packets */
+                unsigned int maxp, packets, bytes;
+
+                maxp = usb_endpoint_maxp(epd);
+                maxp *= usb_endpoint_maxp_mult(epd);
+                bytes = pdu->u.cmd_submit.transfer_buffer_length;
+                packets = DIV_ROUND_UP(bytes, maxp);
+
+                if (pdu->u.cmd_submit.number_of_packets < 0 ||
+                    pdu->u.cmd_submit.number_of_packets > packets) {
+                        dev_err(&sdev->udev->dev,
+                                "CMD_SUBMIT: isoc invalid num packets %d\n",
+                                pdu->u.cmd_submit.number_of_packets);
+                        return -1;
+                }
                 if (dir == USBIP_DIR_OUT)
                         return usb_sndisocpipe(udev, epnum);
                 else
                         return usb_rcvisocpipe(udev, epnum);
         }
 
+err_ret:
         /* NOT REACHED */
-        dev_err(&sdev->udev->dev, "get pipe, epnum %d\n", epnum);
-        return 0;
+        dev_err(&sdev->udev->dev, "CMD_SUBMIT: invalid epnum %d\n", epnum);
+        return -1;
 }
 
 static void masking_bogus_flags(struct urb *urb)
@@ -433,7 +449,10 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
         struct stub_priv *priv;
         struct usbip_device *ud = &sdev->ud;
         struct usb_device *udev = sdev->udev;
-        int pipe = get_pipe(sdev, pdu->base.ep, pdu->base.direction);
+        int pipe = get_pipe(sdev, pdu);
+
+        if (pipe == -1)
+                return;
 
         priv = stub_priv_alloc(sdev, pdu);
         if (!priv)
diff --git a/drivers/usb/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c
index b18bce96c212..f0ec41a50cbc 100644
--- a/drivers/usb/usbip/stub_tx.c
+++ b/drivers/usb/usbip/stub_tx.c
@@ -88,7 +88,7 @@ void stub_complete(struct urb *urb)
         /* link a urb to the queue of tx. */
         spin_lock_irqsave(&sdev->priv_lock, flags);
         if (sdev->ud.tcp_socket == NULL) {
-                usbip_dbg_stub_tx("ignore urb for closed connection %p", urb);
+                usbip_dbg_stub_tx("ignore urb for closed connection\n");
                 /* It will be freed in stub_device_cleanup_urbs(). */
         } else if (priv->unlinking) {
                 stub_enqueue_ret_unlink(sdev, priv->seqnum, urb->status);
@@ -167,6 +167,13 @@ static int stub_send_ret_submit(struct stub_device *sdev)
                 memset(&pdu_header, 0, sizeof(pdu_header));
                 memset(&msg, 0, sizeof(msg));
 
+                if (urb->actual_length > 0 && !urb->transfer_buffer) {
+                        dev_err(&sdev->udev->dev,
+                                "urb: actual_length %d transfer_buffer null\n",
+                                urb->actual_length);
+                        return -1;
+                }
+
                 if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
                         iovnum = 2 + urb->number_of_packets;
                 else
@@ -183,8 +190,8 @@ static int stub_send_ret_submit(struct stub_device *sdev)
 
                 /* 1. setup usbip_header */
                 setup_ret_submit_pdu(&pdu_header, urb);
-                usbip_dbg_stub_tx("setup txdata seqnum: %d urb: %p\n",
-                                  pdu_header.base.seqnum, urb);
+                usbip_dbg_stub_tx("setup txdata seqnum: %d\n",
+                                  pdu_header.base.seqnum);
                 usbip_header_correct_endian(&pdu_header, 1);
 
                 iov[iovnum].iov_base = &pdu_header;
diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
index f7978933b402..ee2bbce24584 100644
--- a/drivers/usb/usbip/usbip_common.c
+++ b/drivers/usb/usbip/usbip_common.c
@@ -91,7 +91,7 @@ static void usbip_dump_usb_device(struct usb_device *udev)
         dev_dbg(dev, "       devnum(%d) devpath(%s) usb speed(%s)",
                 udev->devnum, udev->devpath, usb_speed_string(udev->speed));
 
-        pr_debug("tt %p, ttport %d\n", udev->tt, udev->ttport);
+        pr_debug("tt hub ttport %d\n", udev->ttport);
 
         dev_dbg(dev, "                    ");
         for (i = 0; i < 16; i++)
@@ -124,12 +124,8 @@ static void usbip_dump_usb_device(struct usb_device *udev)
         }
         pr_debug("\n");
 
-        dev_dbg(dev, "parent %p, bus %p\n", udev->parent, udev->bus);
-
-        dev_dbg(dev,
-                "descriptor %p, config %p, actconfig %p, rawdescriptors %p\n",
-                &udev->descriptor, udev->config,
-                udev->actconfig, udev->rawdescriptors);
+        dev_dbg(dev, "parent %s, bus %s\n", dev_name(&udev->parent->dev),
+                udev->bus->bus_name);
 
         dev_dbg(dev, "have_langid %d, string_langid %d\n",
                 udev->have_langid, udev->string_langid);
@@ -237,9 +233,6 @@ void usbip_dump_urb(struct urb *urb)
 
         dev = &urb->dev->dev;
 
-        dev_dbg(dev, "   urb                   :%p\n", urb);
-        dev_dbg(dev, "   dev                   :%p\n", urb->dev);
-
         usbip_dump_usb_device(urb->dev);
 
         dev_dbg(dev, "   pipe                  :%08x ", urb->pipe);
@@ -248,11 +241,9 @@ void usbip_dump_urb(struct urb *urb)
 
         dev_dbg(dev, "   status                :%d\n", urb->status);
         dev_dbg(dev, "   transfer_flags        :%08X\n", urb->transfer_flags);
-        dev_dbg(dev, "   transfer_buffer       :%p\n", urb->transfer_buffer);
         dev_dbg(dev, "   transfer_buffer_length:%d\n",
                                                 urb->transfer_buffer_length);
         dev_dbg(dev, "   actual_length         :%d\n", urb->actual_length);
-        dev_dbg(dev, "   setup_packet          :%p\n", urb->setup_packet);
 
         if (urb->setup_packet && usb_pipetype(urb->pipe) == PIPE_CONTROL)
                 usbip_dump_usb_ctrlrequest(
@@ -262,8 +253,6 @@ void usbip_dump_urb(struct urb *urb)
         dev_dbg(dev, "   number_of_packets     :%d\n", urb->number_of_packets);
         dev_dbg(dev, "   interval              :%d\n", urb->interval);
         dev_dbg(dev, "   error_count           :%d\n", urb->error_count);
-        dev_dbg(dev, "   context               :%p\n", urb->context);
-        dev_dbg(dev, "   complete              :%p\n", urb->complete);
 }
 EXPORT_SYMBOL_GPL(usbip_dump_urb);
 
@@ -317,26 +306,20 @@ int usbip_recv(struct socket *sock, void *buf, int size)
         struct msghdr msg = {.msg_flags = MSG_NOSIGNAL};
         int total = 0;
 
+        if (!sock || !buf || !size)
+                return -EINVAL;
+
         iov_iter_kvec(&msg.msg_iter, READ|ITER_KVEC, &iov, 1, size);
 
         usbip_dbg_xmit("enter\n");
 
-        if (!sock || !buf || !size) {
-                pr_err("invalid arg, sock %p buff %p size %d\n", sock, buf,
-                       size);
-                return -EINVAL;
-        }
-
         do {
-                int sz = msg_data_left(&msg);
+                msg_data_left(&msg);
                 sock->sk->sk_allocation = GFP_NOIO;
 
                 result = sock_recvmsg(sock, &msg, MSG_WAITALL);
-                if (result <= 0) {
-                        pr_debug("receive sock %p buf %p size %u ret %d total %d\n",
-                                 sock, buf + total, sz, result, total);
+                if (result <= 0)
                         goto err;
-                }
 
                 total += result;
         } while (msg_data_left(&msg));
diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h
index e5de35c8c505..473fb8a87289 100644
--- a/drivers/usb/usbip/usbip_common.h
+++ b/drivers/usb/usbip/usbip_common.h
@@ -256,6 +256,7 @@ struct usbip_device {
         /* lock for status */
         spinlock_t lock;
 
+        int sockfd;
         struct socket *tcp_socket;
 
         struct task_struct *tcp_rx;
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 713e94170963..c3e1008aa491 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -656,9 +656,6 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
         struct vhci_device *vdev;
         unsigned long flags;
 
-        usbip_dbg_vhci_hc("enter, usb_hcd %p urb %p mem_flags %d\n",
-                          hcd, urb, mem_flags);
-
         if (portnum > VHCI_HC_PORTS) {
                 pr_err("invalid port number %d\n", portnum);
                 return -ENODEV;
@@ -822,8 +819,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
         struct vhci_device *vdev;
         unsigned long flags;
 
-        pr_info("dequeue a urb %p\n", urb);
-
         spin_lock_irqsave(&vhci->lock, flags);
 
         priv = urb->hcpriv;
@@ -851,7 +846,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                 /* tcp connection is closed */
                 spin_lock(&vdev->priv_lock);
 
-                pr_info("device %p seems to be disconnected\n", vdev);
                 list_del(&priv->list);
                 kfree(priv);
                 urb->hcpriv = NULL;
@@ -863,8 +857,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                  * vhci_rx will receive RET_UNLINK and give back the URB.
                  * Otherwise, we give back it here.
                  */
-                pr_info("gives back urb %p\n", urb);
-
                 usb_hcd_unlink_urb_from_ep(hcd, urb);
 
                 spin_unlock_irqrestore(&vhci->lock, flags);
@@ -892,8 +884,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 
                 unlink->unlink_seqnum = priv->seqnum;
 
-                pr_info("device %p seems to be still connected\n", vdev);
-
                 /* send cmd_unlink and try to cancel the pending URB in the
                  * peer */
                 list_add_tail(&unlink->list, &vdev->unlink_tx);
@@ -975,7 +965,7 @@ static void vhci_shutdown_connection(struct usbip_device *ud)
 
         /* need this? see stub_dev.c */
         if (ud->tcp_socket) {
-                pr_debug("shutdown tcp_socket %p\n", ud->tcp_socket);
+                pr_debug("shutdown tcp_socket %d\n", ud->sockfd);
                 kernel_sock_shutdown(ud->tcp_socket, SHUT_RDWR);
         }
 
@@ -1098,7 +1088,6 @@ static int hcd_name_to_id(const char *name)
 static int vhci_setup(struct usb_hcd *hcd)
 {
         struct vhci *vhci = *((void **)dev_get_platdata(hcd->self.controller));
-        hcd->self.sg_tablesize = ~0;
         if (usb_hcd_is_primary_hcd(hcd)) {
                 vhci->vhci_hcd_hs = hcd_to_vhci_hcd(hcd);
                 vhci->vhci_hcd_hs->vhci = vhci;
diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c
index 90577e8b2282..112ebb90d8c9 100644
--- a/drivers/usb/usbip/vhci_rx.c
+++ b/drivers/usb/usbip/vhci_rx.c
@@ -23,24 +23,23 @@ struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev, __u32 seqnum)
                 urb = priv->urb;
                 status = urb->status;
 
-                usbip_dbg_vhci_rx("find urb %p vurb %p seqnum %u\n",
-                                urb, priv, seqnum);
+                usbip_dbg_vhci_rx("find urb seqnum %u\n", seqnum);
 
                 switch (status) {
                 case -ENOENT:
                         /* fall through */
                 case -ECONNRESET:
-                        dev_info(&urb->dev->dev,
-                                 "urb %p was unlinked %ssynchronuously.\n", urb,
-                                 status == -ENOENT ? "" : "a");
+                        dev_dbg(&urb->dev->dev,
+                                 "urb seq# %u was unlinked %ssynchronuously\n",
+                                 seqnum, status == -ENOENT ? "" : "a");
                         break;
                 case -EINPROGRESS:
                         /* no info output */
                         break;
                 default:
-                        dev_info(&urb->dev->dev,
-                                 "urb %p may be in a error, status %d\n", urb,
-                                 status);
+                        dev_dbg(&urb->dev->dev,
+                                 "urb seq# %u may be in a error, status %d\n",
+                                 seqnum, status);
                 }
 
                 list_del(&priv->list);
@@ -67,8 +66,8 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
         spin_unlock_irqrestore(&vdev->priv_lock, flags);
 
         if (!urb) {
-                pr_err("cannot find a urb of seqnum %u\n", pdu->base.seqnum);
-                pr_info("max seqnum %d\n",
+                pr_err("cannot find a urb of seqnum %u max seqnum %d\n",
+                        pdu->base.seqnum,
                         atomic_read(&vhci_hcd->seqnum));
                 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
                 return;
@@ -91,7 +90,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
         if (usbip_dbg_flag_vhci_rx)
                 usbip_dump_urb(urb);
 
-        usbip_dbg_vhci_rx("now giveback urb %p\n", urb);
+        usbip_dbg_vhci_rx("now giveback urb %u\n", pdu->base.seqnum);
 
         spin_lock_irqsave(&vhci->lock, flags);
         usb_hcd_unlink_urb_from_ep(vhci_hcd_to_hcd(vhci_hcd), urb);
@@ -158,7 +157,7 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev,
                 pr_info("the urb (seqnum %d) was already given back\n",
                         pdu->base.seqnum);
         } else {
-                usbip_dbg_vhci_rx("now giveback urb %p\n", urb);
+                usbip_dbg_vhci_rx("now giveback urb %d\n", pdu->base.seqnum);
 
                 /* If unlink is successful, status is -ECONNRESET */
                 urb->status = pdu->u.ret_unlink.status;
diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c
index e78f7472cac4..091f76b7196d 100644
--- a/drivers/usb/usbip/vhci_sysfs.c
+++ b/drivers/usb/usbip/vhci_sysfs.c
@@ -17,15 +17,20 @@
 
 /*
  * output example:
- * hub port sta spd dev      socket           local_busid
- * hs  0000 004 000 00000000         c5a7bb80 1-2.3
+ * hub port sta spd dev       sockfd    local_busid
+ * hs  0000 004 000 00000000  3         1-2.3
  * ................................................
- * ss  0008 004 000 00000000         d8cee980 2-3.4
+ * ss  0008 004 000 00000000  4         2-3.4
  * ................................................
  *
- * IP address can be retrieved from a socket pointer address by looking
- * up /proc/net/{tcp,tcp6}. Also, a userland program may remember a
- * port number and its peer IP address.
+ * Output includes socket fd instead of socket pointer address to avoid
+ * leaking kernel memory address in:
+ *      /sys/devices/platform/vhci_hcd.0/status and in debug output.
+ * The socket pointer address is not used at the moment and it was made
+ * visible as a convenient way to find IP address from socket pointer
+ * address by looking up /proc/net/{tcp,tcp6}. As this opens a security
+ * hole, the change is made to use sockfd instead.
+ *
  */
 static void port_show_vhci(char **out, int hub, int port, struct vhci_device *vdev)
 {
@@ -39,8 +44,8 @@ static void port_show_vhci(char **out, int hub, int port, struct vhci_device *vd
         if (vdev->ud.status == VDEV_ST_USED) {
                 *out += sprintf(*out, "%03u %08x ",
                                       vdev->speed, vdev->devid);
-                *out += sprintf(*out, "%16p %s",
-                                      vdev->ud.tcp_socket,
+                *out += sprintf(*out, "%u %s",
+                                      vdev->ud.sockfd,
                                       dev_name(&vdev->udev->dev));
 
         } else {
@@ -160,7 +165,8 @@ static ssize_t nports_show(struct device *dev, struct device_attribute *attr,
         char *s = out;
 
         /*
-         * Half the ports are for SPEED_HIGH and half for SPEED_SUPER, thus the * 2.
+         * Half the ports are for SPEED_HIGH and half for SPEED_SUPER,
+         * thus the * 2.
          */
         out += sprintf(out, "%d\n", VHCI_PORTS * vhci_num_controllers);
         return out - s;
@@ -366,6 +372,7 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr,
 
         vdev->devid         = devid;
         vdev->speed         = speed;
+        vdev->ud.sockfd     = sockfd;
         vdev->ud.tcp_socket = socket;
         vdev->ud.status     = VDEV_ST_NOTASSIGNED;
 
diff --git a/drivers/usb/usbip/vhci_tx.c b/drivers/usb/usbip/vhci_tx.c
index d625a2ff4b71..9aed15a358b7 100644
--- a/drivers/usb/usbip/vhci_tx.c
+++ b/drivers/usb/usbip/vhci_tx.c
@@ -69,7 +69,8 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev)
                 memset(&msg, 0, sizeof(msg));
                 memset(&iov, 0, sizeof(iov));
 
-                usbip_dbg_vhci_tx("setup txdata urb %p\n", urb);
+                usbip_dbg_vhci_tx("setup txdata urb seqnum %lu\n",
+                                  priv->seqnum);
 
                 /* 1. setup usbip_header */
                 setup_cmd_submit_pdu(&pdu_header, urb);
diff --git a/drivers/usb/usbip/vudc_rx.c b/drivers/usb/usbip/vudc_rx.c
index df1e30989148..1e8a23d92cb4 100644
--- a/drivers/usb/usbip/vudc_rx.c
+++ b/drivers/usb/usbip/vudc_rx.c
@@ -120,6 +120,25 @@ static int v_recv_cmd_submit(struct vudc *udc,
         urb_p->new = 1;
         urb_p->seqnum = pdu->base.seqnum;
 
+        if (urb_p->ep->type == USB_ENDPOINT_XFER_ISOC) {
+                /* validate packet size and number of packets */
+                unsigned int maxp, packets, bytes;
+
+                maxp = usb_endpoint_maxp(urb_p->ep->desc);
+                maxp *= usb_endpoint_maxp_mult(urb_p->ep->desc);
+                bytes = pdu->u.cmd_submit.transfer_buffer_length;
+                packets = DIV_ROUND_UP(bytes, maxp);
+
+                if (pdu->u.cmd_submit.number_of_packets < 0 ||
+                    pdu->u.cmd_submit.number_of_packets > packets) {
+                        dev_err(&udc->gadget.dev,
+                                "CMD_SUBMIT: isoc invalid num packets %d\n",
+                                pdu->u.cmd_submit.number_of_packets);
+                        ret = -EMSGSIZE;
+                        goto free_urbp;
+                }
+        }
+
         ret = alloc_urb_from_cmd(&urb_p->urb, pdu, urb_p->ep->type);
         if (ret) {
                 usbip_event_add(&udc->ud, VUDC_EVENT_ERROR_MALLOC);
diff --git a/drivers/usb/usbip/vudc_tx.c b/drivers/usb/usbip/vudc_tx.c
index 1440ae0919ec..3ccb17c3e840 100644
--- a/drivers/usb/usbip/vudc_tx.c
+++ b/drivers/usb/usbip/vudc_tx.c
@@ -85,6 +85,13 @@ static int v_send_ret_submit(struct vudc *udc, struct urbp *urb_p)
         memset(&pdu_header, 0, sizeof(pdu_header));
         memset(&msg, 0, sizeof(msg));
 
+        if (urb->actual_length > 0 && !urb->transfer_buffer) {
+                dev_err(&udc->gadget.dev,
+                        "urb: actual_length %d transfer_buffer null\n",
+                        urb->actual_length);
+                return -1;
+        }
+
         if (urb_p->type == USB_ENDPOINT_XFER_ISOC)
                 iovnum = 2 + urb->number_of_packets;
         else
@@ -100,8 +107,8 @@ static int v_send_ret_submit(struct vudc *udc, struct urbp *urb_p)
 
         /* 1. setup usbip_header */
         setup_ret_submit_pdu(&pdu_header, urb_p);
-        usbip_dbg_stub_tx("setup txdata seqnum: %d urb: %p\n",
-                          pdu_header.base.seqnum, urb);
+        usbip_dbg_stub_tx("setup txdata seqnum: %d\n",
+                          pdu_header.base.seqnum);
         usbip_header_correct_endian(&pdu_header, 1);
 
         iov[iovnum].iov_base = &pdu_header;
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 8d626d7c2e7e..c7bdeb655646 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -778,16 +778,6 @@ static void handle_rx(struct vhost_net *net)
                 /* On error, stop handling until the next kick. */
                 if (unlikely(headcount < 0))
                         goto out;
-                if (nvq->rx_array)
-                        msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
-                /* On overrun, truncate and discard */
-                if (unlikely(headcount > UIO_MAXIOV)) {
-                        iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
-                        err = sock->ops->recvmsg(sock, &msg,
-                                                 1, MSG_DONTWAIT | MSG_TRUNC);
-                        pr_debug("Discarded rx packet: len %zd\n", sock_len);
-                        continue;
-                }
                 /* OK, now we need to know about added descriptors. */
                 if (!headcount) {
                         if (unlikely(vhost_enable_notify(&net->dev, vq))) {
@@ -800,6 +790,16 @@ static void handle_rx(struct vhost_net *net)
                          * they refilled. */
                         goto out;
                 }
+                if (nvq->rx_array)
+                        msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
+                /* On overrun, truncate and discard */
+                if (unlikely(headcount > UIO_MAXIOV)) {
+                        iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
+                        err = sock->ops->recvmsg(sock, &msg,
+                                                 1, MSG_DONTWAIT | MSG_TRUNC);
+                        pr_debug("Discarded rx packet: len %zd\n", sock_len);
+                        continue;
+                }
                 /* We don't need to be notified again. */
                 iov_iter_init(&msg.msg_iter, READ, vq->iov, in, vhost_len);
                 fixup = msg.msg_iter;
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 33ac2b186b85..5727b186b3ca 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -904,7 +904,7 @@ static void vhost_dev_lock_vqs(struct vhost_dev *d)
 {
         int i = 0;
         for (i = 0; i < d->nvqs; ++i)
-                mutex_lock(&d->vqs[i]->mutex);
+                mutex_lock_nested(&d->vqs[i]->mutex, i);
 }
 
 static void vhost_dev_unlock_vqs(struct vhost_dev *d)
@@ -1015,6 +1015,10 @@ static int vhost_process_iotlb_msg(struct vhost_dev *dev,
                 vhost_iotlb_notify_vq(dev, msg);
                 break;
         case VHOST_IOTLB_INVALIDATE:
+                if (!dev->iotlb) {
+                        ret = -EFAULT;
+                        break;
+                }
                 vhost_vq_meta_reset(dev);
                 vhost_del_umem_range(dev->iotlb, msg->iova,
                                      msg->iova + msg->size - 1);
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index 48230a5e12f2..bf7ff3934d7f 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -333,6 +333,8 @@ int register_virtio_device(struct virtio_device *dev)
         /* device_register() causes the bus infrastructure to look for a
          * matching driver. */
         err = device_register(&dev->dev);
+        if (err)
+                ida_simple_remove(&virtio_index_ida, dev->index);
 out:
         if (err)
                 virtio_add_status(dev, VIRTIO_CONFIG_S_FAILED);
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 7960746f7597..a1fb52cb3f0a 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -174,13 +174,12 @@ static unsigned fill_balloon(struct virtio_balloon *vb, size_t num)
         while ((page = balloon_page_pop(&pages))) {
                 balloon_page_enqueue(&vb->vb_dev_info, page);
 
-                vb->num_pfns += VIRTIO_BALLOON_PAGES_PER_PAGE;
-
                 set_page_pfns(vb, vb->pfns + vb->num_pfns, page);
                 vb->num_pages += VIRTIO_BALLOON_PAGES_PER_PAGE;
                 if (!virtio_has_feature(vb->vdev,
                                         VIRTIO_BALLOON_F_DEFLATE_ON_OOM))
                         adjust_managed_page_count(page, -1);
+                vb->num_pfns += VIRTIO_BALLOON_PAGES_PER_PAGE;
         }
 
         num_allocated_pages = vb->num_pfns;
diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
index 74dc7170fd35..c92131edfaba 100644
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -493,7 +493,16 @@ static const struct virtio_config_ops virtio_mmio_config_ops = {
 };
 
 
-static void virtio_mmio_release_dev_empty(struct device *_d) {}
+static void virtio_mmio_release_dev(struct device *_d)
+{
+        struct virtio_device *vdev =
+                        container_of(_d, struct virtio_device, dev);
+        struct virtio_mmio_device *vm_dev =
+                        container_of(vdev, struct virtio_mmio_device, vdev);
+        struct platform_device *pdev = vm_dev->pdev;
+
+        devm_kfree(&pdev->dev, vm_dev);
+}
 
 /* Platform device */
 
@@ -514,10 +523,10 @@ static int virtio_mmio_probe(struct platform_device *pdev)
 
         vm_dev = devm_kzalloc(&pdev->dev, sizeof(*vm_dev), GFP_KERNEL);
         if (!vm_dev)
-                return  -ENOMEM;
+                return -ENOMEM;
 
         vm_dev->vdev.dev.parent = &pdev->dev;
-        vm_dev->vdev.dev.release = virtio_mmio_release_dev_empty;
+        vm_dev->vdev.dev.release = virtio_mmio_release_dev;
         vm_dev->vdev.config = &virtio_mmio_config_ops;
         vm_dev->pdev = pdev;
         INIT_LIST_HEAD(&vm_dev->virtqueues);
@@ -573,13 +582,16 @@ static int virtio_mmio_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, vm_dev);
 
-        return register_virtio_device(&vm_dev->vdev);
+        rc = register_virtio_device(&vm_dev->vdev);
+        if (rc)
+                put_device(&vm_dev->vdev.dev);
+
+        return rc;
 }
 
 static int virtio_mmio_remove(struct platform_device *pdev)
 {
         struct virtio_mmio_device *vm_dev = platform_get_drvdata(pdev);
-
         unregister_virtio_device(&vm_dev->vdev);
 
         return 0;
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index d8dd54678ab7..e5d0c28372ea 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -269,7 +269,7 @@ config XEN_ACPI_HOTPLUG_CPU
 
 config XEN_ACPI_PROCESSOR
         tristate "Xen ACPI processor"
-        depends on XEN && X86 && ACPI_PROCESSOR && CPU_FREQ
+        depends on XEN && XEN_DOM0 && X86 && ACPI_PROCESSOR && CPU_FREQ
         default m
         help
           This ACPI processor uploads Power Management information to the Xen
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index f77e499afddd..065f0b607373 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -257,10 +257,25 @@ static void release_memory_resource(struct resource *resource)
         kfree(resource);
 }
 
+/*
+ * Host memory not allocated to dom0. We can use this range for hotplug-based
+ * ballooning.
+ *
+ * It's a type-less resource. Setting IORESOURCE_MEM will make resource
+ * management algorithms (arch_remove_reservations()) look into guest e820,
+ * which we don't want.
+ */
+static struct resource hostmem_resource = {
+        .name   = "Host RAM",
+};
+
+void __attribute__((weak)) __init arch_xen_balloon_init(struct resource *res)
+{}
+
 static struct resource *additional_memory_resource(phys_addr_t size)
 {
-        struct resource *res;
-        int ret;
+        struct resource *res, *res_hostmem;
+        int ret = -ENOMEM;
 
         res = kzalloc(sizeof(*res), GFP_KERNEL);
         if (!res)
@@ -269,13 +284,42 @@ static struct resource *additional_memory_resource(phys_addr_t size)
         res->name = "System RAM";
         res->flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
 
-        ret = allocate_resource(&iomem_resource, res,
-                                size, 0, -1,
-                                PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
-        if (ret < 0) {
-                pr_err("Cannot allocate new System RAM resource\n");
-                kfree(res);
-                return NULL;
+        res_hostmem = kzalloc(sizeof(*res), GFP_KERNEL);
+        if (res_hostmem) {
+                /* Try to grab a range from hostmem */
+                res_hostmem->name = "Host memory";
+                ret = allocate_resource(&hostmem_resource, res_hostmem,
+                                        size, 0, -1,
+                                        PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
+        }
+
+        if (!ret) {
+                /*
+                 * Insert this resource into iomem. Because hostmem_resource
+                 * tracks portion of guest e820 marked as UNUSABLE noone else
+                 * should try to use it.
+                 */
+                res->start = res_hostmem->start;
+                res->end = res_hostmem->end;
+                ret = insert_resource(&iomem_resource, res);
+                if (ret < 0) {
+                        pr_err("Can't insert iomem_resource [%llx - %llx]\n",
+                                res->start, res->end);
+                        release_memory_resource(res_hostmem);
+                        res_hostmem = NULL;
+                        res->start = res->end = 0;
+                }
+        }
+
+        if (ret) {
+                ret = allocate_resource(&iomem_resource, res,
+                                        size, 0, -1,
+                                        PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
+                if (ret < 0) {
+                        pr_err("Cannot allocate new System RAM resource\n");
+                        kfree(res);
+                        return NULL;
+                }
         }
 
 #ifdef CONFIG_SPARSEMEM
@@ -287,6 +331,7 @@ static struct resource *additional_memory_resource(phys_addr_t size)
                         pr_err("New System RAM resource outside addressable RAM (%lu > %lu)\n",
                                pfn, limit);
                         release_memory_resource(res);
+                        release_memory_resource(res_hostmem);
                         return NULL;
                 }
         }
@@ -765,6 +810,8 @@ static int __init balloon_init(void)
         set_online_page_callback(&xen_online_page);
         register_memory_notifier(&xen_memory_nb);
         register_sysctl_table(xen_root);
+
+        arch_xen_balloon_init(&hostmem_resource);
 #endif
 
 #ifdef CONFIG_XEN_PV
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 57efbd3b053b..bd56653b9bbc 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -380,10 +380,8 @@ static int unmap_grant_pages(struct grant_map *map, int offset, int pages)
                 }
                 range = 0;
                 while (range < pages) {
-                        if (map->unmap_ops[offset+range].handle == -1) {
-                                range--;
+                        if (map->unmap_ops[offset+range].handle == -1)
                                 break;
-                        }
                         range++;
                 }
                 err = __unmap_grant_pages(map, offset, range);
@@ -1073,8 +1071,10 @@ unlock_out:
 out_unlock_put:
         mutex_unlock(&priv->lock);
 out_put_map:
-        if (use_ptemod)
+        if (use_ptemod) {
                 map->vma = NULL;
+                unmap_grant_pages(map, 0, map->count);
+        }
         gntdev_put_map(priv, map);
         return err;
 }
diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
index 40caa92bff33..4c789e61554b 100644
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@ -805,7 +805,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                 pvcalls_exit();
                 return ret;
         }
-        map2 = kzalloc(sizeof(*map2), GFP_KERNEL);
+        map2 = kzalloc(sizeof(*map2), GFP_ATOMIC);
         if (map2 == NULL) {
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
@@ -1103,7 +1103,7 @@ static int pvcalls_front_remove(struct xenbus_device *dev)
                         kfree(map);
                 }
         }
-        if (bedata->ref >= 0)
+        if (bedata->ref != -1)
                 gnttab_end_foreign_access(bedata->ref, 0, 0);
         kfree(bedata->ring.sring);
         kfree(bedata);
@@ -1128,6 +1128,8 @@ static int pvcalls_front_probe(struct xenbus_device *dev,
         }
 
         versions = xenbus_read(XBT_NIL, dev->otherend, "versions", &len);
+        if (IS_ERR(versions))
+                return PTR_ERR(versions);
         if (!len)
                 return -EINVAL;
         if (strcmp(versions, "1")) {
diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index ff8d5bf4354f..23c7f395d718 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -895,20 +895,38 @@ error:
  * However, if we didn't have a callback promise outstanding, or it was
  * outstanding on a different server, then it won't break it either...
  */
-static int afs_dir_remove_link(struct dentry *dentry, struct key *key)
+static int afs_dir_remove_link(struct dentry *dentry, struct key *key,
+                               unsigned long d_version_before,
+                               unsigned long d_version_after)
 {
+        bool dir_valid;
         int ret = 0;
 
+        /* There were no intervening changes on the server if the version
+         * number we got back was incremented by exactly 1.
+         */
+        dir_valid = (d_version_after == d_version_before + 1);
+
         if (d_really_is_positive(dentry)) {
                 struct afs_vnode *vnode = AFS_FS_I(d_inode(dentry));
 
-                if (test_bit(AFS_VNODE_DELETED, &vnode->flags))
-                        kdebug("AFS_VNODE_DELETED");
-                clear_bit(AFS_VNODE_CB_PROMISED, &vnode->flags);
-
-                ret = afs_validate(vnode, key);
-                if (ret == -ESTALE)
+                if (dir_valid) {
+                        drop_nlink(&vnode->vfs_inode);
+                        if (vnode->vfs_inode.i_nlink == 0) {
+                                set_bit(AFS_VNODE_DELETED, &vnode->flags);
+                                clear_bit(AFS_VNODE_CB_PROMISED, &vnode->flags);
+                        }
                         ret = 0;
+                } else {
+                        clear_bit(AFS_VNODE_CB_PROMISED, &vnode->flags);
+
+                        if (test_bit(AFS_VNODE_DELETED, &vnode->flags))
+                                kdebug("AFS_VNODE_DELETED");
+
+                        ret = afs_validate(vnode, key);
+                        if (ret == -ESTALE)
+                                ret = 0;
+                }
                 _debug("nlink %d [val %d]", vnode->vfs_inode.i_nlink, ret);
         }
 
@@ -923,6 +941,7 @@ static int afs_unlink(struct inode *dir, struct dentry *dentry)
         struct afs_fs_cursor fc;
         struct afs_vnode *dvnode = AFS_FS_I(dir), *vnode;
         struct key *key;
+        unsigned long d_version = (unsigned long)dentry->d_fsdata;
         int ret;
 
         _enter("{%x:%u},{%pd}",
@@ -955,7 +974,9 @@ static int afs_unlink(struct inode *dir, struct dentry *dentry)
                 afs_vnode_commit_status(&fc, dvnode, fc.cb_break);
                 ret = afs_end_vnode_operation(&fc);
                 if (ret == 0)
-                        ret = afs_dir_remove_link(dentry, key);
+                        ret = afs_dir_remove_link(
+                                dentry, key, d_version,
+                                (unsigned long)dvnode->status.data_version);
         }
 
 error_key:
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index 3415eb7484f6..1e81864ef0b2 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -377,6 +377,10 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
         }
 
         read_sequnlock_excl(&vnode->cb_lock);
+
+        if (test_bit(AFS_VNODE_DELETED, &vnode->flags))
+                clear_nlink(&vnode->vfs_inode);
+
         if (valid)
                 goto valid;
 
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index ea1460b9b71a..e1126659f043 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -885,7 +885,7 @@ int afs_extract_data(struct afs_call *call, void *buf, size_t count,
 {
         struct afs_net *net = call->net;
         enum afs_call_state state;
-        u32 remote_abort;
+        u32 remote_abort = 0;
         int ret;
 
         _enter("{%s,%zu},,%zu,%d",
diff --git a/fs/afs/write.c b/fs/afs/write.c
index cb5f8a3df577..9370e2feb999 100644
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -198,7 +198,7 @@ int afs_write_end(struct file *file, struct address_space *mapping,
                         ret = afs_fill_page(vnode, key, pos + copied,
                                             len - copied, page);
                         if (ret < 0)
-                                return ret;
+                                goto out;
                 }
                 SetPageUptodate(page);
         }
@@ -206,10 +206,12 @@ int afs_write_end(struct file *file, struct address_space *mapping,
         set_page_dirty(page);
         if (PageDirty(page))
                 _debug("dirtied");
+        ret = copied;
+
+out:
         unlock_page(page);
         put_page(page);
-
-        return copied;
+        return ret;
 }
 
 /*
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index 8fc41705c7cd..961a12dc6dc8 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -170,7 +170,6 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
 
         mutex_unlock(&sbi->wq_mutex);
 
-        if (autofs4_write(sbi, pipe, &pkt, pktsz))
         switch (ret = autofs4_write(sbi, pipe, &pkt, pktsz)) {
         case 0:
                 break;
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 531e0a8645b0..1e74cf826532 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1032,14 +1032,17 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
                      root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) &&
                     !(flags & BTRFS_BLOCK_FLAG_FULL_BACKREF)) {
                         ret = btrfs_inc_ref(trans, root, buf, 1);
-                        BUG_ON(ret); /* -ENOMEM */
+                        if (ret)
+                                return ret;
 
                         if (root->root_key.objectid ==
                             BTRFS_TREE_RELOC_OBJECTID) {
                                 ret = btrfs_dec_ref(trans, root, buf, 0);
-                                BUG_ON(ret); /* -ENOMEM */
+                                if (ret)
+                                        return ret;
                                 ret = btrfs_inc_ref(trans, root, cow, 1);
-                                BUG_ON(ret); /* -ENOMEM */
+                                if (ret)
+                                        return ret;
                         }
                         new_flags |= BTRFS_BLOCK_FLAG_FULL_BACKREF;
                 } else {
@@ -1049,7 +1052,8 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
                                 ret = btrfs_inc_ref(trans, root, cow, 1);
                         else
                                 ret = btrfs_inc_ref(trans, root, cow, 0);
-                        BUG_ON(ret); /* -ENOMEM */
+                        if (ret)
+                                return ret;
                 }
                 if (new_flags != 0) {
                         int level = btrfs_header_level(buf);
@@ -1068,9 +1072,11 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
                                 ret = btrfs_inc_ref(trans, root, cow, 1);
                         else
                                 ret = btrfs_inc_ref(trans, root, cow, 0);
-                        BUG_ON(ret); /* -ENOMEM */
+                        if (ret)
+                                return ret;
                         ret = btrfs_dec_ref(trans, root, buf, 1);
-                        BUG_ON(ret); /* -ENOMEM */
+                        if (ret)
+                                return ret;
                 }
                 clean_tree_block(fs_info, buf);
                 *last_ref = 1;
diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index 5d73f79ded8b..a6226cd6063c 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -87,6 +87,7 @@ static struct btrfs_delayed_node *btrfs_get_delayed_node(
 
         spin_lock(&root->inode_lock);
         node = radix_tree_lookup(&root->delayed_nodes_tree, ino);
+
         if (node) {
                 if (btrfs_inode->delayed_node) {
                         refcount_inc(&node->refs);      /* can be accessed */
@@ -94,9 +95,30 @@ static struct btrfs_delayed_node *btrfs_get_delayed_node(
                         spin_unlock(&root->inode_lock);
                         return node;
                 }
-                btrfs_inode->delayed_node = node;
-                /* can be accessed and cached in the inode */
-                refcount_add(2, &node->refs);
+
+                /*
+                 * It's possible that we're racing into the middle of removing
+                 * this node from the radix tree.  In this case, the refcount
+                 * was zero and it should never go back to one.  Just return
+                 * NULL like it was never in the radix at all; our release
+                 * function is in the process of removing it.
+                 *
+                 * Some implementations of refcount_inc refuse to bump the
+                 * refcount once it has hit zero.  If we don't do this dance
+                 * here, refcount_inc() may decide to just WARN_ONCE() instead
+                 * of actually bumping the refcount.
+                 *
+                 * If this node is properly in the radix, we want to bump the
+                 * refcount twice, once for the inode and once for this get
+                 * operation.
+                 */
+                if (refcount_inc_not_zero(&node->refs)) {
+                        refcount_inc(&node->refs);
+                        btrfs_inode->delayed_node = node;
+                } else {
+                        node = NULL;
+                }
+
                 spin_unlock(&root->inode_lock);
                 return node;
         }
@@ -254,17 +276,18 @@ static void __btrfs_release_delayed_node(
         mutex_unlock(&delayed_node->mutex);
 
         if (refcount_dec_and_test(&delayed_node->refs)) {
-                bool free = false;
                 struct btrfs_root *root = delayed_node->root;
+
                 spin_lock(&root->inode_lock);
-                if (refcount_read(&delayed_node->refs) == 0) {
-                        radix_tree_delete(&root->delayed_nodes_tree,
-                                          delayed_node->inode_id);
-                        free = true;
-                }
+                /*
+                 * Once our refcount goes to zero, nobody is allowed to bump it
+                 * back up.  We can delete it now.
+                 */
+                ASSERT(refcount_read(&delayed_node->refs) == 0);
+                radix_tree_delete(&root->delayed_nodes_tree,
+                                  delayed_node->inode_id);
                 spin_unlock(&root->inode_lock);
-                if (free)
-                        kmem_cache_free(delayed_node_cache, delayed_node);
+                kmem_cache_free(delayed_node_cache, delayed_node);
         }
 }
 
@@ -1610,28 +1633,18 @@ void btrfs_readdir_put_delayed_items(struct inode *inode,
 int btrfs_should_delete_dir_index(struct list_head *del_list,
                                   u64 index)
 {
-        struct btrfs_delayed_item *curr, *next;
-        int ret;
-
-        if (list_empty(del_list))
-                return 0;
+        struct btrfs_delayed_item *curr;
+        int ret = 0;
 
-        list_for_each_entry_safe(curr, next, del_list, readdir_list) {
+        list_for_each_entry(curr, del_list, readdir_list) {
                 if (curr->key.offset > index)
                         break;
-
-                list_del(&curr->readdir_list);
-                ret = (curr->key.offset == index);
-
-                if (refcount_dec_and_test(&curr->refs))
-                        kfree(curr);
-
-                if (ret)
-                        return 1;
-                else
-                        continue;
+                if (curr->key.offset == index) {
+                        ret = 1;
+                        break;
+                }
         }
-        return 0;
+        return ret;
 }
 
 /*
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 10a2a579cc7f..a8ecccfc36de 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3231,6 +3231,7 @@ static int write_dev_supers(struct btrfs_device *device,
         int errors = 0;
         u32 crc;
         u64 bytenr;
+        int op_flags;
 
         if (max_mirrors == 0)
                 max_mirrors = BTRFS_SUPER_MIRROR_MAX;
@@ -3273,13 +3274,10 @@ static int write_dev_supers(struct btrfs_device *device,
                  * we fua the first super.  The others we allow
                  * to go down lazy.
                  */
-                if (i == 0) {
-                        ret = btrfsic_submit_bh(REQ_OP_WRITE,
-                                REQ_SYNC | REQ_FUA | REQ_META | REQ_PRIO, bh);
-                } else {
-                        ret = btrfsic_submit_bh(REQ_OP_WRITE,
-                                REQ_SYNC | REQ_META | REQ_PRIO, bh);
-                }
+                op_flags = REQ_SYNC | REQ_META | REQ_PRIO;
+                if (i == 0 && !btrfs_test_opt(device->fs_info, NOBARRIER))
+                        op_flags |= REQ_FUA;
+                ret = btrfsic_submit_bh(REQ_OP_WRITE, op_flags, bh);
                 if (ret)
                         errors++;
         }
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 4497f937e8fb..2f4328511ac8 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -9206,6 +9206,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
         ret = btrfs_del_root(trans, fs_info, &root->root_key);
         if (ret) {
                 btrfs_abort_transaction(trans, ret);
+                err = ret;
                 goto out_end_trans;
         }
 
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 993061f83067..e1a7f3cb5be9 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3005,6 +3005,8 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent)
                 compress_type = ordered_extent->compress_type;
         if (test_bit(BTRFS_ORDERED_PREALLOC, &ordered_extent->flags)) {
                 BUG_ON(compress_type);
+                btrfs_qgroup_free_data(inode, NULL, ordered_extent->file_offset,
+                                       ordered_extent->len);
                 ret = btrfs_mark_extent_written(trans, BTRFS_I(inode),
                                                 ordered_extent->file_offset,
                                                 ordered_extent->file_offset +
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index d748ad1c3620..2ef8acaac688 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2206,7 +2206,7 @@ static noinline int btrfs_search_path_in_tree(struct btrfs_fs_info *info,
         if (!path)
                 return -ENOMEM;
 
-        ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX];
+        ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX - 1];
 
         key.objectid = tree_id;
         key.type = BTRFS_ROOT_ITEM_KEY;
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 49810b70afd3..a25684287501 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -237,7 +237,6 @@ static struct btrfs_device *__alloc_device(void)
                 kfree(dev);
                 return ERR_PTR(-ENOMEM);
         }
-        bio_get(dev->flush_bio);
 
         INIT_LIST_HEAD(&dev->dev_list);
         INIT_LIST_HEAD(&dev->dev_alloc_list);
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index ab69dcb70e8a..1b468250e947 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1440,6 +1440,29 @@ static int __close_session(struct ceph_mds_client *mdsc,
         return request_close_session(mdsc, session);
 }
 
+static bool drop_negative_children(struct dentry *dentry)
+{
+        struct dentry *child;
+        bool all_negative = true;
+
+        if (!d_is_dir(dentry))
+                goto out;
+
+        spin_lock(&dentry->d_lock);
+        list_for_each_entry(child, &dentry->d_subdirs, d_child) {
+                if (d_really_is_positive(child)) {
+                        all_negative = false;
+                        break;
+                }
+        }
+        spin_unlock(&dentry->d_lock);
+
+        if (all_negative)
+                shrink_dcache_parent(dentry);
+out:
+        return all_negative;
+}
+
 /*
  * Trim old(er) caps.
  *
@@ -1490,16 +1513,27 @@ static int trim_caps_cb(struct inode *inode, struct ceph_cap *cap, void *arg)
         if ((used | wanted) & ~oissued & mine)
                 goto out;   /* we need these caps */
 
-        session->s_trim_caps--;
         if (oissued) {
                 /* we aren't the only cap.. just remove us */
                 __ceph_remove_cap(cap, true);
+                session->s_trim_caps--;
         } else {
+                struct dentry *dentry;
                 /* try dropping referring dentries */
                 spin_unlock(&ci->i_ceph_lock);
-                d_prune_aliases(inode);
-                dout("trim_caps_cb %p cap %p  pruned, count now %d\n",
-                     inode, cap, atomic_read(&inode->i_count));
+                dentry = d_find_any_alias(inode);
+                if (dentry && drop_negative_children(dentry)) {
+                        int count;
+                        dput(dentry);
+                        d_prune_aliases(inode);
+                        count = atomic_read(&inode->i_count);
+                        if (count == 1)
+                                session->s_trim_caps--;
+                        dout("trim_caps_cb %p cap %p pruned, count now %d\n",
+                             inode, cap, count);
+                } else {
+                        dput(dentry);
+                }
                 return 0;
         }
 
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index e06740436b92..ed88ab8a4774 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -1406,7 +1406,8 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses,
         } while (rc == -EAGAIN);
 
         if (rc) {
-                cifs_dbg(VFS, "ioctl error in smb2_get_dfs_refer rc=%d\n", rc);
+                if (rc != -ENOENT)
+                        cifs_dbg(VFS, "ioctl error in smb2_get_dfs_refer rc=%d\n", rc);
                 goto out;
         }
 
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 5331631386a2..01346b8b6edb 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2678,27 +2678,27 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
         cifs_small_buf_release(req);
 
         rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;
-        shdr = get_sync_hdr(rsp);
 
-        if (shdr->Status == STATUS_END_OF_FILE) {
+        if (rc) {
+                if (rc != -ENODATA) {
+                        cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
+                        cifs_dbg(VFS, "Send error in read = %d\n", rc);
+                }
                 free_rsp_buf(resp_buftype, rsp_iov.iov_base);
-                return 0;
+                return rc == -ENODATA ? 0 : rc;
         }
 
-        if (rc) {
-                cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
-                cifs_dbg(VFS, "Send error in read = %d\n", rc);
-        } else {
-                *nbytes = le32_to_cpu(rsp->DataLength);
-                if ((*nbytes > CIFS_MAX_MSGSIZE) ||
-                    (*nbytes > io_parms->length)) {
-                        cifs_dbg(FYI, "bad length %d for count %d\n",
-                                 *nbytes, io_parms->length);
-                        rc = -EIO;
-                        *nbytes = 0;
-                }
+        *nbytes = le32_to_cpu(rsp->DataLength);
+        if ((*nbytes > CIFS_MAX_MSGSIZE) ||
+            (*nbytes > io_parms->length)) {
+                cifs_dbg(FYI, "bad length %d for count %d\n",
+                         *nbytes, io_parms->length);
+                rc = -EIO;
+                *nbytes = 0;
         }
 
+        shdr = get_sync_hdr(rsp);
+
         if (*buf) {
                 memcpy(*buf, (char *)shdr + rsp->DataOffset, *nbytes);
                 free_rsp_buf(resp_buftype, rsp_iov.iov_base);
diff --git a/fs/cramfs/Kconfig b/fs/cramfs/Kconfig
index f937082f3244..58e2fe40b2a0 100644
--- a/fs/cramfs/Kconfig
+++ b/fs/cramfs/Kconfig
@@ -34,6 +34,7 @@ config CRAMFS_BLOCKDEV
 config CRAMFS_MTD
         bool "Support CramFs image directly mapped in physical memory"
         depends on CRAMFS && MTD
+        depends on CRAMFS=m || MTD=y
         default y if !CRAMFS_BLOCKDEV
         help
           This option allows the CramFs driver to load data directly from
diff --git a/fs/dax.c b/fs/dax.c
index 78b72c48374e..95981591977a 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -627,8 +627,7 @@ static void dax_mapping_entry_mkclean(struct address_space *mapping,
 
                         if (pfn != pmd_pfn(*pmdp))
                                 goto unlock_pmd;
-                        if (!pmd_dirty(*pmdp)
-                                        && !pmd_access_permitted(*pmdp, WRITE))
+                        if (!pmd_dirty(*pmdp) && !pmd_write(*pmdp))
                                 goto unlock_pmd;
 
                         flush_cache_page(vma, address, pfn);
diff --git a/fs/exec.c b/fs/exec.c
index 6be2aa0ab26f..7eb8d21bcab9 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1216,15 +1216,14 @@ killed:
         return -EAGAIN;
 }
 
-char *get_task_comm(char *buf, struct task_struct *tsk)
+char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk)
 {
-        /* buf must be at least sizeof(tsk->comm) in size */
         task_lock(tsk);
-        strncpy(buf, tsk->comm, sizeof(tsk->comm));
+        strncpy(buf, tsk->comm, buf_size);
         task_unlock(tsk);
         return buf;
 }
-EXPORT_SYMBOL_GPL(get_task_comm);
+EXPORT_SYMBOL_GPL(__get_task_comm);
 
 /*
  * These functions flushes out all traces of the currently running executable
@@ -1340,24 +1339,24 @@ void setup_new_exec(struct linux_binprm * bprm)
                  * avoid bad behavior from the prior rlimits. This has to
                  * happen before arch_pick_mmap_layout(), which examines
                  * RLIMIT_STACK, but after the point of no return to avoid
-                 * races from other threads changing the limits. This also
-                 * must be protected from races with prlimit() calls.
+                 * needing to clean up the change on failure.
                  */
-                task_lock(current->group_leader);
                 if (current->signal->rlim[RLIMIT_STACK].rlim_cur > _STK_LIM)
                         current->signal->rlim[RLIMIT_STACK].rlim_cur = _STK_LIM;
-                if (current->signal->rlim[RLIMIT_STACK].rlim_max > _STK_LIM)
-                        current->signal->rlim[RLIMIT_STACK].rlim_max = _STK_LIM;
-                task_unlock(current->group_leader);
         }
 
         arch_pick_mmap_layout(current->mm);
 
         current->sas_ss_sp = current->sas_ss_size = 0;
 
-        /* Figure out dumpability. */
+        /*
+         * Figure out dumpability. Note that this checking only of current
+         * is wrong, but userspace depends on it. This should be testing
+         * bprm->secureexec instead.
+         */
         if (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP ||
-            bprm->secureexec)
+            !(uid_eq(current_euid(), current_uid()) &&
+              gid_eq(current_egid(), current_gid())))
                 set_dumpable(current->mm, suid_dumpable);
         else
                 set_dumpable(current->mm, SUID_DUMP_USER);
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 07bca11749d4..c941251ac0c0 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4722,6 +4722,7 @@ retry:
                                                     EXT4_INODE_EOFBLOCKS);
                 }
                 ext4_mark_inode_dirty(handle, inode);
+                ext4_update_inode_fsync_trans(handle, inode, 1);
                 ret2 = ext4_journal_stop(handle);
                 if (ret2)
                         break;
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index b4267d72f249..b32cf263750d 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -816,6 +816,8 @@ struct inode *__ext4_new_inode(handle_t *handle, struct inode *dir,
 #ifdef CONFIG_EXT4_FS_POSIX_ACL
                 struct posix_acl *p = get_acl(dir, ACL_TYPE_DEFAULT);
 
+                if (IS_ERR(p))
+                        return ERR_CAST(p);
                 if (p) {
                         int acl_size = p->a_count * sizeof(ext4_acl_entry);
 
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 7df2c5644e59..534a9130f625 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -149,6 +149,15 @@ static int ext4_meta_trans_blocks(struct inode *inode, int lblocks,
  */
 int ext4_inode_is_fast_symlink(struct inode *inode)
 {
+        if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) {
+                int ea_blocks = EXT4_I(inode)->i_file_acl ?
+                                EXT4_CLUSTER_SIZE(inode->i_sb) >> 9 : 0;
+
+                if (ext4_has_inline_data(inode))
+                        return 0;
+
+                return (S_ISLNK(inode->i_mode) && inode->i_blocks - ea_blocks == 0);
+        }
         return S_ISLNK(inode->i_mode) && inode->i_size &&
                (inode->i_size < EXT4_N_BLOCKS * 4);
 }
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 798b3ac680db..e750d68fbcb5 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1399,6 +1399,10 @@ static struct buffer_head * ext4_find_entry (struct inode *dir,
                                "falling back\n"));
         }
         nblocks = dir->i_size >> EXT4_BLOCK_SIZE_BITS(sb);
+        if (!nblocks) {
+                ret = NULL;
+                goto cleanup_and_exit;
+        }
         start = EXT4_I(dir)->i_dir_start_lookup;
         if (start >= nblocks)
                 start = 0;
diff --git a/fs/hpfs/dir.c b/fs/hpfs/dir.c
index 8d6b7e35faf9..c83ece7facc5 100644
--- a/fs/hpfs/dir.c
+++ b/fs/hpfs/dir.c
@@ -150,7 +150,6 @@ static int hpfs_readdir(struct file *file, struct dir_context *ctx)
                         if (unlikely(ret < 0))
                                 goto out;
                         ctx->pos = ((loff_t) hpfs_de_as_down_as_possible(inode->i_sb, hpfs_inode->i_dno) << 4) + 1;
-                        file->f_version = inode->i_version;
                 }
                 next_pos = ctx->pos;
                 if (!(de = map_pos_dirent(inode, &next_pos, &qbh))) {
diff --git a/fs/hpfs/dnode.c b/fs/hpfs/dnode.c
index 3b834563b1f1..a4ad18afbdec 100644
--- a/fs/hpfs/dnode.c
+++ b/fs/hpfs/dnode.c
@@ -419,7 +419,6 @@ int hpfs_add_dirent(struct inode *i,
                 c = 1;
                 goto ret;
         }       
-        i->i_version++;
         c = hpfs_add_to_dnode(i, dno, name, namelen, new_de, 0);
         ret:
         return c;
@@ -726,7 +725,6 @@ int hpfs_remove_dirent(struct inode *i, dnode_secno dno, struct hpfs_dirent *de,
                         return 2;
                 }
         }
-        i->i_version++;
         for_all_poss(i, hpfs_pos_del, (t = get_pos(dnode, de)) + 1, 1);
         hpfs_delete_de(i->i_sb, dnode, de);
         hpfs_mark_4buffers_dirty(qbh);
diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
index c45a3b9b9ac7..f2c3ebcd309c 100644
--- a/fs/hpfs/super.c
+++ b/fs/hpfs/super.c
@@ -235,7 +235,6 @@ static struct inode *hpfs_alloc_inode(struct super_block *sb)
         ei = kmem_cache_alloc(hpfs_inode_cachep, GFP_NOFS);
         if (!ei)
                 return NULL;
-        ei->vfs_inode.i_version = 1;
         return &ei->vfs_inode;
 }
 
diff --git a/fs/namespace.c b/fs/namespace.c
index e158ec6b527b..9d1374ab6e06 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2826,6 +2826,7 @@ long do_mount(const char *dev_name, const char __user *dir_name,
                             SB_DIRSYNC |
                             SB_SILENT |
                             SB_POSIXACL |
+                            SB_LAZYTIME |
                             SB_I_VERSION);
 
         if (flags & MS_REMOUNT)
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 0ac2fb1c6b63..b9129e2befea 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -291,12 +291,23 @@ static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *dat
         const struct sockaddr *sap = data->addr;
         struct nfs_net *nn = net_generic(data->net, nfs_net_id);
 
+again:
         list_for_each_entry(clp, &nn->nfs_client_list, cl_share_link) {
                 const struct sockaddr *clap = (struct sockaddr *)&clp->cl_addr;
                 /* Don't match clients that failed to initialise properly */
                 if (clp->cl_cons_state < 0)
                         continue;
 
+                /* If a client is still initializing then we need to wait */
+                if (clp->cl_cons_state > NFS_CS_READY) {
+                        refcount_inc(&clp->cl_count);
+                        spin_unlock(&nn->nfs_client_lock);
+                        nfs_wait_client_init_complete(clp);
+                        nfs_put_client(clp);
+                        spin_lock(&nn->nfs_client_lock);
+                        goto again;
+                }
+
                 /* Different NFS versions cannot share the same nfs_client */
                 if (clp->rpc_ops != data->nfs_mod->rpc_ops)
                         continue;
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 12bbab0becb4..65a7e5da508c 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -404,15 +404,19 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
         if (error < 0)
                 goto error;
 
-        if (!nfs4_has_session(clp))
-                nfs_mark_client_ready(clp, NFS_CS_READY);
-
         error = nfs4_discover_server_trunking(clp, &old);
         if (error < 0)
                 goto error;
 
-        if (clp != old)
+        if (clp != old) {
                 clp->cl_preserve_clid = true;
+                /*
+                 * Mark the client as having failed initialization so other
+                 * processes walking the nfs_client_list in nfs_match_client()
+                 * won't try to use it.
+                 */
+                nfs_mark_client_ready(clp, -EPERM);
+        }
         nfs_put_client(clp);
         clear_bit(NFS_CS_TSM_POSSIBLE, &clp->cl_flags);
         return old;
@@ -539,6 +543,9 @@ int nfs40_walk_client_list(struct nfs_client *new,
         spin_lock(&nn->nfs_client_lock);
         list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
 
+                if (pos == new)
+                        goto found;
+
                 status = nfs4_match_client(pos, new, &prev, nn);
                 if (status < 0)
                         goto out_unlock;
@@ -559,6 +566,7 @@ int nfs40_walk_client_list(struct nfs_client *new,
                  * way that a SETCLIENTID_CONFIRM to pos can succeed is
                  * if new and pos point to the same server:
                  */
+found:
                 refcount_inc(&pos->cl_count);
                 spin_unlock(&nn->nfs_client_lock);
 
@@ -572,6 +580,7 @@ int nfs40_walk_client_list(struct nfs_client *new,
                 case 0:
                         nfs4_swap_callback_idents(pos, new);
                         pos->cl_confirm = new->cl_confirm;
+                        nfs_mark_client_ready(pos, NFS_CS_READY);
 
                         prev = NULL;
                         *result = pos;
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 5b5f464f6f2a..4a379d7918f2 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1890,6 +1890,8 @@ int nfs_commit_inode(struct inode *inode, int how)
         if (res)
                 error = nfs_generic_commit_list(inode, &head, how, &cinfo);
         nfs_commit_end(cinfo.mds);
+        if (res == 0)
+                return res;
         if (error < 0)
                 goto out_error;
         if (!may_wait)
diff --git a/fs/nfsd/auth.c b/fs/nfsd/auth.c
index 697f8ae7792d..fdf2aad73470 100644
--- a/fs/nfsd/auth.c
+++ b/fs/nfsd/auth.c
@@ -61,6 +61,9 @@ int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp)
                         else
                                 gi->gid[i] = rqgi->gid[i];
                 }
+
+                /* Each thread allocates its own gi, no race */
+                groups_sort(gi);
         } else {
                 gi = get_group_info(rqgi);
         }
diff --git a/fs/orangefs/devorangefs-req.c b/fs/orangefs/devorangefs-req.c
index ded456f17de6..c584ad8d023c 100644
--- a/fs/orangefs/devorangefs-req.c
+++ b/fs/orangefs/devorangefs-req.c
@@ -162,7 +162,7 @@ static ssize_t orangefs_devreq_read(struct file *file,
         struct orangefs_kernel_op_s *op, *temp;
         __s32 proto_ver = ORANGEFS_KERNEL_PROTO_VERSION;
         static __s32 magic = ORANGEFS_DEVREQ_MAGIC;
-        struct orangefs_kernel_op_s *cur_op = NULL;
+        struct orangefs_kernel_op_s *cur_op;
         unsigned long ret;
 
         /* We do not support blocking IO. */
@@ -186,6 +186,7 @@ static ssize_t orangefs_devreq_read(struct file *file,
                 return -EAGAIN;
 
 restart:
+        cur_op = NULL;
         /* Get next op (if any) from top of list. */
         spin_lock(&orangefs_request_list_lock);
         list_for_each_entry_safe(op, temp, &orangefs_request_list, list) {
diff --git a/fs/orangefs/file.c b/fs/orangefs/file.c
index 1668fd645c45..0d228cd087e6 100644
--- a/fs/orangefs/file.c
+++ b/fs/orangefs/file.c
@@ -452,7 +452,7 @@ ssize_t orangefs_inode_read(struct inode *inode,
 static ssize_t orangefs_file_read_iter(struct kiocb *iocb, struct iov_iter *iter)
 {
         struct file *file = iocb->ki_filp;
-        loff_t pos = *(&iocb->ki_pos);
+        loff_t pos = iocb->ki_pos;
         ssize_t rc = 0;
 
         BUG_ON(iocb->private);
@@ -492,9 +492,6 @@ static ssize_t orangefs_file_write_iter(struct kiocb *iocb, struct iov_iter *ite
                 }
         }
 
-        if (file->f_pos > i_size_read(file->f_mapping->host))
-                orangefs_i_size_write(file->f_mapping->host, file->f_pos);
-
         rc = generic_write_checks(iocb, iter);
 
         if (rc <= 0) {
@@ -508,7 +505,7 @@ static ssize_t orangefs_file_write_iter(struct kiocb *iocb, struct iov_iter *ite
          * pos to the end of the file, so we will wait till now to set
          * pos...
          */
-        pos = *(&iocb->ki_pos);
+        pos = iocb->ki_pos;
 
         rc = do_readv_writev(ORANGEFS_IO_WRITE,
                              file,
diff --git a/fs/orangefs/orangefs-kernel.h b/fs/orangefs/orangefs-kernel.h
index 97adf7d100b5..2595453fe737 100644
--- a/fs/orangefs/orangefs-kernel.h
+++ b/fs/orangefs/orangefs-kernel.h
@@ -533,17 +533,6 @@ do {									\
         sys_attr.mask = ORANGEFS_ATTR_SYS_ALL_SETABLE;                  \
 } while (0)
 
-static inline void orangefs_i_size_write(struct inode *inode, loff_t i_size)
-{
-#if BITS_PER_LONG == 32 && defined(CONFIG_SMP)
-        inode_lock(inode);
-#endif
-        i_size_write(inode, i_size);
-#if BITS_PER_LONG == 32 && defined(CONFIG_SMP)
-        inode_unlock(inode);
-#endif
-}
-
 static inline void orangefs_set_timeout(struct dentry *dentry)
 {
         unsigned long time = jiffies + orangefs_dcache_timeout_msecs*HZ/1000;
diff --git a/fs/orangefs/waitqueue.c b/fs/orangefs/waitqueue.c
index 835c6e148afc..0577d6dba8c8 100644
--- a/fs/orangefs/waitqueue.c
+++ b/fs/orangefs/waitqueue.c
@@ -29,10 +29,10 @@ static void orangefs_clean_up_interrupted_operation(struct orangefs_kernel_op_s
  */
 void purge_waiting_ops(void)
 {
-        struct orangefs_kernel_op_s *op;
+        struct orangefs_kernel_op_s *op, *tmp;
 
         spin_lock(&orangefs_request_list_lock);
-        list_for_each_entry(op, &orangefs_request_list, list) {
+        list_for_each_entry_safe(op, tmp, &orangefs_request_list, list) {
                 gossip_debug(GOSSIP_WAIT_DEBUG,
                              "pvfs2-client-core: purging op tag %llu %s\n",
                              llu(op->tag),
diff --git a/fs/overlayfs/Kconfig b/fs/overlayfs/Kconfig
index cbfc196e5dc5..5ac415466861 100644
--- a/fs/overlayfs/Kconfig
+++ b/fs/overlayfs/Kconfig
@@ -24,6 +24,16 @@ config OVERLAY_FS_REDIRECT_DIR
           an overlay which has redirects on a kernel that doesn't support this
           feature will have unexpected results.
 
+config OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW
+        bool "Overlayfs: follow redirects even if redirects are turned off"
+        default y
+        depends on OVERLAY_FS
+        help
+          Disable this to get a possibly more secure configuration, but that
+          might not be backward compatible with previous kernels.
+
+          For more information, see Documentation/filesystems/overlayfs.txt
+
 config OVERLAY_FS_INDEX
         bool "Overlayfs: turn on inodes index feature by default"
         depends on OVERLAY_FS
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index e13921824c70..f9788bc116a8 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -887,7 +887,8 @@ static int ovl_set_redirect(struct dentry *dentry, bool samedir)
                 spin_unlock(&dentry->d_lock);
         } else {
                 kfree(redirect);
-                pr_warn_ratelimited("overlay: failed to set redirect (%i)\n", err);
+                pr_warn_ratelimited("overlayfs: failed to set redirect (%i)\n",
+                                    err);
                 /* Fall back to userspace copy-up */
                 err = -EXDEV;
         }
diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index 625ed8066570..beb945e1963c 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -435,7 +435,7 @@ int ovl_verify_index(struct dentry *index, struct ovl_path *lower,
 
         /* Check if index is orphan and don't warn before cleaning it */
         if (d_inode(index)->i_nlink == 1 &&
-            ovl_get_nlink(index, origin.dentry, 0) == 0)
+            ovl_get_nlink(origin.dentry, index, 0) == 0)
                 err = -ENOENT;
 
         dput(origin.dentry);
@@ -681,6 +681,22 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
                 if (d.stop)
                         break;
 
+                /*
+                 * Following redirects can have security consequences: it's like
+                 * a symlink into the lower layer without the permission checks.
+                 * This is only a problem if the upper layer is untrusted (e.g
+                 * comes from an USB drive).  This can allow a non-readable file
+                 * or directory to become readable.
+                 *
+                 * Only following redirects when redirects are enabled disables
+                 * this attack vector when not necessary.
+                 */
+                err = -EPERM;
+                if (d.redirect && !ofs->config.redirect_follow) {
+                        pr_warn_ratelimited("overlay: refusing to follow redirect for (%pd2)\n", dentry);
+                        goto out_put;
+                }
+
                 if (d.redirect && d.redirect[0] == '/' && poe != roe) {
                         poe = roe;
 
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index 13eab09a6b6f..b489099ccd49 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -180,7 +180,7 @@ static inline int ovl_do_whiteout(struct inode *dir, struct dentry *dentry)
 static inline struct dentry *ovl_do_tmpfile(struct dentry *dentry, umode_t mode)
 {
         struct dentry *ret = vfs_tmpfile(dentry, mode, 0);
-        int err = IS_ERR(ret) ? PTR_ERR(ret) : 0;
+        int err = PTR_ERR_OR_ZERO(ret);
 
         pr_debug("tmpfile(%pd2, 0%o) = %i\n", dentry, mode, err);
         return ret;
diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h
index 752bab645879..9d0bc03bf6e4 100644
--- a/fs/overlayfs/ovl_entry.h
+++ b/fs/overlayfs/ovl_entry.h
@@ -14,6 +14,8 @@ struct ovl_config {
         char *workdir;
         bool default_permissions;
         bool redirect_dir;
+        bool redirect_follow;
+        const char *redirect_mode;
         bool index;
 };
 
diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index 0daa4354fec4..8c98578d27a1 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -499,7 +499,7 @@ out:
         return err;
 
 fail:
-        pr_warn_ratelimited("overlay: failed to look up (%s) for ino (%i)\n",
+        pr_warn_ratelimited("overlayfs: failed to look up (%s) for ino (%i)\n",
                             p->name, err);
         goto out;
 }
@@ -663,7 +663,10 @@ static int ovl_iterate_real(struct file *file, struct dir_context *ctx)
                         return PTR_ERR(rdt.cache);
         }
 
-        return iterate_dir(od->realfile, &rdt.ctx);
+        err = iterate_dir(od->realfile, &rdt.ctx);
+        ctx->pos = rdt.ctx.pos;
+
+        return err;
 }
 
 
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 288d20f9a55a..76440feb79f6 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -33,6 +33,13 @@ module_param_named(redirect_dir, ovl_redirect_dir_def, bool, 0644);
 MODULE_PARM_DESC(ovl_redirect_dir_def,
                  "Default to on or off for the redirect_dir feature");
 
+static bool ovl_redirect_always_follow =
+        IS_ENABLED(CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW);
+module_param_named(redirect_always_follow, ovl_redirect_always_follow,
+                   bool, 0644);
+MODULE_PARM_DESC(ovl_redirect_always_follow,
+                 "Follow redirects even if redirect_dir feature is turned off");
+
 static bool ovl_index_def = IS_ENABLED(CONFIG_OVERLAY_FS_INDEX);
 module_param_named(index, ovl_index_def, bool, 0644);
 MODULE_PARM_DESC(ovl_index_def,
@@ -232,6 +239,7 @@ static void ovl_free_fs(struct ovl_fs *ofs)
         kfree(ofs->config.lowerdir);
         kfree(ofs->config.upperdir);
         kfree(ofs->config.workdir);
+        kfree(ofs->config.redirect_mode);
         if (ofs->creator_cred)
                 put_cred(ofs->creator_cred);
         kfree(ofs);
@@ -244,6 +252,7 @@ static void ovl_put_super(struct super_block *sb)
         ovl_free_fs(ofs);
 }
 
+/* Sync real dirty inodes in upper filesystem (if it exists) */
 static int ovl_sync_fs(struct super_block *sb, int wait)
 {
         struct ovl_fs *ofs = sb->s_fs_info;
@@ -252,14 +261,24 @@ static int ovl_sync_fs(struct super_block *sb, int wait)
 
         if (!ofs->upper_mnt)
                 return 0;
-        upper_sb = ofs->upper_mnt->mnt_sb;
-        if (!upper_sb->s_op->sync_fs)
+
+        /*
+         * If this is a sync(2) call or an emergency sync, all the super blocks
+         * will be iterated, including upper_sb, so no need to do anything.
+         *
+         * If this is a syncfs(2) call, then we do need to call
+         * sync_filesystem() on upper_sb, but enough if we do it when being
+         * called with wait == 1.
+         */
+        if (!wait)
                 return 0;
 
-        /* real inodes have already been synced by sync_filesystem(ovl_sb) */
+        upper_sb = ofs->upper_mnt->mnt_sb;
+
         down_read(&upper_sb->s_umount);
-        ret = upper_sb->s_op->sync_fs(upper_sb, wait);
+        ret = sync_filesystem(upper_sb);
         up_read(&upper_sb->s_umount);
+
         return ret;
 }
 
@@ -295,6 +314,11 @@ static bool ovl_force_readonly(struct ovl_fs *ofs)
         return (!ofs->upper_mnt || !ofs->workdir);
 }
 
+static const char *ovl_redirect_mode_def(void)
+{
+        return ovl_redirect_dir_def ? "on" : "off";
+}
+
 /**
  * ovl_show_options
  *
@@ -313,12 +337,10 @@ static int ovl_show_options(struct seq_file *m, struct dentry *dentry)
         }
         if (ofs->config.default_permissions)
                 seq_puts(m, ",default_permissions");
-        if (ofs->config.redirect_dir != ovl_redirect_dir_def)
-                seq_printf(m, ",redirect_dir=%s",
-                           ofs->config.redirect_dir ? "on" : "off");
+        if (strcmp(ofs->config.redirect_mode, ovl_redirect_mode_def()) != 0)
+                seq_printf(m, ",redirect_dir=%s", ofs->config.redirect_mode);
         if (ofs->config.index != ovl_index_def)
-                seq_printf(m, ",index=%s",
-                           ofs->config.index ? "on" : "off");
+                seq_printf(m, ",index=%s", ofs->config.index ? "on" : "off");
         return 0;
 }
 
@@ -348,8 +370,7 @@ enum {
         OPT_UPPERDIR,
         OPT_WORKDIR,
         OPT_DEFAULT_PERMISSIONS,
-        OPT_REDIRECT_DIR_ON,
-        OPT_REDIRECT_DIR_OFF,
+        OPT_REDIRECT_DIR,
         OPT_INDEX_ON,
         OPT_INDEX_OFF,
         OPT_ERR,
@@ -360,8 +381,7 @@ static const match_table_t ovl_tokens = {
         {OPT_UPPERDIR,                  "upperdir=%s"},
         {OPT_WORKDIR,                   "workdir=%s"},
         {OPT_DEFAULT_PERMISSIONS,       "default_permissions"},
-        {OPT_REDIRECT_DIR_ON,           "redirect_dir=on"},
-        {OPT_REDIRECT_DIR_OFF,          "redirect_dir=off"},
+        {OPT_REDIRECT_DIR,              "redirect_dir=%s"},
         {OPT_INDEX_ON,                  "index=on"},
         {OPT_INDEX_OFF,                 "index=off"},
         {OPT_ERR,                       NULL}
@@ -390,10 +410,37 @@ static char *ovl_next_opt(char **s)
         return sbegin;
 }
 
+static int ovl_parse_redirect_mode(struct ovl_config *config, const char *mode)
+{
+        if (strcmp(mode, "on") == 0) {
+                config->redirect_dir = true;
+                /*
+                 * Does not make sense to have redirect creation without
+                 * redirect following.
+                 */
+                config->redirect_follow = true;
+        } else if (strcmp(mode, "follow") == 0) {
+                config->redirect_follow = true;
+        } else if (strcmp(mode, "off") == 0) {
+                if (ovl_redirect_always_follow)
+                        config->redirect_follow = true;
+        } else if (strcmp(mode, "nofollow") != 0) {
+                pr_err("overlayfs: bad mount option \"redirect_dir=%s\"\n",
+                       mode);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 static int ovl_parse_opt(char *opt, struct ovl_config *config)
 {
         char *p;
 
+        config->redirect_mode = kstrdup(ovl_redirect_mode_def(), GFP_KERNEL);
+        if (!config->redirect_mode)
+                return -ENOMEM;
+
         while ((p = ovl_next_opt(&opt)) != NULL) {
                 int token;
                 substring_t args[MAX_OPT_ARGS];
@@ -428,12 +475,11 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config)
                         config->default_permissions = true;
                         break;
 
-                case OPT_REDIRECT_DIR_ON:
-                        config->redirect_dir = true;
-                        break;
-
-                case OPT_REDIRECT_DIR_OFF:
-                        config->redirect_dir = false;
+                case OPT_REDIRECT_DIR:
+                        kfree(config->redirect_mode);
+                        config->redirect_mode = match_strdup(&args[0]);
+                        if (!config->redirect_mode)
+                                return -ENOMEM;
                         break;
 
                 case OPT_INDEX_ON:
@@ -458,7 +504,7 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config)
                 config->workdir = NULL;
         }
 
-        return 0;
+        return ovl_parse_redirect_mode(config, config->redirect_mode);
 }
 
 #define OVL_WORKDIR_NAME "work"
@@ -1160,7 +1206,6 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
         if (!cred)
                 goto out_err;
 
-        ofs->config.redirect_dir = ovl_redirect_dir_def;
         ofs->config.index = ovl_index_def;
         err = ovl_parse_opt((char *) data, &ofs->config);
         if (err)
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 79375fc115d2..d67a72dcb92c 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -430,8 +430,11 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                  * safe because the task has stopped executing permanently.
                  */
                 if (permitted && (task->flags & PF_DUMPCORE)) {
-                        eip = KSTK_EIP(task);
-                        esp = KSTK_ESP(task);
+                        if (try_get_task_stack(task)) {
+                                eip = KSTK_EIP(task);
+                                esp = KSTK_ESP(task);
+                                put_task_stack(task);
+                        }
                 }
         }
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 28fa85276eec..60316b52d659 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2268,7 +2268,7 @@ static int show_timer(struct seq_file *m, void *v)
         notify = timer->it_sigev_notify;
 
         seq_printf(m, "ID: %d\n", timer->it_id);
-        seq_printf(m, "signal: %d/%p\n",
+        seq_printf(m, "signal: %d/%px\n",
                    timer->sigq->info.si_signo,
                    timer->sigq->info.si_value.sival_ptr);
         seq_printf(m, "notify: %s/%s.%d\n",
diff --git a/fs/super.c b/fs/super.c
index d4e33e8f1e6f..06bd25d90ba5 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -191,6 +191,24 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags,
 
         INIT_LIST_HEAD(&s->s_mounts);
         s->s_user_ns = get_user_ns(user_ns);
+        init_rwsem(&s->s_umount);
+        lockdep_set_class(&s->s_umount, &type->s_umount_key);
+        /*
+         * sget() can have s_umount recursion.
+         *
+         * When it cannot find a suitable sb, it allocates a new
+         * one (this one), and tries again to find a suitable old
+         * one.
+         *
+         * In case that succeeds, it will acquire the s_umount
+         * lock of the old one. Since these are clearly distrinct
+         * locks, and this object isn't exposed yet, there's no
+         * risk of deadlocks.
+         *
+         * Annotate this by putting this lock in a different
+         * subclass.
+         */
+        down_write_nested(&s->s_umount, SINGLE_DEPTH_NESTING);
 
         if (security_sb_alloc(s))
                 goto fail;
@@ -218,25 +236,6 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags,
                 goto fail;
         if (list_lru_init_memcg(&s->s_inode_lru))
                 goto fail;
-
-        init_rwsem(&s->s_umount);
-        lockdep_set_class(&s->s_umount, &type->s_umount_key);
-        /*
-         * sget() can have s_umount recursion.
-         *
-         * When it cannot find a suitable sb, it allocates a new
-         * one (this one), and tries again to find a suitable old
-         * one.
-         *
-         * In case that succeeds, it will acquire the s_umount
-         * lock of the old one. Since these are clearly distrinct
-         * locks, and this object isn't exposed yet, there's no
-         * risk of deadlocks.
-         *
-         * Annotate this by putting this lock in a different
-         * subclass.
-         */
-        down_write_nested(&s->s_umount, SINGLE_DEPTH_NESTING);
         s->s_count = 1;
         atomic_set(&s->s_active, 1);
         mutex_init(&s->s_vfs_rename_mutex);
@@ -518,7 +517,11 @@ retry:
         hlist_add_head(&s->s_instances, &type->fs_supers);
         spin_unlock(&sb_lock);
         get_filesystem(type);
-        register_shrinker(&s->s_shrink);
+        err = register_shrinker(&s->s_shrink);
+        if (err) {
+                deactivate_locked_super(s);
+                s = ERR_PTR(err);
+        }
         return s;
 }
 
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index ac9a4e65ca49..41a75f9f23fd 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -570,11 +570,14 @@ out:
 static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
                                               struct userfaultfd_wait_queue *ewq)
 {
+        struct userfaultfd_ctx *release_new_ctx;
+
         if (WARN_ON_ONCE(current->flags & PF_EXITING))
                 goto out;
 
         ewq->ctx = ctx;
         init_waitqueue_entry(&ewq->wq, current);
+        release_new_ctx = NULL;
 
         spin_lock(&ctx->event_wqh.lock);
         /*
@@ -601,8 +604,7 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
                                 new = (struct userfaultfd_ctx *)
                                         (unsigned long)
                                         ewq->msg.arg.reserved.reserved1;
-
-                                userfaultfd_ctx_put(new);
+                                release_new_ctx = new;
                         }
                         break;
                 }
@@ -617,6 +619,20 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
         __set_current_state(TASK_RUNNING);
         spin_unlock(&ctx->event_wqh.lock);
 
+        if (release_new_ctx) {
+                struct vm_area_struct *vma;
+                struct mm_struct *mm = release_new_ctx->mm;
+
+                /* the various vma->vm_userfaultfd_ctx still points to it */
+                down_write(&mm->mmap_sem);
+                for (vma = mm->mmap; vma; vma = vma->vm_next)
+                        if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx)
+                                vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
+                up_write(&mm->mmap_sem);
+
+                userfaultfd_ctx_put(release_new_ctx);
+        }
+
         /*
          * ctx may go away after this if the userfault pseudo fd is
          * already released.
diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
index 0da80019a917..83ed7715f856 100644
--- a/fs/xfs/libxfs/xfs_alloc.c
+++ b/fs/xfs/libxfs/xfs_alloc.c
@@ -702,7 +702,7 @@ xfs_alloc_ag_vextent(
         ASSERT(args->agbno % args->alignment == 0);
 
         /* if not file data, insert new block into the reverse map btree */
-        if (args->oinfo.oi_owner != XFS_RMAP_OWN_UNKNOWN) {
+        if (!xfs_rmap_should_skip_owner_update(&args->oinfo)) {
                 error = xfs_rmap_alloc(args->tp, args->agbp, args->agno,
                                        args->agbno, args->len, &args->oinfo);
                 if (error)
@@ -1682,7 +1682,7 @@ xfs_free_ag_extent(
         bno_cur = cnt_cur = NULL;
         mp = tp->t_mountp;
 
-        if (oinfo->oi_owner != XFS_RMAP_OWN_UNKNOWN) {
+        if (!xfs_rmap_should_skip_owner_update(oinfo)) {
                 error = xfs_rmap_free(tp, agbp, agno, bno, len, oinfo);
                 if (error)
                         goto error0;
diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
index 6249c92671de..a76914db72ef 100644
--- a/fs/xfs/libxfs/xfs_attr.c
+++ b/fs/xfs/libxfs/xfs_attr.c
@@ -212,6 +212,7 @@ xfs_attr_set(
         int                     flags)
 {
         struct xfs_mount        *mp = dp->i_mount;
+        struct xfs_buf          *leaf_bp = NULL;
         struct xfs_da_args      args;
         struct xfs_defer_ops    dfops;
         struct xfs_trans_res    tres;
@@ -327,9 +328,16 @@ xfs_attr_set(
                  * GROT: another possible req'mt for a double-split btree op.
                  */
                 xfs_defer_init(args.dfops, args.firstblock);
-                error = xfs_attr_shortform_to_leaf(&args);
+                error = xfs_attr_shortform_to_leaf(&args, &leaf_bp);
                 if (error)
                         goto out_defer_cancel;
+                /*
+                 * Prevent the leaf buffer from being unlocked so that a
+                 * concurrent AIL push cannot grab the half-baked leaf
+                 * buffer and run into problems with the write verifier.
+                 */
+                xfs_trans_bhold(args.trans, leaf_bp);
+                xfs_defer_bjoin(args.dfops, leaf_bp);
                 xfs_defer_ijoin(args.dfops, dp);
                 error = xfs_defer_finish(&args.trans, args.dfops);
                 if (error)
@@ -337,13 +345,14 @@ xfs_attr_set(
 
                 /*
                  * Commit the leaf transformation.  We'll need another (linked)
-                 * transaction to add the new attribute to the leaf.
+                 * transaction to add the new attribute to the leaf, which
+                 * means that we have to hold & join the leaf buffer here too.
                  */
-
                 error = xfs_trans_roll_inode(&args.trans, dp);
                 if (error)
                         goto out;
-
+                xfs_trans_bjoin(args.trans, leaf_bp);
+                leaf_bp = NULL;
         }
 
         if (xfs_bmap_one_block(dp, XFS_ATTR_FORK))
@@ -374,8 +383,9 @@ xfs_attr_set(
 
 out_defer_cancel:
         xfs_defer_cancel(&dfops);
-        args.trans = NULL;
 out:
+        if (leaf_bp)
+                xfs_trans_brelse(args.trans, leaf_bp);
         if (args.trans)
                 xfs_trans_cancel(args.trans);
         xfs_iunlock(dp, XFS_ILOCK_EXCL);
diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
index 53cc8b986eac..601eaa36f1ad 100644
--- a/fs/xfs/libxfs/xfs_attr_leaf.c
+++ b/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -735,10 +735,13 @@ xfs_attr_shortform_getvalue(xfs_da_args_t *args)
 }
 
 /*
- * Convert from using the shortform to the leaf.
+ * Convert from using the shortform to the leaf.  On success, return the
+ * buffer so that we can keep it locked until we're totally done with it.
  */
 int
-xfs_attr_shortform_to_leaf(xfs_da_args_t *args)
+xfs_attr_shortform_to_leaf(
+        struct xfs_da_args      *args,
+        struct xfs_buf          **leaf_bp)
 {
         xfs_inode_t *dp;
         xfs_attr_shortform_t *sf;
@@ -818,7 +821,7 @@ xfs_attr_shortform_to_leaf(xfs_da_args_t *args)
                 sfe = XFS_ATTR_SF_NEXTENTRY(sfe);
         }
         error = 0;
-
+        *leaf_bp = bp;
 out:
         kmem_free(tmpbuffer);
         return error;
diff --git a/fs/xfs/libxfs/xfs_attr_leaf.h b/fs/xfs/libxfs/xfs_attr_leaf.h
index f7dda0c237b0..894124efb421 100644
--- a/fs/xfs/libxfs/xfs_attr_leaf.h
+++ b/fs/xfs/libxfs/xfs_attr_leaf.h
@@ -48,7 +48,8 @@ void	xfs_attr_shortform_create(struct xfs_da_args *args);
 void    xfs_attr_shortform_add(struct xfs_da_args *args, int forkoff);
 int     xfs_attr_shortform_lookup(struct xfs_da_args *args);
 int     xfs_attr_shortform_getvalue(struct xfs_da_args *args);
-int     xfs_attr_shortform_to_leaf(struct xfs_da_args *args);
+int     xfs_attr_shortform_to_leaf(struct xfs_da_args *args,
+                        struct xfs_buf **leaf_bp);
 int     xfs_attr_shortform_remove(struct xfs_da_args *args);
 int     xfs_attr_shortform_allfit(struct xfs_buf *bp, struct xfs_inode *dp);
 int     xfs_attr_shortform_bytesfit(struct xfs_inode *dp, int bytes);
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 1210f684d3c2..1bddbba6b80c 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -5136,7 +5136,7 @@ __xfs_bunmapi(
          * blowing out the transaction with a mix of EFIs and reflink
          * adjustments.
          */
-        if (xfs_is_reflink_inode(ip) && whichfork == XFS_DATA_FORK)
+        if (tp && xfs_is_reflink_inode(ip) && whichfork == XFS_DATA_FORK)
                 max_len = min(len, xfs_refcount_max_unmap(tp->t_log_res));
         else
                 max_len = len;
diff --git a/fs/xfs/libxfs/xfs_defer.c b/fs/xfs/libxfs/xfs_defer.c
index 072ebfe1d6ae..087fea02c389 100644
--- a/fs/xfs/libxfs/xfs_defer.c
+++ b/fs/xfs/libxfs/xfs_defer.c
@@ -249,6 +249,10 @@ xfs_defer_trans_roll(
         for (i = 0; i < XFS_DEFER_OPS_NR_INODES && dop->dop_inodes[i]; i++)
                 xfs_trans_log_inode(*tp, dop->dop_inodes[i], XFS_ILOG_CORE);
 
+        /* Hold the (previously bjoin'd) buffer locked across the roll. */
+        for (i = 0; i < XFS_DEFER_OPS_NR_BUFS && dop->dop_bufs[i]; i++)
+                xfs_trans_dirty_buf(*tp, dop->dop_bufs[i]);
+
         trace_xfs_defer_trans_roll((*tp)->t_mountp, dop);
 
         /* Roll the transaction. */
@@ -264,6 +268,12 @@ xfs_defer_trans_roll(
         for (i = 0; i < XFS_DEFER_OPS_NR_INODES && dop->dop_inodes[i]; i++)
                 xfs_trans_ijoin(*tp, dop->dop_inodes[i], 0);
 
+        /* Rejoin the buffers and dirty them so the log moves forward. */
+        for (i = 0; i < XFS_DEFER_OPS_NR_BUFS && dop->dop_bufs[i]; i++) {
+                xfs_trans_bjoin(*tp, dop->dop_bufs[i]);
+                xfs_trans_bhold(*tp, dop->dop_bufs[i]);
+        }
+
         return error;
 }
 
@@ -295,6 +305,31 @@ xfs_defer_ijoin(
                 }
         }
 
+        ASSERT(0);
+        return -EFSCORRUPTED;
+}
+
+/*
+ * Add this buffer to the deferred op.  Each joined buffer is relogged
+ * each time we roll the transaction.
+ */
+int
+xfs_defer_bjoin(
+        struct xfs_defer_ops            *dop,
+        struct xfs_buf                  *bp)
+{
+        int                             i;
+
+        for (i = 0; i < XFS_DEFER_OPS_NR_BUFS; i++) {
+                if (dop->dop_bufs[i] == bp)
+                        return 0;
+                else if (dop->dop_bufs[i] == NULL) {
+                        dop->dop_bufs[i] = bp;
+                        return 0;
+                }
+        }
+
+        ASSERT(0);
         return -EFSCORRUPTED;
 }
 
@@ -493,9 +528,7 @@ xfs_defer_init(
         struct xfs_defer_ops            *dop,
         xfs_fsblock_t                   *fbp)
 {
-        dop->dop_committed = false;
-        dop->dop_low = false;
-        memset(&dop->dop_inodes, 0, sizeof(dop->dop_inodes));
+        memset(dop, 0, sizeof(struct xfs_defer_ops));
         *fbp = NULLFSBLOCK;
         INIT_LIST_HEAD(&dop->dop_intake);
         INIT_LIST_HEAD(&dop->dop_pending);
diff --git a/fs/xfs/libxfs/xfs_defer.h b/fs/xfs/libxfs/xfs_defer.h
index d4f046dd44bd..045beacdd37d 100644
--- a/fs/xfs/libxfs/xfs_defer.h
+++ b/fs/xfs/libxfs/xfs_defer.h
@@ -59,6 +59,7 @@ enum xfs_defer_ops_type {
 };
 
 #define XFS_DEFER_OPS_NR_INODES 2       /* join up to two inodes */
+#define XFS_DEFER_OPS_NR_BUFS   2       /* join up to two buffers */
 
 struct xfs_defer_ops {
         bool                    dop_committed;  /* did any trans commit? */
@@ -66,8 +67,9 @@ struct xfs_defer_ops {
         struct list_head        dop_intake;     /* unlogged pending work */
         struct list_head        dop_pending;    /* logged pending work */
 
-        /* relog these inodes with each roll */
+        /* relog these with each roll */
         struct xfs_inode        *dop_inodes[XFS_DEFER_OPS_NR_INODES];
+        struct xfs_buf          *dop_bufs[XFS_DEFER_OPS_NR_BUFS];
 };
 
 void xfs_defer_add(struct xfs_defer_ops *dop, enum xfs_defer_ops_type type,
@@ -77,6 +79,7 @@ void xfs_defer_cancel(struct xfs_defer_ops *dop);
 void xfs_defer_init(struct xfs_defer_ops *dop, xfs_fsblock_t *fbp);
 bool xfs_defer_has_unfinished_work(struct xfs_defer_ops *dop);
 int xfs_defer_ijoin(struct xfs_defer_ops *dop, struct xfs_inode *ip);
+int xfs_defer_bjoin(struct xfs_defer_ops *dop, struct xfs_buf *bp);
 
 /* Description of a deferred type. */
 struct xfs_defer_op_type {
diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
index de3f04a98656..3b57ef0f2f76 100644
--- a/fs/xfs/libxfs/xfs_ialloc.c
+++ b/fs/xfs/libxfs/xfs_ialloc.c
@@ -920,8 +920,7 @@ STATIC xfs_agnumber_t
 xfs_ialloc_ag_select(
         xfs_trans_t     *tp,            /* transaction pointer */
         xfs_ino_t       parent,         /* parent directory inode number */
-        umode_t         mode,           /* bits set to indicate file type */
-        int             okalloc)        /* ok to allocate more space */
+        umode_t         mode)           /* bits set to indicate file type */
 {
         xfs_agnumber_t  agcount;        /* number of ag's in the filesystem */
         xfs_agnumber_t  agno;           /* current ag number */
@@ -978,9 +977,6 @@ xfs_ialloc_ag_select(
                         return agno;
                 }
 
-                if (!okalloc)
-                        goto nextag;
-
                 if (!pag->pagf_init) {
                         error = xfs_alloc_pagf_init(mp, tp, agno, flags);
                         if (error)
@@ -1680,7 +1676,6 @@ xfs_dialloc(
         struct xfs_trans        *tp,
         xfs_ino_t               parent,
         umode_t                 mode,
-        int                     okalloc,
         struct xfs_buf          **IO_agbp,
         xfs_ino_t               *inop)
 {
@@ -1692,6 +1687,7 @@ xfs_dialloc(
         int                     noroom = 0;
         xfs_agnumber_t          start_agno;
         struct xfs_perag        *pag;
+        int                     okalloc = 1;
 
         if (*IO_agbp) {
                 /*
@@ -1707,7 +1703,7 @@ xfs_dialloc(
          * We do not have an agbp, so select an initial allocation
          * group for inode allocation.
          */
-        start_agno = xfs_ialloc_ag_select(tp, parent, mode, okalloc);
+        start_agno = xfs_ialloc_ag_select(tp, parent, mode);
         if (start_agno == NULLAGNUMBER) {
                 *inop = NULLFSINO;
                 return 0;
diff --git a/fs/xfs/libxfs/xfs_ialloc.h b/fs/xfs/libxfs/xfs_ialloc.h
index d2bdcd5e7312..66a8de0b1caa 100644
--- a/fs/xfs/libxfs/xfs_ialloc.h
+++ b/fs/xfs/libxfs/xfs_ialloc.h
@@ -81,7 +81,6 @@ xfs_dialloc(
         struct xfs_trans *tp,           /* transaction pointer */
         xfs_ino_t       parent,         /* parent inode (directory) */
         umode_t         mode,           /* mode bits for new inode */
-        int             okalloc,        /* ok to allocate more space */
         struct xfs_buf  **agbp,         /* buf for a.g. inode header */
         xfs_ino_t       *inop);         /* inode number allocated */
 
diff --git a/fs/xfs/libxfs/xfs_iext_tree.c b/fs/xfs/libxfs/xfs_iext_tree.c
index 89bf16b4d937..b0f31791c7e6 100644
--- a/fs/xfs/libxfs/xfs_iext_tree.c
+++ b/fs/xfs/libxfs/xfs_iext_tree.c
@@ -632,8 +632,6 @@ xfs_iext_insert(
         struct xfs_iext_leaf    *new = NULL;
         int                     nr_entries, i;
 
-        trace_xfs_iext_insert(ip, cur, state, _RET_IP_);
-
         if (ifp->if_height == 0)
                 xfs_iext_alloc_root(ifp, cur);
         else if (ifp->if_height == 1)
@@ -661,6 +659,8 @@ xfs_iext_insert(
         xfs_iext_set(cur_rec(cur), irec);
         ifp->if_bytes += sizeof(struct xfs_iext_rec);
 
+        trace_xfs_iext_insert(ip, cur, state, _RET_IP_);
+
         if (new)
                 xfs_iext_insert_node(ifp, xfs_iext_leaf_key(new, 0), new, 2);
 }
diff --git a/fs/xfs/libxfs/xfs_refcount.c b/fs/xfs/libxfs/xfs_refcount.c
index 585b35d34142..c40d26763075 100644
--- a/fs/xfs/libxfs/xfs_refcount.c
+++ b/fs/xfs/libxfs/xfs_refcount.c
@@ -1488,27 +1488,12 @@ __xfs_refcount_cow_alloc(
         xfs_extlen_t            aglen,
         struct xfs_defer_ops    *dfops)
 {
-        int                     error;
-
         trace_xfs_refcount_cow_increase(rcur->bc_mp, rcur->bc_private.a.agno,
                         agbno, aglen);
 
         /* Add refcount btree reservation */
-        error = xfs_refcount_adjust_cow(rcur, agbno, aglen,
+        return xfs_refcount_adjust_cow(rcur, agbno, aglen,
                         XFS_REFCOUNT_ADJUST_COW_ALLOC, dfops);
-        if (error)
-                return error;
-
-        /* Add rmap entry */
-        if (xfs_sb_version_hasrmapbt(&rcur->bc_mp->m_sb)) {
-                error = xfs_rmap_alloc_extent(rcur->bc_mp, dfops,
-                                rcur->bc_private.a.agno,
-                                agbno, aglen, XFS_RMAP_OWN_COW);
-                if (error)
-                        return error;
-        }
-
-        return error;
 }
 
 /*
@@ -1521,27 +1506,12 @@ __xfs_refcount_cow_free(
         xfs_extlen_t            aglen,
         struct xfs_defer_ops    *dfops)
 {
-        int                     error;
-
         trace_xfs_refcount_cow_decrease(rcur->bc_mp, rcur->bc_private.a.agno,
                         agbno, aglen);
 
         /* Remove refcount btree reservation */
-        error = xfs_refcount_adjust_cow(rcur, agbno, aglen,
+        return xfs_refcount_adjust_cow(rcur, agbno, aglen,
                         XFS_REFCOUNT_ADJUST_COW_FREE, dfops);
-        if (error)
-                return error;
-
-        /* Remove rmap entry */
-        if (xfs_sb_version_hasrmapbt(&rcur->bc_mp->m_sb)) {
-                error = xfs_rmap_free_extent(rcur->bc_mp, dfops,
-                                rcur->bc_private.a.agno,
-                                agbno, aglen, XFS_RMAP_OWN_COW);
-                if (error)
-                        return error;
-        }
-
-        return error;
 }
 
 /* Record a CoW staging extent in the refcount btree. */
@@ -1552,11 +1522,19 @@ xfs_refcount_alloc_cow_extent(
         xfs_fsblock_t                   fsb,
         xfs_extlen_t                    len)
 {
+        int                             error;
+
         if (!xfs_sb_version_hasreflink(&mp->m_sb))
                 return 0;
 
-        return __xfs_refcount_add(mp, dfops, XFS_REFCOUNT_ALLOC_COW,
+        error = __xfs_refcount_add(mp, dfops, XFS_REFCOUNT_ALLOC_COW,
                         fsb, len);
+        if (error)
+                return error;
+
+        /* Add rmap entry */
+        return xfs_rmap_alloc_extent(mp, dfops, XFS_FSB_TO_AGNO(mp, fsb),
+                        XFS_FSB_TO_AGBNO(mp, fsb), len, XFS_RMAP_OWN_COW);
 }
 
 /* Forget a CoW staging event in the refcount btree. */
@@ -1567,9 +1545,17 @@ xfs_refcount_free_cow_extent(
         xfs_fsblock_t                   fsb,
         xfs_extlen_t                    len)
 {
+        int                             error;
+
         if (!xfs_sb_version_hasreflink(&mp->m_sb))
                 return 0;
 
+        /* Remove rmap entry */
+        error = xfs_rmap_free_extent(mp, dfops, XFS_FSB_TO_AGNO(mp, fsb),
+                        XFS_FSB_TO_AGBNO(mp, fsb), len, XFS_RMAP_OWN_COW);
+        if (error)
+                return error;
+
         return __xfs_refcount_add(mp, dfops, XFS_REFCOUNT_FREE_COW,
                         fsb, len);
 }
diff --git a/fs/xfs/libxfs/xfs_rmap.c b/fs/xfs/libxfs/xfs_rmap.c
index dd019cee1b3b..50db920ceeeb 100644
--- a/fs/xfs/libxfs/xfs_rmap.c
+++ b/fs/xfs/libxfs/xfs_rmap.c
@@ -368,6 +368,51 @@ xfs_rmap_lookup_le_range(
 }
 
 /*
+ * Perform all the relevant owner checks for a removal op.  If we're doing an
+ * unknown-owner removal then we have no owner information to check.
+ */
+static int
+xfs_rmap_free_check_owner(
+        struct xfs_mount        *mp,
+        uint64_t                ltoff,
+        struct xfs_rmap_irec    *rec,
+        xfs_fsblock_t           bno,
+        xfs_filblks_t           len,
+        uint64_t                owner,
+        uint64_t                offset,
+        unsigned int            flags)
+{
+        int                     error = 0;
+
+        if (owner == XFS_RMAP_OWN_UNKNOWN)
+                return 0;
+
+        /* Make sure the unwritten flag matches. */
+        XFS_WANT_CORRUPTED_GOTO(mp, (flags & XFS_RMAP_UNWRITTEN) ==
+                        (rec->rm_flags & XFS_RMAP_UNWRITTEN), out);
+
+        /* Make sure the owner matches what we expect to find in the tree. */
+        XFS_WANT_CORRUPTED_GOTO(mp, owner == rec->rm_owner, out);
+
+        /* Check the offset, if necessary. */
+        if (XFS_RMAP_NON_INODE_OWNER(owner))
+                goto out;
+
+        if (flags & XFS_RMAP_BMBT_BLOCK) {
+                XFS_WANT_CORRUPTED_GOTO(mp, rec->rm_flags & XFS_RMAP_BMBT_BLOCK,
+                                out);
+        } else {
+                XFS_WANT_CORRUPTED_GOTO(mp, rec->rm_offset <= offset, out);
+                XFS_WANT_CORRUPTED_GOTO(mp,
+                                ltoff + rec->rm_blockcount >= offset + len,
+                                out);
+        }
+
+out:
+        return error;
+}
+
+/*
  * Find the extent in the rmap btree and remove it.
  *
  * The record we find should always be an exact match for the extent that we're
@@ -444,33 +489,40 @@ xfs_rmap_unmap(
                 goto out_done;
         }
 
-        /* Make sure the unwritten flag matches. */
-        XFS_WANT_CORRUPTED_GOTO(mp, (flags & XFS_RMAP_UNWRITTEN) ==
-                        (ltrec.rm_flags & XFS_RMAP_UNWRITTEN), out_error);
+        /*
+         * If we're doing an unknown-owner removal for EFI recovery, we expect
+         * to find the full range in the rmapbt or nothing at all.  If we
+         * don't find any rmaps overlapping either end of the range, we're
+         * done.  Hopefully this means that the EFI creator already queued
+         * (and finished) a RUI to remove the rmap.
+         */
+        if (owner == XFS_RMAP_OWN_UNKNOWN &&
+            ltrec.rm_startblock + ltrec.rm_blockcount <= bno) {
+                struct xfs_rmap_irec    rtrec;
+
+                error = xfs_btree_increment(cur, 0, &i);
+                if (error)
+                        goto out_error;
+                if (i == 0)
+                        goto out_done;
+                error = xfs_rmap_get_rec(cur, &rtrec, &i);
+                if (error)
+                        goto out_error;
+                XFS_WANT_CORRUPTED_GOTO(mp, i == 1, out_error);
+                if (rtrec.rm_startblock >= bno + len)
+                        goto out_done;
+        }
 
         /* Make sure the extent we found covers the entire freeing range. */
         XFS_WANT_CORRUPTED_GOTO(mp, ltrec.rm_startblock <= bno &&
-                ltrec.rm_startblock + ltrec.rm_blockcount >=
-                bno + len, out_error);
+                        ltrec.rm_startblock + ltrec.rm_blockcount >=
+                        bno + len, out_error);
 
-        /* Make sure the owner matches what we expect to find in the tree. */
-        XFS_WANT_CORRUPTED_GOTO(mp, owner == ltrec.rm_owner ||
-                                    XFS_RMAP_NON_INODE_OWNER(owner), out_error);
-
-        /* Check the offset, if necessary. */
-        if (!XFS_RMAP_NON_INODE_OWNER(owner)) {
-                if (flags & XFS_RMAP_BMBT_BLOCK) {
-                        XFS_WANT_CORRUPTED_GOTO(mp,
-                                        ltrec.rm_flags & XFS_RMAP_BMBT_BLOCK,
-                                        out_error);
-                } else {
-                        XFS_WANT_CORRUPTED_GOTO(mp,
-                                        ltrec.rm_offset <= offset, out_error);
-                        XFS_WANT_CORRUPTED_GOTO(mp,
-                                        ltoff + ltrec.rm_blockcount >= offset + len,
-                                        out_error);
-                }
-        }
+        /* Check owner information. */
+        error = xfs_rmap_free_check_owner(mp, ltoff, &ltrec, bno, len, owner,
+                        offset, flags);
+        if (error)
+                goto out_error;
 
         if (ltrec.rm_startblock == bno && ltrec.rm_blockcount == len) {
                 /* exact match, simply remove the record from rmap tree */
@@ -664,6 +716,7 @@ xfs_rmap_map(
                 flags |= XFS_RMAP_UNWRITTEN;
         trace_xfs_rmap_map(mp, cur->bc_private.a.agno, bno, len,
                         unwritten, oinfo);
+        ASSERT(!xfs_rmap_should_skip_owner_update(oinfo));
 
         /*
          * For the initial lookup, look for an exact match or the left-adjacent
diff --git a/fs/xfs/libxfs/xfs_rmap.h b/fs/xfs/libxfs/xfs_rmap.h
index 466ede637080..0fcd5b1ba729 100644
--- a/fs/xfs/libxfs/xfs_rmap.h
+++ b/fs/xfs/libxfs/xfs_rmap.h
@@ -61,7 +61,21 @@ static inline void
 xfs_rmap_skip_owner_update(
         struct xfs_owner_info   *oi)
 {
-        oi->oi_owner = XFS_RMAP_OWN_UNKNOWN;
+        xfs_rmap_ag_owner(oi, XFS_RMAP_OWN_NULL);
+}
+
+static inline bool
+xfs_rmap_should_skip_owner_update(
+        struct xfs_owner_info   *oi)
+{
+        return oi->oi_owner == XFS_RMAP_OWN_NULL;
+}
+
+static inline void
+xfs_rmap_any_owner_update(
+        struct xfs_owner_info   *oi)
+{
+        xfs_rmap_ag_owner(oi, XFS_RMAP_OWN_UNKNOWN);
 }
 
 /* Reverse mapping functions. */
diff --git a/fs/xfs/scrub/scrub.c b/fs/xfs/scrub/scrub.c
index 9c42c4efd01e..ab3aef2ae823 100644
--- a/fs/xfs/scrub/scrub.c
+++ b/fs/xfs/scrub/scrub.c
@@ -46,7 +46,6 @@
 #include "scrub/scrub.h"
 #include "scrub/common.h"
 #include "scrub/trace.h"
-#include "scrub/scrub.h"
 #include "scrub/btree.h"
 
 /*
diff --git a/fs/xfs/scrub/trace.c b/fs/xfs/scrub/trace.c
index 472080e75788..86daed0e3a45 100644
--- a/fs/xfs/scrub/trace.c
+++ b/fs/xfs/scrub/trace.c
@@ -26,7 +26,6 @@
 #include "xfs_mount.h"
 #include "xfs_defer.h"
 #include "xfs_da_format.h"
-#include "xfs_defer.h"
 #include "xfs_inode.h"
 #include "xfs_btree.h"
 #include "xfs_trans.h"
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 21e2d70884e1..4fc526a27a94 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -399,7 +399,7 @@ xfs_map_blocks(
                (ip->i_df.if_flags & XFS_IFEXTENTS));
         ASSERT(offset <= mp->m_super->s_maxbytes);
 
-        if ((xfs_ufsize_t)offset + count > mp->m_super->s_maxbytes)
+        if (offset > mp->m_super->s_maxbytes - count)
                 count = mp->m_super->s_maxbytes - offset;
         end_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)offset + count);
         offset_fsb = XFS_B_TO_FSBT(mp, offset);
@@ -1312,7 +1312,7 @@ xfs_get_blocks(
         lockmode = xfs_ilock_data_map_shared(ip);
 
         ASSERT(offset <= mp->m_super->s_maxbytes);
-        if ((xfs_ufsize_t)offset + size > mp->m_super->s_maxbytes)
+        if (offset > mp->m_super->s_maxbytes - size)
                 size = mp->m_super->s_maxbytes - offset;
         end_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)offset + size);
         offset_fsb = XFS_B_TO_FSBT(mp, offset);
diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index 44f8c5451210..64da90655e95 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -538,7 +538,7 @@ xfs_efi_recover(
                 return error;
         efdp = xfs_trans_get_efd(tp, efip, efip->efi_format.efi_nextents);
 
-        xfs_rmap_skip_owner_update(&oinfo);
+        xfs_rmap_any_owner_update(&oinfo);
         for (i = 0; i < efip->efi_format.efi_nextents; i++) {
                 extp = &efip->efi_format.efi_extents[i];
                 error = xfs_trans_free_extent(tp, efdp, extp->ext_start,
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index 8f22fc579dbb..60a2e128cb6a 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -571,6 +571,11 @@ xfs_growfs_data_private(
                  * this doesn't actually exist in the rmap btree.
                  */
                 xfs_rmap_ag_owner(&oinfo, XFS_RMAP_OWN_NULL);
+                error = xfs_rmap_free(tp, bp, agno,
+                                be32_to_cpu(agf->agf_length) - new,
+                                new, &oinfo);
+                if (error)
+                        goto error0;
                 error = xfs_free_extent(tp,
                                 XFS_AGB_TO_FSB(mp, agno,
                                         be32_to_cpu(agf->agf_length) - new),
diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
index 43005fbe8b1e..3861d61fb265 100644
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -870,7 +870,7 @@ xfs_eofblocks_worker(
  * based on the 'speculative_cow_prealloc_lifetime' tunable (5m by default).
  * (We'll just piggyback on the post-EOF prealloc space workqueue.)
  */
-STATIC void
+void
 xfs_queue_cowblocks(
         struct xfs_mount *mp)
 {
@@ -1536,8 +1536,23 @@ xfs_inode_free_quota_eofblocks(
         return __xfs_inode_free_quota_eofblocks(ip, xfs_icache_free_eofblocks);
 }
 
+static inline unsigned long
+xfs_iflag_for_tag(
+        int             tag)
+{
+        switch (tag) {
+        case XFS_ICI_EOFBLOCKS_TAG:
+                return XFS_IEOFBLOCKS;
+        case XFS_ICI_COWBLOCKS_TAG:
+                return XFS_ICOWBLOCKS;
+        default:
+                ASSERT(0);
+                return 0;
+        }
+}
+
 static void
-__xfs_inode_set_eofblocks_tag(
+__xfs_inode_set_blocks_tag(
         xfs_inode_t     *ip,
         void            (*execute)(struct xfs_mount *mp),
         void            (*set_tp)(struct xfs_mount *mp, xfs_agnumber_t agno,
@@ -1552,10 +1567,10 @@ __xfs_inode_set_eofblocks_tag(
          * Don't bother locking the AG and looking up in the radix trees
          * if we already know that we have the tag set.
          */
-        if (ip->i_flags & XFS_IEOFBLOCKS)
+        if (ip->i_flags & xfs_iflag_for_tag(tag))
                 return;
         spin_lock(&ip->i_flags_lock);
-        ip->i_flags |= XFS_IEOFBLOCKS;
+        ip->i_flags |= xfs_iflag_for_tag(tag);
         spin_unlock(&ip->i_flags_lock);
 
         pag = xfs_perag_get(mp, XFS_INO_TO_AGNO(mp, ip->i_ino));
@@ -1587,13 +1602,13 @@ xfs_inode_set_eofblocks_tag(
         xfs_inode_t     *ip)
 {
         trace_xfs_inode_set_eofblocks_tag(ip);
-        return __xfs_inode_set_eofblocks_tag(ip, xfs_queue_eofblocks,
+        return __xfs_inode_set_blocks_tag(ip, xfs_queue_eofblocks,
                         trace_xfs_perag_set_eofblocks,
                         XFS_ICI_EOFBLOCKS_TAG);
 }
 
 static void
-__xfs_inode_clear_eofblocks_tag(
+__xfs_inode_clear_blocks_tag(
         xfs_inode_t     *ip,
         void            (*clear_tp)(struct xfs_mount *mp, xfs_agnumber_t agno,
                                     int error, unsigned long caller_ip),
@@ -1603,7 +1618,7 @@ __xfs_inode_clear_eofblocks_tag(
         struct xfs_perag *pag;
 
         spin_lock(&ip->i_flags_lock);
-        ip->i_flags &= ~XFS_IEOFBLOCKS;
+        ip->i_flags &= ~xfs_iflag_for_tag(tag);
         spin_unlock(&ip->i_flags_lock);
 
         pag = xfs_perag_get(mp, XFS_INO_TO_AGNO(mp, ip->i_ino));
@@ -1630,7 +1645,7 @@ xfs_inode_clear_eofblocks_tag(
         xfs_inode_t     *ip)
 {
         trace_xfs_inode_clear_eofblocks_tag(ip);
-        return __xfs_inode_clear_eofblocks_tag(ip,
+        return __xfs_inode_clear_blocks_tag(ip,
                         trace_xfs_perag_clear_eofblocks, XFS_ICI_EOFBLOCKS_TAG);
 }
 
@@ -1724,7 +1739,7 @@ xfs_inode_set_cowblocks_tag(
         xfs_inode_t     *ip)
 {
         trace_xfs_inode_set_cowblocks_tag(ip);
-        return __xfs_inode_set_eofblocks_tag(ip, xfs_queue_cowblocks,
+        return __xfs_inode_set_blocks_tag(ip, xfs_queue_cowblocks,
                         trace_xfs_perag_set_cowblocks,
                         XFS_ICI_COWBLOCKS_TAG);
 }
@@ -1734,6 +1749,6 @@ xfs_inode_clear_cowblocks_tag(
         xfs_inode_t     *ip)
 {
         trace_xfs_inode_clear_cowblocks_tag(ip);
-        return __xfs_inode_clear_eofblocks_tag(ip,
+        return __xfs_inode_clear_blocks_tag(ip,
                         trace_xfs_perag_clear_cowblocks, XFS_ICI_COWBLOCKS_TAG);
 }
diff --git a/fs/xfs/xfs_icache.h b/fs/xfs/xfs_icache.h
index bff4d85e5498..d4a77588eca1 100644
--- a/fs/xfs/xfs_icache.h
+++ b/fs/xfs/xfs_icache.h
@@ -81,6 +81,7 @@ void xfs_inode_clear_cowblocks_tag(struct xfs_inode *ip);
 int xfs_icache_free_cowblocks(struct xfs_mount *, struct xfs_eofblocks *);
 int xfs_inode_free_quota_cowblocks(struct xfs_inode *ip);
 void xfs_cowblocks_worker(struct work_struct *);
+void xfs_queue_cowblocks(struct xfs_mount *);
 
 int xfs_inode_ag_iterator(struct xfs_mount *mp,
         int (*execute)(struct xfs_inode *ip, int flags, void *args),
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 801274126648..6f95bdb408ce 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -749,7 +749,6 @@ xfs_ialloc(
         xfs_nlink_t     nlink,
         dev_t           rdev,
         prid_t          prid,
-        int             okalloc,
         xfs_buf_t       **ialloc_context,
         xfs_inode_t     **ipp)
 {
@@ -765,7 +764,7 @@ xfs_ialloc(
          * Call the space management code to pick
          * the on-disk inode to be allocated.
          */
-        error = xfs_dialloc(tp, pip ? pip->i_ino : 0, mode, okalloc,
+        error = xfs_dialloc(tp, pip ? pip->i_ino : 0, mode,
                             ialloc_context, &ino);
         if (error)
                 return error;
@@ -957,7 +956,6 @@ xfs_dir_ialloc(
         xfs_nlink_t     nlink,
         dev_t           rdev,
         prid_t          prid,           /* project id */
-        int             okalloc,        /* ok to allocate new space */
         xfs_inode_t     **ipp,          /* pointer to inode; it will be
                                            locked. */
         int             *committed)
@@ -988,8 +986,8 @@ xfs_dir_ialloc(
          * transaction commit so that no other process can steal
          * the inode(s) that we've just allocated.
          */
-        code = xfs_ialloc(tp, dp, mode, nlink, rdev, prid, okalloc,
-                          &ialloc_context, &ip);
+        code = xfs_ialloc(tp, dp, mode, nlink, rdev, prid, &ialloc_context,
+                        &ip);
 
         /*
          * Return an error if we were unable to allocate a new inode.
@@ -1061,7 +1059,7 @@ xfs_dir_ialloc(
                  * this call should always succeed.
                  */
                 code = xfs_ialloc(tp, dp, mode, nlink, rdev, prid,
-                                  okalloc, &ialloc_context, &ip);
+                                  &ialloc_context, &ip);
 
                 /*
                  * If we get an error at this point, return to the caller
@@ -1182,11 +1180,6 @@ xfs_create(
                 xfs_flush_inodes(mp);
                 error = xfs_trans_alloc(mp, tres, resblks, 0, 0, &tp);
         }
-        if (error == -ENOSPC) {
-                /* No space at all so try a "no-allocation" reservation */
-                resblks = 0;
-                error = xfs_trans_alloc(mp, tres, 0, 0, 0, &tp);
-        }
         if (error)
                 goto out_release_inode;
 
@@ -1203,19 +1196,13 @@ xfs_create(
         if (error)
                 goto out_trans_cancel;
 
-        if (!resblks) {
-                error = xfs_dir_canenter(tp, dp, name);
-                if (error)
-                        goto out_trans_cancel;
-        }
-
         /*
          * A newly created regular or special file just has one directory
          * entry pointing to them, but a directory also the "." entry
          * pointing to itself.
          */
-        error = xfs_dir_ialloc(&tp, dp, mode, is_dir ? 2 : 1, rdev,
-                               prid, resblks > 0, &ip, NULL);
+        error = xfs_dir_ialloc(&tp, dp, mode, is_dir ? 2 : 1, rdev, prid, &ip,
+                        NULL);
         if (error)
                 goto out_trans_cancel;
 
@@ -1340,11 +1327,6 @@ xfs_create_tmpfile(
         tres = &M_RES(mp)->tr_create_tmpfile;
 
         error = xfs_trans_alloc(mp, tres, resblks, 0, 0, &tp);
-        if (error == -ENOSPC) {
-                /* No space at all so try a "no-allocation" reservation */
-                resblks = 0;
-                error = xfs_trans_alloc(mp, tres, 0, 0, 0, &tp);
-        }
         if (error)
                 goto out_release_inode;
 
@@ -1353,8 +1335,7 @@ xfs_create_tmpfile(
         if (error)
                 goto out_trans_cancel;
 
-        error = xfs_dir_ialloc(&tp, dp, mode, 1, 0,
-                                prid, resblks > 0, &ip, NULL);
+        error = xfs_dir_ialloc(&tp, dp, mode, 1, 0, prid, &ip, NULL);
         if (error)
                 goto out_trans_cancel;
 
@@ -1506,6 +1487,24 @@ xfs_link(
         return error;
 }
 
+/* Clear the reflink flag and the cowblocks tag if possible. */
+static void
+xfs_itruncate_clear_reflink_flags(
+        struct xfs_inode        *ip)
+{
+        struct xfs_ifork        *dfork;
+        struct xfs_ifork        *cfork;
+
+        if (!xfs_is_reflink_inode(ip))
+                return;
+        dfork = XFS_IFORK_PTR(ip, XFS_DATA_FORK);
+        cfork = XFS_IFORK_PTR(ip, XFS_COW_FORK);
+        if (dfork->if_bytes == 0 && cfork->if_bytes == 0)
+                ip->i_d.di_flags2 &= ~XFS_DIFLAG2_REFLINK;
+        if (cfork->if_bytes == 0)
+                xfs_inode_clear_cowblocks_tag(ip);
+}
+
 /*
  * Free up the underlying blocks past new_size.  The new size must be smaller
  * than the current size.  This routine can be used both for the attribute and
@@ -1602,15 +1601,7 @@ xfs_itruncate_extents(
         if (error)
                 goto out;
 
-        /*
-         * Clear the reflink flag if there are no data fork blocks and
-         * there are no extents staged in the cow fork.
-         */
-        if (xfs_is_reflink_inode(ip) && ip->i_cnextents == 0) {
-                if (ip->i_d.di_nblocks == 0)
-                        ip->i_d.di_flags2 &= ~XFS_DIFLAG2_REFLINK;
-                xfs_inode_clear_cowblocks_tag(ip);
-        }
+        xfs_itruncate_clear_reflink_flags(ip);
 
         /*
          * Always re-log the inode so that our permanent transaction can keep
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index cc13c3763721..d383e392ec9d 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -232,6 +232,7 @@ static inline bool xfs_is_reflink_inode(struct xfs_inode *ip)
  * log recovery to replay a bmap operation on the inode.
  */
 #define XFS_IRECOVERY           (1 << 11)
+#define XFS_ICOWBLOCKS          (1 << 12)/* has the cowblocks tag set */
 
 /*
  * Per-lifetime flags need to be reset when re-using a reclaimable inode during
@@ -428,7 +429,7 @@ xfs_extlen_t	xfs_get_extsz_hint(struct xfs_inode *ip);
 xfs_extlen_t    xfs_get_cowextsz_hint(struct xfs_inode *ip);
 
 int             xfs_dir_ialloc(struct xfs_trans **, struct xfs_inode *, umode_t,
-                               xfs_nlink_t, dev_t, prid_t, int,
+                               xfs_nlink_t, dev_t, prid_t,
                                struct xfs_inode **, int *);
 
 /* from xfs_file.c */
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 33eb4fb2e3fd..66e1edbfb2b2 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -1006,7 +1006,7 @@ xfs_file_iomap_begin(
         }
 
         ASSERT(offset <= mp->m_super->s_maxbytes);
-        if ((xfs_fsize_t)offset + length > mp->m_super->s_maxbytes)
+        if (offset > mp->m_super->s_maxbytes - length)
                 length = mp->m_super->s_maxbytes - offset;
         offset_fsb = XFS_B_TO_FSBT(mp, offset);
         end_fsb = XFS_B_TO_FSB(mp, offset + length);
@@ -1213,7 +1213,7 @@ xfs_xattr_iomap_begin(
 
         ASSERT(ip->i_d.di_aformat != XFS_DINODE_FMT_LOCAL);
         error = xfs_bmapi_read(ip, offset_fsb, end_fsb - offset_fsb, &imap,
-                               &nimaps, XFS_BMAPI_ENTIRE | XFS_BMAPI_ATTRFORK);
+                               &nimaps, XFS_BMAPI_ATTRFORK);
 out_unlock:
         xfs_iunlock(ip, lockmode);
 
diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
index 010a13a201aa..b897b11afb2c 100644
--- a/fs/xfs/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
@@ -48,7 +48,7 @@
 STATIC int      xfs_qm_init_quotainos(xfs_mount_t *);
 STATIC int      xfs_qm_init_quotainfo(xfs_mount_t *);
 
-
+STATIC void     xfs_qm_destroy_quotainos(xfs_quotainfo_t *qi);
 STATIC void     xfs_qm_dqfree_one(struct xfs_dquot *dqp);
 /*
  * We use the batch lookup interface to iterate over the dquots as it
@@ -695,9 +695,17 @@ xfs_qm_init_quotainfo(
         qinf->qi_shrinker.scan_objects = xfs_qm_shrink_scan;
         qinf->qi_shrinker.seeks = DEFAULT_SEEKS;
         qinf->qi_shrinker.flags = SHRINKER_NUMA_AWARE;
-        register_shrinker(&qinf->qi_shrinker);
+
+        error = register_shrinker(&qinf->qi_shrinker);
+        if (error)
+                goto out_free_inos;
+
         return 0;
 
+out_free_inos:
+        mutex_destroy(&qinf->qi_quotaofflock);
+        mutex_destroy(&qinf->qi_tree_lock);
+        xfs_qm_destroy_quotainos(qinf);
 out_free_lru:
         list_lru_destroy(&qinf->qi_lru);
 out_free_qinf:
@@ -706,7 +714,6 @@ out_free_qinf:
         return error;
 }
 
-
 /*
  * Gets called when unmounting a filesystem or when all quotas get
  * turned off.
@@ -723,19 +730,8 @@ xfs_qm_destroy_quotainfo(
 
         unregister_shrinker(&qi->qi_shrinker);
         list_lru_destroy(&qi->qi_lru);
-
-        if (qi->qi_uquotaip) {
-                IRELE(qi->qi_uquotaip);
-                qi->qi_uquotaip = NULL; /* paranoia */
-        }
-        if (qi->qi_gquotaip) {
-                IRELE(qi->qi_gquotaip);
-                qi->qi_gquotaip = NULL;
-        }
-        if (qi->qi_pquotaip) {
-                IRELE(qi->qi_pquotaip);
-                qi->qi_pquotaip = NULL;
-        }
+        xfs_qm_destroy_quotainos(qi);
+        mutex_destroy(&qi->qi_tree_lock);
         mutex_destroy(&qi->qi_quotaofflock);
         kmem_free(qi);
         mp->m_quotainfo = NULL;
@@ -793,8 +789,8 @@ xfs_qm_qino_alloc(
                 return error;
 
         if (need_alloc) {
-                error = xfs_dir_ialloc(&tp, NULL, S_IFREG, 1, 0, 0, 1, ip,
-                                                                &committed);
+                error = xfs_dir_ialloc(&tp, NULL, S_IFREG, 1, 0, 0, ip,
+                                &committed);
                 if (error) {
                         xfs_trans_cancel(tp);
                         return error;
@@ -1600,6 +1596,24 @@ error_rele:
 }
 
 STATIC void
+xfs_qm_destroy_quotainos(
+        xfs_quotainfo_t *qi)
+{
+        if (qi->qi_uquotaip) {
+                IRELE(qi->qi_uquotaip);
+                qi->qi_uquotaip = NULL; /* paranoia */
+        }
+        if (qi->qi_gquotaip) {
+                IRELE(qi->qi_gquotaip);
+                qi->qi_gquotaip = NULL;
+        }
+        if (qi->qi_pquotaip) {
+                IRELE(qi->qi_pquotaip);
+                qi->qi_pquotaip = NULL;
+        }
+}
+
+STATIC void
 xfs_qm_dqfree_one(
         struct xfs_dquot        *dqp)
 {
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index cc041a29eb70..47aea2e82c26 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -49,8 +49,6 @@
 #include "xfs_alloc.h"
 #include "xfs_quota_defs.h"
 #include "xfs_quota.h"
-#include "xfs_btree.h"
-#include "xfs_bmap_btree.h"
 #include "xfs_reflink.h"
 #include "xfs_iomap.h"
 #include "xfs_rmap_btree.h"
@@ -456,6 +454,8 @@ retry:
         if (error)
                 goto out_bmap_cancel;
 
+        xfs_inode_set_cowblocks_tag(ip);
+
         /* Finish up. */
         error = xfs_defer_finish(&tp, &dfops);
         if (error)
@@ -492,8 +492,9 @@ xfs_reflink_find_cow_mapping(
         struct xfs_iext_cursor          icur;
 
         ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL | XFS_ILOCK_SHARED));
-        ASSERT(xfs_is_reflink_inode(ip));
 
+        if (!xfs_is_reflink_inode(ip))
+                return false;
         offset_fsb = XFS_B_TO_FSBT(ip->i_mount, offset);
         if (!xfs_iext_lookup_extent(ip, ifp, offset_fsb, &icur, &got))
                 return false;
@@ -612,6 +613,9 @@ xfs_reflink_cancel_cow_blocks(
 
                         /* Remove the mapping from the CoW fork. */
                         xfs_bmap_del_extent_cow(ip, &icur, &got, &del);
+                } else {
+                        /* Didn't do anything, push cursor back. */
+                        xfs_iext_prev(ifp, &icur);
                 }
 next_extent:
                 if (!xfs_iext_get_extent(ifp, &icur, &got))
@@ -727,7 +731,7 @@ xfs_reflink_end_cow(
                         (unsigned int)(end_fsb - offset_fsb),
                         XFS_DATA_FORK);
         error = xfs_trans_alloc(ip->i_mount, &M_RES(ip->i_mount)->tr_write,
-                        resblks, 0, 0, &tp);
+                        resblks, 0, XFS_TRANS_RESERVE, &tp);
         if (error)
                 goto out;
 
@@ -1293,6 +1297,17 @@ xfs_reflink_remap_range(
 
         trace_xfs_reflink_remap_range(src, pos_in, len, dest, pos_out);
 
+        /*
+         * Clear out post-eof preallocations because we don't have page cache
+         * backing the delayed allocations and they'll never get freed on
+         * their own.
+         */
+        if (xfs_can_free_eofblocks(dest, true)) {
+                ret = xfs_free_eofblocks(dest);
+                if (ret)
+                        goto out_unlock;
+        }
+
         /* Set flags and remap blocks. */
         ret = xfs_reflink_set_inode_flag(src, dest);
         if (ret)
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index 5122d3021117..1dacccc367f8 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1360,6 +1360,7 @@ xfs_fs_remount(
                         xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
                         return error;
                 }
+                xfs_queue_cowblocks(mp);
 
                 /* Create the per-AG metadata reservation pool .*/
                 error = xfs_fs_reserve_ag_blocks(mp);
@@ -1369,6 +1370,14 @@ xfs_fs_remount(
 
         /* rw -> ro */
         if (!(mp->m_flags & XFS_MOUNT_RDONLY) && (*flags & SB_RDONLY)) {
+                /* Get rid of any leftover CoW reservations... */
+                cancel_delayed_work_sync(&mp->m_cowblocks_work);
+                error = xfs_icache_free_cowblocks(mp, NULL);
+                if (error) {
+                        xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
+                        return error;
+                }
+
                 /* Free the per-AG metadata reservation pool. */
                 error = xfs_fs_unreserve_ag_blocks(mp);
                 if (error) {
diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c
index 68d3ca2c4968..2e9e793a8f9d 100644
--- a/fs/xfs/xfs_symlink.c
+++ b/fs/xfs/xfs_symlink.c
@@ -232,11 +232,6 @@ xfs_symlink(
         resblks = XFS_SYMLINK_SPACE_RES(mp, link_name->len, fs_blocks);
 
         error = xfs_trans_alloc(mp, &M_RES(mp)->tr_symlink, resblks, 0, 0, &tp);
-        if (error == -ENOSPC && fs_blocks == 0) {
-                resblks = 0;
-                error = xfs_trans_alloc(mp, &M_RES(mp)->tr_symlink, 0, 0, 0,
-                                &tp);
-        }
         if (error)
                 goto out_release_inode;
 
@@ -260,14 +255,6 @@ xfs_symlink(
                 goto out_trans_cancel;
 
         /*
-         * Check for ability to enter directory entry, if no space reserved.
-         */
-        if (!resblks) {
-                error = xfs_dir_canenter(tp, dp, link_name);
-                if (error)
-                        goto out_trans_cancel;
-        }
-        /*
          * Initialize the bmap freelist prior to calling either
          * bmapi or the directory create code.
          */
@@ -277,7 +264,7 @@ xfs_symlink(
          * Allocate an inode for the symlink.
          */
         error = xfs_dir_ialloc(&tp, dp, S_IFLNK | (mode & ~S_IFMT), 1, 0,
-                               prid, resblks > 0, &ip, NULL);
+                               prid, &ip, NULL);
         if (error)
                 goto out_trans_cancel;
 
diff --git a/fs/xfs/xfs_trace.c b/fs/xfs/xfs_trace.c
index 5d95fe348294..35f3546b6af5 100644
--- a/fs/xfs/xfs_trace.c
+++ b/fs/xfs/xfs_trace.c
@@ -24,7 +24,6 @@
 #include "xfs_mount.h"
 #include "xfs_defer.h"
 #include "xfs_da_format.h"
-#include "xfs_defer.h"
 #include "xfs_inode.h"
 #include "xfs_btree.h"
 #include "xfs_da_btree.h"
diff --git a/include/asm-generic/mm_hooks.h b/include/asm-generic/mm_hooks.h
index ea189d88a3cc..8ac4e68a12f0 100644
--- a/include/asm-generic/mm_hooks.h
+++ b/include/asm-generic/mm_hooks.h
@@ -7,9 +7,10 @@
 #ifndef _ASM_GENERIC_MM_HOOKS_H
 #define _ASM_GENERIC_MM_HOOKS_H
 
-static inline void arch_dup_mmap(struct mm_struct *oldmm,
-                                 struct mm_struct *mm)
+static inline int arch_dup_mmap(struct mm_struct *oldmm,
+                                struct mm_struct *mm)
 {
+        return 0;
 }
 
 static inline void arch_exit_mmap(struct mm_struct *mm)
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index b234d54f2cb6..868e68561f91 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -1025,6 +1025,11 @@ static inline int pmd_clear_huge(pmd_t *pmd)
 struct file;
 int phys_mem_access_prot_allowed(struct file *file, unsigned long pfn,
                         unsigned long size, pgprot_t *vma_prot);
+
+#ifndef CONFIG_X86_ESPFIX64
+static inline void init_espfix_bsp(void) { }
+#endif
+
 #endif /* !__ASSEMBLY__ */
 
 #ifndef io_remap_pfn_range
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index 38d9c5861ed8..f38227a78eae 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -18,6 +18,7 @@
 #include <linux/if_alg.h>
 #include <linux/scatterlist.h>
 #include <linux/types.h>
+#include <linux/atomic.h>
 #include <net/sock.h>
 
 #include <crypto/aead.h>
@@ -150,7 +151,7 @@ struct af_alg_ctx {
         struct crypto_wait wait;
 
         size_t used;
-        size_t rcvused;
+        atomic_t rcvused;
 
         bool more;
         bool merge;
@@ -215,7 +216,7 @@ static inline int af_alg_rcvbuf(struct sock *sk)
         struct af_alg_ctx *ctx = ask->private;
 
         return max_t(int, max_t(int, sk->sk_rcvbuf & PAGE_MASK, PAGE_SIZE) -
-                          ctx->rcvused, 0);
+                     atomic_read(&ctx->rcvused), 0);
 }
 
 /**
diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h
index f0b44c16e88f..c2bae8da642c 100644
--- a/include/crypto/internal/hash.h
+++ b/include/crypto/internal/hash.h
@@ -82,6 +82,14 @@ int ahash_register_instance(struct crypto_template *tmpl,
                             struct ahash_instance *inst);
 void ahash_free_instance(struct crypto_instance *inst);
 
+int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
+                    unsigned int keylen);
+
+static inline bool crypto_shash_alg_has_setkey(struct shash_alg *alg)
+{
+        return alg->setkey != shash_no_setkey;
+}
+
 int crypto_init_ahash_spawn(struct crypto_ahash_spawn *spawn,
                             struct hash_alg_common *alg,
                             struct crypto_instance *inst);
diff --git a/include/crypto/mcryptd.h b/include/crypto/mcryptd.h
index cceafa01f907..b67404fc4b34 100644
--- a/include/crypto/mcryptd.h
+++ b/include/crypto/mcryptd.h
@@ -27,6 +27,7 @@ static inline struct mcryptd_ahash *__mcryptd_ahash_cast(
 
 struct mcryptd_cpu_queue {
         struct crypto_queue queue;
+        spinlock_t q_lock;
         struct work_struct work;
 };
 
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index df9807a3caae..5971577016a2 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -24,6 +24,7 @@
 #define __DRM_CONNECTOR_H__
 
 #include <linux/list.h>
+#include <linux/llist.h>
 #include <linux/ctype.h>
 #include <linux/hdmi.h>
 #include <drm/drm_mode_object.h>
@@ -916,6 +917,15 @@ struct drm_connector {
         uint8_t num_h_tile, num_v_tile;
         uint8_t tile_h_loc, tile_v_loc;
         uint16_t tile_h_size, tile_v_size;
+
+        /**
+         * @free_node:
+         *
+         * List used only by &drm_connector_iter to be able to clean up a
+         * connector from any context, in conjunction with
+         * &drm_mode_config.connector_free_work.
+         */
+        struct llist_node free_node;
 };
 
 #define obj_to_connector(x) container_of(x, struct drm_connector, base)
diff --git a/include/drm/drm_edid.h b/include/drm/drm_edid.h
index 2ec41d032e56..efe6d5a8e834 100644
--- a/include/drm/drm_edid.h
+++ b/include/drm/drm_edid.h
@@ -465,6 +465,8 @@ struct edid *drm_get_edid(struct drm_connector *connector,
 struct edid *drm_get_edid_switcheroo(struct drm_connector *connector,
                                      struct i2c_adapter *adapter);
 struct edid *drm_edid_duplicate(const struct edid *edid);
+void drm_reset_display_info(struct drm_connector *connector);
+u32 drm_add_display_info(struct drm_connector *connector, const struct edid *edid);
 int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid);
 
 u8 drm_match_cea_mode(const struct drm_display_mode *to_match);
diff --git a/include/drm/drm_mode_config.h b/include/drm/drm_mode_config.h
index b21e827c5c78..b0ce26d71296 100644
--- a/include/drm/drm_mode_config.h
+++ b/include/drm/drm_mode_config.h
@@ -27,6 +27,7 @@
 #include <linux/types.h>
 #include <linux/idr.h>
 #include <linux/workqueue.h>
+#include <linux/llist.h>
 
 #include <drm/drm_modeset_lock.h>
 
@@ -393,7 +394,7 @@ struct drm_mode_config {
 
         /**
          * @connector_list_lock: Protects @num_connector and
-         * @connector_list.
+         * @connector_list and @connector_free_list.
          */
         spinlock_t connector_list_lock;
         /**
@@ -414,6 +415,21 @@ struct drm_mode_config {
          */
         struct list_head connector_list;
         /**
+         * @connector_free_list:
+         *
+         * List of connector objects linked with &drm_connector.free_head.
+         * Protected by @connector_list_lock. Used by
+         * drm_for_each_connector_iter() and
+         * &struct drm_connector_list_iter to savely free connectors using
+         * @connector_free_work.
+         */
+        struct llist_head connector_free_list;
+        /**
+         * @connector_free_work: Work to clean up @connector_free_list.
+         */
+        struct work_struct connector_free_work;
+
+        /**
          * @num_encoder:
          *
          * Number of encoders on this device. This is invariant over the
diff --git a/include/kvm/arm_arch_timer.h b/include/kvm/arm_arch_timer.h
index 01ee473517e2..9da6ce22803f 100644
--- a/include/kvm/arm_arch_timer.h
+++ b/include/kvm/arm_arch_timer.h
@@ -62,7 +62,7 @@ struct arch_timer_cpu {
         bool                    enabled;
 };
 
-int kvm_timer_hyp_init(void);
+int kvm_timer_hyp_init(bool);
 int kvm_timer_enable(struct kvm_vcpu *vcpu);
 int kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu);
 void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu);
@@ -93,7 +93,4 @@ void kvm_timer_init_vhe(void);
 #define vcpu_vtimer(v)  (&(v)->arch.timer_cpu.vtimer)
 #define vcpu_ptimer(v)  (&(v)->arch.timer_cpu.ptimer)
 
-void enable_el1_phys_timer_access(void);
-void disable_el1_phys_timer_access(void);
-
 #endif
diff --git a/include/linux/bio.h b/include/linux/bio.h
index 82f0c8fd7be8..23d29b39f71e 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -492,6 +492,8 @@ extern unsigned int bvec_nr_vecs(unsigned short idx);
 
 #define bio_set_dev(bio, bdev)                  \
 do {                                            \
+        if ((bio)->bi_disk != (bdev)->bd_disk)  \
+                bio_clear_flag(bio, BIO_THROTTLED);\
         (bio)->bi_disk = (bdev)->bd_disk;       \
         (bio)->bi_partno = (bdev)->bd_partno;   \
 } while (0)
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index a1e628e032da..9e7d8bd776d2 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -50,8 +50,6 @@ struct blk_issue_stat {
 struct bio {
         struct bio              *bi_next;       /* request queue link */
         struct gendisk          *bi_disk;
-        u8                      bi_partno;
-        blk_status_t            bi_status;
         unsigned int            bi_opf;         /* bottom bits req flags,
                                                  * top bits REQ_OP. Use
                                                  * accessors.
@@ -59,8 +57,8 @@ struct bio {
         unsigned short          bi_flags;       /* status, etc and bvec pool number */
         unsigned short          bi_ioprio;
         unsigned short          bi_write_hint;
-
-        struct bvec_iter        bi_iter;
+        blk_status_t            bi_status;
+        u8                      bi_partno;
 
         /* Number of segments in this BIO after
          * physical address coalescing is performed.
@@ -74,8 +72,9 @@ struct bio {
         unsigned int            bi_seg_front_size;
         unsigned int            bi_seg_back_size;
 
-        atomic_t                __bi_remaining;
+        struct bvec_iter        bi_iter;
 
+        atomic_t                __bi_remaining;
         bio_end_io_t            *bi_end_io;
 
         void                    *bi_private;
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 8089ca17db9a..0ce8a372d506 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -135,7 +135,7 @@ typedef __u32 __bitwise req_flags_t;
 struct request {
         struct list_head queuelist;
         union {
-                call_single_data_t csd;
+                struct __call_single_data csd;
                 u64 fifo_time;
         };
 
@@ -241,14 +241,24 @@ struct request {
         struct request *next_rq;
 };
 
+static inline bool blk_op_is_scsi(unsigned int op)
+{
+        return op == REQ_OP_SCSI_IN || op == REQ_OP_SCSI_OUT;
+}
+
+static inline bool blk_op_is_private(unsigned int op)
+{
+        return op == REQ_OP_DRV_IN || op == REQ_OP_DRV_OUT;
+}
+
 static inline bool blk_rq_is_scsi(struct request *rq)
 {
-        return req_op(rq) == REQ_OP_SCSI_IN || req_op(rq) == REQ_OP_SCSI_OUT;
+        return blk_op_is_scsi(req_op(rq));
 }
 
 static inline bool blk_rq_is_private(struct request *rq)
 {
-        return req_op(rq) == REQ_OP_DRV_IN || req_op(rq) == REQ_OP_DRV_OUT;
+        return blk_op_is_private(req_op(rq));
 }
 
 static inline bool blk_rq_is_passthrough(struct request *rq)
@@ -256,6 +266,13 @@ static inline bool blk_rq_is_passthrough(struct request *rq)
         return blk_rq_is_scsi(rq) || blk_rq_is_private(rq);
 }
 
+static inline bool bio_is_passthrough(struct bio *bio)
+{
+        unsigned op = bio_op(bio);
+
+        return blk_op_is_scsi(op) || blk_op_is_private(op);
+}
+
 static inline unsigned short req_get_ioprio(struct request *req)
 {
         return req->ioprio;
@@ -948,7 +965,7 @@ extern int blk_rq_prep_clone(struct request *rq, struct request *rq_src,
 extern void blk_rq_unprep_clone(struct request *rq);
 extern blk_status_t blk_insert_cloned_request(struct request_queue *q,
                                      struct request *rq);
-extern int blk_rq_append_bio(struct request *rq, struct bio *bio);
+extern int blk_rq_append_bio(struct request *rq, struct bio **bio);
 extern void blk_delay_queue(struct request_queue *, unsigned long);
 extern void blk_queue_split(struct request_queue *, struct bio **);
 extern void blk_recount_segments(struct request_queue *, struct bio *);
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index e55e4255a210..0b25cf87b6d6 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -43,7 +43,14 @@ struct bpf_map_ops {
 };
 
 struct bpf_map {
-        atomic_t refcnt;
+        /* 1st cacheline with read-mostly members of which some
+         * are also accessed in fast-path (e.g. ops, max_entries).
+         */
+        const struct bpf_map_ops *ops ____cacheline_aligned;
+        struct bpf_map *inner_map_meta;
+#ifdef CONFIG_SECURITY
+        void *security;
+#endif
         enum bpf_map_type map_type;
         u32 key_size;
         u32 value_size;
@@ -52,15 +59,17 @@ struct bpf_map {
         u32 pages;
         u32 id;
         int numa_node;
-        struct user_struct *user;
-        const struct bpf_map_ops *ops;
-        struct work_struct work;
+        bool unpriv_array;
+        /* 7 bytes hole */
+
+        /* 2nd cacheline with misc members to avoid false sharing
+         * particularly with refcounting.
+         */
+        struct user_struct *user ____cacheline_aligned;
+        atomic_t refcnt;
         atomic_t usercnt;
-        struct bpf_map *inner_map_meta;
+        struct work_struct work;
         char name[BPF_OBJ_NAME_LEN];
-#ifdef CONFIG_SECURITY
-        void *security;
-#endif
 };
 
 /* function argument constraints */
@@ -221,6 +230,7 @@ struct bpf_prog_aux {
 struct bpf_array {
         struct bpf_map map;
         u32 elem_size;
+        u32 index_mask;
         /* 'ownership' of prog_array is claimed by the first program that
          * is going to use this map or by the first program which FD is stored
          * in the map to make sure that all callers and callees have the same
@@ -419,6 +429,8 @@ static inline int bpf_map_attr_numa_node(const union bpf_attr *attr)
                 attr->numa_node : NUMA_NO_NODE;
 }
 
+struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type type);
+
 #else /* !CONFIG_BPF_SYSCALL */
 static inline struct bpf_prog *bpf_prog_get(u32 ufd)
 {
@@ -506,6 +518,12 @@ static inline int cpu_map_enqueue(struct bpf_cpu_map_entry *rcpu,
 {
         return 0;
 }
+
+static inline struct bpf_prog *bpf_prog_get_type_path(const char *name,
+                                enum bpf_prog_type type)
+{
+        return ERR_PTR(-EOPNOTSUPP);
+}
 #endif /* CONFIG_BPF_SYSCALL */
 
 static inline struct bpf_prog *bpf_prog_get_type(u32 ufd,
@@ -514,6 +532,8 @@ static inline struct bpf_prog *bpf_prog_get_type(u32 ufd,
         return bpf_prog_get_type_dev(ufd, type, false);
 }
 
+bool bpf_prog_get_ok(struct bpf_prog *, enum bpf_prog_type *, bool);
+
 int bpf_prog_offload_compile(struct bpf_prog *prog);
 void bpf_prog_offload_destroy(struct bpf_prog *prog);
 
diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index c561b986bab0..1632bb13ad8a 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -15,11 +15,11 @@
  * In practice this is far bigger than any realistic pointer offset; this limit
  * ensures that umax_value + (int)off + (int)size cannot overflow a u64.
  */
-#define BPF_MAX_VAR_OFF (1ULL << 31)
+#define BPF_MAX_VAR_OFF (1 << 29)
 /* Maximum variable size permitted for ARG_CONST_SIZE[_OR_ZERO].  This ensures
  * that converting umax_value to int cannot overflow.
  */
-#define BPF_MAX_VAR_SIZ INT_MAX
+#define BPF_MAX_VAR_SIZ (1 << 29)
 
 /* Liveness marks, used for registers and spilled-regs (in stack slots).
  * Read marks propagate upwards until they find a write mark; they record that
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 2272ded07496..631354acfa72 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -219,7 +219,7 @@
 /* Mark a function definition as prohibited from being cloned. */
 #define __noclone       __attribute__((__noclone__, __optimize__("no-tracer")))
 
-#ifdef RANDSTRUCT_PLUGIN
+#if defined(RANDSTRUCT_PLUGIN) && !defined(__CHECKER__)
 #define __randomize_layout __attribute__((randomize_layout))
 #define __no_randomize_layout __attribute__((no_randomize_layout))
 #endif
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 188ed9f65517..52e611ab9a6c 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -220,21 +220,21 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
 /*
  * Prevent the compiler from merging or refetching reads or writes. The
  * compiler is also forbidden from reordering successive instances of
- * READ_ONCE, WRITE_ONCE and ACCESS_ONCE (see below), but only when the
- * compiler is aware of some particular ordering.  One way to make the
- * compiler aware of ordering is to put the two invocations of READ_ONCE,
- * WRITE_ONCE or ACCESS_ONCE() in different C statements.
+ * READ_ONCE and WRITE_ONCE, but only when the compiler is aware of some
+ * particular ordering. One way to make the compiler aware of ordering is to
+ * put the two invocations of READ_ONCE or WRITE_ONCE in different C
+ * statements.
  *
- * In contrast to ACCESS_ONCE these two macros will also work on aggregate
- * data types like structs or unions. If the size of the accessed data
- * type exceeds the word size of the machine (e.g., 32 bits or 64 bits)
- * READ_ONCE() and WRITE_ONCE() will fall back to memcpy(). There's at
- * least two memcpy()s: one for the __builtin_memcpy() and then one for
- * the macro doing the copy of variable - '__u' allocated on the stack.
+ * These two macros will also work on aggregate data types like structs or
+ * unions. If the size of the accessed data type exceeds the word size of
+ * the machine (e.g., 32 bits or 64 bits) READ_ONCE() and WRITE_ONCE() will
+ * fall back to memcpy(). There's at least two memcpy()s: one for the
+ * __builtin_memcpy() and then one for the macro doing the copy of variable
+ * - '__u' allocated on the stack.
  *
  * Their two major use cases are: (1) Mediating communication between
  * process-level code and irq/NMI handlers, all running on the same CPU,
- * and (2) Ensuring that the compiler does not  fold, spindle, or otherwise
+ * and (2) Ensuring that the compiler does not fold, spindle, or otherwise
  * mutilate accesses that either do not require ordering or that interact
  * with an explicit memory barrier or atomic instruction that provides the
  * required ordering.
@@ -327,29 +327,4 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
         compiletime_assert(__native_word(t),                            \
                 "Need native word sized stores/loads for atomicity.")
 
-/*
- * Prevent the compiler from merging or refetching accesses.  The compiler
- * is also forbidden from reordering successive instances of ACCESS_ONCE(),
- * but only when the compiler is aware of some particular ordering.  One way
- * to make the compiler aware of ordering is to put the two invocations of
- * ACCESS_ONCE() in different C statements.
- *
- * ACCESS_ONCE will only work on scalar types. For union types, ACCESS_ONCE
- * on a union member will work as long as the size of the member matches the
- * size of the union and the size is smaller than word size.
- *
- * The major use cases of ACCESS_ONCE used to be (1) Mediating communication
- * between process-level code and irq/NMI handlers, all running on the same CPU,
- * and (2) Ensuring that the compiler does not  fold, spindle, or otherwise
- * mutilate accesses that either do not require ordering or that interact
- * with an explicit memory barrier or atomic instruction that provides the
- * required ordering.
- *
- * If possible use READ_ONCE()/WRITE_ONCE() instead.
- */
-#define __ACCESS_ONCE(x) ({ \
-         __maybe_unused typeof(x) __var = (__force typeof(x)) 0; \
-        (volatile typeof(x) *)&(x); })
-#define ACCESS_ONCE(x) (*__ACCESS_ONCE(x))
-
 #endif /* __LINUX_COMPILER_H */
diff --git a/include/linux/completion.h b/include/linux/completion.h
index 0662a417febe..519e94915d18 100644
--- a/include/linux/completion.h
+++ b/include/linux/completion.h
@@ -10,9 +10,6 @@
  */
 
 #include <linux/wait.h>
-#ifdef CONFIG_LOCKDEP_COMPLETIONS
-#include <linux/lockdep.h>
-#endif
 
 /*
  * struct completion - structure used to maintain state for a "completion"
@@ -29,58 +26,15 @@
 struct completion {
         unsigned int done;
         wait_queue_head_t wait;
-#ifdef CONFIG_LOCKDEP_COMPLETIONS
-        struct lockdep_map_cross map;
-#endif
 };
 
-#ifdef CONFIG_LOCKDEP_COMPLETIONS
-static inline void complete_acquire(struct completion *x)
-{
-        lock_acquire_exclusive((struct lockdep_map *)&x->map, 0, 0, NULL, _RET_IP_);
-}
-
-static inline void complete_release(struct completion *x)
-{
-        lock_release((struct lockdep_map *)&x->map, 0, _RET_IP_);
-}
-
-static inline void complete_release_commit(struct completion *x)
-{
-        lock_commit_crosslock((struct lockdep_map *)&x->map);
-}
-
-#define init_completion_map(x, m)                                       \
-do {                                                                    \
-        lockdep_init_map_crosslock((struct lockdep_map *)&(x)->map,     \
-                        (m)->name, (m)->key, 0);                                \
-        __init_completion(x);                                           \
-} while (0)
-
-#define init_completion(x)                                              \
-do {                                                                    \
-        static struct lock_class_key __key;                             \
-        lockdep_init_map_crosslock((struct lockdep_map *)&(x)->map,     \
-                        "(completion)" #x,                              \
-                        &__key, 0);                                     \
-        __init_completion(x);                                           \
-} while (0)
-#else
 #define init_completion_map(x, m) __init_completion(x)
 #define init_completion(x) __init_completion(x)
 static inline void complete_acquire(struct completion *x) {}
 static inline void complete_release(struct completion *x) {}
-static inline void complete_release_commit(struct completion *x) {}
-#endif
 
-#ifdef CONFIG_LOCKDEP_COMPLETIONS
-#define COMPLETION_INITIALIZER(work) \
-        { 0, __WAIT_QUEUE_HEAD_INITIALIZER((work).wait), \
-        STATIC_CROSS_LOCKDEP_MAP_INIT("(completion)" #work, &(work)) }
-#else
 #define COMPLETION_INITIALIZER(work) \
         { 0, __WAIT_QUEUE_HEAD_INITIALIZER((work).wait) }
-#endif
 
 #define COMPLETION_INITIALIZER_ONSTACK_MAP(work, map) \
         (*({ init_completion_map(&(work), &(map)); &(work); }))
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index a04ef7c15c6a..7b01bc11c692 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -47,6 +47,13 @@ extern void cpu_remove_dev_attr(struct device_attribute *attr);
 extern int cpu_add_dev_attr_group(struct attribute_group *attrs);
 extern void cpu_remove_dev_attr_group(struct attribute_group *attrs);
 
+extern ssize_t cpu_show_meltdown(struct device *dev,
+                                 struct device_attribute *attr, char *buf);
+extern ssize_t cpu_show_spectre_v1(struct device *dev,
+                                   struct device_attribute *attr, char *buf);
+extern ssize_t cpu_show_spectre_v2(struct device *dev,
+                                   struct device_attribute *attr, char *buf);
+
 extern __printf(4, 5)
 struct device *cpu_device_create(struct device *parent, void *drvdata,
                                  const struct attribute_group **groups,
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index 201ab7267986..1a32e558eb11 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -86,7 +86,7 @@ enum cpuhp_state {
         CPUHP_MM_ZSWP_POOL_PREPARE,
         CPUHP_KVM_PPC_BOOK3S_PREPARE,
         CPUHP_ZCOMP_PREPARE,
-        CPUHP_TIMERS_DEAD,
+        CPUHP_TIMERS_PREPARE,
         CPUHP_MIPS_SOC_PREPARE,
         CPUHP_BP_PREPARE_DYN,
         CPUHP_BP_PREPARE_DYN_END                = CPUHP_BP_PREPARE_DYN + 20,
diff --git a/include/linux/crash_core.h b/include/linux/crash_core.h
index 06097ef30449..b511f6d24b42 100644
--- a/include/linux/crash_core.h
+++ b/include/linux/crash_core.h
@@ -42,6 +42,8 @@ phys_addr_t paddr_vmcoreinfo_note(void);
         vmcoreinfo_append_str("PAGESIZE=%ld\n", value)
 #define VMCOREINFO_SYMBOL(name) \
         vmcoreinfo_append_str("SYMBOL(%s)=%lx\n", #name, (unsigned long)&name)
+#define VMCOREINFO_SYMBOL_ARRAY(name) \
+        vmcoreinfo_append_str("SYMBOL(%s)=%lx\n", #name, (unsigned long)name)
 #define VMCOREINFO_SIZE(name) \
         vmcoreinfo_append_str("SIZE(%s)=%lu\n", #name, \
                               (unsigned long)sizeof(name))
diff --git a/include/linux/cred.h b/include/linux/cred.h
index 099058e1178b..631286535d0f 100644
--- a/include/linux/cred.h
+++ b/include/linux/cred.h
@@ -83,6 +83,7 @@ extern int set_current_groups(struct group_info *);
 extern void set_groups(struct cred *, struct group_info *);
 extern int groups_search(const struct group_info *, kgid_t);
 extern bool may_setgroups(void);
+extern void groups_sort(struct group_info *);
 
 /*
  * The security context of a task
diff --git a/include/linux/debugfs.h b/include/linux/debugfs.h
index f36ecc2a5712..3b0ba54cc4d5 100644
--- a/include/linux/debugfs.h
+++ b/include/linux/debugfs.h
@@ -216,6 +216,8 @@ static inline void debugfs_remove(struct dentry *dentry)
 static inline void debugfs_remove_recursive(struct dentry *dentry)
 { }
 
+const struct file_operations *debugfs_real_fops(const struct file *filp);
+
 static inline int debugfs_file_get(struct dentry *dentry)
 {
         return 0;
diff --git a/include/linux/delayacct.h b/include/linux/delayacct.h
index 4178d2493547..5e335b6203f4 100644
--- a/include/linux/delayacct.h
+++ b/include/linux/delayacct.h
@@ -71,7 +71,7 @@ extern void delayacct_init(void);
 extern void __delayacct_tsk_init(struct task_struct *);
 extern void __delayacct_tsk_exit(struct task_struct *);
 extern void __delayacct_blkio_start(void);
-extern void __delayacct_blkio_end(void);
+extern void __delayacct_blkio_end(struct task_struct *);
 extern int __delayacct_add_tsk(struct taskstats *, struct task_struct *);
 extern __u64 __delayacct_blkio_ticks(struct task_struct *);
 extern void __delayacct_freepages_start(void);
@@ -122,10 +122,10 @@ static inline void delayacct_blkio_start(void)
                 __delayacct_blkio_start();
 }
 
-static inline void delayacct_blkio_end(void)
+static inline void delayacct_blkio_end(struct task_struct *p)
 {
         if (current->delays)
-                __delayacct_blkio_end();
+                __delayacct_blkio_end(p);
         delayacct_clear_flag(DELAYACCT_PF_BLKIO);
 }
 
@@ -169,7 +169,7 @@ static inline void delayacct_tsk_free(struct task_struct *tsk)
 {}
 static inline void delayacct_blkio_start(void)
 {}
-static inline void delayacct_blkio_end(void)
+static inline void delayacct_blkio_end(struct task_struct *p)
 {}
 static inline int delayacct_add_tsk(struct taskstats *d,
                                         struct task_struct *tsk)
diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
index e8f8e8fb244d..81ed9b2d84dc 100644
--- a/include/linux/dma-mapping.h
+++ b/include/linux/dma-mapping.h
@@ -704,7 +704,6 @@ static inline void *dma_zalloc_coherent(struct device *dev, size_t size,
         return ret;
 }
 
-#ifdef CONFIG_HAS_DMA
 static inline int dma_get_cache_alignment(void)
 {
 #ifdef ARCH_DMA_MINALIGN
@@ -712,7 +711,6 @@ static inline int dma_get_cache_alignment(void)
 #endif
         return 1;
 }
-#endif
 
 /* flags for the coherent memory api */
 #define DMA_MEMORY_EXCLUSIVE            0x01
diff --git a/include/linux/efi.h b/include/linux/efi.h
index d813f7b04da7..29fdf8029cf6 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -140,11 +140,13 @@ struct efi_boot_memmap {
 
 struct capsule_info {
         efi_capsule_header_t    header;
+        efi_capsule_header_t    *capsule;
         int                     reset_type;
         long                    index;
         size_t                  count;
         size_t                  total_size;
-        phys_addr_t             *pages;
+        struct page             **pages;
+        phys_addr_t             *phys;
         size_t                  page_bytes_remain;
 };
 
diff --git a/include/linux/fscache.h b/include/linux/fscache.h
index f4ff47d4a893..fe0c349684fa 100644
--- a/include/linux/fscache.h
+++ b/include/linux/fscache.h
@@ -755,7 +755,7 @@ bool fscache_maybe_release_page(struct fscache_cookie *cookie,
 {
         if (fscache_cookie_valid(cookie) && PageFsCache(page))
                 return __fscache_maybe_release_page(cookie, page, gfp);
-        return false;
+        return true;
 }
 
 /**
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index 2bab81951ced..3319df9727aa 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -332,6 +332,8 @@ extern int ftrace_text_reserved(const void *start, const void *end);
 
 extern int ftrace_nr_registered_ops(void);
 
+struct ftrace_ops *ftrace_ops_trampoline(unsigned long addr);
+
 bool is_ftrace_trampoline(unsigned long addr);
 
 /*
diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h
index 55e672592fa9..7258cd676df4 100644
--- a/include/linux/gpio/driver.h
+++ b/include/linux/gpio/driver.h
@@ -66,9 +66,10 @@ struct gpio_irq_chip {
         /**
          * @lock_key:
          *
-         * Per GPIO IRQ chip lockdep class.
+         * Per GPIO IRQ chip lockdep classes.
          */
         struct lock_class_key *lock_key;
+        struct lock_class_key *request_key;
 
         /**
          * @parent_handler:
@@ -323,7 +324,8 @@ extern const char *gpiochip_is_requested(struct gpio_chip *chip,
 
 /* add/remove chips */
 extern int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
-                                      struct lock_class_key *lock_key);
+                                      struct lock_class_key *lock_key,
+                                      struct lock_class_key *request_key);
 
 /**
  * gpiochip_add_data() - register a gpio_chip
@@ -350,11 +352,13 @@ extern int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
  */
 #ifdef CONFIG_LOCKDEP
 #define gpiochip_add_data(chip, data) ({                \
-                static struct lock_class_key key;       \
-                gpiochip_add_data_with_key(chip, data, &key);   \
+                static struct lock_class_key lock_key;  \
+                static struct lock_class_key request_key;         \
+                gpiochip_add_data_with_key(chip, data, &lock_key, \
+                                           &request_key);         \
         })
 #else
-#define gpiochip_add_data(chip, data) gpiochip_add_data_with_key(chip, data, NULL)
+#define gpiochip_add_data(chip, data) gpiochip_add_data_with_key(chip, data, NULL, NULL)
 #endif
 
 static inline int gpiochip_add(struct gpio_chip *chip)
@@ -429,7 +433,8 @@ int gpiochip_irqchip_add_key(struct gpio_chip *gpiochip,
                              irq_flow_handler_t handler,
                              unsigned int type,
                              bool threaded,
-                             struct lock_class_key *lock_key);
+                             struct lock_class_key *lock_key,
+                             struct lock_class_key *request_key);
 
 #ifdef CONFIG_LOCKDEP
 
@@ -445,10 +450,12 @@ static inline int gpiochip_irqchip_add(struct gpio_chip *gpiochip,
                                        irq_flow_handler_t handler,
                                        unsigned int type)
 {
-        static struct lock_class_key key;
+        static struct lock_class_key lock_key;
+        static struct lock_class_key request_key;
 
         return gpiochip_irqchip_add_key(gpiochip, irqchip, first_irq,
-                                        handler, type, false, &key);
+                                        handler, type, false,
+                                        &lock_key, &request_key);
 }
 
 static inline int gpiochip_irqchip_add_nested(struct gpio_chip *gpiochip,
@@ -458,10 +465,12 @@ static inline int gpiochip_irqchip_add_nested(struct gpio_chip *gpiochip,
                           unsigned int type)
 {
 
-        static struct lock_class_key key;
+        static struct lock_class_key lock_key;
+        static struct lock_class_key request_key;
 
         return gpiochip_irqchip_add_key(gpiochip, irqchip, first_irq,
-                                        handler, type, true, &key);
+                                        handler, type, true,
+                                        &lock_key, &request_key);
 }
 #else
 static inline int gpiochip_irqchip_add(struct gpio_chip *gpiochip,
@@ -471,7 +480,7 @@ static inline int gpiochip_irqchip_add(struct gpio_chip *gpiochip,
                                        unsigned int type)
 {
         return gpiochip_irqchip_add_key(gpiochip, irqchip, first_irq,
-                                        handler, type, false, NULL);
+                                        handler, type, false, NULL, NULL);
 }
 
 static inline int gpiochip_irqchip_add_nested(struct gpio_chip *gpiochip,
@@ -481,7 +490,7 @@ static inline int gpiochip_irqchip_add_nested(struct gpio_chip *gpiochip,
                           unsigned int type)
 {
         return gpiochip_irqchip_add_key(gpiochip, irqchip, first_irq,
-                                        handler, type, true, NULL);
+                                        handler, type, true, NULL, NULL);
 }
 #endif /* CONFIG_LOCKDEP */
 
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index f3e97c5f94c9..6c9336626592 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -708,6 +708,7 @@ struct vmbus_channel {
         u8 monitor_bit;
 
         bool rescind; /* got rescind msg */
+        struct completion rescind_event;
 
         u32 ringbuffer_gpadlhandle;
 
diff --git a/include/linux/idr.h b/include/linux/idr.h
index 7c3a365f7e12..fa14f834e4ed 100644
--- a/include/linux/idr.h
+++ b/include/linux/idr.h
@@ -15,6 +15,7 @@
 #include <linux/radix-tree.h>
 #include <linux/gfp.h>
 #include <linux/percpu.h>
+#include <linux/bug.h>
 
 struct idr {
         struct radix_tree_root  idr_rt;
diff --git a/include/linux/iio/timer/stm32-lptim-trigger.h b/include/linux/iio/timer/stm32-lptim-trigger.h
index 34d59bfdce2d..464458d20b16 100644
--- a/include/linux/iio/timer/stm32-lptim-trigger.h
+++ b/include/linux/iio/timer/stm32-lptim-trigger.h
@@ -16,11 +16,14 @@
 #define LPTIM2_OUT      "lptim2_out"
 #define LPTIM3_OUT      "lptim3_out"
 
-#if IS_ENABLED(CONFIG_IIO_STM32_LPTIMER_TRIGGER)
+#if IS_REACHABLE(CONFIG_IIO_STM32_LPTIMER_TRIGGER)
 bool is_stm32_lptim_trigger(struct iio_trigger *trig);
 #else
 static inline bool is_stm32_lptim_trigger(struct iio_trigger *trig)
 {
+#if IS_ENABLED(CONFIG_IIO_STM32_LPTIMER_TRIGGER)
+        pr_warn_once("stm32 lptim_trigger not linked in\n");
+#endif
         return false;
 }
 #endif
diff --git a/include/linux/intel-pti.h b/include/linux/intel-pti.h
new file mode 100644
index 000000000000..2710d72de3c9
--- /dev/null
+++ b/include/linux/intel-pti.h
@@ -0,0 +1,43 @@
+/*
+ *  Copyright (C) Intel 2011
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ * The PTI (Parallel Trace Interface) driver directs trace data routed from
+ * various parts in the system out through the Intel Penwell PTI port and
+ * out of the mobile device for analysis with a debugging tool
+ * (Lauterbach, Fido). This is part of a solution for the MIPI P1149.7,
+ * compact JTAG, standard.
+ *
+ * This header file will allow other parts of the OS to use the
+ * interface to write out it's contents for debugging a mobile system.
+ */
+
+#ifndef LINUX_INTEL_PTI_H_
+#define LINUX_INTEL_PTI_H_
+
+/* offset for last dword of any PTI message. Part of MIPI P1149.7 */
+#define PTI_LASTDWORD_DTS       0x30
+
+/* basic structure used as a write address to the PTI HW */
+struct pti_masterchannel {
+        u8 master;
+        u8 channel;
+};
+
+/* the following functions are defined in misc/pti.c */
+void pti_writedata(struct pti_masterchannel *mc, u8 *buf, int count);
+struct pti_masterchannel *pti_request_masterchannel(u8 type,
+                                                    const char *thread_name);
+void pti_release_masterchannel(struct pti_masterchannel *mc);
+
+#endif /* LINUX_INTEL_PTI_H_ */
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index cb18c6290ca8..8415bf1a9776 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -273,7 +273,8 @@ struct ipv6_pinfo {
                                                  * 100: prefer care-of address
                                                  */
                                 dontfrag:1,
-                                autoflowlabel:1;
+                                autoflowlabel:1,
+                                autoflowlabel_set:1;
         __u8                    min_hopcount;
         __u8                    tclass;
         __be32                  rcv_flowinfo;
diff --git a/include/linux/irq.h b/include/linux/irq.h
index e140f69163b6..a0231e96a578 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -212,6 +212,7 @@ struct irq_data {
  *                                mask. Applies only to affinity managed irqs.
  * IRQD_SINGLE_TARGET           - IRQ allows only a single affinity target
  * IRQD_DEFAULT_TRIGGER_SET     - Expected trigger already been set
+ * IRQD_CAN_RESERVE             - Can use reservation mode
  */
 enum {
         IRQD_TRIGGER_MASK               = 0xf,
@@ -233,6 +234,7 @@ enum {
         IRQD_MANAGED_SHUTDOWN           = (1 << 23),
         IRQD_SINGLE_TARGET              = (1 << 24),
         IRQD_DEFAULT_TRIGGER_SET        = (1 << 25),
+        IRQD_CAN_RESERVE                = (1 << 26),
 };
 
 #define __irqd_to_state(d) ACCESS_PRIVATE((d)->common, state_use_accessors)
@@ -377,6 +379,21 @@ static inline bool irqd_is_managed_and_shutdown(struct irq_data *d)
         return __irqd_to_state(d) & IRQD_MANAGED_SHUTDOWN;
 }
 
+static inline void irqd_set_can_reserve(struct irq_data *d)
+{
+        __irqd_to_state(d) |= IRQD_CAN_RESERVE;
+}
+
+static inline void irqd_clr_can_reserve(struct irq_data *d)
+{
+        __irqd_to_state(d) &= ~IRQD_CAN_RESERVE;
+}
+
+static inline bool irqd_can_reserve(struct irq_data *d)
+{
+        return __irqd_to_state(d) & IRQD_CAN_RESERVE;
+}
+
 #undef __irqd_to_state
 
 static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
index dd418955962b..25b33b664537 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
@@ -230,7 +230,7 @@ irq_set_chip_handler_name_locked(struct irq_data *data, struct irq_chip *chip,
         data->chip = chip;
 }
 
-static inline int irq_balancing_disabled(unsigned int irq)
+static inline bool irq_balancing_disabled(unsigned int irq)
 {
         struct irq_desc *desc;
 
@@ -238,7 +238,7 @@ static inline int irq_balancing_disabled(unsigned int irq)
         return desc->status_use_accessors & IRQ_NO_BALANCING_MASK;
 }
 
-static inline int irq_is_percpu(unsigned int irq)
+static inline bool irq_is_percpu(unsigned int irq)
 {
         struct irq_desc *desc;
 
@@ -246,7 +246,7 @@ static inline int irq_is_percpu(unsigned int irq)
         return desc->status_use_accessors & IRQ_PER_CPU;
 }
 
-static inline int irq_is_percpu_devid(unsigned int irq)
+static inline bool irq_is_percpu_devid(unsigned int irq)
 {
         struct irq_desc *desc;
 
@@ -255,12 +255,15 @@ static inline int irq_is_percpu_devid(unsigned int irq)
 }
 
 static inline void
-irq_set_lockdep_class(unsigned int irq, struct lock_class_key *class)
+irq_set_lockdep_class(unsigned int irq, struct lock_class_key *lock_class,
+                      struct lock_class_key *request_class)
 {
         struct irq_desc *desc = irq_to_desc(irq);
 
-        if (desc)
-                lockdep_set_class(&desc->lock, class);
+        if (desc) {
+                lockdep_set_class(&desc->lock, lock_class);
+                lockdep_set_class(&desc->request_mutex, request_class);
+        }
 }
 
 #ifdef CONFIG_IRQ_PREFLOW_FASTEOI
diff --git a/include/linux/irqdomain.h b/include/linux/irqdomain.h
index a34355d19546..48c7e86bb556 100644
--- a/include/linux/irqdomain.h
+++ b/include/linux/irqdomain.h
@@ -113,7 +113,7 @@ struct irq_domain_ops {
                      unsigned int nr_irqs, void *arg);
         void (*free)(struct irq_domain *d, unsigned int virq,
                      unsigned int nr_irqs);
-        int (*activate)(struct irq_domain *d, struct irq_data *irqd, bool early);
+        int (*activate)(struct irq_domain *d, struct irq_data *irqd, bool reserve);
         void (*deactivate)(struct irq_domain *d, struct irq_data *irq_data);
         int (*translate)(struct irq_domain *d, struct irq_fwspec *fwspec,
                          unsigned long *out_hwirq, unsigned int *out_type);
diff --git a/include/linux/irqflags.h b/include/linux/irqflags.h
index 46cb57d5eb13..1b3996ff3f16 100644
--- a/include/linux/irqflags.h
+++ b/include/linux/irqflags.h
@@ -27,22 +27,18 @@
 # define trace_hardirq_enter()                  \
 do {                                            \
         current->hardirq_context++;             \
-        crossrelease_hist_start(XHLOCK_HARD);   \
 } while (0)
 # define trace_hardirq_exit()                   \
 do {                                            \
         current->hardirq_context--;             \
-        crossrelease_hist_end(XHLOCK_HARD);     \
 } while (0)
 # define lockdep_softirq_enter()                \
 do {                                            \
         current->softirq_context++;             \
-        crossrelease_hist_start(XHLOCK_SOFT);   \
 } while (0)
 # define lockdep_softirq_exit()                 \
 do {                                            \
         current->softirq_context--;             \
-        crossrelease_hist_end(XHLOCK_SOFT);     \
 } while (0)
 # define INIT_TRACE_IRQFLAGS    .softirqs_enabled = 1,
 #else
diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
index c7b368c734af..e0340ca08d98 100644
--- a/include/linux/jump_label.h
+++ b/include/linux/jump_label.h
@@ -160,6 +160,8 @@ extern void arch_jump_label_transform_static(struct jump_entry *entry,
 extern int jump_label_text_reserved(void *start, void *end);
 extern void static_key_slow_inc(struct static_key *key);
 extern void static_key_slow_dec(struct static_key *key);
+extern void static_key_slow_inc_cpuslocked(struct static_key *key);
+extern void static_key_slow_dec_cpuslocked(struct static_key *key);
 extern void jump_label_apply_nops(struct module *mod);
 extern int static_key_count(struct static_key *key);
 extern void static_key_enable(struct static_key *key);
@@ -222,6 +224,9 @@ static inline void static_key_slow_dec(struct static_key *key)
         atomic_dec(&key->enabled);
 }
 
+#define static_key_slow_inc_cpuslocked(key) static_key_slow_inc(key)
+#define static_key_slow_dec_cpuslocked(key) static_key_slow_dec(key)
+
 static inline int jump_label_text_reserved(void *start, void *end)
 {
         return 0;
@@ -416,6 +421,8 @@ extern bool ____wrong_branch_error(void);
 
 #define static_branch_inc(x)            static_key_slow_inc(&(x)->key)
 #define static_branch_dec(x)            static_key_slow_dec(&(x)->key)
+#define static_branch_inc_cpuslocked(x) static_key_slow_inc_cpuslocked(&(x)->key)
+#define static_branch_dec_cpuslocked(x) static_key_slow_dec_cpuslocked(&(x)->key)
 
 /*
  * Normal usage; boolean enable/disable.
diff --git a/include/linux/kmemcheck.h b/include/linux/kmemcheck.h
deleted file mode 100644
index ea32a7d3cf1b..000000000000
--- a/include/linux/kmemcheck.h
+++ /dev/null
@@ -1 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 893d6d606cd0..6bdd4b9f6611 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -232,7 +232,7 @@ struct kvm_vcpu {
         struct mutex mutex;
         struct kvm_run *run;
 
-        int guest_fpu_loaded, guest_xcr0_loaded;
+        int guest_xcr0_loaded;
         struct swait_queue_head wq;
         struct pid __rcu *pid;
         int sigset_active;
diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h
index a842551fe044..3251d9c0d313 100644
--- a/include/linux/lockdep.h
+++ b/include/linux/lockdep.h
@@ -158,12 +158,6 @@ struct lockdep_map {
         int                             cpu;
         unsigned long                   ip;
 #endif
-#ifdef CONFIG_LOCKDEP_CROSSRELEASE
-        /*
-         * Whether it's a crosslock.
-         */
-        int                             cross;
-#endif
 };
 
 static inline void lockdep_copy_map(struct lockdep_map *to,
@@ -267,96 +261,9 @@ struct held_lock {
         unsigned int hardirqs_off:1;
         unsigned int references:12;                                     /* 32 bits */
         unsigned int pin_count;
-#ifdef CONFIG_LOCKDEP_CROSSRELEASE
-        /*
-         * Generation id.
-         *
-         * A value of cross_gen_id will be stored when holding this,
-         * which is globally increased whenever each crosslock is held.
-         */
-        unsigned int gen_id;
-#endif
-};
-
-#ifdef CONFIG_LOCKDEP_CROSSRELEASE
-#define MAX_XHLOCK_TRACE_ENTRIES 5
-
-/*
- * This is for keeping locks waiting for commit so that true dependencies
- * can be added at commit step.
- */
-struct hist_lock {
-        /*
-         * Id for each entry in the ring buffer. This is used to
-         * decide whether the ring buffer was overwritten or not.
-         *
-         * For example,
-         *
-         *           |<----------- hist_lock ring buffer size ------->|
-         *           pppppppppppppppppppppiiiiiiiiiiiiiiiiiiiiiiiiiiiii
-         * wrapped > iiiiiiiiiiiiiiiiiiiiiiiiiii.......................
-         *
-         *           where 'p' represents an acquisition in process
-         *           context, 'i' represents an acquisition in irq
-         *           context.
-         *
-         * In this example, the ring buffer was overwritten by
-         * acquisitions in irq context, that should be detected on
-         * rollback or commit.
-         */
-        unsigned int hist_id;
-
-        /*
-         * Seperate stack_trace data. This will be used at commit step.
-         */
-        struct stack_trace      trace;
-        unsigned long           trace_entries[MAX_XHLOCK_TRACE_ENTRIES];
-
-        /*
-         * Seperate hlock instance. This will be used at commit step.
-         *
-         * TODO: Use a smaller data structure containing only necessary
-         * data. However, we should make lockdep code able to handle the
-         * smaller one first.
-         */
-        struct held_lock        hlock;
 };
 
 /*
- * To initialize a lock as crosslock, lockdep_init_map_crosslock() should
- * be called instead of lockdep_init_map().
- */
-struct cross_lock {
-        /*
-         * When more than one acquisition of crosslocks are overlapped,
-         * we have to perform commit for them based on cross_gen_id of
-         * the first acquisition, which allows us to add more true
-         * dependencies.
-         *
-         * Moreover, when no acquisition of a crosslock is in progress,
-         * we should not perform commit because the lock might not exist
-         * any more, which might cause incorrect memory access. So we
-         * have to track the number of acquisitions of a crosslock.
-         */
-        int nr_acquire;
-
-        /*
-         * Seperate hlock instance. This will be used at commit step.
-         *
-         * TODO: Use a smaller data structure containing only necessary
-         * data. However, we should make lockdep code able to handle the
-         * smaller one first.
-         */
-        struct held_lock        hlock;
-};
-
-struct lockdep_map_cross {
-        struct lockdep_map map;
-        struct cross_lock xlock;
-};
-#endif
-
-/*
  * Initialization, self-test and debugging-output methods:
  */
 extern void lockdep_info(void);
@@ -560,37 +467,6 @@ enum xhlock_context_t {
         XHLOCK_CTX_NR,
 };
 
-#ifdef CONFIG_LOCKDEP_CROSSRELEASE
-extern void lockdep_init_map_crosslock(struct lockdep_map *lock,
-                                       const char *name,
-                                       struct lock_class_key *key,
-                                       int subclass);
-extern void lock_commit_crosslock(struct lockdep_map *lock);
-
-/*
- * What we essencially have to initialize is 'nr_acquire'. Other members
- * will be initialized in add_xlock().
- */
-#define STATIC_CROSS_LOCK_INIT() \
-        { .nr_acquire = 0,}
-
-#define STATIC_CROSS_LOCKDEP_MAP_INIT(_name, _key) \
-        { .map.name = (_name), .map.key = (void *)(_key), \
-          .map.cross = 1, .xlock = STATIC_CROSS_LOCK_INIT(), }
-
-/*
- * To initialize a lockdep_map statically use this macro.
- * Note that _name must not be NULL.
- */
-#define STATIC_LOCKDEP_MAP_INIT(_name, _key) \
-        { .name = (_name), .key = (void *)(_key), .cross = 0, }
-
-extern void crossrelease_hist_start(enum xhlock_context_t c);
-extern void crossrelease_hist_end(enum xhlock_context_t c);
-extern void lockdep_invariant_state(bool force);
-extern void lockdep_init_task(struct task_struct *task);
-extern void lockdep_free_task(struct task_struct *task);
-#else /* !CROSSRELEASE */
 #define lockdep_init_map_crosslock(m, n, k, s) do {} while (0)
 /*
  * To initialize a lockdep_map statically use this macro.
@@ -599,12 +475,9 @@ extern void lockdep_free_task(struct task_struct *task);
 #define STATIC_LOCKDEP_MAP_INIT(_name, _key) \
         { .name = (_name), .key = (void *)(_key), }
 
-static inline void crossrelease_hist_start(enum xhlock_context_t c) {}
-static inline void crossrelease_hist_end(enum xhlock_context_t c) {}
 static inline void lockdep_invariant_state(bool force) {}
 static inline void lockdep_init_task(struct task_struct *task) {}
 static inline void lockdep_free_task(struct task_struct *task) {}
-#endif /* CROSSRELEASE */
 
 #ifdef CONFIG_LOCK_STAT
 
diff --git a/include/linux/mfd/rtsx_pci.h b/include/linux/mfd/rtsx_pci.h
index a2a1318a3d0c..c3d3f04d8cc6 100644
--- a/include/linux/mfd/rtsx_pci.h
+++ b/include/linux/mfd/rtsx_pci.h
@@ -915,10 +915,10 @@ enum PDEV_STAT  {PDEV_STAT_IDLE, PDEV_STAT_RUN};
 #define LTR_L1SS_PWR_GATE_CHECK_CARD_EN BIT(6)
 
 enum dev_aspm_mode {
-        DEV_ASPM_DISABLE = 0,
         DEV_ASPM_DYNAMIC,
         DEV_ASPM_BACKDOOR,
         DEV_ASPM_STATIC,
+        DEV_ASPM_DISABLE,
 };
 
 /*
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index c403151133e9..fb7e8b205eb9 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -36,6 +36,7 @@
 #include <linux/kernel.h>
 #include <linux/completion.h>
 #include <linux/pci.h>
+#include <linux/irq.h>
 #include <linux/spinlock_types.h>
 #include <linux/semaphore.h>
 #include <linux/slab.h>
@@ -567,6 +568,7 @@ struct mlx5_core_sriov {
 };
 
 struct mlx5_irq_info {
+        cpumask_var_t mask;
         char name[MLX5_MAX_IRQ_NAME];
 };
 
@@ -1062,7 +1064,7 @@ int mlx5_create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, u8 vecidx,
                        enum mlx5_eq_type type);
 int mlx5_destroy_unmap_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq);
 int mlx5_start_eqs(struct mlx5_core_dev *dev);
-int mlx5_stop_eqs(struct mlx5_core_dev *dev);
+void mlx5_stop_eqs(struct mlx5_core_dev *dev);
 int mlx5_vector2eqn(struct mlx5_core_dev *dev, int vector, int *eqn,
                     unsigned int *irqn);
 int mlx5_core_attach_mcg(struct mlx5_core_dev *dev, union ib_gid *mgid, u32 qpn);
@@ -1269,7 +1271,23 @@ enum {
 static inline const struct cpumask *
 mlx5_get_vector_affinity(struct mlx5_core_dev *dev, int vector)
 {
-        return pci_irq_get_affinity(dev->pdev, MLX5_EQ_VEC_COMP_BASE + vector);
+        const struct cpumask *mask;
+        struct irq_desc *desc;
+        unsigned int irq;
+        int eqn;
+        int err;
+
+        err = mlx5_vector2eqn(dev, vector, &eqn, &irq);
+        if (err)
+                return NULL;
+
+        desc = irq_to_desc(irq);
+#ifdef CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK
+        mask = irq_data_get_effective_affinity_mask(&desc->irq_data);
+#else
+        mask = desc->irq_common_data.affinity;
+#endif
+        return mask;
 }
 
 #endif /* MLX5_DRIVER_H */
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 7e88c8e7f374..7ac7bd76c7af 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -147,7 +147,7 @@ enum {
         MLX5_CMD_OP_ALLOC_Q_COUNTER               = 0x771,
         MLX5_CMD_OP_DEALLOC_Q_COUNTER             = 0x772,
         MLX5_CMD_OP_QUERY_Q_COUNTER               = 0x773,
-        MLX5_CMD_OP_SET_RATE_LIMIT                = 0x780,
+        MLX5_CMD_OP_SET_PP_RATE_LIMIT             = 0x780,
         MLX5_CMD_OP_QUERY_RATE_LIMIT              = 0x781,
         MLX5_CMD_OP_CREATE_SCHEDULING_ELEMENT      = 0x782,
         MLX5_CMD_OP_DESTROY_SCHEDULING_ELEMENT     = 0x783,
@@ -1030,8 +1030,9 @@ struct mlx5_ifc_cmd_hca_cap_bits {
         u8         log_max_wq_sz[0x5];
 
         u8         nic_vport_change_event[0x1];
-        u8         disable_local_lb[0x1];
-        u8         reserved_at_3e2[0x9];
+        u8         disable_local_lb_uc[0x1];
+        u8         disable_local_lb_mc[0x1];
+        u8         reserved_at_3e3[0x8];
         u8         log_max_vlan_list[0x5];
         u8         reserved_at_3f0[0x3];
         u8         log_max_current_mc_list[0x5];
@@ -7257,7 +7258,7 @@ struct mlx5_ifc_add_vxlan_udp_dport_in_bits {
         u8         vxlan_udp_port[0x10];
 };
 
-struct mlx5_ifc_set_rate_limit_out_bits {
+struct mlx5_ifc_set_pp_rate_limit_out_bits {
         u8         status[0x8];
         u8         reserved_at_8[0x18];
 
@@ -7266,7 +7267,7 @@ struct mlx5_ifc_set_rate_limit_out_bits {
         u8         reserved_at_40[0x40];
 };
 
-struct mlx5_ifc_set_rate_limit_in_bits {
+struct mlx5_ifc_set_pp_rate_limit_in_bits {
         u8         opcode[0x10];
         u8         reserved_at_10[0x10];
 
@@ -7279,6 +7280,8 @@ struct mlx5_ifc_set_rate_limit_in_bits {
         u8         reserved_at_60[0x20];
 
         u8         rate_limit[0x20];
+
+        u8         reserved_at_a0[0x160];
 };
 
 struct mlx5_ifc_access_register_out_bits {
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 49b4257ce1ea..f3075d6c7e82 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -85,7 +85,7 @@ struct netlink_ext_ack {
  * to the lack of an output buffer.)
  */
 #define NL_SET_ERR_MSG(extack, msg) do {                \
-        static const char __msg[] = (msg);              \
+        static const char __msg[] = msg;                \
         struct netlink_ext_ack *__extack = (extack);    \
                                                         \
         if (__extack)                                   \
@@ -101,7 +101,7 @@ struct netlink_ext_ack {
 } while (0)
 
 #define NL_SET_ERR_MSG_ATTR(extack, attr, msg) do {     \
-        static const char __msg[] = (msg);              \
+        static const char __msg[] = msg;                \
         struct netlink_ext_ack *__extack = (extack);    \
                                                         \
         if (__extack) {                                 \
diff --git a/include/linux/oom.h b/include/linux/oom.h
index 01c91d874a57..5bad038ac012 100644
--- a/include/linux/oom.h
+++ b/include/linux/oom.h
@@ -67,6 +67,15 @@ static inline bool tsk_is_oom_victim(struct task_struct * tsk)
 }
 
 /*
+ * Use this helper if tsk->mm != mm and the victim mm needs a special
+ * handling. This is guaranteed to stay true after once set.
+ */
+static inline bool mm_is_oom_victim(struct mm_struct *mm)
+{
+        return test_bit(MMF_OOM_VICTIM, &mm->flags);
+}
+
+/*
  * Checks whether a page fault on the given mm is still reliable.
  * This is no longer true if the oom reaper started to reap the
  * address space which is reflected by MMF_UNSTABLE flag set in
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 0403894147a3..c170c9250c8b 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1674,6 +1674,9 @@ static inline struct pci_dev *pci_get_slot(struct pci_bus *bus,
 static inline struct pci_dev *pci_get_bus_and_slot(unsigned int bus,
                                                 unsigned int devfn)
 { return NULL; }
+static inline struct pci_dev *pci_get_domain_bus_and_slot(int domain,
+                                        unsigned int bus, unsigned int devfn)
+{ return NULL; }
 
 static inline int pci_domain_nr(struct pci_bus *bus) { return 0; }
 static inline struct pci_dev *pci_dev_get(struct pci_dev *dev) { return NULL; }
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 2c9c87d8a0c1..7546822a1d74 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -15,6 +15,7 @@
 #define _LINUX_PERF_EVENT_H
 
 #include <uapi/linux/perf_event.h>
+#include <uapi/linux/bpf_perf_event.h>
 
 /*
  * Kernel-internal data types and definitions:
@@ -787,7 +788,7 @@ struct perf_output_handle {
 };
 
 struct bpf_perf_event_data_kern {
-        struct pt_regs *regs;
+        bpf_user_pt_regs_t *regs;
         struct perf_sample_data *data;
         struct perf_event *event;
 };
@@ -1177,6 +1178,9 @@ extern void perf_bp_event(struct perf_event *event, void *data);
                 (user_mode(regs) ? PERF_RECORD_MISC_USER : PERF_RECORD_MISC_KERNEL)
 # define perf_instruction_pointer(regs) instruction_pointer(regs)
 #endif
+#ifndef perf_arch_bpf_user_pt_regs
+# define perf_arch_bpf_user_pt_regs(regs) regs
+#endif
 
 static inline bool has_branch_stack(struct perf_event *event)
 {
diff --git a/include/linux/pm.h b/include/linux/pm.h
index 65d39115f06d..492ed473ba7e 100644
--- a/include/linux/pm.h
+++ b/include/linux/pm.h
@@ -765,6 +765,7 @@ extern int pm_generic_poweroff_late(struct device *dev);
 extern int pm_generic_poweroff(struct device *dev);
 extern void pm_generic_complete(struct device *dev);
 
+extern void dev_pm_skip_next_resume_phases(struct device *dev);
 extern bool dev_pm_smart_suspend_and_suspended(struct device *dev);
 
 #else /* !CONFIG_PM_SLEEP */
diff --git a/include/linux/pti.h b/include/linux/pti.h
index b3ea01a3197e..0174883a935a 100644
--- a/include/linux/pti.h
+++ b/include/linux/pti.h
@@ -1,43 +1,11 @@
-/*
- *  Copyright (C) Intel 2011
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- *
- * The PTI (Parallel Trace Interface) driver directs trace data routed from
- * various parts in the system out through the Intel Penwell PTI port and
- * out of the mobile device for analysis with a debugging tool
- * (Lauterbach, Fido). This is part of a solution for the MIPI P1149.7,
- * compact JTAG, standard.
- *
- * This header file will allow other parts of the OS to use the
- * interface to write out it's contents for debugging a mobile system.
- */
+// SPDX-License-Identifier: GPL-2.0
+#ifndef _INCLUDE_PTI_H
+#define _INCLUDE_PTI_H
 
-#ifndef PTI_H_
-#define PTI_H_
+#ifdef CONFIG_PAGE_TABLE_ISOLATION
+#include <asm/pti.h>
+#else
+static inline void pti_init(void) { }
+#endif
 
-/* offset for last dword of any PTI message. Part of MIPI P1149.7 */
-#define PTI_LASTDWORD_DTS       0x30
-
-/* basic structure used as a write address to the PTI HW */
-struct pti_masterchannel {
-        u8 master;
-        u8 channel;
-};
-
-/* the following functions are defined in misc/pti.c */
-void pti_writedata(struct pti_masterchannel *mc, u8 *buf, int count);
-struct pti_masterchannel *pti_request_masterchannel(u8 type,
-                                                    const char *thread_name);
-void pti_release_masterchannel(struct pti_masterchannel *mc);
-
-#endif /*PTI_H_*/
+#endif
diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
index 37b4bb2545b3..d72b2e7dd500 100644
--- a/include/linux/ptr_ring.h
+++ b/include/linux/ptr_ring.h
@@ -101,12 +101,18 @@ static inline bool ptr_ring_full_bh(struct ptr_ring *r)
 
 /* Note: callers invoking this in a loop must use a compiler barrier,
  * for example cpu_relax(). Callers must hold producer_lock.
+ * Callers are responsible for making sure pointer that is being queued
+ * points to a valid data.
  */
 static inline int __ptr_ring_produce(struct ptr_ring *r, void *ptr)
 {
         if (unlikely(!r->size) || r->queue[r->producer])
                 return -ENOSPC;
 
+        /* Make sure the pointer we are storing points to a valid data. */
+        /* Pairs with smp_read_barrier_depends in __ptr_ring_consume. */
+        smp_wmb();
+
         r->queue[r->producer++] = ptr;
         if (unlikely(r->producer >= r->size))
                 r->producer = 0;
@@ -168,6 +174,15 @@ static inline int ptr_ring_produce_bh(struct ptr_ring *r, void *ptr)
  * if they dereference the pointer - see e.g. PTR_RING_PEEK_CALL.
  * If ring is never resized, and if the pointer is merely
  * tested, there's no need to take the lock - see e.g.  __ptr_ring_empty.
+ * However, if called outside the lock, and if some other CPU
+ * consumes ring entries at the same time, the value returned
+ * is not guaranteed to be correct.
+ * In this case - to avoid incorrectly detecting the ring
+ * as empty - the CPU consuming the ring entries is responsible
+ * for either consuming all ring entries until the ring is empty,
+ * or synchronizing with some other CPU and causing it to
+ * execute __ptr_ring_peek and/or consume the ring enteries
+ * after the synchronization point.
  */
 static inline void *__ptr_ring_peek(struct ptr_ring *r)
 {
@@ -176,10 +191,7 @@ static inline void *__ptr_ring_peek(struct ptr_ring *r)
         return NULL;
 }
 
-/* Note: callers invoking this in a loop must use a compiler barrier,
- * for example cpu_relax(). Callers must take consumer_lock
- * if the ring is ever resized - see e.g. ptr_ring_empty.
- */
+/* See __ptr_ring_peek above for locking rules. */
 static inline bool __ptr_ring_empty(struct ptr_ring *r)
 {
         return !__ptr_ring_peek(r);
@@ -275,6 +287,9 @@ static inline void *__ptr_ring_consume(struct ptr_ring *r)
         if (ptr)
                 __ptr_ring_discard_one(r);
 
+        /* Make sure anyone accessing data through the pointer is up to date. */
+        /* Pairs with smp_wmb in __ptr_ring_produce. */
+        smp_read_barrier_depends();
         return ptr;
 }
 
diff --git a/include/linux/rbtree.h b/include/linux/rbtree.h
index d574361943ea..fcbeed4053ef 100644
--- a/include/linux/rbtree.h
+++ b/include/linux/rbtree.h
@@ -99,6 +99,8 @@ extern void rb_replace_node(struct rb_node *victim, struct rb_node *new,
                             struct rb_root *root);
 extern void rb_replace_node_rcu(struct rb_node *victim, struct rb_node *new,
                                 struct rb_root *root);
+extern void rb_replace_node_cached(struct rb_node *victim, struct rb_node *new,
+                                   struct rb_root_cached *root);
 
 static inline void rb_link_node(struct rb_node *node, struct rb_node *parent,
                                 struct rb_node **rb_link)
diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h
index a328e8181e49..e4b257ff881b 100644
--- a/include/linux/rculist_nulls.h
+++ b/include/linux/rculist_nulls.h
@@ -101,44 +101,6 @@ static inline void hlist_nulls_add_head_rcu(struct hlist_nulls_node *n,
 }
 
 /**
- * hlist_nulls_add_tail_rcu
- * @n: the element to add to the hash list.
- * @h: the list to add to.
- *
- * Description:
- * Adds the specified element to the end of the specified hlist_nulls,
- * while permitting racing traversals.  NOTE: tail insertion requires
- * list traversal.
- *
- * The caller must take whatever precautions are necessary
- * (such as holding appropriate locks) to avoid racing
- * with another list-mutation primitive, such as hlist_nulls_add_head_rcu()
- * or hlist_nulls_del_rcu(), running on this same list.
- * However, it is perfectly legal to run concurrently with
- * the _rcu list-traversal primitives, such as
- * hlist_nulls_for_each_entry_rcu(), used to prevent memory-consistency
- * problems on Alpha CPUs.  Regardless of the type of CPU, the
- * list-traversal primitive must be guarded by rcu_read_lock().
- */
-static inline void hlist_nulls_add_tail_rcu(struct hlist_nulls_node *n,
-                                        struct hlist_nulls_head *h)
-{
-        struct hlist_nulls_node *i, *last = NULL;
-
-        for (i = hlist_nulls_first_rcu(h); !is_a_nulls(i);
-             i = hlist_nulls_next_rcu(i))
-                last = i;
-
-        if (last) {
-                n->next = last->next;
-                n->pprev = &last->next;
-                rcu_assign_pointer(hlist_nulls_next_rcu(last), n);
-        } else {
-                hlist_nulls_add_head_rcu(n, h);
-        }
-}
-
-/**
  * hlist_nulls_for_each_entry_rcu - iterate over rcu list of given type
  * @tpos:       the type * to use as a loop cursor.
  * @pos:        the &struct hlist_nulls_node to use as a loop cursor.
diff --git a/include/linux/rwlock_types.h b/include/linux/rwlock_types.h
index cc0072e93e36..857a72ceb794 100644
--- a/include/linux/rwlock_types.h
+++ b/include/linux/rwlock_types.h
@@ -10,9 +10,6 @@
  */
 typedef struct {
         arch_rwlock_t raw_lock;
-#ifdef CONFIG_GENERIC_LOCKBREAK
-        unsigned int break_lock;
-#endif
 #ifdef CONFIG_DEBUG_SPINLOCK
         unsigned int magic, owner_cpu;
         void *owner;
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 21991d668d35..d2588263a989 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -849,17 +849,6 @@ struct task_struct {
         struct held_lock                held_locks[MAX_LOCK_DEPTH];
 #endif
 
-#ifdef CONFIG_LOCKDEP_CROSSRELEASE
-#define MAX_XHLOCKS_NR 64UL
-        struct hist_lock *xhlocks; /* Crossrelease history locks */
-        unsigned int xhlock_idx;
-        /* For restoring at history boundaries */
-        unsigned int xhlock_idx_hist[XHLOCK_CTX_NR];
-        unsigned int hist_id;
-        /* For overwrite check at each context exit */
-        unsigned int hist_id_save[XHLOCK_CTX_NR];
-#endif
-
 #ifdef CONFIG_UBSAN
         unsigned int                    in_ubsan;
 #endif
@@ -1503,7 +1492,11 @@ static inline void set_task_comm(struct task_struct *tsk, const char *from)
         __set_task_comm(tsk, from, false);
 }
 
-extern char *get_task_comm(char *to, struct task_struct *tsk);
+extern char *__get_task_comm(char *to, size_t len, struct task_struct *tsk);
+#define get_task_comm(buf, tsk) ({                      \
+        BUILD_BUG_ON(sizeof(buf) != TASK_COMM_LEN);     \
+        __get_task_comm(buf, sizeof(buf), tsk);         \
+})
 
 #ifdef CONFIG_SMP
 void scheduler_ipi(void);
diff --git a/include/linux/sched/coredump.h b/include/linux/sched/coredump.h
index 9c8847395b5e..ec912d01126f 100644
--- a/include/linux/sched/coredump.h
+++ b/include/linux/sched/coredump.h
@@ -70,6 +70,7 @@ static inline int get_dumpable(struct mm_struct *mm)
 #define MMF_UNSTABLE            22      /* mm is unstable for copy_from_user */
 #define MMF_HUGE_ZERO_PAGE      23      /* mm has ever used the global huge zero page */
 #define MMF_DISABLE_THP         24      /* disable THP for all VMAs */
+#define MMF_OOM_VICTIM          25      /* mm is the oom victim */
 #define MMF_DISABLE_THP_MASK    (1 << MMF_DISABLE_THP)
 
 #define MMF_INIT_MASK           (MMF_DUMPABLE_MASK | MMF_DUMP_FILTER_MASK |\
diff --git a/include/linux/serdev.h b/include/linux/serdev.h
index e69402d4a8ae..d609e6dc5bad 100644
--- a/include/linux/serdev.h
+++ b/include/linux/serdev.h
@@ -184,7 +184,7 @@ static inline int serdev_controller_receive_buf(struct serdev_controller *ctrl,
         struct serdev_device *serdev = ctrl->serdev;
 
         if (!serdev || !serdev->ops->receive_buf)
-                return -EINVAL;
+                return 0;
 
         return serdev->ops->receive_buf(serdev, data, count);
 }
diff --git a/include/linux/sh_eth.h b/include/linux/sh_eth.h
index ff3642d267f7..94081e9a5010 100644
--- a/include/linux/sh_eth.h
+++ b/include/linux/sh_eth.h
@@ -17,7 +17,6 @@ struct sh_eth_plat_data {
         unsigned char mac_addr[ETH_ALEN];
         unsigned no_ether_link:1;
         unsigned ether_link_active_low:1;
-        unsigned needs_init:1;
 };
 
 #endif
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index bc486ef23f20..a38c80e9f91e 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1406,8 +1406,7 @@ static inline struct sk_buff *skb_get(struct sk_buff *skb)
 }
 
 /*
- * If users == 1, we are the only owner and are can avoid redundant
- * atomic change.
+ * If users == 1, we are the only owner and can avoid redundant atomic changes.
  */
 
 /**
diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
index 7b2170bfd6e7..bc6bb325d1bf 100644
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h
@@ -126,7 +126,7 @@ void spi_statistics_add_transfer_stats(struct spi_statistics *stats,
  *      for that name.  This appears in the sysfs "modalias" attribute
  *      for driver coldplugging, and in uevents used for hotplugging
  * @cs_gpio: gpio number of the chipselect line (optional, -ENOENT when
- *      when not using a GPIO line)
+ *      not using a GPIO line)
  *
  * @statistics: statistics for the spi_device
  *
diff --git a/include/linux/spinlock.h b/include/linux/spinlock.h
index a39186194cd6..3bf273538840 100644
--- a/include/linux/spinlock.h
+++ b/include/linux/spinlock.h
@@ -107,16 +107,11 @@ do {								\
 
 #define raw_spin_is_locked(lock)        arch_spin_is_locked(&(lock)->raw_lock)
 
-#ifdef CONFIG_GENERIC_LOCKBREAK
-#define raw_spin_is_contended(lock) ((lock)->break_lock)
-#else
-
 #ifdef arch_spin_is_contended
 #define raw_spin_is_contended(lock)     arch_spin_is_contended(&(lock)->raw_lock)
 #else
 #define raw_spin_is_contended(lock)     (((void)(lock), 0))
 #endif /*arch_spin_is_contended*/
-#endif
 
 /*
  * This barrier must provide two things:
diff --git a/include/linux/spinlock_types.h b/include/linux/spinlock_types.h
index 73548eb13a5d..24b4e6f2c1a2 100644
--- a/include/linux/spinlock_types.h
+++ b/include/linux/spinlock_types.h
@@ -19,9 +19,6 @@
 
 typedef struct raw_spinlock {
         arch_spinlock_t raw_lock;
-#ifdef CONFIG_GENERIC_LOCKBREAK
-        unsigned int break_lock;
-#endif
 #ifdef CONFIG_DEBUG_SPINLOCK
         unsigned int magic, owner_cpu;
         void *owner;
diff --git a/include/linux/string.h b/include/linux/string.h
index 410ecf17de3c..cfd83eb2f926 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -259,7 +259,10 @@ __FORTIFY_INLINE __kernel_size_t strlen(const char *p)
 {
         __kernel_size_t ret;
         size_t p_size = __builtin_object_size(p, 0);
-        if (p_size == (size_t)-1)
+
+        /* Work around gcc excess stack consumption issue */
+        if (p_size == (size_t)-1 ||
+            (__builtin_constant_p(p[p_size - 1]) && p[p_size - 1] == '\0'))
                 return __builtin_strlen(p);
         ret = strnlen(p, p_size);
         if (p_size <= ret)
diff --git a/include/linux/swapops.h b/include/linux/swapops.h
index 9c5a2628d6ce..1d3877c39a00 100644
--- a/include/linux/swapops.h
+++ b/include/linux/swapops.h
@@ -124,6 +124,11 @@ static inline bool is_write_device_private_entry(swp_entry_t entry)
         return unlikely(swp_type(entry) == SWP_DEVICE_WRITE);
 }
 
+static inline unsigned long device_private_entry_to_pfn(swp_entry_t entry)
+{
+        return swp_offset(entry);
+}
+
 static inline struct page *device_private_entry_to_page(swp_entry_t entry)
 {
         return pfn_to_page(swp_offset(entry));
@@ -154,6 +159,11 @@ static inline bool is_write_device_private_entry(swp_entry_t entry)
         return false;
 }
 
+static inline unsigned long device_private_entry_to_pfn(swp_entry_t entry)
+{
+        return 0;
+}
+
 static inline struct page *device_private_entry_to_page(swp_entry_t entry)
 {
         return NULL;
@@ -189,6 +199,11 @@ static inline int is_write_migration_entry(swp_entry_t entry)
         return unlikely(swp_type(entry) == SWP_MIGRATION_WRITE);
 }
 
+static inline unsigned long migration_entry_to_pfn(swp_entry_t entry)
+{
+        return swp_offset(entry);
+}
+
 static inline struct page *migration_entry_to_page(swp_entry_t entry)
 {
         struct page *p = pfn_to_page(swp_offset(entry));
@@ -218,6 +233,12 @@ static inline int is_migration_entry(swp_entry_t swp)
 {
         return 0;
 }
+
+static inline unsigned long migration_entry_to_pfn(swp_entry_t entry)
+{
+        return 0;
+}
+
 static inline struct page *migration_entry_to_page(swp_entry_t entry)
 {
         return NULL;
diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
index e32dfe098e82..40839c02d28c 100644
--- a/include/linux/sysfs.h
+++ b/include/linux/sysfs.h
@@ -117,6 +117,12 @@ struct attribute_group {
         .show   = _name##_show,                                         \
 }
 
+#define __ATTR_RO_MODE(_name, _mode) {                                  \
+        .attr   = { .name = __stringify(_name),                         \
+                    .mode = VERIFY_OCTAL_PERMISSIONS(_mode) },          \
+        .show   = _name##_show,                                         \
+}
+
 #define __ATTR_WO(_name) {                                              \
         .attr   = { .name = __stringify(_name), .mode = S_IWUSR },      \
         .store  = _name##_store,                                        \
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index df5d97a85e1a..ca4a6361389b 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -224,7 +224,8 @@ struct tcp_sock {
                 rate_app_limited:1,  /* rate_{delivered,interval_us} limited? */
                 fastopen_connect:1, /* FASTOPEN_CONNECT sockopt */
                 fastopen_no_cookie:1, /* Allow send/recv SYN+data without a cookie */
-                unused:3;
+                is_sack_reneg:1,    /* in recovery from loss with SACK reneg? */
+                unused:2;
         u8      nonagle     : 4,/* Disable Nagle algorithm?             */
                 thin_lto    : 1,/* Use linear timeouts for thin streams */
                 unused1     : 1,
diff --git a/include/linux/tick.h b/include/linux/tick.h
index f442d1a42025..7cc35921218e 100644
--- a/include/linux/tick.h
+++ b/include/linux/tick.h
@@ -119,6 +119,7 @@ extern void tick_nohz_idle_exit(void);
 extern void tick_nohz_irq_exit(void);
 extern ktime_t tick_nohz_get_sleep_length(void);
 extern unsigned long tick_nohz_get_idle_calls(void);
+extern unsigned long tick_nohz_get_idle_calls_cpu(int cpu);
 extern u64 get_cpu_idle_time_us(int cpu, u64 *last_update_time);
 extern u64 get_cpu_iowait_time_us(int cpu, u64 *last_update_time);
 #else /* !CONFIG_NO_HZ_COMMON */
diff --git a/include/linux/timer.h b/include/linux/timer.h
index 04af640ea95b..2448f9cc48a3 100644
--- a/include/linux/timer.h
+++ b/include/linux/timer.h
@@ -207,9 +207,11 @@ unsigned long round_jiffies_up(unsigned long j);
 unsigned long round_jiffies_up_relative(unsigned long j);
 
 #ifdef CONFIG_HOTPLUG_CPU
+int timers_prepare_cpu(unsigned int cpu);
 int timers_dead_cpu(unsigned int cpu);
 #else
-#define timers_dead_cpu NULL
+#define timers_prepare_cpu      NULL
+#define timers_dead_cpu         NULL
 #endif
 
 #endif
diff --git a/include/linux/trace.h b/include/linux/trace.h
index d24991c1fef3..b95ffb2188ab 100644
--- a/include/linux/trace.h
+++ b/include/linux/trace.h
@@ -18,7 +18,7 @@
  */
 struct trace_export {
         struct trace_export __rcu       *next;
-        void (*write)(const void *, unsigned int);
+        void (*write)(struct trace_export *, const void *, unsigned int);
 };
 
 int register_ftrace_export(struct trace_export *export);
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index a69877734c4e..e2ec3582e549 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -82,6 +82,7 @@ struct usbnet {
 #               define EVENT_RX_KILL    10
 #               define EVENT_LINK_CHANGE        11
 #               define EVENT_SET_RX_MODE        12
+#               define EVENT_NO_IP_ALIGN        13
 };
 
 static inline struct usb_driver *driver_of(struct usb_interface *intf)
diff --git a/include/net/arp.h b/include/net/arp.h
index dc8cd47f883b..977aabfcdc03 100644
--- a/include/net/arp.h
+++ b/include/net/arp.h
@@ -20,6 +20,9 @@ static inline u32 arp_hashfn(const void *pkey, const struct net_device *dev, u32
 
 static inline struct neighbour *__ipv4_neigh_lookup_noref(struct net_device *dev, u32 key)
 {
+        if (dev->flags & (IFF_LOOPBACK | IFF_POINTOPOINT))
+                key = INADDR_ANY;
+
         return ___neigh_lookup_noref(&arp_tbl, neigh_key_eq32, arp_hashfn, &key, dev);
 }
 
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 8b8118a7fadb..fb94a8bd8ab5 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -815,6 +815,8 @@ struct cfg80211_csa_settings {
         u8 count;
 };
 
+#define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10
+
 /**
  * struct iface_combination_params - input parameters for interface combinations
  *
@@ -3226,7 +3228,6 @@ struct cfg80211_ops {
  * @WIPHY_FLAG_IBSS_RSN: The device supports IBSS RSN.
  * @WIPHY_FLAG_MESH_AUTH: The device supports mesh authentication by routing
  *      auth frames to userspace. See @NL80211_MESH_SETUP_USERSPACE_AUTH.
- * @WIPHY_FLAG_SUPPORTS_SCHED_SCAN: The device supports scheduled scans.
  * @WIPHY_FLAG_SUPPORTS_FW_ROAM: The device supports roaming feature in the
  *      firmware.
  * @WIPHY_FLAG_AP_UAPSD: The device supports uapsd on AP.
diff --git a/include/net/dst.h b/include/net/dst.h
index b091fd536098..d49d607dd2b3 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -521,4 +521,12 @@ static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst)
 }
 #endif
 
+static inline void skb_dst_update_pmtu(struct sk_buff *skb, u32 mtu)
+{
+        struct dst_entry *dst = skb_dst(skb);
+
+        if (dst && dst->ops->update_pmtu)
+                dst->ops->update_pmtu(dst, NULL, skb, mtu);
+}
+
 #endif /* _NET_DST_H */
diff --git a/include/net/gue.h b/include/net/gue.h
index 2fdb29ca74c2..fdad41469b65 100644
--- a/include/net/gue.h
+++ b/include/net/gue.h
@@ -44,10 +44,10 @@ struct guehdr {
 #else
 #error  "Please fix <asm/byteorder.h>"
 #endif
-                        __u8    proto_ctype;
-                        __u16   flags;
+                        __u8    proto_ctype;
+                        __be16  flags;
                 };
-                __u32 word;
+                __be32  word;
         };
 };
 
@@ -84,11 +84,10 @@ static inline size_t guehdr_priv_flags_len(__be32 flags)
  * if there is an unknown standard or private flags, or the options length for
  * the flags exceeds the options length specific in hlen of the GUE header.
  */
-static inline int validate_gue_flags(struct guehdr *guehdr,
-                                     size_t optlen)
+static inline int validate_gue_flags(struct guehdr *guehdr, size_t optlen)
 {
+        __be16 flags = guehdr->flags;
         size_t len;
-        __be32 flags = guehdr->flags;
 
         if (flags & ~GUE_FLAGS_ALL)
                 return 1;
@@ -101,12 +100,13 @@ static inline int validate_gue_flags(struct guehdr *guehdr,
                 /* Private flags are last four bytes accounted in
                  * guehdr_flags_len
                  */
-                flags = *(__be32 *)((void *)&guehdr[1] + len - GUE_LEN_PRIV);
+                __be32 pflags = *(__be32 *)((void *)&guehdr[1] +
+                                            len - GUE_LEN_PRIV);
 
-                if (flags & ~GUE_PFLAGS_ALL)
+                if (pflags & ~GUE_PFLAGS_ALL)
                         return 1;
 
-                len += guehdr_priv_flags_len(flags);
+                len += guehdr_priv_flags_len(pflags);
                 if (len > optlen)
                         return 1;
         }
diff --git a/include/net/ip.h b/include/net/ip.h
index 9896f46cbbf1..af8addbaa3c1 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -34,6 +34,7 @@
 #include <net/flow_dissector.h>
 
 #define IPV4_MAX_PMTU           65535U          /* RFC 2675, Section 5.1 */
+#define IPV4_MIN_MTU            68                      /* RFC 791 */
 
 struct sock;
 
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index f73797e2fa60..221238254eb7 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -331,6 +331,7 @@ int ipv6_flowlabel_opt_get(struct sock *sk, struct in6_flowlabel_req *freq,
                            int flags);
 int ip6_flowlabel_init(void);
 void ip6_flowlabel_cleanup(void);
+bool ip6_autoflowlabel(struct net *net, const struct ipv6_pinfo *np);
 
 static inline void fl6_sock_release(struct ip6_flowlabel *fl)
 {
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 10f99dafd5ac..049008493faf 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -223,6 +223,11 @@ int net_eq(const struct net *net1, const struct net *net2)
         return net1 == net2;
 }
 
+static inline int check_net(const struct net *net)
+{
+        return atomic_read(&net->count) != 0;
+}
+
 void net_drop_ns(void *);
 
 #else
@@ -247,6 +252,11 @@ int net_eq(const struct net *net1, const struct net *net2)
         return 1;
 }
 
+static inline int check_net(const struct net *net)
+{
+        return 1;
+}
+
 #define net_drop_ns NULL
 #endif
 
diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
index 0105445cab83..753ac9361154 100644
--- a/include/net/pkt_cls.h
+++ b/include/net/pkt_cls.h
@@ -522,7 +522,7 @@ static inline unsigned char * tcf_get_base_ptr(struct sk_buff *skb, int layer)
 {
         switch (layer) {
                 case TCF_LAYER_LINK:
-                        return skb->data;
+                        return skb_mac_header(skb);
                 case TCF_LAYER_NETWORK:
                         return skb_network_header(skb);
                 case TCF_LAYER_TRANSPORT:
@@ -694,9 +694,7 @@ struct tc_cls_matchall_offload {
 };
 
 enum tc_clsbpf_command {
-        TC_CLSBPF_ADD,
-        TC_CLSBPF_REPLACE,
-        TC_CLSBPF_DESTROY,
+        TC_CLSBPF_OFFLOAD,
         TC_CLSBPF_STATS,
 };
 
@@ -705,6 +703,7 @@ struct tc_cls_bpf_offload {
         enum tc_clsbpf_command command;
         struct tcf_exts *exts;
         struct bpf_prog *prog;
+        struct bpf_prog *oldprog;
         const char *name;
         bool exts_integrated;
         u32 gen_flags;
diff --git a/include/net/red.h b/include/net/red.h
index 9a9347710701..9665582c4687 100644
--- a/include/net/red.h
+++ b/include/net/red.h
@@ -168,6 +168,17 @@ static inline void red_set_vars(struct red_vars *v)
         v->qcount       = -1;
 }
 
+static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog)
+{
+        if (fls(qth_min) + Wlog > 32)
+                return false;
+        if (fls(qth_max) + Wlog > 32)
+                return false;
+        if (qth_max < qth_min)
+                return false;
+        return true;
+}
+
 static inline void red_set_parms(struct red_parms *p,
                                  u32 qth_min, u32 qth_max, u8 Wlog, u8 Plog,
                                  u8 Scell_log, u8 *stab, u32 max_P)
@@ -179,7 +190,7 @@ static inline void red_set_parms(struct red_parms *p,
         p->qth_max      = qth_max << Wlog;
         p->Wlog         = Wlog;
         p->Plog         = Plog;
-        if (delta < 0)
+        if (delta <= 0)
                 delta = 1;
         p->qth_delta    = delta;
         if (!max_P) {
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 65d0d25f2648..becf86aa4ac6 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -71,6 +71,7 @@ struct Qdisc {
                                       * qdisc_tree_decrease_qlen() should stop.
                                       */
 #define TCQ_F_INVISIBLE         0x80 /* invisible by default in dump */
+#define TCQ_F_OFFLOADED         0x200 /* qdisc is offloaded to HW */
         u32                     limit;
         const struct Qdisc_ops  *ops;
         struct qdisc_size_table __rcu *stab;
@@ -178,6 +179,7 @@ struct Qdisc_ops {
         const struct Qdisc_class_ops    *cl_ops;
         char                    id[IFNAMSIZ];
         int                     priv_size;
+        unsigned int            static_flags;
 
         int                     (*enqueue)(struct sk_buff *skb,
                                            struct Qdisc *sch,
@@ -443,6 +445,7 @@ void qdisc_tree_reduce_backlog(struct Qdisc *qdisc, unsigned int n,
                                unsigned int len);
 struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
                           const struct Qdisc_ops *ops);
+void qdisc_free(struct Qdisc *qdisc);
 struct Qdisc *qdisc_create_dflt(struct netdev_queue *dev_queue,
                                 const struct Qdisc_ops *ops, u32 parentid);
 void __qdisc_calculate_pkt_len(struct sk_buff *skb,
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 16f949eef52f..9a5ccf03a59b 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -503,7 +503,8 @@ struct sctp_datamsg {
         /* Did the messenge fail to send? */
         int send_error;
         u8 send_failed:1,
-           can_delay;       /* should this message be Nagle delayed */
+           can_delay:1, /* should this message be Nagle delayed */
+           abandoned:1; /* should this message be abandoned */
 };
 
 struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *,
@@ -965,7 +966,7 @@ void sctp_transport_burst_limited(struct sctp_transport *);
 void sctp_transport_burst_reset(struct sctp_transport *);
 unsigned long sctp_transport_timeout(struct sctp_transport *);
 void sctp_transport_reset(struct sctp_transport *t);
-void sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu);
+bool sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu);
 void sctp_transport_immediate_rtx(struct sctp_transport *);
 void sctp_transport_dst_release(struct sctp_transport *t);
 void sctp_transport_dst_confirm(struct sctp_transport *t);
diff --git a/include/net/sock.h b/include/net/sock.h
index 79e1a2c7912c..7a7b14e9628a 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -685,11 +685,7 @@ static inline void sk_add_node_rcu(struct sock *sk, struct hlist_head *list)
 
 static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list)
 {
-        if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport &&
-            sk->sk_family == AF_INET6)
-                hlist_nulls_add_tail_rcu(&sk->sk_nulls_node, list);
-        else
-                hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list);
+        hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list);
 }
 
 static inline void sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list)
@@ -1518,6 +1514,11 @@ static inline bool sock_owned_by_user(const struct sock *sk)
         return sk->sk_lock.owned;
 }
 
+static inline bool sock_owned_by_user_nocheck(const struct sock *sk)
+{
+        return sk->sk_lock.owned;
+}
+
 /* no reclassification while locks are held */
 static inline bool sock_allow_reclassification(const struct sock *csk)
 {
diff --git a/include/net/tc_act/tc_sample.h b/include/net/tc_act/tc_sample.h
index 524cee4f4c81..01dbfea32672 100644
--- a/include/net/tc_act/tc_sample.h
+++ b/include/net/tc_act/tc_sample.h
@@ -14,7 +14,6 @@ struct tcf_sample {
         struct psample_group __rcu *psample_group;
         u32 psample_group_num;
         struct list_head tcfm_list;
-        struct rcu_head rcu;
 };
 #define to_sample(a) ((struct tcf_sample *)a)
 
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 4e09398009c1..6da880d2f022 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -844,12 +844,11 @@ static inline int tcp_v6_sdif(const struct sk_buff *skb)
 }
 #endif
 
-/* TCP_SKB_CB reference means this can not be used from early demux */
 static inline bool inet_exact_dif_match(struct net *net, struct sk_buff *skb)
 {
 #if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV)
         if (!net->ipv4.sysctl_tcp_l3mdev_accept &&
-            skb && ipv4_l3mdev_skb(TCP_SKB_CB(skb)->header.h4.flags))
+            skb && ipv4_l3mdev_skb(IPCB(skb)->flags))
                 return true;
 #endif
         return false;
@@ -1056,7 +1055,7 @@ void tcp_rate_skb_sent(struct sock *sk, struct sk_buff *skb);
 void tcp_rate_skb_delivered(struct sock *sk, struct sk_buff *skb,
                             struct rate_sample *rs);
 void tcp_rate_gen(struct sock *sk, u32 delivered, u32 lost,
-                  struct rate_sample *rs);
+                  bool is_sack_reneg, struct rate_sample *rs);
 void tcp_rate_check_app_limited(struct sock *sk);
 
 /* These functions determine how the current flow behaves in respect of SACK
diff --git a/include/net/tls.h b/include/net/tls.h
index 936cfc5cab7d..9185e53a743c 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -170,7 +170,7 @@ static inline bool tls_is_pending_open_record(struct tls_context *tls_ctx)
 
 static inline void tls_err_abort(struct sock *sk)
 {
-        sk->sk_err = -EBADMSG;
+        sk->sk_err = EBADMSG;
         sk->sk_error_report(sk);
 }
 
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index 13223396dc64..f96391e84a8a 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -146,7 +146,7 @@ struct vxlanhdr_gpe {
                 np_applied:1,
                 instance_applied:1,
                 version:2,
-reserved_flags2:2;
+                reserved_flags2:2;
 #elif defined(__BIG_ENDIAN_BITFIELD)
         u8      reserved_flags2:2,
                 version:2,
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index dc28a98ce97c..ae35991b5877 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1570,6 +1570,9 @@ int xfrm_init_state(struct xfrm_state *x);
 int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
 int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
 int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
+int xfrm_trans_queue(struct sk_buff *skb,
+                     int (*finish)(struct net *, struct sock *,
+                                   struct sk_buff *));
 int xfrm_output_resume(struct sk_buff *skb, int err);
 int xfrm_output(struct sock *sk, struct sk_buff *skb);
 int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
index 0f9cbf96c093..6df6fe0c2198 100644
--- a/include/scsi/libsas.h
+++ b/include/scsi/libsas.h
@@ -159,11 +159,11 @@ struct expander_device {
 
 struct sata_device {
         unsigned int class;
-        struct smp_resp        rps_resp; /* report_phy_sata_resp */
         u8     port_no;        /* port number, if this is a PM (Port) */
 
         struct ata_port *ap;
         struct ata_host ata_host;
+        struct smp_resp rps_resp ____cacheline_aligned; /* report_phy_sata_resp */
         u8     fis[ATA_RESP_FIS_SIZE];
 };
 
diff --git a/include/trace/events/clk.h b/include/trace/events/clk.h
index 758607226bfd..2cd449328aee 100644
--- a/include/trace/events/clk.h
+++ b/include/trace/events/clk.h
@@ -134,12 +134,12 @@ DECLARE_EVENT_CLASS(clk_parent,
 
         TP_STRUCT__entry(
                 __string(        name,           core->name                )
-                __string(        pname,          parent->name              )
+                __string(        pname, parent ? parent->name : "none"     )
         ),
 
         TP_fast_assign(
                 __assign_str(name, core->name);
-                __assign_str(pname, parent->name);
+                __assign_str(pname, parent ? parent->name : "none");
         ),
 
         TP_printk("%s %s", __get_str(name), __get_str(pname))
diff --git a/include/trace/events/kvm.h b/include/trace/events/kvm.h
index e4b0b8e09932..2c735a3e6613 100644
--- a/include/trace/events/kvm.h
+++ b/include/trace/events/kvm.h
@@ -211,7 +211,7 @@ TRACE_EVENT(kvm_ack_irq,
         { KVM_TRACE_MMIO_WRITE, "write" }
 
 TRACE_EVENT(kvm_mmio,
-        TP_PROTO(int type, int len, u64 gpa, u64 val),
+        TP_PROTO(int type, int len, u64 gpa, void *val),
         TP_ARGS(type, len, gpa, val),
 
         TP_STRUCT__entry(
@@ -225,7 +225,10 @@ TRACE_EVENT(kvm_mmio,
                 __entry->type           = type;
                 __entry->len            = len;
                 __entry->gpa            = gpa;
-                __entry->val            = val;
+                __entry->val            = 0;
+                if (val)
+                        memcpy(&__entry->val, val,
+                               min_t(u32, sizeof(__entry->val), len));
         ),
 
         TP_printk("mmio %s len %u gpa 0x%llx val 0x%llx",
diff --git a/include/trace/events/preemptirq.h b/include/trace/events/preemptirq.h
index f5024c560d8f..9c4eb33c5a1d 100644
--- a/include/trace/events/preemptirq.h
+++ b/include/trace/events/preemptirq.h
@@ -56,15 +56,18 @@ DEFINE_EVENT(preemptirq_template, preempt_enable,
 
 #include <trace/define_trace.h>
 
-#else /* !CONFIG_PREEMPTIRQ_EVENTS */
+#endif /* !CONFIG_PREEMPTIRQ_EVENTS */
 
+#if !defined(CONFIG_PREEMPTIRQ_EVENTS) || defined(CONFIG_PROVE_LOCKING)
 #define trace_irq_enable(...)
 #define trace_irq_disable(...)
-#define trace_preempt_enable(...)
-#define trace_preempt_disable(...)
 #define trace_irq_enable_rcuidle(...)
 #define trace_irq_disable_rcuidle(...)
+#endif
+
+#if !defined(CONFIG_PREEMPTIRQ_EVENTS) || !defined(CONFIG_DEBUG_PREEMPT)
+#define trace_preempt_enable(...)
+#define trace_preempt_disable(...)
 #define trace_preempt_enable_rcuidle(...)
 #define trace_preempt_disable_rcuidle(...)
-
 #endif
diff --git a/include/trace/events/tcp.h b/include/trace/events/tcp.h
index 07cccca6cbf1..ab34c561f26b 100644
--- a/include/trace/events/tcp.h
+++ b/include/trace/events/tcp.h
@@ -25,6 +25,35 @@
                 tcp_state_name(TCP_CLOSING),            \
                 tcp_state_name(TCP_NEW_SYN_RECV))
 
+#define TP_STORE_V4MAPPED(__entry, saddr, daddr)                \
+        do {                                                    \
+                struct in6_addr *pin6;                          \
+                                                                \
+                pin6 = (struct in6_addr *)__entry->saddr_v6;    \
+                ipv6_addr_set_v4mapped(saddr, pin6);            \
+                pin6 = (struct in6_addr *)__entry->daddr_v6;    \
+                ipv6_addr_set_v4mapped(daddr, pin6);            \
+        } while (0)
+
+#if IS_ENABLED(CONFIG_IPV6)
+#define TP_STORE_ADDRS(__entry, saddr, daddr, saddr6, daddr6)           \
+        do {                                                            \
+                if (sk->sk_family == AF_INET6) {                        \
+                        struct in6_addr *pin6;                          \
+                                                                        \
+                        pin6 = (struct in6_addr *)__entry->saddr_v6;    \
+                        *pin6 = saddr6;                                 \
+                        pin6 = (struct in6_addr *)__entry->daddr_v6;    \
+                        *pin6 = daddr6;                                 \
+                } else {                                                \
+                        TP_STORE_V4MAPPED(__entry, saddr, daddr);       \
+                }                                                       \
+        } while (0)
+#else
+#define TP_STORE_ADDRS(__entry, saddr, daddr, saddr6, daddr6)   \
+        TP_STORE_V4MAPPED(__entry, saddr, daddr)
+#endif
+
 /*
  * tcp event with arguments sk and skb
  *
@@ -50,7 +79,6 @@ DECLARE_EVENT_CLASS(tcp_event_sk_skb,
 
         TP_fast_assign(
                 struct inet_sock *inet = inet_sk(sk);
-                struct in6_addr *pin6;
                 __be32 *p32;
 
                 __entry->skbaddr = skb;
@@ -65,20 +93,8 @@ DECLARE_EVENT_CLASS(tcp_event_sk_skb,
                 p32 = (__be32 *) __entry->daddr;
                 *p32 =  inet->inet_daddr;
 
-#if IS_ENABLED(CONFIG_IPV6)
-                if (sk->sk_family == AF_INET6) {
-                        pin6 = (struct in6_addr *)__entry->saddr_v6;
-                        *pin6 = sk->sk_v6_rcv_saddr;
-                        pin6 = (struct in6_addr *)__entry->daddr_v6;
-                        *pin6 = sk->sk_v6_daddr;
-                } else
-#endif
-                {
-                        pin6 = (struct in6_addr *)__entry->saddr_v6;
-                        ipv6_addr_set_v4mapped(inet->inet_saddr, pin6);
-                        pin6 = (struct in6_addr *)__entry->daddr_v6;
-                        ipv6_addr_set_v4mapped(inet->inet_daddr, pin6);
-                }
+                TP_STORE_ADDRS(__entry, inet->inet_saddr, inet->inet_daddr,
+                              sk->sk_v6_rcv_saddr, sk->sk_v6_daddr);
         ),
 
         TP_printk("sport=%hu dport=%hu saddr=%pI4 daddr=%pI4 saddrv6=%pI6c daddrv6=%pI6c",
@@ -127,7 +143,6 @@ DECLARE_EVENT_CLASS(tcp_event_sk,
 
         TP_fast_assign(
                 struct inet_sock *inet = inet_sk(sk);
-                struct in6_addr *pin6;
                 __be32 *p32;
 
                 __entry->skaddr = sk;
@@ -141,20 +156,8 @@ DECLARE_EVENT_CLASS(tcp_event_sk,
                 p32 = (__be32 *) __entry->daddr;
                 *p32 =  inet->inet_daddr;
 
-#if IS_ENABLED(CONFIG_IPV6)
-                if (sk->sk_family == AF_INET6) {
-                        pin6 = (struct in6_addr *)__entry->saddr_v6;
-                        *pin6 = sk->sk_v6_rcv_saddr;
-                        pin6 = (struct in6_addr *)__entry->daddr_v6;
-                        *pin6 = sk->sk_v6_daddr;
-                } else
-#endif
-                {
-                        pin6 = (struct in6_addr *)__entry->saddr_v6;
-                        ipv6_addr_set_v4mapped(inet->inet_saddr, pin6);
-                        pin6 = (struct in6_addr *)__entry->daddr_v6;
-                        ipv6_addr_set_v4mapped(inet->inet_daddr, pin6);
-                }
+                TP_STORE_ADDRS(__entry, inet->inet_saddr, inet->inet_daddr,
+                               sk->sk_v6_rcv_saddr, sk->sk_v6_daddr);
         ),
 
         TP_printk("sport=%hu dport=%hu saddr=%pI4 daddr=%pI4 saddrv6=%pI6c daddrv6=%pI6c",
@@ -197,7 +200,6 @@ TRACE_EVENT(tcp_set_state,
 
         TP_fast_assign(
                 struct inet_sock *inet = inet_sk(sk);
-                struct in6_addr *pin6;
                 __be32 *p32;
 
                 __entry->skaddr = sk;
@@ -213,20 +215,8 @@ TRACE_EVENT(tcp_set_state,
                 p32 = (__be32 *) __entry->daddr;
                 *p32 =  inet->inet_daddr;
 
-#if IS_ENABLED(CONFIG_IPV6)
-                if (sk->sk_family == AF_INET6) {
-                        pin6 = (struct in6_addr *)__entry->saddr_v6;
-                        *pin6 = sk->sk_v6_rcv_saddr;
-                        pin6 = (struct in6_addr *)__entry->daddr_v6;
-                        *pin6 = sk->sk_v6_daddr;
-                } else
-#endif
-                {
-                        pin6 = (struct in6_addr *)__entry->saddr_v6;
-                        ipv6_addr_set_v4mapped(inet->inet_saddr, pin6);
-                        pin6 = (struct in6_addr *)__entry->daddr_v6;
-                        ipv6_addr_set_v4mapped(inet->inet_daddr, pin6);
-                }
+                TP_STORE_ADDRS(__entry, inet->inet_saddr, inet->inet_daddr,
+                               sk->sk_v6_rcv_saddr, sk->sk_v6_daddr);
         ),
 
         TP_printk("sport=%hu dport=%hu saddr=%pI4 daddr=%pI4 saddrv6=%pI6c daddrv6=%pI6c oldstate=%s newstate=%s",
@@ -256,7 +246,6 @@ TRACE_EVENT(tcp_retransmit_synack,
 
         TP_fast_assign(
                 struct inet_request_sock *ireq = inet_rsk(req);
-                struct in6_addr *pin6;
                 __be32 *p32;
 
                 __entry->skaddr = sk;
@@ -271,20 +260,8 @@ TRACE_EVENT(tcp_retransmit_synack,
                 p32 = (__be32 *) __entry->daddr;
                 *p32 = ireq->ir_rmt_addr;
 
-#if IS_ENABLED(CONFIG_IPV6)
-                if (sk->sk_family == AF_INET6) {
-                        pin6 = (struct in6_addr *)__entry->saddr_v6;
-                        *pin6 = ireq->ir_v6_loc_addr;
-                        pin6 = (struct in6_addr *)__entry->daddr_v6;
-                        *pin6 = ireq->ir_v6_rmt_addr;
-                } else
-#endif
-                {
-                        pin6 = (struct in6_addr *)__entry->saddr_v6;
-                        ipv6_addr_set_v4mapped(ireq->ir_loc_addr, pin6);
-                        pin6 = (struct in6_addr *)__entry->daddr_v6;
-                        ipv6_addr_set_v4mapped(ireq->ir_rmt_addr, pin6);
-                }
+                TP_STORE_ADDRS(__entry, ireq->ir_loc_addr, ireq->ir_rmt_addr,
+                              ireq->ir_v6_loc_addr, ireq->ir_v6_rmt_addr);
         ),
 
         TP_printk("sport=%hu dport=%hu saddr=%pI4 daddr=%pI4 saddrv6=%pI6c daddrv6=%pI6c",
diff --git a/include/trace/events/xdp.h b/include/trace/events/xdp.h
index 4cd0f05d0113..8989a92c571a 100644
--- a/include/trace/events/xdp.h
+++ b/include/trace/events/xdp.h
@@ -8,6 +8,7 @@
 #include <linux/netdevice.h>
 #include <linux/filter.h>
 #include <linux/tracepoint.h>
+#include <linux/bpf.h>
 
 #define __XDP_ACT_MAP(FN)       \
         FN(ABORTED)             \
diff --git a/include/uapi/asm-generic/bpf_perf_event.h b/include/uapi/asm-generic/bpf_perf_event.h
new file mode 100644
index 000000000000..53815d2cd047
--- /dev/null
+++ b/include/uapi/asm-generic/bpf_perf_event.h
@@ -0,0 +1,9 @@
+#ifndef _UAPI__ASM_GENERIC_BPF_PERF_EVENT_H__
+#define _UAPI__ASM_GENERIC_BPF_PERF_EVENT_H__
+
+#include <linux/ptrace.h>
+
+/* Export kernel pt_regs structure */
+typedef struct pt_regs bpf_user_pt_regs_t;
+
+#endif /* _UAPI__ASM_GENERIC_BPF_PERF_EVENT_H__ */
diff --git a/include/uapi/linux/bpf_perf_event.h b/include/uapi/linux/bpf_perf_event.h
index af549d4ecf1b..8f95303f9d80 100644
--- a/include/uapi/linux/bpf_perf_event.h
+++ b/include/uapi/linux/bpf_perf_event.h
@@ -8,11 +8,10 @@
 #ifndef _UAPI__LINUX_BPF_PERF_EVENT_H__
 #define _UAPI__LINUX_BPF_PERF_EVENT_H__
 
-#include <linux/types.h>
-#include <linux/ptrace.h>
+#include <asm/bpf_perf_event.h>
 
 struct bpf_perf_event_data {
-        struct pt_regs regs;
+        bpf_user_pt_regs_t regs;
         __u64 sample_period;
 };
 
diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h
index 3ee3bf7c8526..144de4d2f385 100644
--- a/include/uapi/linux/if_ether.h
+++ b/include/uapi/linux/if_ether.h
@@ -23,6 +23,7 @@
 #define _UAPI_LINUX_IF_ETHER_H
 
 #include <linux/types.h>
+#include <linux/libc-compat.h>
 
 /*
  *      IEEE 802.3 Ethernet magic constants.  The frame sizes omit the preamble
@@ -149,11 +150,13 @@
  *      This is an Ethernet frame header.
  */
 
+#if __UAPI_DEF_ETHHDR
 struct ethhdr {
         unsigned char   h_dest[ETH_ALEN];       /* destination eth addr */
         unsigned char   h_source[ETH_ALEN];     /* source ether addr    */
         __be16          h_proto;                /* packet type ID field */
 } __attribute__((packed));
+#endif
 
 
 #endif /* _UAPI_LINUX_IF_ETHER_H */
diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
index 282d7613fce8..8fb90a0819c3 100644
--- a/include/uapi/linux/kvm.h
+++ b/include/uapi/linux/kvm.h
@@ -630,9 +630,9 @@ struct kvm_s390_irq {
 
 struct kvm_s390_irq_state {
         __u64 buf;
-        __u32 flags;
+        __u32 flags;        /* will stay unused for compatibility reasons */
         __u32 len;
-        __u32 reserved[4];
+        __u32 reserved[4];  /* will stay unused for compatibility reasons */
 };
 
 /* for KVM_SET_GUEST_DEBUG */
@@ -932,6 +932,8 @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_HYPERV_SYNIC2 148
 #define KVM_CAP_HYPERV_VP_INDEX 149
 #define KVM_CAP_S390_AIS_MIGRATION 150
+#define KVM_CAP_PPC_GET_CPU_CHAR 151
+#define KVM_CAP_S390_BPB 152
 
 #ifdef KVM_CAP_IRQ_ROUTING
 
@@ -1261,6 +1263,8 @@ struct kvm_s390_ucas_mapping {
 #define KVM_PPC_CONFIGURE_V3_MMU  _IOW(KVMIO,  0xaf, struct kvm_ppc_mmuv3_cfg)
 /* Available with KVM_CAP_PPC_RADIX_MMU */
 #define KVM_PPC_GET_RMMU_INFO     _IOW(KVMIO,  0xb0, struct kvm_ppc_rmmu_info)
+/* Available with KVM_CAP_PPC_GET_CPU_CHAR */
+#define KVM_PPC_GET_CPU_CHAR      _IOR(KVMIO,  0xb1, struct kvm_ppc_cpu_char)
 
 /* ioctl for vm fd */
 #define KVM_CREATE_DEVICE         _IOWR(KVMIO,  0xe0, struct kvm_create_device)
diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
index 282875cf8056..fc29efaa918c 100644
--- a/include/uapi/linux/libc-compat.h
+++ b/include/uapi/linux/libc-compat.h
@@ -168,47 +168,106 @@
 
 /* If we did not see any headers from any supported C libraries,
  * or we are being included in the kernel, then define everything
- * that we need. */
+ * that we need. Check for previous __UAPI_* definitions to give
+ * unsupported C libraries a way to opt out of any kernel definition. */
 #else /* !defined(__GLIBC__) */
 
 /* Definitions for if.h */
+#ifndef __UAPI_DEF_IF_IFCONF
 #define __UAPI_DEF_IF_IFCONF 1
+#endif
+#ifndef __UAPI_DEF_IF_IFMAP
 #define __UAPI_DEF_IF_IFMAP 1
+#endif
+#ifndef __UAPI_DEF_IF_IFNAMSIZ
 #define __UAPI_DEF_IF_IFNAMSIZ 1
+#endif
+#ifndef __UAPI_DEF_IF_IFREQ
 #define __UAPI_DEF_IF_IFREQ 1
+#endif
 /* Everything up to IFF_DYNAMIC, matches net/if.h until glibc 2.23 */
+#ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS
 #define __UAPI_DEF_IF_NET_DEVICE_FLAGS 1
+#endif
 /* For the future if glibc adds IFF_LOWER_UP, IFF_DORMANT and IFF_ECHO */
+#ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO
 #define __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO 1
+#endif
 
 /* Definitions for in.h */
+#ifndef __UAPI_DEF_IN_ADDR
 #define __UAPI_DEF_IN_ADDR              1
+#endif
+#ifndef __UAPI_DEF_IN_IPPROTO
 #define __UAPI_DEF_IN_IPPROTO           1
+#endif
+#ifndef __UAPI_DEF_IN_PKTINFO
 #define __UAPI_DEF_IN_PKTINFO           1
+#endif
+#ifndef __UAPI_DEF_IP_MREQ
 #define __UAPI_DEF_IP_MREQ              1
+#endif
+#ifndef __UAPI_DEF_SOCKADDR_IN
 #define __UAPI_DEF_SOCKADDR_IN          1
+#endif
+#ifndef __UAPI_DEF_IN_CLASS
 #define __UAPI_DEF_IN_CLASS             1
+#endif
 
 /* Definitions for in6.h */
+#ifndef __UAPI_DEF_IN6_ADDR
 #define __UAPI_DEF_IN6_ADDR             1
+#endif
+#ifndef __UAPI_DEF_IN6_ADDR_ALT
 #define __UAPI_DEF_IN6_ADDR_ALT         1
+#endif
+#ifndef __UAPI_DEF_SOCKADDR_IN6
 #define __UAPI_DEF_SOCKADDR_IN6         1
+#endif
+#ifndef __UAPI_DEF_IPV6_MREQ
 #define __UAPI_DEF_IPV6_MREQ            1
+#endif
+#ifndef __UAPI_DEF_IPPROTO_V6
 #define __UAPI_DEF_IPPROTO_V6           1
+#endif
+#ifndef __UAPI_DEF_IPV6_OPTIONS
 #define __UAPI_DEF_IPV6_OPTIONS         1
+#endif
+#ifndef __UAPI_DEF_IN6_PKTINFO
 #define __UAPI_DEF_IN6_PKTINFO          1
+#endif
+#ifndef __UAPI_DEF_IP6_MTUINFO
 #define __UAPI_DEF_IP6_MTUINFO          1
+#endif
 
 /* Definitions for ipx.h */
+#ifndef __UAPI_DEF_SOCKADDR_IPX
 #define __UAPI_DEF_SOCKADDR_IPX                 1
+#endif
+#ifndef __UAPI_DEF_IPX_ROUTE_DEFINITION
 #define __UAPI_DEF_IPX_ROUTE_DEFINITION         1
+#endif
+#ifndef __UAPI_DEF_IPX_INTERFACE_DEFINITION
 #define __UAPI_DEF_IPX_INTERFACE_DEFINITION     1
+#endif
+#ifndef __UAPI_DEF_IPX_CONFIG_DATA
 #define __UAPI_DEF_IPX_CONFIG_DATA              1
+#endif
+#ifndef __UAPI_DEF_IPX_ROUTE_DEF
 #define __UAPI_DEF_IPX_ROUTE_DEF                1
+#endif
 
 /* Definitions for xattr.h */
+#ifndef __UAPI_DEF_XATTR
 #define __UAPI_DEF_XATTR                1
+#endif
 
 #endif /* __GLIBC__ */
 
+/* Definitions for if_ether.h */
+/* allow libcs like musl to deactivate this, glibc does not implement this. */
+#ifndef __UAPI_DEF_ETHHDR
+#define __UAPI_DEF_ETHHDR               1
+#endif
+
 #endif /* _UAPI_LIBC_COMPAT_H */
diff --git a/include/uapi/linux/netfilter/nf_conntrack_common.h b/include/uapi/linux/netfilter/nf_conntrack_common.h
index 3fea7709a441..57ccfb32e87f 100644
--- a/include/uapi/linux/netfilter/nf_conntrack_common.h
+++ b/include/uapi/linux/netfilter/nf_conntrack_common.h
@@ -36,7 +36,7 @@ enum ip_conntrack_info {
 
 #define NF_CT_STATE_INVALID_BIT                 (1 << 0)
 #define NF_CT_STATE_BIT(ctinfo)                 (1 << ((ctinfo) % IP_CT_IS_REPLY + 1))
-#define NF_CT_STATE_UNTRACKED_BIT               (1 << (IP_CT_UNTRACKED + 1))
+#define NF_CT_STATE_UNTRACKED_BIT               (1 << 6)
 
 /* Bitset representing status of connection. */
 enum ip_conntrack_status {
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index 4265d7f9e1f2..dcfab5e3b55c 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -363,7 +363,6 @@ enum ovs_tunnel_key_attr {
         OVS_TUNNEL_KEY_ATTR_IPV6_SRC,           /* struct in6_addr src IPv6 address. */
         OVS_TUNNEL_KEY_ATTR_IPV6_DST,           /* struct in6_addr dst IPv6 address. */
         OVS_TUNNEL_KEY_ATTR_PAD,
-        OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS,        /* be32 ERSPAN index. */
         __OVS_TUNNEL_KEY_ATTR_MAX
 };
 
diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h
index af3cc2f4e1ad..37b5096ae97b 100644
--- a/include/uapi/linux/pkt_sched.h
+++ b/include/uapi/linux/pkt_sched.h
@@ -256,7 +256,6 @@ struct tc_red_qopt {
 #define TC_RED_ECN              1
 #define TC_RED_HARDDROP         2
 #define TC_RED_ADAPTATIVE       4
-#define TC_RED_OFFLOADED        8
 };
 
 struct tc_red_xstats {
diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
index d8b5f80c2ea6..843e29aa3cac 100644
--- a/include/uapi/linux/rtnetlink.h
+++ b/include/uapi/linux/rtnetlink.h
@@ -557,6 +557,7 @@ enum {
         TCA_PAD,
         TCA_DUMP_INVISIBLE,
         TCA_CHAIN,
+        TCA_HW_OFFLOAD,
         __TCA_MAX
 };
 
diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h
index 41a0a81b01e6..c4c79aa331bd 100644
--- a/include/uapi/linux/usb/ch9.h
+++ b/include/uapi/linux/usb/ch9.h
@@ -880,6 +880,8 @@ struct usb_wireless_cap_descriptor {	/* Ultra Wide Band */
         __u8  bReserved;
 } __attribute__((packed));
 
+#define USB_DT_USB_WIRELESS_CAP_SIZE    11
+
 /* USB 2.0 Extension descriptor */
 #define USB_CAP_TYPE_EXT                2
 
@@ -1072,6 +1074,7 @@ struct usb_ptm_cap_descriptor {
         __u8  bDevCapabilityType;
 } __attribute__((packed));
 
+#define USB_DT_USB_PTM_ID_SIZE          3
 /*
  * The size of the descriptor for the Sublink Speed Attribute Count
  * (SSAC) specified in bmAttributes[4:0].
diff --git a/include/xen/balloon.h b/include/xen/balloon.h
index 4914b93a23f2..61f410fd74e4 100644
--- a/include/xen/balloon.h
+++ b/include/xen/balloon.h
@@ -44,3 +44,8 @@ static inline void xen_balloon_init(void)
 {
 }
 #endif
+
+#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+struct resource;
+void arch_xen_balloon_init(struct resource *hostmem_resource);
+#endif
diff --git a/init/Kconfig b/init/Kconfig
index 2934249fba46..a9a2e2c86671 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -461,10 +461,15 @@ endmenu # "CPU/Task time and stats accounting"
 
 config CPU_ISOLATION
         bool "CPU isolation"
+        depends on SMP || COMPILE_TEST
+        default y
         help
           Make sure that CPUs running critical tasks are not disturbed by
           any source of "noise" such as unbound workqueues, timers, kthreads...
-          Unbound jobs get offloaded to housekeeping CPUs.
+          Unbound jobs get offloaded to housekeeping CPUs. This is driven by
+          the "isolcpus=" boot parameter.
+
+          Say Y if unsure.
 
 source "kernel/rcu/Kconfig"
 
@@ -1392,6 +1397,13 @@ config BPF_SYSCALL
           Enable the bpf() system call that allows to manipulate eBPF
           programs and maps via file descriptors.
 
+config BPF_JIT_ALWAYS_ON
+        bool "Permanently enable BPF JIT and remove BPF interpreter"
+        depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
+        help
+          Enables BPF JIT and removes BPF interpreter to avoid
+          speculative execution of BPF instructions by the interpreter
+
 config USERFAULTFD
         bool "Enable userfaultfd() system call"
         select ANON_INODES
diff --git a/init/main.c b/init/main.c
index dfec3809e740..a8100b954839 100644
--- a/init/main.c
+++ b/init/main.c
@@ -75,6 +75,7 @@
 #include <linux/slab.h>
 #include <linux/perf_event.h>
 #include <linux/ptrace.h>
+#include <linux/pti.h>
 #include <linux/blkdev.h>
 #include <linux/elevator.h>
 #include <linux/sched_clock.h>
@@ -504,6 +505,10 @@ static void __init mm_init(void)
         pgtable_init();
         vmalloc_init();
         ioremap_huge_init();
+        /* Should be run before the first non-init thread is created */
+        init_espfix_bsp();
+        /* Should be run after espfix64 is set up. */
+        pti_init();
 }
 
 asmlinkage __visible void __init start_kernel(void)
@@ -589,6 +594,12 @@ asmlinkage __visible void __init start_kernel(void)
         radix_tree_init();
 
         /*
+         * Set up housekeeping before setting up workqueues to allow the unbound
+         * workqueue to take non-housekeeping into account.
+         */
+        housekeeping_init();
+
+        /*
          * Allow workqueue creation and work item queueing/cancelling
          * early.  Work item execution depends on kthreads and starts after
          * workqueue_init().
@@ -605,7 +616,6 @@ asmlinkage __visible void __init start_kernel(void)
         early_irq_init();
         init_IRQ();
         tick_init();
-        housekeeping_init();
         rcu_init_nohz();
         init_timers();
         hrtimers_init();
@@ -674,10 +684,6 @@ asmlinkage __visible void __init start_kernel(void)
         if (efi_enabled(EFI_RUNTIME_SERVICES))
                 efi_enter_virtual_mode();
 #endif
-#ifdef CONFIG_X86_ESPFIX64
-        /* Should be run before the first non-init thread is created */
-        init_espfix_bsp();
-#endif
         thread_stack_cache_init();
         cred_init();
         fork_init();
diff --git a/kernel/acct.c b/kernel/acct.c
index d15c0ee4d955..addf7732fb56 100644
--- a/kernel/acct.c
+++ b/kernel/acct.c
@@ -102,7 +102,7 @@ static int check_free_space(struct bsd_acct_struct *acct)
 {
         struct kstatfs sbuf;
 
-        if (time_is_before_jiffies(acct->needcheck))
+        if (time_is_after_jiffies(acct->needcheck))
                 goto out;
 
         /* May block */
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 7c25426d3cf5..ab94d304a634 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -53,9 +53,10 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr)
 {
         bool percpu = attr->map_type == BPF_MAP_TYPE_PERCPU_ARRAY;
         int numa_node = bpf_map_attr_numa_node(attr);
+        u32 elem_size, index_mask, max_entries;
+        bool unpriv = !capable(CAP_SYS_ADMIN);
         struct bpf_array *array;
-        u64 array_size;
-        u32 elem_size;
+        u64 array_size, mask64;
 
         /* check sanity of attributes */
         if (attr->max_entries == 0 || attr->key_size != 4 ||
@@ -72,11 +73,32 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr)
 
         elem_size = round_up(attr->value_size, 8);
 
+        max_entries = attr->max_entries;
+
+        /* On 32 bit archs roundup_pow_of_two() with max_entries that has
+         * upper most bit set in u32 space is undefined behavior due to
+         * resulting 1U << 32, so do it manually here in u64 space.
+         */
+        mask64 = fls_long(max_entries - 1);
+        mask64 = 1ULL << mask64;
+        mask64 -= 1;
+
+        index_mask = mask64;
+        if (unpriv) {
+                /* round up array size to nearest power of 2,
+                 * since cpu will speculate within index_mask limits
+                 */
+                max_entries = index_mask + 1;
+                /* Check for overflows. */
+                if (max_entries < attr->max_entries)
+                        return ERR_PTR(-E2BIG);
+        }
+
         array_size = sizeof(*array);
         if (percpu)
-                array_size += (u64) attr->max_entries * sizeof(void *);
+                array_size += (u64) max_entries * sizeof(void *);
         else
-                array_size += (u64) attr->max_entries * elem_size;
+                array_size += (u64) max_entries * elem_size;
 
         /* make sure there is no u32 overflow later in round_up() */
         if (array_size >= U32_MAX - PAGE_SIZE)
@@ -86,6 +108,8 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr)
         array = bpf_map_area_alloc(array_size, numa_node);
         if (!array)
                 return ERR_PTR(-ENOMEM);
+        array->index_mask = index_mask;
+        array->map.unpriv_array = unpriv;
 
         /* copy mandatory map attributes */
         array->map.map_type = attr->map_type;
@@ -121,12 +145,13 @@ static void *array_map_lookup_elem(struct bpf_map *map, void *key)
         if (unlikely(index >= array->map.max_entries))
                 return NULL;
 
-        return array->value + array->elem_size * index;
+        return array->value + array->elem_size * (index & array->index_mask);
 }
 
 /* emit BPF instructions equivalent to C code of array_map_lookup_elem() */
 static u32 array_map_gen_lookup(struct bpf_map *map, struct bpf_insn *insn_buf)
 {
+        struct bpf_array *array = container_of(map, struct bpf_array, map);
         struct bpf_insn *insn = insn_buf;
         u32 elem_size = round_up(map->value_size, 8);
         const int ret = BPF_REG_0;
@@ -135,7 +160,12 @@ static u32 array_map_gen_lookup(struct bpf_map *map, struct bpf_insn *insn_buf)
 
         *insn++ = BPF_ALU64_IMM(BPF_ADD, map_ptr, offsetof(struct bpf_array, value));
         *insn++ = BPF_LDX_MEM(BPF_W, ret, index, 0);
-        *insn++ = BPF_JMP_IMM(BPF_JGE, ret, map->max_entries, 3);
+        if (map->unpriv_array) {
+                *insn++ = BPF_JMP_IMM(BPF_JGE, ret, map->max_entries, 4);
+                *insn++ = BPF_ALU32_IMM(BPF_AND, ret, array->index_mask);
+        } else {
+                *insn++ = BPF_JMP_IMM(BPF_JGE, ret, map->max_entries, 3);
+        }
 
         if (is_power_of_2(elem_size)) {
                 *insn++ = BPF_ALU64_IMM(BPF_LSH, ret, ilog2(elem_size));
@@ -157,7 +187,7 @@ static void *percpu_array_map_lookup_elem(struct bpf_map *map, void *key)
         if (unlikely(index >= array->map.max_entries))
                 return NULL;
 
-        return this_cpu_ptr(array->pptrs[index]);
+        return this_cpu_ptr(array->pptrs[index & array->index_mask]);
 }
 
 int bpf_percpu_array_copy(struct bpf_map *map, void *key, void *value)
@@ -177,7 +207,7 @@ int bpf_percpu_array_copy(struct bpf_map *map, void *key, void *value)
          */
         size = round_up(map->value_size, 8);
         rcu_read_lock();
-        pptr = array->pptrs[index];
+        pptr = array->pptrs[index & array->index_mask];
         for_each_possible_cpu(cpu) {
                 bpf_long_memcpy(value + off, per_cpu_ptr(pptr, cpu), size);
                 off += size;
@@ -225,10 +255,11 @@ static int array_map_update_elem(struct bpf_map *map, void *key, void *value,
                 return -EEXIST;
 
         if (array->map.map_type == BPF_MAP_TYPE_PERCPU_ARRAY)
-                memcpy(this_cpu_ptr(array->pptrs[index]),
+                memcpy(this_cpu_ptr(array->pptrs[index & array->index_mask]),
                        value, map->value_size);
         else
-                memcpy(array->value + array->elem_size * index,
+                memcpy(array->value +
+                       array->elem_size * (index & array->index_mask),
                        value, map->value_size);
         return 0;
 }
@@ -262,7 +293,7 @@ int bpf_percpu_array_update(struct bpf_map *map, void *key, void *value,
          */
         size = round_up(map->value_size, 8);
         rcu_read_lock();
-        pptr = array->pptrs[index];
+        pptr = array->pptrs[index & array->index_mask];
         for_each_possible_cpu(cpu) {
                 bpf_long_memcpy(per_cpu_ptr(pptr, cpu), value + off, size);
                 off += size;
@@ -613,6 +644,7 @@ static void *array_of_map_lookup_elem(struct bpf_map *map, void *key)
 static u32 array_of_map_gen_lookup(struct bpf_map *map,
                                    struct bpf_insn *insn_buf)
 {
+        struct bpf_array *array = container_of(map, struct bpf_array, map);
         u32 elem_size = round_up(map->value_size, 8);
         struct bpf_insn *insn = insn_buf;
         const int ret = BPF_REG_0;
@@ -621,7 +653,12 @@ static u32 array_of_map_gen_lookup(struct bpf_map *map,
 
         *insn++ = BPF_ALU64_IMM(BPF_ADD, map_ptr, offsetof(struct bpf_array, value));
         *insn++ = BPF_LDX_MEM(BPF_W, ret, index, 0);
-        *insn++ = BPF_JMP_IMM(BPF_JGE, ret, map->max_entries, 5);
+        if (map->unpriv_array) {
+                *insn++ = BPF_JMP_IMM(BPF_JGE, ret, map->max_entries, 6);
+                *insn++ = BPF_ALU32_IMM(BPF_AND, ret, array->index_mask);
+        } else {
+                *insn++ = BPF_JMP_IMM(BPF_JGE, ret, map->max_entries, 5);
+        }
         if (is_power_of_2(elem_size))
                 *insn++ = BPF_ALU64_IMM(BPF_LSH, ret, ilog2(elem_size));
         else
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index b9f8686a84cf..7949e8b8f94e 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -767,6 +767,7 @@ noinline u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
 }
 EXPORT_SYMBOL_GPL(__bpf_call_base);
 
+#ifndef CONFIG_BPF_JIT_ALWAYS_ON
 /**
  *      __bpf_prog_run - run eBPF program on a given context
  *      @ctx: is the data we are operating on
@@ -955,7 +956,7 @@ select_insn:
                 DST = tmp;
                 CONT;
         ALU_MOD_X:
-                if (unlikely(SRC == 0))
+                if (unlikely((u32)SRC == 0))
                         return 0;
                 tmp = (u32) DST;
                 DST = do_div(tmp, (u32) SRC);
@@ -974,7 +975,7 @@ select_insn:
                 DST = div64_u64(DST, SRC);
                 CONT;
         ALU_DIV_X:
-                if (unlikely(SRC == 0))
+                if (unlikely((u32)SRC == 0))
                         return 0;
                 tmp = (u32) DST;
                 do_div(tmp, (u32) SRC);
@@ -1317,6 +1318,14 @@ EVAL6(PROG_NAME_LIST, 224, 256, 288, 320, 352, 384)
 EVAL4(PROG_NAME_LIST, 416, 448, 480, 512)
 };
 
+#else
+static unsigned int __bpf_prog_ret0(const void *ctx,
+                                    const struct bpf_insn *insn)
+{
+        return 0;
+}
+#endif
+
 bool bpf_prog_array_compatible(struct bpf_array *array,
                                const struct bpf_prog *fp)
 {
@@ -1364,9 +1373,13 @@ static int bpf_check_tail_call(const struct bpf_prog *fp)
  */
 struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err)
 {
+#ifndef CONFIG_BPF_JIT_ALWAYS_ON
         u32 stack_depth = max_t(u32, fp->aux->stack_depth, 1);
 
         fp->bpf_func = interpreters[(round_up(stack_depth, 32) / 32) - 1];
+#else
+        fp->bpf_func = __bpf_prog_ret0;
+#endif
 
         /* eBPF JITs can rewrite the program in case constant
          * blinding is active. However, in case of error during
@@ -1376,6 +1389,12 @@ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err)
          */
         if (!bpf_prog_is_dev_bound(fp->aux)) {
                 fp = bpf_int_jit_compile(fp);
+#ifdef CONFIG_BPF_JIT_ALWAYS_ON
+                if (!fp->jited) {
+                        *err = -ENOTSUPP;
+                        return fp;
+                }
+#endif
         } else {
                 *err = bpf_prog_offload_compile(fp);
                 if (*err)
@@ -1447,7 +1466,8 @@ int bpf_prog_array_length(struct bpf_prog_array __rcu *progs)
         rcu_read_lock();
         prog = rcu_dereference(progs)->progs;
         for (; *prog; prog++)
-                cnt++;
+                if (*prog != &dummy_bpf_prog.prog)
+                        cnt++;
         rcu_read_unlock();
         return cnt;
 }
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index e469e05c8e83..3905d4bc5b80 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -114,6 +114,7 @@ static void htab_free_elems(struct bpf_htab *htab)
                 pptr = htab_elem_get_ptr(get_htab_elem(htab, i),
                                          htab->map.key_size);
                 free_percpu(pptr);
+                cond_resched();
         }
 free_elems:
         bpf_map_area_free(htab->elems);
@@ -159,6 +160,7 @@ static int prealloc_init(struct bpf_htab *htab)
                         goto free_elems;
                 htab_elem_set_ptr(get_htab_elem(htab, i), htab->map.key_size,
                                   pptr);
+                cond_resched();
         }
 
 skip_percpu_elems:
diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
index 01aaef1a77c5..5bb5e49ef4c3 100644
--- a/kernel/bpf/inode.c
+++ b/kernel/bpf/inode.c
@@ -368,7 +368,45 @@ out:
         putname(pname);
         return ret;
 }
-EXPORT_SYMBOL_GPL(bpf_obj_get_user);
+
+static struct bpf_prog *__get_prog_inode(struct inode *inode, enum bpf_prog_type type)
+{
+        struct bpf_prog *prog;
+        int ret = inode_permission(inode, MAY_READ | MAY_WRITE);
+        if (ret)
+                return ERR_PTR(ret);
+
+        if (inode->i_op == &bpf_map_iops)
+                return ERR_PTR(-EINVAL);
+        if (inode->i_op != &bpf_prog_iops)
+                return ERR_PTR(-EACCES);
+
+        prog = inode->i_private;
+
+        ret = security_bpf_prog(prog);
+        if (ret < 0)
+                return ERR_PTR(ret);
+
+        if (!bpf_prog_get_ok(prog, &type, false))
+                return ERR_PTR(-EINVAL);
+
+        return bpf_prog_inc(prog);
+}
+
+struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type type)
+{
+        struct bpf_prog *prog;
+        struct path path;
+        int ret = kern_path(name, LOOKUP_FOLLOW, &path);
+        if (ret)
+                return ERR_PTR(ret);
+        prog = __get_prog_inode(d_backing_inode(path.dentry), type);
+        if (!IS_ERR(prog))
+                touch_atime(&path);
+        path_put(&path);
+        return prog;
+}
+EXPORT_SYMBOL(bpf_prog_get_type_path);
 
 static void bpf_evict_inode(struct inode *inode)
 {
diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
index 68ec884440b7..8455b89d1bbf 100644
--- a/kernel/bpf/offload.c
+++ b/kernel/bpf/offload.c
@@ -1,3 +1,18 @@
+/*
+ * Copyright (C) 2017 Netronome Systems, Inc.
+ *
+ * This software is licensed under the GNU General License Version 2,
+ * June 1991 as shown in the file COPYING in the top-level directory of this
+ * source tree.
+ *
+ * THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS"
+ * WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING,
+ * BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE
+ * OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME
+ * THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+ */
+
 #include <linux/bpf.h>
 #include <linux/bpf_verifier.h>
 #include <linux/bug.h>
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index 5ee2e41893d9..1712d319c2d8 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -591,8 +591,15 @@ static void sock_map_free(struct bpf_map *map)
 
                 write_lock_bh(&sock->sk_callback_lock);
                 psock = smap_psock_sk(sock);
-                smap_list_remove(psock, &stab->sock_map[i]);
-                smap_release_sock(psock, sock);
+                /* This check handles a racing sock event that can get the
+                 * sk_callback_lock before this case but after xchg happens
+                 * causing the refcnt to hit zero and sock user data (psock)
+                 * to be null and queued for garbage collection.
+                 */
+                if (likely(psock)) {
+                        smap_list_remove(psock, &stab->sock_map[i]);
+                        smap_release_sock(psock, sock);
+                }
                 write_unlock_bh(&sock->sk_callback_lock);
         }
         rcu_read_unlock();
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 2c4cfeaa8d5e..5cb783fc8224 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1057,7 +1057,7 @@ struct bpf_prog *bpf_prog_inc_not_zero(struct bpf_prog *prog)
 }
 EXPORT_SYMBOL_GPL(bpf_prog_inc_not_zero);
 
-static bool bpf_prog_get_ok(struct bpf_prog *prog,
+bool bpf_prog_get_ok(struct bpf_prog *prog,
                             enum bpf_prog_type *attach_type, bool attach_drv)
 {
         /* not an attachment, just a refcount inc, always allow */
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index d4593571c404..13551e623501 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -978,6 +978,13 @@ static bool is_pointer_value(struct bpf_verifier_env *env, int regno)
         return __is_pointer_value(env->allow_ptr_leaks, cur_regs(env) + regno);
 }
 
+static bool is_ctx_reg(struct bpf_verifier_env *env, int regno)
+{
+        const struct bpf_reg_state *reg = cur_regs(env) + regno;
+
+        return reg->type == PTR_TO_CTX;
+}
+
 static int check_pkt_ptr_alignment(struct bpf_verifier_env *env,
                                    const struct bpf_reg_state *reg,
                                    int off, int size, bool strict)
@@ -1059,6 +1066,11 @@ static int check_ptr_alignment(struct bpf_verifier_env *env,
                 break;
         case PTR_TO_STACK:
                 pointer_desc = "stack ";
+                /* The stack spill tracking logic in check_stack_write()
+                 * and check_stack_read() relies on stack accesses being
+                 * aligned.
+                 */
+                strict = true;
                 break;
         default:
                 break;
@@ -1067,6 +1079,29 @@ static int check_ptr_alignment(struct bpf_verifier_env *env,
                                            strict);
 }
 
+/* truncate register to smaller size (in bytes)
+ * must be called with size < BPF_REG_SIZE
+ */
+static void coerce_reg_to_size(struct bpf_reg_state *reg, int size)
+{
+        u64 mask;
+
+        /* clear high bits in bit representation */
+        reg->var_off = tnum_cast(reg->var_off, size);
+
+        /* fix arithmetic bounds */
+        mask = ((u64)1 << (size * 8)) - 1;
+        if ((reg->umin_value & ~mask) == (reg->umax_value & ~mask)) {
+                reg->umin_value &= mask;
+                reg->umax_value &= mask;
+        } else {
+                reg->umin_value = 0;
+                reg->umax_value = mask;
+        }
+        reg->smin_value = reg->umin_value;
+        reg->smax_value = reg->umax_value;
+}
+
 /* check whether memory at (regno + off) is accessible for t = (read | write)
  * if t==write, value_regno is a register which value is stored into memory
  * if t==read, value_regno is a register which will receive the value from memory
@@ -1200,9 +1235,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
         if (!err && size < BPF_REG_SIZE && value_regno >= 0 && t == BPF_READ &&
             regs[value_regno].type == SCALAR_VALUE) {
                 /* b/h/w load zero-extends, mark upper bits as known 0 */
-                regs[value_regno].var_off =
-                        tnum_cast(regs[value_regno].var_off, size);
-                __update_reg_bounds(&regs[value_regno]);
+                coerce_reg_to_size(&regs[value_regno], size);
         }
         return err;
 }
@@ -1232,6 +1265,12 @@ static int check_xadd(struct bpf_verifier_env *env, int insn_idx, struct bpf_ins
                 return -EACCES;
         }
 
+        if (is_ctx_reg(env, insn->dst_reg)) {
+                verbose(env, "BPF_XADD stores into R%d context is not allowed\n",
+                        insn->dst_reg);
+                return -EACCES;
+        }
+
         /* check whether atomic_add can read the memory */
         err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
                                BPF_SIZE(insn->code), BPF_READ, -1);
@@ -1282,6 +1321,7 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno,
                 tnum_strn(tn_buf, sizeof(tn_buf), regs[regno].var_off);
                 verbose(env, "invalid variable stack read R%d var_off=%s\n",
                         regno, tn_buf);
+                return -EACCES;
         }
         off = regs[regno].off + regs[regno].var_off.value;
         if (off >= 0 || off < -MAX_BPF_STACK || off + access_size > 0 ||
@@ -1674,7 +1714,13 @@ static int check_call(struct bpf_verifier_env *env, int func_id, int insn_idx)
                 return -EINVAL;
         }
 
+        /* With LD_ABS/IND some JITs save/restore skb from r1. */
         changes_data = bpf_helper_changes_pkt_data(fn->func);
+        if (changes_data && fn->arg1_type != ARG_PTR_TO_CTX) {
+                verbose(env, "kernel subsystem misconfigured func %s#%d: r1 != ctx\n",
+                        func_id_name(func_id), func_id);
+                return -EINVAL;
+        }
 
         memset(&meta, 0, sizeof(meta));
         meta.pkt_access = fn->pkt_access;
@@ -1696,6 +1742,13 @@ static int check_call(struct bpf_verifier_env *env, int func_id, int insn_idx)
         err = check_func_arg(env, BPF_REG_2, fn->arg2_type, &meta);
         if (err)
                 return err;
+        if (func_id == BPF_FUNC_tail_call) {
+                if (meta.map_ptr == NULL) {
+                        verbose(env, "verifier bug\n");
+                        return -EINVAL;
+                }
+                env->insn_aux_data[insn_idx].map_ptr = meta.map_ptr;
+        }
         err = check_func_arg(env, BPF_REG_3, fn->arg3_type, &meta);
         if (err)
                 return err;
@@ -1766,14 +1819,6 @@ static int check_call(struct bpf_verifier_env *env, int func_id, int insn_idx)
         return 0;
 }
 
-static void coerce_reg_to_32(struct bpf_reg_state *reg)
-{
-        /* clear high 32 bits */
-        reg->var_off = tnum_cast(reg->var_off, 4);
-        /* Update bounds */
-        __update_reg_bounds(reg);
-}
-
 static bool signed_add_overflows(s64 a, s64 b)
 {
         /* Do the add in u64, where overflow is well-defined */
@@ -1794,6 +1839,41 @@ static bool signed_sub_overflows(s64 a, s64 b)
         return res > a;
 }
 
+static bool check_reg_sane_offset(struct bpf_verifier_env *env,
+                                  const struct bpf_reg_state *reg,
+                                  enum bpf_reg_type type)
+{
+        bool known = tnum_is_const(reg->var_off);
+        s64 val = reg->var_off.value;
+        s64 smin = reg->smin_value;
+
+        if (known && (val >= BPF_MAX_VAR_OFF || val <= -BPF_MAX_VAR_OFF)) {
+                verbose(env, "math between %s pointer and %lld is not allowed\n",
+                        reg_type_str[type], val);
+                return false;
+        }
+
+        if (reg->off >= BPF_MAX_VAR_OFF || reg->off <= -BPF_MAX_VAR_OFF) {
+                verbose(env, "%s pointer offset %d is not allowed\n",
+                        reg_type_str[type], reg->off);
+                return false;
+        }
+
+        if (smin == S64_MIN) {
+                verbose(env, "math between %s pointer and register with unbounded min value is not allowed\n",
+                        reg_type_str[type]);
+                return false;
+        }
+
+        if (smin >= BPF_MAX_VAR_OFF || smin <= -BPF_MAX_VAR_OFF) {
+                verbose(env, "value %lld makes %s pointer be out of bounds\n",
+                        smin, reg_type_str[type]);
+                return false;
+        }
+
+        return true;
+}
+
 /* Handles arithmetic on a pointer and a scalar: computes new min/max and var_off.
  * Caller should also handle BPF_MOV case separately.
  * If we return -EACCES, caller may want to try again treating pointer as a
@@ -1815,44 +1895,36 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
 
         dst_reg = &regs[dst];
 
-        if (WARN_ON_ONCE(known && (smin_val != smax_val))) {
-                print_verifier_state(env, env->cur_state);
-                verbose(env,
-                        "verifier internal error: known but bad sbounds\n");
-                return -EINVAL;
-        }
-        if (WARN_ON_ONCE(known && (umin_val != umax_val))) {
-                print_verifier_state(env, env->cur_state);
-                verbose(env,
-                        "verifier internal error: known but bad ubounds\n");
-                return -EINVAL;
+        if ((known && (smin_val != smax_val || umin_val != umax_val)) ||
+            smin_val > smax_val || umin_val > umax_val) {
+                /* Taint dst register if offset had invalid bounds derived from
+                 * e.g. dead branches.
+                 */
+                __mark_reg_unknown(dst_reg);
+                return 0;
         }
 
         if (BPF_CLASS(insn->code) != BPF_ALU64) {
                 /* 32-bit ALU ops on pointers produce (meaningless) scalars */
-                if (!env->allow_ptr_leaks)
-                        verbose(env,
-                                "R%d 32-bit pointer arithmetic prohibited\n",
-                                dst);
+                verbose(env,
+                        "R%d 32-bit pointer arithmetic prohibited\n",
+                        dst);
                 return -EACCES;
         }
 
         if (ptr_reg->type == PTR_TO_MAP_VALUE_OR_NULL) {
-                if (!env->allow_ptr_leaks)
-                        verbose(env, "R%d pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL prohibited, null-check it first\n",
-                                dst);
+                verbose(env, "R%d pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL prohibited, null-check it first\n",
+                        dst);
                 return -EACCES;
         }
         if (ptr_reg->type == CONST_PTR_TO_MAP) {
-                if (!env->allow_ptr_leaks)
-                        verbose(env, "R%d pointer arithmetic on CONST_PTR_TO_MAP prohibited\n",
-                                dst);
+                verbose(env, "R%d pointer arithmetic on CONST_PTR_TO_MAP prohibited\n",
+                        dst);
                 return -EACCES;
         }
         if (ptr_reg->type == PTR_TO_PACKET_END) {
-                if (!env->allow_ptr_leaks)
-                        verbose(env, "R%d pointer arithmetic on PTR_TO_PACKET_END prohibited\n",
-                                dst);
+                verbose(env, "R%d pointer arithmetic on PTR_TO_PACKET_END prohibited\n",
+                        dst);
                 return -EACCES;
         }
 
@@ -1862,6 +1934,10 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
         dst_reg->type = ptr_reg->type;
         dst_reg->id = ptr_reg->id;
 
+        if (!check_reg_sane_offset(env, off_reg, ptr_reg->type) ||
+            !check_reg_sane_offset(env, ptr_reg, ptr_reg->type))
+                return -EINVAL;
+
         switch (opcode) {
         case BPF_ADD:
                 /* We can take a fixed offset as long as it doesn't overflow
@@ -1915,9 +1991,8 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
         case BPF_SUB:
                 if (dst_reg == off_reg) {
                         /* scalar -= pointer.  Creates an unknown scalar */
-                        if (!env->allow_ptr_leaks)
-                                verbose(env, "R%d tried to subtract pointer from scalar\n",
-                                        dst);
+                        verbose(env, "R%d tried to subtract pointer from scalar\n",
+                                dst);
                         return -EACCES;
                 }
                 /* We don't allow subtraction from FP, because (according to
@@ -1925,9 +2000,8 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
                  * be able to deal with it.
                  */
                 if (ptr_reg->type == PTR_TO_STACK) {
-                        if (!env->allow_ptr_leaks)
-                                verbose(env, "R%d subtraction from stack pointer prohibited\n",
-                                        dst);
+                        verbose(env, "R%d subtraction from stack pointer prohibited\n",
+                                dst);
                         return -EACCES;
                 }
                 if (known && (ptr_reg->off - smin_val ==
@@ -1976,28 +2050,30 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
         case BPF_AND:
         case BPF_OR:
         case BPF_XOR:
-                /* bitwise ops on pointers are troublesome, prohibit for now.
-                 * (However, in principle we could allow some cases, e.g.
-                 * ptr &= ~3 which would reduce min_value by 3.)
-                 */
-                if (!env->allow_ptr_leaks)
-                        verbose(env, "R%d bitwise operator %s on pointer prohibited\n",
-                                dst, bpf_alu_string[opcode >> 4]);
+                /* bitwise ops on pointers are troublesome, prohibit. */
+                verbose(env, "R%d bitwise operator %s on pointer prohibited\n",
+                        dst, bpf_alu_string[opcode >> 4]);
                 return -EACCES;
         default:
                 /* other operators (e.g. MUL,LSH) produce non-pointer results */
-                if (!env->allow_ptr_leaks)
-                        verbose(env, "R%d pointer arithmetic with %s operator prohibited\n",
-                                dst, bpf_alu_string[opcode >> 4]);
+                verbose(env, "R%d pointer arithmetic with %s operator prohibited\n",
+                        dst, bpf_alu_string[opcode >> 4]);
                 return -EACCES;
         }
 
+        if (!check_reg_sane_offset(env, dst_reg, ptr_reg->type))
+                return -EINVAL;
+
         __update_reg_bounds(dst_reg);
         __reg_deduce_bounds(dst_reg);
         __reg_bound_offset(dst_reg);
         return 0;
 }
 
+/* WARNING: This function does calculations on 64-bit values, but the actual
+ * execution may occur on 32-bit values. Therefore, things like bitshifts
+ * need extra checks in the 32-bit case.
+ */
 static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
                                       struct bpf_insn *insn,
                                       struct bpf_reg_state *dst_reg,
@@ -2008,12 +2084,8 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
         bool src_known, dst_known;
         s64 smin_val, smax_val;
         u64 umin_val, umax_val;
+        u64 insn_bitness = (BPF_CLASS(insn->code) == BPF_ALU64) ? 64 : 32;
 
-        if (BPF_CLASS(insn->code) != BPF_ALU64) {
-                /* 32-bit ALU ops are (32,32)->64 */
-                coerce_reg_to_32(dst_reg);
-                coerce_reg_to_32(&src_reg);
-        }
         smin_val = src_reg.smin_value;
         smax_val = src_reg.smax_value;
         umin_val = src_reg.umin_value;
@@ -2021,6 +2093,21 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
         src_known = tnum_is_const(src_reg.var_off);
         dst_known = tnum_is_const(dst_reg->var_off);
 
+        if ((src_known && (smin_val != smax_val || umin_val != umax_val)) ||
+            smin_val > smax_val || umin_val > umax_val) {
+                /* Taint dst register if offset had invalid bounds derived from
+                 * e.g. dead branches.
+                 */
+                __mark_reg_unknown(dst_reg);
+                return 0;
+        }
+
+        if (!src_known &&
+            opcode != BPF_ADD && opcode != BPF_SUB && opcode != BPF_AND) {
+                __mark_reg_unknown(dst_reg);
+                return 0;
+        }
+
         switch (opcode) {
         case BPF_ADD:
                 if (signed_add_overflows(dst_reg->smin_value, smin_val) ||
@@ -2149,9 +2236,9 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
                 __update_reg_bounds(dst_reg);
                 break;
         case BPF_LSH:
-                if (umax_val > 63) {
-                        /* Shifts greater than 63 are undefined.  This includes
-                         * shifts by a negative number.
+                if (umax_val >= insn_bitness) {
+                        /* Shifts greater than 31 or 63 are undefined.
+                         * This includes shifts by a negative number.
                          */
                         mark_reg_unknown(env, regs, insn->dst_reg);
                         break;
@@ -2177,27 +2264,29 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
                 __update_reg_bounds(dst_reg);
                 break;
         case BPF_RSH:
-                if (umax_val > 63) {
-                        /* Shifts greater than 63 are undefined.  This includes
-                         * shifts by a negative number.
+                if (umax_val >= insn_bitness) {
+                        /* Shifts greater than 31 or 63 are undefined.
+                         * This includes shifts by a negative number.
                          */
                         mark_reg_unknown(env, regs, insn->dst_reg);
                         break;
                 }
-                /* BPF_RSH is an unsigned shift, so make the appropriate casts */
-                if (dst_reg->smin_value < 0) {
-                        if (umin_val) {
-                                /* Sign bit will be cleared */
-                                dst_reg->smin_value = 0;
-                        } else {
-                                /* Lost sign bit information */
-                                dst_reg->smin_value = S64_MIN;
-                                dst_reg->smax_value = S64_MAX;
-                        }
-                } else {
-                        dst_reg->smin_value =
-                                (u64)(dst_reg->smin_value) >> umax_val;
-                }
+                /* BPF_RSH is an unsigned shift.  If the value in dst_reg might
+                 * be negative, then either:
+                 * 1) src_reg might be zero, so the sign bit of the result is
+                 *    unknown, so we lose our signed bounds
+                 * 2) it's known negative, thus the unsigned bounds capture the
+                 *    signed bounds
+                 * 3) the signed bounds cross zero, so they tell us nothing
+                 *    about the result
+                 * If the value in dst_reg is known nonnegative, then again the
+                 * unsigned bounts capture the signed bounds.
+                 * Thus, in all cases it suffices to blow away our signed bounds
+                 * and rely on inferring new ones from the unsigned bounds and
+                 * var_off of the result.
+                 */
+                dst_reg->smin_value = S64_MIN;
+                dst_reg->smax_value = S64_MAX;
                 if (src_known)
                         dst_reg->var_off = tnum_rshift(dst_reg->var_off,
                                                        umin_val);
@@ -2213,6 +2302,12 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
                 break;
         }
 
+        if (BPF_CLASS(insn->code) != BPF_ALU64) {
+                /* 32-bit ALU ops are (32,32)->32 */
+                coerce_reg_to_size(dst_reg, 4);
+                coerce_reg_to_size(&src_reg, 4);
+        }
+
         __reg_deduce_bounds(dst_reg);
         __reg_bound_offset(dst_reg);
         return 0;
@@ -2227,7 +2322,6 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
         struct bpf_reg_state *regs = cur_regs(env), *dst_reg, *src_reg;
         struct bpf_reg_state *ptr_reg = NULL, off_reg = {0};
         u8 opcode = BPF_OP(insn->code);
-        int rc;
 
         dst_reg = &regs[insn->dst_reg];
         src_reg = NULL;
@@ -2238,43 +2332,29 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                 if (src_reg->type != SCALAR_VALUE) {
                         if (dst_reg->type != SCALAR_VALUE) {
                                 /* Combining two pointers by any ALU op yields
-                                 * an arbitrary scalar.
+                                 * an arbitrary scalar. Disallow all math except
+                                 * pointer subtraction
                                  */
-                                if (!env->allow_ptr_leaks) {
-                                        verbose(env, "R%d pointer %s pointer prohibited\n",
-                                                insn->dst_reg,
-                                                bpf_alu_string[opcode >> 4]);
-                                        return -EACCES;
+                                if (opcode == BPF_SUB){
+                                        mark_reg_unknown(env, regs, insn->dst_reg);
+                                        return 0;
                                 }
-                                mark_reg_unknown(env, regs, insn->dst_reg);
-                                return 0;
+                                verbose(env, "R%d pointer %s pointer prohibited\n",
+                                        insn->dst_reg,
+                                        bpf_alu_string[opcode >> 4]);
+                                return -EACCES;
                         } else {
                                 /* scalar += pointer
                                  * This is legal, but we have to reverse our
                                  * src/dest handling in computing the range
                                  */
-                                rc = adjust_ptr_min_max_vals(env, insn,
-                                                             src_reg, dst_reg);
-                                if (rc == -EACCES && env->allow_ptr_leaks) {
-                                        /* scalar += unknown scalar */
-                                        __mark_reg_unknown(&off_reg);
-                                        return adjust_scalar_min_max_vals(
-                                                        env, insn,
-                                                        dst_reg, off_reg);
-                                }
-                                return rc;
+                                return adjust_ptr_min_max_vals(env, insn,
+                                                               src_reg, dst_reg);
                         }
                 } else if (ptr_reg) {
                         /* pointer += scalar */
-                        rc = adjust_ptr_min_max_vals(env, insn,
-                                                     dst_reg, src_reg);
-                        if (rc == -EACCES && env->allow_ptr_leaks) {
-                                /* unknown scalar += scalar */
-                                __mark_reg_unknown(dst_reg);
-                                return adjust_scalar_min_max_vals(
-                                                env, insn, dst_reg, *src_reg);
-                        }
-                        return rc;
+                        return adjust_ptr_min_max_vals(env, insn,
+                                                       dst_reg, src_reg);
                 }
         } else {
                 /* Pretend the src is a reg with a known value, since we only
@@ -2283,17 +2363,9 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                 off_reg.type = SCALAR_VALUE;
                 __mark_reg_known(&off_reg, insn->imm);
                 src_reg = &off_reg;
-                if (ptr_reg) { /* pointer += K */
-                        rc = adjust_ptr_min_max_vals(env, insn,
-                                                     ptr_reg, src_reg);
-                        if (rc == -EACCES && env->allow_ptr_leaks) {
-                                /* unknown scalar += K */
-                                __mark_reg_unknown(dst_reg);
-                                return adjust_scalar_min_max_vals(
-                                                env, insn, dst_reg, off_reg);
-                        }
-                        return rc;
-                }
+                if (ptr_reg) /* pointer += K */
+                        return adjust_ptr_min_max_vals(env, insn,
+                                                       ptr_reg, src_reg);
         }
 
         /* Got here implies adding two SCALAR_VALUEs */
@@ -2390,17 +2462,20 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
                                         return -EACCES;
                                 }
                                 mark_reg_unknown(env, regs, insn->dst_reg);
-                                /* high 32 bits are known zero. */
-                                regs[insn->dst_reg].var_off = tnum_cast(
-                                                regs[insn->dst_reg].var_off, 4);
-                                __update_reg_bounds(&regs[insn->dst_reg]);
+                                coerce_reg_to_size(&regs[insn->dst_reg], 4);
                         }
                 } else {
                         /* case: R = imm
                          * remember the value we stored into this reg
                          */
                         regs[insn->dst_reg].type = SCALAR_VALUE;
-                        __mark_reg_known(regs + insn->dst_reg, insn->imm);
+                        if (BPF_CLASS(insn->code) == BPF_ALU64) {
+                                __mark_reg_known(regs + insn->dst_reg,
+                                                 insn->imm);
+                        } else {
+                                __mark_reg_known(regs + insn->dst_reg,
+                                                 (u32)insn->imm);
+                        }
                 }
 
         } else if (opcode > BPF_END) {
@@ -2436,6 +2511,11 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
                         return -EINVAL;
                 }
 
+                if (opcode == BPF_ARSH && BPF_CLASS(insn->code) != BPF_ALU64) {
+                        verbose(env, "BPF_ARSH not supported for 32 bit ALU\n");
+                        return -EINVAL;
+                }
+
                 if ((opcode == BPF_LSH || opcode == BPF_RSH ||
                      opcode == BPF_ARSH) && BPF_SRC(insn->code) == BPF_K) {
                         int size = BPF_CLASS(insn->code) == BPF_ALU64 ? 64 : 32;
@@ -3431,15 +3511,14 @@ static bool regsafe(struct bpf_reg_state *rold, struct bpf_reg_state *rcur,
                         return range_within(rold, rcur) &&
                                tnum_in(rold->var_off, rcur->var_off);
                 } else {
-                        /* if we knew anything about the old value, we're not
-                         * equal, because we can't know anything about the
-                         * scalar value of the pointer in the new value.
+                        /* We're trying to use a pointer in place of a scalar.
+                         * Even if the scalar was unbounded, this could lead to
+                         * pointer leaks because scalars are allowed to leak
+                         * while pointers are not. We could make this safe in
+                         * special cases if root is calling us, but it's
+                         * probably not worth the hassle.
                          */
-                        return rold->umin_value == 0 &&
-                               rold->umax_value == U64_MAX &&
-                               rold->smin_value == S64_MIN &&
-                               rold->smax_value == S64_MAX &&
-                               tnum_is_unknown(rold->var_off);
+                        return false;
                 }
         case PTR_TO_MAP_VALUE:
                 /* If the new min/max/var_off satisfy the old ones and
@@ -3932,6 +4011,12 @@ static int do_check(struct bpf_verifier_env *env)
                         if (err)
                                 return err;
 
+                        if (is_ctx_reg(env, insn->dst_reg)) {
+                                verbose(env, "BPF_ST stores into R%d context is not allowed\n",
+                                        insn->dst_reg);
+                                return -EACCES;
+                        }
+
                         /* check that memory (dst_reg + off) is writeable */
                         err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
                                                BPF_SIZE(insn->code), BPF_WRITE,
@@ -4384,6 +4469,24 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
         int i, cnt, delta = 0;
 
         for (i = 0; i < insn_cnt; i++, insn++) {
+                if (insn->code == (BPF_ALU | BPF_MOD | BPF_X) ||
+                    insn->code == (BPF_ALU | BPF_DIV | BPF_X)) {
+                        /* due to JIT bugs clear upper 32-bits of src register
+                         * before div/mod operation
+                         */
+                        insn_buf[0] = BPF_MOV32_REG(insn->src_reg, insn->src_reg);
+                        insn_buf[1] = *insn;
+                        cnt = 2;
+                        new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
+                        if (!new_prog)
+                                return -ENOMEM;
+
+                        delta    += cnt - 1;
+                        env->prog = prog = new_prog;
+                        insn      = new_prog->insnsi + i + delta;
+                        continue;
+                }
+
                 if (insn->code != (BPF_JMP | BPF_CALL))
                         continue;
 
@@ -4407,6 +4510,35 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
                          */
                         insn->imm = 0;
                         insn->code = BPF_JMP | BPF_TAIL_CALL;
+
+                        /* instead of changing every JIT dealing with tail_call
+                         * emit two extra insns:
+                         * if (index >= max_entries) goto out;
+                         * index &= array->index_mask;
+                         * to avoid out-of-bounds cpu speculation
+                         */
+                        map_ptr = env->insn_aux_data[i + delta].map_ptr;
+                        if (map_ptr == BPF_MAP_PTR_POISON) {
+                                verbose(env, "tail_call abusing map_ptr\n");
+                                return -EINVAL;
+                        }
+                        if (!map_ptr->unpriv_array)
+                                continue;
+                        insn_buf[0] = BPF_JMP_IMM(BPF_JGE, BPF_REG_3,
+                                                  map_ptr->max_entries, 2);
+                        insn_buf[1] = BPF_ALU32_IMM(BPF_AND, BPF_REG_3,
+                                                    container_of(map_ptr,
+                                                                 struct bpf_array,
+                                                                 map)->index_mask);
+                        insn_buf[2] = *insn;
+                        cnt = 3;
+                        new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
+                        if (!new_prog)
+                                return -ENOMEM;
+
+                        delta    += cnt - 1;
+                        env->prog = prog = new_prog;
+                        insn      = new_prog->insnsi + i + delta;
                         continue;
                 }
 
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index 024085daab1a..a2c05d2476ac 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -123,7 +123,11 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)
          */
         do {
                 css_task_iter_start(&from->self, 0, &it);
-                task = css_task_iter_next(&it);
+
+                do {
+                        task = css_task_iter_next(&it);
+                } while (task && (task->flags & PF_EXITING));
+
                 if (task)
                         get_task_struct(task);
                 css_task_iter_end(&it);
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 0b1ffe147f24..7e4c44538119 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -1397,7 +1397,7 @@ static char *cgroup_file_name(struct cgroup *cgrp, const struct cftype *cft,
                          cgroup_on_dfl(cgrp) ? ss->name : ss->legacy_name,
                          cft->name);
         else
-                strncpy(buf, cft->name, CGROUP_FILE_NAME_MAX);
+                strlcpy(buf, cft->name, CGROUP_FILE_NAME_MAX);
         return buf;
 }
 
@@ -1864,9 +1864,9 @@ void init_cgroup_root(struct cgroup_root *root, struct cgroup_sb_opts *opts)
 
         root->flags = opts->flags;
         if (opts->release_agent)
-                strcpy(root->release_agent_path, opts->release_agent);
+                strlcpy(root->release_agent_path, opts->release_agent, PATH_MAX);
         if (opts->name)
-                strcpy(root->name, opts->name);
+                strlcpy(root->name, opts->name, MAX_CGROUP_ROOT_NAMELEN);
         if (opts->cpuset_clone_children)
                 set_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->cgrp.flags);
 }
@@ -4125,26 +4125,24 @@ static void css_task_iter_advance_css_set(struct css_task_iter *it)
 
 static void css_task_iter_advance(struct css_task_iter *it)
 {
-        struct list_head *l = it->task_pos;
+        struct list_head *next;
 
         lockdep_assert_held(&css_set_lock);
-        WARN_ON_ONCE(!l);
-
 repeat:
         /*
          * Advance iterator to find next entry.  cset->tasks is consumed
          * first and then ->mg_tasks.  After ->mg_tasks, we move onto the
          * next cset.
          */
-        l = l->next;
+        next = it->task_pos->next;
 
-        if (l == it->tasks_head)
-                l = it->mg_tasks_head->next;
+        if (next == it->tasks_head)
+                next = it->mg_tasks_head->next;
 
-        if (l == it->mg_tasks_head)
+        if (next == it->mg_tasks_head)
                 css_task_iter_advance_css_set(it);
         else
-                it->task_pos = l;
+                it->task_pos = next;
 
         /* if PROCS, skip over tasks which aren't group leaders */
         if ((it->flags & CSS_TASK_ITER_PROCS) && it->task_pos &&
@@ -4449,6 +4447,7 @@ static struct cftype cgroup_base_files[] = {
         },
         {
                 .name = "cgroup.threads",
+                .flags = CFTYPE_NS_DELEGATABLE,
                 .release = cgroup_procs_release,
                 .seq_start = cgroup_threads_start,
                 .seq_next = cgroup_procs_next,
diff --git a/kernel/cgroup/debug.c b/kernel/cgroup/debug.c
index 5f780d8f6a9d..9caeda610249 100644
--- a/kernel/cgroup/debug.c
+++ b/kernel/cgroup/debug.c
@@ -50,7 +50,7 @@ static int current_css_set_read(struct seq_file *seq, void *v)
 
         spin_lock_irq(&css_set_lock);
         rcu_read_lock();
-        cset = rcu_dereference(current->cgroups);
+        cset = task_css_set(current);
         refcnt = refcount_read(&cset->refcount);
         seq_printf(seq, "css_set %pK %d", cset, refcnt);
         if (refcnt > cset->nr_tasks)
@@ -96,7 +96,7 @@ static int current_css_set_cg_links_read(struct seq_file *seq, void *v)
 
         spin_lock_irq(&css_set_lock);
         rcu_read_lock();
-        cset = rcu_dereference(current->cgroups);
+        cset = task_css_set(current);
         list_for_each_entry(link, &cset->cgrp_links, cgrp_link) {
                 struct cgroup *c = link->cgrp;
 
diff --git a/kernel/cgroup/stat.c b/kernel/cgroup/stat.c
index 133b465691d6..1e111dd455c4 100644
--- a/kernel/cgroup/stat.c
+++ b/kernel/cgroup/stat.c
@@ -296,8 +296,12 @@ int cgroup_stat_init(struct cgroup *cgrp)
         }
 
         /* ->updated_children list is self terminated */
-        for_each_possible_cpu(cpu)
-                cgroup_cpu_stat(cgrp, cpu)->updated_children = cgrp;
+        for_each_possible_cpu(cpu) {
+                struct cgroup_cpu_stat *cstat = cgroup_cpu_stat(cgrp, cpu);
+
+                cstat->updated_children = cgrp;
+                u64_stats_init(&cstat->sync);
+        }
 
         prev_cputime_init(&cgrp->stat.prev_cputime);
 
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 04892a82f6ac..53f7dc65f9a3 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -80,19 +80,19 @@ static struct lockdep_map cpuhp_state_down_map =
         STATIC_LOCKDEP_MAP_INIT("cpuhp_state-down", &cpuhp_state_down_map);
 
 
-static void inline cpuhp_lock_acquire(bool bringup)
+static inline void cpuhp_lock_acquire(bool bringup)
 {
         lock_map_acquire(bringup ? &cpuhp_state_up_map : &cpuhp_state_down_map);
 }
 
-static void inline cpuhp_lock_release(bool bringup)
+static inline void cpuhp_lock_release(bool bringup)
 {
         lock_map_release(bringup ? &cpuhp_state_up_map : &cpuhp_state_down_map);
 }
 #else
 
-static void inline cpuhp_lock_acquire(bool bringup) { }
-static void inline cpuhp_lock_release(bool bringup) { }
+static inline void cpuhp_lock_acquire(bool bringup) { }
+static inline void cpuhp_lock_release(bool bringup) { }
 
 #endif
 
@@ -780,8 +780,8 @@ static int takedown_cpu(unsigned int cpu)
         BUG_ON(cpu_online(cpu));
 
         /*
-         * The CPUHP_AP_SCHED_MIGRATE_DYING callback will have removed all
-         * runnable tasks from the cpu, there's only the idle task left now
+         * The teardown callback for CPUHP_AP_SCHED_STARTING will have removed
+         * all runnable tasks from the CPU, there's only the idle task left now
          * that the migration thread is done doing the stop_machine thing.
          *
          * Wait for the stop thread to go away.
@@ -1277,9 +1277,9 @@ static struct cpuhp_step cpuhp_bp_states[] = {
          * before blk_mq_queue_reinit_notify() from notify_dead(),
          * otherwise a RCU stall occurs.
          */
-        [CPUHP_TIMERS_DEAD] = {
+        [CPUHP_TIMERS_PREPARE] = {
                 .name                   = "timers:dead",
-                .startup.single         = NULL,
+                .startup.single         = timers_prepare_cpu,
                 .teardown.single        = timers_dead_cpu,
         },
         /* Kicks the plugged cpu into life */
@@ -1289,11 +1289,6 @@ static struct cpuhp_step cpuhp_bp_states[] = {
                 .teardown.single        = NULL,
                 .cant_stop              = true,
         },
-        [CPUHP_AP_SMPCFD_DYING] = {
-                .name                   = "smpcfd:dying",
-                .startup.single         = NULL,
-                .teardown.single        = smpcfd_dying_cpu,
-        },
         /*
          * Handled on controll processor until the plugged processor manages
          * this itself.
@@ -1335,6 +1330,11 @@ static struct cpuhp_step cpuhp_ap_states[] = {
                 .startup.single         = NULL,
                 .teardown.single        = rcutree_dying_cpu,
         },
+        [CPUHP_AP_SMPCFD_DYING] = {
+                .name                   = "smpcfd:dying",
+                .startup.single         = NULL,
+                .teardown.single        = smpcfd_dying_cpu,
+        },
         /* Entry state on starting. Interrupts enabled from here on. Transient
          * state for synchronsization */
         [CPUHP_AP_ONLINE] = {
diff --git a/kernel/crash_core.c b/kernel/crash_core.c
index b3663896278e..4f63597c824d 100644
--- a/kernel/crash_core.c
+++ b/kernel/crash_core.c
@@ -410,7 +410,7 @@ static int __init crash_save_vmcoreinfo_init(void)
         VMCOREINFO_SYMBOL(contig_page_data);
 #endif
 #ifdef CONFIG_SPARSEMEM
-        VMCOREINFO_SYMBOL(mem_section);
+        VMCOREINFO_SYMBOL_ARRAY(mem_section);
         VMCOREINFO_LENGTH(mem_section, NR_SECTION_ROOTS);
         VMCOREINFO_STRUCT_SIZE(mem_section);
         VMCOREINFO_OFFSET(mem_section, section_mem_map);
diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
index e74be38245ad..ed5d34925ad0 100644
--- a/kernel/debug/kdb/kdb_io.c
+++ b/kernel/debug/kdb/kdb_io.c
@@ -350,7 +350,7 @@ poll_again:
                         }
                         kdb_printf("\n");
                         for (i = 0; i < count; i++) {
-                                if (kallsyms_symbol_next(p_tmp, i) < 0)
+                                if (WARN_ON(!kallsyms_symbol_next(p_tmp, i)))
                                         break;
                                 kdb_printf("%s ", p_tmp);
                                 *(p_tmp + len) = '\0';
diff --git a/kernel/delayacct.c b/kernel/delayacct.c
index 4a1c33416b6a..e2764d767f18 100644
--- a/kernel/delayacct.c
+++ b/kernel/delayacct.c
@@ -51,16 +51,16 @@ void __delayacct_tsk_init(struct task_struct *tsk)
  * Finish delay accounting for a statistic using its timestamps (@start),
  * accumalator (@total) and @count
  */
-static void delayacct_end(u64 *start, u64 *total, u32 *count)
+static void delayacct_end(spinlock_t *lock, u64 *start, u64 *total, u32 *count)
 {
         s64 ns = ktime_get_ns() - *start;
         unsigned long flags;
 
         if (ns > 0) {
-                spin_lock_irqsave(&current->delays->lock, flags);
+                spin_lock_irqsave(lock, flags);
                 *total += ns;
                 (*count)++;
-                spin_unlock_irqrestore(&current->delays->lock, flags);
+                spin_unlock_irqrestore(lock, flags);
         }
 }
 
@@ -69,17 +69,25 @@ void __delayacct_blkio_start(void)
         current->delays->blkio_start = ktime_get_ns();
 }
 
-void __delayacct_blkio_end(void)
+/*
+ * We cannot rely on the `current` macro, as we haven't yet switched back to
+ * the process being woken.
+ */
+void __delayacct_blkio_end(struct task_struct *p)
 {
-        if (current->delays->flags & DELAYACCT_PF_SWAPIN)
-                /* Swapin block I/O */
-                delayacct_end(&current->delays->blkio_start,
-                        &current->delays->swapin_delay,
-                        &current->delays->swapin_count);
-        else    /* Other block I/O */
-                delayacct_end(&current->delays->blkio_start,
-                        &current->delays->blkio_delay,
-                        &current->delays->blkio_count);
+        struct task_delay_info *delays = p->delays;
+        u64 *total;
+        u32 *count;
+
+        if (p->delays->flags & DELAYACCT_PF_SWAPIN) {
+                total = &delays->swapin_delay;
+                count = &delays->swapin_count;
+        } else {
+                total = &delays->blkio_delay;
+                count = &delays->blkio_count;
+        }
+
+        delayacct_end(&delays->lock, &delays->blkio_start, total, count);
 }
 
 int __delayacct_add_tsk(struct taskstats *d, struct task_struct *tsk)
@@ -153,8 +161,10 @@ void __delayacct_freepages_start(void)
 
 void __delayacct_freepages_end(void)
 {
-        delayacct_end(&current->delays->freepages_start,
-                        &current->delays->freepages_delay,
-                        &current->delays->freepages_count);
+        delayacct_end(
+                &current->delays->lock,
+                &current->delays->freepages_start,
+                &current->delays->freepages_delay,
+                &current->delays->freepages_count);
 }
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 16beab4767e1..5d8f4031f8d5 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1231,6 +1231,10 @@ static void put_ctx(struct perf_event_context *ctx)
  *            perf_event_context::lock
  *          perf_event::mmap_mutex
  *          mmap_sem
+ *
+ *    cpu_hotplug_lock
+ *      pmus_lock
+ *        cpuctx->mutex / perf_event_context::mutex
  */
 static struct perf_event_context *
 perf_event_ctx_lock_nested(struct perf_event *event, int nesting)
@@ -4196,6 +4200,7 @@ int perf_event_release_kernel(struct perf_event *event)
 {
         struct perf_event_context *ctx = event->ctx;
         struct perf_event *child, *tmp;
+        LIST_HEAD(free_list);
 
         /*
          * If we got here through err_file: fput(event_file); we will not have
@@ -4268,8 +4273,7 @@ again:
                                                struct perf_event, child_list);
                 if (tmp == child) {
                         perf_remove_from_context(child, DETACH_GROUP);
-                        list_del(&child->child_list);
-                        free_event(child);
+                        list_move(&child->child_list, &free_list);
                         /*
                          * This matches the refcount bump in inherit_event();
                          * this can't be the last reference.
@@ -4284,6 +4288,11 @@ again:
         }
         mutex_unlock(&event->child_mutex);
 
+        list_for_each_entry_safe(child, tmp, &free_list, child_list) {
+                list_del(&child->child_list);
+                free_event(child);
+        }
+
 no_ctx:
         put_event(event); /* Must be the 'last' reference */
         return 0;
@@ -6639,6 +6648,7 @@ static void perf_event_namespaces_output(struct perf_event *event,
         struct perf_namespaces_event *namespaces_event = data;
         struct perf_output_handle handle;
         struct perf_sample_data sample;
+        u16 header_size = namespaces_event->event_id.header.size;
         int ret;
 
         if (!perf_event_namespaces_match(event))
@@ -6649,7 +6659,7 @@ static void perf_event_namespaces_output(struct perf_event *event,
         ret = perf_output_begin(&handle, event,
                                 namespaces_event->event_id.header.size);
         if (ret)
-                return;
+                goto out;
 
         namespaces_event->event_id.pid = perf_event_pid(event,
                                                         namespaces_event->task);
@@ -6661,6 +6671,8 @@ static void perf_event_namespaces_output(struct perf_event *event,
         perf_event__output_id_sample(event, &handle, &sample);
 
         perf_output_end(&handle);
+out:
+        namespaces_event->event_id.header.size = header_size;
 }
 
 static void perf_fill_ns_link_info(struct perf_ns_link_info *ns_link_info,
@@ -7987,11 +7999,11 @@ static void bpf_overflow_handler(struct perf_event *event,
 {
         struct bpf_perf_event_data_kern ctx = {
                 .data = data,
-                .regs = regs,
                 .event = event,
         };
         int ret = 0;
 
+        ctx.regs = perf_arch_bpf_user_pt_regs(regs);
         preempt_disable();
         if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1))
                 goto out;
@@ -8513,6 +8525,29 @@ fail_clear_files:
         return ret;
 }
 
+static int
+perf_tracepoint_set_filter(struct perf_event *event, char *filter_str)
+{
+        struct perf_event_context *ctx = event->ctx;
+        int ret;
+
+        /*
+         * Beware, here be dragons!!
+         *
+         * the tracepoint muck will deadlock against ctx->mutex, but the tracepoint
+         * stuff does not actually need it. So temporarily drop ctx->mutex. As per
+         * perf_event_ctx_lock() we already have a reference on ctx.
+         *
+         * This can result in event getting moved to a different ctx, but that
+         * does not affect the tracepoint state.
+         */
+        mutex_unlock(&ctx->mutex);
+        ret = ftrace_profile_set_filter(event, event->attr.config, filter_str);
+        mutex_lock(&ctx->mutex);
+
+        return ret;
+}
+
 static int perf_event_set_filter(struct perf_event *event, void __user *arg)
 {
         char *filter_str;
@@ -8529,8 +8564,7 @@ static int perf_event_set_filter(struct perf_event *event, void __user *arg)
 
         if (IS_ENABLED(CONFIG_EVENT_TRACING) &&
             event->attr.type == PERF_TYPE_TRACEPOINT)
-                ret = ftrace_profile_set_filter(event, event->attr.config,
-                                                filter_str);
+                ret = perf_tracepoint_set_filter(event, filter_str);
         else if (has_addr_filter(event))
                 ret = perf_event_set_addr_filter(event, filter_str);
 
@@ -9165,7 +9199,13 @@ static int perf_try_init_event(struct pmu *pmu, struct perf_event *event)
         if (!try_module_get(pmu->module))
                 return -ENODEV;
 
-        if (event->group_leader != event) {
+        /*
+         * A number of pmu->event_init() methods iterate the sibling_list to,
+         * for example, validate if the group fits on the PMU. Therefore,
+         * if this is a sibling event, acquire the ctx->mutex to protect
+         * the sibling_list.
+         */
+        if (event->group_leader != event && pmu->task_ctx_nr != perf_sw_context) {
                 /*
                  * This ctx->mutex can nest when we're called through
                  * inheritance. See the perf_event_ctx_lock_nested() comment.
diff --git a/kernel/exit.c b/kernel/exit.c
index 6b4298a41167..995453d9fb55 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1755,3 +1755,12 @@ Efault:
         return -EFAULT;
 }
 #endif
+
+__weak void abort(void)
+{
+        BUG();
+
+        /* if that doesn't kill us, halt */
+        panic("Oops failed to kill thread");
+}
+EXPORT_SYMBOL(abort);
diff --git a/kernel/fork.c b/kernel/fork.c
index 432eadf6b58c..2295fc69717f 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -721,8 +721,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm,
                         goto out;
         }
         /* a new mm has just been created */
-        arch_dup_mmap(oldmm, mm);
-        retval = 0;
+        retval = arch_dup_mmap(oldmm, mm);
 out:
         up_write(&mm->mmap_sem);
         flush_tlb_mm(oldmm);
diff --git a/kernel/futex.c b/kernel/futex.c
index 76ed5921117a..7f719d110908 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1582,8 +1582,8 @@ static int futex_atomic_op_inuser(unsigned int encoded_op, u32 __user *uaddr)
 {
         unsigned int op =         (encoded_op & 0x70000000) >> 28;
         unsigned int cmp =        (encoded_op & 0x0f000000) >> 24;
-        int oparg = sign_extend32((encoded_op & 0x00fff000) >> 12, 12);
-        int cmparg = sign_extend32(encoded_op & 0x00000fff, 12);
+        int oparg = sign_extend32((encoded_op & 0x00fff000) >> 12, 11);
+        int cmparg = sign_extend32(encoded_op & 0x00000fff, 11);
         int oldval, ret;
 
         if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28)) {
@@ -1878,6 +1878,9 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
         struct futex_q *this, *next;
         DEFINE_WAKE_Q(wake_q);
 
+        if (nr_wake < 0 || nr_requeue < 0)
+                return -EINVAL;
+
         /*
          * When PI not supported: return -ENOSYS if requeue_pi is true,
          * consequently the compiler knows requeue_pi is always false past
@@ -2294,34 +2297,33 @@ static void unqueue_me_pi(struct futex_q *q)
         spin_unlock(q->lock_ptr);
 }
 
-/*
- * Fixup the pi_state owner with the new owner.
- *
- * Must be called with hash bucket lock held and mm->sem held for non
- * private futexes.
- */
 static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
-                                struct task_struct *newowner)
+                                struct task_struct *argowner)
 {
-        u32 newtid = task_pid_vnr(newowner) | FUTEX_WAITERS;
         struct futex_pi_state *pi_state = q->pi_state;
         u32 uval, uninitialized_var(curval), newval;
-        struct task_struct *oldowner;
+        struct task_struct *oldowner, *newowner;
+        u32 newtid;
         int ret;
 
+        lockdep_assert_held(q->lock_ptr);
+
         raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
 
         oldowner = pi_state->owner;
-        /* Owner died? */
-        if (!pi_state->owner)
-                newtid |= FUTEX_OWNER_DIED;
 
         /*
-         * We are here either because we stole the rtmutex from the
-         * previous highest priority waiter or we are the highest priority
-         * waiter but have failed to get the rtmutex the first time.
+         * We are here because either:
+         *
+         *  - we stole the lock and pi_state->owner needs updating to reflect
+         *    that (@argowner == current),
+         *
+         * or:
          *
-         * We have to replace the newowner TID in the user space variable.
+         *  - someone stole our lock and we need to fix things to point to the
+         *    new owner (@argowner == NULL).
+         *
+         * Either way, we have to replace the TID in the user space variable.
          * This must be atomic as we have to preserve the owner died bit here.
          *
          * Note: We write the user space value _before_ changing the pi_state
@@ -2334,6 +2336,45 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
          * in the PID check in lookup_pi_state.
          */
 retry:
+        if (!argowner) {
+                if (oldowner != current) {
+                        /*
+                         * We raced against a concurrent self; things are
+                         * already fixed up. Nothing to do.
+                         */
+                        ret = 0;
+                        goto out_unlock;
+                }
+
+                if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) {
+                        /* We got the lock after all, nothing to fix. */
+                        ret = 0;
+                        goto out_unlock;
+                }
+
+                /*
+                 * Since we just failed the trylock; there must be an owner.
+                 */
+                newowner = rt_mutex_owner(&pi_state->pi_mutex);
+                BUG_ON(!newowner);
+        } else {
+                WARN_ON_ONCE(argowner != current);
+                if (oldowner == current) {
+                        /*
+                         * We raced against a concurrent self; things are
+                         * already fixed up. Nothing to do.
+                         */
+                        ret = 0;
+                        goto out_unlock;
+                }
+                newowner = argowner;
+        }
+
+        newtid = task_pid_vnr(newowner) | FUTEX_WAITERS;
+        /* Owner died? */
+        if (!pi_state->owner)
+                newtid |= FUTEX_OWNER_DIED;
+
         if (get_futex_value_locked(&uval, uaddr))
                 goto handle_fault;
 
@@ -2434,9 +2475,9 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
                  * Got the lock. We might not be the anticipated owner if we
                  * did a lock-steal - fix up the PI-state in that case:
                  *
-                 * We can safely read pi_state->owner without holding wait_lock
-                 * because we now own the rt_mutex, only the owner will attempt
-                 * to change it.
+                 * Speculative pi_state->owner read (we don't hold wait_lock);
+                 * since we own the lock pi_state->owner == current is the
+                 * stable state, anything else needs more attention.
                  */
                 if (q->pi_state->owner != current)
                         ret = fixup_pi_state_owner(uaddr, q, current);
@@ -2444,6 +2485,19 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
         }
 
         /*
+         * If we didn't get the lock; check if anybody stole it from us. In
+         * that case, we need to fix up the uval to point to them instead of
+         * us, otherwise bad things happen. [10]
+         *
+         * Another speculative read; pi_state->owner == current is unstable
+         * but needs our attention.
+         */
+        if (q->pi_state->owner == current) {
+                ret = fixup_pi_state_owner(uaddr, q, NULL);
+                goto out;
+        }
+
+        /*
          * Paranoia check. If we did not take the lock, then we should not be
          * the owner of the rt_mutex.
          */
diff --git a/kernel/groups.c b/kernel/groups.c
index e357bc800111..daae2f2dc6d4 100644
--- a/kernel/groups.c
+++ b/kernel/groups.c
@@ -86,11 +86,12 @@ static int gid_cmp(const void *_a, const void *_b)
         return gid_gt(a, b) - gid_lt(a, b);
 }
 
-static void groups_sort(struct group_info *group_info)
+void groups_sort(struct group_info *group_info)
 {
         sort(group_info->gid, group_info->ngroups, sizeof(*group_info->gid),
              gid_cmp, NULL);
 }
+EXPORT_SYMBOL(groups_sort);
 
 /* a simple bsearch */
 int groups_search(const struct group_info *group_info, kgid_t grp)
@@ -122,7 +123,6 @@ int groups_search(const struct group_info *group_info, kgid_t grp)
 void set_groups(struct cred *new, struct group_info *group_info)
 {
         put_group_info(new->group_info);
-        groups_sort(group_info);
         get_group_info(group_info);
         new->group_info = group_info;
 }
@@ -206,6 +206,7 @@ SYSCALL_DEFINE2(setgroups, int, gidsetsize, gid_t __user *, grouplist)
                 return retval;
         }
 
+        groups_sort(group_info);
         retval = set_current_groups(group_info);
         put_group_info(group_info);
 
diff --git a/kernel/irq/debug.h b/kernel/irq/debug.h
index 17f05ef8f575..e4d3819a91cc 100644
--- a/kernel/irq/debug.h
+++ b/kernel/irq/debug.h
@@ -12,6 +12,11 @@
 
 static inline void print_irq_desc(unsigned int irq, struct irq_desc *desc)
 {
+        static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
+
+        if (!__ratelimit(&ratelimit))
+                return;
+
         printk("irq %d, desc: %p, depth: %d, count: %d, unhandled: %d\n",
                 irq, desc, desc->depth, desc->irq_count, desc->irqs_unhandled);
         printk("->handle_irq():  %p, ", desc->handle_irq);
diff --git a/kernel/irq/debugfs.c b/kernel/irq/debugfs.c
index 7f608ac39653..acfaaef8672a 100644
--- a/kernel/irq/debugfs.c
+++ b/kernel/irq/debugfs.c
@@ -113,6 +113,7 @@ static const struct irq_bit_descr irqdata_states[] = {
         BIT_MASK_DESCR(IRQD_SETAFFINITY_PENDING),
         BIT_MASK_DESCR(IRQD_AFFINITY_MANAGED),
         BIT_MASK_DESCR(IRQD_MANAGED_SHUTDOWN),
+        BIT_MASK_DESCR(IRQD_CAN_RESERVE),
 
         BIT_MASK_DESCR(IRQD_FORWARDED_TO_VCPU),
 
diff --git a/kernel/irq/generic-chip.c b/kernel/irq/generic-chip.c
index c26c5bb6b491..508c03dfef25 100644
--- a/kernel/irq/generic-chip.c
+++ b/kernel/irq/generic-chip.c
@@ -364,10 +364,11 @@ irq_get_domain_generic_chip(struct irq_domain *d, unsigned int hw_irq)
 EXPORT_SYMBOL_GPL(irq_get_domain_generic_chip);
 
 /*
- * Separate lockdep class for interrupt chip which can nest irq_desc
- * lock.
+ * Separate lockdep classes for interrupt chip which can nest irq_desc
+ * lock and request mutex.
  */
 static struct lock_class_key irq_nested_lock_class;
+static struct lock_class_key irq_nested_request_class;
 
 /*
  * irq_map_generic_chip - Map a generic chip for an irq domain
@@ -409,7 +410,8 @@ int irq_map_generic_chip(struct irq_domain *d, unsigned int virq,
         set_bit(idx, &gc->installed);
 
         if (dgc->gc_flags & IRQ_GC_INIT_NESTED_LOCK)
-                irq_set_lockdep_class(virq, &irq_nested_lock_class);
+                irq_set_lockdep_class(virq, &irq_nested_lock_class,
+                                      &irq_nested_request_class);
 
         if (chip->irq_calc_mask)
                 chip->irq_calc_mask(data);
@@ -479,7 +481,8 @@ void irq_setup_generic_chip(struct irq_chip_generic *gc, u32 msk,
                         continue;
 
                 if (flags & IRQ_GC_INIT_NESTED_LOCK)
-                        irq_set_lockdep_class(i, &irq_nested_lock_class);
+                        irq_set_lockdep_class(i, &irq_nested_lock_class,
+                                              &irq_nested_request_class);
 
                 if (!(flags & IRQ_GC_NO_MASK)) {
                         struct irq_data *d = irq_get_irq_data(i);
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index 07d08ca701ec..ab19371eab9b 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -440,7 +440,7 @@ static inline bool irq_fixup_move_pending(struct irq_desc *desc, bool fclear)
 #endif /* !CONFIG_GENERIC_PENDING_IRQ */
 
 #if !defined(CONFIG_IRQ_DOMAIN) || !defined(CONFIG_IRQ_DOMAIN_HIERARCHY)
-static inline int irq_domain_activate_irq(struct irq_data *data, bool early)
+static inline int irq_domain_activate_irq(struct irq_data *data, bool reserve)
 {
         irqd_set_activated(data);
         return 0;
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 4f4f60015e8a..62068ad46930 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1693,7 +1693,7 @@ static void __irq_domain_deactivate_irq(struct irq_data *irq_data)
         }
 }
 
-static int __irq_domain_activate_irq(struct irq_data *irqd, bool early)
+static int __irq_domain_activate_irq(struct irq_data *irqd, bool reserve)
 {
         int ret = 0;
 
@@ -1702,9 +1702,9 @@ static int __irq_domain_activate_irq(struct irq_data *irqd, bool early)
 
                 if (irqd->parent_data)
                         ret = __irq_domain_activate_irq(irqd->parent_data,
-                                                        early);
+                                                        reserve);
                 if (!ret && domain->ops->activate) {
-                        ret = domain->ops->activate(domain, irqd, early);
+                        ret = domain->ops->activate(domain, irqd, reserve);
                         /* Rollback in case of error */
                         if (ret && irqd->parent_data)
                                 __irq_domain_deactivate_irq(irqd->parent_data);
@@ -1716,17 +1716,18 @@ static int __irq_domain_activate_irq(struct irq_data *irqd, bool early)
 /**
  * irq_domain_activate_irq - Call domain_ops->activate recursively to activate
  *                           interrupt
- * @irq_data:   outermost irq_data associated with interrupt
+ * @irq_data:   Outermost irq_data associated with interrupt
+ * @reserve:    If set only reserve an interrupt vector instead of assigning one
  *
  * This is the second step to call domain_ops->activate to program interrupt
  * controllers, so the interrupt could actually get delivered.
  */
-int irq_domain_activate_irq(struct irq_data *irq_data, bool early)
+int irq_domain_activate_irq(struct irq_data *irq_data, bool reserve)
 {
         int ret = 0;
 
         if (!irqd_is_activated(irq_data))
-                ret = __irq_domain_activate_irq(irq_data, early);
+                ret = __irq_domain_activate_irq(irq_data, reserve);
         if (!ret)
                 irqd_set_activated(irq_data);
         return ret;
diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c
index 7df2480005f8..5187dfe809ac 100644
--- a/kernel/irq/matrix.c
+++ b/kernel/irq/matrix.c
@@ -321,15 +321,23 @@ void irq_matrix_remove_reserved(struct irq_matrix *m)
 int irq_matrix_alloc(struct irq_matrix *m, const struct cpumask *msk,
                      bool reserved, unsigned int *mapped_cpu)
 {
-        unsigned int cpu;
+        unsigned int cpu, best_cpu, maxavl = 0;
+        struct cpumap *cm;
+        unsigned int bit;
 
+        best_cpu = UINT_MAX;
         for_each_cpu(cpu, msk) {
-                struct cpumap *cm = per_cpu_ptr(m->maps, cpu);
-                unsigned int bit;
+                cm = per_cpu_ptr(m->maps, cpu);
 
-                if (!cm->online)
+                if (!cm->online || cm->available <= maxavl)
                         continue;
 
+                best_cpu = cpu;
+                maxavl = cm->available;
+        }
+
+        if (maxavl) {
+                cm = per_cpu_ptr(m->maps, best_cpu);
                 bit = matrix_alloc_area(m, cm, 1, false);
                 if (bit < m->alloc_end) {
                         cm->allocated++;
@@ -338,8 +346,8 @@ int irq_matrix_alloc(struct irq_matrix *m, const struct cpumask *msk,
                         m->global_available--;
                         if (reserved)
                                 m->global_reserved--;
-                        *mapped_cpu = cpu;
-                        trace_irq_matrix_alloc(bit, cpu, m, cm);
+                        *mapped_cpu = best_cpu;
+                        trace_irq_matrix_alloc(bit, best_cpu, m, cm);
                         return bit;
                 }
         }
@@ -384,7 +392,9 @@ unsigned int irq_matrix_available(struct irq_matrix *m, bool cpudown)
 {
         struct cpumap *cm = this_cpu_ptr(m->maps);
 
-        return (m->global_available - cpudown) ? cm->available : 0;
+        if (!cpudown)
+                return m->global_available;
+        return m->global_available - cm->available;
 }
 
 /**
diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
index edb987b2c58d..2f3c4f5382cc 100644
--- a/kernel/irq/msi.c
+++ b/kernel/irq/msi.c
@@ -339,6 +339,40 @@ int msi_domain_populate_irqs(struct irq_domain *domain, struct device *dev,
         return ret;
 }
 
+/*
+ * Carefully check whether the device can use reservation mode. If
+ * reservation mode is enabled then the early activation will assign a
+ * dummy vector to the device. If the PCI/MSI device does not support
+ * masking of the entry then this can result in spurious interrupts when
+ * the device driver is not absolutely careful. But even then a malfunction
+ * of the hardware could result in a spurious interrupt on the dummy vector
+ * and render the device unusable. If the entry can be masked then the core
+ * logic will prevent the spurious interrupt and reservation mode can be
+ * used. For now reservation mode is restricted to PCI/MSI.
+ */
+static bool msi_check_reservation_mode(struct irq_domain *domain,
+                                       struct msi_domain_info *info,
+                                       struct device *dev)
+{
+        struct msi_desc *desc;
+
+        if (domain->bus_token != DOMAIN_BUS_PCI_MSI)
+                return false;
+
+        if (!(info->flags & MSI_FLAG_MUST_REACTIVATE))
+                return false;
+
+        if (IS_ENABLED(CONFIG_PCI_MSI) && pci_msi_ignore_mask)
+                return false;
+
+        /*
+         * Checking the first MSI descriptor is sufficient. MSIX supports
+         * masking and MSI does so when the maskbit is set.
+         */
+        desc = first_msi_entry(dev);
+        return desc->msi_attrib.is_msix || desc->msi_attrib.maskbit;
+}
+
 /**
  * msi_domain_alloc_irqs - Allocate interrupts from a MSI interrupt domain
  * @domain:     The domain to allocate from
@@ -353,9 +387,11 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
 {
         struct msi_domain_info *info = domain->host_data;
         struct msi_domain_ops *ops = info->ops;
-        msi_alloc_info_t arg;
+        struct irq_data *irq_data;
         struct msi_desc *desc;
+        msi_alloc_info_t arg;
         int i, ret, virq;
+        bool can_reserve;
 
         ret = msi_domain_prepare_irqs(domain, dev, nvec, &arg);
         if (ret)
@@ -385,6 +421,8 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
         if (ops->msi_finish)
                 ops->msi_finish(&arg, 0);
 
+        can_reserve = msi_check_reservation_mode(domain, info, dev);
+
         for_each_msi_entry(desc, dev) {
                 virq = desc->irq;
                 if (desc->nvec_used == 1)
@@ -397,15 +435,25 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
                  * the MSI entries before the PCI layer enables MSI in the
                  * card. Otherwise the card latches a random msi message.
                  */
-                if (info->flags & MSI_FLAG_ACTIVATE_EARLY) {
-                        struct irq_data *irq_data;
+                if (!(info->flags & MSI_FLAG_ACTIVATE_EARLY))
+                        continue;
 
+                irq_data = irq_domain_get_irq_data(domain, desc->irq);
+                if (!can_reserve)
+                        irqd_clr_can_reserve(irq_data);
+                ret = irq_domain_activate_irq(irq_data, can_reserve);
+                if (ret)
+                        goto cleanup;
+        }
+
+        /*
+         * If these interrupts use reservation mode, clear the activated bit
+         * so request_irq() will assign the final vector.
+         */
+        if (can_reserve) {
+                for_each_msi_entry(desc, dev) {
                         irq_data = irq_domain_get_irq_data(domain, desc->irq);
-                        ret = irq_domain_activate_irq(irq_data, true);
-                        if (ret)
-                                goto cleanup;
-                        if (info->flags & MSI_FLAG_MUST_REACTIVATE)
-                                irqd_clr_activated(irq_data);
+                        irqd_clr_activated(irq_data);
                 }
         }
         return 0;
diff --git a/kernel/jump_label.c b/kernel/jump_label.c
index 8594d24e4adc..b4517095db6a 100644
--- a/kernel/jump_label.c
+++ b/kernel/jump_label.c
@@ -79,7 +79,7 @@ int static_key_count(struct static_key *key)
 }
 EXPORT_SYMBOL_GPL(static_key_count);
 
-static void static_key_slow_inc_cpuslocked(struct static_key *key)
+void static_key_slow_inc_cpuslocked(struct static_key *key)
 {
         int v, v1;
 
@@ -180,7 +180,7 @@ void static_key_disable(struct static_key *key)
 }
 EXPORT_SYMBOL_GPL(static_key_disable);
 
-static void static_key_slow_dec_cpuslocked(struct static_key *key,
+static void __static_key_slow_dec_cpuslocked(struct static_key *key,
                                            unsigned long rate_limit,
                                            struct delayed_work *work)
 {
@@ -211,7 +211,7 @@ static void __static_key_slow_dec(struct static_key *key,
                                   struct delayed_work *work)
 {
         cpus_read_lock();
-        static_key_slow_dec_cpuslocked(key, rate_limit, work);
+        __static_key_slow_dec_cpuslocked(key, rate_limit, work);
         cpus_read_unlock();
 }
 
@@ -229,6 +229,12 @@ void static_key_slow_dec(struct static_key *key)
 }
 EXPORT_SYMBOL_GPL(static_key_slow_dec);
 
+void static_key_slow_dec_cpuslocked(struct static_key *key)
+{
+        STATIC_KEY_CHECK_USE(key);
+        __static_key_slow_dec_cpuslocked(key, 0, NULL);
+}
+
 void static_key_slow_dec_deferred(struct static_key_deferred *key)
 {
         STATIC_KEY_CHECK_USE(key);
diff --git a/kernel/kcov.c b/kernel/kcov.c
index 15f33faf4013..7594c033d98a 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -157,7 +157,7 @@ void notrace __sanitizer_cov_trace_cmp2(u16 arg1, u16 arg2)
 }
 EXPORT_SYMBOL(__sanitizer_cov_trace_cmp2);
 
-void notrace __sanitizer_cov_trace_cmp4(u16 arg1, u16 arg2)
+void notrace __sanitizer_cov_trace_cmp4(u32 arg1, u32 arg2)
 {
         write_comp_data(KCOV_CMP_SIZE(2), arg1, arg2, _RET_IP_);
 }
@@ -183,7 +183,7 @@ void notrace __sanitizer_cov_trace_const_cmp2(u16 arg1, u16 arg2)
 }
 EXPORT_SYMBOL(__sanitizer_cov_trace_const_cmp2);
 
-void notrace __sanitizer_cov_trace_const_cmp4(u16 arg1, u16 arg2)
+void notrace __sanitizer_cov_trace_const_cmp4(u32 arg1, u32 arg2)
 {
         write_comp_data(KCOV_CMP_SIZE(2) | KCOV_CMP_CONST, arg1, arg2,
                         _RET_IP_);
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 9776da8db180..521659044719 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -49,6 +49,7 @@
 #include <linux/gfp.h>
 #include <linux/random.h>
 #include <linux/jhash.h>
+#include <linux/nmi.h>
 
 #include <asm/sections.h>
 
@@ -57,10 +58,6 @@
 #define CREATE_TRACE_POINTS
 #include <trace/events/lock.h>
 
-#ifdef CONFIG_LOCKDEP_CROSSRELEASE
-#include <linux/slab.h>
-#endif
-
 #ifdef CONFIG_PROVE_LOCKING
 int prove_locking = 1;
 module_param(prove_locking, int, 0644);
@@ -75,19 +72,6 @@ module_param(lock_stat, int, 0644);
 #define lock_stat 0
 #endif
 
-#ifdef CONFIG_BOOTPARAM_LOCKDEP_CROSSRELEASE_FULLSTACK
-static int crossrelease_fullstack = 1;
-#else
-static int crossrelease_fullstack;
-#endif
-static int __init allow_crossrelease_fullstack(char *str)
-{
-        crossrelease_fullstack = 1;
-        return 0;
-}
-
-early_param("crossrelease_fullstack", allow_crossrelease_fullstack);
-
 /*
  * lockdep_lock: protects the lockdep graph, the hashes and the
  *               class/list/hash allocators.
@@ -740,18 +724,6 @@ look_up_lock_class(struct lockdep_map *lock, unsigned int subclass)
         return is_static || static_obj(lock->key) ? NULL : ERR_PTR(-EINVAL);
 }
 
-#ifdef CONFIG_LOCKDEP_CROSSRELEASE
-static void cross_init(struct lockdep_map *lock, int cross);
-static int cross_lock(struct lockdep_map *lock);
-static int lock_acquire_crosslock(struct held_lock *hlock);
-static int lock_release_crosslock(struct lockdep_map *lock);
-#else
-static inline void cross_init(struct lockdep_map *lock, int cross) {}
-static inline int cross_lock(struct lockdep_map *lock) { return 0; }
-static inline int lock_acquire_crosslock(struct held_lock *hlock) { return 2; }
-static inline int lock_release_crosslock(struct lockdep_map *lock) { return 2; }
-#endif
-
 /*
  * Register a lock's class in the hash-table, if the class is not present
  * yet. Otherwise we look it up. We cache the result in the lock object
@@ -1151,41 +1123,22 @@ print_circular_lock_scenario(struct held_lock *src,
                 printk(KERN_CONT "\n\n");
         }
 
-        if (cross_lock(tgt->instance)) {
-                printk(" Possible unsafe locking scenario by crosslock:\n\n");
-                printk("       CPU0                    CPU1\n");
-                printk("       ----                    ----\n");
-                printk("  lock(");
-                __print_lock_name(parent);
-                printk(KERN_CONT ");\n");
-                printk("  lock(");
-                __print_lock_name(target);
-                printk(KERN_CONT ");\n");
-                printk("                               lock(");
-                __print_lock_name(source);
-                printk(KERN_CONT ");\n");
-                printk("                               unlock(");
-                __print_lock_name(target);
-                printk(KERN_CONT ");\n");
-                printk("\n *** DEADLOCK ***\n\n");
-        } else {
-                printk(" Possible unsafe locking scenario:\n\n");
-                printk("       CPU0                    CPU1\n");
-                printk("       ----                    ----\n");
-                printk("  lock(");
-                __print_lock_name(target);
-                printk(KERN_CONT ");\n");
-                printk("                               lock(");
-                __print_lock_name(parent);
-                printk(KERN_CONT ");\n");
-                printk("                               lock(");
-                __print_lock_name(target);
-                printk(KERN_CONT ");\n");
-                printk("  lock(");
-                __print_lock_name(source);
-                printk(KERN_CONT ");\n");
-                printk("\n *** DEADLOCK ***\n\n");
-        }
+        printk(" Possible unsafe locking scenario:\n\n");
+        printk("       CPU0                    CPU1\n");
+        printk("       ----                    ----\n");
+        printk("  lock(");
+        __print_lock_name(target);
+        printk(KERN_CONT ");\n");
+        printk("                               lock(");
+        __print_lock_name(parent);
+        printk(KERN_CONT ");\n");
+        printk("                               lock(");
+        __print_lock_name(target);
+        printk(KERN_CONT ");\n");
+        printk("  lock(");
+        __print_lock_name(source);
+        printk(KERN_CONT ");\n");
+        printk("\n *** DEADLOCK ***\n\n");
 }
 
 /*
@@ -1211,10 +1164,7 @@ print_circular_bug_header(struct lock_list *entry, unsigned int depth,
                 curr->comm, task_pid_nr(curr));
         print_lock(check_src);
 
-        if (cross_lock(check_tgt->instance))
-                pr_warn("\nbut now in release context of a crosslock acquired at the following:\n");
-        else
-                pr_warn("\nbut task is already holding lock:\n");
+        pr_warn("\nbut task is already holding lock:\n");
 
         print_lock(check_tgt);
         pr_warn("\nwhich lock already depends on the new lock.\n\n");
@@ -1244,9 +1194,7 @@ static noinline int print_circular_bug(struct lock_list *this,
         if (!debug_locks_off_graph_unlock() || debug_locks_silent)
                 return 0;
 
-        if (cross_lock(check_tgt->instance))
-                this->trace = *trace;
-        else if (!save_trace(&this->trace))
+        if (!save_trace(&this->trace))
                 return 0;
 
         depth = get_lock_depth(target);
@@ -1850,9 +1798,6 @@ check_deadlock(struct task_struct *curr, struct held_lock *next,
                 if (nest)
                         return 2;
 
-                if (cross_lock(prev->instance))
-                        continue;
-
                 return print_deadlock_bug(curr, prev, next);
         }
         return 1;
@@ -2018,31 +1963,26 @@ check_prevs_add(struct task_struct *curr, struct held_lock *next)
         for (;;) {
                 int distance = curr->lockdep_depth - depth + 1;
                 hlock = curr->held_locks + depth - 1;
+
                 /*
-                 * Only non-crosslock entries get new dependencies added.
-                 * Crosslock entries will be added by commit later:
+                 * Only non-recursive-read entries get new dependencies
+                 * added:
                  */
-                if (!cross_lock(hlock->instance)) {
+                if (hlock->read != 2 && hlock->check) {
+                        int ret = check_prev_add(curr, hlock, next, distance, &trace, save_trace);
+                        if (!ret)
+                                return 0;
+
                         /*
-                         * Only non-recursive-read entries get new dependencies
-                         * added:
+                         * Stop after the first non-trylock entry,
+                         * as non-trylock entries have added their
+                         * own direct dependencies already, so this
+                         * lock is connected to them indirectly:
                          */
-                        if (hlock->read != 2 && hlock->check) {
-                                int ret = check_prev_add(curr, hlock, next,
-                                                         distance, &trace, save_trace);
-                                if (!ret)
-                                        return 0;
-
-                                /*
-                                 * Stop after the first non-trylock entry,
-                                 * as non-trylock entries have added their
-                                 * own direct dependencies already, so this
-                                 * lock is connected to them indirectly:
-                                 */
-                                if (!hlock->trylock)
-                                        break;
-                        }
+                        if (!hlock->trylock)
+                                break;
                 }
+
                 depth--;
                 /*
                  * End of lock-stack?
@@ -3292,21 +3232,10 @@ static void __lockdep_init_map(struct lockdep_map *lock, const char *name,
 void lockdep_init_map(struct lockdep_map *lock, const char *name,
                       struct lock_class_key *key, int subclass)
 {
-        cross_init(lock, 0);
         __lockdep_init_map(lock, name, key, subclass);
 }
 EXPORT_SYMBOL_GPL(lockdep_init_map);
 
-#ifdef CONFIG_LOCKDEP_CROSSRELEASE
-void lockdep_init_map_crosslock(struct lockdep_map *lock, const char *name,
-                      struct lock_class_key *key, int subclass)
-{
-        cross_init(lock, 1);
-        __lockdep_init_map(lock, name, key, subclass);
-}
-EXPORT_SYMBOL_GPL(lockdep_init_map_crosslock);
-#endif
-
 struct lock_class_key __lockdep_no_validate__;
 EXPORT_SYMBOL_GPL(__lockdep_no_validate__);
 
@@ -3362,7 +3291,6 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
         int chain_head = 0;
         int class_idx;
         u64 chain_key;
-        int ret;
 
         if (unlikely(!debug_locks))
                 return 0;
@@ -3411,8 +3339,7 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
 
         class_idx = class - lock_classes + 1;
 
-        /* TODO: nest_lock is not implemented for crosslock yet. */
-        if (depth && !cross_lock(lock)) {
+        if (depth) {
                 hlock = curr->held_locks + depth - 1;
                 if (hlock->class_idx == class_idx && nest_lock) {
                         if (hlock->references) {
@@ -3500,14 +3427,6 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
         if (!validate_chain(curr, lock, hlock, chain_head, chain_key))
                 return 0;
 
-        ret = lock_acquire_crosslock(hlock);
-        /*
-         * 2 means normal acquire operations are needed. Otherwise, it's
-         * ok just to return with '0:fail, 1:success'.
-         */
-        if (ret != 2)
-                return ret;
-
         curr->curr_chain_key = chain_key;
         curr->lockdep_depth++;
         check_chain_key(curr);
@@ -3745,19 +3664,11 @@ __lock_release(struct lockdep_map *lock, int nested, unsigned long ip)
         struct task_struct *curr = current;
         struct held_lock *hlock;
         unsigned int depth;
-        int ret, i;
+        int i;
 
         if (unlikely(!debug_locks))
                 return 0;
 
-        ret = lock_release_crosslock(lock);
-        /*
-         * 2 means normal release operations are needed. Otherwise, it's
-         * ok just to return with '0:fail, 1:success'.
-         */
-        if (ret != 2)
-                return ret;
-
         depth = curr->lockdep_depth;
         /*
          * So we're all set to release this lock.. wait what lock? We don't
@@ -4580,6 +4491,7 @@ retry:
                 if (!unlock)
                         if (read_trylock(&tasklist_lock))
                                 unlock = 1;
+                touch_nmi_watchdog();
         } while_each_thread(g, p);
 
         pr_warn("\n");
@@ -4675,494 +4587,3 @@ void lockdep_rcu_suspicious(const char *file, const int line, const char *s)
         dump_stack();
 }
 EXPORT_SYMBOL_GPL(lockdep_rcu_suspicious);
-
-#ifdef CONFIG_LOCKDEP_CROSSRELEASE
-
-/*
- * Crossrelease works by recording a lock history for each thread and
- * connecting those historic locks that were taken after the
- * wait_for_completion() in the complete() context.
- *
- * Task-A                               Task-B
- *
- *                                      mutex_lock(&A);
- *                                      mutex_unlock(&A);
- *
- * wait_for_completion(&C);
- *   lock_acquire_crosslock();
- *     atomic_inc_return(&cross_gen_id);
- *                                |
- *                                |     mutex_lock(&B);
- *                                |     mutex_unlock(&B);
- *                                |
- *                                |     complete(&C);
- *                                `--     lock_commit_crosslock();
- *
- * Which will then add a dependency between B and C.
- */
-
-#define xhlock(i)         (current->xhlocks[(i) % MAX_XHLOCKS_NR])
-
-/*
- * Whenever a crosslock is held, cross_gen_id will be increased.
- */
-static atomic_t cross_gen_id; /* Can be wrapped */
-
-/*
- * Make an entry of the ring buffer invalid.
- */
-static inline void invalidate_xhlock(struct hist_lock *xhlock)
-{
-        /*
-         * Normally, xhlock->hlock.instance must be !NULL.
-         */
-        xhlock->hlock.instance = NULL;
-}
-
-/*
- * Lock history stacks; we have 2 nested lock history stacks:
- *
- *   HARD(IRQ)
- *   SOFT(IRQ)
- *
- * The thing is that once we complete a HARD/SOFT IRQ the future task locks
- * should not depend on any of the locks observed while running the IRQ.  So
- * what we do is rewind the history buffer and erase all our knowledge of that
- * temporal event.
- */
-
-void crossrelease_hist_start(enum xhlock_context_t c)
-{
-        struct task_struct *cur = current;
-
-        if (!cur->xhlocks)
-                return;
-
-        cur->xhlock_idx_hist[c] = cur->xhlock_idx;
-        cur->hist_id_save[c]    = cur->hist_id;
-}
-
-void crossrelease_hist_end(enum xhlock_context_t c)
-{
-        struct task_struct *cur = current;
-
-        if (cur->xhlocks) {
-                unsigned int idx = cur->xhlock_idx_hist[c];
-                struct hist_lock *h = &xhlock(idx);
-
-                cur->xhlock_idx = idx;
-
-                /* Check if the ring was overwritten. */
-                if (h->hist_id != cur->hist_id_save[c])
-                        invalidate_xhlock(h);
-        }
-}
-
-/*
- * lockdep_invariant_state() is used to annotate independence inside a task, to
- * make one task look like multiple independent 'tasks'.
- *
- * Take for instance workqueues; each work is independent of the last. The
- * completion of a future work does not depend on the completion of a past work
- * (in general). Therefore we must not carry that (lock) dependency across
- * works.
- *
- * This is true for many things; pretty much all kthreads fall into this
- * pattern, where they have an invariant state and future completions do not
- * depend on past completions. Its just that since they all have the 'same'
- * form -- the kthread does the same over and over -- it doesn't typically
- * matter.
- *
- * The same is true for system-calls, once a system call is completed (we've
- * returned to userspace) the next system call does not depend on the lock
- * history of the previous system call.
- *
- * They key property for independence, this invariant state, is that it must be
- * a point where we hold no locks and have no history. Because if we were to
- * hold locks, the restore at _end() would not necessarily recover it's history
- * entry. Similarly, independence per-definition means it does not depend on
- * prior state.
- */
-void lockdep_invariant_state(bool force)
-{
-        /*
-         * We call this at an invariant point, no current state, no history.
-         * Verify the former, enforce the latter.
-         */
-        WARN_ON_ONCE(!force && current->lockdep_depth);
-        invalidate_xhlock(&xhlock(current->xhlock_idx));
-}
-
-static int cross_lock(struct lockdep_map *lock)
-{
-        return lock ? lock->cross : 0;
-}
-
-/*
- * This is needed to decide the relationship between wrapable variables.
- */
-static inline int before(unsigned int a, unsigned int b)
-{
-        return (int)(a - b) < 0;
-}
-
-static inline struct lock_class *xhlock_class(struct hist_lock *xhlock)
-{
-        return hlock_class(&xhlock->hlock);
-}
-
-static inline struct lock_class *xlock_class(struct cross_lock *xlock)
-{
-        return hlock_class(&xlock->hlock);
-}
-
-/*
- * Should we check a dependency with previous one?
- */
-static inline int depend_before(struct held_lock *hlock)
-{
-        return hlock->read != 2 && hlock->check && !hlock->trylock;
-}
-
-/*
- * Should we check a dependency with next one?
- */
-static inline int depend_after(struct held_lock *hlock)
-{
-        return hlock->read != 2 && hlock->check;
-}
-
-/*
- * Check if the xhlock is valid, which would be false if,
- *
- *    1. Has not used after initializaion yet.
- *    2. Got invalidated.
- *
- * Remind hist_lock is implemented as a ring buffer.
- */
-static inline int xhlock_valid(struct hist_lock *xhlock)
-{
-        /*
-         * xhlock->hlock.instance must be !NULL.
-         */
-        return !!xhlock->hlock.instance;
-}
-
-/*
- * Record a hist_lock entry.
- *
- * Irq disable is only required.
- */
-static void add_xhlock(struct held_lock *hlock)
-{
-        unsigned int idx = ++current->xhlock_idx;
-        struct hist_lock *xhlock = &xhlock(idx);
-
-#ifdef CONFIG_DEBUG_LOCKDEP
-        /*
-         * This can be done locklessly because they are all task-local
-         * state, we must however ensure IRQs are disabled.
-         */
-        WARN_ON_ONCE(!irqs_disabled());
-#endif
-
-        /* Initialize hist_lock's members */
-        xhlock->hlock = *hlock;
-        xhlock->hist_id = ++current->hist_id;
-
-        xhlock->trace.nr_entries = 0;
-        xhlock->trace.max_entries = MAX_XHLOCK_TRACE_ENTRIES;
-        xhlock->trace.entries = xhlock->trace_entries;
-
-        if (crossrelease_fullstack) {
-                xhlock->trace.skip = 3;
-                save_stack_trace(&xhlock->trace);
-        } else {
-                xhlock->trace.nr_entries = 1;
-                xhlock->trace.entries[0] = hlock->acquire_ip;
-        }
-}
-
-static inline int same_context_xhlock(struct hist_lock *xhlock)
-{
-        return xhlock->hlock.irq_context == task_irq_context(current);
-}
-
-/*
- * This should be lockless as far as possible because this would be
- * called very frequently.
- */
-static void check_add_xhlock(struct held_lock *hlock)
-{
-        /*
-         * Record a hist_lock, only in case that acquisitions ahead
-         * could depend on the held_lock. For example, if the held_lock
-         * is trylock then acquisitions ahead never depends on that.
-         * In that case, we don't need to record it. Just return.
-         */
-        if (!current->xhlocks || !depend_before(hlock))
-                return;
-
-        add_xhlock(hlock);
-}
-
-/*
- * For crosslock.
- */
-static int add_xlock(struct held_lock *hlock)
-{
-        struct cross_lock *xlock;
-        unsigned int gen_id;
-
-        if (!graph_lock())
-                return 0;
-
-        xlock = &((struct lockdep_map_cross *)hlock->instance)->xlock;
-
-        /*
-         * When acquisitions for a crosslock are overlapped, we use
-         * nr_acquire to perform commit for them, based on cross_gen_id
-         * of the first acquisition, which allows to add additional
-         * dependencies.
-         *
-         * Moreover, when no acquisition of a crosslock is in progress,
-         * we should not perform commit because the lock might not exist
-         * any more, which might cause incorrect memory access. So we
-         * have to track the number of acquisitions of a crosslock.
-         *
-         * depend_after() is necessary to initialize only the first
-         * valid xlock so that the xlock can be used on its commit.
-         */
-        if (xlock->nr_acquire++ && depend_after(&xlock->hlock))
-                goto unlock;
-
-        gen_id = (unsigned int)atomic_inc_return(&cross_gen_id);
-        xlock->hlock = *hlock;
-        xlock->hlock.gen_id = gen_id;
-unlock:
-        graph_unlock();
-        return 1;
-}
-
-/*
- * Called for both normal and crosslock acquires. Normal locks will be
- * pushed on the hist_lock queue. Cross locks will record state and
- * stop regular lock_acquire() to avoid being placed on the held_lock
- * stack.
- *
- * Return: 0 - failure;
- *         1 - crosslock, done;
- *         2 - normal lock, continue to held_lock[] ops.
- */
-static int lock_acquire_crosslock(struct held_lock *hlock)
-{
-        /*
-         *      CONTEXT 1               CONTEXT 2
-         *      ---------               ---------
-         *      lock A (cross)
-         *      X = atomic_inc_return(&cross_gen_id)
-         *      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-         *                              Y = atomic_read_acquire(&cross_gen_id)
-         *                              lock B
-         *
-         * atomic_read_acquire() is for ordering between A and B,
-         * IOW, A happens before B, when CONTEXT 2 see Y >= X.
-         *
-         * Pairs with atomic_inc_return() in add_xlock().
-         */
-        hlock->gen_id = (unsigned int)atomic_read_acquire(&cross_gen_id);
-
-        if (cross_lock(hlock->instance))
-                return add_xlock(hlock);
-
-        check_add_xhlock(hlock);
-        return 2;
-}
-
-static int copy_trace(struct stack_trace *trace)
-{
-        unsigned long *buf = stack_trace + nr_stack_trace_entries;
-        unsigned int max_nr = MAX_STACK_TRACE_ENTRIES - nr_stack_trace_entries;
-        unsigned int nr = min(max_nr, trace->nr_entries);
-
-        trace->nr_entries = nr;
-        memcpy(buf, trace->entries, nr * sizeof(trace->entries[0]));
-        trace->entries = buf;
-        nr_stack_trace_entries += nr;
-
-        if (nr_stack_trace_entries >= MAX_STACK_TRACE_ENTRIES-1) {
-                if (!debug_locks_off_graph_unlock())
-                        return 0;
-
-                print_lockdep_off("BUG: MAX_STACK_TRACE_ENTRIES too low!");
-                dump_stack();
-
-                return 0;
-        }
-
-        return 1;
-}
-
-static int commit_xhlock(struct cross_lock *xlock, struct hist_lock *xhlock)
-{
-        unsigned int xid, pid;
-        u64 chain_key;
-
-        xid = xlock_class(xlock) - lock_classes;
-        chain_key = iterate_chain_key((u64)0, xid);
-        pid = xhlock_class(xhlock) - lock_classes;
-        chain_key = iterate_chain_key(chain_key, pid);
-
-        if (lookup_chain_cache(chain_key))
-                return 1;
-
-        if (!add_chain_cache_classes(xid, pid, xhlock->hlock.irq_context,
-                                chain_key))
-                return 0;
-
-        if (!check_prev_add(current, &xlock->hlock, &xhlock->hlock, 1,
-                            &xhlock->trace, copy_trace))
-                return 0;
-
-        return 1;
-}
-
-static void commit_xhlocks(struct cross_lock *xlock)
-{
-        unsigned int cur = current->xhlock_idx;
-        unsigned int prev_hist_id = xhlock(cur).hist_id;
-        unsigned int i;
-
-        if (!graph_lock())
-                return;
-
-        if (xlock->nr_acquire) {
-                for (i = 0; i < MAX_XHLOCKS_NR; i++) {
-                        struct hist_lock *xhlock = &xhlock(cur - i);
-
-                        if (!xhlock_valid(xhlock))
-                                break;
-
-                        if (before(xhlock->hlock.gen_id, xlock->hlock.gen_id))
-                                break;
-
-                        if (!same_context_xhlock(xhlock))
-                                break;
-
-                        /*
-                         * Filter out the cases where the ring buffer was
-                         * overwritten and the current entry has a bigger
-                         * hist_id than the previous one, which is impossible
-                         * otherwise:
-                         */
-                        if (unlikely(before(prev_hist_id, xhlock->hist_id)))
-                                break;
-
-                        prev_hist_id = xhlock->hist_id;
-
-                        /*
-                         * commit_xhlock() returns 0 with graph_lock already
-                         * released if fail.
-                         */
-                        if (!commit_xhlock(xlock, xhlock))
-                                return;
-                }
-        }
-
-        graph_unlock();
-}
-
-void lock_commit_crosslock(struct lockdep_map *lock)
-{
-        struct cross_lock *xlock;
-        unsigned long flags;
-
-        if (unlikely(!debug_locks || current->lockdep_recursion))
-                return;
-
-        if (!current->xhlocks)
-                return;
-
-        /*
-         * Do commit hist_locks with the cross_lock, only in case that
-         * the cross_lock could depend on acquisitions after that.
-         *
-         * For example, if the cross_lock does not have the 'check' flag
-         * then we don't need to check dependencies and commit for that.
-         * Just skip it. In that case, of course, the cross_lock does
-         * not depend on acquisitions ahead, either.
-         *
-         * WARNING: Don't do that in add_xlock() in advance. When an
-         * acquisition context is different from the commit context,
-         * invalid(skipped) cross_lock might be accessed.
-         */
-        if (!depend_after(&((struct lockdep_map_cross *)lock)->xlock.hlock))
-                return;
-
-        raw_local_irq_save(flags);
-        check_flags(flags);
-        current->lockdep_recursion = 1;
-        xlock = &((struct lockdep_map_cross *)lock)->xlock;
-        commit_xhlocks(xlock);
-        current->lockdep_recursion = 0;
-        raw_local_irq_restore(flags);
-}
-EXPORT_SYMBOL_GPL(lock_commit_crosslock);
-
-/*
- * Return: 0 - failure;
- *         1 - crosslock, done;
- *         2 - normal lock, continue to held_lock[] ops.
- */
-static int lock_release_crosslock(struct lockdep_map *lock)
-{
-        if (cross_lock(lock)) {
-                if (!graph_lock())
-                        return 0;
-                ((struct lockdep_map_cross *)lock)->xlock.nr_acquire--;
-                graph_unlock();
-                return 1;
-        }
-        return 2;
-}
-
-static void cross_init(struct lockdep_map *lock, int cross)
-{
-        if (cross)
-                ((struct lockdep_map_cross *)lock)->xlock.nr_acquire = 0;
-
-        lock->cross = cross;
-
-        /*
-         * Crossrelease assumes that the ring buffer size of xhlocks
-         * is aligned with power of 2. So force it on build.
-         */
-        BUILD_BUG_ON(MAX_XHLOCKS_NR & (MAX_XHLOCKS_NR - 1));
-}
-
-void lockdep_init_task(struct task_struct *task)
-{
-        int i;
-
-        task->xhlock_idx = UINT_MAX;
-        task->hist_id = 0;
-
-        for (i = 0; i < XHLOCK_CTX_NR; i++) {
-                task->xhlock_idx_hist[i] = UINT_MAX;
-                task->hist_id_save[i] = 0;
-        }
-
-        task->xhlocks = kzalloc(sizeof(struct hist_lock) * MAX_XHLOCKS_NR,
-                                GFP_KERNEL);
-}
-
-void lockdep_free_task(struct task_struct *task)
-{
-        if (task->xhlocks) {
-                void *tmp = task->xhlocks;
-                /* Diable crossrelease for current */
-                task->xhlocks = NULL;
-                kfree(tmp);
-        }
-}
-#endif
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 6f3dba6e4e9e..65cc0cb984e6 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1290,6 +1290,19 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
         return ret;
 }
 
+static inline int __rt_mutex_slowtrylock(struct rt_mutex *lock)
+{
+        int ret = try_to_take_rt_mutex(lock, current, NULL);
+
+        /*
+         * try_to_take_rt_mutex() sets the lock waiters bit
+         * unconditionally. Clean this up.
+         */
+        fixup_rt_mutex_waiters(lock);
+
+        return ret;
+}
+
 /*
  * Slow path try-lock function:
  */
@@ -1312,13 +1325,7 @@ static inline int rt_mutex_slowtrylock(struct rt_mutex *lock)
          */
         raw_spin_lock_irqsave(&lock->wait_lock, flags);
 
-        ret = try_to_take_rt_mutex(lock, current, NULL);
-
-        /*
-         * try_to_take_rt_mutex() sets the lock waiters bit
-         * unconditionally. Clean this up.
-         */
-        fixup_rt_mutex_waiters(lock);
+        ret = __rt_mutex_slowtrylock(lock);
 
         raw_spin_unlock_irqrestore(&lock->wait_lock, flags);
 
@@ -1505,6 +1512,11 @@ int __sched rt_mutex_futex_trylock(struct rt_mutex *lock)
         return rt_mutex_slowtrylock(lock);
 }
 
+int __sched __rt_mutex_futex_trylock(struct rt_mutex *lock)
+{
+        return __rt_mutex_slowtrylock(lock);
+}
+
 /**
  * rt_mutex_timed_lock - lock a rt_mutex interruptible
  *                      the timeout structure is provided
diff --git a/kernel/locking/rtmutex_common.h b/kernel/locking/rtmutex_common.h
index 124e98ca0b17..68686b3ec3c1 100644
--- a/kernel/locking/rtmutex_common.h
+++ b/kernel/locking/rtmutex_common.h
@@ -148,6 +148,7 @@ extern bool rt_mutex_cleanup_proxy_lock(struct rt_mutex *lock,
                                  struct rt_mutex_waiter *waiter);
 
 extern int rt_mutex_futex_trylock(struct rt_mutex *l);
+extern int __rt_mutex_futex_trylock(struct rt_mutex *l);
 
 extern void rt_mutex_futex_unlock(struct rt_mutex *lock);
 extern bool __rt_mutex_futex_unlock(struct rt_mutex *lock,
diff --git a/kernel/locking/spinlock.c b/kernel/locking/spinlock.c
index 1fd1a7543cdd..936f3d14dd6b 100644
--- a/kernel/locking/spinlock.c
+++ b/kernel/locking/spinlock.c
@@ -66,12 +66,8 @@ void __lockfunc __raw_##op##_lock(locktype##_t *lock)			\
                         break;                                          \
                 preempt_enable();                                       \
                                                                         \
-                if (!(lock)->break_lock)                                \
-                        (lock)->break_lock = 1;                         \
-                while ((lock)->break_lock)                              \
-                        arch_##op##_relax(&lock->raw_lock);             \
+                arch_##op##_relax(&lock->raw_lock);                     \
         }                                                               \
-        (lock)->break_lock = 0;                                         \
 }                                                                       \
                                                                         \
 unsigned long __lockfunc __raw_##op##_lock_irqsave(locktype##_t *lock)  \
@@ -86,12 +82,9 @@ unsigned long __lockfunc __raw_##op##_lock_irqsave(locktype##_t *lock)	\
                 local_irq_restore(flags);                               \
                 preempt_enable();                                       \
                                                                         \
-                if (!(lock)->break_lock)                                \
-                        (lock)->break_lock = 1;                         \
-                while ((lock)->break_lock)                              \
-                        arch_##op##_relax(&lock->raw_lock);             \
+                arch_##op##_relax(&lock->raw_lock);                     \
         }                                                               \
-        (lock)->break_lock = 0;                                         \
+                                                                        \
         return flags;                                                   \
 }                                                                       \
                                                                         \
diff --git a/kernel/pid.c b/kernel/pid.c
index b13b624e2c49..1e8bb6550ec4 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -193,10 +193,8 @@ struct pid *alloc_pid(struct pid_namespace *ns)
         }
 
         if (unlikely(is_child_reaper(pid))) {
-                if (pid_ns_prepare_proc(ns)) {
-                        disable_pid_allocation(ns);
+                if (pid_ns_prepare_proc(ns))
                         goto out_free;
-                }
         }
 
         get_pid_ns(ns);
@@ -226,6 +224,10 @@ out_free:
         while (++i <= ns->level)
                 idr_remove(&ns->idr, (pid->numbers + i)->nr);
 
+        /* On failure to allocate the first pid, reset the state */
+        if (ns->pid_allocated == PIDNS_ADDING)
+                idr_set_cursor(&ns->idr, 0);
+
         spin_unlock_irq(&pidmap_lock);
 
         kmem_cache_free(ns->pid_cachep, pid);
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 5d81206a572d..b9006617710f 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -3141,9 +3141,6 @@ void dump_stack_print_info(const char *log_lvl)
 void show_regs_print_info(const char *log_lvl)
 {
         dump_stack_print_info(log_lvl);
-
-        printk("%stask: %p task.stack: %p\n",
-               log_lvl, current, task_stack_page(current));
 }
 
 #endif
diff --git a/kernel/sched/completion.c b/kernel/sched/completion.c
index 2ddaec40956f..0926aef10dad 100644
--- a/kernel/sched/completion.c
+++ b/kernel/sched/completion.c
@@ -34,11 +34,6 @@ void complete(struct completion *x)
 
         spin_lock_irqsave(&x->wait.lock, flags);
 
-        /*
-         * Perform commit of crossrelease here.
-         */
-        complete_release_commit(x);
-
         if (x->done != UINT_MAX)
                 x->done++;
         __wake_up_locked(&x->wait, TASK_NORMAL, 1);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 75554f366fd3..a7bf32aabfda 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2056,7 +2056,7 @@ try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
         p->state = TASK_WAKING;
 
         if (p->in_iowait) {
-                delayacct_blkio_end();
+                delayacct_blkio_end(p);
                 atomic_dec(&task_rq(p)->nr_iowait);
         }
 
@@ -2069,7 +2069,7 @@ try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
 #else /* CONFIG_SMP */
 
         if (p->in_iowait) {
-                delayacct_blkio_end();
+                delayacct_blkio_end(p);
                 atomic_dec(&task_rq(p)->nr_iowait);
         }
 
@@ -2122,7 +2122,7 @@ static void try_to_wake_up_local(struct task_struct *p, struct rq_flags *rf)
 
         if (!task_on_rq_queued(p)) {
                 if (p->in_iowait) {
-                        delayacct_blkio_end();
+                        delayacct_blkio_end(p);
                         atomic_dec(&rq->nr_iowait);
                 }
                 ttwu_activate(rq, p, ENQUEUE_WAKEUP | ENQUEUE_NOCLOCK);
@@ -5097,17 +5097,6 @@ SYSCALL_DEFINE1(sched_get_priority_min, int, policy)
         return ret;
 }
 
-/**
- * sys_sched_rr_get_interval - return the default timeslice of a process.
- * @pid: pid of the process.
- * @interval: userspace pointer to the timeslice value.
- *
- * this syscall writes the default timeslice value of a given process
- * into the user-space timespec buffer. A value of '0' means infinity.
- *
- * Return: On success, 0 and the timeslice is in @interval. Otherwise,
- * an error code.
- */
 static int sched_rr_get_interval(pid_t pid, struct timespec64 *t)
 {
         struct task_struct *p;
@@ -5144,6 +5133,17 @@ out_unlock:
         return retval;
 }
 
+/**
+ * sys_sched_rr_get_interval - return the default timeslice of a process.
+ * @pid: pid of the process.
+ * @interval: userspace pointer to the timeslice value.
+ *
+ * this syscall writes the default timeslice value of a given process
+ * into the user-space timespec buffer. A value of '0' means infinity.
+ *
+ * Return: On success, 0 and the timeslice is in @interval. Otherwise,
+ * an error code.
+ */
 SYSCALL_DEFINE2(sched_rr_get_interval, pid_t, pid,
                 struct timespec __user *, interval)
 {
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 2f52ec0f1539..d6717a3331a1 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -244,7 +244,7 @@ static void sugov_iowait_boost(struct sugov_cpu *sg_cpu, unsigned long *util,
 #ifdef CONFIG_NO_HZ_COMMON
 static bool sugov_cpu_is_busy(struct sugov_cpu *sg_cpu)
 {
-        unsigned long idle_calls = tick_nohz_get_idle_calls();
+        unsigned long idle_calls = tick_nohz_get_idle_calls_cpu(sg_cpu->cpu);
         bool ret = idle_calls == sg_cpu->saved_idle_calls;
 
         sg_cpu->saved_idle_calls = idle_calls;
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 4037e19bbca2..26a71ebcd3c2 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3413,9 +3413,9 @@ void set_task_rq_fair(struct sched_entity *se,
  * _IFF_ we look at the pure running and runnable sums. Because they
  * represent the very same entity, just at different points in the hierarchy.
  *
- *
- * Per the above update_tg_cfs_util() is trivial (and still 'wrong') and
- * simply copies the running sum over.
+ * Per the above update_tg_cfs_util() is trivial and simply copies the running
+ * sum over (but still wrong, because the group entity and group rq do not have
+ * their PELT windows aligned).
  *
  * However, update_tg_cfs_runnable() is more complex. So we have:
  *
@@ -3424,11 +3424,11 @@ void set_task_rq_fair(struct sched_entity *se,
  * And since, like util, the runnable part should be directly transferable,
  * the following would _appear_ to be the straight forward approach:
  *
- *   grq->avg.load_avg = grq->load.weight * grq->avg.running_avg        (3)
+ *   grq->avg.load_avg = grq->load.weight * grq->avg.runnable_avg       (3)
  *
  * And per (1) we have:
  *
- *   ge->avg.running_avg == grq->avg.running_avg
+ *   ge->avg.runnable_avg == grq->avg.runnable_avg
  *
  * Which gives:
  *
@@ -3447,27 +3447,28 @@ void set_task_rq_fair(struct sched_entity *se,
  * to (shortly) return to us. This only works by keeping the weights as
  * integral part of the sum. We therefore cannot decompose as per (3).
  *
- * OK, so what then?
+ * Another reason this doesn't work is that runnable isn't a 0-sum entity.
+ * Imagine a rq with 2 tasks that each are runnable 2/3 of the time. Then the
+ * rq itself is runnable anywhere between 2/3 and 1 depending on how the
+ * runnable section of these tasks overlap (or not). If they were to perfectly
+ * align the rq as a whole would be runnable 2/3 of the time. If however we
+ * always have at least 1 runnable task, the rq as a whole is always runnable.
  *
+ * So we'll have to approximate.. :/
  *
- * Another way to look at things is:
+ * Given the constraint:
  *
- *   grq->avg.load_avg = \Sum se->avg.load_avg
+ *   ge->avg.running_sum <= ge->avg.runnable_sum <= LOAD_AVG_MAX
  *
- * Therefore, per (2):
+ * We can construct a rule that adds runnable to a rq by assuming minimal
+ * overlap.
  *
- *   grq->avg.load_avg = \Sum se->load.weight * se->avg.runnable_avg
+ * On removal, we'll assume each task is equally runnable; which yields:
  *
- * And the very thing we're propagating is a change in that sum (someone
- * joined/left). So we can easily know the runnable change, which would be, per
- * (2) the already tracked se->load_avg divided by the corresponding
- * se->weight.
+ *   grq->avg.runnable_sum = grq->avg.load_sum / grq->load.weight
  *
- * Basically (4) but in differential form:
+ * XXX: only do this for the part of runnable > running ?
  *
- *   d(runnable_avg) += se->avg.load_avg / se->load.weight
- *                                                                 (5)
- *   ge->avg.load_avg += ge->load.weight * d(runnable_avg)
  */
 
 static inline void
@@ -3479,6 +3480,14 @@ update_tg_cfs_util(struct cfs_rq *cfs_rq, struct sched_entity *se, struct cfs_rq
         if (!delta)
                 return;
 
+        /*
+         * The relation between sum and avg is:
+         *
+         *   LOAD_AVG_MAX - 1024 + sa->period_contrib
+         *
+         * however, the PELT windows are not aligned between grq and gse.
+         */
+
         /* Set new sched_entity's utilization */
         se->avg.util_avg = gcfs_rq->avg.util_avg;
         se->avg.util_sum = se->avg.util_avg * LOAD_AVG_MAX;
@@ -3491,33 +3500,68 @@ update_tg_cfs_util(struct cfs_rq *cfs_rq, struct sched_entity *se, struct cfs_rq
 static inline void
 update_tg_cfs_runnable(struct cfs_rq *cfs_rq, struct sched_entity *se, struct cfs_rq *gcfs_rq)
 {
-        long runnable_sum = gcfs_rq->prop_runnable_sum;
-        long runnable_load_avg, load_avg;
-        s64 runnable_load_sum, load_sum;
+        long delta_avg, running_sum, runnable_sum = gcfs_rq->prop_runnable_sum;
+        unsigned long runnable_load_avg, load_avg;
+        u64 runnable_load_sum, load_sum = 0;
+        s64 delta_sum;
 
         if (!runnable_sum)
                 return;
 
         gcfs_rq->prop_runnable_sum = 0;
 
+        if (runnable_sum >= 0) {
+                /*
+                 * Add runnable; clip at LOAD_AVG_MAX. Reflects that until
+                 * the CPU is saturated running == runnable.
+                 */
+                runnable_sum += se->avg.load_sum;
+                runnable_sum = min(runnable_sum, (long)LOAD_AVG_MAX);
+        } else {
+                /*
+                 * Estimate the new unweighted runnable_sum of the gcfs_rq by
+                 * assuming all tasks are equally runnable.
+                 */
+                if (scale_load_down(gcfs_rq->load.weight)) {
+                        load_sum = div_s64(gcfs_rq->avg.load_sum,
+                                scale_load_down(gcfs_rq->load.weight));
+                }
+
+                /* But make sure to not inflate se's runnable */
+                runnable_sum = min(se->avg.load_sum, load_sum);
+        }
+
+        /*
+         * runnable_sum can't be lower than running_sum
+         * As running sum is scale with cpu capacity wehreas the runnable sum
+         * is not we rescale running_sum 1st
+         */
+        running_sum = se->avg.util_sum /
+                arch_scale_cpu_capacity(NULL, cpu_of(rq_of(cfs_rq)));
+        runnable_sum = max(runnable_sum, running_sum);
+
         load_sum = (s64)se_weight(se) * runnable_sum;
         load_avg = div_s64(load_sum, LOAD_AVG_MAX);
 
-        add_positive(&se->avg.load_sum, runnable_sum);
-        add_positive(&se->avg.load_avg, load_avg);
+        delta_sum = load_sum - (s64)se_weight(se) * se->avg.load_sum;
+        delta_avg = load_avg - se->avg.load_avg;
 
-        add_positive(&cfs_rq->avg.load_avg, load_avg);
-        add_positive(&cfs_rq->avg.load_sum, load_sum);
+        se->avg.load_sum = runnable_sum;
+        se->avg.load_avg = load_avg;
+        add_positive(&cfs_rq->avg.load_avg, delta_avg);
+        add_positive(&cfs_rq->avg.load_sum, delta_sum);
 
         runnable_load_sum = (s64)se_runnable(se) * runnable_sum;
         runnable_load_avg = div_s64(runnable_load_sum, LOAD_AVG_MAX);
+        delta_sum = runnable_load_sum - se_weight(se) * se->avg.runnable_load_sum;
+        delta_avg = runnable_load_avg - se->avg.runnable_load_avg;
 
-        add_positive(&se->avg.runnable_load_sum, runnable_sum);
-        add_positive(&se->avg.runnable_load_avg, runnable_load_avg);
+        se->avg.runnable_load_sum = runnable_sum;
+        se->avg.runnable_load_avg = runnable_load_avg;
 
         if (se->on_rq) {
-                add_positive(&cfs_rq->avg.runnable_load_avg, runnable_load_avg);
-                add_positive(&cfs_rq->avg.runnable_load_sum, runnable_load_sum);
+                add_positive(&cfs_rq->avg.runnable_load_avg, delta_avg);
+                add_positive(&cfs_rq->avg.runnable_load_sum, delta_sum);
         }
 }
 
@@ -4321,12 +4365,12 @@ static inline bool cfs_bandwidth_used(void)
 
 void cfs_bandwidth_usage_inc(void)
 {
-        static_key_slow_inc(&__cfs_bandwidth_used);
+        static_key_slow_inc_cpuslocked(&__cfs_bandwidth_used);
 }
 
 void cfs_bandwidth_usage_dec(void)
 {
-        static_key_slow_dec(&__cfs_bandwidth_used);
+        static_key_slow_dec_cpuslocked(&__cfs_bandwidth_used);
 }
 #else /* HAVE_JUMP_LABEL */
 static bool cfs_bandwidth_used(void)
diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c
index dd7908743dab..9bcbacba82a8 100644
--- a/kernel/sched/membarrier.c
+++ b/kernel/sched/membarrier.c
@@ -89,7 +89,9 @@ static int membarrier_private_expedited(void)
                 rcu_read_unlock();
         }
         if (!fallback) {
+                preempt_disable();
                 smp_call_function_many(tmpmask, ipi_mb, NULL, 1);
+                preempt_enable();
                 free_cpumask_var(tmpmask);
         }
         cpus_read_unlock();
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 4056c19ca3f0..665ace2fc558 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -2034,8 +2034,9 @@ static void pull_rt_task(struct rq *this_rq)
         bool resched = false;
         struct task_struct *p;
         struct rq *src_rq;
+        int rt_overload_count = rt_overloaded(this_rq);
 
-        if (likely(!rt_overloaded(this_rq)))
+        if (likely(!rt_overload_count))
                 return;
 
         /*
@@ -2044,6 +2045,11 @@ static void pull_rt_task(struct rq *this_rq)
          */
         smp_rmb();
 
+        /* If we are the only overloaded CPU do nothing */
+        if (rt_overload_count == 1 &&
+            cpumask_test_cpu(this_rq->cpu, this_rq->rd->rto_mask))
+                return;
+
 #ifdef HAVE_RT_PUSH_IPI
         if (sched_feat(RT_PUSH_IPI)) {
                 tell_cpu_to_push(this_rq);
diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c
index 98feab7933c7..929ecb7d6b78 100644
--- a/kernel/sched/wait.c
+++ b/kernel/sched/wait.c
@@ -27,7 +27,7 @@ void add_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq
 
         wq_entry->flags &= ~WQ_FLAG_EXCLUSIVE;
         spin_lock_irqsave(&wq_head->lock, flags);
-        __add_wait_queue_entry_tail(wq_head, wq_entry);
+        __add_wait_queue(wq_head, wq_entry);
         spin_unlock_irqrestore(&wq_head->lock, flags);
 }
 EXPORT_SYMBOL(add_wait_queue);
diff --git a/kernel/time/Kconfig b/kernel/time/Kconfig
index e776fc8cc1df..f6b5f19223d6 100644
--- a/kernel/time/Kconfig
+++ b/kernel/time/Kconfig
@@ -95,6 +95,7 @@ config NO_HZ_FULL
         select RCU_NOCB_CPU
         select VIRT_CPU_ACCOUNTING_GEN
         select IRQ_WORK
+        select CPU_ISOLATION
         help
          Adaptively try to shutdown the tick whenever possible, even when
          the CPU is running tasks. Typically this requires running a single
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index d32520840fde..aa9d2a2b1210 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -655,7 +655,9 @@ static void hrtimer_reprogram(struct hrtimer *timer,
 static inline void hrtimer_init_hres(struct hrtimer_cpu_base *base)
 {
         base->expires_next = KTIME_MAX;
+        base->hang_detected = 0;
         base->hres_active = 0;
+        base->next_timer = NULL;
 }
 
 /*
@@ -1589,6 +1591,7 @@ int hrtimers_prepare_cpu(unsigned int cpu)
                 timerqueue_init_head(&cpu_base->clock_base[i].active);
         }
 
+        cpu_base->active_bases = 0;
         cpu_base->cpu = cpu;
         hrtimer_init_hres(cpu_base);
         return 0;
diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index 13d6881f908b..ec999f32c840 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -434,17 +434,22 @@ static struct pid *good_sigevent(sigevent_t * event)
 {
         struct task_struct *rtn = current->group_leader;
 
-        if ((event->sigev_notify & SIGEV_THREAD_ID ) &&
-                (!(rtn = find_task_by_vpid(event->sigev_notify_thread_id)) ||
-                 !same_thread_group(rtn, current) ||
-                 (event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_SIGNAL))
+        switch (event->sigev_notify) {
+        case SIGEV_SIGNAL | SIGEV_THREAD_ID:
+                rtn = find_task_by_vpid(event->sigev_notify_thread_id);
+                if (!rtn || !same_thread_group(rtn, current))
+                        return NULL;
+                /* FALLTHRU */
+        case SIGEV_SIGNAL:
+        case SIGEV_THREAD:
+                if (event->sigev_signo <= 0 || event->sigev_signo > SIGRTMAX)
+                        return NULL;
+                /* FALLTHRU */
+        case SIGEV_NONE:
+                return task_pid(rtn);
+        default:
                 return NULL;
-
-        if (((event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) &&
-            ((event->sigev_signo <= 0) || (event->sigev_signo > SIGRTMAX)))
-                return NULL;
-
-        return task_pid(rtn);
+        }
 }
 
 static struct k_itimer * alloc_posix_timer(void)
@@ -669,7 +674,7 @@ void common_timer_get(struct k_itimer *timr, struct itimerspec64 *cur_setting)
         struct timespec64 ts64;
         bool sig_none;
 
-        sig_none = (timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE;
+        sig_none = timr->it_sigev_notify == SIGEV_NONE;
         iv = timr->it_interval;
 
         /* interval timer ? */
@@ -856,7 +861,7 @@ int common_timer_set(struct k_itimer *timr, int flags,
 
         timr->it_interval = timespec64_to_ktime(new_setting->it_interval);
         expires = timespec64_to_ktime(new_setting->it_value);
-        sigev_none = (timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE;
+        sigev_none = timr->it_sigev_notify == SIGEV_NONE;
 
         kc->timer_arm(timr, expires, flags & TIMER_ABSTIME, sigev_none);
         timr->it_active = !sigev_none;
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 99578f06c8d4..f7cc7abfcf25 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -650,6 +650,11 @@ static void tick_nohz_restart(struct tick_sched *ts, ktime_t now)
         ts->next_tick = 0;
 }
 
+static inline bool local_timer_softirq_pending(void)
+{
+        return local_softirq_pending() & TIMER_SOFTIRQ;
+}
+
 static ktime_t tick_nohz_stop_sched_tick(struct tick_sched *ts,
                                          ktime_t now, int cpu)
 {
@@ -666,8 +671,18 @@ static ktime_t tick_nohz_stop_sched_tick(struct tick_sched *ts,
         } while (read_seqretry(&jiffies_lock, seq));
         ts->last_jiffies = basejiff;
 
-        if (rcu_needs_cpu(basemono, &next_rcu) ||
-            arch_needs_cpu() || irq_work_needs_cpu()) {
+        /*
+         * Keep the periodic tick, when RCU, architecture or irq_work
+         * requests it.
+         * Aside of that check whether the local timer softirq is
+         * pending. If so its a bad idea to call get_next_timer_interrupt()
+         * because there is an already expired timer, so it will request
+         * immeditate expiry, which rearms the hardware timer with a
+         * minimal delta which brings us back to this place
+         * immediately. Lather, rinse and repeat...
+         */
+        if (rcu_needs_cpu(basemono, &next_rcu) || arch_needs_cpu() ||
+            irq_work_needs_cpu() || local_timer_softirq_pending()) {
                 next_tick = basemono + TICK_NSEC;
         } else {
                 /*
@@ -986,6 +1001,19 @@ ktime_t tick_nohz_get_sleep_length(void)
 }
 
 /**
+ * tick_nohz_get_idle_calls_cpu - return the current idle calls counter value
+ * for a particular CPU.
+ *
+ * Called from the schedutil frequency scaling governor in scheduler context.
+ */
+unsigned long tick_nohz_get_idle_calls_cpu(int cpu)
+{
+        struct tick_sched *ts = tick_get_tick_sched(cpu);
+
+        return ts->idle_calls;
+}
+
+/**
  * tick_nohz_get_idle_calls - return the current idle calls counter value
  *
  * Called from the schedutil frequency scaling governor in scheduler context.
diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index ffebcf878fba..0bcf00e3ce48 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -823,11 +823,10 @@ static inline struct timer_base *get_timer_cpu_base(u32 tflags, u32 cpu)
         struct timer_base *base = per_cpu_ptr(&timer_bases[BASE_STD], cpu);
 
         /*
-         * If the timer is deferrable and nohz is active then we need to use
-         * the deferrable base.
+         * If the timer is deferrable and NO_HZ_COMMON is set then we need
+         * to use the deferrable base.
          */
-        if (IS_ENABLED(CONFIG_NO_HZ_COMMON) && base->nohz_active &&
-            (tflags & TIMER_DEFERRABLE))
+        if (IS_ENABLED(CONFIG_NO_HZ_COMMON) && (tflags & TIMER_DEFERRABLE))
                 base = per_cpu_ptr(&timer_bases[BASE_DEF], cpu);
         return base;
 }
@@ -837,11 +836,10 @@ static inline struct timer_base *get_timer_this_cpu_base(u32 tflags)
         struct timer_base *base = this_cpu_ptr(&timer_bases[BASE_STD]);
 
         /*
-         * If the timer is deferrable and nohz is active then we need to use
-         * the deferrable base.
+         * If the timer is deferrable and NO_HZ_COMMON is set then we need
+         * to use the deferrable base.
          */
-        if (IS_ENABLED(CONFIG_NO_HZ_COMMON) && base->nohz_active &&
-            (tflags & TIMER_DEFERRABLE))
+        if (IS_ENABLED(CONFIG_NO_HZ_COMMON) && (tflags & TIMER_DEFERRABLE))
                 base = this_cpu_ptr(&timer_bases[BASE_DEF]);
         return base;
 }
@@ -1009,8 +1007,6 @@ __mod_timer(struct timer_list *timer, unsigned long expires, unsigned int option
         if (!ret && (options & MOD_TIMER_PENDING_ONLY))
                 goto out_unlock;
 
-        debug_activate(timer, expires);
-
         new_base = get_target_base(base, timer->flags);
 
         if (base != new_base) {
@@ -1034,6 +1030,8 @@ __mod_timer(struct timer_list *timer, unsigned long expires, unsigned int option
                 }
         }
 
+        debug_activate(timer, expires);
+
         timer->expires = expires;
         /*
          * If 'idx' was calculated above and the base time did not advance
@@ -1684,7 +1682,7 @@ static __latent_entropy void run_timer_softirq(struct softirq_action *h)
         base->must_forward_clk = false;
 
         __run_timers(base);
-        if (IS_ENABLED(CONFIG_NO_HZ_COMMON) && base->nohz_active)
+        if (IS_ENABLED(CONFIG_NO_HZ_COMMON))
                 __run_timers(this_cpu_ptr(&timer_bases[BASE_DEF]));
 }
 
@@ -1698,7 +1696,7 @@ void run_local_timers(void)
         hrtimer_run_queues();
         /* Raise the softirq only if required. */
         if (time_before(jiffies, base->clk)) {
-                if (!IS_ENABLED(CONFIG_NO_HZ_COMMON) || !base->nohz_active)
+                if (!IS_ENABLED(CONFIG_NO_HZ_COMMON))
                         return;
                 /* CPU is awake, so check the deferrable base. */
                 base++;
@@ -1855,6 +1853,21 @@ static void migrate_timer_list(struct timer_base *new_base, struct hlist_head *h
         }
 }
 
+int timers_prepare_cpu(unsigned int cpu)
+{
+        struct timer_base *base;
+        int b;
+
+        for (b = 0; b < NR_BASES; b++) {
+                base = per_cpu_ptr(&timer_bases[b], cpu);
+                base->clk = jiffies;
+                base->next_expiry = base->clk + NEXT_TIMER_MAX_DELTA;
+                base->is_idle = false;
+                base->must_forward_clk = true;
+        }
+        return 0;
+}
+
 int timers_dead_cpu(unsigned int cpu)
 {
         struct timer_base *old_base;
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index af7dad126c13..f54dc62b599c 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -164,6 +164,7 @@ config PREEMPTIRQ_EVENTS
         bool "Enable trace events for preempt and irq disable/enable"
         select TRACE_IRQFLAGS
         depends on DEBUG_PREEMPT || !PROVE_LOCKING
+        depends on TRACING
         default n
         help
           Enable tracing of disable and enable events for preemption and irqs.
@@ -354,7 +355,7 @@ config PROFILE_ANNOTATED_BRANCHES
           on if you need to profile the system's use of these macros.
 
 config PROFILE_ALL_BRANCHES
-        bool "Profile all if conditionals"
+        bool "Profile all if conditionals" if !FORTIFY_SOURCE
         select TRACE_BRANCH_PROFILING
         help
           This tracer profiles all branch conditions. Every if ()
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 27d1f4ffa3de..40207c2a4113 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -343,14 +343,13 @@ static const struct bpf_func_proto bpf_perf_event_read_value_proto = {
         .arg4_type      = ARG_CONST_SIZE,
 };
 
-static DEFINE_PER_CPU(struct perf_sample_data, bpf_sd);
+static DEFINE_PER_CPU(struct perf_sample_data, bpf_trace_sd);
 
 static __always_inline u64
 __bpf_perf_event_output(struct pt_regs *regs, struct bpf_map *map,
-                        u64 flags, struct perf_raw_record *raw)
+                        u64 flags, struct perf_sample_data *sd)
 {
         struct bpf_array *array = container_of(map, struct bpf_array, map);
-        struct perf_sample_data *sd = this_cpu_ptr(&bpf_sd);
         unsigned int cpu = smp_processor_id();
         u64 index = flags & BPF_F_INDEX_MASK;
         struct bpf_event_entry *ee;
@@ -373,8 +372,6 @@ __bpf_perf_event_output(struct pt_regs *regs, struct bpf_map *map,
         if (unlikely(event->oncpu != cpu))
                 return -EOPNOTSUPP;
 
-        perf_sample_data_init(sd, 0, 0);
-        sd->raw = raw;
         perf_event_output(event, sd, regs);
         return 0;
 }
@@ -382,6 +379,7 @@ __bpf_perf_event_output(struct pt_regs *regs, struct bpf_map *map,
 BPF_CALL_5(bpf_perf_event_output, struct pt_regs *, regs, struct bpf_map *, map,
            u64, flags, void *, data, u64, size)
 {
+        struct perf_sample_data *sd = this_cpu_ptr(&bpf_trace_sd);
         struct perf_raw_record raw = {
                 .frag = {
                         .size = size,
@@ -392,7 +390,10 @@ BPF_CALL_5(bpf_perf_event_output, struct pt_regs *, regs, struct bpf_map *, map,
         if (unlikely(flags & ~(BPF_F_INDEX_MASK)))
                 return -EINVAL;
 
-        return __bpf_perf_event_output(regs, map, flags, &raw);
+        perf_sample_data_init(sd, 0, 0);
+        sd->raw = &raw;
+
+        return __bpf_perf_event_output(regs, map, flags, sd);
 }
 
 static const struct bpf_func_proto bpf_perf_event_output_proto = {
@@ -407,10 +408,12 @@ static const struct bpf_func_proto bpf_perf_event_output_proto = {
 };
 
 static DEFINE_PER_CPU(struct pt_regs, bpf_pt_regs);
+static DEFINE_PER_CPU(struct perf_sample_data, bpf_misc_sd);
 
 u64 bpf_event_output(struct bpf_map *map, u64 flags, void *meta, u64 meta_size,
                      void *ctx, u64 ctx_size, bpf_ctx_copy_t ctx_copy)
 {
+        struct perf_sample_data *sd = this_cpu_ptr(&bpf_misc_sd);
         struct pt_regs *regs = this_cpu_ptr(&bpf_pt_regs);
         struct perf_raw_frag frag = {
                 .copy           = ctx_copy,
@@ -428,8 +431,10 @@ u64 bpf_event_output(struct bpf_map *map, u64 flags, void *meta, u64 meta_size,
         };
 
         perf_fetch_caller_regs(regs);
+        perf_sample_data_init(sd, 0, 0);
+        sd->raw = &raw;
 
-        return __bpf_perf_event_output(regs, map, flags, &raw);
+        return __bpf_perf_event_output(regs, map, flags, sd);
 }
 
 BPF_CALL_0(bpf_get_current_task)
@@ -759,6 +764,8 @@ const struct bpf_prog_ops perf_event_prog_ops = {
 
 static DEFINE_MUTEX(bpf_event_mutex);
 
+#define BPF_TRACE_MAX_PROGS 64
+
 int perf_event_attach_bpf_prog(struct perf_event *event,
                                struct bpf_prog *prog)
 {
@@ -772,6 +779,12 @@ int perf_event_attach_bpf_prog(struct perf_event *event,
                 goto unlock;
 
         old_array = event->tp_event->prog_array;
+        if (old_array &&
+            bpf_prog_array_length(old_array) >= BPF_TRACE_MAX_PROGS) {
+                ret = -E2BIG;
+                goto unlock;
+        }
+
         ret = bpf_prog_array_copy(old_array, NULL, prog, &new_array);
         if (ret < 0)
                 goto unlock;
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index ccdf3664e4a9..554b517c61a0 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1119,15 +1119,11 @@ static struct ftrace_ops global_ops = {
 };
 
 /*
- * This is used by __kernel_text_address() to return true if the
- * address is on a dynamically allocated trampoline that would
- * not return true for either core_kernel_text() or
- * is_module_text_address().
+ * Used by the stack undwinder to know about dynamic ftrace trampolines.
  */
-bool is_ftrace_trampoline(unsigned long addr)
+struct ftrace_ops *ftrace_ops_trampoline(unsigned long addr)
 {
-        struct ftrace_ops *op;
-        bool ret = false;
+        struct ftrace_ops *op = NULL;
 
         /*
          * Some of the ops may be dynamically allocated,
@@ -1144,15 +1140,24 @@ bool is_ftrace_trampoline(unsigned long addr)
                 if (op->trampoline && op->trampoline_size)
                         if (addr >= op->trampoline &&
                             addr < op->trampoline + op->trampoline_size) {
-                                ret = true;
-                                goto out;
+                                preempt_enable_notrace();
+                                return op;
                         }
         } while_for_each_ftrace_op(op);
-
- out:
         preempt_enable_notrace();
 
-        return ret;
+        return NULL;
+}
+
+/*
+ * This is used by __kernel_text_address() to return true if the
+ * address is on a dynamically allocated trampoline that would
+ * not return true for either core_kernel_text() or
+ * is_module_text_address().
+ */
+bool is_ftrace_trampoline(unsigned long addr)
+{
+        return ftrace_ops_trampoline(addr) != NULL;
 }
 
 struct ftrace_page {
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 91874a95060d..5af2842dea96 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -280,6 +280,8 @@ EXPORT_SYMBOL_GPL(ring_buffer_event_data);
 /* Missed count stored at end */
 #define RB_MISSED_STORED        (1 << 30)
 
+#define RB_MISSED_FLAGS         (RB_MISSED_EVENTS|RB_MISSED_STORED)
+
 struct buffer_data_page {
         u64              time_stamp;    /* page time stamp */
         local_t          commit;        /* write committed index */
@@ -331,7 +333,9 @@ static void rb_init_page(struct buffer_data_page *bpage)
  */
 size_t ring_buffer_page_len(void *page)
 {
-        return local_read(&((struct buffer_data_page *)page)->commit)
+        struct buffer_data_page *bpage = page;
+
+        return (local_read(&bpage->commit) & ~RB_MISSED_FLAGS)
                 + BUF_PAGE_HDR_SIZE;
 }
 
@@ -1799,12 +1803,6 @@ void ring_buffer_change_overwrite(struct ring_buffer *buffer, int val)
 }
 EXPORT_SYMBOL_GPL(ring_buffer_change_overwrite);
 
-static __always_inline void *
-__rb_data_page_index(struct buffer_data_page *bpage, unsigned index)
-{
-        return bpage->data + index;
-}
-
 static __always_inline void *__rb_page_index(struct buffer_page *bpage, unsigned index)
 {
         return bpage->page->data + index;
@@ -2536,29 +2534,58 @@ rb_wakeups(struct ring_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer)
  * The lock and unlock are done within a preempt disable section.
  * The current_context per_cpu variable can only be modified
  * by the current task between lock and unlock. But it can
- * be modified more than once via an interrupt. There are four
- * different contexts that we need to consider.
+ * be modified more than once via an interrupt. To pass this
+ * information from the lock to the unlock without having to
+ * access the 'in_interrupt()' functions again (which do show
+ * a bit of overhead in something as critical as function tracing,
+ * we use a bitmask trick.
+ *
+ *  bit 0 =  NMI context
+ *  bit 1 =  IRQ context
+ *  bit 2 =  SoftIRQ context
+ *  bit 3 =  normal context.
+ *
+ * This works because this is the order of contexts that can
+ * preempt other contexts. A SoftIRQ never preempts an IRQ
+ * context.
+ *
+ * When the context is determined, the corresponding bit is
+ * checked and set (if it was set, then a recursion of that context
+ * happened).
+ *
+ * On unlock, we need to clear this bit. To do so, just subtract
+ * 1 from the current_context and AND it to itself.
  *
- *  Normal context.
- *  SoftIRQ context
- *  IRQ context
- *  NMI context
+ * (binary)
+ *  101 - 1 = 100
+ *  101 & 100 = 100 (clearing bit zero)
  *
- * If for some reason the ring buffer starts to recurse, we
- * only allow that to happen at most 4 times (one for each
- * context). If it happens 5 times, then we consider this a
- * recusive loop and do not let it go further.
+ *  1010 - 1 = 1001
+ *  1010 & 1001 = 1000 (clearing bit 1)
+ *
+ * The least significant bit can be cleared this way, and it
+ * just so happens that it is the same bit corresponding to
+ * the current context.
  */
 
 static __always_inline int
 trace_recursive_lock(struct ring_buffer_per_cpu *cpu_buffer)
 {
-        if (cpu_buffer->current_context >= 4)
+        unsigned int val = cpu_buffer->current_context;
+        unsigned long pc = preempt_count();
+        int bit;
+
+        if (!(pc & (NMI_MASK | HARDIRQ_MASK | SOFTIRQ_OFFSET)))
+                bit = RB_CTX_NORMAL;
+        else
+                bit = pc & NMI_MASK ? RB_CTX_NMI :
+                        pc & HARDIRQ_MASK ? RB_CTX_IRQ : RB_CTX_SOFTIRQ;
+
+        if (unlikely(val & (1 << bit)))
                 return 1;
 
-        cpu_buffer->current_context++;
-        /* Interrupts must see this update */
-        barrier();
+        val |= (1 << bit);
+        cpu_buffer->current_context = val;
 
         return 0;
 }
@@ -2566,9 +2593,7 @@ trace_recursive_lock(struct ring_buffer_per_cpu *cpu_buffer)
 static __always_inline void
 trace_recursive_unlock(struct ring_buffer_per_cpu *cpu_buffer)
 {
-        /* Don't let the dec leak out */
-        barrier();
-        cpu_buffer->current_context--;
+        cpu_buffer->current_context &= cpu_buffer->current_context - 1;
 }
 
 /**
@@ -4406,8 +4431,13 @@ void ring_buffer_free_read_page(struct ring_buffer *buffer, int cpu, void *data)
 {
         struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
         struct buffer_data_page *bpage = data;
+        struct page *page = virt_to_page(bpage);
         unsigned long flags;
 
+        /* If the page is still in use someplace else, we can't reuse it */
+        if (page_ref_count(page) > 1)
+                goto out;
+
         local_irq_save(flags);
         arch_spin_lock(&cpu_buffer->lock);
 
@@ -4419,6 +4449,7 @@ void ring_buffer_free_read_page(struct ring_buffer *buffer, int cpu, void *data)
         arch_spin_unlock(&cpu_buffer->lock);
         local_irq_restore(flags);
 
+ out:
         free_page((unsigned long)bpage);
 }
 EXPORT_SYMBOL_GPL(ring_buffer_free_read_page);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 73e67b68c53b..8e3f20a18a06 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -362,7 +362,7 @@ trace_ignore_this_task(struct trace_pid_list *filtered_pids, struct task_struct
 }
 
 /**
- * trace_pid_filter_add_remove - Add or remove a task from a pid_list
+ * trace_pid_filter_add_remove_task - Add or remove a task from a pid_list
  * @pid_list: The list to modify
  * @self: The current task for fork or NULL for exit
  * @task: The task to add or remove
@@ -925,7 +925,7 @@ static void tracing_snapshot_instance(struct trace_array *tr)
 }
 
 /**
- * trace_snapshot - take a snapshot of the current buffer.
+ * tracing_snapshot - take a snapshot of the current buffer.
  *
  * This causes a swap between the snapshot buffer and the current live
  * tracing buffer. You can use this to take snapshots of the live
@@ -1004,9 +1004,9 @@ int tracing_alloc_snapshot(void)
 EXPORT_SYMBOL_GPL(tracing_alloc_snapshot);
 
 /**
- * trace_snapshot_alloc - allocate and take a snapshot of the current buffer.
+ * tracing_snapshot_alloc - allocate and take a snapshot of the current buffer.
  *
- * This is similar to trace_snapshot(), but it will allocate the
+ * This is similar to tracing_snapshot(), but it will allocate the
  * snapshot buffer if it isn't already allocated. Use this only
  * where it is safe to sleep, as the allocation may sleep.
  *
@@ -1303,7 +1303,7 @@ unsigned long __read_mostly	tracing_thresh;
 /*
  * Copy the new maximum trace into the separate maximum-trace
  * structure. (this way the maximum trace is permanently saved,
- * for later retrieval via /sys/kernel/debug/tracing/latency_trace)
+ * for later retrieval via /sys/kernel/tracing/tracing_max_latency)
  */
 static void
 __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
@@ -2374,6 +2374,15 @@ void trace_event_buffer_commit(struct trace_event_buffer *fbuffer)
 }
 EXPORT_SYMBOL_GPL(trace_event_buffer_commit);
 
+/*
+ * Skip 3:
+ *
+ *   trace_buffer_unlock_commit_regs()
+ *   trace_event_buffer_commit()
+ *   trace_event_raw_event_xxx()
+*/
+# define STACK_SKIP 3
+
 void trace_buffer_unlock_commit_regs(struct trace_array *tr,
                                      struct ring_buffer *buffer,
                                      struct ring_buffer_event *event,
@@ -2383,16 +2392,12 @@ void trace_buffer_unlock_commit_regs(struct trace_array *tr,
         __buffer_unlock_commit(buffer, event);
 
         /*
-         * If regs is not set, then skip the following callers:
-         *   trace_buffer_unlock_commit_regs
-         *   event_trigger_unlock_commit
-         *   trace_event_buffer_commit
-         *   trace_event_raw_event_sched_switch
+         * If regs is not set, then skip the necessary functions.
          * Note, we can still get here via blktrace, wakeup tracer
          * and mmiotrace, but that's ok if they lose a function or
-         * two. They are that meaningful.
+         * two. They are not that meaningful.
          */
-        ftrace_trace_stack(tr, buffer, flags, regs ? 0 : 4, pc, regs);
+        ftrace_trace_stack(tr, buffer, flags, regs ? 0 : STACK_SKIP, pc, regs);
         ftrace_trace_userstack(buffer, flags, pc);
 }
 
@@ -2415,7 +2420,7 @@ trace_process_export(struct trace_export *export,
 
         entry = ring_buffer_event_data(event);
         size = ring_buffer_event_length(event);
-        export->write(entry, size);
+        export->write(export, entry, size);
 }
 
 static DEFINE_MUTEX(ftrace_export_lock);
@@ -2579,11 +2584,13 @@ static void __ftrace_trace_stack(struct ring_buffer *buffer,
         trace.skip              = skip;
 
         /*
-         * Add two, for this function and the call to save_stack_trace()
+         * Add one, for this function and the call to save_stack_trace()
          * If regs is set, then these functions will not be in the way.
          */
+#ifndef CONFIG_UNWINDER_ORC
         if (!regs)
-                trace.skip += 2;
+                trace.skip++;
+#endif
 
         /*
          * Since events can happen in NMIs there's no safe way to
@@ -2711,11 +2718,10 @@ void trace_dump_stack(int skip)
 
         local_save_flags(flags);
 
-        /*
-         * Skip 3 more, seems to get us at the caller of
-         * this function.
-         */
-        skip += 3;
+#ifndef CONFIG_UNWINDER_ORC
+        /* Skip 1 to skip this function. */
+        skip++;
+#endif
         __ftrace_trace_stack(global_trace.trace_buffer.buffer,
                              flags, skip, preempt_count(), NULL);
 }
@@ -4178,37 +4184,30 @@ static const struct file_operations show_traces_fops = {
         .llseek         = seq_lseek,
 };
 
-/*
- * The tracer itself will not take this lock, but still we want
- * to provide a consistent cpumask to user-space:
- */
-static DEFINE_MUTEX(tracing_cpumask_update_lock);
-
-/*
- * Temporary storage for the character representation of the
- * CPU bitmask (and one more byte for the newline):
- */
-static char mask_str[NR_CPUS + 1];
-
 static ssize_t
 tracing_cpumask_read(struct file *filp, char __user *ubuf,
                      size_t count, loff_t *ppos)
 {
         struct trace_array *tr = file_inode(filp)->i_private;
+        char *mask_str;
         int len;
 
-        mutex_lock(&tracing_cpumask_update_lock);
+        len = snprintf(NULL, 0, "%*pb\n",
+                       cpumask_pr_args(tr->tracing_cpumask)) + 1;
+        mask_str = kmalloc(len, GFP_KERNEL);
+        if (!mask_str)
+                return -ENOMEM;
 
-        len = snprintf(mask_str, count, "%*pb\n",
+        len = snprintf(mask_str, len, "%*pb\n",
                        cpumask_pr_args(tr->tracing_cpumask));
         if (len >= count) {
                 count = -EINVAL;
                 goto out_err;
         }
-        count = simple_read_from_buffer(ubuf, count, ppos, mask_str, NR_CPUS+1);
+        count = simple_read_from_buffer(ubuf, count, ppos, mask_str, len);
 
 out_err:
-        mutex_unlock(&tracing_cpumask_update_lock);
+        kfree(mask_str);
 
         return count;
 }
@@ -4228,8 +4227,6 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf,
         if (err)
                 goto err_unlock;
 
-        mutex_lock(&tracing_cpumask_update_lock);
-
         local_irq_disable();
         arch_spin_lock(&tr->max_lock);
         for_each_tracing_cpu(cpu) {
@@ -4252,8 +4249,6 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf,
         local_irq_enable();
 
         cpumask_copy(tr->tracing_cpumask, tracing_cpumask_new);
-
-        mutex_unlock(&tracing_cpumask_update_lock);
         free_cpumask_var(tracing_cpumask_new);
 
         return count;
@@ -6780,7 +6775,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
                 .spd_release    = buffer_spd_release,
         };
         struct buffer_ref *ref;
-        int entries, size, i;
+        int entries, i;
         ssize_t ret = 0;
 
 #ifdef CONFIG_TRACER_MAX_TRACE
@@ -6834,14 +6829,6 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
                         break;
                 }
 
-                /*
-                 * zero out any left over data, this is going to
-                 * user land.
-                 */
-                size = ring_buffer_page_len(ref->page);
-                if (size < PAGE_SIZE)
-                        memset(ref->page + size, 0, PAGE_SIZE - size);
-
                 page = virt_to_page(ref->page);
 
                 spd.pages[i] = page;
@@ -7599,6 +7586,7 @@ allocate_trace_buffer(struct trace_array *tr, struct trace_buffer *buf, int size
         buf->data = alloc_percpu(struct trace_array_cpu);
         if (!buf->data) {
                 ring_buffer_free(buf->buffer);
+                buf->buffer = NULL;
                 return -ENOMEM;
         }
 
@@ -7622,7 +7610,9 @@ static int allocate_trace_buffers(struct trace_array *tr, int size)
                                     allocate_snapshot ? size : 1);
         if (WARN_ON(ret)) {
                 ring_buffer_free(tr->trace_buffer.buffer);
+                tr->trace_buffer.buffer = NULL;
                 free_percpu(tr->trace_buffer.data);
+                tr->trace_buffer.data = NULL;
                 return -ENOMEM;
         }
         tr->allocated_snapshot = allocate_snapshot;
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index ec0f9aa4e151..1b87157edbff 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -2213,6 +2213,7 @@ void trace_event_eval_update(struct trace_eval_map **map, int len)
 {
         struct trace_event_call *call, *p;
         const char *last_system = NULL;
+        bool first = false;
         int last_i;
         int i;
 
@@ -2220,15 +2221,28 @@ void trace_event_eval_update(struct trace_eval_map **map, int len)
         list_for_each_entry_safe(call, p, &ftrace_events, list) {
                 /* events are usually grouped together with systems */
                 if (!last_system || call->class->system != last_system) {
+                        first = true;
                         last_i = 0;
                         last_system = call->class->system;
                 }
 
+                /*
+                 * Since calls are grouped by systems, the likelyhood that the
+                 * next call in the iteration belongs to the same system as the
+                 * previous call is high. As an optimization, we skip seaching
+                 * for a map[] that matches the call's system if the last call
+                 * was from the same system. That's what last_i is for. If the
+                 * call has the same system as the previous call, then last_i
+                 * will be the index of the first map[] that has a matching
+                 * system.
+                 */
                 for (i = last_i; i < len; i++) {
                         if (call->class->system == map[i]->system) {
                                 /* Save the first system if need be */
-                                if (!last_i)
+                                if (first) {
                                         last_i = i;
+                                        first = false;
+                                }
                                 update_event_printk(call, map[i]);
                         }
                 }
diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index f2ac9d44f6c4..87411482a46f 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -1123,13 +1123,22 @@ static __init int register_trigger_snapshot_cmd(void) { return 0; }
 #endif /* CONFIG_TRACER_SNAPSHOT */
 
 #ifdef CONFIG_STACKTRACE
+#ifdef CONFIG_UNWINDER_ORC
+/* Skip 2:
+ *   event_triggers_post_call()
+ *   trace_event_raw_event_xxx()
+ */
+# define STACK_SKIP 2
+#else
 /*
- * Skip 3:
+ * Skip 4:
  *   stacktrace_trigger()
  *   event_triggers_post_call()
+ *   trace_event_buffer_commit()
  *   trace_event_raw_event_xxx()
  */
-#define STACK_SKIP 3
+#define STACK_SKIP 4
+#endif
 
 static void
 stacktrace_trigger(struct event_trigger_data *data, void *rec)
diff --git a/kernel/trace/trace_functions.c b/kernel/trace/trace_functions.c
index 27f7ad12c4b1..b611cd36e22d 100644
--- a/kernel/trace/trace_functions.c
+++ b/kernel/trace/trace_functions.c
@@ -154,6 +154,24 @@ function_trace_call(unsigned long ip, unsigned long parent_ip,
         preempt_enable_notrace();
 }
 
+#ifdef CONFIG_UNWINDER_ORC
+/*
+ * Skip 2:
+ *
+ *   function_stack_trace_call()
+ *   ftrace_call()
+ */
+#define STACK_SKIP 2
+#else
+/*
+ * Skip 3:
+ *   __trace_stack()
+ *   function_stack_trace_call()
+ *   ftrace_call()
+ */
+#define STACK_SKIP 3
+#endif
+
 static void
 function_stack_trace_call(unsigned long ip, unsigned long parent_ip,
                           struct ftrace_ops *op, struct pt_regs *pt_regs)
@@ -180,15 +198,7 @@ function_stack_trace_call(unsigned long ip, unsigned long parent_ip,
         if (likely(disabled == 1)) {
                 pc = preempt_count();
                 trace_function(tr, ip, parent_ip, flags, pc);
-                /*
-                 * skip over 5 funcs:
-                 *    __ftrace_trace_stack,
-                 *    __trace_stack,
-                 *    function_stack_trace_call
-                 *    ftrace_list_func
-                 *    ftrace_call
-                 */
-                __trace_stack(tr, flags, 5, pc);
+                __trace_stack(tr, flags, STACK_SKIP, pc);
         }
 
         atomic_dec(&data->disabled);
@@ -367,14 +377,27 @@ ftrace_traceoff(unsigned long ip, unsigned long parent_ip,
         tracer_tracing_off(tr);
 }
 
+#ifdef CONFIG_UNWINDER_ORC
 /*
- * Skip 4:
+ * Skip 3:
+ *
+ *   function_trace_probe_call()
+ *   ftrace_ops_assist_func()
+ *   ftrace_call()
+ */
+#define FTRACE_STACK_SKIP 3
+#else
+/*
+ * Skip 5:
+ *
+ *   __trace_stack()
  *   ftrace_stacktrace()
  *   function_trace_probe_call()
- *   ftrace_ops_list_func()
+ *   ftrace_ops_assist_func()
  *   ftrace_call()
  */
-#define STACK_SKIP 4
+#define FTRACE_STACK_SKIP 5
+#endif
 
 static __always_inline void trace_stack(struct trace_array *tr)
 {
@@ -384,7 +407,7 @@ static __always_inline void trace_stack(struct trace_array *tr)
         local_save_flags(flags);
         pc = preempt_count();
 
-        __trace_stack(tr, flags, STACK_SKIP, pc);
+        __trace_stack(tr, flags, FTRACE_STACK_SKIP, pc);
 }
 
 static void
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 734accc02418..3c7bfc4bf5e9 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -209,6 +209,10 @@ stack_trace_call(unsigned long ip, unsigned long parent_ip,
         if (__this_cpu_read(disable_stack_tracer) != 1)
                 goto out;
 
+        /* If rcu is not watching, then save stack trace can fail */
+        if (!rcu_is_watching())
+                goto out;
+
         ip += MCOUNT_INSN_SIZE;
 
         check_stack(ip, &stack);
diff --git a/kernel/uid16.c b/kernel/uid16.c
index ce74a4901d2b..ef1da2a5f9bd 100644
--- a/kernel/uid16.c
+++ b/kernel/uid16.c
@@ -192,6 +192,7 @@ SYSCALL_DEFINE2(setgroups16, int, gidsetsize, old_gid_t __user *, grouplist)
                 return retval;
         }
 
+        groups_sort(group_info);
         retval = set_current_groups(group_info);
         put_group_info(group_info);
 
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 8fdb710bfdd7..f699122dab32 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -38,7 +38,6 @@
 #include <linux/hardirq.h>
 #include <linux/mempolicy.h>
 #include <linux/freezer.h>
-#include <linux/kallsyms.h>
 #include <linux/debug_locks.h>
 #include <linux/lockdep.h>
 #include <linux/idr.h>
@@ -48,6 +47,8 @@
 #include <linux/nodemask.h>
 #include <linux/moduleparam.h>
 #include <linux/uaccess.h>
+#include <linux/sched/isolation.h>
+#include <linux/nmi.h>
 
 #include "workqueue_internal.h"
 
@@ -1634,7 +1635,7 @@ static void worker_enter_idle(struct worker *worker)
                 mod_timer(&pool->idle_timer, jiffies + IDLE_WORKER_TIMEOUT);
 
         /*
-         * Sanity check nr_running.  Because wq_unbind_fn() releases
+         * Sanity check nr_running.  Because unbind_workers() releases
          * pool->lock between setting %WORKER_UNBOUND and zapping
          * nr_running, the warning may trigger spuriously.  Check iff
          * unbind is not in progress.
@@ -4463,6 +4464,12 @@ void show_workqueue_state(void)
                         if (pwq->nr_active || !list_empty(&pwq->delayed_works))
                                 show_pwq(pwq);
                         spin_unlock_irqrestore(&pwq->pool->lock, flags);
+                        /*
+                         * We could be printing a lot from atomic context, e.g.
+                         * sysrq-t -> show_workqueue_state(). Avoid triggering
+                         * hard lockup.
+                         */
+                        touch_nmi_watchdog();
                 }
         }
 
@@ -4490,6 +4497,12 @@ void show_workqueue_state(void)
                 pr_cont("\n");
         next_pool:
                 spin_unlock_irqrestore(&pool->lock, flags);
+                /*
+                 * We could be printing a lot from atomic context, e.g.
+                 * sysrq-t -> show_workqueue_state(). Avoid triggering
+                 * hard lockup.
+                 */
+                touch_nmi_watchdog();
         }
 
         rcu_read_unlock_sched();
@@ -4510,9 +4523,8 @@ void show_workqueue_state(void)
  * cpu comes back online.
  */
 
-static void wq_unbind_fn(struct work_struct *work)
+static void unbind_workers(int cpu)
 {
-        int cpu = smp_processor_id();
         struct worker_pool *pool;
         struct worker *worker;
 
@@ -4589,16 +4601,6 @@ static void rebind_workers(struct worker_pool *pool)
 
         spin_lock_irq(&pool->lock);
 
-        /*
-         * XXX: CPU hotplug notifiers are weird and can call DOWN_FAILED
-         * w/o preceding DOWN_PREPARE.  Work around it.  CPU hotplug is
-         * being reworked and this can go away in time.
-         */
-        if (!(pool->flags & POOL_DISASSOCIATED)) {
-                spin_unlock_irq(&pool->lock);
-                return;
-        }
-
         pool->flags &= ~POOL_DISASSOCIATED;
 
         for_each_pool_worker(worker, pool) {
@@ -4709,12 +4711,13 @@ int workqueue_online_cpu(unsigned int cpu)
 
 int workqueue_offline_cpu(unsigned int cpu)
 {
-        struct work_struct unbind_work;
         struct workqueue_struct *wq;
 
         /* unbinding per-cpu workers should happen on the local CPU */
-        INIT_WORK_ONSTACK(&unbind_work, wq_unbind_fn);
-        queue_work_on(cpu, system_highpri_wq, &unbind_work);
+        if (WARN_ON(cpu != smp_processor_id()))
+                return -1;
+
+        unbind_workers(cpu);
 
         /* update NUMA affinity of unbound workqueues */
         mutex_lock(&wq_pool_mutex);
@@ -4722,9 +4725,6 @@ int workqueue_offline_cpu(unsigned int cpu)
                 wq_update_unbound_numa(wq, cpu, false);
         mutex_unlock(&wq_pool_mutex);
 
-        /* wait for per-cpu unbinding to finish */
-        flush_work(&unbind_work);
-        destroy_work_on_stack(&unbind_work);
         return 0;
 }
 
@@ -4957,6 +4957,10 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask)
         if (!zalloc_cpumask_var(&saved_cpumask, GFP_KERNEL))
                 return -ENOMEM;
 
+        /*
+         * Not excluding isolated cpus on purpose.
+         * If the user wishes to include them, we allow that.
+         */
         cpumask_and(cpumask, cpumask, cpu_possible_mask);
         if (!cpumask_empty(cpumask)) {
                 apply_wqattrs_lock();
@@ -5555,7 +5559,7 @@ int __init workqueue_init_early(void)
         WARN_ON(__alignof__(struct pool_workqueue) < __alignof__(long long));
 
         BUG_ON(!alloc_cpumask_var(&wq_unbound_cpumask, GFP_KERNEL));
-        cpumask_copy(wq_unbound_cpumask, cpu_possible_mask);
+        cpumask_copy(wq_unbound_cpumask, housekeeping_cpumask(HK_FLAG_DOMAIN));
 
         pwq_cache = KMEM_CACHE(pool_workqueue, SLAB_PANIC);
 
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 947d3e2ed5c2..9d5b78aad4c5 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1099,8 +1099,6 @@ config PROVE_LOCKING
         select DEBUG_MUTEXES
         select DEBUG_RT_MUTEXES if RT_MUTEXES
         select DEBUG_LOCK_ALLOC
-        select LOCKDEP_CROSSRELEASE
-        select LOCKDEP_COMPLETIONS
         select TRACE_IRQFLAGS
         default n
         help
@@ -1170,37 +1168,6 @@ config LOCK_STAT
          CONFIG_LOCK_STAT defines "contended" and "acquired" lock events.
          (CONFIG_LOCKDEP defines "acquire" and "release" events.)
 
-config LOCKDEP_CROSSRELEASE
-        bool
-        help
-         This makes lockdep work for crosslock which is a lock allowed to
-         be released in a different context from the acquisition context.
-         Normally a lock must be released in the context acquiring the lock.
-         However, relexing this constraint helps synchronization primitives
-         such as page locks or completions can use the lock correctness
-         detector, lockdep.
-
-config LOCKDEP_COMPLETIONS
-        bool
-        help
-         A deadlock caused by wait_for_completion() and complete() can be
-         detected by lockdep using crossrelease feature.
-
-config BOOTPARAM_LOCKDEP_CROSSRELEASE_FULLSTACK
-        bool "Enable the boot parameter, crossrelease_fullstack"
-        depends on LOCKDEP_CROSSRELEASE
-        default n
-        help
-         The lockdep "cross-release" feature needs to record stack traces
-         (of calling functions) for all acquisitions, for eventual later
-         use during analysis. By default only a single caller is recorded,
-         because the unwind operation can be very expensive with deeper
-         stack chains.
-
-         However a boot parameter, crossrelease_fullstack, was
-         introduced since sometimes deeper traces are required for full
-         analysis. This option turns on the boot parameter.
-
 config DEBUG_LOCKDEP
         bool "Lock dependency engine debugging"
         depends on DEBUG_KERNEL && LOCKDEP
diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c
index 1ef0cec38d78..dc14beae2c9a 100644
--- a/lib/asn1_decoder.c
+++ b/lib/asn1_decoder.c
@@ -313,42 +313,47 @@ next_op:
 
         /* Decide how to handle the operation */
         switch (op) {
-        case ASN1_OP_MATCH_ANY_ACT:
-        case ASN1_OP_MATCH_ANY_ACT_OR_SKIP:
-        case ASN1_OP_COND_MATCH_ANY_ACT:
-        case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP:
-                ret = actions[machine[pc + 1]](context, hdr, tag, data + dp, len);
-                if (ret < 0)
-                        return ret;
-                goto skip_data;
-
-        case ASN1_OP_MATCH_ACT:
-        case ASN1_OP_MATCH_ACT_OR_SKIP:
-        case ASN1_OP_COND_MATCH_ACT_OR_SKIP:
-                ret = actions[machine[pc + 2]](context, hdr, tag, data + dp, len);
-                if (ret < 0)
-                        return ret;
-                goto skip_data;
-
         case ASN1_OP_MATCH:
         case ASN1_OP_MATCH_OR_SKIP:
+        case ASN1_OP_MATCH_ACT:
+        case ASN1_OP_MATCH_ACT_OR_SKIP:
         case ASN1_OP_MATCH_ANY:
         case ASN1_OP_MATCH_ANY_OR_SKIP:
+        case ASN1_OP_MATCH_ANY_ACT:
+        case ASN1_OP_MATCH_ANY_ACT_OR_SKIP:
         case ASN1_OP_COND_MATCH_OR_SKIP:
+        case ASN1_OP_COND_MATCH_ACT_OR_SKIP:
         case ASN1_OP_COND_MATCH_ANY:
         case ASN1_OP_COND_MATCH_ANY_OR_SKIP:
-        skip_data:
+        case ASN1_OP_COND_MATCH_ANY_ACT:
+        case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP:
+
                 if (!(flags & FLAG_CONS)) {
                         if (flags & FLAG_INDEFINITE_LENGTH) {
+                                size_t tmp = dp;
+
                                 ret = asn1_find_indefinite_length(
-                                        data, datalen, &dp, &len, &errmsg);
+                                        data, datalen, &tmp, &len, &errmsg);
                                 if (ret < 0)
                                         goto error;
-                        } else {
-                                dp += len;
                         }
                         pr_debug("- LEAF: %zu\n", len);
                 }
+
+                if (op & ASN1_OP_MATCH__ACT) {
+                        unsigned char act;
+
+                        if (op & ASN1_OP_MATCH__ANY)
+                                act = machine[pc + 1];
+                        else
+                                act = machine[pc + 2];
+                        ret = actions[act](context, hdr, tag, data + dp, len);
+                        if (ret < 0)
+                                return ret;
+                }
+
+                if (!(flags & FLAG_CONS))
+                        dp += len;
                 pc += asn1_op_lengths[op];
                 goto next_op;
 
@@ -434,6 +439,8 @@ next_op:
                         else
                                 act = machine[pc + 1];
                         ret = actions[act](context, hdr, 0, data + tdp, len);
+                        if (ret < 0)
+                                return ret;
                 }
                 pc += asn1_op_lengths[op];
                 goto next_op;
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index c3e84edc47c9..2615074d3de5 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -346,7 +346,8 @@ static int kobject_uevent_net_broadcast(struct kobject *kobj,
 static void zap_modalias_env(struct kobj_uevent_env *env)
 {
         static const char modalias_prefix[] = "MODALIAS=";
-        int i;
+        size_t len;
+        int i, j;
 
         for (i = 0; i < env->envp_idx;) {
                 if (strncmp(env->envp[i], modalias_prefix,
@@ -355,11 +356,18 @@ static void zap_modalias_env(struct kobj_uevent_env *env)
                         continue;
                 }
 
-                if (i != env->envp_idx - 1)
-                        memmove(&env->envp[i], &env->envp[i + 1],
-                                sizeof(env->envp[i]) * env->envp_idx - 1);
+                len = strlen(env->envp[i]) + 1;
+
+                if (i != env->envp_idx - 1) {
+                        memmove(env->envp[i], env->envp[i + 1],
+                                env->buflen - len);
+
+                        for (j = i; j < env->envp_idx - 1; j++)
+                                env->envp[j] = env->envp[j + 1] - len;
+                }
 
                 env->envp_idx--;
+                env->buflen -= len;
         }
 }
 
diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h
index 57fd45ab7af1..08c60d10747f 100644
--- a/lib/mpi/longlong.h
+++ b/lib/mpi/longlong.h
@@ -671,7 +671,23 @@ do {						\
         **************  MIPS/64  **************
         ***************************************/
 #if (defined(__mips) && __mips >= 3) && W_TYPE_SIZE == 64
-#if (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
+#if defined(__mips_isa_rev) && __mips_isa_rev >= 6
+/*
+ * GCC ends up emitting a __multi3 intrinsic call for MIPS64r6 with the plain C
+ * code below, so we special case MIPS64r6 until the compiler can do better.
+ */
+#define umul_ppmm(w1, w0, u, v)                                         \
+do {                                                                    \
+        __asm__ ("dmulu %0,%1,%2"                                       \
+                 : "=d" ((UDItype)(w0))                                 \
+                 : "d" ((UDItype)(u)),                                  \
+                   "d" ((UDItype)(v)));                                 \
+        __asm__ ("dmuhu %0,%1,%2"                                       \
+                 : "=d" ((UDItype)(w1))                                 \
+                 : "d" ((UDItype)(u)),                                  \
+                   "d" ((UDItype)(v)));                                 \
+} while (0)
+#elif (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
 #define umul_ppmm(w1, w0, u, v) \
 do {                                                                    \
         typedef unsigned int __ll_UTItype __attribute__((mode(TI)));    \
diff --git a/lib/nlattr.c b/lib/nlattr.c
index 8bf78b4b78f0..dfa55c873c13 100644
--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -15,7 +15,11 @@
 #include <linux/types.h>
 #include <net/netlink.h>
 
-/* for these data types attribute length must be exactly given size */
+/* For these data types, attribute length should be exactly the given
+ * size. However, to maintain compatibility with broken commands, if the
+ * attribute length does not match the expected size a warning is emitted
+ * to the user that the command is sending invalid data and needs to be fixed.
+ */
 static const u8 nla_attr_len[NLA_TYPE_MAX+1] = {
         [NLA_U8]        = sizeof(u8),
         [NLA_U16]       = sizeof(u16),
@@ -28,8 +32,16 @@ static const u8 nla_attr_len[NLA_TYPE_MAX+1] = {
 };
 
 static const u8 nla_attr_minlen[NLA_TYPE_MAX+1] = {
+        [NLA_U8]        = sizeof(u8),
+        [NLA_U16]       = sizeof(u16),
+        [NLA_U32]       = sizeof(u32),
+        [NLA_U64]       = sizeof(u64),
         [NLA_MSECS]     = sizeof(u64),
         [NLA_NESTED]    = NLA_HDRLEN,
+        [NLA_S8]        = sizeof(s8),
+        [NLA_S16]       = sizeof(s16),
+        [NLA_S32]       = sizeof(s32),
+        [NLA_S64]       = sizeof(s64),
 };
 
 static int validate_nla_bitfield32(const struct nlattr *nla,
@@ -69,11 +81,9 @@ static int validate_nla(const struct nlattr *nla, int maxtype,
 
         BUG_ON(pt->type > NLA_TYPE_MAX);
 
-        /* for data types NLA_U* and NLA_S* require exact length */
-        if (nla_attr_len[pt->type]) {
-                if (attrlen != nla_attr_len[pt->type])
-                        return -ERANGE;
-                return 0;
+        if (nla_attr_len[pt->type] && attrlen != nla_attr_len[pt->type]) {
+                pr_warn_ratelimited("netlink: '%s': attribute type %d has an invalid length.\n",
+                                    current->comm, type);
         }
 
         switch (pt->type) {
diff --git a/lib/oid_registry.c b/lib/oid_registry.c
index 41b9e50711a7..0bcac6ccb1b2 100644
--- a/lib/oid_registry.c
+++ b/lib/oid_registry.c
@@ -116,14 +116,14 @@ int sprint_oid(const void *data, size_t datasize, char *buffer, size_t bufsize)
         int count;
 
         if (v >= end)
-                return -EBADMSG;
+                goto bad;
 
         n = *v++;
         ret = count = snprintf(buffer, bufsize, "%u.%u", n / 40, n % 40);
+        if (count >= bufsize)
+                return -ENOBUFS;
         buffer += count;
         bufsize -= count;
-        if (bufsize == 0)
-                return -ENOBUFS;
 
         while (v < end) {
                 num = 0;
@@ -134,20 +134,24 @@ int sprint_oid(const void *data, size_t datasize, char *buffer, size_t bufsize)
                         num = n & 0x7f;
                         do {
                                 if (v >= end)
-                                        return -EBADMSG;
+                                        goto bad;
                                 n = *v++;
                                 num <<= 7;
                                 num |= n & 0x7f;
                         } while (n & 0x80);
                 }
                 ret += count = snprintf(buffer, bufsize, ".%lu", num);
-                buffer += count;
-                if (bufsize <= count)
+                if (count >= bufsize)
                         return -ENOBUFS;
+                buffer += count;
                 bufsize -= count;
         }
 
         return ret;
+
+bad:
+        snprintf(buffer, bufsize, "(bad)");
+        return -EBADMSG;
 }
 EXPORT_SYMBOL_GPL(sprint_oid);
 
diff --git a/lib/rbtree.c b/lib/rbtree.c
index ba4a9d165f1b..d3ff682fd4b8 100644
--- a/lib/rbtree.c
+++ b/lib/rbtree.c
@@ -603,6 +603,16 @@ void rb_replace_node(struct rb_node *victim, struct rb_node *new,
 }
 EXPORT_SYMBOL(rb_replace_node);
 
+void rb_replace_node_cached(struct rb_node *victim, struct rb_node *new,
+                            struct rb_root_cached *root)
+{
+        rb_replace_node(victim, new, &root->rb_root);
+
+        if (root->rb_leftmost == victim)
+                root->rb_leftmost = new;
+}
+EXPORT_SYMBOL(rb_replace_node_cached);
+
 void rb_replace_node_rcu(struct rb_node *victim, struct rb_node *new,
                          struct rb_root *root)
 {
diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index aa8812ae6776..f369889e521d 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -435,6 +435,41 @@ loop:
         return 0;
 }
 
+static int bpf_fill_ld_abs_vlan_push_pop2(struct bpf_test *self)
+{
+        struct bpf_insn *insn;
+
+        insn = kmalloc_array(16, sizeof(*insn), GFP_KERNEL);
+        if (!insn)
+                return -ENOMEM;
+
+        /* Due to func address being non-const, we need to
+         * assemble this here.
+         */
+        insn[0] = BPF_MOV64_REG(R6, R1);
+        insn[1] = BPF_LD_ABS(BPF_B, 0);
+        insn[2] = BPF_LD_ABS(BPF_H, 0);
+        insn[3] = BPF_LD_ABS(BPF_W, 0);
+        insn[4] = BPF_MOV64_REG(R7, R6);
+        insn[5] = BPF_MOV64_IMM(R6, 0);
+        insn[6] = BPF_MOV64_REG(R1, R7);
+        insn[7] = BPF_MOV64_IMM(R2, 1);
+        insn[8] = BPF_MOV64_IMM(R3, 2);
+        insn[9] = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                               bpf_skb_vlan_push_proto.func - __bpf_call_base);
+        insn[10] = BPF_MOV64_REG(R6, R7);
+        insn[11] = BPF_LD_ABS(BPF_B, 0);
+        insn[12] = BPF_LD_ABS(BPF_H, 0);
+        insn[13] = BPF_LD_ABS(BPF_W, 0);
+        insn[14] = BPF_MOV64_IMM(R0, 42);
+        insn[15] = BPF_EXIT_INSN();
+
+        self->u.ptr.insns = insn;
+        self->u.ptr.len = 16;
+
+        return 0;
+}
+
 static int bpf_fill_jump_around_ld_abs(struct bpf_test *self)
 {
         unsigned int len = BPF_MAXINSNS;
@@ -6066,6 +6101,14 @@ static struct bpf_test tests[] = {
                 {},
                 { {0x1, 0x42 } },
         },
+        {
+                "LD_ABS with helper changing skb data",
+                { },
+                INTERNAL,
+                { 0x34 },
+                { { ETH_HLEN, 42 } },
+                .fill_helper = bpf_fill_ld_abs_vlan_push_pop2,
+        },
 };
 
 static struct net_device dev;
@@ -6207,9 +6250,8 @@ static struct bpf_prog *generate_filter(int which, int *err)
                                 return NULL;
                         }
                 }
-                /* We don't expect to fail. */
                 if (*err) {
-                        pr_cont("FAIL to attach err=%d len=%d\n",
+                        pr_cont("FAIL to prog_create err=%d len=%d\n",
                                 *err, fprog.len);
                         return NULL;
                 }
@@ -6233,6 +6275,10 @@ static struct bpf_prog *generate_filter(int which, int *err)
                  * checks.
                  */
                 fp = bpf_prog_select_runtime(fp, err);
+                if (*err) {
+                        pr_cont("FAIL to select_runtime err=%d\n", *err);
+                        return NULL;
+                }
                 break;
         }
 
@@ -6418,8 +6464,8 @@ static __init int test_bpf(void)
                                 pass_cnt++;
                                 continue;
                         }
-
-                        return err;
+                        err_cnt++;
+                        continue;
                 }
 
                 pr_cont("jited:%u ", fp->jited);
diff --git a/lib/timerqueue.c b/lib/timerqueue.c
index 4a720ed4fdaf..0d54bcbc8170 100644
--- a/lib/timerqueue.c
+++ b/lib/timerqueue.c
@@ -33,8 +33,9 @@
  * @head: head of timerqueue
  * @node: timer node to be added
  *
- * Adds the timer node to the timerqueue, sorted by the
- * node's expires value.
+ * Adds the timer node to the timerqueue, sorted by the node's expires
+ * value. Returns true if the newly added timer is the first expiring timer in
+ * the queue.
  */
 bool timerqueue_add(struct timerqueue_head *head, struct timerqueue_node *node)
 {
@@ -70,7 +71,8 @@ EXPORT_SYMBOL_GPL(timerqueue_add);
  * @head: head of timerqueue
  * @node: timer node to be removed
  *
- * Removes the timer node from the timerqueue.
+ * Removes the timer node from the timerqueue. Returns true if the queue is
+ * not empty after the remove.
  */
 bool timerqueue_del(struct timerqueue_head *head, struct timerqueue_node *node)
 {
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 84b2dc76f140..b5f940ce0143 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -882,13 +882,10 @@ int bdi_register_va(struct backing_dev_info *bdi, const char *fmt, va_list args)
         if (IS_ERR(dev))
                 return PTR_ERR(dev);
 
-        if (bdi_debug_register(bdi, dev_name(dev))) {
-                device_destroy(bdi_class, dev->devt);
-                return -ENOMEM;
-        }
         cgwb_bdi_register(bdi);
         bdi->dev = dev;
 
+        bdi_debug_register(bdi, dev_name(dev));
         set_bit(WB_registered, &bdi->wb.state);
 
         spin_lock_bh(&bdi_lock);
diff --git a/mm/debug.c b/mm/debug.c
index d947f3e03b0d..56e2d9125ea5 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -50,7 +50,7 @@ void __dump_page(struct page *page, const char *reason)
          */
         int mapcount = PageSlab(page) ? 0 : page_mapcount(page);
 
-        pr_emerg("page:%p count:%d mapcount:%d mapping:%p index:%#lx",
+        pr_emerg("page:%px count:%d mapcount:%d mapping:%px index:%#lx",
                   page, page_ref_count(page), mapcount,
                   page->mapping, page_to_pgoff(page));
         if (PageCompound(page))
@@ -69,7 +69,7 @@ void __dump_page(struct page *page, const char *reason)
 
 #ifdef CONFIG_MEMCG
         if (page->mem_cgroup)
-                pr_alert("page->mem_cgroup:%p\n", page->mem_cgroup);
+                pr_alert("page->mem_cgroup:%px\n", page->mem_cgroup);
 #endif
 }
 
@@ -84,10 +84,10 @@ EXPORT_SYMBOL(dump_page);
 
 void dump_vma(const struct vm_area_struct *vma)
 {
-        pr_emerg("vma %p start %p end %p\n"
-                "next %p prev %p mm %p\n"
-                "prot %lx anon_vma %p vm_ops %p\n"
-                "pgoff %lx file %p private_data %p\n"
+        pr_emerg("vma %px start %px end %px\n"
+                "next %px prev %px mm %px\n"
+                "prot %lx anon_vma %px vm_ops %px\n"
+                "pgoff %lx file %px private_data %px\n"
                 "flags: %#lx(%pGv)\n",
                 vma, (void *)vma->vm_start, (void *)vma->vm_end, vma->vm_next,
                 vma->vm_prev, vma->vm_mm,
@@ -100,27 +100,27 @@ EXPORT_SYMBOL(dump_vma);
 
 void dump_mm(const struct mm_struct *mm)
 {
-        pr_emerg("mm %p mmap %p seqnum %d task_size %lu\n"
+        pr_emerg("mm %px mmap %px seqnum %d task_size %lu\n"
 #ifdef CONFIG_MMU
-                "get_unmapped_area %p\n"
+                "get_unmapped_area %px\n"
 #endif
                 "mmap_base %lu mmap_legacy_base %lu highest_vm_end %lu\n"
-                "pgd %p mm_users %d mm_count %d pgtables_bytes %lu map_count %d\n"
+                "pgd %px mm_users %d mm_count %d pgtables_bytes %lu map_count %d\n"
                 "hiwater_rss %lx hiwater_vm %lx total_vm %lx locked_vm %lx\n"
                 "pinned_vm %lx data_vm %lx exec_vm %lx stack_vm %lx\n"
                 "start_code %lx end_code %lx start_data %lx end_data %lx\n"
                 "start_brk %lx brk %lx start_stack %lx\n"
                 "arg_start %lx arg_end %lx env_start %lx env_end %lx\n"
-                "binfmt %p flags %lx core_state %p\n"
+                "binfmt %px flags %lx core_state %px\n"
 #ifdef CONFIG_AIO
-                "ioctx_table %p\n"
+                "ioctx_table %px\n"
 #endif
 #ifdef CONFIG_MEMCG
-                "owner %p "
+                "owner %px "
 #endif
-                "exe_file %p\n"
+                "exe_file %px\n"
 #ifdef CONFIG_MMU_NOTIFIER
-                "mmu_notifier_mm %p\n"
+                "mmu_notifier_mm %px\n"
 #endif
 #ifdef CONFIG_NUMA_BALANCING
                 "numa_next_scan %lu numa_scan_offset %lu numa_scan_seq %d\n"
diff --git a/mm/early_ioremap.c b/mm/early_ioremap.c
index d04ac1ec0559..1826f191e72c 100644
--- a/mm/early_ioremap.c
+++ b/mm/early_ioremap.c
@@ -111,7 +111,7 @@ __early_ioremap(resource_size_t phys_addr, unsigned long size, pgprot_t prot)
         enum fixed_addresses idx;
         int i, slot;
 
-        WARN_ON(system_state != SYSTEM_BOOTING);
+        WARN_ON(system_state >= SYSTEM_RUNNING);
 
         slot = -1;
         for (i = 0; i < FIX_BTMAPS_SLOTS; i++) {
diff --git a/mm/frame_vector.c b/mm/frame_vector.c
index 297c7238f7d4..c64dca6e27c2 100644
--- a/mm/frame_vector.c
+++ b/mm/frame_vector.c
@@ -62,8 +62,10 @@ int get_vaddr_frames(unsigned long start, unsigned int nr_frames,
          * get_user_pages_longterm() and disallow it for filesystem-dax
          * mappings.
          */
-        if (vma_is_fsdax(vma))
-                return -EOPNOTSUPP;
+        if (vma_is_fsdax(vma)) {
+                ret = -EOPNOTSUPP;
+                goto out;
+        }
 
         if (!(vma->vm_flags & (VM_IO | VM_PFNMAP))) {
                 vec->got_ref = true;
diff --git a/mm/gup.c b/mm/gup.c
index d3fb60e5bfac..e0d82b6706d7 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -66,7 +66,7 @@ static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address,
  */
 static inline bool can_follow_write_pte(pte_t pte, unsigned int flags)
 {
-        return pte_access_permitted(pte, WRITE) ||
+        return pte_write(pte) ||
                 ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte));
 }
 
diff --git a/mm/hmm.c b/mm/hmm.c
index 3a5c172af560..ea19742a5d60 100644
--- a/mm/hmm.c
+++ b/mm/hmm.c
@@ -391,11 +391,11 @@ again:
                 if (pmd_protnone(pmd))
                         return hmm_vma_walk_clear(start, end, walk);
 
-                if (!pmd_access_permitted(pmd, write_fault))
+                if (write_fault && !pmd_write(pmd))
                         return hmm_vma_walk_clear(start, end, walk);
 
                 pfn = pmd_pfn(pmd) + pte_index(addr);
-                flag |= pmd_access_permitted(pmd, WRITE) ? HMM_PFN_WRITE : 0;
+                flag |= pmd_write(pmd) ? HMM_PFN_WRITE : 0;
                 for (; addr < end; addr += PAGE_SIZE, i++, pfn++)
                         pfns[i] = hmm_pfn_t_from_pfn(pfn) | flag;
                 return 0;
@@ -456,11 +456,11 @@ again:
                         continue;
                 }
 
-                if (!pte_access_permitted(pte, write_fault))
+                if (write_fault && !pte_write(pte))
                         goto fault;
 
                 pfns[i] = hmm_pfn_t_from_pfn(pte_pfn(pte)) | flag;
-                pfns[i] |= pte_access_permitted(pte, WRITE) ? HMM_PFN_WRITE : 0;
+                pfns[i] |= pte_write(pte) ? HMM_PFN_WRITE : 0;
                 continue;
 
 fault:
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 2f2f5e774902..0e7ded98d114 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -870,7 +870,7 @@ struct page *follow_devmap_pmd(struct vm_area_struct *vma, unsigned long addr,
          */
         WARN_ONCE(flags & FOLL_COW, "mm: In follow_devmap_pmd with FOLL_COW set");
 
-        if (!pmd_access_permitted(*pmd, flags & FOLL_WRITE))
+        if (flags & FOLL_WRITE && !pmd_write(*pmd))
                 return NULL;
 
         if (pmd_present(*pmd) && pmd_devmap(*pmd))
@@ -1012,7 +1012,7 @@ struct page *follow_devmap_pud(struct vm_area_struct *vma, unsigned long addr,
 
         assert_spin_locked(pud_lockptr(mm, pud));
 
-        if (!pud_access_permitted(*pud, flags & FOLL_WRITE))
+        if (flags & FOLL_WRITE && !pud_write(*pud))
                 return NULL;
 
         if (pud_present(*pud) && pud_devmap(*pud))
@@ -1386,7 +1386,7 @@ out_unlock:
  */
 static inline bool can_follow_write_pmd(pmd_t pmd, unsigned int flags)
 {
-        return pmd_access_permitted(pmd, WRITE) ||
+        return pmd_write(pmd) ||
                ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pmd_dirty(pmd));
 }
 
diff --git a/mm/kmemcheck.c b/mm/kmemcheck.c
deleted file mode 100644
index cec594032515..000000000000
--- a/mm/kmemcheck.c
+++ /dev/null
@@ -1 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 3d4781756d50..f656ca27f6c2 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -127,7 +127,7 @@
 /* GFP bitmask for kmemleak internal allocations */
 #define gfp_kmemleak_mask(gfp)  (((gfp) & (GFP_KERNEL | GFP_ATOMIC)) | \
                                  __GFP_NORETRY | __GFP_NOMEMALLOC | \
-                                 __GFP_NOWARN)
+                                 __GFP_NOWARN | __GFP_NOFAIL)
 
 /* scanning area inside a memory block */
 struct kmemleak_scan_area {
@@ -1523,7 +1523,7 @@ static void kmemleak_scan(void)
                         if (page_count(page) == 0)
                                 continue;
                         scan_block(page, page + 1, NULL);
-                        if (!(pfn % (MAX_SCAN_SIZE / sizeof(*page))))
+                        if (!(pfn & 63))
                                 cond_resched();
                 }
         }
diff --git a/mm/memory.c b/mm/memory.c
index 5eb3d2524bdc..793004608332 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2857,8 +2857,11 @@ int do_swap_page(struct vm_fault *vmf)
         int ret = 0;
         bool vma_readahead = swap_use_vma_readahead();
 
-        if (vma_readahead)
+        if (vma_readahead) {
                 page = swap_readahead_detect(vmf, &swap_ra);
+                swapcache = page;
+        }
+
         if (!pte_unmap_same(vma->vm_mm, vmf->pmd, vmf->pte, vmf->orig_pte)) {
                 if (page)
                         put_page(page);
@@ -2889,9 +2892,12 @@ int do_swap_page(struct vm_fault *vmf)
 
 
         delayacct_set_flag(DELAYACCT_PF_SWAPIN);
-        if (!page)
+        if (!page) {
                 page = lookup_swap_cache(entry, vma_readahead ? vma : NULL,
                                          vmf->address);
+                swapcache = page;
+        }
+
         if (!page) {
                 struct swap_info_struct *si = swp_swap_info(entry);
 
@@ -3831,7 +3837,8 @@ static inline int create_huge_pmd(struct vm_fault *vmf)
         return VM_FAULT_FALLBACK;
 }
 
-static int wp_huge_pmd(struct vm_fault *vmf, pmd_t orig_pmd)
+/* `inline' is required to avoid gcc 4.1.2 build error */
+static inline int wp_huge_pmd(struct vm_fault *vmf, pmd_t orig_pmd)
 {
         if (vma_is_anonymous(vmf->vma))
                 return do_huge_pmd_wp_page(vmf, orig_pmd);
@@ -3948,7 +3955,7 @@ static int handle_pte_fault(struct vm_fault *vmf)
         if (unlikely(!pte_same(*vmf->pte, entry)))
                 goto unlock;
         if (vmf->flags & FAULT_FLAG_WRITE) {
-                if (!pte_access_permitted(entry, WRITE))
+                if (!pte_write(entry))
                         return do_wp_page(vmf);
                 entry = pte_mkdirty(entry);
         }
@@ -4013,7 +4020,7 @@ static int __handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
 
                         /* NUMA case for anonymous PUDs would go here */
 
-                        if (dirty && !pud_access_permitted(orig_pud, WRITE)) {
+                        if (dirty && !pud_write(orig_pud)) {
                                 ret = wp_huge_pud(&vmf, orig_pud);
                                 if (!(ret & VM_FAULT_FALLBACK))
                                         return ret;
@@ -4046,7 +4053,7 @@ static int __handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
                         if (pmd_protnone(orig_pmd) && vma_is_accessible(vma))
                                 return do_huge_pmd_numa_page(&vmf, orig_pmd);
 
-                        if (dirty && !pmd_access_permitted(orig_pmd, WRITE)) {
+                        if (dirty && !pmd_write(orig_pmd)) {
                                 ret = wp_huge_pmd(&vmf, orig_pmd);
                                 if (!(ret & VM_FAULT_FALLBACK))
                                         return ret;
@@ -4336,7 +4343,7 @@ int follow_phys(struct vm_area_struct *vma,
                 goto out;
         pte = *ptep;
 
-        if (!pte_access_permitted(pte, flags & FOLL_WRITE))
+        if ((flags & FOLL_WRITE) && !pte_write(pte))
                 goto unlock;
 
         *prot = pgprot_val(pte_pgprot(pte));
diff --git a/mm/mmap.c b/mm/mmap.c
index a4d546821214..9efdc021ad22 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -3019,20 +3019,20 @@ void exit_mmap(struct mm_struct *mm)
         /* Use -1 here to ensure all VMAs in the mm are unmapped */
         unmap_vmas(&tlb, vma, 0, -1);
 
-        set_bit(MMF_OOM_SKIP, &mm->flags);
-        if (unlikely(tsk_is_oom_victim(current))) {
+        if (unlikely(mm_is_oom_victim(mm))) {
                 /*
                  * Wait for oom_reap_task() to stop working on this
                  * mm. Because MMF_OOM_SKIP is already set before
                  * calling down_read(), oom_reap_task() will not run
                  * on this "mm" post up_write().
                  *
-                 * tsk_is_oom_victim() cannot be set from under us
-                 * either because current->mm is already set to NULL
+                 * mm_is_oom_victim() cannot be set from under us
+                 * either because victim->mm is already set to NULL
                  * under task_lock before calling mmput and oom_mm is
-                 * set not NULL by the OOM killer only if current->mm
+                 * set not NULL by the OOM killer only if victim->mm
                  * is found not NULL while holding the task_lock.
                  */
+                set_bit(MMF_OOM_SKIP, &mm->flags);
                 down_write(&mm->mmap_sem);
                 up_write(&mm->mmap_sem);
         }
diff --git a/mm/mprotect.c b/mm/mprotect.c
index ec39f730a0bf..58b629bb70de 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -166,7 +166,7 @@ static inline unsigned long change_pmd_range(struct vm_area_struct *vma,
                 next = pmd_addr_end(addr, end);
                 if (!is_swap_pmd(*pmd) && !pmd_trans_huge(*pmd) && !pmd_devmap(*pmd)
                                 && pmd_none_or_clear_bad(pmd))
-                        continue;
+                        goto next;
 
                 /* invoke the mmu notifier if the pmd is populated */
                 if (!mni_start) {
@@ -188,7 +188,7 @@ static inline unsigned long change_pmd_range(struct vm_area_struct *vma,
                                         }
 
                                         /* huge pmd was handled */
-                                        continue;
+                                        goto next;
                                 }
                         }
                         /* fall through, the trans huge pmd just split */
@@ -196,6 +196,8 @@ static inline unsigned long change_pmd_range(struct vm_area_struct *vma,
                 this_pages = change_pte_range(vma, pmd, addr, next, newprot,
                                  dirty_accountable, prot_numa);
                 pages += this_pages;
+next:
+                cond_resched();
         } while (pmd++, addr = next, addr != end);
 
         if (mni_start)
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index c957be32b27a..29f855551efe 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -683,8 +683,10 @@ static void mark_oom_victim(struct task_struct *tsk)
                 return;
 
         /* oom_mm is bound to the signal struct life time. */
-        if (!cmpxchg(&tsk->signal->oom_mm, NULL, mm))
+        if (!cmpxchg(&tsk->signal->oom_mm, NULL, mm)) {
                 mmgrab(tsk->signal->oom_mm);
+                set_bit(MMF_OOM_VICTIM, &mm->flags);
+        }
 
         /*
          * Make sure that the task is woken up from uninterruptible sleep
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 73f5d4556b3d..76c9688b6a0a 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2684,6 +2684,7 @@ void free_unref_page_list(struct list_head *list)
 {
         struct page *page, *next;
         unsigned long flags, pfn;
+        int batch_count = 0;
 
         /* Prepare pages for freeing */
         list_for_each_entry_safe(page, next, list, lru) {
@@ -2700,6 +2701,16 @@ void free_unref_page_list(struct list_head *list)
                 set_page_private(page, 0);
                 trace_mm_page_free_batched(page);
                 free_unref_page_commit(page, pfn);
+
+                /*
+                 * Guard against excessive IRQ disabled times when we get
+                 * a large list of pages to free.
+                 */
+                if (++batch_count == SWAP_CLUSTER_MAX) {
+                        local_irq_restore(flags);
+                        batch_count = 0;
+                        local_irq_save(flags);
+                }
         }
         local_irq_restore(flags);
 }
@@ -6249,6 +6260,8 @@ void __paginginit zero_resv_unavail(void)
         pgcnt = 0;
         for_each_resv_unavail_range(i, &start, &end) {
                 for (pfn = PFN_DOWN(start); pfn < PFN_UP(end); pfn++) {
+                        if (!pfn_valid(ALIGN_DOWN(pfn, pageblock_nr_pages)))
+                                continue;
                         mm_zero_struct_page(pfn_to_page(pfn));
                         pgcnt++;
                 }
diff --git a/mm/page_owner.c b/mm/page_owner.c
index 8592543a0f15..270a8219ccd0 100644
--- a/mm/page_owner.c
+++ b/mm/page_owner.c
@@ -616,7 +616,6 @@ static void init_early_allocated_pages(void)
 {
         pg_data_t *pgdat;
 
-        drain_all_pages(NULL);
         for_each_online_pgdat(pgdat)
                 init_zones_in_node(pgdat);
 }
diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c
index d22b84310f6d..ae3c2a35d61b 100644
--- a/mm/page_vma_mapped.c
+++ b/mm/page_vma_mapped.c
@@ -30,10 +30,37 @@ static bool map_pte(struct page_vma_mapped_walk *pvmw)
         return true;
 }
 
+static inline bool pfn_in_hpage(struct page *hpage, unsigned long pfn)
+{
+        unsigned long hpage_pfn = page_to_pfn(hpage);
+
+        /* THP can be referenced by any subpage */
+        return pfn >= hpage_pfn && pfn - hpage_pfn < hpage_nr_pages(hpage);
+}
+
+/**
+ * check_pte - check if @pvmw->page is mapped at the @pvmw->pte
+ *
+ * page_vma_mapped_walk() found a place where @pvmw->page is *potentially*
+ * mapped. check_pte() has to validate this.
+ *
+ * @pvmw->pte may point to empty PTE, swap PTE or PTE pointing to arbitrary
+ * page.
+ *
+ * If PVMW_MIGRATION flag is set, returns true if @pvmw->pte contains migration
+ * entry that points to @pvmw->page or any subpage in case of THP.
+ *
+ * If PVMW_MIGRATION flag is not set, returns true if @pvmw->pte points to
+ * @pvmw->page or any subpage in case of THP.
+ *
+ * Otherwise, return false.
+ *
+ */
 static bool check_pte(struct page_vma_mapped_walk *pvmw)
 {
+        unsigned long pfn;
+
         if (pvmw->flags & PVMW_MIGRATION) {
-#ifdef CONFIG_MIGRATION
                 swp_entry_t entry;
                 if (!is_swap_pte(*pvmw->pte))
                         return false;
@@ -41,38 +68,25 @@ static bool check_pte(struct page_vma_mapped_walk *pvmw)
 
                 if (!is_migration_entry(entry))
                         return false;
-                if (migration_entry_to_page(entry) - pvmw->page >=
-                                hpage_nr_pages(pvmw->page)) {
-                        return false;
-                }
-                if (migration_entry_to_page(entry) < pvmw->page)
-                        return false;
-#else
-                WARN_ON_ONCE(1);
-#endif
-        } else {
-                if (is_swap_pte(*pvmw->pte)) {
-                        swp_entry_t entry;
 
-                        entry = pte_to_swp_entry(*pvmw->pte);
-                        if (is_device_private_entry(entry) &&
-                            device_private_entry_to_page(entry) == pvmw->page)
-                                return true;
-                }
+                pfn = migration_entry_to_pfn(entry);
+        } else if (is_swap_pte(*pvmw->pte)) {
+                swp_entry_t entry;
 
-                if (!pte_present(*pvmw->pte))
+                /* Handle un-addressable ZONE_DEVICE memory */
+                entry = pte_to_swp_entry(*pvmw->pte);
+                if (!is_device_private_entry(entry))
                         return false;
 
-                /* THP can be referenced by any subpage */
-                if (pte_page(*pvmw->pte) - pvmw->page >=
-                                hpage_nr_pages(pvmw->page)) {
-                        return false;
-                }
-                if (pte_page(*pvmw->pte) < pvmw->page)
+                pfn = device_private_entry_to_pfn(entry);
+        } else {
+                if (!pte_present(*pvmw->pte))
                         return false;
+
+                pfn = pte_pfn(*pvmw->pte);
         }
 
-        return true;
+        return pfn_in_hpage(pvmw->page, pfn);
 }
 
 /**
diff --git a/mm/percpu.c b/mm/percpu.c
index 79e3549cab0f..50e7fdf84055 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -2719,7 +2719,11 @@ void __init setup_per_cpu_areas(void)
 
         if (pcpu_setup_first_chunk(ai, fc) < 0)
                 panic("Failed to initialize percpu areas.");
+#ifdef CONFIG_CRIS
+#warning "the CRIS architecture has physical and virtual addresses confused"
+#else
         pcpu_free_alloc_info(ai);
+#endif
 }
 
 #endif  /* CONFIG_SMP */
diff --git a/mm/slab.c b/mm/slab.c
index 183e996dde5f..4e51ef954026 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -1584,11 +1584,8 @@ static void print_objinfo(struct kmem_cache *cachep, void *objp, int lines)
                        *dbg_redzone2(cachep, objp));
         }
 
-        if (cachep->flags & SLAB_STORE_USER) {
-                pr_err("Last user: [<%p>](%pSR)\n",
-                       *dbg_userword(cachep, objp),
-                       *dbg_userword(cachep, objp));
-        }
+        if (cachep->flags & SLAB_STORE_USER)
+                pr_err("Last user: (%pSR)\n", *dbg_userword(cachep, objp));
         realobj = (char *)objp + obj_offset(cachep);
         size = cachep->object_size;
         for (i = 0; i < size && lines; i += 16, lines--) {
@@ -1621,7 +1618,7 @@ static void check_poison_obj(struct kmem_cache *cachep, void *objp)
                         /* Mismatch ! */
                         /* Print header */
                         if (lines == 0) {
-                                pr_err("Slab corruption (%s): %s start=%p, len=%d\n",
+                                pr_err("Slab corruption (%s): %s start=%px, len=%d\n",
                                        print_tainted(), cachep->name,
                                        realobj, size);
                                 print_objinfo(cachep, objp, 0);
@@ -1650,13 +1647,13 @@ static void check_poison_obj(struct kmem_cache *cachep, void *objp)
                 if (objnr) {
                         objp = index_to_obj(cachep, page, objnr - 1);
                         realobj = (char *)objp + obj_offset(cachep);
-                        pr_err("Prev obj: start=%p, len=%d\n", realobj, size);
+                        pr_err("Prev obj: start=%px, len=%d\n", realobj, size);
                         print_objinfo(cachep, objp, 2);
                 }
                 if (objnr + 1 < cachep->num) {
                         objp = index_to_obj(cachep, page, objnr + 1);
                         realobj = (char *)objp + obj_offset(cachep);
-                        pr_err("Next obj: start=%p, len=%d\n", realobj, size);
+                        pr_err("Next obj: start=%px, len=%d\n", realobj, size);
                         print_objinfo(cachep, objp, 2);
                 }
         }
@@ -2608,7 +2605,7 @@ static void slab_put_obj(struct kmem_cache *cachep,
         /* Verify double free bug */
         for (i = page->active; i < cachep->num; i++) {
                 if (get_free_obj(page, i) == objnr) {
-                        pr_err("slab: double free detected in cache '%s', objp %p\n",
+                        pr_err("slab: double free detected in cache '%s', objp %px\n",
                                cachep->name, objp);
                         BUG();
                 }
@@ -2772,7 +2769,7 @@ static inline void verify_redzone_free(struct kmem_cache *cache, void *obj)
         else
                 slab_error(cache, "memory outside object was overwritten");
 
-        pr_err("%p: redzone 1:0x%llx, redzone 2:0x%llx\n",
+        pr_err("%px: redzone 1:0x%llx, redzone 2:0x%llx\n",
                obj, redzone1, redzone2);
 }
 
@@ -3078,7 +3075,7 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
                 if (*dbg_redzone1(cachep, objp) != RED_INACTIVE ||
                                 *dbg_redzone2(cachep, objp) != RED_INACTIVE) {
                         slab_error(cachep, "double free, or memory outside object was overwritten");
-                        pr_err("%p: redzone 1:0x%llx, redzone 2:0x%llx\n",
+                        pr_err("%px: redzone 1:0x%llx, redzone 2:0x%llx\n",
                                objp, *dbg_redzone1(cachep, objp),
                                *dbg_redzone2(cachep, objp));
                 }
@@ -3091,7 +3088,7 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
                 cachep->ctor(objp);
         if (ARCH_SLAB_MINALIGN &&
             ((unsigned long)objp & (ARCH_SLAB_MINALIGN-1))) {
-                pr_err("0x%p: not aligned to ARCH_SLAB_MINALIGN=%d\n",
+                pr_err("0x%px: not aligned to ARCH_SLAB_MINALIGN=%d\n",
                        objp, (int)ARCH_SLAB_MINALIGN);
         }
         return objp;
@@ -4283,7 +4280,7 @@ static void show_symbol(struct seq_file *m, unsigned long address)
                 return;
         }
 #endif
-        seq_printf(m, "%p", (void *)address);
+        seq_printf(m, "%px", (void *)address);
 }
 
 static int leaks_show(struct seq_file *m, void *p)
diff --git a/mm/sparse.c b/mm/sparse.c
index 7a5dacaa06e3..2609aba121e8 100644
--- a/mm/sparse.c
+++ b/mm/sparse.c
@@ -211,7 +211,7 @@ void __init memory_present(int nid, unsigned long start, unsigned long end)
         if (unlikely(!mem_section)) {
                 unsigned long size, align;
 
-                size = sizeof(struct mem_section) * NR_SECTION_ROOTS;
+                size = sizeof(struct mem_section*) * NR_SECTION_ROOTS;
                 align = 1 << (INTERNODE_CACHE_SHIFT);
                 mem_section = memblock_virt_alloc(size, align);
         }
diff --git a/mm/vmscan.c b/mm/vmscan.c
index c02c850ea349..47d5ced51f2d 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -297,10 +297,13 @@ EXPORT_SYMBOL(register_shrinker);
  */
 void unregister_shrinker(struct shrinker *shrinker)
 {
+        if (!shrinker->nr_deferred)
+                return;
         down_write(&shrinker_rwsem);
         list_del(&shrinker->list);
         up_write(&shrinker_rwsem);
         kfree(shrinker->nr_deferred);
+        shrinker->nr_deferred = NULL;
 }
 EXPORT_SYMBOL(unregister_shrinker);
 
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 685049a9048d..683c0651098c 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -53,6 +53,7 @@
 #include <linux/mount.h>
 #include <linux/migrate.h>
 #include <linux/pagemap.h>
+#include <linux/fs.h>
 
 #define ZSPAGE_MAGIC    0x58
 
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 8dfdd94e430f..bad01b14a4ad 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -111,12 +111,7 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
                 vlan_gvrp_uninit_applicant(real_dev);
         }
 
-        /* Take it out of our own structures, but be sure to interlock with
-         * HW accelerating devices or SW vlan input packet processing if
-         * VLAN is not 0 (leave it there for 802.1p).
-         */
-        if (vlan_id)
-                vlan_vid_del(real_dev, vlan->vlan_proto, vlan_id);
+        vlan_vid_del(real_dev, vlan->vlan_proto, vlan_id);
 
         /* Get rid of the vlan's reference to real_dev */
         dev_put(real_dev);
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 985046ae4231..80f5c79053a4 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -839,7 +839,6 @@ static int p9_socket_open(struct p9_client *client, struct socket *csocket)
         if (IS_ERR(file)) {
                 pr_err("%s (%d): failed to map fd\n",
                        __func__, task_pid_nr(current));
-                sock_release(csocket);
                 kfree(p);
                 return PTR_ERR(file);
         }
diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index 325c56043007..086a4abdfa7c 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -543,3 +543,7 @@ static void p9_trans_xen_exit(void)
         return xenbus_unregister_driver(&xen_9pfs_front_driver);
 }
 module_exit(p9_trans_xen_exit);
+
+MODULE_AUTHOR("Stefano Stabellini <stefano@aporeto.com>");
+MODULE_DESCRIPTION("Xen Transport for 9P");
+MODULE_LICENSE("GPL");
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 1b659ab652fb..bbe8414b6ee7 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -1214,7 +1214,7 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
         orig_node->last_seen = jiffies;
 
         /* find packet count of corresponding one hop neighbor */
-        spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock);
+        spin_lock_bh(&orig_neigh_node->bat_iv.ogm_cnt_lock);
         if_num = if_incoming->if_num;
         orig_eq_count = orig_neigh_node->bat_iv.bcast_own_sum[if_num];
         neigh_ifinfo = batadv_neigh_ifinfo_new(neigh_node, if_outgoing);
@@ -1224,7 +1224,7 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
         } else {
                 neigh_rq_count = 0;
         }
-        spin_unlock_bh(&orig_node->bat_iv.ogm_cnt_lock);
+        spin_unlock_bh(&orig_neigh_node->bat_iv.ogm_cnt_lock);
 
         /* pay attention to not get a value bigger than 100 % */
         if (orig_eq_count > neigh_rq_count)
diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c
index 341ceab8338d..e0e2bfcd6b3e 100644
--- a/net/batman-adv/bat_v.c
+++ b/net/batman-adv/bat_v.c
@@ -814,7 +814,7 @@ static bool batadv_v_gw_is_eligible(struct batadv_priv *bat_priv,
         }
 
         orig_gw = batadv_gw_node_get(bat_priv, orig_node);
-        if (!orig_node)
+        if (!orig_gw)
                 goto out;
 
         if (batadv_v_gw_throughput_get(orig_gw, &orig_throughput) < 0)
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index a98cf1104a30..ebe6e38934e4 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -499,6 +499,8 @@ int batadv_frag_send_packet(struct sk_buff *skb,
          */
         if (skb->priority >= 256 && skb->priority <= 263)
                 frag_header.priority = skb->priority - 256;
+        else
+                frag_header.priority = 0;
 
         ether_addr_copy(frag_header.orig, primary_if->net_dev->dev_addr);
         ether_addr_copy(frag_header.dest, orig_node->orig);
diff --git a/net/batman-adv/tp_meter.c b/net/batman-adv/tp_meter.c
index 15cd2139381e..ebc4e2241c77 100644
--- a/net/batman-adv/tp_meter.c
+++ b/net/batman-adv/tp_meter.c
@@ -482,7 +482,7 @@ static void batadv_tp_reset_sender_timer(struct batadv_tp_vars *tp_vars)
 
 /**
  * batadv_tp_sender_timeout - timer that fires in case of packet loss
- * @arg: address of the related tp_vars
+ * @t: address to timer_list inside tp_vars
  *
  * If fired it means that there was packet loss.
  * Switch to Slow Start, set the ss_threshold to half of the current cwnd and
@@ -1106,7 +1106,7 @@ static void batadv_tp_reset_receiver_timer(struct batadv_tp_vars *tp_vars)
 /**
  * batadv_tp_receiver_shutdown - stop a tp meter receiver when timeout is
  *  reached without received ack
- * @arg: address of the related tp_vars
+ * @t: address to timer_list inside tp_vars
  */
 static void batadv_tp_receiver_shutdown(struct timer_list *t)
 {
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 43ba91c440bc..fc6615d59165 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3363,9 +3363,10 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
                         break;
 
                 case L2CAP_CONF_EFS:
-                        remote_efs = 1;
-                        if (olen == sizeof(efs))
+                        if (olen == sizeof(efs)) {
+                                remote_efs = 1;
                                 memcpy(&efs, (void *) val, olen);
+                        }
                         break;
 
                 case L2CAP_CONF_EWS:
@@ -3584,16 +3585,17 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
                         break;
 
                 case L2CAP_CONF_EFS:
-                        if (olen == sizeof(efs))
+                        if (olen == sizeof(efs)) {
                                 memcpy(&efs, (void *)val, olen);
 
-                        if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
-                            efs.stype != L2CAP_SERV_NOTRAFIC &&
-                            efs.stype != chan->local_stype)
-                                return -ECONNREFUSED;
+                                if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
+                                    efs.stype != L2CAP_SERV_NOTRAFIC &&
+                                    efs.stype != chan->local_stype)
+                                        return -ECONNREFUSED;
 
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
-                                           (unsigned long) &efs, endptr - ptr);
+                                l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
+                                                   (unsigned long) &efs, endptr - ptr);
+                        }
                         break;
 
                 case L2CAP_CONF_FCS:
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index d0ef0a8e8831..015f465c514b 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -1262,19 +1262,20 @@ static int br_dev_newlink(struct net *src_net, struct net_device *dev,
         struct net_bridge *br = netdev_priv(dev);
         int err;
 
+        err = register_netdevice(dev);
+        if (err)
+                return err;
+
         if (tb[IFLA_ADDRESS]) {
                 spin_lock_bh(&br->lock);
                 br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS]));
                 spin_unlock_bh(&br->lock);
         }
 
-        err = register_netdevice(dev);
-        if (err)
-                return err;
-
         err = br_changelink(dev, tb, data, extack);
         if (err)
-                unregister_netdevice(dev);
+                br_dev_delete(dev, NULL);
+
         return err;
 }
 
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 2d38b6e34203..e0adcd123f48 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -334,9 +334,8 @@ void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
         mutex_lock(&caifdevs->lock);
         list_add_rcu(&caifd->list, &caifdevs->list);
 
-        strncpy(caifd->layer.name, dev->name,
-                sizeof(caifd->layer.name) - 1);
-        caifd->layer.name[sizeof(caifd->layer.name) - 1] = 0;
+        strlcpy(caifd->layer.name, dev->name,
+                sizeof(caifd->layer.name));
         caifd->layer.transmit = transmit;
         cfcnfg_add_phy_layer(cfg,
                                 dev,
diff --git a/net/caif/caif_usb.c b/net/caif/caif_usb.c
index 5cd44f001f64..1a082a946045 100644
--- a/net/caif/caif_usb.c
+++ b/net/caif/caif_usb.c
@@ -176,9 +176,7 @@ static int cfusbl_device_notify(struct notifier_block *me, unsigned long what,
                 dev_add_pack(&caif_usb_type);
         pack_added = true;
 
-        strncpy(layer->name, dev->name,
-                        sizeof(layer->name) - 1);
-        layer->name[sizeof(layer->name) - 1] = 0;
+        strlcpy(layer->name, dev->name, sizeof(layer->name));
 
         return 0;
 }
diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
index 273cb07f57d8..8f00bea093b9 100644
--- a/net/caif/cfcnfg.c
+++ b/net/caif/cfcnfg.c
@@ -268,17 +268,15 @@ static int caif_connect_req_to_link_param(struct cfcnfg *cnfg,
         case CAIFPROTO_RFM:
                 l->linktype = CFCTRL_SRV_RFM;
                 l->u.datagram.connid = s->sockaddr.u.rfm.connection_id;
-                strncpy(l->u.rfm.volume, s->sockaddr.u.rfm.volume,
-                        sizeof(l->u.rfm.volume)-1);
-                l->u.rfm.volume[sizeof(l->u.rfm.volume)-1] = 0;
+                strlcpy(l->u.rfm.volume, s->sockaddr.u.rfm.volume,
+                        sizeof(l->u.rfm.volume));
                 break;
         case CAIFPROTO_UTIL:
                 l->linktype = CFCTRL_SRV_UTIL;
                 l->endpoint = 0x00;
                 l->chtype = 0x00;
-                strncpy(l->u.utility.name, s->sockaddr.u.util.service,
-                        sizeof(l->u.utility.name)-1);
-                l->u.utility.name[sizeof(l->u.utility.name)-1] = 0;
+                strlcpy(l->u.utility.name, s->sockaddr.u.util.service,
+                        sizeof(l->u.utility.name));
                 caif_assert(sizeof(l->u.utility.name) > 10);
                 l->u.utility.paramlen = s->param.size;
                 if (l->u.utility.paramlen > sizeof(l->u.utility.params))
diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
index f5afda1abc76..655ed7032150 100644
--- a/net/caif/cfctrl.c
+++ b/net/caif/cfctrl.c
@@ -258,8 +258,8 @@ int cfctrl_linkup_request(struct cflayer *layer,
                 tmp16 = cpu_to_le16(param->u.utility.fifosize_bufs);
                 cfpkt_add_body(pkt, &tmp16, 2);
                 memset(utility_name, 0, sizeof(utility_name));
-                strncpy(utility_name, param->u.utility.name,
-                        UTILITY_NAME_LENGTH - 1);
+                strlcpy(utility_name, param->u.utility.name,
+                        UTILITY_NAME_LENGTH);
                 cfpkt_add_body(pkt, utility_name, UTILITY_NAME_LENGTH);
                 tmp8 = param->u.utility.paramlen;
                 cfpkt_add_body(pkt, &tmp8, 1);
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 003b2d6d655f..4d7f988a3130 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -721,20 +721,16 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
 {
         struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
 
-        if (WARN_ONCE(dev->type != ARPHRD_CAN ||
-                      skb->len != CAN_MTU ||
-                      cfd->len > CAN_MAX_DLEN,
-                      "PF_CAN: dropped non conform CAN skbuf: "
-                      "dev type %d, len %d, datalen %d\n",
-                      dev->type, skb->len, cfd->len))
-                goto drop;
+        if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU ||
+                     cfd->len > CAN_MAX_DLEN)) {
+                pr_warn_once("PF_CAN: dropped non conform CAN skbuf: dev type %d, len %d, datalen %d\n",
+                             dev->type, skb->len, cfd->len);
+                kfree_skb(skb);
+                return NET_RX_DROP;
+        }
 
         can_receive(skb, dev);
         return NET_RX_SUCCESS;
-
-drop:
-        kfree_skb(skb);
-        return NET_RX_DROP;
 }
 
 static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
@@ -742,20 +738,16 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
 {
         struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
 
-        if (WARN_ONCE(dev->type != ARPHRD_CAN ||
-                      skb->len != CANFD_MTU ||
-                      cfd->len > CANFD_MAX_DLEN,
-                      "PF_CAN: dropped non conform CAN FD skbuf: "
-                      "dev type %d, len %d, datalen %d\n",
-                      dev->type, skb->len, cfd->len))
-                goto drop;
+        if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU ||
+                     cfd->len > CANFD_MAX_DLEN)) {
+                pr_warn_once("PF_CAN: dropped non conform CAN FD skbuf: dev type %d, len %d, datalen %d\n",
+                             dev->type, skb->len, cfd->len);
+                kfree_skb(skb);
+                return NET_RX_DROP;
+        }
 
         can_receive(skb, dev);
         return NET_RX_SUCCESS;
-
-drop:
-        kfree_skb(skb);
-        return NET_RX_DROP;
 }
 
 /*
diff --git a/net/core/dev.c b/net/core/dev.c
index 07ed21d64f92..613fb4066be7 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1106,7 +1106,7 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf)
          * when the name is long and there isn't enough space left
          * for the digits, or if all bits are used.
          */
-        return p ? -ENFILE : -EEXIST;
+        return -ENFILE;
 }
 
 static int dev_alloc_name_ns(struct net *net,
@@ -1146,7 +1146,19 @@ EXPORT_SYMBOL(dev_alloc_name);
 int dev_get_valid_name(struct net *net, struct net_device *dev,
                        const char *name)
 {
-        return dev_alloc_name_ns(net, dev, name);
+        BUG_ON(!net);
+
+        if (!dev_valid_name(name))
+                return -EINVAL;
+
+        if (strchr(name, '%'))
+                return dev_alloc_name_ns(net, dev, name);
+        else if (__dev_get_by_name(net, name))
+                return -EEXIST;
+        else if (dev->name != name)
+                strlcpy(dev->name, name, IFNAMSIZ);
+
+        return 0;
 }
 EXPORT_SYMBOL(dev_get_valid_name);
 
@@ -3139,10 +3151,21 @@ static void qdisc_pkt_len_init(struct sk_buff *skb)
                 hdr_len = skb_transport_header(skb) - skb_mac_header(skb);
 
                 /* + transport layer */
-                if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
-                        hdr_len += tcp_hdrlen(skb);
-                else
-                        hdr_len += sizeof(struct udphdr);
+                if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))) {
+                        const struct tcphdr *th;
+                        struct tcphdr _tcphdr;
+
+                        th = skb_header_pointer(skb, skb_transport_offset(skb),
+                                                sizeof(_tcphdr), &_tcphdr);
+                        if (likely(th))
+                                hdr_len += __tcp_hdrlen(th);
+                } else {
+                        struct udphdr _udphdr;
+
+                        if (skb_header_pointer(skb, skb_transport_offset(skb),
+                                               sizeof(_udphdr), &_udphdr))
+                                hdr_len += sizeof(struct udphdr);
+                }
 
                 if (shinfo->gso_type & SKB_GSO_DODGY)
                         gso_segs = DIV_ROUND_UP(skb->len - hdr_len,
@@ -3904,7 +3927,7 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
                                      hroom > 0 ? ALIGN(hroom, NET_SKB_PAD) : 0,
                                      troom > 0 ? troom + 128 : 0, GFP_ATOMIC))
                         goto do_drop;
-                if (troom > 0 && __skb_linearize(skb))
+                if (skb_linearize(skb))
                         goto do_drop;
         }
 
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index f8fcf450a36e..8225416911ae 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -770,15 +770,6 @@ static int ethtool_set_link_ksettings(struct net_device *dev,
         return dev->ethtool_ops->set_link_ksettings(dev, &link_ksettings);
 }
 
-static void
-warn_incomplete_ethtool_legacy_settings_conversion(const char *details)
-{
-        char name[sizeof(current->comm)];
-
-        pr_info_once("warning: `%s' uses legacy ethtool link settings API, %s\n",
-                     get_task_comm(name, current), details);
-}
-
 /* Query device for its ethtool_cmd settings.
  *
  * Backward compatibility note: for compatibility with legacy ethtool,
@@ -805,10 +796,8 @@ static int ethtool_get_settings(struct net_device *dev, void __user *useraddr)
                                                            &link_ksettings);
                 if (err < 0)
                         return err;
-                if (!convert_link_ksettings_to_legacy_settings(&cmd,
-                                                               &link_ksettings))
-                        warn_incomplete_ethtool_legacy_settings_conversion(
-                                "link modes are only partially reported");
+                convert_link_ksettings_to_legacy_settings(&cmd,
+                                                          &link_ksettings);
 
                 /* send a sensible cmd tag back to user */
                 cmd.cmd = ETHTOOL_GSET;
diff --git a/net/core/filter.c b/net/core/filter.c
index 6a85e67fafce..1c0eb436671f 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -458,6 +458,10 @@ do_pass:
                             convert_bpf_extensions(fp, &insn))
                                 break;
 
+                        if (fp->code == (BPF_ALU | BPF_DIV | BPF_X) ||
+                            fp->code == (BPF_ALU | BPF_MOD | BPF_X))
+                                *insn++ = BPF_MOV32_REG(BPF_REG_X, BPF_REG_X);
+
                         *insn = BPF_RAW_INSN(fp->code, BPF_REG_A, BPF_REG_X, 0, fp->k);
                         break;
 
@@ -1054,11 +1058,9 @@ static struct bpf_prog *bpf_migrate_filter(struct bpf_prog *fp)
                  */
                 goto out_err_free;
 
-        /* We are guaranteed to never error here with cBPF to eBPF
-         * transitions, since there's no issue with type compatibility
-         * checks on program arrays.
-         */
         fp = bpf_prog_select_runtime(fp, &err);
+        if (err)
+                goto out_err_free;
 
         kfree(old_prog);
         return fp;
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 15ce30063765..544bddf08e13 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -976,8 +976,8 @@ ip_proto_again:
 out_good:
         ret = true;
 
-        key_control->thoff = (u16)nhoff;
 out:
+        key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen);
         key_basic->n_proto = proto;
         key_basic->ip_proto = ip_proto;
 
@@ -985,7 +985,6 @@ out:
 
 out_bad:
         ret = false;
-        key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen);
         goto out;
 }
 EXPORT_SYMBOL(__skb_flow_dissect);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index d1f5fe986edd..7f831711b6e0 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -532,7 +532,7 @@ struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
         if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
                 nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 
-        hash_val = tbl->hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
+        hash_val = tbl->hash(n->primary_key, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 
         if (n->parms->dead) {
                 rc = ERR_PTR(-EINVAL);
@@ -544,7 +544,7 @@ struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
              n1 != NULL;
              n1 = rcu_dereference_protected(n1->next,
                         lockdep_is_held(&tbl->lock))) {
-                if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
+                if (dev == n1->dev && !memcmp(n1->primary_key, n->primary_key, key_len)) {
                         if (want_ref)
                                 neigh_hold(n1);
                         rc = n1;
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index b797832565d3..60a71be75aea 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -267,7 +267,7 @@ struct net *get_net_ns_by_id(struct net *net, int id)
         spin_lock_bh(&net->nsid_lock);
         peer = idr_find(&net->netns_ids, id);
         if (peer)
-                get_net(peer);
+                peer = maybe_get_net(peer);
         spin_unlock_bh(&net->nsid_lock);
         rcu_read_unlock();
 
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index 1c4810919a0a..b9057478d69c 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -14,7 +14,6 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/types.h>
-#include <linux/module.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/skbuff.h>
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index dabba2a91fc8..778d7f03404a 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1681,18 +1681,18 @@ static bool link_dump_filtered(struct net_device *dev,
         return false;
 }
 
-static struct net *get_target_net(struct sk_buff *skb, int netnsid)
+static struct net *get_target_net(struct sock *sk, int netnsid)
 {
         struct net *net;
 
-        net = get_net_ns_by_id(sock_net(skb->sk), netnsid);
+        net = get_net_ns_by_id(sock_net(sk), netnsid);
         if (!net)
                 return ERR_PTR(-EINVAL);
 
         /* For now, the caller is required to have CAP_NET_ADMIN in
          * the user namespace owning the target net ns.
          */
-        if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
+        if (!sk_ns_capable(sk, net->user_ns, CAP_NET_ADMIN)) {
                 put_net(net);
                 return ERR_PTR(-EACCES);
         }
@@ -1733,7 +1733,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                         ifla_policy, NULL) >= 0) {
                 if (tb[IFLA_IF_NETNSID]) {
                         netnsid = nla_get_s32(tb[IFLA_IF_NETNSID]);
-                        tgt_net = get_target_net(skb, netnsid);
+                        tgt_net = get_target_net(skb->sk, netnsid);
                         if (IS_ERR(tgt_net)) {
                                 tgt_net = net;
                                 netnsid = -1;
@@ -2883,7 +2883,7 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         if (tb[IFLA_IF_NETNSID]) {
                 netnsid = nla_get_s32(tb[IFLA_IF_NETNSID]);
-                tgt_net = get_target_net(skb, netnsid);
+                tgt_net = get_target_net(NETLINK_CB(skb).sk, netnsid);
                 if (IS_ERR(tgt_net))
                         return PTR_ERR(tgt_net);
         }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 6b0ff396fa9d..08f574081315 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1177,12 +1177,12 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
         int i, new_frags;
         u32 d_off;
 
-        if (!num_frags)
-                return 0;
-
         if (skb_shared(skb) || skb_unclone(skb, gfp_mask))
                 return -EINVAL;
 
+        if (!num_frags)
+                goto release;
+
         new_frags = (__skb_pagelen(skb) + PAGE_SIZE - 1) >> PAGE_SHIFT;
         for (i = 0; i < new_frags; i++) {
                 page = alloc_page(gfp_mask);
@@ -1238,6 +1238,7 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
         __skb_fill_page_desc(skb, new_frags - 1, head, 0, d_off);
         skb_shinfo(skb)->nr_frags = new_frags;
 
+release:
         skb_zcopy_clear(skb, false);
         return 0;
 }
@@ -3654,8 +3655,6 @@ normal:
 
                 skb_shinfo(nskb)->tx_flags |= skb_shinfo(head_skb)->tx_flags &
                                               SKBTX_SHARED_FRAG;
-                if (skb_zerocopy_clone(nskb, head_skb, GFP_ATOMIC))
-                        goto err;
 
                 while (pos < offset + len) {
                         if (i >= nfrags) {
@@ -3681,6 +3680,8 @@ normal:
 
                         if (unlikely(skb_orphan_frags(frag_skb, GFP_ATOMIC)))
                                 goto err;
+                        if (skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC))
+                                goto err;
 
                         *nskb_frag = *frag;
                         __skb_frag_ref(nskb_frag);
@@ -4293,7 +4294,7 @@ void skb_complete_tx_timestamp(struct sk_buff *skb,
         struct sock *sk = skb->sk;
 
         if (!skb_may_tx_timestamp(sk, false))
-                return;
+                goto err;
 
         /* Take a reference to prevent skb_orphan() from freeing the socket,
          * but only if the socket refcount is not zero.
@@ -4302,7 +4303,11 @@ void skb_complete_tx_timestamp(struct sk_buff *skb,
                 *skb_hwtstamps(skb) = *hwtstamps;
                 __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND, false);
                 sock_put(sk);
+                return;
         }
+
+err:
+        kfree_skb(skb);
 }
 EXPORT_SYMBOL_GPL(skb_complete_tx_timestamp);
 
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index 217f4e3b82f6..146b50e30659 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -288,7 +288,7 @@ static int sock_diag_bind(struct net *net, int group)
         case SKNLGRP_INET6_UDP_DESTROY:
                 if (!sock_diag_handlers[AF_INET6])
                         request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
-                                       NETLINK_SOCK_DIAG, AF_INET);
+                                       NETLINK_SOCK_DIAG, AF_INET6);
                 break;
         }
         return 0;
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index cbc3dde4cfcc..a47ad6cd41c0 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -325,7 +325,13 @@ static struct ctl_table net_core_table[] = {
                 .data           = &bpf_jit_enable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
+#ifndef CONFIG_BPF_JIT_ALWAYS_ON
                 .proc_handler   = proc_dointvec
+#else
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &one,
+                .extra2         = &one,
+#endif
         },
 # ifdef CONFIG_HAVE_EBPF_JIT
         {
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 1c75cd1255f6..92d016e87816 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -140,6 +140,9 @@ static void ccid2_hc_tx_rto_expire(struct timer_list *t)
 
         ccid2_pr_debug("RTO_EXPIRE\n");
 
+        if (sk->sk_state == DCCP_CLOSED)
+                goto out;
+
         /* back-off timer */
         hc->tx_rto <<= 1;
         if (hc->tx_rto > DCCP_RTO_MAX)
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index abd07a443219..178bb9833311 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -57,10 +57,16 @@ void dccp_time_wait(struct sock *sk, int state, int timeo)
                 if (state == DCCP_TIME_WAIT)
                         timeo = DCCP_TIMEWAIT_LEN;
 
+                /* tw_timer is pinned, so we need to make sure BH are disabled
+                 * in following section, otherwise timer handler could run before
+                 * we complete the initialization.
+                 */
+                local_bh_disable();
                 inet_twsk_schedule(tw, timeo);
                 /* Linkage updates. */
                 __inet_twsk_hashdance(tw, sk, &dccp_hashinfo);
                 inet_twsk_put(tw);
+                local_bh_enable();
         } else {
                 /* Sorry, if we're out of memory, just CLOSE this
                  * socket up.  We've got bigger problems than
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index b68168fcc06a..9d43c1f40274 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -259,6 +259,7 @@ int dccp_disconnect(struct sock *sk, int flags)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct inet_sock *inet = inet_sk(sk);
+        struct dccp_sock *dp = dccp_sk(sk);
         int err = 0;
         const int old_state = sk->sk_state;
 
@@ -278,6 +279,10 @@ int dccp_disconnect(struct sock *sk, int flags)
                 sk->sk_err = ECONNRESET;
 
         dccp_clear_xmit_timers(sk);
+        ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
+        ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+        dp->dccps_hc_rx_ccid = NULL;
+        dp->dccps_hc_tx_ccid = NULL;
 
         __skb_queue_purge(&sk->sk_receive_queue);
         __skb_queue_purge(&sk->sk_write_queue);
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index d6e7a642493b..a95a55f79137 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -16,7 +16,6 @@
 #include <linux/of_net.h>
 #include <linux/of_mdio.h>
 #include <linux/mdio.h>
-#include <linux/list.h>
 #include <net/rtnetlink.h>
 #include <net/pkt_cls.h>
 #include <net/tc_act/tc_mirred.h>
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index a8d7c5a9fb05..6c231b43974d 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -223,11 +223,16 @@ static bool arp_key_eq(const struct neighbour *neigh, const void *pkey)
 
 static int arp_constructor(struct neighbour *neigh)
 {
-        __be32 addr = *(__be32 *)neigh->primary_key;
+        __be32 addr;
         struct net_device *dev = neigh->dev;
         struct in_device *in_dev;
         struct neigh_parms *parms;
+        u32 inaddr_any = INADDR_ANY;
 
+        if (dev->flags & (IFF_LOOPBACK | IFF_POINTOPOINT))
+                memcpy(neigh->primary_key, &inaddr_any, arp_tbl.key_len);
+
+        addr = *(__be32 *)neigh->primary_key;
         rcu_read_lock();
         in_dev = __in_dev_get_rcu(dev);
         if (!in_dev) {
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index a4573bccd6da..7a93359fbc72 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1428,7 +1428,7 @@ skip:
 
 static bool inetdev_valid_mtu(unsigned int mtu)
 {
-        return mtu >= 68;
+        return mtu >= IPV4_MIN_MTU;
 }
 
 static void inetdev_send_gratuitous_arp(struct net_device *dev,
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index d57aa64fa7c7..61fe6e4d23fc 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -981,6 +981,7 @@ static int esp_init_state(struct xfrm_state *x)
 
                 switch (encap->encap_type) {
                 default:
+                        err = -EINVAL;
                         goto error;
                 case UDP_ENCAP_ESPINUDP:
                         x->props.header_len += sizeof(struct udphdr);
diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c
index f8b918c766b0..29b333a62ab0 100644
--- a/net/ipv4/esp4_offload.c
+++ b/net/ipv4/esp4_offload.c
@@ -38,7 +38,8 @@ static struct sk_buff **esp4_gro_receive(struct sk_buff **head,
         __be32 spi;
         int err;
 
-        skb_pull(skb, offset);
+        if (!pskb_pull(skb, offset))
+                return NULL;
 
         if ((err = xfrm_parse_spi(skb, IPPROTO_ESP, &spi, &seq)) != 0)
                 goto out;
@@ -121,6 +122,9 @@ static struct sk_buff *esp4_gso_segment(struct sk_buff *skb,
         if (!xo)
                 goto out;
 
+        if (!(skb_shinfo(skb)->gso_type & SKB_GSO_ESP))
+                goto out;
+
         seq = xo->seq.low;
 
         x = skb->sp->xvec[skb->sp->len - 1];
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index f52d27a422c3..08259d078b1c 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1298,14 +1298,19 @@ err_table_hash_alloc:
 
 static void ip_fib_net_exit(struct net *net)
 {
-        unsigned int i;
+        int i;
 
         rtnl_lock();
 #ifdef CONFIG_IP_MULTIPLE_TABLES
         RCU_INIT_POINTER(net->ipv4.fib_main, NULL);
         RCU_INIT_POINTER(net->ipv4.fib_default, NULL);
 #endif
-        for (i = 0; i < FIB_TABLE_HASHSZ; i++) {
+        /* Destroy the tables in reverse order to guarantee that the
+         * local table, ID 255, is destroyed before the main table, ID
+         * 254. This is necessary as the local table may contain
+         * references to data contained in the main table.
+         */
+        for (i = FIB_TABLE_HASHSZ - 1; i >= 0; i--) {
                 struct hlist_head *head = &net->ipv4.fib_table_hash[i];
                 struct hlist_node *tmp;
                 struct fib_table *tb;
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index f04d944f8abe..c586597da20d 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -698,7 +698,7 @@ bool fib_metrics_match(struct fib_config *cfg, struct fib_info *fi)
 
         nla_for_each_attr(nla, cfg->fc_mx, cfg->fc_mx_len, remaining) {
                 int type = nla_type(nla);
-                u32 val;
+                u32 fi_val, val;
 
                 if (!type)
                         continue;
@@ -715,7 +715,11 @@ bool fib_metrics_match(struct fib_config *cfg, struct fib_info *fi)
                         val = nla_get_u32(nla);
                 }
 
-                if (fi->fib_metrics->metrics[type - 1] != val)
+                fi_val = fi->fib_metrics->metrics[type - 1];
+                if (type == RTAX_FEATURES)
+                        fi_val &= ~DST_FEATURE_ECN_CA;
+
+                if (fi_val != val)
                         return false;
         }
 
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index d1f8f302dbf3..2d49717a7421 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -89,6 +89,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/times.h>
 #include <linux/pkt_sched.h>
+#include <linux/byteorder/generic.h>
 
 #include <net/net_namespace.h>
 #include <net/arp.h>
@@ -321,6 +322,23 @@ igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted)
         return scount;
 }
 
+/* source address selection per RFC 3376 section 4.2.13 */
+static __be32 igmpv3_get_srcaddr(struct net_device *dev,
+                                 const struct flowi4 *fl4)
+{
+        struct in_device *in_dev = __in_dev_get_rcu(dev);
+
+        if (!in_dev)
+                return htonl(INADDR_ANY);
+
+        for_ifa(in_dev) {
+                if (fl4->saddr == ifa->ifa_local)
+                        return fl4->saddr;
+        } endfor_ifa(in_dev);
+
+        return htonl(INADDR_ANY);
+}
+
 static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu)
 {
         struct sk_buff *skb;
@@ -368,7 +386,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu)
         pip->frag_off = htons(IP_DF);
         pip->ttl      = 1;
         pip->daddr    = fl4.daddr;
-        pip->saddr    = fl4.saddr;
+        pip->saddr    = igmpv3_get_srcaddr(dev, &fl4);
         pip->protocol = IPPROTO_IGMP;
         pip->tot_len  = 0;      /* filled in later */
         ip_select_ident(net, skb, NULL);
@@ -404,16 +422,17 @@ static int grec_size(struct ip_mc_list *pmc, int type, int gdel, int sdel)
 }
 
 static struct sk_buff *add_grhead(struct sk_buff *skb, struct ip_mc_list *pmc,
-        int type, struct igmpv3_grec **ppgr)
+        int type, struct igmpv3_grec **ppgr, unsigned int mtu)
 {
         struct net_device *dev = pmc->interface->dev;
         struct igmpv3_report *pih;
         struct igmpv3_grec *pgr;
 
-        if (!skb)
-                skb = igmpv3_newpack(dev, dev->mtu);
-        if (!skb)
-                return NULL;
+        if (!skb) {
+                skb = igmpv3_newpack(dev, mtu);
+                if (!skb)
+                        return NULL;
+        }
         pgr = skb_put(skb, sizeof(struct igmpv3_grec));
         pgr->grec_type = type;
         pgr->grec_auxwords = 0;
@@ -436,12 +455,17 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
         struct igmpv3_grec *pgr = NULL;
         struct ip_sf_list *psf, *psf_next, *psf_prev, **psf_list;
         int scount, stotal, first, isquery, truncate;
+        unsigned int mtu;
 
         if (pmc->multiaddr == IGMP_ALL_HOSTS)
                 return skb;
         if (ipv4_is_local_multicast(pmc->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports)
                 return skb;
 
+        mtu = READ_ONCE(dev->mtu);
+        if (mtu < IPV4_MIN_MTU)
+                return skb;
+
         isquery = type == IGMPV3_MODE_IS_INCLUDE ||
                   type == IGMPV3_MODE_IS_EXCLUDE;
         truncate = type == IGMPV3_MODE_IS_EXCLUDE ||
@@ -462,7 +486,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
                     AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
                         if (skb)
                                 igmpv3_sendpack(skb);
-                        skb = igmpv3_newpack(dev, dev->mtu);
+                        skb = igmpv3_newpack(dev, mtu);
                 }
         }
         first = 1;
@@ -498,12 +522,12 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
                                 pgr->grec_nsrcs = htons(scount);
                         if (skb)
                                 igmpv3_sendpack(skb);
-                        skb = igmpv3_newpack(dev, dev->mtu);
+                        skb = igmpv3_newpack(dev, mtu);
                         first = 1;
                         scount = 0;
                 }
                 if (first) {
-                        skb = add_grhead(skb, pmc, type, &pgr);
+                        skb = add_grhead(skb, pmc, type, &pgr, mtu);
                         first = 0;
                 }
                 if (!skb)
@@ -538,7 +562,7 @@ empty_source:
                                 igmpv3_sendpack(skb);
                                 skb = NULL; /* add_grhead will get a new one */
                         }
-                        skb = add_grhead(skb, pmc, type, &pgr);
+                        skb = add_grhead(skb, pmc, type, &pgr, mtu);
                 }
         }
         if (pgr)
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index c690cd0d9b3f..b563e0c46bac 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -93,7 +93,7 @@ static void inet_twsk_add_bind_node(struct inet_timewait_sock *tw,
 }
 
 /*
- * Enter the time wait state.
+ * Enter the time wait state. This is called with locally disabled BH.
  * Essentially we whip up a timewait bucket, copy the relevant info into it
  * from the SK, and mess with hash chains and list linkage.
  */
@@ -111,7 +111,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
          */
         bhead = &hashinfo->bhash[inet_bhashfn(twsk_net(tw), inet->inet_num,
                         hashinfo->bhash_size)];
-        spin_lock_bh(&bhead->lock);
+        spin_lock(&bhead->lock);
         tw->tw_tb = icsk->icsk_bind_hash;
         WARN_ON(!icsk->icsk_bind_hash);
         inet_twsk_add_bind_node(tw, &tw->tw_tb->owners);
@@ -137,7 +137,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
         if (__sk_nulls_del_node_init_rcu(sk))
                 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
 
-        spin_unlock_bh(lock);
+        spin_unlock(lock);
 }
 EXPORT_SYMBOL_GPL(__inet_twsk_hashdance);
 
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index bb6239169b1a..45ffd3d045d2 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -266,7 +266,7 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
         len = gre_hdr_len + sizeof(*ershdr);
 
         if (unlikely(!pskb_may_pull(skb, len)))
-                return -ENOMEM;
+                return PACKET_REJECT;
 
         iph = ip_hdr(skb);
         ershdr = (struct erspanhdr *)(skb->data + gre_hdr_len);
@@ -1310,6 +1310,7 @@ static const struct net_device_ops erspan_netdev_ops = {
 static void ipgre_tap_setup(struct net_device *dev)
 {
         ether_setup(dev);
+        dev->max_mtu = 0;
         dev->netdev_ops = &gre_tap_netdev_ops;
         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index fe6fee728ce4..6d21068f9b55 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -349,8 +349,8 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
         dev->needed_headroom = t_hlen + hlen;
         mtu -= (dev->hard_header_len + t_hlen);
 
-        if (mtu < 68)
-                mtu = 68;
+        if (mtu < IPV4_MIN_MTU)
+                mtu = IPV4_MIN_MTU;
 
         return mtu;
 }
@@ -520,8 +520,7 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
         else
                 mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
 
-        if (skb_dst(skb))
-                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
+        skb_dst_update_pmtu(skb, mtu);
 
         if (skb->protocol == htons(ETH_P_IP)) {
                 if (!skb_is_gso(skb) &&
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 949f432a5f04..51b1669334fe 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -200,7 +200,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
 
         mtu = dst_mtu(dst);
         if (skb->len > mtu) {
-                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
+                skb_dst_update_pmtu(skb, mtu);
                 if (skb->protocol == htons(ETH_P_IP)) {
                         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
                                   htonl(mtu));
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index f88221aebc9d..0c3c944a7b72 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -373,7 +373,6 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
                                         if (!xt_find_jump_offset(offsets, newpos,
                                                                  newinfo->number))
                                                 return 0;
-                                        e = entry0 + newpos;
                                 } else {
                                         /* ... this is a fallthru */
                                         newpos = pos + e->next_offset;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 4cbe5e80f3bf..2e0d339028bb 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -439,7 +439,6 @@ mark_source_chains(const struct xt_table_info *newinfo,
                                         if (!xt_find_jump_offset(offsets, newpos,
                                                                  newinfo->number))
                                                 return 0;
-                                        e = entry0 + newpos;
                                 } else {
                                         /* ... this is a fallthru */
                                         newpos = pos + e->next_offset;
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 17b4ca562944..69060e3abe85 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -813,12 +813,13 @@ static int clusterip_net_init(struct net *net)
 
 static void clusterip_net_exit(struct net *net)
 {
-#ifdef CONFIG_PROC_FS
         struct clusterip_net *cn = net_generic(net, clusterip_net_id);
+#ifdef CONFIG_PROC_FS
         proc_remove(cn->procdir);
         cn->procdir = NULL;
 #endif
         nf_unregister_net_hook(net, &cip_arp_ops);
+        WARN_ON_ONCE(!list_empty(&cn->configs));
 }
 
 static struct pernet_operations clusterip_net_ops = {
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 33b70bfd1122..5e570aa9e43b 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -513,11 +513,18 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         int err;
         struct ip_options_data opt_copy;
         struct raw_frag_vec rfv;
+        int hdrincl;
 
         err = -EMSGSIZE;
         if (len > 0xFFFF)
                 goto out;
 
+        /* hdrincl should be READ_ONCE(inet->hdrincl)
+         * but READ_ONCE() doesn't work with bit fields.
+         * Doing this indirectly yields the same result.
+         */
+        hdrincl = inet->hdrincl;
+        hdrincl = READ_ONCE(hdrincl);
         /*
          *      Check the flags.
          */
@@ -593,7 +600,7 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
                 /* Linux does not mangle headers on raw sockets,
                  * so that IP options + IP_HDRINCL is non-sense.
                  */
-                if (inet->hdrincl)
+                if (hdrincl)
                         goto done;
                 if (ipc.opt->opt.srr) {
                         if (!daddr)
@@ -615,12 +622,12 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 
         flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
                            RT_SCOPE_UNIVERSE,
-                           inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
+                           hdrincl ? IPPROTO_RAW : sk->sk_protocol,
                            inet_sk_flowi_flags(sk) |
-                            (inet->hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
+                            (hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
                            daddr, saddr, 0, 0, sk->sk_uid);
 
-        if (!inet->hdrincl) {
+        if (!hdrincl) {
                 rfv.msg = msg;
                 rfv.hlen = 0;
 
@@ -645,7 +652,7 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
                 goto do_confirm;
 back_from_confirm:
 
-        if (inet->hdrincl)
+        if (hdrincl)
                 err = raw_send_hdrinc(sk, &fl4, msg, len,
                                       &rt, msg->msg_flags, &ipc.sockc);
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 43b69af242e1..4e153b23bcec 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2762,6 +2762,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                 if (err == 0 && rt->dst.error)
                         err = -rt->dst.error;
         } else {
+                fl4.flowi4_iif = LOOPBACK_IFINDEX;
                 rt = ip_route_output_key_hash_rcu(net, &fl4, &res, skb);
                 err = 0;
                 if (IS_ERR(rt))
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index bf97317e6c97..8e053ad7cae2 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2298,6 +2298,9 @@ adjudge_to_death:
                         tcp_send_active_reset(sk, GFP_ATOMIC);
                         __NET_INC_STATS(sock_net(sk),
                                         LINUX_MIB_TCPABORTONMEMORY);
+                } else if (!check_net(sock_net(sk))) {
+                        /* Not possible to send reset; just close */
+                        tcp_set_state(sk, TCP_CLOSE);
                 }
         }
 
@@ -2412,6 +2415,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         tp->snd_cwnd_cnt = 0;
         tp->window_clamp = 0;
         tcp_set_ca_state(sk, TCP_CA_Open);
+        tp->is_sack_reneg = 0;
         tcp_clear_retrans(tp);
         inet_csk_delack_init(sk);
         /* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0
diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
index 69ee877574d0..8322f26e770e 100644
--- a/net/ipv4/tcp_bbr.c
+++ b/net/ipv4/tcp_bbr.c
@@ -110,7 +110,8 @@ struct bbr {
         u32     lt_last_lost;        /* LT intvl start: tp->lost */
         u32     pacing_gain:10, /* current gain for setting pacing rate */
                 cwnd_gain:10,   /* current gain for setting cwnd */
-                full_bw_cnt:3,  /* number of rounds without large bw gains */
+                full_bw_reached:1,   /* reached full bw in Startup? */
+                full_bw_cnt:2,  /* number of rounds without large bw gains */
                 cycle_idx:3,    /* current index in pacing_gain cycle array */
                 has_seen_rtt:1, /* have we seen an RTT sample yet? */
                 unused_b:5;
@@ -180,7 +181,7 @@ static bool bbr_full_bw_reached(const struct sock *sk)
 {
         const struct bbr *bbr = inet_csk_ca(sk);
 
-        return bbr->full_bw_cnt >= bbr_full_bw_cnt;
+        return bbr->full_bw_reached;
 }
 
 /* Return the windowed max recent bandwidth sample, in pkts/uS << BW_SCALE. */
@@ -717,6 +718,7 @@ static void bbr_check_full_bw_reached(struct sock *sk,
                 return;
         }
         ++bbr->full_bw_cnt;
+        bbr->full_bw_reached = bbr->full_bw_cnt >= bbr_full_bw_cnt;
 }
 
 /* If pipe is probably full, drain the queue and then enter steady-state. */
@@ -850,6 +852,7 @@ static void bbr_init(struct sock *sk)
         bbr->restore_cwnd = 0;
         bbr->round_start = 0;
         bbr->idle_restart = 0;
+        bbr->full_bw_reached = 0;
         bbr->full_bw = 0;
         bbr->full_bw_cnt = 0;
         bbr->cycle_mstamp = 0;
@@ -871,6 +874,11 @@ static u32 bbr_sndbuf_expand(struct sock *sk)
  */
 static u32 bbr_undo_cwnd(struct sock *sk)
 {
+        struct bbr *bbr = inet_csk_ca(sk);
+
+        bbr->full_bw = 0;   /* spurious slow-down; reset full pipe detection */
+        bbr->full_bw_cnt = 0;
+        bbr_reset_lt_bw_sampling(sk);
         return tcp_sk(sk)->snd_cwnd;
 }
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 734cfc8ff76e..45f750e85714 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -508,9 +508,6 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)
         u32 new_sample = tp->rcv_rtt_est.rtt_us;
         long m = sample;
 
-        if (m == 0)
-                m = 1;
-
         if (new_sample != 0) {
                 /* If we sample in larger samples in the non-timestamp
                  * case, we could grossly overestimate the RTT especially
@@ -547,6 +544,8 @@ static inline void tcp_rcv_rtt_measure(struct tcp_sock *tp)
         if (before(tp->rcv_nxt, tp->rcv_rtt_est.seq))
                 return;
         delta_us = tcp_stamp_us_delta(tp->tcp_mstamp, tp->rcv_rtt_est.time);
+        if (!delta_us)
+                delta_us = 1;
         tcp_rcv_rtt_update(tp, delta_us, 1);
 
 new_measure:
@@ -563,8 +562,11 @@ static inline void tcp_rcv_rtt_measure_ts(struct sock *sk,
             (TCP_SKB_CB(skb)->end_seq -
              TCP_SKB_CB(skb)->seq >= inet_csk(sk)->icsk_ack.rcv_mss)) {
                 u32 delta = tcp_time_stamp(tp) - tp->rx_opt.rcv_tsecr;
-                u32 delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
+                u32 delta_us;
 
+                if (!delta)
+                        delta = 1;
+                delta_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
                 tcp_rcv_rtt_update(tp, delta_us, 0);
         }
 }
@@ -579,6 +581,7 @@ void tcp_rcv_space_adjust(struct sock *sk)
         int time;
         int copied;
 
+        tcp_mstamp_refresh(tp);
         time = tcp_stamp_us_delta(tp->tcp_mstamp, tp->rcvq_space.time);
         if (time < (tp->rcv_rtt_est.rtt_us >> 3) || tp->rcv_rtt_est.rtt_us == 0)
                 return;
@@ -1941,6 +1944,8 @@ void tcp_enter_loss(struct sock *sk)
         if (is_reneg) {
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSACKRENEGING);
                 tp->sacked_out = 0;
+                /* Mark SACK reneging until we recover from this loss event. */
+                tp->is_sack_reneg = 1;
         }
         tcp_clear_all_retrans_hints(tp);
 
@@ -2326,6 +2331,7 @@ static void tcp_undo_cwnd_reduction(struct sock *sk, bool unmark_loss)
         }
         tp->snd_cwnd_stamp = tcp_jiffies32;
         tp->undo_marker = 0;
+        tp->rack.advanced = 1; /* Force RACK to re-exam losses */
 }
 
 static inline bool tcp_may_undo(const struct tcp_sock *tp)
@@ -2364,6 +2370,7 @@ static bool tcp_try_undo_recovery(struct sock *sk)
                 return true;
         }
         tcp_set_ca_state(sk, TCP_CA_Open);
+        tp->is_sack_reneg = 0;
         return false;
 }
 
@@ -2397,8 +2404,10 @@ static bool tcp_try_undo_loss(struct sock *sk, bool frto_undo)
                         NET_INC_STATS(sock_net(sk),
                                         LINUX_MIB_TCPSPURIOUSRTOS);
                 inet_csk(sk)->icsk_retransmits = 0;
-                if (frto_undo || tcp_is_sack(tp))
+                if (frto_undo || tcp_is_sack(tp)) {
                         tcp_set_ca_state(sk, TCP_CA_Open);
+                        tp->is_sack_reneg = 0;
+                }
                 return true;
         }
         return false;
@@ -3495,6 +3504,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
         struct tcp_sacktag_state sack_state;
         struct rate_sample rs = { .prior_delivered = 0 };
         u32 prior_snd_una = tp->snd_una;
+        bool is_sack_reneg = tp->is_sack_reneg;
         u32 ack_seq = TCP_SKB_CB(skb)->seq;
         u32 ack = TCP_SKB_CB(skb)->ack_seq;
         bool is_dupack = false;
@@ -3611,7 +3621,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
 
         delivered = tp->delivered - delivered;  /* freshly ACKed or SACKed */
         lost = tp->lost - lost;                 /* freshly marked lost */
-        tcp_rate_gen(sk, delivered, lost, sack_state.rate);
+        tcp_rate_gen(sk, delivered, lost, is_sack_reneg, sack_state.rate);
         tcp_cong_control(sk, ack, delivered, flag, sack_state.rate);
         tcp_xmit_recovery(sk, rexmit);
         return 1;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index c6bc0c4d19c6..94e28350f420 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -848,7 +848,7 @@ static void tcp_v4_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
                         tcp_time_stamp_raw() + tcp_rsk(req)->ts_off,
                         req->ts_recent,
                         0,
-                        tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&ip_hdr(skb)->daddr,
+                        tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&ip_hdr(skb)->saddr,
                                           AF_INET),
                         inet_rsk(req)->no_srccheck ? IP_REPLY_ARG_NOSRCCHECK : 0,
                         ip_hdr(skb)->tos);
@@ -1591,6 +1591,34 @@ int tcp_filter(struct sock *sk, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(tcp_filter);
 
+static void tcp_v4_restore_cb(struct sk_buff *skb)
+{
+        memmove(IPCB(skb), &TCP_SKB_CB(skb)->header.h4,
+                sizeof(struct inet_skb_parm));
+}
+
+static void tcp_v4_fill_cb(struct sk_buff *skb, const struct iphdr *iph,
+                           const struct tcphdr *th)
+{
+        /* This is tricky : We move IPCB at its correct location into TCP_SKB_CB()
+         * barrier() makes sure compiler wont play fool^Waliasing games.
+         */
+        memmove(&TCP_SKB_CB(skb)->header.h4, IPCB(skb),
+                sizeof(struct inet_skb_parm));
+        barrier();
+
+        TCP_SKB_CB(skb)->seq = ntohl(th->seq);
+        TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
+                                    skb->len - th->doff * 4);
+        TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
+        TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
+        TCP_SKB_CB(skb)->tcp_tw_isn = 0;
+        TCP_SKB_CB(skb)->ip_dsfield = ipv4_get_dsfield(iph);
+        TCP_SKB_CB(skb)->sacked  = 0;
+        TCP_SKB_CB(skb)->has_rxtstamp =
+                        skb->tstamp || skb_hwtstamps(skb)->hwtstamp;
+}
+
 /*
  *      From tcp_input.c
  */
@@ -1631,24 +1659,6 @@ int tcp_v4_rcv(struct sk_buff *skb)
 
         th = (const struct tcphdr *)skb->data;
         iph = ip_hdr(skb);
-        /* This is tricky : We move IPCB at its correct location into TCP_SKB_CB()
-         * barrier() makes sure compiler wont play fool^Waliasing games.
-         */
-        memmove(&TCP_SKB_CB(skb)->header.h4, IPCB(skb),
-                sizeof(struct inet_skb_parm));
-        barrier();
-
-        TCP_SKB_CB(skb)->seq = ntohl(th->seq);
-        TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
-                                    skb->len - th->doff * 4);
-        TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
-        TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
-        TCP_SKB_CB(skb)->tcp_tw_isn = 0;
-        TCP_SKB_CB(skb)->ip_dsfield = ipv4_get_dsfield(iph);
-        TCP_SKB_CB(skb)->sacked  = 0;
-        TCP_SKB_CB(skb)->has_rxtstamp =
-                        skb->tstamp || skb_hwtstamps(skb)->hwtstamp;
-
 lookup:
         sk = __inet_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th), th->source,
                                th->dest, sdif, &refcounted);
@@ -1679,14 +1689,19 @@ process:
                 sock_hold(sk);
                 refcounted = true;
                 nsk = NULL;
-                if (!tcp_filter(sk, skb))
+                if (!tcp_filter(sk, skb)) {
+                        th = (const struct tcphdr *)skb->data;
+                        iph = ip_hdr(skb);
+                        tcp_v4_fill_cb(skb, iph, th);
                         nsk = tcp_check_req(sk, skb, req, false);
+                }
                 if (!nsk) {
                         reqsk_put(req);
                         goto discard_and_relse;
                 }
                 if (nsk == sk) {
                         reqsk_put(req);
+                        tcp_v4_restore_cb(skb);
                 } else if (tcp_child_process(sk, nsk, skb)) {
                         tcp_v4_send_reset(nsk, skb);
                         goto discard_and_relse;
@@ -1712,6 +1727,7 @@ process:
                 goto discard_and_relse;
         th = (const struct tcphdr *)skb->data;
         iph = ip_hdr(skb);
+        tcp_v4_fill_cb(skb, iph, th);
 
         skb->dev = NULL;
 
@@ -1742,6 +1758,8 @@ no_tcp_socket:
         if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
                 goto discard_it;
 
+        tcp_v4_fill_cb(skb, iph, th);
+
         if (tcp_checksum_complete(skb)) {
 csum_error:
                 __TCP_INC_STATS(net, TCP_MIB_CSUMERRORS);
@@ -1768,6 +1786,8 @@ do_time_wait:
                 goto discard_it;
         }
 
+        tcp_v4_fill_cb(skb, iph, th);
+
         if (tcp_checksum_complete(skb)) {
                 inet_twsk_put(inet_twsk(sk));
                 goto csum_error;
@@ -1784,6 +1804,7 @@ do_time_wait:
                 if (sk2) {
                         inet_twsk_deschedule_put(inet_twsk(sk));
                         sk = sk2;
+                        tcp_v4_restore_cb(skb);
                         refcounted = false;
                         goto process;
                 }
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index e36eff0403f4..b079b619b60c 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -310,10 +310,16 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                 if (state == TCP_TIME_WAIT)
                         timeo = TCP_TIMEWAIT_LEN;
 
+                /* tw_timer is pinned, so we need to make sure BH are disabled
+                 * in following section, otherwise timer handler could run before
+                 * we complete the initialization.
+                 */
+                local_bh_disable();
                 inet_twsk_schedule(tw, timeo);
                 /* Linkage updates. */
                 __inet_twsk_hashdance(tw, sk, &tcp_hashinfo);
                 inet_twsk_put(tw);
+                local_bh_enable();
         } else {
                 /* Sorry, if we're out of memory, just CLOSE this
                  * socket up.  We've got bigger problems than
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index b6a2aa1dcf56..4d58e2ce0b5b 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -32,6 +32,9 @@ static void tcp_gso_tstamp(struct sk_buff *skb, unsigned int ts_seq,
 static struct sk_buff *tcp4_gso_segment(struct sk_buff *skb,
                                         netdev_features_t features)
 {
+        if (!(skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4))
+                return ERR_PTR(-EINVAL);
+
         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
                 return ERR_PTR(-EINVAL);
 
diff --git a/net/ipv4/tcp_rate.c b/net/ipv4/tcp_rate.c
index 3330a370d306..c61240e43923 100644
--- a/net/ipv4/tcp_rate.c
+++ b/net/ipv4/tcp_rate.c
@@ -106,7 +106,7 @@ void tcp_rate_skb_delivered(struct sock *sk, struct sk_buff *skb,
 
 /* Update the connection delivery information and generate a rate sample. */
 void tcp_rate_gen(struct sock *sk, u32 delivered, u32 lost,
-                  struct rate_sample *rs)
+                  bool is_sack_reneg, struct rate_sample *rs)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         u32 snd_us, ack_us;
@@ -124,8 +124,12 @@ void tcp_rate_gen(struct sock *sk, u32 delivered, u32 lost,
 
         rs->acked_sacked = delivered;   /* freshly ACKed or SACKed */
         rs->losses = lost;              /* freshly marked lost */
-        /* Return an invalid sample if no timing information is available. */
-        if (!rs->prior_mstamp) {
+        /* Return an invalid sample if no timing information is available or
+         * in recovery from loss with SACK reneging. Rate samples taken during
+         * a SACK reneging event may overestimate bw by including packets that
+         * were SACKed before the reneg.
+         */
+        if (!rs->prior_mstamp || is_sack_reneg) {
                 rs->delivered = -1;
                 rs->interval_us = -1;
                 return;
diff --git a/net/ipv4/tcp_recovery.c b/net/ipv4/tcp_recovery.c
index d3ea89020c69..3a81720ac0c4 100644
--- a/net/ipv4/tcp_recovery.c
+++ b/net/ipv4/tcp_recovery.c
@@ -55,7 +55,8 @@ static void tcp_rack_detect_loss(struct sock *sk, u32 *reo_timeout)
          * to queuing or delayed ACKs.
          */
         reo_wnd = 1000;
-        if ((tp->rack.reord || !tp->lost_out) && min_rtt != ~0U) {
+        if ((tp->rack.reord || inet_csk(sk)->icsk_ca_state < TCP_CA_Recovery) &&
+            min_rtt != ~0U) {
                 reo_wnd = max((min_rtt >> 2) * tp->rack.reo_wnd_steps, reo_wnd);
                 reo_wnd = min(reo_wnd, tp->srtt_us >> 3);
         }
@@ -79,12 +80,12 @@ static void tcp_rack_detect_loss(struct sock *sk, u32 *reo_timeout)
                  */
                 remaining = tp->rack.rtt_us + reo_wnd -
                             tcp_stamp_us_delta(tp->tcp_mstamp, skb->skb_mstamp);
-                if (remaining < 0) {
+                if (remaining <= 0) {
                         tcp_rack_mark_skb_lost(sk, skb);
                         list_del_init(&skb->tcp_tsorted_anchor);
                 } else {
-                        /* Record maximum wait time (+1 to avoid 0) */
-                        *reo_timeout = max_t(u32, *reo_timeout, 1 + remaining);
+                        /* Record maximum wait time */
+                        *reo_timeout = max_t(u32, *reo_timeout, remaining);
                 }
         }
 }
@@ -116,13 +117,8 @@ void tcp_rack_advance(struct tcp_sock *tp, u8 sacked, u32 end_seq,
 {
         u32 rtt_us;
 
-        if (tp->rack.mstamp &&
-            !tcp_rack_sent_after(xmit_time, tp->rack.mstamp,
-                                 end_seq, tp->rack.end_seq))
-                return;
-
         rtt_us = tcp_stamp_us_delta(tp->tcp_mstamp, xmit_time);
-        if (sacked & TCPCB_RETRANS) {
+        if (rtt_us < tcp_min_rtt(tp) && (sacked & TCPCB_RETRANS)) {
                 /* If the sacked packet was retransmitted, it's ambiguous
                  * whether the retransmission or the original (or the prior
                  * retransmission) was sacked.
@@ -133,13 +129,15 @@ void tcp_rack_advance(struct tcp_sock *tp, u8 sacked, u32 end_seq,
                  * so it's at least one RTT (i.e., retransmission is at least
                  * an RTT later).
                  */
-                if (rtt_us < tcp_min_rtt(tp))
-                        return;
+                return;
         }
-        tp->rack.rtt_us = rtt_us;
-        tp->rack.mstamp = xmit_time;
-        tp->rack.end_seq = end_seq;
         tp->rack.advanced = 1;
+        tp->rack.rtt_us = rtt_us;
+        if (tcp_rack_sent_after(xmit_time, tp->rack.mstamp,
+                                end_seq, tp->rack.end_seq)) {
+                tp->rack.mstamp = xmit_time;
+                tp->rack.end_seq = end_seq;
+        }
 }
 
 /* We have waited long enough to accommodate reordering. Mark the expired
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 16df6dd44b98..388158c9d9f6 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -48,11 +48,19 @@ static void tcp_write_err(struct sock *sk)
  *  to prevent DoS attacks. It is called when a retransmission timeout
  *  or zero probe timeout occurs on orphaned socket.
  *
+ *  Also close if our net namespace is exiting; in that case there is no
+ *  hope of ever communicating again since all netns interfaces are already
+ *  down (or about to be down), and we need to release our dst references,
+ *  which have been moved to the netns loopback interface, so the namespace
+ *  can finish exiting.  This condition is only possible if we are a kernel
+ *  socket, as those do not hold references to the namespace.
+ *
  *  Criteria is still not confirmed experimentally and may change.
  *  We kill the socket, if:
  *  1. If number of orphaned sockets exceeds an administratively configured
  *     limit.
  *  2. If we have strong memory pressure.
+ *  3. If our net namespace is exiting.
  */
 static int tcp_out_of_resources(struct sock *sk, bool do_reset)
 {
@@ -81,6 +89,13 @@ static int tcp_out_of_resources(struct sock *sk, bool do_reset)
                 __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONMEMORY);
                 return 1;
         }
+
+        if (!check_net(sock_net(sk))) {
+                /* Not possible to send reset; just close */
+                tcp_done(sk);
+                return 1;
+        }
+
         return 0;
 }
 
@@ -264,6 +279,7 @@ void tcp_delack_timer_handler(struct sock *sk)
                         icsk->icsk_ack.pingpong = 0;
                         icsk->icsk_ack.ato      = TCP_ATO_MIN;
                 }
+                tcp_mstamp_refresh(tcp_sk(sk));
                 tcp_send_ack(sk);
                 __NET_INC_STATS(sock_net(sk), LINUX_MIB_DELAYEDACKS);
         }
@@ -632,6 +648,7 @@ static void tcp_keepalive_timer (struct timer_list *t)
                 goto out;
         }
 
+        tcp_mstamp_refresh(tp);
         if (sk->sk_state == TCP_FIN_WAIT2 && sock_flag(sk, SOCK_DEAD)) {
                 if (tp->linger2 >= 0) {
                         const int tmo = tcp_fin_time(sk) - TCP_TIMEWAIT_LEN;
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 01801b77bd0d..ea6e6e7df0ee 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -203,6 +203,9 @@ static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
                 goto out;
         }
 
+        if (!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP))
+                goto out;
+
         if (!pskb_may_pull(skb, sizeof(struct udphdr)))
                 goto out;
 
diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index e50b7fea57ee..bcfc00e88756 100644
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -23,6 +23,12 @@ int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb)
         return xfrm4_extract_header(skb);
 }
 
+static int xfrm4_rcv_encap_finish2(struct net *net, struct sock *sk,
+                                   struct sk_buff *skb)
+{
+        return dst_input(skb);
+}
+
 static inline int xfrm4_rcv_encap_finish(struct net *net, struct sock *sk,
                                          struct sk_buff *skb)
 {
@@ -33,7 +39,11 @@ static inline int xfrm4_rcv_encap_finish(struct net *net, struct sock *sk,
                                          iph->tos, skb->dev))
                         goto drop;
         }
-        return dst_input(skb);
+
+        if (xfrm_trans_queue(skb, xfrm4_rcv_encap_finish2))
+                goto drop;
+
+        return 0;
 drop:
         kfree_skb(skb);
         return NET_RX_DROP;
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index e6265e2c274e..20ca486b3cad 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -92,6 +92,7 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb_reset_network_header(skb);
         skb_mac_header_rebuild(skb);
+        eth_hdr(skb)->h_proto = skb->protocol;
 
         err = 0;
 
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index c26f71234b9c..c9441ca45399 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -210,7 +210,6 @@ lookup_protocol:
         np->mcast_hops  = IPV6_DEFAULT_MCASTHOPS;
         np->mc_loop     = 1;
         np->pmtudisc    = IPV6_PMTUDISC_WANT;
-        np->autoflowlabel = ip6_default_np_autolabel(net);
         np->repflow     = net->ipv6.sysctl.flowlabel_reflect;
         sk->sk_ipv6only = net->ipv6.sysctl.bindv6only;
 
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index a902ff8f59be..1a7f00cd4803 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -890,13 +890,12 @@ static int esp6_init_state(struct xfrm_state *x)
                         x->props.header_len += IPV4_BEET_PHMAXLEN +
                                                (sizeof(struct ipv6hdr) - sizeof(struct iphdr));
                 break;
+        default:
         case XFRM_MODE_TRANSPORT:
                 break;
         case XFRM_MODE_TUNNEL:
                 x->props.header_len += sizeof(struct ipv6hdr);
                 break;
-        default:
-                goto error;
         }
 
         align = ALIGN(crypto_aead_blocksize(aead), 4);
diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
index 333a478aa161..f52c314d4c97 100644
--- a/net/ipv6/esp6_offload.c
+++ b/net/ipv6/esp6_offload.c
@@ -60,7 +60,8 @@ static struct sk_buff **esp6_gro_receive(struct sk_buff **head,
         int nhoff;
         int err;
 
-        skb_pull(skb, offset);
+        if (!pskb_pull(skb, offset))
+                return NULL;
 
         if ((err = xfrm_parse_spi(skb, IPPROTO_ESP, &spi, &seq)) != 0)
                 goto out;
@@ -148,6 +149,9 @@ static struct sk_buff *esp6_gso_segment(struct sk_buff *skb,
         if (!xo)
                 goto out;
 
+        if (!(skb_shinfo(skb)->gso_type & SKB_GSO_ESP))
+                goto out;
+
         seq = xo->seq.low;
 
         x = skb->sp->xvec[skb->sp->len - 1];
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 83bd75713535..bc68eb661970 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -925,6 +925,15 @@ static void ipv6_push_rthdr4(struct sk_buff *skb, u8 *proto,
         sr_phdr->segments[0] = **addr_p;
         *addr_p = &sr_ihdr->segments[sr_ihdr->segments_left];
 
+        if (sr_ihdr->hdrlen > hops * 2) {
+                int tlvs_offset, tlvs_length;
+
+                tlvs_offset = (1 + hops * 2) << 3;
+                tlvs_length = (sr_ihdr->hdrlen - hops * 2) << 3;
+                memcpy((char *)sr_phdr + tlvs_offset,
+                       (char *)sr_ihdr + tlvs_offset, tlvs_length);
+        }
+
 #ifdef CONFIG_IPV6_SEG6_HMAC
         if (sr_has_hmac(sr_phdr)) {
                 struct net *net = NULL;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index f5285f4e1d08..217683d40f12 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -640,6 +640,11 @@ static struct fib6_node *fib6_add_1(struct net *net,
                         if (!(fn->fn_flags & RTN_RTINFO)) {
                                 RCU_INIT_POINTER(fn->leaf, NULL);
                                 rt6_release(leaf);
+                        /* remove null_entry in the root node */
+                        } else if (fn->fn_flags & RTN_TL_ROOT &&
+                                   rcu_access_pointer(fn->leaf) ==
+                                   net->ipv6.ip6_null_entry) {
+                                RCU_INIT_POINTER(fn->leaf, NULL);
                         }
 
                         return fn;
@@ -1221,8 +1226,14 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
                 }
 
                 if (!rcu_access_pointer(fn->leaf)) {
-                        atomic_inc(&rt->rt6i_ref);
-                        rcu_assign_pointer(fn->leaf, rt);
+                        if (fn->fn_flags & RTN_TL_ROOT) {
+                                /* put back null_entry for root node */
+                                rcu_assign_pointer(fn->leaf,
+                                            info->nl_net->ipv6.ip6_null_entry);
+                        } else {
+                                atomic_inc(&rt->rt6i_ref);
+                                rcu_assign_pointer(fn->leaf, rt);
+                        }
                 }
                 fn = sn;
         }
@@ -1241,23 +1252,28 @@ out:
                  * If fib6_add_1 has cleared the old leaf pointer in the
                  * super-tree leaf node we have to find a new one for it.
                  */
-                struct rt6_info *pn_leaf = rcu_dereference_protected(pn->leaf,
-                                            lockdep_is_held(&table->tb6_lock));
-                if (pn != fn && pn_leaf == rt) {
-                        pn_leaf = NULL;
-                        RCU_INIT_POINTER(pn->leaf, NULL);
-                        atomic_dec(&rt->rt6i_ref);
-                }
-                if (pn != fn && !pn_leaf && !(pn->fn_flags & RTN_RTINFO)) {
-                        pn_leaf = fib6_find_prefix(info->nl_net, table, pn);
-#if RT6_DEBUG >= 2
-                        if (!pn_leaf) {
-                                WARN_ON(!pn_leaf);
-                                pn_leaf = info->nl_net->ipv6.ip6_null_entry;
+                if (pn != fn) {
+                        struct rt6_info *pn_leaf =
+                                rcu_dereference_protected(pn->leaf,
+                                    lockdep_is_held(&table->tb6_lock));
+                        if (pn_leaf == rt) {
+                                pn_leaf = NULL;
+                                RCU_INIT_POINTER(pn->leaf, NULL);
+                                atomic_dec(&rt->rt6i_ref);
                         }
+                        if (!pn_leaf && !(pn->fn_flags & RTN_RTINFO)) {
+                                pn_leaf = fib6_find_prefix(info->nl_net, table,
+                                                           pn);
+#if RT6_DEBUG >= 2
+                                if (!pn_leaf) {
+                                        WARN_ON(!pn_leaf);
+                                        pn_leaf =
+                                            info->nl_net->ipv6.ip6_null_entry;
+                                }
 #endif
-                        atomic_inc(&pn_leaf->rt6i_ref);
-                        rcu_assign_pointer(pn->leaf, pn_leaf);
+                                atomic_inc(&pn_leaf->rt6i_ref);
+                                rcu_assign_pointer(pn->leaf, pn_leaf);
+                        }
                 }
 #endif
                 goto failure;
@@ -1265,13 +1281,17 @@ out:
         return err;
 
 failure:
-        /* fn->leaf could be NULL if fn is an intermediate node and we
-         * failed to add the new route to it in both subtree creation
-         * failure and fib6_add_rt2node() failure case.
-         * In both cases, fib6_repair_tree() should be called to fix
-         * fn->leaf.
+        /* fn->leaf could be NULL and fib6_repair_tree() needs to be called if:
+         * 1. fn is an intermediate node and we failed to add the new
+         * route to it in both subtree creation failure and fib6_add_rt2node()
+         * failure case.
+         * 2. fn is the root node in the table and we fail to add the first
+         * default route to it.
          */
-        if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT)))
+        if (fn &&
+            (!(fn->fn_flags & (RTN_RTINFO|RTN_ROOT)) ||
+             (fn->fn_flags & RTN_TL_ROOT &&
+              !rcu_access_pointer(fn->leaf))))
                 fib6_repair_tree(info->nl_net, table, fn);
         /* Always release dst as dst->__refcnt is guaranteed
          * to be taken before entering this function
@@ -1526,6 +1546,12 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
         struct fib6_walker *w;
         int iter = 0;
 
+        /* Set fn->leaf to null_entry for root node. */
+        if (fn->fn_flags & RTN_TL_ROOT) {
+                rcu_assign_pointer(fn->leaf, net->ipv6.ip6_null_entry);
+                return fn;
+        }
+
         for (;;) {
                 struct fib6_node *fn_r = rcu_dereference_protected(fn->right,
                                             lockdep_is_held(&table->tb6_lock));
@@ -1680,10 +1706,15 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn,
         }
         read_unlock(&net->ipv6.fib6_walker_lock);
 
-        /* If it was last route, expunge its radix tree node */
+        /* If it was last route, call fib6_repair_tree() to:
+         * 1. For root node, put back null_entry as how the table was created.
+         * 2. For other nodes, expunge its radix tree node.
+         */
         if (!rcu_access_pointer(fn->leaf)) {
-                fn->fn_flags &= ~RTN_RTINFO;
-                net->ipv6.rt6_stats->fib_route_nodes--;
+                if (!(fn->fn_flags & RTN_TL_ROOT)) {
+                        fn->fn_flags &= ~RTN_RTINFO;
+                        net->ipv6.rt6_stats->fib_route_nodes--;
+                }
                 fn = fib6_repair_tree(net, table, fn);
         }
 
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 4cfd8e0696fe..873549228ccb 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -337,11 +337,12 @@ static struct ip6_tnl *ip6gre_tunnel_locate(struct net *net,
 
         nt->dev = dev;
         nt->net = dev_net(dev);
-        ip6gre_tnl_link_config(nt, 1);
 
         if (register_netdevice(dev) < 0)
                 goto failed_free;
 
+        ip6gre_tnl_link_config(nt, 1);
+
         /* Can use a lockless transmit, unless we generate output sequences */
         if (!(nt->parms.o_flags & TUNNEL_SEQ))
                 dev->features |= NETIF_F_LLTX;
@@ -1014,6 +1015,36 @@ static void ip6gre_tunnel_setup(struct net_device *dev)
         eth_random_addr(dev->perm_addr);
 }
 
+#define GRE6_FEATURES (NETIF_F_SG |             \
+                       NETIF_F_FRAGLIST |       \
+                       NETIF_F_HIGHDMA |        \
+                       NETIF_F_HW_CSUM)
+
+static void ip6gre_tnl_init_features(struct net_device *dev)
+{
+        struct ip6_tnl *nt = netdev_priv(dev);
+
+        dev->features           |= GRE6_FEATURES;
+        dev->hw_features        |= GRE6_FEATURES;
+
+        if (!(nt->parms.o_flags & TUNNEL_SEQ)) {
+                /* TCP offload with GRE SEQ is not supported, nor
+                 * can we support 2 levels of outer headers requiring
+                 * an update.
+                 */
+                if (!(nt->parms.o_flags & TUNNEL_CSUM) ||
+                    nt->encap.type == TUNNEL_ENCAP_NONE) {
+                        dev->features    |= NETIF_F_GSO_SOFTWARE;
+                        dev->hw_features |= NETIF_F_GSO_SOFTWARE;
+                }
+
+                /* Can use a lockless transmit, unless we generate
+                 * output sequences
+                 */
+                dev->features |= NETIF_F_LLTX;
+        }
+}
+
 static int ip6gre_tunnel_init_common(struct net_device *dev)
 {
         struct ip6_tnl *tunnel;
@@ -1048,6 +1079,8 @@ static int ip6gre_tunnel_init_common(struct net_device *dev)
         if (!(tunnel->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
                 dev->mtu -= 8;
 
+        ip6gre_tnl_init_features(dev);
+
         return 0;
 }
 
@@ -1271,7 +1304,6 @@ static void ip6gre_netlink_parms(struct nlattr *data[],
 
 static int ip6gre_tap_init(struct net_device *dev)
 {
-        struct ip6_tnl *tunnel;
         int ret;
 
         ret = ip6gre_tunnel_init_common(dev);
@@ -1280,10 +1312,6 @@ static int ip6gre_tap_init(struct net_device *dev)
 
         dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
 
-        tunnel = netdev_priv(dev);
-
-        ip6gre_tnl_link_config(tunnel, 1);
-
         return 0;
 }
 
@@ -1298,16 +1326,12 @@ static const struct net_device_ops ip6gre_tap_netdev_ops = {
         .ndo_get_iflink = ip6_tnl_get_iflink,
 };
 
-#define GRE6_FEATURES (NETIF_F_SG |             \
-                       NETIF_F_FRAGLIST |       \
-                       NETIF_F_HIGHDMA |                \
-                       NETIF_F_HW_CSUM)
-
 static void ip6gre_tap_setup(struct net_device *dev)
 {
 
         ether_setup(dev);
 
+        dev->max_mtu = 0;
         dev->netdev_ops = &ip6gre_tap_netdev_ops;
         dev->needs_free_netdev = true;
         dev->priv_destructor = ip6gre_dev_free;
@@ -1380,32 +1404,16 @@ static int ip6gre_newlink(struct net *src_net, struct net_device *dev,
 
         nt->dev = dev;
         nt->net = dev_net(dev);
-        ip6gre_tnl_link_config(nt, !tb[IFLA_MTU]);
-
-        dev->features           |= GRE6_FEATURES;
-        dev->hw_features        |= GRE6_FEATURES;
-
-        if (!(nt->parms.o_flags & TUNNEL_SEQ)) {
-                /* TCP offload with GRE SEQ is not supported, nor
-                 * can we support 2 levels of outer headers requiring
-                 * an update.
-                 */
-                if (!(nt->parms.o_flags & TUNNEL_CSUM) ||
-                    (nt->encap.type == TUNNEL_ENCAP_NONE)) {
-                        dev->features    |= NETIF_F_GSO_SOFTWARE;
-                        dev->hw_features |= NETIF_F_GSO_SOFTWARE;
-                }
-
-                /* Can use a lockless transmit, unless we generate
-                 * output sequences
-                 */
-                dev->features |= NETIF_F_LLTX;
-        }
 
         err = register_netdevice(dev);
         if (err)
                 goto out;
 
+        ip6gre_tnl_link_config(nt, !tb[IFLA_MTU]);
+
+        if (tb[IFLA_MTU])
+                ip6_tnl_change_mtu(dev, nla_get_u32(tb[IFLA_MTU]));
+
         dev_hold(dev);
         ip6gre_tunnel_link(ign, nt);
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 5110a418cc4d..3763dc01e374 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -166,6 +166,14 @@ int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
                             !(IP6CB(skb)->flags & IP6SKB_REROUTED));
 }
 
+bool ip6_autoflowlabel(struct net *net, const struct ipv6_pinfo *np)
+{
+        if (!np->autoflowlabel_set)
+                return ip6_default_np_autolabel(net);
+        else
+                return np->autoflowlabel;
+}
+
 /*
  * xmit an sk_buff (used by TCP, SCTP and DCCP)
  * Note : socket lock is not held for SYNACK packets, but might be modified
@@ -230,7 +238,7 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
                 hlimit = ip6_dst_hoplimit(dst);
 
         ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel,
-                                                     np->autoflowlabel, fl6));
+                                ip6_autoflowlabel(net, np), fl6));
 
         hdr->payload_len = htons(seg_len);
         hdr->nexthdr = proto;
@@ -1198,14 +1206,16 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
         v6_cork->tclass = ipc6->tclass;
         if (rt->dst.flags & DST_XFRM_TUNNEL)
                 mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
-                      rt->dst.dev->mtu : dst_mtu(&rt->dst);
+                      READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst);
         else
                 mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
-                      rt->dst.dev->mtu : dst_mtu(rt->dst.path);
+                      READ_ONCE(rt->dst.dev->mtu) : dst_mtu(rt->dst.path);
         if (np->frag_size < mtu) {
                 if (np->frag_size)
                         mtu = np->frag_size;
         }
+        if (mtu < IPV6_MIN_MTU)
+                return -EINVAL;
         cork->base.fragsize = mtu;
         if (dst_allfrag(rt->dst.path))
                 cork->base.flags |= IPCORK_ALLFRAG;
@@ -1626,7 +1636,7 @@ struct sk_buff *__ip6_make_skb(struct sock *sk,
 
         ip6_flow_hdr(hdr, v6_cork->tclass,
                      ip6_make_flowlabel(net, skb, fl6->flowlabel,
-                                        np->autoflowlabel, fl6));
+                                        ip6_autoflowlabel(net, np), fl6));
         hdr->hop_limit = v6_cork->hop_limit;
         hdr->nexthdr = proto;
         hdr->saddr = fl6->saddr;
@@ -1725,11 +1735,13 @@ struct sk_buff *ip6_make_skb(struct sock *sk,
         cork.base.flags = 0;
         cork.base.addr = 0;
         cork.base.opt = NULL;
+        cork.base.dst = NULL;
         v6_cork.opt = NULL;
         err = ip6_setup_cork(sk, &cork, &v6_cork, ipc6, rt, fl6);
-        if (err)
+        if (err) {
+                ip6_cork_release(&cork, &v6_cork);
                 return ERR_PTR(err);
-
+        }
         if (ipc6->dontfrag < 0)
                 ipc6->dontfrag = inet6_sk(sk)->dontfrag;
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 3d3092adf1d2..1ee5584c3555 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -642,8 +642,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 if (rel_info > dst_mtu(skb_dst(skb2)))
                         goto out;
 
-                skb_dst(skb2)->ops->update_pmtu(skb_dst(skb2), NULL, skb2,
-                                                rel_info);
+                skb_dst_update_pmtu(skb2, rel_info);
         }
 
         icmp_send(skb2, rel_type, rel_code, htonl(rel_info));
@@ -904,7 +903,7 @@ static int ipxip6_rcv(struct sk_buff *skb, u8 ipproto,
                 if (t->parms.collect_md) {
                         tun_dst = ipv6_tun_rx_dst(skb, 0, 0, 0);
                         if (!tun_dst)
-                                return 0;
+                                goto drop;
                 }
                 ret = __ip6_tnl_rcv(t, skb, tpi, tun_dst, dscp_ecn_decapsulate,
                                     log_ecn_error);
@@ -1074,10 +1073,11 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
                         memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
                         neigh_release(neigh);
                 }
-        } else if (!(t->parms.flags &
-                     (IP6_TNL_F_USE_ORIG_TCLASS | IP6_TNL_F_USE_ORIG_FWMARK))) {
-                /* enable the cache only only if the routing decision does
-                 * not depend on the current inner header value
+        } else if (t->parms.proto != 0 && !(t->parms.flags &
+                                            (IP6_TNL_F_USE_ORIG_TCLASS |
+                                             IP6_TNL_F_USE_ORIG_FWMARK))) {
+                /* enable the cache only if neither the outer protocol nor the
+                 * routing decision depends on the current inner header value
                  */
                 use_cache = true;
         }
@@ -1123,10 +1123,14 @@ route_lookup:
                 max_headroom += 8;
                 mtu -= 8;
         }
-        if (mtu < IPV6_MIN_MTU)
-                mtu = IPV6_MIN_MTU;
-        if (skb_dst(skb) && !t->parms.collect_md)
-                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
+        if (skb->protocol == htons(ETH_P_IPV6)) {
+                if (mtu < IPV6_MIN_MTU)
+                        mtu = IPV6_MIN_MTU;
+        } else if (mtu < 576) {
+                mtu = 576;
+        }
+
+        skb_dst_update_pmtu(skb, mtu);
         if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) {
                 *pmtu = mtu;
                 err = -EMSGSIZE;
@@ -1671,11 +1675,11 @@ int ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
 {
         struct ip6_tnl *tnl = netdev_priv(dev);
 
-        if (tnl->parms.proto == IPPROTO_IPIP) {
-                if (new_mtu < ETH_MIN_MTU)
+        if (tnl->parms.proto == IPPROTO_IPV6) {
+                if (new_mtu < IPV6_MIN_MTU)
                         return -EINVAL;
         } else {
-                if (new_mtu < IPV6_MIN_MTU)
+                if (new_mtu < ETH_MIN_MTU)
                         return -EINVAL;
         }
         if (new_mtu > 0xFFF8 - dev->hard_header_len)
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index dbb74f3c57a7..8c184f84f353 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -483,7 +483,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
 
         mtu = dst_mtu(dst);
         if (!skb->ignore_df && skb->len > mtu) {
-                skb_dst(skb)->ops->update_pmtu(dst, NULL, skb, mtu);
+                skb_dst_update_pmtu(skb, mtu);
 
                 if (skb->protocol == htons(ETH_P_IPV6)) {
                         if (mtu < IPV6_MIN_MTU)
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index b9404feabd78..e8ffb5b5d84e 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -886,6 +886,7 @@ pref_skip_coa:
                 break;
         case IPV6_AUTOFLOWLABEL:
                 np->autoflowlabel = valbool;
+                np->autoflowlabel_set = 1;
                 retv = 0;
                 break;
         case IPV6_RECVFRAGSIZE:
@@ -1335,7 +1336,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                 break;
 
         case IPV6_AUTOFLOWLABEL:
-                val = np->autoflowlabel;
+                val = ip6_autoflowlabel(sock_net(sk), np);
                 break;
 
         case IPV6_RECVFRAGSIZE:
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index fc6d7d143f2c..844642682b83 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1682,16 +1682,16 @@ static int grec_size(struct ifmcaddr6 *pmc, int type, int gdel, int sdel)
 }
 
 static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
-        int type, struct mld2_grec **ppgr)
+        int type, struct mld2_grec **ppgr, unsigned int mtu)
 {
-        struct net_device *dev = pmc->idev->dev;
         struct mld2_report *pmr;
         struct mld2_grec *pgr;
 
-        if (!skb)
-                skb = mld_newpack(pmc->idev, dev->mtu);
-        if (!skb)
-                return NULL;
+        if (!skb) {
+                skb = mld_newpack(pmc->idev, mtu);
+                if (!skb)
+                        return NULL;
+        }
         pgr = skb_put(skb, sizeof(struct mld2_grec));
         pgr->grec_type = type;
         pgr->grec_auxwords = 0;
@@ -1714,10 +1714,15 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
         struct mld2_grec *pgr = NULL;
         struct ip6_sf_list *psf, *psf_next, *psf_prev, **psf_list;
         int scount, stotal, first, isquery, truncate;
+        unsigned int mtu;
 
         if (pmc->mca_flags & MAF_NOREPORT)
                 return skb;
 
+        mtu = READ_ONCE(dev->mtu);
+        if (mtu < IPV6_MIN_MTU)
+                return skb;
+
         isquery = type == MLD2_MODE_IS_INCLUDE ||
                   type == MLD2_MODE_IS_EXCLUDE;
         truncate = type == MLD2_MODE_IS_EXCLUDE ||
@@ -1738,7 +1743,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
                     AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
                         if (skb)
                                 mld_sendpack(skb);
-                        skb = mld_newpack(idev, dev->mtu);
+                        skb = mld_newpack(idev, mtu);
                 }
         }
         first = 1;
@@ -1774,12 +1779,12 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
                                 pgr->grec_nsrcs = htons(scount);
                         if (skb)
                                 mld_sendpack(skb);
-                        skb = mld_newpack(idev, dev->mtu);
+                        skb = mld_newpack(idev, mtu);
                         first = 1;
                         scount = 0;
                 }
                 if (first) {
-                        skb = add_grhead(skb, pmc, type, &pgr);
+                        skb = add_grhead(skb, pmc, type, &pgr, mtu);
                         first = 0;
                 }
                 if (!skb)
@@ -1814,7 +1819,7 @@ empty_source:
                                 mld_sendpack(skb);
                                 skb = NULL; /* add_grhead will get a new one */
                         }
-                        skb = add_grhead(skb, pmc, type, &pgr);
+                        skb = add_grhead(skb, pmc, type, &pgr, mtu);
                 }
         }
         if (pgr)
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index f06e25065a34..1d7ae9366335 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -458,7 +458,6 @@ mark_source_chains(const struct xt_table_info *newinfo,
                                         if (!xt_find_jump_offset(offsets, newpos,
                                                                  newinfo->number))
                                                 return 0;
-                                        e = entry0 + newpos;
                                 } else {
                                         /* ... this is a fallthru */
                                         newpos = pos + e->next_offset;
diff --git a/net/ipv6/netfilter/ip6t_MASQUERADE.c b/net/ipv6/netfilter/ip6t_MASQUERADE.c
index 2b1a15846f9a..92c0047e7e33 100644
--- a/net/ipv6/netfilter/ip6t_MASQUERADE.c
+++ b/net/ipv6/netfilter/ip6t_MASQUERADE.c
@@ -33,13 +33,19 @@ static int masquerade_tg6_checkentry(const struct xt_tgchk_param *par)
 
         if (range->flags & NF_NAT_RANGE_MAP_IPS)
                 return -EINVAL;
-        return 0;
+        return nf_ct_netns_get(par->net, par->family);
+}
+
+static void masquerade_tg6_destroy(const struct xt_tgdtor_param *par)
+{
+        nf_ct_netns_put(par->net, par->family);
 }
 
 static struct xt_target masquerade_tg6_reg __read_mostly = {
         .name           = "MASQUERADE",
         .family         = NFPROTO_IPV6,
         .checkentry     = masquerade_tg6_checkentry,
+        .destroy        = masquerade_tg6_destroy,
         .target         = masquerade_tg6,
         .targetsize     = sizeof(struct nf_nat_range),
         .table          = "nat",
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 7a8d1500d374..0458b761f3c5 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2336,6 +2336,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
         }
 
         rt->dst.flags |= DST_HOST;
+        rt->dst.input = ip6_input;
         rt->dst.output  = ip6_output;
         rt->rt6i_gateway  = fl6->daddr;
         rt->rt6i_dst.addr = fl6->daddr;
@@ -4297,19 +4298,13 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                 if (!ipv6_addr_any(&fl6.saddr))
                         flags |= RT6_LOOKUP_F_HAS_SADDR;
 
-                if (!fibmatch)
-                        dst = ip6_route_input_lookup(net, dev, &fl6, flags);
-                else
-                        dst = ip6_route_lookup(net, &fl6, 0);
+                dst = ip6_route_input_lookup(net, dev, &fl6, flags);
 
                 rcu_read_unlock();
         } else {
                 fl6.flowi6_oif = oif;
 
-                if (!fibmatch)
-                        dst = ip6_route_output(net, NULL, &fl6);
-                else
-                        dst = ip6_route_lookup(net, &fl6, 0);
+                dst = ip6_route_output(net, NULL, &fl6);
         }
 
 
@@ -4326,6 +4321,15 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                 goto errout;
         }
 
+        if (fibmatch && rt->dst.from) {
+                struct rt6_info *ort = container_of(rt->dst.from,
+                                                    struct rt6_info, dst);
+
+                dst_hold(&ort->dst);
+                ip6_rt_put(rt);
+                rt = ort;
+        }
+
         skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
         if (!skb) {
                 ip6_rt_put(rt);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index d60ddcb0bfe2..3873d3877135 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -934,8 +934,8 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                         df = 0;
                 }
 
-                if (tunnel->parms.iph.daddr && skb_dst(skb))
-                        skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
+                if (tunnel->parms.iph.daddr)
+                        skb_dst_update_pmtu(skb, mtu);
 
                 if (skb->len > mtu && !skb_is_gso(skb)) {
                         icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
@@ -1098,6 +1098,7 @@ static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p,
         ipip6_tunnel_link(sitn, t);
         t->parms.iph.ttl = p->iph.ttl;
         t->parms.iph.tos = p->iph.tos;
+        t->parms.iph.frag_off = p->iph.frag_off;
         if (t->parms.link != p->link || t->fwmark != fwmark) {
                 t->parms.link = p->link;
                 t->fwmark = fwmark;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 6bb98c93edfe..7178476b3d2f 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -994,7 +994,7 @@ static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
                         req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
                         tcp_time_stamp_raw() + tcp_rsk(req)->ts_off,
                         req->ts_recent, sk->sk_bound_dev_if,
-                        tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
+                        tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr),
                         0, 0);
 }
 
@@ -1454,7 +1454,6 @@ process:
                 struct sock *nsk;
 
                 sk = req->rsk_listener;
-                tcp_v6_fill_cb(skb, hdr, th);
                 if (tcp_v6_inbound_md5_hash(sk, skb)) {
                         sk_drops_add(sk, skb);
                         reqsk_put(req);
@@ -1467,8 +1466,12 @@ process:
                 sock_hold(sk);
                 refcounted = true;
                 nsk = NULL;
-                if (!tcp_filter(sk, skb))
+                if (!tcp_filter(sk, skb)) {
+                        th = (const struct tcphdr *)skb->data;
+                        hdr = ipv6_hdr(skb);
+                        tcp_v6_fill_cb(skb, hdr, th);
                         nsk = tcp_check_req(sk, skb, req, false);
+                }
                 if (!nsk) {
                         reqsk_put(req);
                         goto discard_and_relse;
@@ -1492,8 +1495,6 @@ process:
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_and_relse;
 
-        tcp_v6_fill_cb(skb, hdr, th);
-
         if (tcp_v6_inbound_md5_hash(sk, skb))
                 goto discard_and_relse;
 
@@ -1501,6 +1502,7 @@ process:
                 goto discard_and_relse;
         th = (const struct tcphdr *)skb->data;
         hdr = ipv6_hdr(skb);
+        tcp_v6_fill_cb(skb, hdr, th);
 
         skb->dev = NULL;
 
@@ -1590,7 +1592,6 @@ do_time_wait:
                 tcp_v6_timewait_ack(sk, skb);
                 break;
         case TCP_TW_RST:
-                tcp_v6_restore_cb(skb);
                 tcp_v6_send_reset(sk, skb);
                 inet_twsk_deschedule_put(inet_twsk(sk));
                 goto discard_it;
diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c
index d883c9204c01..278e49cd67d4 100644
--- a/net/ipv6/tcpv6_offload.c
+++ b/net/ipv6/tcpv6_offload.c
@@ -46,6 +46,9 @@ static struct sk_buff *tcp6_gso_segment(struct sk_buff *skb,
 {
         struct tcphdr *th;
 
+        if (!(skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6))
+                return ERR_PTR(-EINVAL);
+
         if (!pskb_may_pull(skb, sizeof(*th)))
                 return ERR_PTR(-EINVAL);
 
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index a0f89ad76f9d..2a04dc9c781b 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -42,6 +42,9 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                 const struct ipv6hdr *ipv6h;
                 struct udphdr *uh;
 
+                if (!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP))
+                        goto out;
+
                 if (!pskb_may_pull(skb, sizeof(struct udphdr)))
                         goto out;
 
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index fe04e23af986..841f4a07438e 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -32,6 +32,14 @@ int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
 }
 EXPORT_SYMBOL(xfrm6_rcv_spi);
 
+static int xfrm6_transport_finish2(struct net *net, struct sock *sk,
+                                   struct sk_buff *skb)
+{
+        if (xfrm_trans_queue(skb, ip6_rcv_finish))
+                __kfree_skb(skb);
+        return -1;
+}
+
 int xfrm6_transport_finish(struct sk_buff *skb, int async)
 {
         struct xfrm_offload *xo = xfrm_offload(skb);
@@ -56,7 +64,7 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async)
 
         NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,
                 dev_net(skb->dev), NULL, skb, skb->dev, NULL,
-                ip6_rcv_finish);
+                xfrm6_transport_finish2);
         return -1;
 }
 
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 02556e356f87..dc93002ff9d1 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -92,6 +92,7 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb_reset_network_header(skb);
         skb_mac_header_rebuild(skb);
+        eth_hdr(skb)->h_proto = skb->protocol;
 
         err = 0;
 
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index 0b750a22c4b9..4a8d407f8902 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1387,8 +1387,13 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
         if (!csk)
                 return -EINVAL;
 
-        /* We must prevent loops or risk deadlock ! */
-        if (csk->sk_family == PF_KCM)
+        /* Only allow TCP sockets to be attached for now */
+        if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) ||
+            csk->sk_protocol != IPPROTO_TCP)
+                return -EOPNOTSUPP;
+
+        /* Don't allow listeners or closed sockets */
+        if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE)
                 return -EOPNOTSUPP;
 
         psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL);
@@ -1405,9 +1410,18 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
                 return err;
         }
 
-        sock_hold(csk);
-
         write_lock_bh(&csk->sk_callback_lock);
+
+        /* Check if sk_user_data is aready by KCM or someone else.
+         * Must be done under lock to prevent race conditions.
+         */
+        if (csk->sk_user_data) {
+                write_unlock_bh(&csk->sk_callback_lock);
+                strp_done(&psock->strp);
+                kmem_cache_free(kcm_psockp, psock);
+                return -EALREADY;
+        }
+
         psock->save_data_ready = csk->sk_data_ready;
         psock->save_write_space = csk->sk_write_space;
         psock->save_state_change = csk->sk_state_change;
@@ -1415,8 +1429,11 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
         csk->sk_data_ready = psock_data_ready;
         csk->sk_write_space = psock_write_space;
         csk->sk_state_change = psock_state_change;
+
         write_unlock_bh(&csk->sk_callback_lock);
 
+        sock_hold(csk);
+
         /* Finished initialization, now add the psock to the MUX. */
         spin_lock_bh(&mux->lock);
         head = &mux->psocks;
@@ -1625,60 +1642,30 @@ static struct proto kcm_proto = {
 };
 
 /* Clone a kcm socket. */
-static int kcm_clone(struct socket *osock, struct kcm_clone *info,
-                     struct socket **newsockp)
+static struct file *kcm_clone(struct socket *osock)
 {
         struct socket *newsock;
         struct sock *newsk;
-        struct file *newfile;
-        int err, newfd;
 
-        err = -ENFILE;
         newsock = sock_alloc();
         if (!newsock)
-                goto out;
+                return ERR_PTR(-ENFILE);
 
         newsock->type = osock->type;
         newsock->ops = osock->ops;
 
         __module_get(newsock->ops->owner);
 
-        newfd = get_unused_fd_flags(0);
-        if (unlikely(newfd < 0)) {
-                err = newfd;
-                goto out_fd_fail;
-        }
-
-        newfile = sock_alloc_file(newsock, 0, osock->sk->sk_prot_creator->name);
-        if (IS_ERR(newfile)) {
-                err = PTR_ERR(newfile);
-                goto out_sock_alloc_fail;
-        }
-
         newsk = sk_alloc(sock_net(osock->sk), PF_KCM, GFP_KERNEL,
                          &kcm_proto, true);
         if (!newsk) {
-                err = -ENOMEM;
-                goto out_sk_alloc_fail;
+                sock_release(newsock);
+                return ERR_PTR(-ENOMEM);
         }
-
         sock_init_data(newsock, newsk);
         init_kcm_sock(kcm_sk(newsk), kcm_sk(osock->sk)->mux);
 
-        fd_install(newfd, newfile);
-        *newsockp = newsock;
-        info->fd = newfd;
-
-        return 0;
-
-out_sk_alloc_fail:
-        fput(newfile);
-out_sock_alloc_fail:
-        put_unused_fd(newfd);
-out_fd_fail:
-        sock_release(newsock);
-out:
-        return err;
+        return sock_alloc_file(newsock, 0, osock->sk->sk_prot_creator->name);
 }
 
 static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
@@ -1708,17 +1695,25 @@ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         }
         case SIOCKCMCLONE: {
                 struct kcm_clone info;
-                struct socket *newsock = NULL;
-
-                err = kcm_clone(sock, &info, &newsock);
-                if (!err) {
-                        if (copy_to_user((void __user *)arg, &info,
-                                         sizeof(info))) {
-                                err = -EFAULT;
-                                sys_close(info.fd);
-                        }
-                }
+                struct file *file;
 
+                info.fd = get_unused_fd_flags(0);
+                if (unlikely(info.fd < 0))
+                        return info.fd;
+
+                file = kcm_clone(sock);
+                if (IS_ERR(file)) {
+                        put_unused_fd(info.fd);
+                        return PTR_ERR(file);
+                }
+                if (copy_to_user((void __user *)arg, &info,
+                                 sizeof(info))) {
+                        put_unused_fd(info.fd);
+                        fput(file);
+                        return -EFAULT;
+                }
+                fd_install(info.fd, file);
+                err = 0;
                 break;
         }
         default:
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 3dffb892d52c..7e2e7188e7f4 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -401,6 +401,11 @@ static int verify_address_len(const void *p)
 #endif
         int len;
 
+        if (sp->sadb_address_len <
+            DIV_ROUND_UP(sizeof(*sp) + offsetofend(typeof(*addr), sa_family),
+                         sizeof(uint64_t)))
+                return -EINVAL;
+
         switch (addr->sa_family) {
         case AF_INET:
                 len = DIV_ROUND_UP(sizeof(*sp) + sizeof(*sin), sizeof(uint64_t));
@@ -511,6 +516,9 @@ static int parse_exthdrs(struct sk_buff *skb, const struct sadb_msg *hdr, void *
                 uint16_t ext_type;
                 int ext_len;
 
+                if (len < sizeof(*ehdr))
+                        return -EINVAL;
+
                 ext_len  = ehdr->sadb_ext_len;
                 ext_len *= sizeof(uint64_t);
                 ext_type = ehdr->sadb_ext_type;
@@ -2194,8 +2202,10 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, const struct km_ev
                 return PTR_ERR(out_skb);
 
         err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(out_skb);
                 return err;
+        }
 
         out_hdr = (struct sadb_msg *) out_skb->data;
         out_hdr->sadb_msg_version = PF_KEY_V2;
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 167f83b853e6..1621b6ab17ba 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -291,16 +291,15 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
         int i;
 
         mutex_lock(&sta->ampdu_mlme.mtx);
-        for (i = 0; i <  IEEE80211_NUM_TIDS; i++) {
+        for (i = 0; i <  IEEE80211_NUM_TIDS; i++)
                 ___ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
                                                 WLAN_REASON_QSTA_LEAVE_QBSS,
                                                 reason != AGG_STOP_DESTROY_STA &&
                                                 reason != AGG_STOP_PEER_REQUEST);
-        }
-        mutex_unlock(&sta->ampdu_mlme.mtx);
 
         for (i = 0; i <  IEEE80211_NUM_TIDS; i++)
                 ___ieee80211_stop_tx_ba_session(sta, i, reason);
+        mutex_unlock(&sta->ampdu_mlme.mtx);
 
         /* stopping might queue the work again - so cancel only afterwards */
         cancel_work_sync(&sta->ampdu_mlme.work);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 70e9d2ca8bbe..4daafb07602f 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3632,6 +3632,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
                 }
                 return true;
         case NL80211_IFTYPE_MESH_POINT:
+                if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
+                        return false;
                 if (multicast)
                         return true;
                 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index cf1bf2605c10..dc6347342e34 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -103,7 +103,6 @@ struct bitstr {
 #define INC_BIT(bs) if((++(bs)->bit)>7){(bs)->cur++;(bs)->bit=0;}
 #define INC_BITS(bs,b) if(((bs)->bit+=(b))>7){(bs)->cur+=(bs)->bit>>3;(bs)->bit&=7;}
 #define BYTE_ALIGN(bs) if((bs)->bit){(bs)->cur++;(bs)->bit=0;}
-#define CHECK_BOUND(bs,n) if((bs)->cur+(n)>(bs)->end)return(H323_ERROR_BOUND)
 static unsigned int get_len(struct bitstr *bs);
 static unsigned int get_bit(struct bitstr *bs);
 static unsigned int get_bits(struct bitstr *bs, unsigned int b);
@@ -165,6 +164,19 @@ static unsigned int get_len(struct bitstr *bs)
         return v;
 }
 
+static int nf_h323_error_boundary(struct bitstr *bs, size_t bytes, size_t bits)
+{
+        bits += bs->bit;
+        bytes += bits / BITS_PER_BYTE;
+        if (bits % BITS_PER_BYTE > 0)
+                bytes++;
+
+        if (*bs->cur + bytes > *bs->end)
+                return 1;
+
+        return 0;
+}
+
 /****************************************************************************/
 static unsigned int get_bit(struct bitstr *bs)
 {
@@ -279,8 +291,8 @@ static int decode_bool(struct bitstr *bs, const struct field_t *f,
         PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
 
         INC_BIT(bs);
-
-        CHECK_BOUND(bs, 0);
+        if (nf_h323_error_boundary(bs, 0, 0))
+                return H323_ERROR_BOUND;
         return H323_ERROR_NONE;
 }
 
@@ -293,11 +305,14 @@ static int decode_oid(struct bitstr *bs, const struct field_t *f,
         PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
 
         BYTE_ALIGN(bs);
-        CHECK_BOUND(bs, 1);
+        if (nf_h323_error_boundary(bs, 1, 0))
+                return H323_ERROR_BOUND;
+
         len = *bs->cur++;
         bs->cur += len;
+        if (nf_h323_error_boundary(bs, 0, 0))
+                return H323_ERROR_BOUND;
 
-        CHECK_BOUND(bs, 0);
         return H323_ERROR_NONE;
 }
 
@@ -319,6 +334,8 @@ static int decode_int(struct bitstr *bs, const struct field_t *f,
                 bs->cur += 2;
                 break;
         case CONS:              /* 64K < Range < 4G */
+                if (nf_h323_error_boundary(bs, 0, 2))
+                        return H323_ERROR_BOUND;
                 len = get_bits(bs, 2) + 1;
                 BYTE_ALIGN(bs);
                 if (base && (f->attr & DECODE)) {       /* timeToLive */
@@ -330,7 +347,8 @@ static int decode_int(struct bitstr *bs, const struct field_t *f,
                 break;
         case UNCO:
                 BYTE_ALIGN(bs);
-                CHECK_BOUND(bs, 2);
+                if (nf_h323_error_boundary(bs, 2, 0))
+                        return H323_ERROR_BOUND;
                 len = get_len(bs);
                 bs->cur += len;
                 break;
@@ -341,7 +359,8 @@ static int decode_int(struct bitstr *bs, const struct field_t *f,
 
         PRINT("\n");
 
-        CHECK_BOUND(bs, 0);
+        if (nf_h323_error_boundary(bs, 0, 0))
+                return H323_ERROR_BOUND;
         return H323_ERROR_NONE;
 }
 
@@ -357,7 +376,8 @@ static int decode_enum(struct bitstr *bs, const struct field_t *f,
                 INC_BITS(bs, f->sz);
         }
 
-        CHECK_BOUND(bs, 0);
+        if (nf_h323_error_boundary(bs, 0, 0))
+                return H323_ERROR_BOUND;
         return H323_ERROR_NONE;
 }
 
@@ -375,12 +395,14 @@ static int decode_bitstr(struct bitstr *bs, const struct field_t *f,
                 len = f->lb;
                 break;
         case WORD:              /* 2-byte length */
-                CHECK_BOUND(bs, 2);
+                if (nf_h323_error_boundary(bs, 2, 0))
+                        return H323_ERROR_BOUND;
                 len = (*bs->cur++) << 8;
                 len += (*bs->cur++) + f->lb;
                 break;
         case SEMI:
-                CHECK_BOUND(bs, 2);
+                if (nf_h323_error_boundary(bs, 2, 0))
+                        return H323_ERROR_BOUND;
                 len = get_len(bs);
                 break;
         default:
@@ -391,7 +413,8 @@ static int decode_bitstr(struct bitstr *bs, const struct field_t *f,
         bs->cur += len >> 3;
         bs->bit = len & 7;
 
-        CHECK_BOUND(bs, 0);
+        if (nf_h323_error_boundary(bs, 0, 0))
+                return H323_ERROR_BOUND;
         return H323_ERROR_NONE;
 }
 
@@ -404,12 +427,15 @@ static int decode_numstr(struct bitstr *bs, const struct field_t *f,
         PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
 
         /* 2 <= Range <= 255 */
+        if (nf_h323_error_boundary(bs, 0, f->sz))
+                return H323_ERROR_BOUND;
         len = get_bits(bs, f->sz) + f->lb;
 
         BYTE_ALIGN(bs);
         INC_BITS(bs, (len << 2));
 
-        CHECK_BOUND(bs, 0);
+        if (nf_h323_error_boundary(bs, 0, 0))
+                return H323_ERROR_BOUND;
         return H323_ERROR_NONE;
 }
 
@@ -440,15 +466,19 @@ static int decode_octstr(struct bitstr *bs, const struct field_t *f,
                 break;
         case BYTE:              /* Range == 256 */
                 BYTE_ALIGN(bs);
-                CHECK_BOUND(bs, 1);
+                if (nf_h323_error_boundary(bs, 1, 0))
+                        return H323_ERROR_BOUND;
                 len = (*bs->cur++) + f->lb;
                 break;
         case SEMI:
                 BYTE_ALIGN(bs);
-                CHECK_BOUND(bs, 2);
+                if (nf_h323_error_boundary(bs, 2, 0))
+                        return H323_ERROR_BOUND;
                 len = get_len(bs) + f->lb;
                 break;
         default:                /* 2 <= Range <= 255 */
+                if (nf_h323_error_boundary(bs, 0, f->sz))
+                        return H323_ERROR_BOUND;
                 len = get_bits(bs, f->sz) + f->lb;
                 BYTE_ALIGN(bs);
                 break;
@@ -458,7 +488,8 @@ static int decode_octstr(struct bitstr *bs, const struct field_t *f,
 
         PRINT("\n");
 
-        CHECK_BOUND(bs, 0);
+        if (nf_h323_error_boundary(bs, 0, 0))
+                return H323_ERROR_BOUND;
         return H323_ERROR_NONE;
 }
 
@@ -473,10 +504,13 @@ static int decode_bmpstr(struct bitstr *bs, const struct field_t *f,
         switch (f->sz) {
         case BYTE:              /* Range == 256 */
                 BYTE_ALIGN(bs);
-                CHECK_BOUND(bs, 1);
+                if (nf_h323_error_boundary(bs, 1, 0))
+                        return H323_ERROR_BOUND;
                 len = (*bs->cur++) + f->lb;
                 break;
         default:                /* 2 <= Range <= 255 */
+                if (nf_h323_error_boundary(bs, 0, f->sz))
+                        return H323_ERROR_BOUND;
                 len = get_bits(bs, f->sz) + f->lb;
                 BYTE_ALIGN(bs);
                 break;
@@ -484,7 +518,8 @@ static int decode_bmpstr(struct bitstr *bs, const struct field_t *f,
 
         bs->cur += len << 1;
 
-        CHECK_BOUND(bs, 0);
+        if (nf_h323_error_boundary(bs, 0, 0))
+                return H323_ERROR_BOUND;
         return H323_ERROR_NONE;
 }
 
@@ -503,9 +538,13 @@ static int decode_seq(struct bitstr *bs, const struct field_t *f,
         base = (base && (f->attr & DECODE)) ? base + f->offset : NULL;
 
         /* Extensible? */
+        if (nf_h323_error_boundary(bs, 0, 1))
+                return H323_ERROR_BOUND;
         ext = (f->attr & EXT) ? get_bit(bs) : 0;
 
         /* Get fields bitmap */
+        if (nf_h323_error_boundary(bs, 0, f->sz))
+                return H323_ERROR_BOUND;
         bmp = get_bitmap(bs, f->sz);
         if (base)
                 *(unsigned int *)base = bmp;
@@ -525,9 +564,11 @@ static int decode_seq(struct bitstr *bs, const struct field_t *f,
 
                 /* Decode */
                 if (son->attr & OPEN) { /* Open field */
-                        CHECK_BOUND(bs, 2);
+                        if (nf_h323_error_boundary(bs, 2, 0))
+                                return H323_ERROR_BOUND;
                         len = get_len(bs);
-                        CHECK_BOUND(bs, len);
+                        if (nf_h323_error_boundary(bs, len, 0))
+                                return H323_ERROR_BOUND;
                         if (!base || !(son->attr & DECODE)) {
                                 PRINT("%*.s%s\n", (level + 1) * TAB_SIZE,
                                       " ", son->name);
@@ -555,8 +596,11 @@ static int decode_seq(struct bitstr *bs, const struct field_t *f,
                 return H323_ERROR_NONE;
 
         /* Get the extension bitmap */
+        if (nf_h323_error_boundary(bs, 0, 7))
+                return H323_ERROR_BOUND;
         bmp2_len = get_bits(bs, 7) + 1;
-        CHECK_BOUND(bs, (bmp2_len + 7) >> 3);
+        if (nf_h323_error_boundary(bs, 0, bmp2_len))
+                return H323_ERROR_BOUND;
         bmp2 = get_bitmap(bs, bmp2_len);
         bmp |= bmp2 >> f->sz;
         if (base)
@@ -567,9 +611,11 @@ static int decode_seq(struct bitstr *bs, const struct field_t *f,
         for (opt = 0; opt < bmp2_len; opt++, i++, son++) {
                 /* Check Range */
                 if (i >= f->ub) {       /* Newer Version? */
-                        CHECK_BOUND(bs, 2);
+                        if (nf_h323_error_boundary(bs, 2, 0))
+                                return H323_ERROR_BOUND;
                         len = get_len(bs);
-                        CHECK_BOUND(bs, len);
+                        if (nf_h323_error_boundary(bs, len, 0))
+                                return H323_ERROR_BOUND;
                         bs->cur += len;
                         continue;
                 }
@@ -583,9 +629,11 @@ static int decode_seq(struct bitstr *bs, const struct field_t *f,
                 if (!((0x80000000 >> opt) & bmp2))      /* Not present */
                         continue;
 
-                CHECK_BOUND(bs, 2);
+                if (nf_h323_error_boundary(bs, 2, 0))
+                        return H323_ERROR_BOUND;
                 len = get_len(bs);
-                CHECK_BOUND(bs, len);
+                if (nf_h323_error_boundary(bs, len, 0))
+                        return H323_ERROR_BOUND;
                 if (!base || !(son->attr & DECODE)) {
                         PRINT("%*.s%s\n", (level + 1) * TAB_SIZE, " ",
                               son->name);
@@ -623,22 +671,27 @@ static int decode_seqof(struct bitstr *bs, const struct field_t *f,
         switch (f->sz) {
         case BYTE:
                 BYTE_ALIGN(bs);
-                CHECK_BOUND(bs, 1);
+                if (nf_h323_error_boundary(bs, 1, 0))
+                        return H323_ERROR_BOUND;
                 count = *bs->cur++;
                 break;
         case WORD:
                 BYTE_ALIGN(bs);
-                CHECK_BOUND(bs, 2);
+                if (nf_h323_error_boundary(bs, 2, 0))
+                        return H323_ERROR_BOUND;
                 count = *bs->cur++;
                 count <<= 8;
                 count += *bs->cur++;
                 break;
         case SEMI:
                 BYTE_ALIGN(bs);
-                CHECK_BOUND(bs, 2);
+                if (nf_h323_error_boundary(bs, 2, 0))
+                        return H323_ERROR_BOUND;
                 count = get_len(bs);
                 break;
         default:
+                if (nf_h323_error_boundary(bs, 0, f->sz))
+                        return H323_ERROR_BOUND;
                 count = get_bits(bs, f->sz);
                 break;
         }
@@ -658,8 +711,11 @@ static int decode_seqof(struct bitstr *bs, const struct field_t *f,
         for (i = 0; i < count; i++) {
                 if (son->attr & OPEN) {
                         BYTE_ALIGN(bs);
+                        if (nf_h323_error_boundary(bs, 2, 0))
+                                return H323_ERROR_BOUND;
                         len = get_len(bs);
-                        CHECK_BOUND(bs, len);
+                        if (nf_h323_error_boundary(bs, len, 0))
+                                return H323_ERROR_BOUND;
                         if (!base || !(son->attr & DECODE)) {
                                 PRINT("%*.s%s\n", (level + 1) * TAB_SIZE,
                                       " ", son->name);
@@ -710,11 +766,17 @@ static int decode_choice(struct bitstr *bs, const struct field_t *f,
         base = (base && (f->attr & DECODE)) ? base + f->offset : NULL;
 
         /* Decode the choice index number */
+        if (nf_h323_error_boundary(bs, 0, 1))
+                return H323_ERROR_BOUND;
         if ((f->attr & EXT) && get_bit(bs)) {
                 ext = 1;
+                if (nf_h323_error_boundary(bs, 0, 7))
+                        return H323_ERROR_BOUND;
                 type = get_bits(bs, 7) + f->lb;
         } else {
                 ext = 0;
+                if (nf_h323_error_boundary(bs, 0, f->sz))
+                        return H323_ERROR_BOUND;
                 type = get_bits(bs, f->sz);
                 if (type >= f->lb)
                         return H323_ERROR_RANGE;
@@ -727,8 +789,11 @@ static int decode_choice(struct bitstr *bs, const struct field_t *f,
         /* Check Range */
         if (type >= f->ub) {    /* Newer version? */
                 BYTE_ALIGN(bs);
+                if (nf_h323_error_boundary(bs, 2, 0))
+                        return H323_ERROR_BOUND;
                 len = get_len(bs);
-                CHECK_BOUND(bs, len);
+                if (nf_h323_error_boundary(bs, len, 0))
+                        return H323_ERROR_BOUND;
                 bs->cur += len;
                 return H323_ERROR_NONE;
         }
@@ -742,8 +807,11 @@ static int decode_choice(struct bitstr *bs, const struct field_t *f,
 
         if (ext || (son->attr & OPEN)) {
                 BYTE_ALIGN(bs);
+                if (nf_h323_error_boundary(bs, len, 0))
+                        return H323_ERROR_BOUND;
                 len = get_len(bs);
-                CHECK_BOUND(bs, len);
+                if (nf_h323_error_boundary(bs, len, 0))
+                        return H323_ERROR_BOUND;
                 if (!base || !(son->attr & DECODE)) {
                         PRINT("%*.s%s\n", (level + 1) * TAB_SIZE, " ",
                               son->name);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 59c08997bfdf..382d49792f42 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -45,7 +45,6 @@
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_timestamp.h>
 #include <net/netfilter/nf_conntrack_labels.h>
-#include <net/netfilter/nf_conntrack_seqadj.h>
 #include <net/netfilter/nf_conntrack_synproxy.h>
 #ifdef CONFIG_NF_NAT_NEEDED
 #include <net/netfilter/nf_nat_core.h>
@@ -1566,9 +1565,11 @@ static int ctnetlink_change_helper(struct nf_conn *ct,
 static int ctnetlink_change_timeout(struct nf_conn *ct,
                                     const struct nlattr * const cda[])
 {
-        u_int32_t timeout = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));
+        u64 timeout = (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ;
 
-        ct->timeout = nfct_time_stamp + timeout * HZ;
+        if (timeout > INT_MAX)
+                timeout = INT_MAX;
+        ct->timeout = nfct_time_stamp + (u32)timeout;
 
         if (test_bit(IPS_DYING_BIT, &ct->status))
                 return -ETIME;
@@ -1768,6 +1769,7 @@ ctnetlink_create_conntrack(struct net *net,
         int err = -EINVAL;
         struct nf_conntrack_helper *helper;
         struct nf_conn_tstamp *tstamp;
+        u64 timeout;
 
         ct = nf_conntrack_alloc(net, zone, otuple, rtuple, GFP_ATOMIC);
         if (IS_ERR(ct))
@@ -1776,7 +1778,10 @@ ctnetlink_create_conntrack(struct net *net,
         if (!cda[CTA_TIMEOUT])
                 goto err1;
 
-        ct->timeout = nfct_time_stamp + ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ;
+        timeout = (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ;
+        if (timeout > INT_MAX)
+                timeout = INT_MAX;
+        ct->timeout = (u32)timeout + nfct_time_stamp;
 
         rcu_read_lock();
         if (cda[CTA_HELP]) {
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index b12fc07111d0..37ef35b861f2 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -1039,6 +1039,9 @@ static int tcp_packet(struct nf_conn *ct,
                  IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
                  timeouts[new_state] > timeouts[TCP_CONNTRACK_UNACK])
                 timeout = timeouts[TCP_CONNTRACK_UNACK];
+        else if (ct->proto.tcp.last_win == 0 &&
+                 timeouts[new_state] > timeouts[TCP_CONNTRACK_RETRANS])
+                timeout = timeouts[TCP_CONNTRACK_RETRANS];
         else
                 timeout = timeouts[new_state];
         spin_unlock_bh(&ct->lock);
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index d8327b43e4dc..07bd4138c84e 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2072,7 +2072,7 @@ static int nf_tables_dump_rules(struct sk_buff *skb,
                                 continue;
 
                         list_for_each_entry_rcu(chain, &table->chains, list) {
-                                if (ctx && ctx->chain[0] &&
+                                if (ctx && ctx->chain &&
                                     strcmp(ctx->chain, chain->name) != 0)
                                         continue;
 
@@ -4665,8 +4665,10 @@ static int nf_tables_dump_obj_done(struct netlink_callback *cb)
 {
         struct nft_obj_filter *filter = cb->data;
 
-        kfree(filter->table);
-        kfree(filter);
+        if (filter) {
+                kfree(filter->table);
+                kfree(filter);
+        }
 
         return 0;
 }
@@ -5847,6 +5849,12 @@ static int __net_init nf_tables_init_net(struct net *net)
         return 0;
 }
 
+static void __net_exit nf_tables_exit_net(struct net *net)
+{
+        WARN_ON_ONCE(!list_empty(&net->nft.af_info));
+        WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
+}
+
 int __nft_release_basechain(struct nft_ctx *ctx)
 {
         struct nft_rule *rule, *nr;
@@ -5917,6 +5925,7 @@ static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi)
 
 static struct pernet_operations nf_tables_net_ops = {
         .init   = nf_tables_init_net,
+        .exit   = nf_tables_exit_net,
 };
 
 static int __init nf_tables_module_init(void)
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 41628b393673..d33ce6d5ebce 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -17,6 +17,7 @@
 #include <linux/types.h>
 #include <linux/list.h>
 #include <linux/errno.h>
+#include <linux/capability.h>
 #include <net/netlink.h>
 #include <net/sock.h>
 
@@ -407,6 +408,9 @@ static int nfnl_cthelper_new(struct net *net, struct sock *nfnl,
         struct nfnl_cthelper *nlcth;
         int ret = 0;
 
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
         if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE])
                 return -EINVAL;
 
@@ -611,6 +615,9 @@ static int nfnl_cthelper_get(struct net *net, struct sock *nfnl,
         struct nfnl_cthelper *nlcth;
         bool tuple_set = false;
 
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 struct netlink_dump_control c = {
                         .dump = nfnl_cthelper_dump_table,
@@ -678,6 +685,9 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
         struct nfnl_cthelper *nlcth, *n;
         int j = 0, ret;
 
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
         if (tb[NFCTH_NAME])
                 helper_name = nla_data(tb[NFCTH_NAME]);
 
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index e5afab86381c..e955bec0acc6 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -1093,10 +1093,15 @@ static int __net_init nfnl_log_net_init(struct net *net)
 
 static void __net_exit nfnl_log_net_exit(struct net *net)
 {
+        struct nfnl_log_net *log = nfnl_log_pernet(net);
+        unsigned int i;
+
 #ifdef CONFIG_PROC_FS
         remove_proc_entry("nfnetlink_log", net->nf.proc_netfilter);
 #endif
         nf_log_unset(net, &nfulnl_logger);
+        for (i = 0; i < INSTANCE_BUCKETS; i++)
+                WARN_ON_ONCE(!hlist_empty(&log->instance_table[i]));
 }
 
 static struct pernet_operations nfnl_log_net_ops = {
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index a16356cacec3..c09b36755ed7 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1512,10 +1512,15 @@ static int __net_init nfnl_queue_net_init(struct net *net)
 
 static void __net_exit nfnl_queue_net_exit(struct net *net)
 {
+        struct nfnl_queue_net *q = nfnl_queue_pernet(net);
+        unsigned int i;
+
         nf_unregister_queue_handler(net);
 #ifdef CONFIG_PROC_FS
         remove_proc_entry("nfnetlink_queue", net->nf.proc_netfilter);
 #endif
+        for (i = 0; i < INSTANCE_BUCKETS; i++)
+                WARN_ON_ONCE(!hlist_empty(&q->instance_table[i]));
 }
 
 static void nfnl_queue_net_exit_batch(struct list_head *net_exit_list)
diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index a0a93d987a3b..47ec1046ad11 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -214,6 +214,8 @@ static const struct nla_policy nft_exthdr_policy[NFTA_EXTHDR_MAX + 1] = {
         [NFTA_EXTHDR_OFFSET]            = { .type = NLA_U32 },
         [NFTA_EXTHDR_LEN]               = { .type = NLA_U32 },
         [NFTA_EXTHDR_FLAGS]             = { .type = NLA_U32 },
+        [NFTA_EXTHDR_OP]                = { .type = NLA_U32 },
+        [NFTA_EXTHDR_SREG]              = { .type = NLA_U32 },
 };
 
 static int nft_exthdr_init(const struct nft_ctx *ctx,
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index a77dd514297c..55802e97f906 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1729,8 +1729,17 @@ static int __net_init xt_net_init(struct net *net)
         return 0;
 }
 
+static void __net_exit xt_net_exit(struct net *net)
+{
+        int i;
+
+        for (i = 0; i < NFPROTO_NUMPROTO; i++)
+                WARN_ON_ONCE(!list_empty(&net->xt.tables[i]));
+}
+
 static struct pernet_operations xt_net_ops = {
         .init = xt_net_init,
+        .exit = xt_net_exit,
 };
 
 static int __init xt_init(void)
diff --git a/net/netfilter/xt_bpf.c b/net/netfilter/xt_bpf.c
index 041da0d9c06f..06b090d8e901 100644
--- a/net/netfilter/xt_bpf.c
+++ b/net/netfilter/xt_bpf.c
@@ -27,6 +27,9 @@ static int __bpf_mt_check_bytecode(struct sock_filter *insns, __u16 len,
 {
         struct sock_fprog_kern program;
 
+        if (len > XT_BPF_MAX_NUM_INSTR)
+                return -EINVAL;
+
         program.len = len;
         program.filter = insns;
 
@@ -52,18 +55,11 @@ static int __bpf_mt_check_fd(int fd, struct bpf_prog **ret)
 
 static int __bpf_mt_check_path(const char *path, struct bpf_prog **ret)
 {
-        mm_segment_t oldfs = get_fs();
-        int retval, fd;
-
-        set_fs(KERNEL_DS);
-        fd = bpf_obj_get_user(path, 0);
-        set_fs(oldfs);
-        if (fd < 0)
-                return fd;
-
-        retval = __bpf_mt_check_fd(fd, ret);
-        sys_close(fd);
-        return retval;
+        if (strnlen(path, XT_BPF_PATH_MAX) == XT_BPF_PATH_MAX)
+                return -EINVAL;
+
+        *ret = bpf_prog_get_type_path(path, BPF_PROG_TYPE_SOCKET_FILTER);
+        return PTR_ERR_OR_ZERO(*ret);
 }
 
 static int bpf_mt_check(const struct xt_mtchk_param *par)
diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
index 36e14b1f061d..a34f314a8c23 100644
--- a/net/netfilter/xt_osf.c
+++ b/net/netfilter/xt_osf.c
@@ -19,6 +19,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 
+#include <linux/capability.h>
 #include <linux/if.h>
 #include <linux/inetdevice.h>
 #include <linux/ip.h>
@@ -70,6 +71,9 @@ static int xt_osf_add_callback(struct net *net, struct sock *ctnl,
         struct xt_osf_finger *kf = NULL, *sf;
         int err = 0;
 
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
         if (!osf_attrs[OSF_ATTR_FINGER])
                 return -EINVAL;
 
@@ -115,6 +119,9 @@ static int xt_osf_remove_callback(struct net *net, struct sock *ctnl,
         struct xt_osf_finger *sf;
         int err = -ENOENT;
 
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
         if (!osf_attrs[OSF_ATTR_FINGER])
                 return -EINVAL;
 
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index b9e0ee4e22f5..84a4e4c3be4b 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -253,6 +253,9 @@ static int __netlink_deliver_tap_skb(struct sk_buff *skb,
         struct sock *sk = skb->sk;
         int ret = -ENOMEM;
 
+        if (!net_eq(dev_net(dev), sock_net(sk)))
+                return 0;
+
         dev_hold(dev);
 
         if (is_vmalloc_addr(skb->head))
@@ -2381,13 +2384,14 @@ int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *,
                                                    struct nlmsghdr *,
                                                    struct netlink_ext_ack *))
 {
-        struct netlink_ext_ack extack = {};
+        struct netlink_ext_ack extack;
         struct nlmsghdr *nlh;
         int err;
 
         while (skb->len >= nlmsg_total_size(0)) {
                 int msglen;
 
+                memset(&extack, 0, sizeof(extack));
                 nlh = nlmsg_hdr(skb);
                 err = 0;
 
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index dbe2379329c5..f039064ce922 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -579,6 +579,7 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
                         return -EINVAL;
 
                 skb_reset_network_header(skb);
+                key->eth.type = skb->protocol;
         } else {
                 eth = eth_hdr(skb);
                 ether_addr_copy(key->eth.src, eth->h_source);
@@ -592,15 +593,23 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
                 if (unlikely(parse_vlan(skb, key)))
                         return -ENOMEM;
 
-                skb->protocol = parse_ethertype(skb);
-                if (unlikely(skb->protocol == htons(0)))
+                key->eth.type = parse_ethertype(skb);
+                if (unlikely(key->eth.type == htons(0)))
                         return -ENOMEM;
 
+                /* Multiple tagged packets need to retain TPID to satisfy
+                 * skb_vlan_pop(), which will later shift the ethertype into
+                 * skb->protocol.
+                 */
+                if (key->eth.cvlan.tci & htons(VLAN_TAG_PRESENT))
+                        skb->protocol = key->eth.cvlan.tpid;
+                else
+                        skb->protocol = key->eth.type;
+
                 skb_reset_network_header(skb);
                 __skb_push(skb, skb->data - skb_mac_header(skb));
         }
         skb_reset_mac_len(skb);
-        key->eth.type = skb->protocol;
 
         /* Network layer. */
         if (key->eth.type == htons(ETH_P_IP)) {
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 624ea74353dd..f143908b651d 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -49,7 +49,6 @@
 #include <net/mpls.h>
 #include <net/vxlan.h>
 #include <net/tun_proto.h>
-#include <net/erspan.h>
 
 #include "flow_netlink.h"
 
@@ -334,8 +333,7 @@ size_t ovs_tun_key_attr_size(void)
                  * OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS and covered by it.
                  */
                 + nla_total_size(2)    /* OVS_TUNNEL_KEY_ATTR_TP_SRC */
-                + nla_total_size(2)    /* OVS_TUNNEL_KEY_ATTR_TP_DST */
-                + nla_total_size(4);   /* OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS */
+                + nla_total_size(2);   /* OVS_TUNNEL_KEY_ATTR_TP_DST */
 }
 
 static size_t ovs_nsh_key_attr_size(void)
@@ -402,7 +400,6 @@ static const struct ovs_len_tbl ovs_tunnel_key_lens[OVS_TUNNEL_KEY_ATTR_MAX + 1]
                                                 .next = ovs_vxlan_ext_key_lens },
         [OVS_TUNNEL_KEY_ATTR_IPV6_SRC]      = { .len = sizeof(struct in6_addr) },
         [OVS_TUNNEL_KEY_ATTR_IPV6_DST]      = { .len = sizeof(struct in6_addr) },
-        [OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS]   = { .len = sizeof(u32) },
 };
 
 static const struct ovs_len_tbl
@@ -634,33 +631,6 @@ static int vxlan_tun_opt_from_nlattr(const struct nlattr *attr,
         return 0;
 }
 
-static int erspan_tun_opt_from_nlattr(const struct nlattr *attr,
-                                      struct sw_flow_match *match, bool is_mask,
-                                      bool log)
-{
-        unsigned long opt_key_offset;
-        struct erspan_metadata opts;
-
-        BUILD_BUG_ON(sizeof(opts) > sizeof(match->key->tun_opts));
-
-        memset(&opts, 0, sizeof(opts));
-        opts.index = nla_get_be32(attr);
-
-        /* Index has only 20-bit */
-        if (ntohl(opts.index) & ~INDEX_MASK) {
-                OVS_NLERR(log, "ERSPAN index number %x too large.",
-                          ntohl(opts.index));
-                return -EINVAL;
-        }
-
-        SW_FLOW_KEY_PUT(match, tun_opts_len, sizeof(opts), is_mask);
-        opt_key_offset = TUN_METADATA_OFFSET(sizeof(opts));
-        SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, &opts, sizeof(opts),
-                                  is_mask);
-
-        return 0;
-}
-
 static int ip_tun_from_nlattr(const struct nlattr *attr,
                               struct sw_flow_match *match, bool is_mask,
                               bool log)
@@ -768,19 +738,6 @@ static int ip_tun_from_nlattr(const struct nlattr *attr,
                         break;
                 case OVS_TUNNEL_KEY_ATTR_PAD:
                         break;
-                case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS:
-                        if (opts_type) {
-                                OVS_NLERR(log, "Multiple metadata blocks provided");
-                                return -EINVAL;
-                        }
-
-                        err = erspan_tun_opt_from_nlattr(a, match, is_mask, log);
-                        if (err)
-                                return err;
-
-                        tun_flags |= TUNNEL_ERSPAN_OPT;
-                        opts_type = type;
-                        break;
                 default:
                         OVS_NLERR(log, "Unknown IP tunnel attribute %d",
                                   type);
@@ -905,10 +862,6 @@ static int __ip_tun_to_nlattr(struct sk_buff *skb,
                 else if (output->tun_flags & TUNNEL_VXLAN_OPT &&
                          vxlan_opt_to_nlattr(skb, tun_opts, swkey_tun_opts_len))
                         return -EMSGSIZE;
-                else if (output->tun_flags & TUNNEL_ERSPAN_OPT &&
-                         nla_put_be32(skb, OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS,
-                                      ((struct erspan_metadata *)tun_opts)->index))
-                        return -EMSGSIZE;
         }
 
         return 0;
@@ -2533,8 +2486,6 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
                         break;
                 case OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS:
                         break;
-                case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS:
-                        break;
                 }
         };
 
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 8886f15abe90..634cfcb7bba6 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -183,7 +183,7 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
         long i;
         int ret;
 
-        if (rs->rs_bound_addr == 0) {
+        if (rs->rs_bound_addr == 0 || !rs->rs_transport) {
                 ret = -ENOTCONN; /* XXX not a great errno */
                 goto out;
         }
@@ -525,6 +525,9 @@ int rds_rdma_extra_size(struct rds_rdma_args *args)
 
         local_vec = (struct rds_iovec __user *)(unsigned long) args->local_vec_addr;
 
+        if (args->nr_local == 0)
+                return -EINVAL;
+
         /* figure out the number of pages in the vector */
         for (i = 0; i < args->nr_local; i++) {
                 if (copy_from_user(&vec, &local_vec[i],
@@ -874,6 +877,7 @@ int rds_cmsg_atomic(struct rds_sock *rs, struct rds_message *rm,
 err:
         if (page)
                 put_page(page);
+        rm->atomic.op_active = 0;
         kfree(rm->atomic.op_notifier);
 
         return ret;
diff --git a/net/rds/send.c b/net/rds/send.c
index b52cdc8ae428..f72466c63f0c 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -1009,6 +1009,9 @@ static int rds_rdma_bytes(struct msghdr *msg, size_t *rdma_bytes)
                         continue;
 
                 if (cmsg->cmsg_type == RDS_CMSG_RDMA_ARGS) {
+                        if (cmsg->cmsg_len <
+                            CMSG_LEN(sizeof(struct rds_rdma_args)))
+                                return -EINVAL;
                         args = CMSG_DATA(cmsg);
                         *rdma_bytes += args->remote_vec.bytes;
                 }
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index 6b7ee71f40c6..ab7356e0ba83 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -90,9 +90,10 @@ void rds_tcp_nonagle(struct socket *sock)
                               sizeof(val));
 }
 
-u32 rds_tcp_snd_nxt(struct rds_tcp_connection *tc)
+u32 rds_tcp_write_seq(struct rds_tcp_connection *tc)
 {
-        return tcp_sk(tc->t_sock->sk)->snd_nxt;
+        /* seq# of the last byte of data in tcp send buffer */
+        return tcp_sk(tc->t_sock->sk)->write_seq;
 }
 
 u32 rds_tcp_snd_una(struct rds_tcp_connection *tc)
diff --git a/net/rds/tcp.h b/net/rds/tcp.h
index 1aafbf7c3011..864ca7d8f019 100644
--- a/net/rds/tcp.h
+++ b/net/rds/tcp.h
@@ -54,7 +54,7 @@ void rds_tcp_set_callbacks(struct socket *sock, struct rds_conn_path *cp);
 void rds_tcp_reset_callbacks(struct socket *sock, struct rds_conn_path *cp);
 void rds_tcp_restore_callbacks(struct socket *sock,
                                struct rds_tcp_connection *tc);
-u32 rds_tcp_snd_nxt(struct rds_tcp_connection *tc);
+u32 rds_tcp_write_seq(struct rds_tcp_connection *tc);
 u32 rds_tcp_snd_una(struct rds_tcp_connection *tc);
 u64 rds_tcp_map_seq(struct rds_tcp_connection *tc, u32 seq);
 extern struct rds_transport rds_tcp_transport;
diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
index dc860d1bb608..9b76e0fa1722 100644
--- a/net/rds/tcp_send.c
+++ b/net/rds/tcp_send.c
@@ -86,7 +86,7 @@ int rds_tcp_xmit(struct rds_connection *conn, struct rds_message *rm,
                  * m_ack_seq is set to the sequence number of the last byte of
                  * header and data.  see rds_tcp_is_acked().
                  */
-                tc->t_last_sent_nxt = rds_tcp_snd_nxt(tc);
+                tc->t_last_sent_nxt = rds_tcp_write_seq(tc);
                 rm->m_ack_seq = tc->t_last_sent_nxt +
                                 sizeof(struct rds_header) +
                                 be32_to_cpu(rm->m_inc.i_hdr.h_len) - 1;
@@ -98,7 +98,7 @@ int rds_tcp_xmit(struct rds_connection *conn, struct rds_message *rm,
                         rm->m_inc.i_hdr.h_flags |= RDS_FLAG_RETRANSMITTED;
 
                 rdsdebug("rm %p tcp nxt %u ack_seq %llu\n",
-                         rm, rds_tcp_snd_nxt(tc),
+                         rm, rds_tcp_write_seq(tc),
                          (unsigned long long)rm->m_ack_seq);
         }
 
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 8f7cf4c042be..dcd818fa837e 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -860,6 +860,7 @@ static void rxrpc_sock_destructor(struct sock *sk)
 static int rxrpc_release_sock(struct sock *sk)
 {
         struct rxrpc_sock *rx = rxrpc_sk(sk);
+        struct rxrpc_net *rxnet = rxrpc_net(sock_net(&rx->sk));
 
         _enter("%p{%d,%d}", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));
 
@@ -895,8 +896,8 @@ static int rxrpc_release_sock(struct sock *sk)
         rxrpc_release_calls_on_socket(rx);
         flush_workqueue(rxrpc_workqueue);
         rxrpc_purge_queue(&sk->sk_receive_queue);
-        rxrpc_queue_work(&rx->local->rxnet->service_conn_reaper);
-        rxrpc_queue_work(&rx->local->rxnet->client_conn_reaper);
+        rxrpc_queue_work(&rxnet->service_conn_reaper);
+        rxrpc_queue_work(&rxnet->client_conn_reaper);
 
         rxrpc_put_local(rx->local);
         rx->local = NULL;
diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index bda952ffe6a6..ad2ab1103189 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -123,7 +123,7 @@ static void __rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
                 else
                         ack_at = expiry;
 
-                ack_at = jiffies + expiry;
+                ack_at += now;
                 if (time_before(ack_at, call->ack_at)) {
                         WRITE_ONCE(call->ack_at, ack_at);
                         rxrpc_reduce_call_timer(call, ack_at, now,
@@ -426,7 +426,7 @@ recheck_state:
         next = call->expect_rx_by;
 
 #define set(T) { t = READ_ONCE(T); if (time_before(t, next)) next = t; }
-        
+
         set(call->expect_req_by);
         set(call->expect_term_by);
         set(call->ack_at);
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index 9e9a8db1bc9c..4ca11be6be3c 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -30,22 +30,18 @@ static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn,
         struct rxrpc_skb_priv *sp = skb ? rxrpc_skb(skb) : NULL;
         struct rxrpc_channel *chan;
         struct msghdr msg;
-        struct kvec iov;
+        struct kvec iov[3];
         struct {
                 struct rxrpc_wire_header whdr;
                 union {
-                        struct {
-                                __be32 code;
-                        } abort;
-                        struct {
-                                struct rxrpc_ackpacket ack;
-                                u8 padding[3];
-                                struct rxrpc_ackinfo info;
-                        };
+                        __be32 abort_code;
+                        struct rxrpc_ackpacket ack;
                 };
         } __attribute__((packed)) pkt;
+        struct rxrpc_ackinfo ack_info;
         size_t len;
-        u32 serial, mtu, call_id;
+        int ioc;
+        u32 serial, mtu, call_id, padding;
 
         _enter("%d", conn->debug_id);
 
@@ -66,6 +62,13 @@ static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn,
         msg.msg_controllen = 0;
         msg.msg_flags   = 0;
 
+        iov[0].iov_base = &pkt;
+        iov[0].iov_len  = sizeof(pkt.whdr);
+        iov[1].iov_base = &padding;
+        iov[1].iov_len  = 3;
+        iov[2].iov_base = &ack_info;
+        iov[2].iov_len  = sizeof(ack_info);
+
         pkt.whdr.epoch          = htonl(conn->proto.epoch);
         pkt.whdr.cid            = htonl(conn->proto.cid);
         pkt.whdr.callNumber     = htonl(call_id);
@@ -80,8 +83,10 @@ static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn,
         len = sizeof(pkt.whdr);
         switch (chan->last_type) {
         case RXRPC_PACKET_TYPE_ABORT:
-                pkt.abort.code  = htonl(chan->last_abort);
-                len += sizeof(pkt.abort);
+                pkt.abort_code  = htonl(chan->last_abort);
+                iov[0].iov_len += sizeof(pkt.abort_code);
+                len += sizeof(pkt.abort_code);
+                ioc = 1;
                 break;
 
         case RXRPC_PACKET_TYPE_ACK:
@@ -94,13 +99,19 @@ static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn,
                 pkt.ack.serial          = htonl(skb ? sp->hdr.serial : 0);
                 pkt.ack.reason          = skb ? RXRPC_ACK_DUPLICATE : RXRPC_ACK_IDLE;
                 pkt.ack.nAcks           = 0;
-                pkt.info.rxMTU          = htonl(rxrpc_rx_mtu);
-                pkt.info.maxMTU         = htonl(mtu);
-                pkt.info.rwind          = htonl(rxrpc_rx_window_size);
-                pkt.info.jumbo_max      = htonl(rxrpc_rx_jumbo_max);
+                ack_info.rxMTU          = htonl(rxrpc_rx_mtu);
+                ack_info.maxMTU         = htonl(mtu);
+                ack_info.rwind          = htonl(rxrpc_rx_window_size);
+                ack_info.jumbo_max      = htonl(rxrpc_rx_jumbo_max);
                 pkt.whdr.flags          |= RXRPC_SLOW_START_OK;
-                len += sizeof(pkt.ack) + sizeof(pkt.info);
+                padding                 = 0;
+                iov[0].iov_len += sizeof(pkt.ack);
+                len += sizeof(pkt.ack) + 3 + sizeof(ack_info);
+                ioc = 3;
                 break;
+
+        default:
+                return;
         }
 
         /* Resync with __rxrpc_disconnect_call() and check that the last call
@@ -110,9 +121,6 @@ static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn,
         if (READ_ONCE(chan->last_call) != call_id)
                 return;
 
-        iov.iov_base    = &pkt;
-        iov.iov_len     = len;
-
         serial = atomic_inc_return(&conn->serial);
         pkt.whdr.serial = htonl(serial);
 
@@ -127,7 +135,7 @@ static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn,
                 break;
         }
 
-        kernel_sendmsg(conn->params.local->socket, &msg, &iov, 1, len);
+        kernel_sendmsg(conn->params.local->socket, &msg, iov, ioc, len);
         _leave("");
         return;
 }
diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
index 1aad04a32d5e..c628351eb900 100644
--- a/net/rxrpc/conn_object.c
+++ b/net/rxrpc/conn_object.c
@@ -424,7 +424,7 @@ void rxrpc_service_connection_reaper(struct work_struct *work)
         if (earliest != now + MAX_JIFFY_OFFSET) {
                 _debug("reschedule reaper %ld", (long)earliest - (long)now);
                 ASSERT(time_after(earliest, now));
-                rxrpc_set_service_reap_timer(rxnet, earliest);          
+                rxrpc_set_service_reap_timer(rxnet, earliest);
         }
 
         while (!list_empty(&graveyard)) {
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 23a5e61d8f79..6fc61400337f 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -976,7 +976,7 @@ static void rxrpc_input_call_packet(struct rxrpc_call *call,
                 rxrpc_reduce_call_timer(call, expect_rx_by, now,
                                         rxrpc_timer_set_for_normal);
         }
-        
+
         switch (sp->hdr.type) {
         case RXRPC_PACKET_TYPE_DATA:
                 rxrpc_input_data(call, skb, skew);
@@ -1213,7 +1213,7 @@ void rxrpc_data_ready(struct sock *udp_sk)
                                 goto reupgrade;
                         conn->service_id = sp->hdr.serviceId;
                 }
-                
+
                 if (sp->hdr.callNumber == 0) {
                         /* Connection-level packet */
                         _debug("CONN %p {%d}", conn, conn->debug_id);
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index a1c53ac066a1..09f2a3e05221 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -233,7 +233,7 @@ static void rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
                 if (resend_at < 1)
                         resend_at = 1;
 
-                resend_at = now + rxrpc_resend_timeout;
+                resend_at += now;
                 WRITE_ONCE(call->resend_at, resend_at);
                 rxrpc_reduce_call_timer(call, resend_at, now,
                                         rxrpc_timer_set_for_send);
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index e29a48ef7fc3..a0ac42b3ed06 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -159,7 +159,7 @@ static void tcf_gact_stats_update(struct tc_action *a, u64 bytes, u32 packets,
         if (action == TC_ACT_SHOT)
                 this_cpu_ptr(gact->common.cpu_qstats)->drops += packets;
 
-        tm->lastuse = lastuse;
+        tm->lastuse = max_t(u64, tm->lastuse, lastuse);
 }
 
 static int tcf_gact_dump(struct sk_buff *skb, struct tc_action *a,
diff --git a/net/sched/act_meta_mark.c b/net/sched/act_meta_mark.c
index 1e3f10e5da99..6445184b2759 100644
--- a/net/sched/act_meta_mark.c
+++ b/net/sched/act_meta_mark.c
@@ -22,7 +22,6 @@
 #include <net/pkt_sched.h>
 #include <uapi/linux/tc_act/tc_ife.h>
 #include <net/tc_act/tc_ife.h>
-#include <linux/rtnetlink.h>
 
 static int skbmark_encode(struct sk_buff *skb, void *skbdata,
                           struct tcf_meta_info *e)
diff --git a/net/sched/act_meta_skbtcindex.c b/net/sched/act_meta_skbtcindex.c
index 2ea1f26c9e96..7221437ca3a6 100644
--- a/net/sched/act_meta_skbtcindex.c
+++ b/net/sched/act_meta_skbtcindex.c
@@ -22,7 +22,6 @@
 #include <net/pkt_sched.h>
 #include <uapi/linux/tc_act/tc_ife.h>
 #include <net/tc_act/tc_ife.h>
-#include <linux/rtnetlink.h>
 
 static int skbtcindex_encode(struct sk_buff *skb, void *skbdata,
                              struct tcf_meta_info *e)
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 8b3e59388480..08b61849c2a2 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -239,7 +239,7 @@ static void tcf_stats_update(struct tc_action *a, u64 bytes, u32 packets,
         struct tcf_t *tm = &m->tcf_tm;
 
         _bstats_cpu_update(this_cpu_ptr(a->cpu_bstats), bytes, packets);
-        tm->lastuse = lastuse;
+        tm->lastuse = max_t(u64, tm->lastuse, lastuse);
 }
 
 static int tcf_mirred_dump(struct sk_buff *skb, struct tc_action *a, int bind,
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index 8b5abcd2f32f..9438969290a6 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -96,23 +96,16 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
         return ret;
 }
 
-static void tcf_sample_cleanup_rcu(struct rcu_head *rcu)
+static void tcf_sample_cleanup(struct tc_action *a, int bind)
 {
-        struct tcf_sample *s = container_of(rcu, struct tcf_sample, rcu);
+        struct tcf_sample *s = to_sample(a);
         struct psample_group *psample_group;
 
-        psample_group = rcu_dereference_protected(s->psample_group, 1);
+        psample_group = rtnl_dereference(s->psample_group);
         RCU_INIT_POINTER(s->psample_group, NULL);
         psample_group_put(psample_group);
 }
 
-static void tcf_sample_cleanup(struct tc_action *a, int bind)
-{
-        struct tcf_sample *s = to_sample(a);
-
-        call_rcu(&s->rcu, tcf_sample_cleanup_rcu);
-}
-
 static bool tcf_sample_dev_ok_push(struct net_device *dev)
 {
         switch (dev->type) {
@@ -264,7 +257,6 @@ static int __init sample_init_module(void)
 
 static void __exit sample_cleanup_module(void)
 {
-        rcu_barrier();
         tcf_unregister_action(&act_sample_ops, &sample_net_ops);
 }
 
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index ddcf04b4ab43..b9d63d2246e6 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -23,7 +23,6 @@
 #include <linux/skbuff.h>
 #include <linux/init.h>
 #include <linux/kmod.h>
-#include <linux/err.h>
 #include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -352,6 +351,8 @@ void tcf_block_put_ext(struct tcf_block *block, struct Qdisc *q,
 {
         struct tcf_chain *chain;
 
+        if (!block)
+                return;
         /* Hold a refcnt for all chains, except 0, so that they don't disappear
          * while we are iterating.
          */
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index 6fe798c2df1a..a62586e2dbdb 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -42,7 +42,6 @@ struct cls_bpf_prog {
         struct list_head link;
         struct tcf_result res;
         bool exts_integrated;
-        bool offloaded;
         u32 gen_flags;
         struct tcf_exts exts;
         u32 handle;
@@ -148,73 +147,63 @@ static bool cls_bpf_is_ebpf(const struct cls_bpf_prog *prog)
 }
 
 static int cls_bpf_offload_cmd(struct tcf_proto *tp, struct cls_bpf_prog *prog,
-                               enum tc_clsbpf_command cmd)
+                               struct cls_bpf_prog *oldprog)
 {
-        bool addorrep = cmd == TC_CLSBPF_ADD || cmd == TC_CLSBPF_REPLACE;
         struct tcf_block *block = tp->chain->block;
-        bool skip_sw = tc_skip_sw(prog->gen_flags);
         struct tc_cls_bpf_offload cls_bpf = {};
+        struct cls_bpf_prog *obj;
+        bool skip_sw;
         int err;
 
+        skip_sw = prog && tc_skip_sw(prog->gen_flags);
+        obj = prog ?: oldprog;
+
         tc_cls_common_offload_init(&cls_bpf.common, tp);
-        cls_bpf.command = cmd;
-        cls_bpf.exts = &prog->exts;
-        cls_bpf.prog = prog->filter;
-        cls_bpf.name = prog->bpf_name;
-        cls_bpf.exts_integrated = prog->exts_integrated;
-        cls_bpf.gen_flags = prog->gen_flags;
+        cls_bpf.command = TC_CLSBPF_OFFLOAD;
+        cls_bpf.exts = &obj->exts;
+        cls_bpf.prog = prog ? prog->filter : NULL;
+        cls_bpf.oldprog = oldprog ? oldprog->filter : NULL;
+        cls_bpf.name = obj->bpf_name;
+        cls_bpf.exts_integrated = obj->exts_integrated;
+        cls_bpf.gen_flags = obj->gen_flags;
 
         err = tc_setup_cb_call(block, NULL, TC_SETUP_CLSBPF, &cls_bpf, skip_sw);
-        if (addorrep) {
+        if (prog) {
                 if (err < 0) {
-                        cls_bpf_offload_cmd(tp, prog, TC_CLSBPF_DESTROY);
+                        cls_bpf_offload_cmd(tp, oldprog, prog);
                         return err;
                 } else if (err > 0) {
                         prog->gen_flags |= TCA_CLS_FLAGS_IN_HW;
                 }
         }
 
-        if (addorrep && skip_sw && !(prog->gen_flags & TCA_CLS_FLAGS_IN_HW))
+        if (prog && skip_sw && !(prog->gen_flags & TCA_CLS_FLAGS_IN_HW))
                 return -EINVAL;
 
         return 0;
 }
 
+static u32 cls_bpf_flags(u32 flags)
+{
+        return flags & CLS_BPF_SUPPORTED_GEN_FLAGS;
+}
+
 static int cls_bpf_offload(struct tcf_proto *tp, struct cls_bpf_prog *prog,
                            struct cls_bpf_prog *oldprog)
 {
-        struct cls_bpf_prog *obj = prog;
-        enum tc_clsbpf_command cmd;
-        bool skip_sw;
-        int ret;
-
-        skip_sw = tc_skip_sw(prog->gen_flags) ||
-                (oldprog && tc_skip_sw(oldprog->gen_flags));
-
-        if (oldprog && oldprog->offloaded) {
-                if (!tc_skip_hw(prog->gen_flags)) {
-                        cmd = TC_CLSBPF_REPLACE;
-                } else if (!tc_skip_sw(prog->gen_flags)) {
-                        obj = oldprog;
-                        cmd = TC_CLSBPF_DESTROY;
-                } else {
-                        return -EINVAL;
-                }
-        } else {
-                if (tc_skip_hw(prog->gen_flags))
-                        return skip_sw ? -EINVAL : 0;
-                cmd = TC_CLSBPF_ADD;
-        }
-
-        ret = cls_bpf_offload_cmd(tp, obj, cmd);
-        if (ret)
-                return ret;
+        if (prog && oldprog &&
+            cls_bpf_flags(prog->gen_flags) !=
+            cls_bpf_flags(oldprog->gen_flags))
+                return -EINVAL;
 
-        obj->offloaded = true;
-        if (oldprog)
-                oldprog->offloaded = false;
+        if (prog && tc_skip_hw(prog->gen_flags))
+                prog = NULL;
+        if (oldprog && tc_skip_hw(oldprog->gen_flags))
+                oldprog = NULL;
+        if (!prog && !oldprog)
+                return 0;
 
-        return 0;
+        return cls_bpf_offload_cmd(tp, prog, oldprog);
 }
 
 static void cls_bpf_stop_offload(struct tcf_proto *tp,
@@ -222,25 +211,26 @@ static void cls_bpf_stop_offload(struct tcf_proto *tp,
 {
         int err;
 
-        if (!prog->offloaded)
-                return;
-
-        err = cls_bpf_offload_cmd(tp, prog, TC_CLSBPF_DESTROY);
-        if (err) {
+        err = cls_bpf_offload_cmd(tp, NULL, prog);
+        if (err)
                 pr_err("Stopping hardware offload failed: %d\n", err);
-                return;
-        }
-
-        prog->offloaded = false;
 }
 
 static void cls_bpf_offload_update_stats(struct tcf_proto *tp,
                                          struct cls_bpf_prog *prog)
 {
-        if (!prog->offloaded)
-                return;
+        struct tcf_block *block = tp->chain->block;
+        struct tc_cls_bpf_offload cls_bpf = {};
+
+        tc_cls_common_offload_init(&cls_bpf.common, tp);
+        cls_bpf.command = TC_CLSBPF_STATS;
+        cls_bpf.exts = &prog->exts;
+        cls_bpf.prog = prog->filter;
+        cls_bpf.name = prog->bpf_name;
+        cls_bpf.exts_integrated = prog->exts_integrated;
+        cls_bpf.gen_flags = prog->gen_flags;
 
-        cls_bpf_offload_cmd(tp, prog, TC_CLSBPF_STATS);
+        tc_setup_cb_call(block, NULL, TC_SETUP_CLSBPF, &cls_bpf, false);
 }
 
 static int cls_bpf_init(struct tcf_proto *tp)
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index ac152b4f4247..507859cdd1cb 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -45,7 +45,6 @@
 #include <net/netlink.h>
 #include <net/act_api.h>
 #include <net/pkt_cls.h>
-#include <linux/netdevice.h>
 #include <linux/idr.h>
 
 struct tc_u_knode {
diff --git a/net/sched/em_nbyte.c b/net/sched/em_nbyte.c
index df3110d69585..07c10bac06a0 100644
--- a/net/sched/em_nbyte.c
+++ b/net/sched/em_nbyte.c
@@ -51,7 +51,7 @@ static int em_nbyte_match(struct sk_buff *skb, struct tcf_ematch *em,
         if (!tcf_valid_offset(skb, ptr, nbyte->hdr.len))
                 return 0;
 
-        return !memcmp(ptr + nbyte->hdr.off, nbyte->pattern, nbyte->hdr.len);
+        return !memcmp(ptr, nbyte->pattern, nbyte->hdr.len);
 }
 
 static struct tcf_ematch_ops em_nbyte_ops = {
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index b6c4f536876b..52529b7f8d96 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -795,6 +795,8 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
         tcm->tcm_info = refcount_read(&q->refcnt);
         if (nla_put_string(skb, TCA_KIND, q->ops->id))
                 goto nla_put_failure;
+        if (nla_put_u8(skb, TCA_HW_OFFLOAD, !!(q->flags & TCQ_F_OFFLOADED)))
+                goto nla_put_failure;
         if (q->ops->dump && q->ops->dump(q, skb) < 0)
                 goto nla_put_failure;
         qlen = q->q.qlen;
@@ -1061,17 +1063,6 @@ static struct Qdisc *qdisc_create(struct net_device *dev,
         }
 
         if (!ops->init || (err = ops->init(sch, tca[TCA_OPTIONS])) == 0) {
-                if (qdisc_is_percpu_stats(sch)) {
-                        sch->cpu_bstats =
-                                netdev_alloc_pcpu_stats(struct gnet_stats_basic_cpu);
-                        if (!sch->cpu_bstats)
-                                goto err_out4;
-
-                        sch->cpu_qstats = alloc_percpu(struct gnet_stats_queue);
-                        if (!sch->cpu_qstats)
-                                goto err_out4;
-                }
-
                 if (tca[TCA_STAB]) {
                         stab = qdisc_get_stab(tca[TCA_STAB]);
                         if (IS_ERR(stab)) {
@@ -1113,7 +1104,7 @@ static struct Qdisc *qdisc_create(struct net_device *dev,
                 ops->destroy(sch);
 err_out3:
         dev_put(dev);
-        kfree((char *) sch - sch->padded);
+        qdisc_free(sch);
 err_out2:
         module_put(ops->owner);
 err_out:
@@ -1121,8 +1112,6 @@ err_out:
         return NULL;
 
 err_out4:
-        free_percpu(sch->cpu_bstats);
-        free_percpu(sch->cpu_qstats);
         /*
          * Any broken qdiscs that would require a ops->reset() here?
          * The qdisc was never in action so it shouldn't be necessary.
diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
index b30a2c70bd48..531250fceb9e 100644
--- a/net/sched/sch_choke.c
+++ b/net/sched/sch_choke.c
@@ -369,6 +369,9 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt)
 
         ctl = nla_data(tb[TCA_CHOKE_PARMS]);
 
+        if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
+                return -EINVAL;
+
         if (ctl->limit > CHOKE_MAX_QUEUE)
                 return -EINVAL;
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 3839cbbdc32b..cac003fddf3e 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -26,6 +26,7 @@
 #include <linux/list.h>
 #include <linux/slab.h>
 #include <linux/if_vlan.h>
+#include <linux/if_macvlan.h>
 #include <net/sch_generic.h>
 #include <net/pkt_sched.h>
 #include <net/dst.h>
@@ -277,6 +278,8 @@ unsigned long dev_trans_start(struct net_device *dev)
 
         if (is_vlan_dev(dev))
                 dev = vlan_dev_real_dev(dev);
+        else if (netif_is_macvlan(dev))
+                dev = macvlan_dev_real_dev(dev);
         res = netdev_get_tx_queue(dev, 0)->trans_start;
         for (i = 1; i < dev->num_tx_queues; i++) {
                 val = netdev_get_tx_queue(dev, i)->trans_start;
@@ -630,6 +633,19 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
         qdisc_skb_head_init(&sch->q);
         spin_lock_init(&sch->q.lock);
 
+        if (ops->static_flags & TCQ_F_CPUSTATS) {
+                sch->cpu_bstats =
+                        netdev_alloc_pcpu_stats(struct gnet_stats_basic_cpu);
+                if (!sch->cpu_bstats)
+                        goto errout1;
+
+                sch->cpu_qstats = alloc_percpu(struct gnet_stats_queue);
+                if (!sch->cpu_qstats) {
+                        free_percpu(sch->cpu_bstats);
+                        goto errout1;
+                }
+        }
+
         spin_lock_init(&sch->busylock);
         lockdep_set_class(&sch->busylock,
                           dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);
@@ -639,6 +655,7 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
                           dev->qdisc_running_key ?: &qdisc_running_key);
 
         sch->ops = ops;
+        sch->flags = ops->static_flags;
         sch->enqueue = ops->enqueue;
         sch->dequeue = ops->dequeue;
         sch->dev_queue = dev_queue;
@@ -646,6 +663,8 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
         refcount_set(&sch->refcnt, 1);
 
         return sch;
+errout1:
+        kfree(p);
 errout:
         return ERR_PTR(err);
 }
@@ -695,7 +714,7 @@ void qdisc_reset(struct Qdisc *qdisc)
 }
 EXPORT_SYMBOL(qdisc_reset);
 
-static void qdisc_free(struct Qdisc *qdisc)
+void qdisc_free(struct Qdisc *qdisc)
 {
         if (qdisc_is_percpu_stats(qdisc)) {
                 free_percpu(qdisc->cpu_bstats);
@@ -1037,6 +1056,8 @@ void mini_qdisc_pair_swap(struct mini_Qdisc_pair *miniqp,
 
         if (!tp_head) {
                 RCU_INIT_POINTER(*miniqp->p_miniq, NULL);
+                /* Wait for flying RCU callback before it is freed. */
+                rcu_barrier_bh();
                 return;
         }
 
@@ -1052,7 +1073,7 @@ void mini_qdisc_pair_swap(struct mini_Qdisc_pair *miniqp,
         rcu_assign_pointer(*miniqp->p_miniq, miniq);
 
         if (miniq_old)
-                /* This is counterpart of the rcu barrier above. We need to
+                /* This is counterpart of the rcu barriers above. We need to
                  * block potential new user of miniq_old until all readers
                  * are not seeing it.
                  */
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index 17c7130454bd..bc30f9186ac6 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -356,6 +356,9 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp,
         struct gred_sched *table = qdisc_priv(sch);
         struct gred_sched_data *q = table->tab[dp];
 
+        if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
+                return -EINVAL;
+
         if (!q) {
                 table->tab[dp] = q = *prealloc;
                 *prealloc = NULL;
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index 5ecc38f35d47..003e1b063447 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -66,7 +66,8 @@ static int ingress_init(struct Qdisc *sch, struct nlattr *opt)
 {
         struct ingress_sched_data *q = qdisc_priv(sch);
         struct net_device *dev = qdisc_dev(sch);
-        int err;
+
+        net_inc_ingress_queue();
 
         mini_qdisc_pair_init(&q->miniqp, sch, &dev->miniq_ingress);
 
@@ -74,14 +75,7 @@ static int ingress_init(struct Qdisc *sch, struct nlattr *opt)
         q->block_info.chain_head_change = clsact_chain_head_change;
         q->block_info.chain_head_change_priv = &q->miniqp;
 
-        err = tcf_block_get_ext(&q->block, sch, &q->block_info);
-        if (err)
-                return err;
-
-        net_inc_ingress_queue();
-        sch->flags |= TCQ_F_CPUSTATS;
-
-        return 0;
+        return tcf_block_get_ext(&q->block, sch, &q->block_info);
 }
 
 static void ingress_destroy(struct Qdisc *sch)
@@ -120,6 +114,7 @@ static struct Qdisc_ops ingress_qdisc_ops __read_mostly = {
         .cl_ops         =       &ingress_class_ops,
         .id             =       "ingress",
         .priv_size      =       sizeof(struct ingress_sched_data),
+        .static_flags   =       TCQ_F_CPUSTATS,
         .init           =       ingress_init,
         .destroy        =       ingress_destroy,
         .dump           =       ingress_dump,
@@ -172,6 +167,9 @@ static int clsact_init(struct Qdisc *sch, struct nlattr *opt)
         struct net_device *dev = qdisc_dev(sch);
         int err;
 
+        net_inc_ingress_queue();
+        net_inc_egress_queue();
+
         mini_qdisc_pair_init(&q->miniqp_ingress, sch, &dev->miniq_ingress);
 
         q->ingress_block_info.binder_type = TCF_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
@@ -188,20 +186,7 @@ static int clsact_init(struct Qdisc *sch, struct nlattr *opt)
         q->egress_block_info.chain_head_change = clsact_chain_head_change;
         q->egress_block_info.chain_head_change_priv = &q->miniqp_egress;
 
-        err = tcf_block_get_ext(&q->egress_block, sch, &q->egress_block_info);
-        if (err)
-                goto err_egress_block_get;
-
-        net_inc_ingress_queue();
-        net_inc_egress_queue();
-
-        sch->flags |= TCQ_F_CPUSTATS;
-
-        return 0;
-
-err_egress_block_get:
-        tcf_block_put_ext(q->ingress_block, sch, &q->ingress_block_info);
-        return err;
+        return tcf_block_get_ext(&q->egress_block, sch, &q->egress_block_info);
 }
 
 static void clsact_destroy(struct Qdisc *sch)
@@ -228,6 +213,7 @@ static struct Qdisc_ops clsact_qdisc_ops __read_mostly = {
         .cl_ops         =       &clsact_class_ops,
         .id             =       "clsact",
         .priv_size      =       sizeof(struct clsact_sched_data),
+        .static_flags   =       TCQ_F_CPUSTATS,
         .init           =       clsact_init,
         .destroy        =       clsact_destroy,
         .dump           =       ingress_dump,
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 7f8ea9e297c3..f0747eb87dc4 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -157,6 +157,7 @@ static int red_offload(struct Qdisc *sch, bool enable)
                 .handle = sch->handle,
                 .parent = sch->parent,
         };
+        int err;
 
         if (!tc_can_offload(dev) || !dev->netdev_ops->ndo_setup_tc)
                 return -EOPNOTSUPP;
@@ -171,7 +172,14 @@ static int red_offload(struct Qdisc *sch, bool enable)
                 opt.command = TC_RED_DESTROY;
         }
 
-        return dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_QDISC_RED, &opt);
+        err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_QDISC_RED, &opt);
+
+        if (!err && enable)
+                sch->flags |= TCQ_F_OFFLOADED;
+        else
+                sch->flags &= ~TCQ_F_OFFLOADED;
+
+        return err;
 }
 
 static void red_destroy(struct Qdisc *sch)
@@ -212,6 +220,8 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt)
         max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0;
 
         ctl = nla_data(tb[TCA_RED_PARMS]);
+        if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
+                return -EINVAL;
 
         if (ctl->limit > 0) {
                 child = fifo_create_dflt(sch, &bfifo_qdisc_ops, ctl->limit);
@@ -272,7 +282,7 @@ static int red_init(struct Qdisc *sch, struct nlattr *opt)
         return red_change(sch, opt);
 }
 
-static int red_dump_offload(struct Qdisc *sch, struct tc_red_qopt *opt)
+static int red_dump_offload_stats(struct Qdisc *sch, struct tc_red_qopt *opt)
 {
         struct net_device *dev = qdisc_dev(sch);
         struct tc_red_qopt_offload hw_stats = {
@@ -284,21 +294,12 @@ static int red_dump_offload(struct Qdisc *sch, struct tc_red_qopt *opt)
                         .stats.qstats = &sch->qstats,
                 },
         };
-        int err;
 
-        opt->flags &= ~TC_RED_OFFLOADED;
-        if (!tc_can_offload(dev) || !dev->netdev_ops->ndo_setup_tc)
-                return 0;
-
-        err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_QDISC_RED,
-                                            &hw_stats);
-        if (err == -EOPNOTSUPP)
+        if (!(sch->flags & TCQ_F_OFFLOADED))
                 return 0;
 
-        if (!err)
-                opt->flags |= TC_RED_OFFLOADED;
-
-        return err;
+        return dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_QDISC_RED,
+                                             &hw_stats);
 }
 
 static int red_dump(struct Qdisc *sch, struct sk_buff *skb)
@@ -317,7 +318,7 @@ static int red_dump(struct Qdisc *sch, struct sk_buff *skb)
         int err;
 
         sch->qstats.backlog = q->qdisc->qstats.backlog;
-        err = red_dump_offload(sch, &opt);
+        err = red_dump_offload_stats(sch, &opt);
         if (err)
                 goto nla_put_failure;
 
@@ -345,7 +346,7 @@ static int red_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
                 .marked = q->stats.prob_mark + q->stats.forced_mark,
         };
 
-        if (tc_can_offload(dev) &&  dev->netdev_ops->ndo_setup_tc) {
+        if (sch->flags & TCQ_F_OFFLOADED) {
                 struct red_stats hw_stats = {0};
                 struct tc_red_qopt_offload hw_stats_request = {
                         .command = TC_RED_XSTATS,
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 09c1203c1711..930e5bd26d3d 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -639,6 +639,9 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
         if (ctl->divisor &&
             (!is_power_of_2(ctl->divisor) || ctl->divisor > 65536))
                 return -EINVAL;
+        if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,
+                                        ctl_v1->Wlog))
+                return -EINVAL;
         if (ctl_v1 && ctl_v1->qth_min) {
                 p = kmalloc(sizeof(*p), GFP_KERNEL);
                 if (!p)
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 7b261afc47b9..7f8baa48e7c2 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -53,6 +53,7 @@ static void sctp_datamsg_init(struct sctp_datamsg *msg)
         msg->send_failed = 0;
         msg->send_error = 0;
         msg->can_delay = 1;
+        msg->abandoned = 0;
         msg->expires_at = 0;
         INIT_LIST_HEAD(&msg->chunks);
 }
@@ -304,6 +305,13 @@ int sctp_chunk_abandoned(struct sctp_chunk *chunk)
         if (!chunk->asoc->peer.prsctp_capable)
                 return 0;
 
+        if (chunk->msg->abandoned)
+                return 1;
+
+        if (!chunk->has_tsn &&
+            !(chunk->chunk_hdr->flags & SCTP_DATA_FIRST_FRAG))
+                return 0;
+
         if (SCTP_PR_TTL_ENABLED(chunk->sinfo.sinfo_flags) &&
             time_after(jiffies, chunk->msg->expires_at)) {
                 struct sctp_stream_out *streamout =
@@ -316,6 +324,7 @@ int sctp_chunk_abandoned(struct sctp_chunk *chunk)
                         chunk->asoc->abandoned_unsent[SCTP_PR_INDEX(TTL)]++;
                         streamout->ext->abandoned_unsent[SCTP_PR_INDEX(TTL)]++;
                 }
+                chunk->msg->abandoned = 1;
                 return 1;
         } else if (SCTP_PR_RTX_ENABLED(chunk->sinfo.sinfo_flags) &&
                    chunk->sent_count > chunk->sinfo.sinfo_timetolive) {
@@ -324,10 +333,12 @@ int sctp_chunk_abandoned(struct sctp_chunk *chunk)
 
                 chunk->asoc->abandoned_sent[SCTP_PR_INDEX(RTX)]++;
                 streamout->ext->abandoned_sent[SCTP_PR_INDEX(RTX)]++;
+                chunk->msg->abandoned = 1;
                 return 1;
         } else if (!SCTP_PR_POLICY(chunk->sinfo.sinfo_flags) &&
                    chunk->msg->expires_at &&
                    time_after(jiffies, chunk->msg->expires_at)) {
+                chunk->msg->abandoned = 1;
                 return 1;
         }
         /* PRIO policy is processed by sendmsg, not here */
diff --git a/net/sctp/debug.c b/net/sctp/debug.c
index 3f619fdcbf0a..291c97b07058 100644
--- a/net/sctp/debug.c
+++ b/net/sctp/debug.c
@@ -78,6 +78,9 @@ const char *sctp_cname(const union sctp_subtype cid)
         case SCTP_CID_AUTH:
                 return "AUTH";
 
+        case SCTP_CID_RECONF:
+                return "RECONF";
+
         default:
                 break;
         }
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 621b5ca3fd1c..141c9c466ec1 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -399,20 +399,24 @@ void sctp_icmp_frag_needed(struct sock *sk, struct sctp_association *asoc,
                 return;
         }
 
-        if (t->param_flags & SPP_PMTUD_ENABLE) {
-                /* Update transports view of the MTU */
-                sctp_transport_update_pmtu(t, pmtu);
-
-                /* Update association pmtu. */
-                sctp_assoc_sync_pmtu(asoc);
-        }
+        if (!(t->param_flags & SPP_PMTUD_ENABLE))
+                /* We can't allow retransmitting in such case, as the
+                 * retransmission would be sized just as before, and thus we
+                 * would get another icmp, and retransmit again.
+                 */
+                return;
 
-        /* Retransmit with the new pmtu setting.
-         * Normally, if PMTU discovery is disabled, an ICMP Fragmentation
-         * Needed will never be sent, but if a message was sent before
-         * PMTU discovery was disabled that was larger than the PMTU, it
-         * would not be fragmented, so it must be re-transmitted fragmented.
+        /* Update transports view of the MTU. Return if no update was needed.
+         * If an update wasn't needed/possible, it also doesn't make sense to
+         * try to retransmit now.
          */
+        if (!sctp_transport_update_pmtu(t, pmtu))
+                return;
+
+        /* Update association pmtu. */
+        sctp_assoc_sync_pmtu(asoc);
+
+        /* Retransmit with the new pmtu setting. */
         sctp_retransmit(&asoc->outqueue, t, SCTP_RTXR_PMTUD);
 }
 
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 3b18085e3b10..5d4c15bf66d2 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -826,6 +826,7 @@ static int sctp_inet6_af_supported(sa_family_t family, struct sctp_sock *sp)
         case AF_INET:
                 if (!__ipv6_only_sock(sctp_opt2sk(sp)))
                         return 1;
+                /* fallthru */
         default:
                 return 0;
         }
diff --git a/net/sctp/offload.c b/net/sctp/offload.c
index 275925b93b29..35bc7106d182 100644
--- a/net/sctp/offload.c
+++ b/net/sctp/offload.c
@@ -45,6 +45,9 @@ static struct sk_buff *sctp_gso_segment(struct sk_buff *skb,
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         struct sctphdr *sh;
 
+        if (!(skb_shinfo(skb)->gso_type & SKB_GSO_SCTP))
+                goto out;
+
         sh = sctp_hdr(skb);
         if (!pskb_may_pull(skb, sizeof(*sh)))
                 goto out;
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 4db012aa25f7..c4ec99b20150 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -364,10 +364,12 @@ static int sctp_prsctp_prune_sent(struct sctp_association *asoc,
         list_for_each_entry_safe(chk, temp, queue, transmitted_list) {
                 struct sctp_stream_out *streamout;
 
-                if (!SCTP_PR_PRIO_ENABLED(chk->sinfo.sinfo_flags) ||
-                    chk->sinfo.sinfo_timetolive <= sinfo->sinfo_timetolive)
+                if (!chk->msg->abandoned &&
+                    (!SCTP_PR_PRIO_ENABLED(chk->sinfo.sinfo_flags) ||
+                     chk->sinfo.sinfo_timetolive <= sinfo->sinfo_timetolive))
                         continue;
 
+                chk->msg->abandoned = 1;
                 list_del_init(&chk->transmitted_list);
                 sctp_insert_list(&asoc->outqueue.abandoned,
                                  &chk->transmitted_list);
@@ -377,7 +379,8 @@ static int sctp_prsctp_prune_sent(struct sctp_association *asoc,
                 asoc->abandoned_sent[SCTP_PR_INDEX(PRIO)]++;
                 streamout->ext->abandoned_sent[SCTP_PR_INDEX(PRIO)]++;
 
-                if (!chk->tsn_gap_acked) {
+                if (queue != &asoc->outqueue.retransmit &&
+                    !chk->tsn_gap_acked) {
                         if (chk->transport)
                                 chk->transport->flight_size -=
                                                 sctp_data_size(chk);
@@ -403,10 +406,13 @@ static int sctp_prsctp_prune_unsent(struct sctp_association *asoc,
         q->sched->unsched_all(&asoc->stream);
 
         list_for_each_entry_safe(chk, temp, &q->out_chunk_list, list) {
-                if (!SCTP_PR_PRIO_ENABLED(chk->sinfo.sinfo_flags) ||
-                    chk->sinfo.sinfo_timetolive <= sinfo->sinfo_timetolive)
+                if (!chk->msg->abandoned &&
+                    (!(chk->chunk_hdr->flags & SCTP_DATA_FIRST_FRAG) ||
+                     !SCTP_PR_PRIO_ENABLED(chk->sinfo.sinfo_flags) ||
+                     chk->sinfo.sinfo_timetolive <= sinfo->sinfo_timetolive))
                         continue;
 
+                chk->msg->abandoned = 1;
                 sctp_sched_dequeue_common(q, chk);
                 asoc->sent_cnt_removable--;
                 asoc->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++;
@@ -912,9 +918,9 @@ static void sctp_outq_flush(struct sctp_outq *q, int rtx_timeout, gfp_t gfp)
                         break;
 
                 case SCTP_CID_ABORT:
-                        if (sctp_test_T_bit(chunk)) {
+                        if (sctp_test_T_bit(chunk))
                                 packet->vtag = asoc->c.my_vtag;
-                        }
+                        /* fallthru */
                 /* The following chunks are "response" chunks, i.e.
                  * they are generated in response to something we
                  * received.  If we are sending these, then we can
@@ -1434,7 +1440,8 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                         /* If this chunk has not been acked, stop
                          * considering it as 'outstanding'.
                          */
-                        if (!tchunk->tsn_gap_acked) {
+                        if (transmitted_queue != &q->retransmit &&
+                            !tchunk->tsn_gap_acked) {
                                 if (tchunk->transport)
                                         tchunk->transport->flight_size -=
                                                         sctp_data_size(tchunk);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 014847e25648..039fcb618c34 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -85,7 +85,7 @@
 static int sctp_writeable(struct sock *sk);
 static void sctp_wfree(struct sk_buff *skb);
 static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
-                                size_t msg_len, struct sock **orig_sk);
+                                size_t msg_len);
 static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);
 static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
 static int sctp_wait_for_accept(struct sock *sk, long timeo);
@@ -335,16 +335,14 @@ static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
         if (len < sizeof (struct sockaddr))
                 return NULL;
 
+        if (!opt->pf->af_supported(addr->sa.sa_family, opt))
+                return NULL;
+
         /* V4 mapped address are really of AF_INET family */
         if (addr->sa.sa_family == AF_INET6 &&
-            ipv6_addr_v4mapped(&addr->v6.sin6_addr)) {
-                if (!opt->pf->af_supported(AF_INET, opt))
-                        return NULL;
-        } else {
-                /* Does this PF support this AF? */
-                if (!opt->pf->af_supported(addr->sa.sa_family, opt))
-                        return NULL;
-        }
+            ipv6_addr_v4mapped(&addr->v6.sin6_addr) &&
+            !opt->pf->af_supported(AF_INET, opt))
+                return NULL;
 
         /* If we get this far, af is valid. */
         af = sctp_get_af_specific(addr->sa.sa_family);
@@ -1883,8 +1881,14 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
                  */
                 if (sinit) {
                         if (sinit->sinit_num_ostreams) {
-                                asoc->c.sinit_num_ostreams =
-                                        sinit->sinit_num_ostreams;
+                                __u16 outcnt = sinit->sinit_num_ostreams;
+
+                                asoc->c.sinit_num_ostreams = outcnt;
+                                /* outcnt has been changed, so re-init stream */
+                                err = sctp_stream_init(&asoc->stream, outcnt, 0,
+                                                       GFP_KERNEL);
+                                if (err)
+                                        goto out_free;
                         }
                         if (sinit->sinit_max_instreams) {
                                 asoc->c.sinit_max_instreams =
@@ -1971,7 +1975,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
         timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
         if (!sctp_wspace(asoc)) {
                 /* sk can be changed by peel off when waiting for buf. */
-                err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len, &sk);
+                err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);
                 if (err) {
                         if (err == -ESRCH) {
                                 /* asoc is already dead. */
@@ -2277,7 +2281,7 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
 
                 if (asoc && sctp_outq_is_empty(&asoc->outqueue)) {
                         event = sctp_ulpevent_make_sender_dry_event(asoc,
-                                        GFP_ATOMIC);
+                                        GFP_USER | __GFP_NOWARN);
                         if (!event)
                                 return -ENOMEM;
 
@@ -3498,6 +3502,8 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
 
         if (optlen < sizeof(struct sctp_hmacalgo))
                 return -EINVAL;
+        optlen = min_t(unsigned int, optlen, sizeof(struct sctp_hmacalgo) +
+                                             SCTP_AUTH_NUM_HMACS * sizeof(u16));
 
         hmacs = memdup_user(optval, optlen);
         if (IS_ERR(hmacs))
@@ -3536,6 +3542,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
 
         if (optlen <= sizeof(struct sctp_authkey))
                 return -EINVAL;
+        /* authkey->sca_keylength is u16, so optlen can't be bigger than
+         * this.
+         */
+        optlen = min_t(unsigned int, optlen, USHRT_MAX +
+                                             sizeof(struct sctp_authkey));
 
         authkey = memdup_user(optval, optlen);
         if (IS_ERR(authkey))
@@ -3891,13 +3902,20 @@ static int sctp_setsockopt_reset_streams(struct sock *sk,
         struct sctp_association *asoc;
         int retval = -EINVAL;
 
-        if (optlen < sizeof(struct sctp_reset_streams))
+        if (optlen < sizeof(*params))
                 return -EINVAL;
+        /* srs_number_streams is u16, so optlen can't be bigger than this. */
+        optlen = min_t(unsigned int, optlen, USHRT_MAX +
+                                             sizeof(__u16) * sizeof(*params));
 
         params = memdup_user(optval, optlen);
         if (IS_ERR(params))
                 return PTR_ERR(params);
 
+        if (params->srs_number_streams * sizeof(__u16) >
+            optlen - sizeof(*params))
+                goto out;
+
         asoc = sctp_id2assoc(sk, params->srs_assoc_id);
         if (!asoc)
                 goto out;
@@ -4494,7 +4512,7 @@ static int sctp_init_sock(struct sock *sk)
         SCTP_DBG_OBJCNT_INC(sock);
 
         local_bh_disable();
-        percpu_counter_inc(&sctp_sockets_allocated);
+        sk_sockets_allocated_inc(sk);
         sock_prot_inuse_add(net, sk->sk_prot, 1);
 
         /* Nothing can fail after this block, otherwise
@@ -4538,7 +4556,7 @@ static void sctp_destroy_sock(struct sock *sk)
         }
         sctp_endpoint_free(sp->ep);
         local_bh_disable();
-        percpu_counter_dec(&sctp_sockets_allocated);
+        sk_sockets_allocated_dec(sk);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
         local_bh_enable();
 }
@@ -5011,7 +5029,7 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
         len = sizeof(int);
         if (put_user(len, optlen))
                 return -EFAULT;
-        if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int)))
+        if (copy_to_user(optval, &sctp_sk(sk)->autoclose, len))
                 return -EFAULT;
         return 0;
 }
@@ -5080,7 +5098,6 @@ static int sctp_getsockopt_peeloff_common(struct sock *sk, sctp_peeloff_arg_t *p
         *newfile = sock_alloc_file(newsock, 0, NULL);
         if (IS_ERR(*newfile)) {
                 put_unused_fd(retval);
-                sock_release(newsock);
                 retval = PTR_ERR(*newfile);
                 *newfile = NULL;
                 return retval;
@@ -5642,6 +5659,9 @@ copy_getaddrs:
                 err = -EFAULT;
                 goto out;
         }
+        /* XXX: We should have accounted for sizeof(struct sctp_getaddrs) too,
+         * but we can't change it anymore.
+         */
         if (put_user(bytes_copied, optlen))
                 err = -EFAULT;
 out:
@@ -6078,7 +6098,7 @@ static int sctp_getsockopt_maxseg(struct sock *sk, int len,
                 params.assoc_id = 0;
         } else if (len >= sizeof(struct sctp_assoc_value)) {
                 len = sizeof(struct sctp_assoc_value);
-                if (copy_from_user(&params, optval, sizeof(params)))
+                if (copy_from_user(&params, optval, len))
                         return -EFAULT;
         } else
                 return -EINVAL;
@@ -6248,7 +6268,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
 
         if (len < sizeof(struct sctp_authkeyid))
                 return -EINVAL;
-        if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
+
+        len = sizeof(struct sctp_authkeyid);
+        if (copy_from_user(&val, optval, len))
                 return -EFAULT;
 
         asoc = sctp_id2assoc(sk, val.scact_assoc_id);
@@ -6260,7 +6282,6 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
         else
                 val.scact_keynumber = ep->active_key_id;
 
-        len = sizeof(struct sctp_authkeyid);
         if (put_user(len, optlen))
                 return -EFAULT;
         if (copy_to_user(optval, &val, len))
@@ -6286,7 +6307,7 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
         if (len < sizeof(struct sctp_authchunks))
                 return -EINVAL;
 
-        if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
+        if (copy_from_user(&val, optval, sizeof(val)))
                 return -EFAULT;
 
         to = p->gauth_chunks;
@@ -6331,7 +6352,7 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
         if (len < sizeof(struct sctp_authchunks))
                 return -EINVAL;
 
-        if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
+        if (copy_from_user(&val, optval, sizeof(val)))
                 return -EFAULT;
 
         to = p->gauth_chunks;
@@ -7999,12 +8020,12 @@ void sctp_sock_rfree(struct sk_buff *skb)
 
 /* Helper function to wait for space in the sndbuf.  */
 static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
-                                size_t msg_len, struct sock **orig_sk)
+                                size_t msg_len)
 {
         struct sock *sk = asoc->base.sk;
-        int err = 0;
         long current_timeo = *timeo_p;
         DEFINE_WAIT(wait);
+        int err = 0;
 
         pr_debug("%s: asoc:%p, timeo:%ld, msg_len:%zu\n", __func__, asoc,
                  *timeo_p, msg_len);
@@ -8033,17 +8054,13 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
                 release_sock(sk);
                 current_timeo = schedule_timeout(current_timeo);
                 lock_sock(sk);
-                if (sk != asoc->base.sk) {
-                        release_sock(sk);
-                        sk = asoc->base.sk;
-                        lock_sock(sk);
-                }
+                if (sk != asoc->base.sk)
+                        goto do_error;
 
                 *timeo_p = current_timeo;
         }
 
 out:
-        *orig_sk = sk;
         finish_wait(&asoc->wait, &wait);
 
         /* Release the association's refcnt.  */
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 76ea66be0bbe..524dfeb94c41 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -156,9 +156,9 @@ int sctp_stream_init(struct sctp_stream *stream, __u16 outcnt, __u16 incnt,
         sctp_stream_outq_migrate(stream, NULL, outcnt);
         sched->sched_all(stream);
 
-        i = sctp_stream_alloc_out(stream, outcnt, gfp);
-        if (i)
-                return i;
+        ret = sctp_stream_alloc_out(stream, outcnt, gfp);
+        if (ret)
+                goto out;
 
         stream->outcnt = outcnt;
         for (i = 0; i < stream->outcnt; i++)
@@ -170,19 +170,17 @@ in:
         if (!incnt)
                 goto out;
 
-        i = sctp_stream_alloc_in(stream, incnt, gfp);
-        if (i) {
-                ret = -ENOMEM;
-                goto free;
+        ret = sctp_stream_alloc_in(stream, incnt, gfp);
+        if (ret) {
+                sched->free(stream);
+                kfree(stream->out);
+                stream->out = NULL;
+                stream->outcnt = 0;
+                goto out;
         }
 
         stream->incnt = incnt;
-        goto out;
 
-free:
-        sched->free(stream);
-        kfree(stream->out);
-        stream->out = NULL;
 out:
         return ret;
 }
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 1e5a22430cf5..47f82bd794d9 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -248,28 +248,37 @@ void sctp_transport_pmtu(struct sctp_transport *transport, struct sock *sk)
                 transport->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
 }
 
-void sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu)
+bool sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu)
 {
         struct dst_entry *dst = sctp_transport_dst_check(t);
+        bool change = true;
 
         if (unlikely(pmtu < SCTP_DEFAULT_MINSEGMENT)) {
-                pr_warn("%s: Reported pmtu %d too low, using default minimum of %d\n",
-                        __func__, pmtu, SCTP_DEFAULT_MINSEGMENT);
-                /* Use default minimum segment size and disable
-                 * pmtu discovery on this transport.
-                 */
-                t->pathmtu = SCTP_DEFAULT_MINSEGMENT;
-        } else {
-                t->pathmtu = pmtu;
+                pr_warn_ratelimited("%s: Reported pmtu %d too low, using default minimum of %d\n",
+                                    __func__, pmtu, SCTP_DEFAULT_MINSEGMENT);
+                /* Use default minimum segment instead */
+                pmtu = SCTP_DEFAULT_MINSEGMENT;
         }
+        pmtu = SCTP_TRUNC4(pmtu);
 
         if (dst) {
                 dst->ops->update_pmtu(dst, t->asoc->base.sk, NULL, pmtu);
                 dst = sctp_transport_dst_check(t);
         }
 
-        if (!dst)
+        if (!dst) {
                 t->af_specific->get_dst(t, &t->saddr, &t->fl, t->asoc->base.sk);
+                dst = t->dst;
+        }
+
+        if (dst) {
+                /* Re-fetch, as under layers may have a higher minimum size */
+                pmtu = SCTP_TRUNC4(dst_mtu(dst));
+                change = t->pathmtu != pmtu;
+        }
+        t->pathmtu = pmtu;
+
+        return change;
 }
 
 /* Caches the dst entry and source address for a transport's destination
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index a71be33f3afe..e36ec5dd64c6 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -1084,29 +1084,21 @@ void sctp_ulpq_partial_delivery(struct sctp_ulpq *ulpq,
 void sctp_ulpq_renege(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
                       gfp_t gfp)
 {
-        struct sctp_association *asoc;
-        __u16 needed, freed;
-
-        asoc = ulpq->asoc;
+        struct sctp_association *asoc = ulpq->asoc;
+        __u32 freed = 0;
+        __u16 needed;
 
-        if (chunk) {
-                needed = ntohs(chunk->chunk_hdr->length);
-                needed -= sizeof(struct sctp_data_chunk);
-        } else
-                needed = SCTP_DEFAULT_MAXWINDOW;
-
-        freed = 0;
+        needed = ntohs(chunk->chunk_hdr->length) -
+                 sizeof(struct sctp_data_chunk);
 
         if (skb_queue_empty(&asoc->base.sk->sk_receive_queue)) {
                 freed = sctp_ulpq_renege_order(ulpq, needed);
-                if (freed < needed) {
+                if (freed < needed)
                         freed += sctp_ulpq_renege_frags(ulpq, needed - freed);
-                }
         }
         /* If able to free enough room, accept this chunk. */
-        if (chunk && (freed >= needed)) {
-                int retval;
-                retval = sctp_ulpq_tail_data(ulpq, chunk, gfp);
+        if (freed >= needed) {
+                int retval = sctp_ulpq_tail_data(ulpq, chunk, gfp);
                 /*
                  * Enter partial delivery if chunk has not been
                  * delivered; otherwise, drain the reassembly queue.
diff --git a/net/socket.c b/net/socket.c
index 42d8e9c9ccd5..6f05d5c4bf30 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -406,8 +406,10 @@ struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
                 name.len = strlen(name.name);
         }
         path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
-        if (unlikely(!path.dentry))
+        if (unlikely(!path.dentry)) {
+                sock_release(sock);
                 return ERR_PTR(-ENOMEM);
+        }
         path.mnt = mntget(sock_mnt);
 
         d_instantiate(path.dentry, SOCK_INODE(sock));
@@ -415,9 +417,11 @@ struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
         file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
                   &socket_file_ops);
         if (IS_ERR(file)) {
-                /* drop dentry, keep inode */
+                /* drop dentry, keep inode for a bit */
                 ihold(d_inode(path.dentry));
                 path_put(&path);
+                /* ... and now kill it properly */
+                sock_release(sock);
                 return file;
         }
 
@@ -432,8 +436,10 @@ static int sock_map_fd(struct socket *sock, int flags)
 {
         struct file *newfile;
         int fd = get_unused_fd_flags(flags);
-        if (unlikely(fd < 0))
+        if (unlikely(fd < 0)) {
+                sock_release(sock);
                 return fd;
+        }
 
         newfile = sock_alloc_file(sock, flags, NULL);
         if (likely(!IS_ERR(newfile))) {
@@ -1330,19 +1336,9 @@ SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
 
         retval = sock_create(family, type, protocol, &sock);
         if (retval < 0)
-                goto out;
-
-        retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
-        if (retval < 0)
-                goto out_release;
-
-out:
-        /* It may be already another descriptor 8) Not kernel problem. */
-        return retval;
+                return retval;
 
-out_release:
-        sock_release(sock);
-        return retval;
+        return sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
 }
 
 /*
@@ -1366,87 +1362,72 @@ SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
                 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
 
         /*
+         * reserve descriptors and make sure we won't fail
+         * to return them to userland.
+         */
+        fd1 = get_unused_fd_flags(flags);
+        if (unlikely(fd1 < 0))
+                return fd1;
+
+        fd2 = get_unused_fd_flags(flags);
+        if (unlikely(fd2 < 0)) {
+                put_unused_fd(fd1);
+                return fd2;
+        }
+
+        err = put_user(fd1, &usockvec[0]);
+        if (err)
+                goto out;
+
+        err = put_user(fd2, &usockvec[1]);
+        if (err)
+                goto out;
+
+        /*
          * Obtain the first socket and check if the underlying protocol
          * supports the socketpair call.
          */
 
         err = sock_create(family, type, protocol, &sock1);
-        if (err < 0)
+        if (unlikely(err < 0))
                 goto out;
 
         err = sock_create(family, type, protocol, &sock2);
-        if (err < 0)
-                goto out_release_1;
-
-        err = sock1->ops->socketpair(sock1, sock2);
-        if (err < 0)
-                goto out_release_both;
-
-        fd1 = get_unused_fd_flags(flags);
-        if (unlikely(fd1 < 0)) {
-                err = fd1;
-                goto out_release_both;
+        if (unlikely(err < 0)) {
+                sock_release(sock1);
+                goto out;
         }
 
-        fd2 = get_unused_fd_flags(flags);
-        if (unlikely(fd2 < 0)) {
-                err = fd2;
-                goto out_put_unused_1;
+        err = sock1->ops->socketpair(sock1, sock2);
+        if (unlikely(err < 0)) {
+                sock_release(sock2);
+                sock_release(sock1);
+                goto out;
         }
 
         newfile1 = sock_alloc_file(sock1, flags, NULL);
         if (IS_ERR(newfile1)) {
                 err = PTR_ERR(newfile1);
-                goto out_put_unused_both;
+                sock_release(sock2);
+                goto out;
         }
 
         newfile2 = sock_alloc_file(sock2, flags, NULL);
         if (IS_ERR(newfile2)) {
                 err = PTR_ERR(newfile2);
-                goto out_fput_1;
+                fput(newfile1);
+                goto out;
         }
 
-        err = put_user(fd1, &usockvec[0]);
-        if (err)
-                goto out_fput_both;
-
-        err = put_user(fd2, &usockvec[1]);
-        if (err)
-                goto out_fput_both;
-
         audit_fd_pair(fd1, fd2);
 
         fd_install(fd1, newfile1);
         fd_install(fd2, newfile2);
-        /* fd1 and fd2 may be already another descriptors.
-         * Not kernel problem.
-         */
-
         return 0;
 
-out_fput_both:
-        fput(newfile2);
-        fput(newfile1);
-        put_unused_fd(fd2);
-        put_unused_fd(fd1);
-        goto out;
-
-out_fput_1:
-        fput(newfile1);
-        put_unused_fd(fd2);
-        put_unused_fd(fd1);
-        sock_release(sock2);
-        goto out;
-
-out_put_unused_both:
+out:
         put_unused_fd(fd2);
-out_put_unused_1:
         put_unused_fd(fd1);
-out_release_both:
-        sock_release(sock2);
-out_release_1:
-        sock_release(sock1);
-out:
         return err;
 }
 
@@ -1562,7 +1543,6 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
         if (IS_ERR(newfile)) {
                 err = PTR_ERR(newfile);
                 put_unused_fd(newfd);
-                sock_release(newsock);
                 goto out_put;
         }
 
@@ -2641,6 +2621,15 @@ out_fs:
 
 core_initcall(sock_init);       /* early initcall */
 
+static int __init jit_init(void)
+{
+#ifdef CONFIG_BPF_JIT_ALWAYS_ON
+        bpf_jit_enable = 1;
+#endif
+        return 0;
+}
+pure_initcall(jit_init);
+
 #ifdef CONFIG_PROC_FS
 void socket_seq_show(struct seq_file *seq)
 {
diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
index c5fda15ba319..1fdab5c4eda8 100644
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -401,7 +401,7 @@ void strp_data_ready(struct strparser *strp)
          * allows a thread in BH context to safely check if the process
          * lock is held. In this case, if the lock is held, queue work.
          */
-        if (sock_owned_by_user(strp->sk)) {
+        if (sock_owned_by_user_nocheck(strp->sk)) {
                 queue_work(strp_wq, &strp->work);
                 return;
         }
diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
index c4778cae58ef..444380f968f1 100644
--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
@@ -231,6 +231,7 @@ static int gssx_dec_linux_creds(struct xdr_stream *xdr,
                         goto out_free_groups;
                 creds->cr_group_info->gid[i] = kgid;
         }
+        groups_sort(creds->cr_group_info);
 
         return 0;
 out_free_groups:
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 5dd4e6c9fef2..26531193fce4 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -481,6 +481,7 @@ static int rsc_parse(struct cache_detail *cd,
                                 goto out;
                         rsci.cred.cr_group_info->gid[i] = kgid;
                 }
+                groups_sort(rsci.cred.cr_group_info);
 
                 /* mech name */
                 len = qword_get(&mesg, buf, mlen);
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 740b67d5a733..af7f28fb8102 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -520,6 +520,7 @@ static int unix_gid_parse(struct cache_detail *cd,
                 ug.gi->gid[i] = kgid;
         }
 
+        groups_sort(ug.gi);
         ugp = unix_gid_lookup(cd, uid);
         if (ugp) {
                 struct cache_head *ch;
@@ -819,6 +820,7 @@ svcauth_unix_accept(struct svc_rqst *rqstp, __be32 *authp)
                 kgid_t kgid = make_kgid(&init_user_ns, svc_getnl(argv));
                 cred->cr_group_info->gid[i] = kgid;
         }
+        groups_sort(cred->cr_group_info);
         if (svc_getu32(argv) != htonl(RPC_AUTH_NULL) || svc_getu32(argv) != 0) {
                 *authp = rpc_autherr_badverf;
                 return SVC_DENIED;
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 333b9d697ae5..33b74fd84051 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1001,6 +1001,7 @@ void xprt_transmit(struct rpc_task *task)
 {
         struct rpc_rqst *req = task->tk_rqstp;
         struct rpc_xprt *xprt = req->rq_xprt;
+        unsigned int connect_cookie;
         int status, numreqs;
 
         dprintk("RPC: %5u xprt_transmit(%u)\n", task->tk_pid, req->rq_slen);
@@ -1024,6 +1025,7 @@ void xprt_transmit(struct rpc_task *task)
         } else if (!req->rq_bytes_sent)
                 return;
 
+        connect_cookie = xprt->connect_cookie;
         req->rq_xtime = ktime_get();
         status = xprt->ops->send_request(task);
         trace_xprt_transmit(xprt, req->rq_xid, status);
@@ -1047,20 +1049,28 @@ void xprt_transmit(struct rpc_task *task)
         xprt->stat.bklog_u += xprt->backlog.qlen;
         xprt->stat.sending_u += xprt->sending.qlen;
         xprt->stat.pending_u += xprt->pending.qlen;
+        spin_unlock_bh(&xprt->transport_lock);
 
-        /* Don't race with disconnect */
-        if (!xprt_connected(xprt))
-                task->tk_status = -ENOTCONN;
-        else {
+        req->rq_connect_cookie = connect_cookie;
+        if (rpc_reply_expected(task) && !READ_ONCE(req->rq_reply_bytes_recvd)) {
                 /*
-                 * Sleep on the pending queue since
-                 * we're expecting a reply.
+                 * Sleep on the pending queue if we're expecting a reply.
+                 * The spinlock ensures atomicity between the test of
+                 * req->rq_reply_bytes_recvd, and the call to rpc_sleep_on().
                  */
-                if (!req->rq_reply_bytes_recvd && rpc_reply_expected(task))
+                spin_lock(&xprt->recv_lock);
+                if (!req->rq_reply_bytes_recvd) {
                         rpc_sleep_on(&xprt->pending, task, xprt_timer);
-                req->rq_connect_cookie = xprt->connect_cookie;
+                        /*
+                         * Send an extra queue wakeup call if the
+                         * connection was dropped in case the call to
+                         * rpc_sleep_on() raced.
+                         */
+                        if (!xprt_connected(xprt))
+                                xprt_wake_pending_tasks(xprt, -ENOTCONN);
+                }
+                spin_unlock(&xprt->recv_lock);
         }
-        spin_unlock_bh(&xprt->transport_lock);
 }
 
 static void xprt_add_backlog(struct rpc_xprt *xprt, struct rpc_task *task)
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index ed34dc0f144c..a3f2ab283aeb 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -1408,11 +1408,7 @@ void rpcrdma_reply_handler(struct rpcrdma_rep *rep)
         dprintk("RPC:       %s: reply %p completes request %p (xid 0x%08x)\n",
                 __func__, rep, req, be32_to_cpu(rep->rr_xid));
 
-        if (list_empty(&req->rl_registered) &&
-            !test_bit(RPCRDMA_REQ_F_TX_RESOURCES, &req->rl_flags))
-                rpcrdma_complete_rqst(rep);
-        else
-                queue_work(rpcrdma_receive_wq, &rep->rr_work);
+        queue_work_on(req->rl_cpu, rpcrdma_receive_wq, &rep->rr_work);
         return;
 
 out_badstatus:
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 646c24494ea7..6ee1ad8978f3 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -52,6 +52,7 @@
 #include <linux/slab.h>
 #include <linux/seq_file.h>
 #include <linux/sunrpc/addr.h>
+#include <linux/smp.h>
 
 #include "xprt_rdma.h"
 
@@ -656,6 +657,7 @@ xprt_rdma_allocate(struct rpc_task *task)
                 task->tk_pid, __func__, rqst->rq_callsize,
                 rqst->rq_rcvsize, req);
 
+        req->rl_cpu = smp_processor_id();
         req->rl_connect_cookie = 0;     /* our reserved value */
         rpcrdma_set_xprtdata(rqst, req);
         rqst->rq_buffer = req->rl_sendbuf->rg_base;
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 710b3f77db82..8607c029c0dd 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -83,7 +83,7 @@ rpcrdma_alloc_wq(void)
         struct workqueue_struct *recv_wq;
 
         recv_wq = alloc_workqueue("xprtrdma_receive",
-                                  WQ_MEM_RECLAIM | WQ_UNBOUND | WQ_HIGHPRI,
+                                  WQ_MEM_RECLAIM | WQ_HIGHPRI,
                                   0);
         if (!recv_wq)
                 return -ENOMEM;
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index 51686d9eac5f..1342f743f1c4 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -342,6 +342,7 @@ enum {
 struct rpcrdma_buffer;
 struct rpcrdma_req {
         struct list_head        rl_list;
+        int                     rl_cpu;
         unsigned int            rl_connect_cookie;
         struct rpcrdma_buffer   *rl_buffer;
         struct rpcrdma_rep      *rl_reply;
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 47ec121574ce..c8001471da6c 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -324,6 +324,7 @@ restart:
         if (res) {
                 pr_warn("Bearer <%s> rejected, enable failure (%d)\n",
                         name, -res);
+                kfree(b);
                 return -EINVAL;
         }
 
@@ -347,8 +348,10 @@ restart:
         if (skb)
                 tipc_bearer_xmit_skb(net, bearer_id, skb, &b->bcast_addr);
 
-        if (tipc_mon_create(net, bearer_id))
+        if (tipc_mon_create(net, bearer_id)) {
+                bearer_disable(net, b);
                 return -ENOMEM;
+        }
 
         pr_info("Enabled bearer <%s>, discovery domain %s, priority %u\n",
                 name,
diff --git a/net/tipc/group.c b/net/tipc/group.c
index 95fec2c057d6..5f4ffae807ee 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -109,7 +109,8 @@ static void tipc_group_proto_xmit(struct tipc_group *grp, struct tipc_member *m,
 static void tipc_group_decr_active(struct tipc_group *grp,
                                    struct tipc_member *m)
 {
-        if (m->state == MBR_ACTIVE || m->state == MBR_RECLAIMING)
+        if (m->state == MBR_ACTIVE || m->state == MBR_RECLAIMING ||
+            m->state == MBR_REMITTED)
                 grp->active_cnt--;
 }
 
@@ -351,8 +352,7 @@ void tipc_group_update_member(struct tipc_member *m, int len)
         if (m->window >= ADV_IDLE)
                 return;
 
-        if (!list_empty(&m->congested))
-                return;
+        list_del_init(&m->congested);
 
         /* Sort member into congested members' list */
         list_for_each_entry_safe(_m, tmp, &grp->congested, congested) {
@@ -369,18 +369,20 @@ void tipc_group_update_bc_members(struct tipc_group *grp, int len, bool ack)
         u16 prev = grp->bc_snd_nxt - 1;
         struct tipc_member *m;
         struct rb_node *n;
+        u16 ackers = 0;
 
         for (n = rb_first(&grp->members); n; n = rb_next(n)) {
                 m = container_of(n, struct tipc_member, tree_node);
                 if (tipc_group_is_enabled(m)) {
                         tipc_group_update_member(m, len);
                         m->bc_acked = prev;
+                        ackers++;
                 }
         }
 
         /* Mark number of acknowledges to expect, if any */
         if (ack)
-                grp->bc_ackers = grp->member_cnt;
+                grp->bc_ackers = ackers;
         grp->bc_snd_nxt++;
 }
 
@@ -561,7 +563,7 @@ void tipc_group_update_rcv_win(struct tipc_group *grp, int blks, u32 node,
         int max_active = grp->max_active;
         int reclaim_limit = max_active * 3 / 4;
         int active_cnt = grp->active_cnt;
-        struct tipc_member *m, *rm;
+        struct tipc_member *m, *rm, *pm;
 
         m = tipc_group_find_member(grp, node, port);
         if (!m)
@@ -604,6 +606,17 @@ void tipc_group_update_rcv_win(struct tipc_group *grp, int blks, u32 node,
                         pr_warn_ratelimited("Rcv unexpected msg after REMIT\n");
                         tipc_group_proto_xmit(grp, m, GRP_ADV_MSG, xmitq);
                 }
+                grp->active_cnt--;
+                list_del_init(&m->list);
+                if (list_empty(&grp->pending))
+                        return;
+
+                /* Set oldest pending member to active and advertise */
+                pm = list_first_entry(&grp->pending, struct tipc_member, list);
+                pm->state = MBR_ACTIVE;
+                list_move_tail(&pm->list, &grp->active);
+                grp->active_cnt++;
+                tipc_group_proto_xmit(grp, pm, GRP_ADV_MSG, xmitq);
                 break;
         case MBR_RECLAIMING:
         case MBR_DISCOVERED:
@@ -648,6 +661,7 @@ static void tipc_group_proto_xmit(struct tipc_group *grp, struct tipc_member *m,
         } else if (mtyp == GRP_REMIT_MSG) {
                 msg_set_grp_remitted(hdr, m->window);
         }
+        msg_set_dest_droppable(hdr, true);
         __skb_queue_tail(xmitq, skb);
 }
 
@@ -689,15 +703,16 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup,
                         msg_set_grp_bc_seqno(ehdr, m->bc_syncpt);
                         __skb_queue_tail(inputq, m->event_msg);
                 }
-                if (m->window < ADV_IDLE)
-                        tipc_group_update_member(m, 0);
-                else
-                        list_del_init(&m->congested);
+                list_del_init(&m->congested);
+                tipc_group_update_member(m, 0);
                 return;
         case GRP_LEAVE_MSG:
                 if (!m)
                         return;
                 m->bc_syncpt = msg_grp_bc_syncpt(hdr);
+                list_del_init(&m->list);
+                list_del_init(&m->congested);
+                *usr_wakeup = true;
 
                 /* Wait until WITHDRAW event is received */
                 if (m->state != MBR_LEAVING) {
@@ -709,8 +724,6 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup,
                 ehdr = buf_msg(m->event_msg);
                 msg_set_grp_bc_seqno(ehdr, m->bc_syncpt);
                 __skb_queue_tail(inputq, m->event_msg);
-                *usr_wakeup = true;
-                list_del_init(&m->congested);
                 return;
         case GRP_ADV_MSG:
                 if (!m)
@@ -741,14 +754,14 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup,
                 if (!m || m->state != MBR_RECLAIMING)
                         return;
 
-                list_del_init(&m->list);
-                grp->active_cnt--;
                 remitted = msg_grp_remitted(hdr);
 
                 /* Messages preceding the REMIT still in receive queue */
                 if (m->advertised > remitted) {
                         m->state = MBR_REMITTED;
                         in_flight = m->advertised - remitted;
+                        m->advertised = ADV_IDLE + in_flight;
+                        return;
                 }
                 /* All messages preceding the REMIT have been read */
                 if (m->advertised <= remitted) {
@@ -760,6 +773,8 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup,
                         tipc_group_proto_xmit(grp, m, GRP_ADV_MSG, xmitq);
 
                 m->advertised = ADV_IDLE + in_flight;
+                grp->active_cnt--;
+                list_del_init(&m->list);
 
                 /* Set oldest pending member to active and advertise */
                 if (list_empty(&grp->pending))
@@ -849,19 +864,29 @@ void tipc_group_member_evt(struct tipc_group *grp,
                 *usr_wakeup = true;
                 m->usr_pending = false;
                 node_up = tipc_node_is_up(net, node);
-
-                /* Hold back event if more messages might be expected */
-                if (m->state != MBR_LEAVING && node_up) {
-                        m->event_msg = skb;
-                        tipc_group_decr_active(grp, m);
-                        m->state = MBR_LEAVING;
-                } else {
-                        if (node_up)
+                m->event_msg = NULL;
+
+                if (node_up) {
+                        /* Hold back event if a LEAVE msg should be expected */
+                        if (m->state != MBR_LEAVING) {
+                                m->event_msg = skb;
+                                tipc_group_decr_active(grp, m);
+                                m->state = MBR_LEAVING;
+                        } else {
                                 msg_set_grp_bc_seqno(hdr, m->bc_syncpt);
-                        else
+                                __skb_queue_tail(inputq, skb);
+                        }
+                } else {
+                        if (m->state != MBR_LEAVING) {
+                                tipc_group_decr_active(grp, m);
+                                m->state = MBR_LEAVING;
                                 msg_set_grp_bc_seqno(hdr, m->bc_rcv_nxt);
+                        } else {
+                                msg_set_grp_bc_seqno(hdr, m->bc_syncpt);
+                        }
                         __skb_queue_tail(inputq, skb);
                 }
+                list_del_init(&m->list);
                 list_del_init(&m->congested);
         }
         *sk_rcvbuf = tipc_group_rcvbuf_limit(grp);
diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
index 8e884ed06d4b..32dc33a94bc7 100644
--- a/net/tipc/monitor.c
+++ b/net/tipc/monitor.c
@@ -642,9 +642,13 @@ void tipc_mon_delete(struct net *net, int bearer_id)
 {
         struct tipc_net *tn = tipc_net(net);
         struct tipc_monitor *mon = tipc_monitor(net, bearer_id);
-        struct tipc_peer *self = get_self(net, bearer_id);
+        struct tipc_peer *self;
         struct tipc_peer *peer, *tmp;
 
+        if (!mon)
+                return;
+
+        self = get_self(net, bearer_id);
         write_lock_bh(&mon->lock);
         tn->monitors[bearer_id] = NULL;
         list_for_each_entry_safe(peer, tmp, &self->list, list) {
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 507017fe0f1b..9036d8756e73 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1880,36 +1880,38 @@ int tipc_nl_node_get_link(struct sk_buff *skb, struct genl_info *info)
 
         if (strcmp(name, tipc_bclink_name) == 0) {
                 err = tipc_nl_add_bc_link(net, &msg);
-                if (err) {
-                        nlmsg_free(msg.skb);
-                        return err;
-                }
+                if (err)
+                        goto err_free;
         } else {
                 int bearer_id;
                 struct tipc_node *node;
                 struct tipc_link *link;
 
                 node = tipc_node_find_by_name(net, name, &bearer_id);
-                if (!node)
-                        return -EINVAL;
+                if (!node) {
+                        err = -EINVAL;
+                        goto err_free;
+                }
 
                 tipc_node_read_lock(node);
                 link = node->links[bearer_id].link;
                 if (!link) {
                         tipc_node_read_unlock(node);
-                        nlmsg_free(msg.skb);
-                        return -EINVAL;
+                        err = -EINVAL;
+                        goto err_free;
                 }
 
                 err = __tipc_nl_add_link(net, &msg, link, 0);
                 tipc_node_read_unlock(node);
-                if (err) {
-                        nlmsg_free(msg.skb);
-                        return err;
-                }
+                if (err)
+                        goto err_free;
         }
 
         return genlmsg_reply(msg.skb, info);
+
+err_free:
+        nlmsg_free(msg.skb);
+        return err;
 }
 
 int tipc_nl_node_reset_link_stats(struct sk_buff *skb, struct genl_info *info)
diff --git a/net/tipc/server.c b/net/tipc/server.c
index acaef80fb88c..d60c30342327 100644
--- a/net/tipc/server.c
+++ b/net/tipc/server.c
@@ -314,6 +314,7 @@ static int tipc_accept_from_sock(struct tipc_conn *con)
         newcon->usr_data = s->tipc_conn_new(newcon->conid);
         if (!newcon->usr_data) {
                 sock_release(newsock);
+                conn_put(newcon);
                 return -ENOMEM;
         }
 
@@ -511,7 +512,7 @@ bool tipc_topsrv_kern_subscr(struct net *net, u32 port, u32 type,
         s = con->server;
         scbr = s->tipc_conn_new(*conid);
         if (!scbr) {
-                tipc_close_conn(con);
+                conn_put(con);
                 return false;
         }
 
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 5d18c0caa92b..3b4084480377 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -727,11 +727,11 @@ static unsigned int tipc_poll(struct file *file, struct socket *sock,
 
         switch (sk->sk_state) {
         case TIPC_ESTABLISHED:
+        case TIPC_CONNECTING:
                 if (!tsk->cong_link_cnt && !tsk_conn_cong(tsk))
                         revents |= POLLOUT;
                 /* fall thru' */
         case TIPC_LISTEN:
-        case TIPC_CONNECTING:
                 if (!skb_queue_empty(&sk->sk_receive_queue))
                         revents |= POLLIN | POLLRDNORM;
                 break;
@@ -1140,7 +1140,7 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq,
                                 __skb_dequeue(arrvq);
                                 __skb_queue_tail(inputq, skb);
                         }
-                        refcount_dec(&skb->users);
+                        kfree_skb(skb);
                         spin_unlock_bh(&inputq->lock);
                         continue;
                 }
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index ecca64fc6a6f..3deabcab4882 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -371,10 +371,6 @@ static int tipc_udp_recv(struct sock *sk, struct sk_buff *skb)
                         goto rcu_out;
         }
 
-        tipc_rcv(sock_net(sk), skb, b);
-        rcu_read_unlock();
-        return 0;
-
 rcu_out:
         rcu_read_unlock();
 out:
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index e07ee3ae0023..736719c8314e 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -367,8 +367,10 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
 
         crypto_info = &ctx->crypto_send;
         /* Currently we don't support set crypto info more than one time */
-        if (TLS_CRYPTO_INFO_READY(crypto_info))
+        if (TLS_CRYPTO_INFO_READY(crypto_info)) {
+                rc = -EBUSY;
                 goto out;
+        }
 
         rc = copy_from_user(crypto_info, optval, sizeof(*crypto_info));
         if (rc) {
@@ -386,7 +388,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
         case TLS_CIPHER_AES_GCM_128: {
                 if (optlen != sizeof(struct tls12_crypto_info_aes_gcm_128)) {
                         rc = -EINVAL;
-                        goto out;
+                        goto err_crypto_info;
                 }
                 rc = copy_from_user(crypto_info + 1, optval + sizeof(*crypto_info),
                                     optlen - sizeof(*crypto_info));
@@ -398,7 +400,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
         }
         default:
                 rc = -EINVAL;
-                goto out;
+                goto err_crypto_info;
         }
 
         /* currently SW is default, we will have ethtool in future */
@@ -454,6 +456,15 @@ static int tls_init(struct sock *sk)
         struct tls_context *ctx;
         int rc = 0;
 
+        /* The TLS ulp is currently supported only for TCP sockets
+         * in ESTABLISHED state.
+         * Supporting sockets in LISTEN state will require us
+         * to modify the accept implementation to clone rather then
+         * share the ulp context.
+         */
+        if (sk->sk_state != TCP_ESTABLISHED)
+                return -ENOTSUPP;
+
         /* allocate tls context */
         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
         if (!ctx) {
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 73d19210dd49..0a9b72fbd761 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -391,7 +391,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 
         while (msg_data_left(msg)) {
                 if (sk->sk_err) {
-                        ret = sk->sk_err;
+                        ret = -sk->sk_err;
                         goto send_end;
                 }
 
@@ -544,7 +544,7 @@ int tls_sw_sendpage(struct sock *sk, struct page *page,
                 size_t copy, required_size;
 
                 if (sk->sk_err) {
-                        ret = sk->sk_err;
+                        ret = -sk->sk_err;
                         goto sendpage_end;
                 }
 
@@ -577,6 +577,8 @@ alloc_payload:
                 get_page(page);
                 sg = ctx->sg_plaintext_data + ctx->sg_plaintext_num_elem;
                 sg_set_page(sg, page, copy, offset);
+                sg_unmark_end(sg);
+
                 ctx->sg_plaintext_num_elem++;
 
                 sk_mem_charge(sk, copy);
@@ -681,18 +683,17 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx)
         }
         default:
                 rc = -EINVAL;
-                goto out;
+                goto free_priv;
         }
 
         ctx->prepend_size = TLS_HEADER_SIZE + nonce_size;
         ctx->tag_size = tag_size;
         ctx->overhead_size = ctx->prepend_size + ctx->tag_size;
         ctx->iv_size = iv_size;
-        ctx->iv = kmalloc(iv_size + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
-                          GFP_KERNEL);
+        ctx->iv = kmalloc(iv_size + TLS_CIPHER_AES_GCM_128_SALT_SIZE, GFP_KERNEL);
         if (!ctx->iv) {
                 rc = -ENOMEM;
-                goto out;
+                goto free_priv;
         }
         memcpy(ctx->iv, gcm_128_info->salt, TLS_CIPHER_AES_GCM_128_SALT_SIZE);
         memcpy(ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, iv, iv_size);
@@ -740,7 +741,7 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx)
 
         rc = crypto_aead_setauthsize(sw_ctx->aead_send, ctx->tag_size);
         if (!rc)
-                goto out;
+                return 0;
 
 free_aead:
         crypto_free_aead(sw_ctx->aead_send);
@@ -751,6 +752,9 @@ free_rec_seq:
 free_iv:
         kfree(ctx->iv);
         ctx->iv = NULL;
+free_priv:
+        kfree(ctx->priv_ctx);
+        ctx->priv_ctx = NULL;
 out:
         return rc;
 }
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 5d28abf87fbf..c9473d698525 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -951,7 +951,7 @@ static unsigned int vsock_poll(struct file *file, struct socket *sock,
                  * POLLOUT|POLLWRNORM when peer is closed and nothing to read,
                  * but local send is not shutdown.
                  */
-                if (sk->sk_state == TCP_CLOSE) {
+                if (sk->sk_state == TCP_CLOSE || sk->sk_state == TCP_CLOSING) {
                         if (!(sk->sk_shutdown & SEND_SHUTDOWN))
                                 mask |= POLLOUT | POLLWRNORM;
 
diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
index 5583df708b8c..a827547aa102 100644
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -487,7 +487,7 @@ static void hvs_release(struct vsock_sock *vsk)
 
         lock_sock(sk);
 
-        sk->sk_state = SS_DISCONNECTING;
+        sk->sk_state = TCP_CLOSING;
         vsock_remove_sock(vsk);
 
         release_sock(sk);
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index 278d979c211a..1d84f91bbfb0 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -23,19 +23,36 @@ ifneq ($(CONFIG_CFG80211_EXTRA_REGDB_KEYDIR),)
 cfg80211-y += extra-certs.o
 endif
 
-$(obj)/shipped-certs.c: $(wildcard $(srctree)/$(src)/certs/*.x509)
+$(obj)/shipped-certs.c: $(wildcard $(srctree)/$(src)/certs/*.hex)
         @$(kecho) "  GEN     $@"
-        @echo '#include "reg.h"' > $@
-        @echo 'const u8 shipped_regdb_certs[] = {' >> $@
-        @for f in $^ ; do hexdump -v -e '1/1 "0x%.2x," "\n"' < $$f >> $@ ; done
-        @echo '};' >> $@
-        @echo 'unsigned int shipped_regdb_certs_len = sizeof(shipped_regdb_certs);' >> $@
+        @(echo '#include "reg.h"'; \
+          echo 'const u8 shipped_regdb_certs[] = {'; \
+          cat $^ ; \
+          echo '};'; \
+          echo 'unsigned int shipped_regdb_certs_len = sizeof(shipped_regdb_certs);'; \
+         ) > $@
 
 $(obj)/extra-certs.c: $(CONFIG_CFG80211_EXTRA_REGDB_KEYDIR:"%"=%) \
                       $(wildcard $(CONFIG_CFG80211_EXTRA_REGDB_KEYDIR:"%"=%)/*.x509)
         @$(kecho) "  GEN     $@"
-        @echo '#include "reg.h"' > $@
-        @echo 'const u8 extra_regdb_certs[] = {' >> $@
-        @for f in $^ ; do test -f $$f && hexdump -v -e '1/1 "0x%.2x," "\n"' < $$f >> $@ || true ; done
-        @echo '};' >> $@
-        @echo 'unsigned int extra_regdb_certs_len = sizeof(extra_regdb_certs);' >> $@
+        @(set -e; \
+          allf=""; \
+          for f in $^ ; do \
+              # similar to hexdump -v -e '1/1 "0x%.2x," "\n"' \
+              thisf=$$(od -An -v -tx1 < $$f | \
+                           sed -e 's/ /\n/g' | \
+                           sed -e 's/^[0-9a-f]\+$$/\0/;t;d' | \
+                           sed -e 's/^/0x/;s/$$/,/'); \
+              # file should not be empty - maybe command substitution failed? \
+              test ! -z "$$thisf";\
+              allf=$$allf$$thisf;\
+          done; \
+          ( \
+              echo '#include "reg.h"'; \
+              echo 'const u8 extra_regdb_certs[] = {'; \
+              echo "$$allf"; \
+              echo '};'; \
+              echo 'unsigned int extra_regdb_certs_len = sizeof(extra_regdb_certs);'; \
+          ) > $@)
+
+clean-files += shipped-certs.c extra-certs.c
diff --git a/net/wireless/certs/sforshee.hex b/net/wireless/certs/sforshee.hex
new file mode 100644
index 000000000000..14ea66643ffa
--- /dev/null
+++ b/net/wireless/certs/sforshee.hex
@@ -0,0 +1,86 @@
+/* Seth Forshee's regdb certificate */
+0x30, 0x82, 0x02, 0xa4, 0x30, 0x82, 0x01, 0x8c,
+0x02, 0x09, 0x00, 0xb2, 0x8d, 0xdf, 0x47, 0xae,
+0xf9, 0xce, 0xa7, 0x30, 0x0d, 0x06, 0x09, 0x2a,
+0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b,
+0x05, 0x00, 0x30, 0x13, 0x31, 0x11, 0x30, 0x0f,
+0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x08, 0x73,
+0x66, 0x6f, 0x72, 0x73, 0x68, 0x65, 0x65, 0x30,
+0x20, 0x17, 0x0d, 0x31, 0x37, 0x31, 0x30, 0x30,
+0x36, 0x31, 0x39, 0x34, 0x30, 0x33, 0x35, 0x5a,
+0x18, 0x0f, 0x32, 0x31, 0x31, 0x37, 0x30, 0x39,
+0x31, 0x32, 0x31, 0x39, 0x34, 0x30, 0x33, 0x35,
+0x5a, 0x30, 0x13, 0x31, 0x11, 0x30, 0x0f, 0x06,
+0x03, 0x55, 0x04, 0x03, 0x0c, 0x08, 0x73, 0x66,
+0x6f, 0x72, 0x73, 0x68, 0x65, 0x65, 0x30, 0x82,
+0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
+0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05,
+0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82,
+0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xb5,
+0x40, 0xe3, 0x9c, 0x28, 0x84, 0x39, 0x03, 0xf2,
+0x39, 0xd7, 0x66, 0x2c, 0x41, 0x38, 0x15, 0xac,
+0x7e, 0xa5, 0x83, 0x71, 0x25, 0x7e, 0x90, 0x7c,
+0x68, 0xdd, 0x6f, 0x3f, 0xd9, 0xd7, 0x59, 0x38,
+0x9f, 0x7c, 0x6a, 0x52, 0xc2, 0x03, 0x2a, 0x2d,
+0x7e, 0x66, 0xf4, 0x1e, 0xb3, 0x12, 0x70, 0x20,
+0x5b, 0xd4, 0x97, 0x32, 0x3d, 0x71, 0x8b, 0x3b,
+0x1b, 0x08, 0x17, 0x14, 0x6b, 0x61, 0xc4, 0x57,
+0x8b, 0x96, 0x16, 0x1c, 0xfd, 0x24, 0xd5, 0x0b,
+0x09, 0xf9, 0x68, 0x11, 0x84, 0xfb, 0xca, 0x51,
+0x0c, 0xd1, 0x45, 0x19, 0xda, 0x10, 0x44, 0x8a,
+0xd9, 0xfe, 0x76, 0xa9, 0xfd, 0x60, 0x2d, 0x18,
+0x0b, 0x28, 0x95, 0xb2, 0x2d, 0xea, 0x88, 0x98,
+0xb8, 0xd1, 0x56, 0x21, 0xf0, 0x53, 0x1f, 0xf1,
+0x02, 0x6f, 0xe9, 0x46, 0x9b, 0x93, 0x5f, 0x28,
+0x90, 0x0f, 0xac, 0x36, 0xfa, 0x68, 0x23, 0x71,
+0x57, 0x56, 0xf6, 0xcc, 0xd3, 0xdf, 0x7d, 0x2a,
+0xd9, 0x1b, 0x73, 0x45, 0xeb, 0xba, 0x27, 0x85,
+0xef, 0x7a, 0x7f, 0xa5, 0xcb, 0x80, 0xc7, 0x30,
+0x36, 0xd2, 0x53, 0xee, 0xec, 0xac, 0x1e, 0xe7,
+0x31, 0xf1, 0x36, 0xa2, 0x9c, 0x63, 0xc6, 0x65,
+0x5b, 0x7f, 0x25, 0x75, 0x68, 0xa1, 0xea, 0xd3,
+0x7e, 0x00, 0x5c, 0x9a, 0x5e, 0xd8, 0x20, 0x18,
+0x32, 0x77, 0x07, 0x29, 0x12, 0x66, 0x1e, 0x36,
+0x73, 0xe7, 0x97, 0x04, 0x41, 0x37, 0xb1, 0xb1,
+0x72, 0x2b, 0xf4, 0xa1, 0x29, 0x20, 0x7c, 0x96,
+0x79, 0x0b, 0x2b, 0xd0, 0xd8, 0xde, 0xc8, 0x6c,
+0x3f, 0x93, 0xfb, 0xc5, 0xee, 0x78, 0x52, 0x11,
+0x15, 0x1b, 0x7a, 0xf6, 0xe2, 0x68, 0x99, 0xe7,
+0xfb, 0x46, 0x16, 0x84, 0xe3, 0xc7, 0xa1, 0xe6,
+0xe0, 0xd2, 0x46, 0xd5, 0xe1, 0xc4, 0x5f, 0xa0,
+0x66, 0xf4, 0xda, 0xc4, 0xff, 0x95, 0x1d, 0x02,
+0x03, 0x01, 0x00, 0x01, 0x30, 0x0d, 0x06, 0x09,
+0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
+0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00,
+0x87, 0x03, 0xda, 0xf2, 0x82, 0xc2, 0xdd, 0xaf,
+0x7c, 0x44, 0x2f, 0x86, 0xd3, 0x5f, 0x4c, 0x93,
+0x48, 0xb9, 0xfe, 0x07, 0x17, 0xbb, 0x21, 0xf7,
+0x25, 0x23, 0x4e, 0xaa, 0x22, 0x0c, 0x16, 0xb9,
+0x73, 0xae, 0x9d, 0x46, 0x7c, 0x75, 0xd9, 0xc3,
+0x49, 0x57, 0x47, 0xbf, 0x33, 0xb7, 0x97, 0xec,
+0xf5, 0x40, 0x75, 0xc0, 0x46, 0x22, 0xf0, 0xa0,
+0x5d, 0x9c, 0x79, 0x13, 0xa1, 0xff, 0xb8, 0xa3,
+0x2f, 0x7b, 0x8e, 0x06, 0x3f, 0xc8, 0xb6, 0xe4,
+0x6a, 0x28, 0xf2, 0x34, 0x5c, 0x23, 0x3f, 0x32,
+0xc0, 0xe6, 0xad, 0x0f, 0xac, 0xcf, 0x55, 0x74,
+0x47, 0x73, 0xd3, 0x01, 0x85, 0xb7, 0x0b, 0x22,
+0x56, 0x24, 0x7d, 0x9f, 0x09, 0xa9, 0x0e, 0x86,
+0x9e, 0x37, 0x5b, 0x9c, 0x6d, 0x02, 0xd9, 0x8c,
+0xc8, 0x50, 0x6a, 0xe2, 0x59, 0xf3, 0x16, 0x06,
+0xea, 0xb2, 0x42, 0xb5, 0x58, 0xfe, 0xba, 0xd1,
+0x81, 0x57, 0x1a, 0xef, 0xb2, 0x38, 0x88, 0x58,
+0xf6, 0xaa, 0xc4, 0x2e, 0x8b, 0x5a, 0x27, 0xe4,
+0xa5, 0xe8, 0xa4, 0xca, 0x67, 0x5c, 0xac, 0x72,
+0x67, 0xc3, 0x6f, 0x13, 0xc3, 0x2d, 0x35, 0x79,
+0xd7, 0x8a, 0xe7, 0xf5, 0xd4, 0x21, 0x30, 0x4a,
+0xd5, 0xf6, 0xa3, 0xd9, 0x79, 0x56, 0xf2, 0x0f,
+0x10, 0xf7, 0x7d, 0xd0, 0x51, 0x93, 0x2f, 0x47,
+0xf8, 0x7d, 0x4b, 0x0a, 0x84, 0x55, 0x12, 0x0a,
+0x7d, 0x4e, 0x3b, 0x1f, 0x2b, 0x2f, 0xfc, 0x28,
+0xb3, 0x69, 0x34, 0xe1, 0x80, 0x80, 0xbb, 0xe2,
+0xaf, 0xb9, 0xd6, 0x30, 0xf1, 0x1d, 0x54, 0x87,
+0x23, 0x99, 0x9f, 0x51, 0x03, 0x4c, 0x45, 0x7d,
+0x02, 0x65, 0x73, 0xab, 0xfd, 0xcf, 0x94, 0xcc,
+0x0d, 0x3a, 0x60, 0xfd, 0x3c, 0x14, 0x2f, 0x16,
+0x33, 0xa9, 0x21, 0x1f, 0xcb, 0x50, 0xb1, 0x8f,
+0x03, 0xee, 0xa0, 0x66, 0xa9, 0x16, 0x79, 0x14,
diff --git a/net/wireless/certs/sforshee.x509 b/net/wireless/certs/sforshee.x509
deleted file mode 100644
index c6f8f9d6b988..000000000000
--- a/net/wireless/certs/sforshee.x509
+++ /dev/null
diff --git a/net/wireless/core.c b/net/wireless/core.c
index fdde0d98fde1..a6f3cac8c640 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -439,6 +439,8 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,
                 if (rv)
                         goto use_default_name;
         } else {
+                int rv;
+
 use_default_name:
                 /* NOTE:  This is *probably* safe w/out holding rtnl because of
                  * the restrictions on phy names.  Probably this call could
@@ -446,7 +448,11 @@ use_default_name:
                  * phyX.  But, might should add some locking and check return
                  * value, and use a different name if this one exists?
                  */
-                dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
+                rv = dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
+                if (rv < 0) {
+                        kfree(rdev);
+                        return NULL;
+                }
         }
 
         INIT_LIST_HEAD(&rdev->wiphy.wdev_list);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index d2f7e8b8a097..eaff636169c2 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -507,8 +507,6 @@ void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
 void cfg80211_stop_nan(struct cfg80211_registered_device *rdev,
                        struct wireless_dev *wdev);
 
-#define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10
-
 #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
 #define CFG80211_DEV_WARN_ON(cond)      WARN_ON(cond)
 #else
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index b1ac23ca20c8..542a4fc0a8d7 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2610,7 +2610,7 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flag
         case NL80211_IFTYPE_AP:
                 if (wdev->ssid_len &&
                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
-                        goto nla_put_failure;
+                        goto nla_put_failure_locked;
                 break;
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_P2P_CLIENT:
@@ -2618,12 +2618,13 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flag
                 const u8 *ssid_ie;
                 if (!wdev->current_bss)
                         break;
+                rcu_read_lock();
                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
                                                WLAN_EID_SSID);
-                if (!ssid_ie)
-                        break;
-                if (nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
-                        goto nla_put_failure;
+                if (ssid_ie &&
+                    nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
+                        goto nla_put_failure_rcu_locked;
+                rcu_read_unlock();
                 break;
                 }
         default:
@@ -2635,6 +2636,10 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flag
         genlmsg_end(msg, hdr);
         return 0;
 
+ nla_put_failure_rcu_locked:
+        rcu_read_unlock();
+ nla_put_failure_locked:
+        wdev_unlock(wdev);
  nla_put_failure:
         genlmsg_cancel(msg, hdr);
         return -EMSGSIZE;
@@ -9804,7 +9809,7 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
          */
         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
             rdev->ops->get_station) {
-                struct station_info sinfo;
+                struct station_info sinfo = {};
                 u8 *mac_addr;
 
                 mac_addr = wdev->current_bss->pub.bssid;
@@ -11359,7 +11364,8 @@ static int nl80211_nan_add_func(struct sk_buff *skb,
                 break;
         case NL80211_NAN_FUNC_FOLLOW_UP:
                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
-                    !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) {
+                    !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
+                    !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
                         err = -EINVAL;
                         goto out;
                 }
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 78e71b0390be..7b42f0bacfd8 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1769,8 +1769,7 @@ static void handle_reg_beacon(struct wiphy *wiphy, unsigned int chan_idx,
         if (wiphy->regulatory_flags & REGULATORY_DISABLE_BEACON_HINTS)
                 return;
 
-        chan_before.center_freq = chan->center_freq;
-        chan_before.flags = chan->flags;
+        chan_before = *chan;
 
         if (chan->flags & IEEE80211_CHAN_NO_IR) {
                 chan->flags &= ~IEEE80211_CHAN_NO_IR;
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 7ca04a7de85a..05186a47878f 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -1254,8 +1254,7 @@ static int cfg80211_wext_giwrate(struct net_device *dev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
-        /* we are under RTNL - globally locked - so can use a static struct */
-        static struct station_info sinfo;
+        struct station_info sinfo = {};
         u8 addr[ETH_ALEN];
         int err;
 
diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index 30e5746085b8..ac9477189d1c 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -102,6 +102,7 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
 
         err = dev->xfrmdev_ops->xdo_dev_state_add(x);
         if (err) {
+                xso->dev = NULL;
                 dev_put(dev);
                 return err;
         }
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 347ab31574d5..5b2409746ae0 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -8,15 +8,29 @@
  *
  */
 
+#include <linux/bottom_half.h>
+#include <linux/interrupt.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
+#include <linux/percpu.h>
 #include <net/dst.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/ip_tunnels.h>
 #include <net/ip6_tunnel.h>
 
+struct xfrm_trans_tasklet {
+        struct tasklet_struct tasklet;
+        struct sk_buff_head queue;
+};
+
+struct xfrm_trans_cb {
+        int (*finish)(struct net *net, struct sock *sk, struct sk_buff *skb);
+};
+
+#define XFRM_TRANS_SKB_CB(__skb) ((struct xfrm_trans_cb *)&((__skb)->cb[0]))
+
 static struct kmem_cache *secpath_cachep __read_mostly;
 
 static DEFINE_SPINLOCK(xfrm_input_afinfo_lock);
@@ -25,6 +39,8 @@ static struct xfrm_input_afinfo const __rcu *xfrm_input_afinfo[AF_INET6 + 1];
 static struct gro_cells gro_cells;
 static struct net_device xfrm_napi_dev;
 
+static DEFINE_PER_CPU(struct xfrm_trans_tasklet, xfrm_trans_tasklet);
+
 int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo)
 {
         int err = 0;
@@ -207,7 +223,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
         xfrm_address_t *daddr;
         struct xfrm_mode *inner_mode;
         u32 mark = skb->mark;
-        unsigned int family;
+        unsigned int family = AF_UNSPEC;
         int decaps = 0;
         int async = 0;
         bool xfrm_gro = false;
@@ -216,6 +232,16 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 
         if (encap_type < 0) {
                 x = xfrm_input_state(skb);
+
+                if (unlikely(x->km.state != XFRM_STATE_VALID)) {
+                        if (x->km.state == XFRM_STATE_ACQ)
+                                XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR);
+                        else
+                                XFRM_INC_STATS(net,
+                                               LINUX_MIB_XFRMINSTATEINVALID);
+                        goto drop;
+                }
+
                 family = x->outer_mode->afinfo->family;
 
                 /* An encap_type of -1 indicates async resumption. */
@@ -467,9 +493,41 @@ int xfrm_input_resume(struct sk_buff *skb, int nexthdr)
 }
 EXPORT_SYMBOL(xfrm_input_resume);
 
+static void xfrm_trans_reinject(unsigned long data)
+{
+        struct xfrm_trans_tasklet *trans = (void *)data;
+        struct sk_buff_head queue;
+        struct sk_buff *skb;
+
+        __skb_queue_head_init(&queue);
+        skb_queue_splice_init(&trans->queue, &queue);
+
+        while ((skb = __skb_dequeue(&queue)))
+                XFRM_TRANS_SKB_CB(skb)->finish(dev_net(skb->dev), NULL, skb);
+}
+
+int xfrm_trans_queue(struct sk_buff *skb,
+                     int (*finish)(struct net *, struct sock *,
+                                   struct sk_buff *))
+{
+        struct xfrm_trans_tasklet *trans;
+
+        trans = this_cpu_ptr(&xfrm_trans_tasklet);
+
+        if (skb_queue_len(&trans->queue) >= netdev_max_backlog)
+                return -ENOBUFS;
+
+        XFRM_TRANS_SKB_CB(skb)->finish = finish;
+        __skb_queue_tail(&trans->queue, skb);
+        tasklet_schedule(&trans->tasklet);
+        return 0;
+}
+EXPORT_SYMBOL(xfrm_trans_queue);
+
 void __init xfrm_input_init(void)
 {
         int err;
+        int i;
 
         init_dummy_netdev(&xfrm_napi_dev);
         err = gro_cells_init(&gro_cells, &xfrm_napi_dev);
@@ -480,4 +538,13 @@ void __init xfrm_input_init(void)
                                            sizeof(struct sec_path),
                                            0, SLAB_HWCACHE_ALIGN|SLAB_PANIC,
                                            NULL);
+
+        for_each_possible_cpu(i) {
+                struct xfrm_trans_tasklet *trans;
+
+                trans = &per_cpu(xfrm_trans_tasklet, i);
+                __skb_queue_head_init(&trans->queue);
+                tasklet_init(&trans->tasklet, xfrm_trans_reinject,
+                             (unsigned long)trans);
+        }
 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 9542975eb2f9..bd6b0e7a0ee4 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -609,7 +609,8 @@ static void xfrm_hash_rebuild(struct work_struct *work)
 
         /* re-insert all policies by order of creation */
         list_for_each_entry_reverse(policy, &net->xfrm.policy_all, walk.all) {
-                if (xfrm_policy_id2dir(policy->index) >= XFRM_POLICY_MAX) {
+                if (policy->walk.dead ||
+                    xfrm_policy_id2dir(policy->index) >= XFRM_POLICY_MAX) {
                         /* skip socket policies */
                         continue;
                 }
@@ -974,8 +975,6 @@ int xfrm_policy_flush(struct net *net, u8 type, bool task_valid)
         }
         if (!cnt)
                 err = -ESRCH;
-        else
-                xfrm_policy_cache_flush();
 out:
         spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
         return err;
@@ -1168,9 +1167,15 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
  again:
         pol = rcu_dereference(sk->sk_policy[dir]);
         if (pol != NULL) {
-                bool match = xfrm_selector_match(&pol->selector, fl, family);
+                bool match;
                 int err = 0;
 
+                if (pol->family != family) {
+                        pol = NULL;
+                        goto out;
+                }
+
+                match = xfrm_selector_match(&pol->selector, fl, family);
                 if (match) {
                         if ((sk->sk_mark & pol->mark.m) != pol->mark.v) {
                                 pol = NULL;
@@ -1737,6 +1742,8 @@ void xfrm_policy_cache_flush(void)
         bool found = 0;
         int cpu;
 
+        might_sleep();
+
         local_bh_disable();
         rcu_read_lock();
         for_each_possible_cpu(cpu) {
@@ -1833,6 +1840,7 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
                    sizeof(struct xfrm_policy *) * num_pols) == 0 &&
             xfrm_xdst_can_reuse(xdst, xfrm, err)) {
                 dst_hold(&xdst->u.dst);
+                xfrm_pols_put(pols, num_pols);
                 while (err > 0)
                         xfrm_state_put(xfrm[--err]);
                 return xdst;
@@ -2055,8 +2063,11 @@ xfrm_bundle_lookup(struct net *net, const struct flowi *fl, u16 family, u8 dir,
         if (num_xfrms <= 0)
                 goto make_dummy_bundle;
 
+        local_bh_disable();
         xdst = xfrm_resolve_and_create_bundle(pols, num_pols, fl, family,
-                                                  xflo->dst_orig);
+                                              xflo->dst_orig);
+        local_bh_enable();
+
         if (IS_ERR(xdst)) {
                 err = PTR_ERR(xdst);
                 if (err != -EAGAIN)
@@ -2143,9 +2154,12 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
                                 goto no_transform;
                         }
 
+                        local_bh_disable();
                         xdst = xfrm_resolve_and_create_bundle(
                                         pols, num_pols, fl,
                                         family, dst_orig);
+                        local_bh_enable();
+
                         if (IS_ERR(xdst)) {
                                 xfrm_pols_put(pols, num_pols);
                                 err = PTR_ERR(xdst);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 065d89606888..a3785f538018 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -313,13 +313,14 @@ retry:
         if ((type && !try_module_get(type->owner)))
                 type = NULL;
 
+        rcu_read_unlock();
+
         if (!type && try_load) {
                 request_module("xfrm-offload-%d-%d", family, proto);
-                try_load = 0;
+                try_load = false;
                 goto retry;
         }
 
-        rcu_read_unlock();
         return type;
 }
 
@@ -1343,6 +1344,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
 
         if (orig->aead) {
                 x->aead = xfrm_algo_aead_clone(orig->aead);
+                x->geniv = orig->geniv;
                 if (!x->aead)
                         goto error;
         }
@@ -1533,8 +1535,12 @@ out:
         err = -EINVAL;
         spin_lock_bh(&x1->lock);
         if (likely(x1->km.state == XFRM_STATE_VALID)) {
-                if (x->encap && x1->encap)
+                if (x->encap && x1->encap &&
+                    x->encap->encap_type == x1->encap->encap_type)
                         memcpy(x1->encap, x->encap, sizeof(*x1->encap));
+                else if (x->encap || x1->encap)
+                        goto fail;
+
                 if (x->coaddr && x1->coaddr) {
                         memcpy(x1->coaddr, x->coaddr, sizeof(*x1->coaddr));
                 }
@@ -1551,6 +1557,8 @@ out:
                 x->km.state = XFRM_STATE_DEAD;
                 __xfrm_state_put(x);
         }
+
+fail:
         spin_unlock_bh(&x1->lock);
 
         xfrm_state_put(x1);
@@ -2264,8 +2272,6 @@ int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload)
                         goto error;
         }
 
-        x->km.state = XFRM_STATE_VALID;
-
 error:
         return err;
 }
@@ -2274,7 +2280,13 @@ EXPORT_SYMBOL(__xfrm_init_state);
 
 int xfrm_init_state(struct xfrm_state *x)
 {
-        return __xfrm_init_state(x, true, false);
+        int err;
+
+        err = __xfrm_init_state(x, true, false);
+        if (!err)
+                x->km.state = XFRM_STATE_VALID;
+
+        return err;
 }
 
 EXPORT_SYMBOL(xfrm_init_state);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 983b0233767b..7f52b8eb177d 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -598,13 +598,6 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
                         goto error;
         }
 
-        if (attrs[XFRMA_OFFLOAD_DEV]) {
-                err = xfrm_dev_state_add(net, x,
-                                         nla_data(attrs[XFRMA_OFFLOAD_DEV]));
-                if (err)
-                        goto error;
-        }
-
         if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn,
                                                attrs[XFRMA_REPLAY_ESN_VAL])))
                 goto error;
@@ -620,6 +613,14 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
         /* override default values from above */
         xfrm_update_ae_params(x, attrs, 0);
 
+        /* configure the hardware if offload is requested */
+        if (attrs[XFRMA_OFFLOAD_DEV]) {
+                err = xfrm_dev_state_add(net, x,
+                                         nla_data(attrs[XFRMA_OFFLOAD_DEV]));
+                if (err)
+                        goto error;
+        }
+
         return x;
 
 error:
@@ -662,6 +663,9 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
                 goto out;
         }
 
+        if (x->km.state == XFRM_STATE_VOID)
+                x->km.state = XFRM_STATE_VALID;
+
         c.seq = nlh->nlmsg_seq;
         c.portid = nlh->nlmsg_pid;
         c.event = nlh->nlmsg_type;
@@ -1419,11 +1423,14 @@ static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
 
 static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
 {
+        u16 prev_family;
         int i;
 
         if (nr > XFRM_MAX_DEPTH)
                 return -EINVAL;
 
+        prev_family = family;
+
         for (i = 0; i < nr; i++) {
                 /* We never validated the ut->family value, so many
                  * applications simply leave it at zero.  The check was
@@ -1435,6 +1442,12 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
                 if (!ut[i].family)
                         ut[i].family = family;
 
+                if ((ut[i].mode == XFRM_MODE_TRANSPORT) &&
+                    (ut[i].family != prev_family))
+                        return -EINVAL;
+
+                prev_family = ut[i].family;
+
                 switch (ut[i].family) {
                 case AF_INET:
                         break;
@@ -1445,6 +1458,21 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
                 default:
                         return -EINVAL;
                 }
+
+                switch (ut[i].id.proto) {
+                case IPPROTO_AH:
+                case IPPROTO_ESP:
+                case IPPROTO_COMP:
+#if IS_ENABLED(CONFIG_IPV6)
+                case IPPROTO_ROUTING:
+                case IPPROTO_DSTOPTS:
+#endif
+                case IPSEC_PROTO_ANY:
+                        break;
+                default:
+                        return -EINVAL;
+                }
+
         }
 
         return 0;
@@ -2470,7 +2498,7 @@ static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
         [XFRMA_PROTO]           = { .type = NLA_U8 },
         [XFRMA_ADDRESS_FILTER]  = { .len = sizeof(struct xfrm_address_filter) },
         [XFRMA_OFFLOAD_DEV]     = { .len = sizeof(struct xfrm_user_offload) },
-        [XFRMA_OUTPUT_MARK]     = { .len = NLA_U32 },
+        [XFRMA_OUTPUT_MARK]     = { .type = NLA_U32 },
 };
 
 static const struct nla_policy xfrma_spd_policy[XFRMA_SPD_MAX+1] = {
diff --git a/samples/bpf/bpf_load.c b/samples/bpf/bpf_load.c
index 522ca9252d6c..242631aa4ea2 100644
--- a/samples/bpf/bpf_load.c
+++ b/samples/bpf/bpf_load.c
@@ -193,8 +193,18 @@ static int load_and_attach(const char *event, struct bpf_insn *prog, int size)
                 return -1;
         }
         event_fd[prog_cnt - 1] = efd;
-        ioctl(efd, PERF_EVENT_IOC_ENABLE, 0);
-        ioctl(efd, PERF_EVENT_IOC_SET_BPF, fd);
+        err = ioctl(efd, PERF_EVENT_IOC_ENABLE, 0);
+        if (err < 0) {
+                printf("ioctl PERF_EVENT_IOC_ENABLE failed err %s\n",
+                       strerror(errno));
+                return -1;
+        }
+        err = ioctl(efd, PERF_EVENT_IOC_SET_BPF, fd);
+        if (err < 0) {
+                printf("ioctl PERF_EVENT_IOC_SET_BPF failed err %s\n",
+                       strerror(errno));
+                return -1;
+        }
 
         return 0;
 }
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index cb8997ed0149..47cddf32aeba 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -265,12 +265,18 @@ else
 objtool_args += $(call cc-ifversion, -lt, 0405, --no-unreachable)
 endif
 
+ifdef CONFIG_MODVERSIONS
+objtool_o = $(@D)/.tmp_$(@F)
+else
+objtool_o = $(@)
+endif
+
 # 'OBJECT_FILES_NON_STANDARD := y': skip objtool checking for a directory
 # 'OBJECT_FILES_NON_STANDARD_foo.o := 'y': skip objtool checking for a file
 # 'OBJECT_FILES_NON_STANDARD_foo.o := 'n': override directory skip for a file
 cmd_objtool = $(if $(patsubst y%,, \
         $(OBJECT_FILES_NON_STANDARD_$(basetarget).o)$(OBJECT_FILES_NON_STANDARD)n), \
-        $(__objtool_obj) $(objtool_args) "$(@)";)
+        $(__objtool_obj) $(objtool_args) "$(objtool_o)";)
 objtool_obj = $(if $(patsubst y%,, \
         $(OBJECT_FILES_NON_STANDARD_$(basetarget).o)$(OBJECT_FILES_NON_STANDARD)n), \
         $(__objtool_obj))
@@ -286,16 +292,16 @@ objtool_dep = $(objtool_obj)					\
 define rule_cc_o_c
         $(call echo-cmd,checksrc) $(cmd_checksrc)                         \
         $(call cmd_and_fixdep,cc_o_c)                                     \
-        $(cmd_modversions_c)                                              \
         $(cmd_checkdoc)                                                   \
         $(call echo-cmd,objtool) $(cmd_objtool)                           \
+        $(cmd_modversions_c)                                              \
         $(call echo-cmd,record_mcount) $(cmd_record_mcount)
 endef
 
 define rule_as_o_S
         $(call cmd_and_fixdep,as_o_S)                                     \
-        $(cmd_modversions_S)                                              \
-        $(call echo-cmd,objtool) $(cmd_objtool)
+        $(call echo-cmd,objtool) $(cmd_objtool)                           \
+        $(cmd_modversions_S)
 endef
 
 # List module undefined symbols (or empty line if not enabled)
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 040aa79e1d9d..31031f10fe56 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -6233,28 +6233,6 @@ sub process {
                         }
                 }
 
-# whine about ACCESS_ONCE
-                if ($^V && $^V ge 5.10.0 &&
-                    $line =~ /\bACCESS_ONCE\s*$balanced_parens\s*(=(?!=))?\s*($FuncArg)?/) {
-                        my $par = $1;
-                        my $eq = $2;
-                        my $fun = $3;
-                        $par =~ s/^\(\s*(.*)\s*\)$/$1/;
-                        if (defined($eq)) {
-                                if (WARN("PREFER_WRITE_ONCE",
-                                         "Prefer WRITE_ONCE(<FOO>, <BAR>) over ACCESS_ONCE(<FOO>) = <BAR>\n" . $herecurr) &&
-                                    $fix) {
-                                        $fixed[$fixlinenr] =~ s/\bACCESS_ONCE\s*\(\s*\Q$par\E\s*\)\s*$eq\s*\Q$fun\E/WRITE_ONCE($par, $fun)/;
-                                }
-                        } else {
-                                if (WARN("PREFER_READ_ONCE",
-                                         "Prefer READ_ONCE(<FOO>) over ACCESS_ONCE(<FOO>)\n" . $herecurr) &&
-                                    $fix) {
-                                        $fixed[$fixlinenr] =~ s/\bACCESS_ONCE\s*\(\s*\Q$par\E\s*\)/READ_ONCE($par)/;
-                                }
-                        }
-                }
-
 # check for mutex_trylock_recursive usage
                 if ($line =~ /mutex_trylock_recursive/) {
                         ERROR("LOCKING",
diff --git a/scripts/decodecode b/scripts/decodecode
index 438120da1361..5ea071099330 100755
--- a/scripts/decodecode
+++ b/scripts/decodecode
@@ -59,6 +59,14 @@ disas() {
                 ${CROSS_COMPILE}strip $1.o
         fi
 
+        if [ "$ARCH" = "arm64" ]; then
+                if [ $width -eq 4 ]; then
+                        type=inst
+                fi
+
+                ${CROSS_COMPILE}strip $1.o
+        fi
+
         ${CROSS_COMPILE}objdump $OBJDUMPFLAGS -S $1.o | \
                 grep -v "/tmp\|Disassembly\|\.text\|^$" > $1.dis 2>&1
 }
diff --git a/scripts/faddr2line b/scripts/faddr2line
index 39e07d8574dd..7721d5b2b0c0 100755
--- a/scripts/faddr2line
+++ b/scripts/faddr2line
@@ -44,10 +44,10 @@
 set -o errexit
 set -o nounset
 
-READELF="${CROSS_COMPILE}readelf"
-ADDR2LINE="${CROSS_COMPILE}addr2line"
-SIZE="${CROSS_COMPILE}size"
-NM="${CROSS_COMPILE}nm"
+READELF="${CROSS_COMPILE:-}readelf"
+ADDR2LINE="${CROSS_COMPILE:-}addr2line"
+SIZE="${CROSS_COMPILE:-}size"
+NM="${CROSS_COMPILE:-}nm"
 
 command -v awk >/dev/null 2>&1 || die "awk isn't installed"
 command -v ${READELF} >/dev/null 2>&1 || die "readelf isn't installed"
diff --git a/scripts/gdb/linux/tasks.py b/scripts/gdb/linux/tasks.py
index 1bf949c43b76..f6ab3ccf698f 100644
--- a/scripts/gdb/linux/tasks.py
+++ b/scripts/gdb/linux/tasks.py
@@ -96,6 +96,8 @@ def get_thread_info(task):
         thread_info_addr = task.address + ia64_task_size
         thread_info = thread_info_addr.cast(thread_info_ptr_type)
     else:
+        if task.type.fields()[0].type == thread_info_type.get_type():
+            return task['thread_info']
         thread_info = task['stack'].cast(thread_info_ptr_type)
     return thread_info.dereference()
 
diff --git a/scripts/genksyms/.gitignore b/scripts/genksyms/.gitignore
index 86dc07a01b43..e7836b47f060 100644
--- a/scripts/genksyms/.gitignore
+++ b/scripts/genksyms/.gitignore
@@ -1,4 +1,3 @@
-*.hash.c
 *.lex.c
 *.tab.c
 *.tab.h
diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c
index cbf4996dd9c1..8cee597d33a5 100644
--- a/scripts/kconfig/expr.c
+++ b/scripts/kconfig/expr.c
@@ -893,7 +893,10 @@ static enum string_value_kind expr_parse_string(const char *str,
         switch (type) {
         case S_BOOLEAN:
         case S_TRISTATE:
-                return k_string;
+                val->s = !strcmp(str, "n") ? 0 :
+                         !strcmp(str, "m") ? 1 :
+                         !strcmp(str, "y") ? 2 : -1;
+                return k_signed;
         case S_INT:
                 val->s = strtoll(str, &tail, 10);
                 kind = k_signed;
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index bd29a92b4b48..df0f045a9a89 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -3248,4 +3248,4 @@ if ($verbose && $warnings) {
   print STDERR "$warnings warnings\n";
 }
 
-exit($errors);
+exit($output_mode eq "none" ? 0 : $errors);
diff --git a/security/Kconfig b/security/Kconfig
index e8e449444e65..b0cb9a5f9448 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -54,6 +54,17 @@ config SECURITY_NETWORK
           implement socket and networking access controls.
           If you are unsure how to answer this question, answer N.
 
+config PAGE_TABLE_ISOLATION
+        bool "Remove the kernel mapping in user mode"
+        default y
+        depends on X86_64 && !UML
+        help
+          This feature reduces the number of hardware side channels by
+          ensuring that the majority of kernel addresses are not mapped
+          into userspace.
+
+          See Documentation/x86/pti.txt for more details.
+
 config SECURITY_INFINIBAND
         bool "Infiniband Security Hooks"
         depends on SECURITY && INFINIBAND
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 04ba9d0718ea..6a54d2ffa840 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -330,10 +330,7 @@ static struct aa_profile *__attach_match(const char *name,
                         continue;
 
                 if (profile->xmatch) {
-                        if (profile->xmatch_len == len) {
-                                conflict = true;
-                                continue;
-                        } else if (profile->xmatch_len > len) {
+                        if (profile->xmatch_len >= len) {
                                 unsigned int state;
                                 u32 perm;
 
@@ -342,6 +339,10 @@ static struct aa_profile *__attach_match(const char *name,
                                 perm = dfa_user_allow(profile->xmatch, state);
                                 /* any accepting state means a valid match. */
                                 if (perm & MAY_EXEC) {
+                                        if (profile->xmatch_len == len) {
+                                                conflict = true;
+                                                continue;
+                                        }
                                         candidate = profile;
                                         len = profile->xmatch_len;
                                         conflict = false;
diff --git a/security/apparmor/include/perms.h b/security/apparmor/include/perms.h
index 2b27bb79aec4..d7b7e7115160 100644
--- a/security/apparmor/include/perms.h
+++ b/security/apparmor/include/perms.h
@@ -133,6 +133,9 @@ extern struct aa_perms allperms;
 #define xcheck_labels_profiles(L1, L2, FN, args...)             \
         xcheck_ns_labels((L1), (L2), xcheck_ns_profile_label, (FN), args)
 
+#define xcheck_labels(L1, L2, P, FN1, FN2)                      \
+        xcheck(fn_for_each((L1), (P), (FN1)), fn_for_each((L2), (P), (FN2)))
+
 
 void aa_perm_mask_to_str(char *str, const char *chrs, u32 mask);
 void aa_audit_perm_names(struct audit_buffer *ab, const char **names, u32 mask);
diff --git a/security/apparmor/ipc.c b/security/apparmor/ipc.c
index 7ca0032e7ba9..b40678f3c1d5 100644
--- a/security/apparmor/ipc.c
+++ b/security/apparmor/ipc.c
@@ -64,40 +64,48 @@ static void audit_ptrace_cb(struct audit_buffer *ab, void *va)
                         FLAGS_NONE, GFP_ATOMIC);
 }
 
+/* assumes check for PROFILE_MEDIATES is already done */
 /* TODO: conditionals */
 static int profile_ptrace_perm(struct aa_profile *profile,
-                               struct aa_profile *peer, u32 request,
-                               struct common_audit_data *sa)
+                             struct aa_label *peer, u32 request,
+                             struct common_audit_data *sa)
 {
         struct aa_perms perms = { };
 
-        /* need because of peer in cross check */
-        if (profile_unconfined(profile) ||
-            !PROFILE_MEDIATES(profile, AA_CLASS_PTRACE))
-                return 0;
-
-        aad(sa)->peer = &peer->label;
-        aa_profile_match_label(profile, &peer->label, AA_CLASS_PTRACE, request,
+        aad(sa)->peer = peer;
+        aa_profile_match_label(profile, peer, AA_CLASS_PTRACE, request,
                                &perms);
         aa_apply_modes_to_perms(profile, &perms);
         return aa_check_perms(profile, &perms, request, sa, audit_ptrace_cb);
 }
 
-static int cross_ptrace_perm(struct aa_profile *tracer,
-                             struct aa_profile *tracee, u32 request,
-                             struct common_audit_data *sa)
+static int profile_tracee_perm(struct aa_profile *tracee,
+                               struct aa_label *tracer, u32 request,
+                               struct common_audit_data *sa)
 {
+        if (profile_unconfined(tracee) || unconfined(tracer) ||
+            !PROFILE_MEDIATES(tracee, AA_CLASS_PTRACE))
+                return 0;
+
+        return profile_ptrace_perm(tracee, tracer, request, sa);
+}
+
+static int profile_tracer_perm(struct aa_profile *tracer,
+                               struct aa_label *tracee, u32 request,
+                               struct common_audit_data *sa)
+{
+        if (profile_unconfined(tracer))
+                return 0;
+
         if (PROFILE_MEDIATES(tracer, AA_CLASS_PTRACE))
-                return xcheck(profile_ptrace_perm(tracer, tracee, request, sa),
-                              profile_ptrace_perm(tracee, tracer,
-                                                  request << PTRACE_PERM_SHIFT,
-                                                  sa));
-        /* policy uses the old style capability check for ptrace */
-        if (profile_unconfined(tracer) || tracer == tracee)
+                return profile_ptrace_perm(tracer, tracee, request, sa);
+
+        /* profile uses the old style capability check for ptrace */
+        if (&tracer->label == tracee)
                 return 0;
 
         aad(sa)->label = &tracer->label;
-        aad(sa)->peer = &tracee->label;
+        aad(sa)->peer = tracee;
         aad(sa)->request = 0;
         aad(sa)->error = aa_capable(&tracer->label, CAP_SYS_PTRACE, 1);
 
@@ -115,10 +123,13 @@ static int cross_ptrace_perm(struct aa_profile *tracer,
 int aa_may_ptrace(struct aa_label *tracer, struct aa_label *tracee,
                   u32 request)
 {
+        struct aa_profile *profile;
+        u32 xrequest = request << PTRACE_PERM_SHIFT;
         DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_PTRACE);
 
-        return xcheck_labels_profiles(tracer, tracee, cross_ptrace_perm,
-                                      request, &sa);
+        return xcheck_labels(tracer, tracee, profile,
+                        profile_tracer_perm(profile, tracee, request, &sa),
+                        profile_tracee_perm(profile, tracer, xrequest, &sa));
 }
 
 
diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c
index ed9b4d0f9f7e..8c558cbce930 100644
--- a/security/apparmor/mount.c
+++ b/security/apparmor/mount.c
@@ -329,6 +329,9 @@ static int match_mnt_path_str(struct aa_profile *profile,
         AA_BUG(!mntpath);
         AA_BUG(!buffer);
 
+        if (!PROFILE_MEDIATES(profile, AA_CLASS_MOUNT))
+                return 0;
+
         error = aa_path_name(mntpath, path_flags(profile, mntpath), buffer,
                              &mntpnt, &info, profile->disconnected);
         if (error)
@@ -380,6 +383,9 @@ static int match_mnt(struct aa_profile *profile, const struct path *path,
         AA_BUG(!profile);
         AA_BUG(devpath && !devbuffer);
 
+        if (!PROFILE_MEDIATES(profile, AA_CLASS_MOUNT))
+                return 0;
+
         if (devpath) {
                 error = aa_path_name(devpath, path_flags(profile, devpath),
                                      devbuffer, &devname, &info,
@@ -558,6 +564,9 @@ static int profile_umount(struct aa_profile *profile, struct path *path,
         AA_BUG(!profile);
         AA_BUG(!path);
 
+        if (!PROFILE_MEDIATES(profile, AA_CLASS_MOUNT))
+                return 0;
+
         error = aa_path_name(path, path_flags(profile, path), buffer, &name,
                              &info, profile->disconnected);
         if (error)
@@ -613,7 +622,8 @@ static struct aa_label *build_pivotroot(struct aa_profile *profile,
         AA_BUG(!new_path);
         AA_BUG(!old_path);
 
-        if (profile_unconfined(profile))
+        if (profile_unconfined(profile) ||
+            !PROFILE_MEDIATES(profile, AA_CLASS_MOUNT))
                 return aa_get_newest_label(&profile->label);
 
         error = aa_path_name(old_path, path_flags(profile, old_path),
diff --git a/security/commoncap.c b/security/commoncap.c
index 4f8e09340956..48620c93d697 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -348,21 +348,18 @@ static __u32 sansflags(__u32 m)
         return m & ~VFS_CAP_FLAGS_EFFECTIVE;
 }
 
-static bool is_v2header(size_t size, __le32 magic)
+static bool is_v2header(size_t size, const struct vfs_cap_data *cap)
 {
-        __u32 m = le32_to_cpu(magic);
         if (size != XATTR_CAPS_SZ_2)
                 return false;
-        return sansflags(m) == VFS_CAP_REVISION_2;
+        return sansflags(le32_to_cpu(cap->magic_etc)) == VFS_CAP_REVISION_2;
 }
 
-static bool is_v3header(size_t size, __le32 magic)
+static bool is_v3header(size_t size, const struct vfs_cap_data *cap)
 {
-        __u32 m = le32_to_cpu(magic);
-
         if (size != XATTR_CAPS_SZ_3)
                 return false;
-        return sansflags(m) == VFS_CAP_REVISION_3;
+        return sansflags(le32_to_cpu(cap->magic_etc)) == VFS_CAP_REVISION_3;
 }
 
 /*
@@ -405,7 +402,7 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
 
         fs_ns = inode->i_sb->s_user_ns;
         cap = (struct vfs_cap_data *) tmpbuf;
-        if (is_v2header((size_t) ret, cap->magic_etc)) {
+        if (is_v2header((size_t) ret, cap)) {
                 /* If this is sizeof(vfs_cap_data) then we're ok with the
                  * on-disk value, so return that.  */
                 if (alloc)
@@ -413,7 +410,7 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
                 else
                         kfree(tmpbuf);
                 return ret;
-        } else if (!is_v3header((size_t) ret, cap->magic_etc)) {
+        } else if (!is_v3header((size_t) ret, cap)) {
                 kfree(tmpbuf);
                 return -EINVAL;
         }
@@ -470,9 +467,9 @@ static kuid_t rootid_from_xattr(const void *value, size_t size,
         return make_kuid(task_ns, rootid);
 }
 
-static bool validheader(size_t size, __le32 magic)
+static bool validheader(size_t size, const struct vfs_cap_data *cap)
 {
-        return is_v2header(size, magic) || is_v3header(size, magic);
+        return is_v2header(size, cap) || is_v3header(size, cap);
 }
 
 /*
@@ -495,7 +492,7 @@ int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size)
 
         if (!*ivalue)
                 return -EINVAL;
-        if (!validheader(size, cap->magic_etc))
+        if (!validheader(size, cap))
                 return -EINVAL;
         if (!capable_wrt_inode_uidgid(inode, CAP_SETFCAP))
                 return -EPERM;
diff --git a/security/keys/key.c b/security/keys/key.c
index 66049183ad89..d97c9394b5dd 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -833,7 +833,6 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
 
         key_check(keyring);
 
-        key_ref = ERR_PTR(-EPERM);
         if (!(flags & KEY_ALLOC_BYPASS_RESTRICTION))
                 restrict_link = keyring->restrict_link;
 
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 76d22f726ae4..1ffe60bb2845 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -1588,9 +1588,8 @@ error_keyring:
  * The caller must have Setattr permission to change keyring restrictions.
  *
  * The requested type name may be a NULL pointer to reject all attempts
- * to link to the keyring. If _type is non-NULL, _restriction can be
- * NULL or a pointer to a string describing the restriction. If _type is
- * NULL, _restriction must also be NULL.
+ * to link to the keyring.  In this case, _restriction must also be NULL.
+ * Otherwise, both _type and _restriction must be non-NULL.
  *
  * Returns 0 if successful.
  */
@@ -1598,7 +1597,6 @@ long keyctl_restrict_keyring(key_serial_t id, const char __user *_type,
                              const char __user *_restriction)
 {
         key_ref_t key_ref;
-        bool link_reject = !_type;
         char type[32];
         char *restriction = NULL;
         long ret;
@@ -1607,31 +1605,29 @@ long keyctl_restrict_keyring(key_serial_t id, const char __user *_type,
         if (IS_ERR(key_ref))
                 return PTR_ERR(key_ref);
 
+        ret = -EINVAL;
         if (_type) {
-                ret = key_get_type_from_user(type, _type, sizeof(type));
-                if (ret < 0)
+                if (!_restriction)
                         goto error;
-        }
 
-        if (_restriction) {
-                if (!_type) {
-                        ret = -EINVAL;
+                ret = key_get_type_from_user(type, _type, sizeof(type));
+                if (ret < 0)
                         goto error;
-                }
 
                 restriction = strndup_user(_restriction, PAGE_SIZE);
                 if (IS_ERR(restriction)) {
                         ret = PTR_ERR(restriction);
                         goto error;
                 }
+        } else {
+                if (_restriction)
+                        goto error;
         }
 
-        ret = keyring_restrict(key_ref, link_reject ? NULL : type, restriction);
+        ret = keyring_restrict(key_ref, _type ? type : NULL, restriction);
         kfree(restriction);
-
 error:
         key_ref_put(key_ref);
-
         return ret;
 }
 
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index e8036cd0ad54..114f7408feee 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -251,11 +251,12 @@ static int construct_key(struct key *key, const void *callout_info,
  * The keyring selected is returned with an extra reference upon it which the
  * caller must release.
  */
-static void construct_get_dest_keyring(struct key **_dest_keyring)
+static int construct_get_dest_keyring(struct key **_dest_keyring)
 {
         struct request_key_auth *rka;
         const struct cred *cred = current_cred();
         struct key *dest_keyring = *_dest_keyring, *authkey;
+        int ret;
 
         kenter("%p", dest_keyring);
 
@@ -264,6 +265,8 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
                 /* the caller supplied one */
                 key_get(dest_keyring);
         } else {
+                bool do_perm_check = true;
+
                 /* use a default keyring; falling through the cases until we
                  * find one that we actually have */
                 switch (cred->jit_keyring) {
@@ -278,8 +281,10 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
                                         dest_keyring =
                                                 key_get(rka->dest_keyring);
                                 up_read(&authkey->sem);
-                                if (dest_keyring)
+                                if (dest_keyring) {
+                                        do_perm_check = false;
                                         break;
+                                }
                         }
 
                 case KEY_REQKEY_DEFL_THREAD_KEYRING:
@@ -314,11 +319,29 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
                 default:
                         BUG();
                 }
+
+                /*
+                 * Require Write permission on the keyring.  This is essential
+                 * because the default keyring may be the session keyring, and
+                 * joining a keyring only requires Search permission.
+                 *
+                 * However, this check is skipped for the "requestor keyring" so
+                 * that /sbin/request-key can itself use request_key() to add
+                 * keys to the original requestor's destination keyring.
+                 */
+                if (dest_keyring && do_perm_check) {
+                        ret = key_permission(make_key_ref(dest_keyring, 1),
+                                             KEY_NEED_WRITE);
+                        if (ret) {
+                                key_put(dest_keyring);
+                                return ret;
+                        }
+                }
         }
 
         *_dest_keyring = dest_keyring;
         kleave(" [dk %d]", key_serial(dest_keyring));
-        return;
+        return 0;
 }
 
 /*
@@ -444,11 +467,15 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
         if (ctx->index_key.type == &key_type_keyring)
                 return ERR_PTR(-EPERM);
 
-        user = key_user_lookup(current_fsuid());
-        if (!user)
-                return ERR_PTR(-ENOMEM);
+        ret = construct_get_dest_keyring(&dest_keyring);
+        if (ret)
+                goto error;
 
-        construct_get_dest_keyring(&dest_keyring);
+        user = key_user_lookup(current_fsuid());
+        if (!user) {
+                ret = -ENOMEM;
+                goto error_put_dest_keyring;
+        }
 
         ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key);
         key_user_put(user);
@@ -463,7 +490,7 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
         } else if (ret == -EINPROGRESS) {
                 ret = 0;
         } else {
-                goto couldnt_alloc_key;
+                goto error_put_dest_keyring;
         }
 
         key_put(dest_keyring);
@@ -473,8 +500,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
 construction_failed:
         key_negate_and_link(key, key_negative_timeout, NULL, NULL);
         key_put(key);
-couldnt_alloc_key:
+error_put_dest_keyring:
         key_put(dest_keyring);
+error:
         kleave(" = %d", ret);
         return ERR_PTR(ret);
 }
@@ -546,9 +574,7 @@ struct key *request_key_and_link(struct key_type *type,
         if (!IS_ERR(key_ref)) {
                 key = key_ref_to_ptr(key_ref);
                 if (dest_keyring) {
-                        construct_get_dest_keyring(&dest_keyring);
                         ret = key_link(dest_keyring, key);
-                        key_put(dest_keyring);
                         if (ret < 0) {
                                 key_put(key);
                                 key = ERR_PTR(ret);
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index e49f448ee04f..c2db7e905f7d 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -455,7 +455,6 @@ static int snd_pcm_hw_param_near(struct snd_pcm_substream *pcm,
                 v = snd_pcm_hw_param_last(pcm, params, var, dir);
         else
                 v = snd_pcm_hw_param_first(pcm, params, var, dir);
-        snd_BUG_ON(v < 0);
         return v;
 }
 
@@ -1335,8 +1334,11 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha
 
         if ((tmp = snd_pcm_oss_make_ready(substream)) < 0)
                 return tmp;
-        mutex_lock(&runtime->oss.params_lock);
         while (bytes > 0) {
+                if (mutex_lock_interruptible(&runtime->oss.params_lock)) {
+                        tmp = -ERESTARTSYS;
+                        break;
+                }
                 if (bytes < runtime->oss.period_bytes || runtime->oss.buffer_used > 0) {
                         tmp = bytes;
                         if (tmp + runtime->oss.buffer_used > runtime->oss.period_bytes)
@@ -1380,14 +1382,18 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha
                         xfer += tmp;
                         if ((substream->f_flags & O_NONBLOCK) != 0 &&
                             tmp != runtime->oss.period_bytes)
-                                break;
+                                tmp = -EAGAIN;
                 }
-        }
-        mutex_unlock(&runtime->oss.params_lock);
-        return xfer;
-
  err:
-        mutex_unlock(&runtime->oss.params_lock);
+                mutex_unlock(&runtime->oss.params_lock);
+                if (tmp < 0)
+                        break;
+                if (signal_pending(current)) {
+                        tmp = -ERESTARTSYS;
+                        break;
+                }
+                tmp = 0;
+        }
         return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp;
 }
 
@@ -1435,8 +1441,11 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use
 
         if ((tmp = snd_pcm_oss_make_ready(substream)) < 0)
                 return tmp;
-        mutex_lock(&runtime->oss.params_lock);
         while (bytes > 0) {
+                if (mutex_lock_interruptible(&runtime->oss.params_lock)) {
+                        tmp = -ERESTARTSYS;
+                        break;
+                }
                 if (bytes < runtime->oss.period_bytes || runtime->oss.buffer_used > 0) {
                         if (runtime->oss.buffer_used == 0) {
                                 tmp = snd_pcm_oss_read2(substream, runtime->oss.buffer, runtime->oss.period_bytes, 1);
@@ -1467,12 +1476,16 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use
                         bytes -= tmp;
                         xfer += tmp;
                 }
-        }
-        mutex_unlock(&runtime->oss.params_lock);
-        return xfer;
-
  err:
-        mutex_unlock(&runtime->oss.params_lock);
+                mutex_unlock(&runtime->oss.params_lock);
+                if (tmp < 0)
+                        break;
+                if (signal_pending(current)) {
+                        tmp = -ERESTARTSYS;
+                        break;
+                }
+                tmp = 0;
+        }
         return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp;
 }
 
diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
index cadc93792868..85a56af104bd 100644
--- a/sound/core/oss/pcm_plugin.c
+++ b/sound/core/oss/pcm_plugin.c
@@ -592,18 +592,26 @@ snd_pcm_sframes_t snd_pcm_plug_write_transfer(struct snd_pcm_substream *plug, st
         snd_pcm_sframes_t frames = size;
 
         plugin = snd_pcm_plug_first(plug);
-        while (plugin && frames > 0) {
+        while (plugin) {
+                if (frames <= 0)
+                        return frames;
                 if ((next = plugin->next) != NULL) {
                         snd_pcm_sframes_t frames1 = frames;
-                        if (plugin->dst_frames)
+                        if (plugin->dst_frames) {
                                 frames1 = plugin->dst_frames(plugin, frames);
+                                if (frames1 <= 0)
+                                        return frames1;
+                        }
                         if ((err = next->client_channels(next, frames1, &dst_channels)) < 0) {
                                 return err;
                         }
                         if (err != frames1) {
                                 frames = err;
-                                if (plugin->src_frames)
+                                if (plugin->src_frames) {
                                         frames = plugin->src_frames(plugin, frames1);
+                                        if (frames <= 0)
+                                                return frames;
+                                }
                         }
                 } else
                         dst_channels = NULL;
diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index 9070f277f8db..09ee8c6b9f75 100644
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -153,7 +153,9 @@ static int snd_pcm_control_ioctl(struct snd_card *card,
                                 err = -ENXIO;
                                 goto _error;
                         }
+                        mutex_lock(&pcm->open_mutex);
                         err = snd_pcm_info_user(substream, info);
+                        mutex_unlock(&pcm->open_mutex);
                 _error:
                         mutex_unlock(&register_mutex);
                         return err;
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 10e7ef7a8804..faa67861cbc1 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -560,7 +560,6 @@ static inline unsigned int muldiv32(unsigned int a, unsigned int b,
 {
         u_int64_t n = (u_int64_t) a * b;
         if (c == 0) {
-                snd_BUG_ON(!n);
                 *r = 0;
                 return UINT_MAX;
         }
@@ -1632,7 +1631,7 @@ int snd_pcm_hw_param_first(struct snd_pcm_substream *pcm,
                 return changed;
         if (params->rmask) {
                 int err = snd_pcm_hw_refine(pcm, params);
-                if (snd_BUG_ON(err < 0))
+                if (err < 0)
                         return err;
         }
         return snd_pcm_hw_param_value(params, var, dir);
@@ -1678,7 +1677,7 @@ int snd_pcm_hw_param_last(struct snd_pcm_substream *pcm,
                 return changed;
         if (params->rmask) {
                 int err = snd_pcm_hw_refine(pcm, params);
-                if (snd_BUG_ON(err < 0))
+                if (err < 0)
                         return err;
         }
         return snd_pcm_hw_param_value(params, var, dir);
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index a4d92e46c459..f08772568c17 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -2580,7 +2580,7 @@ static snd_pcm_sframes_t forward_appl_ptr(struct snd_pcm_substream *substream,
         return ret < 0 ? ret : frames;
 }
 
-/* decrease the appl_ptr; returns the processed frames or a negative error */
+/* decrease the appl_ptr; returns the processed frames or zero for error */
 static snd_pcm_sframes_t rewind_appl_ptr(struct snd_pcm_substream *substream,
                                          snd_pcm_uframes_t frames,
                                          snd_pcm_sframes_t avail)
@@ -2597,7 +2597,12 @@ static snd_pcm_sframes_t rewind_appl_ptr(struct snd_pcm_substream *substream,
         if (appl_ptr < 0)
                 appl_ptr += runtime->boundary;
         ret = pcm_lib_apply_appl_ptr(substream, appl_ptr);
-        return ret < 0 ? ret : frames;
+        /* NOTE: we return zero for errors because PulseAudio gets depressed
+         * upon receiving an error from rewind ioctl and stops processing
+         * any longer.  Returning zero means that no rewind is done, so
+         * it's not absolutely wrong to answer like that.
+         */
+        return ret < 0 ? 0 : frames;
 }
 
 static snd_pcm_sframes_t snd_pcm_playback_rewind(struct snd_pcm_substream *substream,
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index b3b353d72527..f055ca10bbc1 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -579,15 +579,14 @@ static int snd_rawmidi_info_user(struct snd_rawmidi_substream *substream,
         return 0;
 }
 
-int snd_rawmidi_info_select(struct snd_card *card, struct snd_rawmidi_info *info)
+static int __snd_rawmidi_info_select(struct snd_card *card,
+                                     struct snd_rawmidi_info *info)
 {
         struct snd_rawmidi *rmidi;
         struct snd_rawmidi_str *pstr;
         struct snd_rawmidi_substream *substream;
 
-        mutex_lock(&register_mutex);
         rmidi = snd_rawmidi_search(card, info->device);
-        mutex_unlock(&register_mutex);
         if (!rmidi)
                 return -ENXIO;
         if (info->stream < 0 || info->stream > 1)
@@ -603,6 +602,16 @@ int snd_rawmidi_info_select(struct snd_card *card, struct snd_rawmidi_info *info
         }
         return -ENXIO;
 }
+
+int snd_rawmidi_info_select(struct snd_card *card, struct snd_rawmidi_info *info)
+{
+        int ret;
+
+        mutex_lock(&register_mutex);
+        ret = __snd_rawmidi_info_select(card, info);
+        mutex_unlock(&register_mutex);
+        return ret;
+}
 EXPORT_SYMBOL(snd_rawmidi_info_select);
 
 static int snd_rawmidi_info_select_user(struct snd_card *card,
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 6e22eea72654..d01913404581 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -221,6 +221,7 @@ static struct snd_seq_client *seq_create_client1(int client_index, int poolsize)
         rwlock_init(&client->ports_lock);
         mutex_init(&client->ports_mutex);
         INIT_LIST_HEAD(&client->ports_list_head);
+        mutex_init(&client->ioctl_mutex);
 
         /* find free slot in the client table */
         spin_lock_irqsave(&clients_lock, flags);
@@ -2130,7 +2131,9 @@ static long snd_seq_ioctl(struct file *file, unsigned int cmd,
                         return -EFAULT;
         }
 
+        mutex_lock(&client->ioctl_mutex);
         err = handler->func(client, &buf);
+        mutex_unlock(&client->ioctl_mutex);
         if (err >= 0) {
                 /* Some commands includes a bug in 'dir' field. */
                 if (handler->cmd == SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT ||
diff --git a/sound/core/seq/seq_clientmgr.h b/sound/core/seq/seq_clientmgr.h
index c6614254ef8a..0611e1e0ed5b 100644
--- a/sound/core/seq/seq_clientmgr.h
+++ b/sound/core/seq/seq_clientmgr.h
@@ -61,6 +61,7 @@ struct snd_seq_client {
         struct list_head ports_list_head;
         rwlock_t ports_lock;
         struct mutex ports_mutex;
+        struct mutex ioctl_mutex;
         int convert32;          /* convert 32->64bit */
 
         /* output pool */
diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
index 37d9cfbc29f9..b80985fbc334 100644
--- a/sound/core/seq/seq_timer.c
+++ b/sound/core/seq/seq_timer.c
@@ -355,7 +355,7 @@ static int initialize_timer(struct snd_seq_timer *tmr)
         unsigned long freq;
 
         t = tmr->timeri->timer;
-        if (snd_BUG_ON(!t))
+        if (!t)
                 return -EINVAL;
 
         freq = tmr->preferred_resolution;
diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index afac886ffa28..0333143a1fa7 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -39,6 +39,7 @@
 #include <sound/core.h>
 #include <sound/control.h>
 #include <sound/pcm.h>
+#include <sound/pcm_params.h>
 #include <sound/info.h>
 #include <sound/initval.h>
 
@@ -305,19 +306,6 @@ static int loopback_trigger(struct snd_pcm_substream *substream, int cmd)
         return 0;
 }
 
-static void params_change_substream(struct loopback_pcm *dpcm,
-                                    struct snd_pcm_runtime *runtime)
-{
-        struct snd_pcm_runtime *dst_runtime;
-
-        if (dpcm == NULL || dpcm->substream == NULL)
-                return;
-        dst_runtime = dpcm->substream->runtime;
-        if (dst_runtime == NULL)
-                return;
-        dst_runtime->hw = dpcm->cable->hw;
-}
-
 static void params_change(struct snd_pcm_substream *substream)
 {
         struct snd_pcm_runtime *runtime = substream->runtime;
@@ -329,10 +317,6 @@ static void params_change(struct snd_pcm_substream *substream)
         cable->hw.rate_max = runtime->rate;
         cable->hw.channels_min = runtime->channels;
         cable->hw.channels_max = runtime->channels;
-        params_change_substream(cable->streams[SNDRV_PCM_STREAM_PLAYBACK],
-                                runtime);
-        params_change_substream(cable->streams[SNDRV_PCM_STREAM_CAPTURE],
-                                runtime);
 }
 
 static int loopback_prepare(struct snd_pcm_substream *substream)
@@ -620,26 +604,29 @@ static unsigned int get_cable_index(struct snd_pcm_substream *substream)
 static int rule_format(struct snd_pcm_hw_params *params,
                        struct snd_pcm_hw_rule *rule)
 {
+        struct loopback_pcm *dpcm = rule->private;
+        struct loopback_cable *cable = dpcm->cable;
+        struct snd_mask m;
 
-        struct snd_pcm_hardware *hw = rule->private;
-        struct snd_mask *maskp = hw_param_mask(params, rule->var);
-
-        maskp->bits[0] &= (u_int32_t)hw->formats;
-        maskp->bits[1] &= (u_int32_t)(hw->formats >> 32);
-        memset(maskp->bits + 2, 0, (SNDRV_MASK_MAX-64) / 8); /* clear rest */
-        if (! maskp->bits[0] && ! maskp->bits[1])
-                return -EINVAL;
-        return 0;
+        snd_mask_none(&m);
+        mutex_lock(&dpcm->loopback->cable_lock);
+        m.bits[0] = (u_int32_t)cable->hw.formats;
+        m.bits[1] = (u_int32_t)(cable->hw.formats >> 32);
+        mutex_unlock(&dpcm->loopback->cable_lock);
+        return snd_mask_refine(hw_param_mask(params, rule->var), &m);
 }
 
 static int rule_rate(struct snd_pcm_hw_params *params,
                      struct snd_pcm_hw_rule *rule)
 {
-        struct snd_pcm_hardware *hw = rule->private;
+        struct loopback_pcm *dpcm = rule->private;
+        struct loopback_cable *cable = dpcm->cable;
         struct snd_interval t;
 
-        t.min = hw->rate_min;
-        t.max = hw->rate_max;
+        mutex_lock(&dpcm->loopback->cable_lock);
+        t.min = cable->hw.rate_min;
+        t.max = cable->hw.rate_max;
+        mutex_unlock(&dpcm->loopback->cable_lock);
         t.openmin = t.openmax = 0;
         t.integer = 0;
         return snd_interval_refine(hw_param_interval(params, rule->var), &t);
@@ -648,22 +635,44 @@ static int rule_rate(struct snd_pcm_hw_params *params,
 static int rule_channels(struct snd_pcm_hw_params *params,
                          struct snd_pcm_hw_rule *rule)
 {
-        struct snd_pcm_hardware *hw = rule->private;
+        struct loopback_pcm *dpcm = rule->private;
+        struct loopback_cable *cable = dpcm->cable;
         struct snd_interval t;
 
-        t.min = hw->channels_min;
-        t.max = hw->channels_max;
+        mutex_lock(&dpcm->loopback->cable_lock);
+        t.min = cable->hw.channels_min;
+        t.max = cable->hw.channels_max;
+        mutex_unlock(&dpcm->loopback->cable_lock);
         t.openmin = t.openmax = 0;
         t.integer = 0;
         return snd_interval_refine(hw_param_interval(params, rule->var), &t);
 }
 
+static void free_cable(struct snd_pcm_substream *substream)
+{
+        struct loopback *loopback = substream->private_data;
+        int dev = get_cable_index(substream);
+        struct loopback_cable *cable;
+
+        cable = loopback->cables[substream->number][dev];
+        if (!cable)
+                return;
+        if (cable->streams[!substream->stream]) {
+                /* other stream is still alive */
+                cable->streams[substream->stream] = NULL;
+        } else {
+                /* free the cable */
+                loopback->cables[substream->number][dev] = NULL;
+                kfree(cable);
+        }
+}
+
 static int loopback_open(struct snd_pcm_substream *substream)
 {
         struct snd_pcm_runtime *runtime = substream->runtime;
         struct loopback *loopback = substream->private_data;
         struct loopback_pcm *dpcm;
-        struct loopback_cable *cable;
+        struct loopback_cable *cable = NULL;
         int err = 0;
         int dev = get_cable_index(substream);
 
@@ -681,7 +690,6 @@ static int loopback_open(struct snd_pcm_substream *substream)
         if (!cable) {
                 cable = kzalloc(sizeof(*cable), GFP_KERNEL);
                 if (!cable) {
-                        kfree(dpcm);
                         err = -ENOMEM;
                         goto unlock;
                 }
@@ -699,19 +707,19 @@ static int loopback_open(struct snd_pcm_substream *substream)
         /* are cached -> they do not reflect the actual state */
         err = snd_pcm_hw_rule_add(runtime, 0,
                                   SNDRV_PCM_HW_PARAM_FORMAT,
-                                  rule_format, &runtime->hw,
+                                  rule_format, dpcm,
                                   SNDRV_PCM_HW_PARAM_FORMAT, -1);
         if (err < 0)
                 goto unlock;
         err = snd_pcm_hw_rule_add(runtime, 0,
                                   SNDRV_PCM_HW_PARAM_RATE,
-                                  rule_rate, &runtime->hw,
+                                  rule_rate, dpcm,
                                   SNDRV_PCM_HW_PARAM_RATE, -1);
         if (err < 0)
                 goto unlock;
         err = snd_pcm_hw_rule_add(runtime, 0,
                                   SNDRV_PCM_HW_PARAM_CHANNELS,
-                                  rule_channels, &runtime->hw,
+                                  rule_channels, dpcm,
                                   SNDRV_PCM_HW_PARAM_CHANNELS, -1);
         if (err < 0)
                 goto unlock;
@@ -723,6 +731,10 @@ static int loopback_open(struct snd_pcm_substream *substream)
         else
                 runtime->hw = cable->hw;
  unlock:
+        if (err < 0) {
+                free_cable(substream);
+                kfree(dpcm);
+        }
         mutex_unlock(&loopback->cable_lock);
         return err;
 }
@@ -731,20 +743,10 @@ static int loopback_close(struct snd_pcm_substream *substream)
 {
         struct loopback *loopback = substream->private_data;
         struct loopback_pcm *dpcm = substream->runtime->private_data;
-        struct loopback_cable *cable;
-        int dev = get_cable_index(substream);
 
         loopback_timer_stop(dpcm);
         mutex_lock(&loopback->cable_lock);
-        cable = loopback->cables[substream->number][dev];
-        if (cable->streams[!substream->stream]) {
-                /* other stream is still alive */
-                cable->streams[substream->stream] = NULL;
-        } else {
-                /* free the cable */
-                loopback->cables[substream->number][dev] = NULL;
-                kfree(cable);
-        }
+        free_cable(substream);
         mutex_unlock(&loopback->cable_lock);
         return 0;
 }
diff --git a/sound/hda/hdac_i915.c b/sound/hda/hdac_i915.c
index 038a180d3f81..cbe818eda336 100644
--- a/sound/hda/hdac_i915.c
+++ b/sound/hda/hdac_i915.c
@@ -325,7 +325,7 @@ static int hdac_component_master_match(struct device *dev, void *data)
  */
 int snd_hdac_i915_register_notifier(const struct i915_audio_component_audio_ops *aops)
 {
-        if (WARN_ON(!hdac_acomp))
+        if (!hdac_acomp)
                 return -ENODEV;
 
         hdac_acomp->audio_ops = aops;
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 80bbadc83721..d6e079f4ec09 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -408,6 +408,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = {
         /*SND_PCI_QUIRK(0x8086, 0x7270, "IMac 27 Inch", CS420X_IMAC27),*/
 
         /* codec SSID */
+        SND_PCI_QUIRK(0x106b, 0x0600, "iMac 14,1", CS420X_IMAC27_122),
         SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81),
         SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122),
         SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index a81aacf684b2..37e1cf8218ff 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -271,6 +271,8 @@ enum {
         CXT_FIXUP_HP_SPECTRE,
         CXT_FIXUP_HP_GATE_MIC,
         CXT_FIXUP_MUTE_LED_GPIO,
+        CXT_FIXUP_HEADSET_MIC,
+        CXT_FIXUP_HP_MIC_NO_PRESENCE,
 };
 
 /* for hda_fixup_thinkpad_acpi() */
@@ -350,6 +352,18 @@ static void cxt_fixup_headphone_mic(struct hda_codec *codec,
         }
 }
 
+static void cxt_fixup_headset_mic(struct hda_codec *codec,
+                                    const struct hda_fixup *fix, int action)
+{
+        struct conexant_spec *spec = codec->spec;
+
+        switch (action) {
+        case HDA_FIXUP_ACT_PRE_PROBE:
+                spec->parse_flags |= HDA_PINCFG_HEADSET_MIC;
+                break;
+        }
+}
+
 /* OPLC XO 1.5 fixup */
 
 /* OLPC XO-1.5 supports DC input mode (e.g. for use with analog sensors)
@@ -880,6 +894,19 @@ static const struct hda_fixup cxt_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = cxt_fixup_mute_led_gpio,
         },
+        [CXT_FIXUP_HEADSET_MIC] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = cxt_fixup_headset_mic,
+        },
+        [CXT_FIXUP_HP_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x1a, 0x02a1113c },
+                        { }
+                },
+                .chained = true,
+                .chain_id = CXT_FIXUP_HEADSET_MIC,
+        },
 };
 
 static const struct snd_pci_quirk cxt5045_fixups[] = {
@@ -934,6 +961,8 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC),
         SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
         SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO),
+        SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
         SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index c19c81d230bd..b4f1b6e88305 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -55,10 +55,11 @@ MODULE_PARM_DESC(static_hdmi_pcm, "Don't restrict PCM parameters per ELD info");
 #define is_kabylake(codec) ((codec)->core.vendor_id == 0x8086280b)
 #define is_geminilake(codec) (((codec)->core.vendor_id == 0x8086280d) || \
                                 ((codec)->core.vendor_id == 0x80862800))
+#define is_cannonlake(codec) ((codec)->core.vendor_id == 0x8086280c)
 #define is_haswell_plus(codec) (is_haswell(codec) || is_broadwell(codec) \
                                 || is_skylake(codec) || is_broxton(codec) \
-                                || is_kabylake(codec)) || is_geminilake(codec)
-
+                                || is_kabylake(codec)) || is_geminilake(codec) \
+                                || is_cannonlake(codec)
 #define is_valleyview(codec) ((codec)->core.vendor_id == 0x80862882)
 #define is_cherryview(codec) ((codec)->core.vendor_id == 0x80862883)
 #define is_valleyview_plus(codec) (is_valleyview(codec) || is_cherryview(codec))
@@ -3841,6 +3842,7 @@ HDA_CODEC_ENTRY(0x80862808, "Broadwell HDMI",	patch_i915_hsw_hdmi),
 HDA_CODEC_ENTRY(0x80862809, "Skylake HDMI",     patch_i915_hsw_hdmi),
 HDA_CODEC_ENTRY(0x8086280a, "Broxton HDMI",     patch_i915_hsw_hdmi),
 HDA_CODEC_ENTRY(0x8086280b, "Kabylake HDMI",    patch_i915_hsw_hdmi),
+HDA_CODEC_ENTRY(0x8086280c, "Cannonlake HDMI",  patch_i915_glk_hdmi),
 HDA_CODEC_ENTRY(0x8086280d, "Geminilake HDMI",  patch_i915_glk_hdmi),
 HDA_CODEC_ENTRY(0x80862800, "Geminilake HDMI",  patch_i915_glk_hdmi),
 HDA_CODEC_ENTRY(0x80862880, "CedarTrail HDMI",  patch_generic_hdmi),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 921a10eff43a..9aafc6c86132 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -324,21 +324,24 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
         case 0x10ec0292:
                 alc_update_coef_idx(codec, 0x4, 1<<15, 0);
                 break;
-        case 0x10ec0215:
         case 0x10ec0225:
+        case 0x10ec0295:
+        case 0x10ec0299:
+                alc_update_coef_idx(codec, 0x67, 0xf000, 0x3000);
+                /* fallthrough */
+        case 0x10ec0215:
         case 0x10ec0233:
         case 0x10ec0236:
         case 0x10ec0255:
         case 0x10ec0256:
+        case 0x10ec0257:
         case 0x10ec0282:
         case 0x10ec0283:
         case 0x10ec0286:
         case 0x10ec0288:
         case 0x10ec0285:
-        case 0x10ec0295:
         case 0x10ec0298:
         case 0x10ec0289:
-        case 0x10ec0299:
                 alc_update_coef_idx(codec, 0x10, 1<<9, 0);
                 break;
         case 0x10ec0275:
@@ -2772,6 +2775,7 @@ enum {
         ALC269_TYPE_ALC298,
         ALC269_TYPE_ALC255,
         ALC269_TYPE_ALC256,
+        ALC269_TYPE_ALC257,
         ALC269_TYPE_ALC215,
         ALC269_TYPE_ALC225,
         ALC269_TYPE_ALC294,
@@ -2805,6 +2809,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
         case ALC269_TYPE_ALC298:
         case ALC269_TYPE_ALC255:
         case ALC269_TYPE_ALC256:
+        case ALC269_TYPE_ALC257:
         case ALC269_TYPE_ALC215:
         case ALC269_TYPE_ALC225:
         case ALC269_TYPE_ALC294:
@@ -5182,6 +5187,22 @@ static void alc233_alc662_fixup_lenovo_dual_codecs(struct hda_codec *codec,
         }
 }
 
+/* Forcibly assign NID 0x03 to HP/LO while NID 0x02 to SPK for EQ */
+static void alc274_fixup_bind_dacs(struct hda_codec *codec,
+                                    const struct hda_fixup *fix, int action)
+{
+        struct alc_spec *spec = codec->spec;
+        static hda_nid_t preferred_pairs[] = {
+                0x21, 0x03, 0x1b, 0x03, 0x16, 0x02,
+                0
+        };
+
+        if (action != HDA_FIXUP_ACT_PRE_PROBE)
+                return;
+
+        spec->gen.preferred_dacs = preferred_pairs;
+}
+
 /* for hda_fixup_thinkpad_acpi() */
 #include "thinkpad_helper.c"
 
@@ -5299,6 +5320,8 @@ enum {
         ALC233_FIXUP_LENOVO_MULTI_CODECS,
         ALC294_FIXUP_LENOVO_MIC_LOCATION,
         ALC700_FIXUP_INTEL_REFERENCE,
+        ALC274_FIXUP_DELL_BIND_DACS,
+        ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -6109,6 +6132,21 @@ static const struct hda_fixup alc269_fixups[] = {
                         {}
                 }
         },
+        [ALC274_FIXUP_DELL_BIND_DACS] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc274_fixup_bind_dacs,
+                .chained = true,
+                .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE
+        },
+        [ALC274_FIXUP_DELL_AIO_LINEOUT_VERB] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x1b, 0x0401102f },
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC274_FIXUP_DELL_BIND_DACS
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6158,6 +6196,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
         SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
         SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+        SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
         SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
@@ -6292,6 +6331,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+        SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
         SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
         SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
@@ -6550,6 +6590,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x1b, 0x01011020},
                 {0x21, 0x02211010}),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60130},
+                {0x14, 0x90170110},
+                {0x1b, 0x01011020},
+                {0x21, 0x0221101f}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                 {0x12, 0x90a60160},
                 {0x14, 0x90170120},
                 {0x21, 0x02211030}),
@@ -6575,7 +6620,7 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x14, 0x90170110},
                 {0x1b, 0x90a70130},
                 {0x21, 0x03211020}),
-        SND_HDA_PIN_QUIRK(0x10ec0274, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+        SND_HDA_PIN_QUIRK(0x10ec0274, 0x1028, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
                 {0x12, 0xb7a60130},
                 {0x13, 0xb8a61140},
                 {0x16, 0x90170110},
@@ -6867,6 +6912,10 @@ static int patch_alc269(struct hda_codec *codec)
                 spec->gen.mixer_nid = 0; /* ALC256 does not have any loopback mixer path */
                 alc_update_coef_idx(codec, 0x36, 1 << 13, 1 << 5); /* Switch pcbeep path to Line in path*/
                 break;
+        case 0x10ec0257:
+                spec->codec_variant = ALC269_TYPE_ALC257;
+                spec->gen.mixer_nid = 0;
+                break;
         case 0x10ec0215:
         case 0x10ec0285:
         case 0x10ec0289:
@@ -7914,6 +7963,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
         HDA_CODEC_ENTRY(0x10ec0236, "ALC236", patch_alc269),
         HDA_CODEC_ENTRY(0x10ec0255, "ALC255", patch_alc269),
         HDA_CODEC_ENTRY(0x10ec0256, "ALC256", patch_alc269),
+        HDA_CODEC_ENTRY(0x10ec0257, "ALC257", patch_alc269),
         HDA_CODEC_ENTRY(0x10ec0260, "ALC260", patch_alc260),
         HDA_CODEC_ENTRY(0x10ec0262, "ALC262", patch_alc262),
         HDA_CODEC_ENTRY(0x10ec0267, "ALC267", patch_alc268),
diff --git a/sound/soc/amd/acp-pcm-dma.c b/sound/soc/amd/acp-pcm-dma.c
index 9f521a55d610..b5e41df6bb3a 100644
--- a/sound/soc/amd/acp-pcm-dma.c
+++ b/sound/soc/amd/acp-pcm-dma.c
@@ -1051,6 +1051,11 @@ static int acp_audio_probe(struct platform_device *pdev)
         struct resource *res;
         const u32 *pdata = pdev->dev.platform_data;
 
+        if (!pdata) {
+                dev_err(&pdev->dev, "Missing platform data\n");
+                return -ENODEV;
+        }
+
         audio_drv_data = devm_kzalloc(&pdev->dev, sizeof(struct audio_drv_data),
                                         GFP_KERNEL);
         if (audio_drv_data == NULL)
@@ -1058,6 +1063,8 @@ static int acp_audio_probe(struct platform_device *pdev)
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         audio_drv_data->acp_mmio = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(audio_drv_data->acp_mmio))
+                return PTR_ERR(audio_drv_data->acp_mmio);
 
         /* The following members gets populated in device 'open'
          * function. Till then interrupts are disabled in 'acp_init'
diff --git a/sound/soc/atmel/Kconfig b/sound/soc/atmel/Kconfig
index 4a56f3dfba51..dcee145dd179 100644
--- a/sound/soc/atmel/Kconfig
+++ b/sound/soc/atmel/Kconfig
@@ -64,7 +64,7 @@ config SND_AT91_SOC_SAM9X5_WM8731
 config SND_ATMEL_SOC_CLASSD
         tristate "Atmel ASoC driver for boards using CLASSD"
         depends on ARCH_AT91 || COMPILE_TEST
-        select SND_ATMEL_SOC_DMA
+        select SND_SOC_GENERIC_DMAENGINE_PCM
         select REGMAP_MMIO
         help
           Say Y if you want to add support for Atmel ASoC driver for boards using
diff --git a/sound/soc/codecs/da7218.c b/sound/soc/codecs/da7218.c
index b2d42ec1dcd9..56564ce90cb6 100644
--- a/sound/soc/codecs/da7218.c
+++ b/sound/soc/codecs/da7218.c
@@ -2520,7 +2520,7 @@ static struct da7218_pdata *da7218_of_to_pdata(struct snd_soc_codec *codec)
         }
 
         if (da7218->dev_id == DA7218_DEV_ID) {
-                hpldet_np = of_find_node_by_name(np, "da7218_hpldet");
+                hpldet_np = of_get_child_by_name(np, "da7218_hpldet");
                 if (!hpldet_np)
                         return pdata;
 
diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c
index 5f3c42c4f74a..066ea2f4ce7b 100644
--- a/sound/soc/codecs/msm8916-wcd-analog.c
+++ b/sound/soc/codecs/msm8916-wcd-analog.c
@@ -267,7 +267,7 @@
 #define MSM8916_WCD_ANALOG_RATES (SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000 |\
                         SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_48000)
 #define MSM8916_WCD_ANALOG_FORMATS (SNDRV_PCM_FMTBIT_S16_LE |\
-                                    SNDRV_PCM_FMTBIT_S24_LE)
+                                    SNDRV_PCM_FMTBIT_S32_LE)
 
 static int btn_mask = SND_JACK_BTN_0 | SND_JACK_BTN_1 |
                SND_JACK_BTN_2 | SND_JACK_BTN_3 | SND_JACK_BTN_4;
diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c
index a10a724eb448..13354d6304a8 100644
--- a/sound/soc/codecs/msm8916-wcd-digital.c
+++ b/sound/soc/codecs/msm8916-wcd-digital.c
@@ -194,7 +194,7 @@
                                    SNDRV_PCM_RATE_32000 | \
                                    SNDRV_PCM_RATE_48000)
 #define MSM8916_WCD_DIGITAL_FORMATS (SNDRV_PCM_FMTBIT_S16_LE |\
-                                     SNDRV_PCM_FMTBIT_S24_LE)
+                                     SNDRV_PCM_FMTBIT_S32_LE)
 
 struct msm8916_wcd_digital_priv {
         struct clk *ahbclk, *mclk;
@@ -645,7 +645,7 @@ static int msm8916_wcd_digital_hw_params(struct snd_pcm_substream *substream,
                                     RX_I2S_CTL_RX_I2S_MODE_MASK,
                                     RX_I2S_CTL_RX_I2S_MODE_16);
                 break;
-        case SNDRV_PCM_FORMAT_S24_LE:
+        case SNDRV_PCM_FORMAT_S32_LE:
                 snd_soc_update_bits(dai->codec, LPASS_CDC_CLK_TX_I2S_CTL,
                                     TX_I2S_CTL_TX_I2S_MODE_MASK,
                                     TX_I2S_CTL_TX_I2S_MODE_32);
diff --git a/sound/soc/codecs/nau8825.c b/sound/soc/codecs/nau8825.c
index 714ce17da717..e853a6dfd33b 100644
--- a/sound/soc/codecs/nau8825.c
+++ b/sound/soc/codecs/nau8825.c
@@ -905,6 +905,7 @@ static int nau8825_adc_event(struct snd_soc_dapm_widget *w,
 
         switch (event) {
         case SND_SOC_DAPM_POST_PMU:
+                msleep(125);
                 regmap_update_bits(nau8825->regmap, NAU8825_REG_ENA_CTRL,
                         NAU8825_ENABLE_ADC, NAU8825_ENABLE_ADC);
                 break;
diff --git a/sound/soc/codecs/rt5514-spi.c b/sound/soc/codecs/rt5514-spi.c
index 2df91db765ac..64bf26cec20d 100644
--- a/sound/soc/codecs/rt5514-spi.c
+++ b/sound/soc/codecs/rt5514-spi.c
@@ -289,6 +289,8 @@ static int rt5514_spi_pcm_probe(struct snd_soc_platform *platform)
                         dev_err(&rt5514_spi->dev,
                                 "%s Failed to reguest IRQ: %d\n", __func__,
                                 ret);
+                else
+                        device_init_wakeup(rt5514_dsp->dev, true);
         }
 
         return 0;
@@ -456,8 +458,6 @@ static int rt5514_spi_probe(struct spi_device *spi)
                 return ret;
         }
 
-        device_init_wakeup(&spi->dev, true);
-
         return 0;
 }
 
@@ -482,10 +482,13 @@ static int __maybe_unused rt5514_resume(struct device *dev)
         if (device_may_wakeup(dev))
                 disable_irq_wake(irq);
 
-        if (rt5514_dsp->substream) {
-                rt5514_spi_burst_read(RT5514_IRQ_CTRL, (u8 *)&buf, sizeof(buf));
-                if (buf[0] & RT5514_IRQ_STATUS_BIT)
-                        rt5514_schedule_copy(rt5514_dsp);
+        if (rt5514_dsp) {
+                if (rt5514_dsp->substream) {
+                        rt5514_spi_burst_read(RT5514_IRQ_CTRL, (u8 *)&buf,
+                                sizeof(buf));
+                        if (buf[0] & RT5514_IRQ_STATUS_BIT)
+                                rt5514_schedule_copy(rt5514_dsp);
+                }
         }
 
         return 0;
diff --git a/sound/soc/codecs/rt5514.c b/sound/soc/codecs/rt5514.c
index 2a5b5d74e697..2dd6e9f990a4 100644
--- a/sound/soc/codecs/rt5514.c
+++ b/sound/soc/codecs/rt5514.c
@@ -496,7 +496,7 @@ static const struct snd_soc_dapm_widget rt5514_dapm_widgets[] = {
         SND_SOC_DAPM_PGA("DMIC1", SND_SOC_NOPM, 0, 0, NULL, 0),
         SND_SOC_DAPM_PGA("DMIC2", SND_SOC_NOPM, 0, 0, NULL, 0),
 
-        SND_SOC_DAPM_SUPPLY("DMIC CLK", SND_SOC_NOPM, 0, 0,
+        SND_SOC_DAPM_SUPPLY_S("DMIC CLK", 1, SND_SOC_NOPM, 0, 0,
                 rt5514_set_dmic_clk, SND_SOC_DAPM_PRE_PMU),
 
         SND_SOC_DAPM_SUPPLY("ADC CLK", RT5514_CLK_CTRL1,
diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index f020d2d1eef4..edc152c8a1fe 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -3823,6 +3823,8 @@ static int rt5645_i2c_probe(struct i2c_client *i2c,
         regmap_read(regmap, RT5645_VENDOR_ID, &val);
         rt5645->v_id = val & 0xff;
 
+        regmap_write(rt5645->regmap, RT5645_AD_DA_MIXER, 0x8080);
+
         ret = regmap_register_patch(rt5645->regmap, init_list,
                                     ARRAY_SIZE(init_list));
         if (ret != 0)
diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c
index b036c9dc0c8c..d329bf719d80 100644
--- a/sound/soc/codecs/rt5663.c
+++ b/sound/soc/codecs/rt5663.c
@@ -1560,6 +1560,10 @@ static int rt5663_jack_detect(struct snd_soc_codec *codec, int jack_insert)
                         RT5663_IRQ_POW_SAV_MASK, RT5663_IRQ_POW_SAV_EN);
                 snd_soc_update_bits(codec, RT5663_IRQ_1,
                         RT5663_EN_IRQ_JD1_MASK, RT5663_EN_IRQ_JD1_EN);
+                snd_soc_update_bits(codec, RT5663_EM_JACK_TYPE_1,
+                        RT5663_EM_JD_MASK, RT5663_EM_JD_RST);
+                snd_soc_update_bits(codec, RT5663_EM_JACK_TYPE_1,
+                        RT5663_EM_JD_MASK, RT5663_EM_JD_NOR);
 
                 while (true) {
                         regmap_read(rt5663->regmap, RT5663_INT_ST_2, &val);
diff --git a/sound/soc/codecs/rt5663.h b/sound/soc/codecs/rt5663.h
index c5a9b69579ad..03adc8004ba9 100644
--- a/sound/soc/codecs/rt5663.h
+++ b/sound/soc/codecs/rt5663.h
@@ -1029,6 +1029,10 @@
 #define RT5663_POL_EXT_JD_SHIFT                 10
 #define RT5663_POL_EXT_JD_EN                    (0x1 << 10)
 #define RT5663_POL_EXT_JD_DIS                   (0x0 << 10)
+#define RT5663_EM_JD_MASK                       (0x1 << 7)
+#define RT5663_EM_JD_SHIFT                      7
+#define RT5663_EM_JD_NOR                        (0x1 << 7)
+#define RT5663_EM_JD_RST                        (0x0 << 7)
 
 /* DACREF LDO Control (0x0112)*/
 #define RT5663_PWR_LDO_DACREFL_MASK             (0x1 << 9)
diff --git a/sound/soc/codecs/tlv320aic31xx.h b/sound/soc/codecs/tlv320aic31xx.h
index 730fb2058869..1ff3edb7bbb6 100644
--- a/sound/soc/codecs/tlv320aic31xx.h
+++ b/sound/soc/codecs/tlv320aic31xx.h
@@ -116,7 +116,7 @@ struct aic31xx_pdata {
 /* INT2 interrupt control */
 #define AIC31XX_INT2CTRL        AIC31XX_REG(0, 49)
 /* GPIO1 control */
-#define AIC31XX_GPIO1           AIC31XX_REG(0, 50)
+#define AIC31XX_GPIO1           AIC31XX_REG(0, 51)
 
 #define AIC31XX_DACPRB          AIC31XX_REG(0, 60)
 /* ADC Instruction Set Register */
diff --git a/sound/soc/codecs/twl4030.c b/sound/soc/codecs/twl4030.c
index c482b2e7a7d2..cfe72b9d4356 100644
--- a/sound/soc/codecs/twl4030.c
+++ b/sound/soc/codecs/twl4030.c
@@ -232,7 +232,7 @@ static struct twl4030_codec_data *twl4030_get_pdata(struct snd_soc_codec *codec)
         struct twl4030_codec_data *pdata = dev_get_platdata(codec->dev);
         struct device_node *twl4030_codec_node = NULL;
 
-        twl4030_codec_node = of_find_node_by_name(codec->dev->parent->of_node,
+        twl4030_codec_node = of_get_child_by_name(codec->dev->parent->of_node,
                                                   "codec");
 
         if (!pdata && twl4030_codec_node) {
@@ -241,9 +241,11 @@ static struct twl4030_codec_data *twl4030_get_pdata(struct snd_soc_codec *codec)
                                      GFP_KERNEL);
                 if (!pdata) {
                         dev_err(codec->dev, "Can not allocate memory\n");
+                        of_node_put(twl4030_codec_node);
                         return NULL;
                 }
                 twl4030_setup_pdata_of(pdata, twl4030_codec_node);
+                of_node_put(twl4030_codec_node);
         }
 
         return pdata;
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index 65c059b5ffd7..66e32f5d2917 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -1733,7 +1733,7 @@ static int wm_adsp_load(struct wm_adsp *dsp)
                  le64_to_cpu(footer->timestamp));
 
         while (pos < firmware->size &&
-               pos - firmware->size > sizeof(*region)) {
+               sizeof(*region) < firmware->size - pos) {
                 region = (void *)&(firmware->data[pos]);
                 region_name = "Unknown";
                 reg = 0;
@@ -1782,8 +1782,8 @@ static int wm_adsp_load(struct wm_adsp *dsp)
                          regions, le32_to_cpu(region->len), offset,
                          region_name);
 
-                if ((pos + le32_to_cpu(region->len) + sizeof(*region)) >
-                    firmware->size) {
+                if (le32_to_cpu(region->len) >
+                    firmware->size - pos - sizeof(*region)) {
                         adsp_err(dsp,
                                  "%s.%d: %s region len %d bytes exceeds file length %zu\n",
                                  file, regions, region_name,
@@ -2253,7 +2253,7 @@ static int wm_adsp_load_coeff(struct wm_adsp *dsp)
 
         blocks = 0;
         while (pos < firmware->size &&
-               pos - firmware->size > sizeof(*blk)) {
+               sizeof(*blk) < firmware->size - pos) {
                 blk = (void *)(&firmware->data[pos]);
 
                 type = le16_to_cpu(blk->type);
@@ -2327,8 +2327,8 @@ static int wm_adsp_load_coeff(struct wm_adsp *dsp)
                 }
 
                 if (reg) {
-                        if ((pos + le32_to_cpu(blk->len) + sizeof(*blk)) >
-                            firmware->size) {
+                        if (le32_to_cpu(blk->len) >
+                            firmware->size - pos - sizeof(*blk)) {
                                 adsp_err(dsp,
                                          "%s.%d: %s region len %d bytes exceeds file length %zu\n",
                                          file, blocks, region_name,
diff --git a/sound/soc/fsl/fsl_asrc.h b/sound/soc/fsl/fsl_asrc.h
index 0f163abe4ba3..52c27a358933 100644
--- a/sound/soc/fsl/fsl_asrc.h
+++ b/sound/soc/fsl/fsl_asrc.h
@@ -260,8 +260,8 @@
 #define ASRFSTi_OUTPUT_FIFO_SHIFT       12
 #define ASRFSTi_OUTPUT_FIFO_MASK        (((1 << ASRFSTi_OUTPUT_FIFO_WIDTH) - 1) << ASRFSTi_OUTPUT_FIFO_SHIFT)
 #define ASRFSTi_IAEi_SHIFT              11
-#define ASRFSTi_IAEi_MASK               (1 << ASRFSTi_OAFi_SHIFT)
-#define ASRFSTi_IAEi                    (1 << ASRFSTi_OAFi_SHIFT)
+#define ASRFSTi_IAEi_MASK               (1 << ASRFSTi_IAEi_SHIFT)
+#define ASRFSTi_IAEi                    (1 << ASRFSTi_IAEi_SHIFT)
 #define ASRFSTi_INPUT_FIFO_WIDTH        7
 #define ASRFSTi_INPUT_FIFO_SHIFT        0
 #define ASRFSTi_INPUT_FIFO_MASK         ((1 << ASRFSTi_INPUT_FIFO_WIDTH) - 1)
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index f2f51e06e22c..424bafaf51ef 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -38,6 +38,7 @@
 #include <linux/ctype.h>
 #include <linux/device.h>
 #include <linux/delay.h>
+#include <linux/mutex.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/of.h>
@@ -265,6 +266,8 @@ struct fsl_ssi_private {
 
         u32 fifo_watermark;
         u32 dma_maxburst;
+
+        struct mutex ac97_reg_lock;
 };
 
 /*
@@ -1260,11 +1263,13 @@ static void fsl_ssi_ac97_write(struct snd_ac97 *ac97, unsigned short reg,
         if (reg > 0x7f)
                 return;
 
+        mutex_lock(&fsl_ac97_data->ac97_reg_lock);
+
         ret = clk_prepare_enable(fsl_ac97_data->clk);
         if (ret) {
                 pr_err("ac97 write clk_prepare_enable failed: %d\n",
                         ret);
-                return;
+                goto ret_unlock;
         }
 
         lreg = reg <<  12;
@@ -1278,6 +1283,9 @@ static void fsl_ssi_ac97_write(struct snd_ac97 *ac97, unsigned short reg,
         udelay(100);
 
         clk_disable_unprepare(fsl_ac97_data->clk);
+
+ret_unlock:
+        mutex_unlock(&fsl_ac97_data->ac97_reg_lock);
 }
 
 static unsigned short fsl_ssi_ac97_read(struct snd_ac97 *ac97,
@@ -1285,16 +1293,18 @@ static unsigned short fsl_ssi_ac97_read(struct snd_ac97 *ac97,
 {
         struct regmap *regs = fsl_ac97_data->regs;
 
-        unsigned short val = -1;
+        unsigned short val = 0;
         u32 reg_val;
         unsigned int lreg;
         int ret;
 
+        mutex_lock(&fsl_ac97_data->ac97_reg_lock);
+
         ret = clk_prepare_enable(fsl_ac97_data->clk);
         if (ret) {
                 pr_err("ac97 read clk_prepare_enable failed: %d\n",
                         ret);
-                return -1;
+                goto ret_unlock;
         }
 
         lreg = (reg & 0x7f) <<  12;
@@ -1309,6 +1319,8 @@ static unsigned short fsl_ssi_ac97_read(struct snd_ac97 *ac97,
 
         clk_disable_unprepare(fsl_ac97_data->clk);
 
+ret_unlock:
+        mutex_unlock(&fsl_ac97_data->ac97_reg_lock);
         return val;
 }
 
@@ -1458,12 +1470,6 @@ static int fsl_ssi_probe(struct platform_device *pdev)
                                 sizeof(fsl_ssi_ac97_dai));
 
                 fsl_ac97_data = ssi_private;
-
-                ret = snd_soc_set_ac97_ops_of_reset(&fsl_ssi_ac97_ops, pdev);
-                if (ret) {
-                        dev_err(&pdev->dev, "could not set AC'97 ops\n");
-                        return ret;
-                }
         } else {
                 /* Initialize this copy of the CPU DAI driver structure */
                 memcpy(&ssi_private->cpu_dai_drv, &fsl_ssi_dai_template,
@@ -1574,6 +1580,15 @@ static int fsl_ssi_probe(struct platform_device *pdev)
                         return ret;
         }
 
+        if (fsl_ssi_is_ac97(ssi_private)) {
+                mutex_init(&ssi_private->ac97_reg_lock);
+                ret = snd_soc_set_ac97_ops_of_reset(&fsl_ssi_ac97_ops, pdev);
+                if (ret) {
+                        dev_err(&pdev->dev, "could not set AC'97 ops\n");
+                        goto error_ac97_ops;
+                }
+        }
+
         ret = devm_snd_soc_register_component(&pdev->dev, &fsl_ssi_component,
                                               &ssi_private->cpu_dai_drv, 1);
         if (ret) {
@@ -1657,6 +1672,13 @@ error_sound_card:
         fsl_ssi_debugfs_remove(&ssi_private->dbg_stats);
 
 error_asoc_register:
+        if (fsl_ssi_is_ac97(ssi_private))
+                snd_soc_set_ac97_ops(NULL);
+
+error_ac97_ops:
+        if (fsl_ssi_is_ac97(ssi_private))
+                mutex_destroy(&ssi_private->ac97_reg_lock);
+
         if (ssi_private->soc->imx)
                 fsl_ssi_imx_clean(pdev, ssi_private);
 
@@ -1675,8 +1697,10 @@ static int fsl_ssi_remove(struct platform_device *pdev)
         if (ssi_private->soc->imx)
                 fsl_ssi_imx_clean(pdev, ssi_private);
 
-        if (fsl_ssi_is_ac97(ssi_private))
+        if (fsl_ssi_is_ac97(ssi_private)) {
                 snd_soc_set_ac97_ops(NULL);
+                mutex_destroy(&ssi_private->ac97_reg_lock);
+        }
 
         return 0;
 }
diff --git a/sound/soc/intel/boards/kbl_rt5663_max98927.c b/sound/soc/intel/boards/kbl_rt5663_max98927.c
index 6f9a8bcf20f3..6dcad0a8a0d0 100644
--- a/sound/soc/intel/boards/kbl_rt5663_max98927.c
+++ b/sound/soc/intel/boards/kbl_rt5663_max98927.c
@@ -101,7 +101,7 @@ static const struct snd_soc_dapm_route kabylake_map[] = {
         { "ssp0 Tx", NULL, "spk_out" },
 
         { "AIF Playback", NULL, "ssp1 Tx" },
-        { "ssp1 Tx", NULL, "hs_out" },
+        { "ssp1 Tx", NULL, "codec1_out" },
 
         { "hs_in", NULL, "ssp1 Rx" },
         { "ssp1 Rx", NULL, "AIF Capture" },
diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
index 6072164f2d43..271ae3c2c535 100644
--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
@@ -109,7 +109,7 @@ static const struct snd_soc_dapm_route kabylake_map[] = {
         { "ssp0 Tx", NULL, "spk_out" },
 
         { "AIF Playback", NULL, "ssp1 Tx" },
-        { "ssp1 Tx", NULL, "hs_out" },
+        { "ssp1 Tx", NULL, "codec1_out" },
 
         { "hs_in", NULL, "ssp1 Rx" },
         { "ssp1 Rx", NULL, "AIF Capture" },
diff --git a/sound/soc/intel/skylake/skl-nhlt.c b/sound/soc/intel/skylake/skl-nhlt.c
index d14c50a60289..3eaac41090ca 100644
--- a/sound/soc/intel/skylake/skl-nhlt.c
+++ b/sound/soc/intel/skylake/skl-nhlt.c
@@ -119,11 +119,16 @@ static bool skl_check_ep_match(struct device *dev, struct nhlt_endpoint *epnt,
 
         if ((epnt->virtual_bus_id == instance_id) &&
                         (epnt->linktype == link_type) &&
-                        (epnt->direction == dirn) &&
-                        (epnt->device_type == dev_type))
-                return true;
-        else
-                return false;
+                        (epnt->direction == dirn)) {
+                /* do not check dev_type for DMIC link type */
+                if (epnt->linktype == NHLT_LINK_DMIC)
+                        return true;
+
+                if (epnt->device_type == dev_type)
+                        return true;
+        }
+
+        return false;
 }
 
 struct nhlt_specific_cfg
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index a072bcf209d2..81923da18ac2 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -2908,7 +2908,7 @@ static int skl_tplg_control_load(struct snd_soc_component *cmpnt,
                 break;
 
         default:
-                dev_warn(bus->dev, "Control load not supported %d:%d:%d\n",
+                dev_dbg(bus->dev, "Control load not supported %d:%d:%d\n",
                         hdr->ops.get, hdr->ops.put, hdr->ops.info);
                 break;
         }
diff --git a/sound/soc/rockchip/rockchip_spdif.c b/sound/soc/rockchip/rockchip_spdif.c
index ee5055d47d13..a89fe9b6463b 100644
--- a/sound/soc/rockchip/rockchip_spdif.c
+++ b/sound/soc/rockchip/rockchip_spdif.c
@@ -322,26 +322,30 @@ static int rk_spdif_probe(struct platform_device *pdev)
         spdif->mclk = devm_clk_get(&pdev->dev, "mclk");
         if (IS_ERR(spdif->mclk)) {
                 dev_err(&pdev->dev, "Can't retrieve rk_spdif master clock\n");
-                return PTR_ERR(spdif->mclk);
+                ret = PTR_ERR(spdif->mclk);
+                goto err_disable_hclk;
         }
 
         ret = clk_prepare_enable(spdif->mclk);
         if (ret) {
                 dev_err(spdif->dev, "clock enable failed %d\n", ret);
-                return ret;
+                goto err_disable_clocks;
         }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         regs = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(regs))
-                return PTR_ERR(regs);
+        if (IS_ERR(regs)) {
+                ret = PTR_ERR(regs);
+                goto err_disable_clocks;
+        }
 
         spdif->regmap = devm_regmap_init_mmio_clk(&pdev->dev, "hclk", regs,
                                                   &rk_spdif_regmap_config);
         if (IS_ERR(spdif->regmap)) {
                 dev_err(&pdev->dev,
                         "Failed to initialise managed register map\n");
-                return PTR_ERR(spdif->regmap);
+                ret = PTR_ERR(spdif->regmap);
+                goto err_disable_clocks;
         }
 
         spdif->playback_dma_data.addr = res->start + SPDIF_SMPDR;
@@ -373,6 +377,10 @@ static int rk_spdif_probe(struct platform_device *pdev)
 
 err_pm_runtime:
         pm_runtime_disable(&pdev->dev);
+err_disable_clocks:
+        clk_disable_unprepare(spdif->mclk);
+err_disable_hclk:
+        clk_disable_unprepare(spdif->hclk);
 
         return ret;
 }
diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c
index 8ddb08714faa..4672688cac32 100644
--- a/sound/soc/sh/rcar/adg.c
+++ b/sound/soc/sh/rcar/adg.c
@@ -222,7 +222,7 @@ int rsnd_adg_set_cmd_timsel_gen2(struct rsnd_mod *cmd_mod,
                                    NULL, &val, NULL);
 
         val  = val      << shift;
-        mask = 0xffff   << shift;
+        mask = 0x0f1f   << shift;
 
         rsnd_mod_bset(adg_mod, CMDOUT_TIMSEL, mask, val);
 
@@ -250,7 +250,7 @@ int rsnd_adg_set_src_timesel_gen2(struct rsnd_mod *src_mod,
 
         in   = in       << shift;
         out  = out      << shift;
-        mask = 0xffff   << shift;
+        mask = 0x0f1f   << shift;
 
         switch (id / 2) {
         case 0:
@@ -380,7 +380,7 @@ int rsnd_adg_ssi_clk_try_start(struct rsnd_mod *ssi_mod, unsigned int rate)
                         ckr = 0x80000000;
         }
 
-        rsnd_mod_bset(adg_mod, BRGCKR, 0x80FF0000, adg->ckr | ckr);
+        rsnd_mod_bset(adg_mod, BRGCKR, 0x80770000, adg->ckr | ckr);
         rsnd_mod_write(adg_mod, BRRA,  adg->rbga);
         rsnd_mod_write(adg_mod, BRRB,  adg->rbgb);
 
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index c70eb2097816..f12a88a21dfa 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -1332,8 +1332,8 @@ static int rsnd_pcm_new(struct snd_soc_pcm_runtime *rtd)
 
         return snd_pcm_lib_preallocate_pages_for_all(
                 rtd->pcm,
-                SNDRV_DMA_TYPE_CONTINUOUS,
-                snd_dma_continuous_data(GFP_KERNEL),
+                SNDRV_DMA_TYPE_DEV,
+                rtd->card->snd_card->dev,
                 PREALLOC_BUFFER, PREALLOC_BUFFER_MAX);
 }
 
diff --git a/sound/soc/sh/rcar/dma.c b/sound/soc/sh/rcar/dma.c
index fd557abfe390..4d750bdf8e24 100644
--- a/sound/soc/sh/rcar/dma.c
+++ b/sound/soc/sh/rcar/dma.c
@@ -26,10 +26,7 @@
 struct rsnd_dmaen {
         struct dma_chan         *chan;
         dma_cookie_t            cookie;
-        dma_addr_t              dma_buf;
         unsigned int            dma_len;
-        unsigned int            dma_period;
-        unsigned int            dma_cnt;
 };
 
 struct rsnd_dmapp {
@@ -71,38 +68,10 @@ static struct rsnd_mod mem = {
 /*
  *              Audio DMAC
  */
-#define rsnd_dmaen_sync(dmaen, io, i)   __rsnd_dmaen_sync(dmaen, io, i, 1)
-#define rsnd_dmaen_unsync(dmaen, io, i) __rsnd_dmaen_sync(dmaen, io, i, 0)
-static void __rsnd_dmaen_sync(struct rsnd_dmaen *dmaen, struct rsnd_dai_stream *io,
-                              int i, int sync)
-{
-        struct device *dev = dmaen->chan->device->dev;
-        enum dma_data_direction dir;
-        int is_play = rsnd_io_is_play(io);
-        dma_addr_t buf;
-        int len, max;
-        size_t period;
-
-        len     = dmaen->dma_len;
-        period  = dmaen->dma_period;
-        max     = len / period;
-        i       = i % max;
-        buf     = dmaen->dma_buf + (period * i);
-
-        dir = is_play ? DMA_TO_DEVICE : DMA_FROM_DEVICE;
-
-        if (sync)
-                dma_sync_single_for_device(dev, buf, period, dir);
-        else
-                dma_sync_single_for_cpu(dev, buf, period, dir);
-}
-
 static void __rsnd_dmaen_complete(struct rsnd_mod *mod,
                                   struct rsnd_dai_stream *io)
 {
         struct rsnd_priv *priv = rsnd_mod_to_priv(mod);
-        struct rsnd_dma *dma = rsnd_mod_to_dma(mod);
-        struct rsnd_dmaen *dmaen = rsnd_dma_to_dmaen(dma);
         bool elapsed = false;
         unsigned long flags;
 
@@ -115,22 +84,9 @@ static void __rsnd_dmaen_complete(struct rsnd_mod *mod,
          */
         spin_lock_irqsave(&priv->lock, flags);
 
-        if (rsnd_io_is_working(io)) {
-                rsnd_dmaen_unsync(dmaen, io, dmaen->dma_cnt);
-
-                /*
-                 * Next period is already started.
-                 * Let's sync Next Next period
-                 * see
-                 *      rsnd_dmaen_start()
-                 */
-                rsnd_dmaen_sync(dmaen, io, dmaen->dma_cnt + 2);
-
+        if (rsnd_io_is_working(io))
                 elapsed = true;
 
-                dmaen->dma_cnt++;
-        }
-
         spin_unlock_irqrestore(&priv->lock, flags);
 
         if (elapsed)
@@ -165,14 +121,8 @@ static int rsnd_dmaen_stop(struct rsnd_mod *mod,
         struct rsnd_dma *dma = rsnd_mod_to_dma(mod);
         struct rsnd_dmaen *dmaen = rsnd_dma_to_dmaen(dma);
 
-        if (dmaen->chan) {
-                int is_play = rsnd_io_is_play(io);
-
+        if (dmaen->chan)
                 dmaengine_terminate_all(dmaen->chan);
-                dma_unmap_single(dmaen->chan->device->dev,
-                                 dmaen->dma_buf, dmaen->dma_len,
-                                 is_play ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
-        }
 
         return 0;
 }
@@ -237,11 +187,7 @@ static int rsnd_dmaen_start(struct rsnd_mod *mod,
         struct device *dev = rsnd_priv_to_dev(priv);
         struct dma_async_tx_descriptor *desc;
         struct dma_slave_config cfg = {};
-        dma_addr_t buf;
-        size_t len;
-        size_t period;
         int is_play = rsnd_io_is_play(io);
-        int i;
         int ret;
 
         cfg.direction   = is_play ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM;
@@ -258,19 +204,10 @@ static int rsnd_dmaen_start(struct rsnd_mod *mod,
         if (ret < 0)
                 return ret;
 
-        len     = snd_pcm_lib_buffer_bytes(substream);
-        period  = snd_pcm_lib_period_bytes(substream);
-        buf     = dma_map_single(dmaen->chan->device->dev,
-                                 substream->runtime->dma_area,
-                                 len,
-                                 is_play ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
-        if (dma_mapping_error(dmaen->chan->device->dev, buf)) {
-                dev_err(dev, "dma map failed\n");
-                return -EIO;
-        }
-
         desc = dmaengine_prep_dma_cyclic(dmaen->chan,
-                                         buf, len, period,
+                                         substream->runtime->dma_addr,
+                                         snd_pcm_lib_buffer_bytes(substream),
+                                         snd_pcm_lib_period_bytes(substream),
                                          is_play ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM,
                                          DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
 
@@ -282,18 +219,7 @@ static int rsnd_dmaen_start(struct rsnd_mod *mod,
         desc->callback          = rsnd_dmaen_complete;
         desc->callback_param    = rsnd_mod_get(dma);
 
-        dmaen->dma_buf          = buf;
-        dmaen->dma_len          = len;
-        dmaen->dma_period       = period;
-        dmaen->dma_cnt          = 0;
-
-        /*
-         * synchronize this and next period
-         * see
-         *      __rsnd_dmaen_complete()
-         */
-        for (i = 0; i < 2; i++)
-                rsnd_dmaen_sync(dmaen, io, i);
+        dmaen->dma_len          = snd_pcm_lib_buffer_bytes(substream);
 
         dmaen->cookie = dmaengine_submit(desc);
         if (dmaen->cookie < 0) {
diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
index fece1e5f582f..cbf3bf312d23 100644
--- a/sound/soc/sh/rcar/ssi.c
+++ b/sound/soc/sh/rcar/ssi.c
@@ -446,25 +446,29 @@ static bool rsnd_ssi_pointer_update(struct rsnd_mod *mod,
                                     int byte)
 {
         struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
+        bool ret = false;
+        int byte_pos;
 
-        ssi->byte_pos += byte;
+        byte_pos = ssi->byte_pos + byte;
 
-        if (ssi->byte_pos >= ssi->next_period_byte) {
+        if (byte_pos >= ssi->next_period_byte) {
                 struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
 
                 ssi->period_pos++;
                 ssi->next_period_byte += ssi->byte_per_period;
 
                 if (ssi->period_pos >= runtime->periods) {
-                        ssi->byte_pos = 0;
+                        byte_pos = 0;
                         ssi->period_pos = 0;
                         ssi->next_period_byte = ssi->byte_per_period;
                 }
 
-                return true;
+                ret = true;
         }
 
-        return false;
+        WRITE_ONCE(ssi->byte_pos, byte_pos);
+
+        return ret;
 }
 
 /*
@@ -838,7 +842,7 @@ static int rsnd_ssi_pointer(struct rsnd_mod *mod,
         struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
         struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
 
-        *pointer = bytes_to_frames(runtime, ssi->byte_pos);
+        *pointer = bytes_to_frames(runtime, READ_ONCE(ssi->byte_pos));
 
         return 0;
 }
diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c
index 4d948757d300..6ff8a36c2c82 100644
--- a/sound/soc/sh/rcar/ssiu.c
+++ b/sound/soc/sh/rcar/ssiu.c
@@ -125,6 +125,7 @@ static int rsnd_ssiu_init_gen2(struct rsnd_mod *mod,
 {
         int hdmi = rsnd_ssi_hdmi_port(io);
         int ret;
+        u32 mode = 0;
 
         ret = rsnd_ssiu_init(mod, io, priv);
         if (ret < 0)
@@ -136,9 +137,11 @@ static int rsnd_ssiu_init_gen2(struct rsnd_mod *mod,
                  * see
                  *      rsnd_ssi_config_init()
                  */
-                rsnd_mod_write(mod, SSI_MODE, 0x1);
+                mode = 0x1;
         }
 
+        rsnd_mod_write(mod, SSI_MODE, mode);
+
         if (rsnd_ssi_use_busif(io)) {
                 rsnd_mod_write(mod, SSI_BUSIF_ADINR,
                                rsnd_get_adinr_bit(mod, io) |
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 61b348383de8..2b4ceda36291 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -204,6 +204,10 @@ static int snd_usb_copy_string_desc(struct mixer_build *state,
                                     int index, char *buf, int maxlen)
 {
         int len = usb_string(state->chip->dev, index, buf, maxlen - 1);
+
+        if (len < 0)
+                return 0;
+
         buf[len] = 0;
         return len;
 }
@@ -2169,19 +2173,25 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
         kctl->private_value = (unsigned long)namelist;
         kctl->private_free = usb_mixer_selector_elem_free;
 
-        nameid = uac_selector_unit_iSelector(desc);
+        /* check the static mapping table at first */
         len = check_mapped_name(map, kctl->id.name, sizeof(kctl->id.name));
-        if (len)
-                ;
-        else if (nameid)
-                snd_usb_copy_string_desc(state, nameid, kctl->id.name,
-                                         sizeof(kctl->id.name));
-        else {
-                len = get_term_name(state, &state->oterm,
+        if (!len) {
+                /* no mapping ? */
+                /* if iSelector is given, use it */
+                nameid = uac_selector_unit_iSelector(desc);
+                if (nameid)
+                        len = snd_usb_copy_string_desc(state, nameid,
+                                                       kctl->id.name,
+                                                       sizeof(kctl->id.name));
+                /* ... or pick up the terminal name at next */
+                if (!len)
+                        len = get_term_name(state, &state->oterm,
                                     kctl->id.name, sizeof(kctl->id.name), 0);
+                /* ... or use the fixed string "USB" as the last resort */
                 if (!len)
                         strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name));
 
+                /* and add the proper suffix */
                 if (desc->bDescriptorSubtype == UAC2_CLOCK_SELECTOR)
                         append_ctl_name(kctl, " Clock Source");
                 else if ((state->oterm.type & 0xff00) == 0x0100)
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 77eecaa4db1f..a66ef5777887 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1166,10 +1166,11 @@ static bool is_marantz_denon_dac(unsigned int id)
 /* TEAC UD-501/UD-503/NT-503 USB DACs need a vendor cmd to switch
  * between PCM/DOP and native DSD mode
  */
-static bool is_teac_50X_dac(unsigned int id)
+static bool is_teac_dsd_dac(unsigned int id)
 {
         switch (id) {
         case USB_ID(0x0644, 0x8043): /* TEAC UD-501/UD-503/NT-503 */
+        case USB_ID(0x0644, 0x8044): /* Esoteric D-05X */
                 return true;
         }
         return false;
@@ -1202,7 +1203,7 @@ int snd_usb_select_mode_quirk(struct snd_usb_substream *subs,
                         break;
                 }
                 mdelay(20);
-        } else if (is_teac_50X_dac(subs->stream->chip->usb_id)) {
+        } else if (is_teac_dsd_dac(subs->stream->chip->usb_id)) {
                 /* Vendor mode switch cmd is required. */
                 switch (fmt->altsetting) {
                 case 3: /* DSD mode (DSD_U32) requested */
@@ -1392,7 +1393,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
         }
 
         /* TEAC devices with USB DAC functionality */
-        if (is_teac_50X_dac(chip->usb_id)) {
+        if (is_teac_dsd_dac(chip->usb_id)) {
                 if (fp->altsetting == 3)
                         return SNDRV_PCM_FMTBIT_DSD_U32_BE;
         }
diff --git a/tools/arch/arm/include/uapi/asm/kvm.h b/tools/arch/arm/include/uapi/asm/kvm.h
index 1f57bbe82b6f..6edd177bb1c7 100644
--- a/tools/arch/arm/include/uapi/asm/kvm.h
+++ b/tools/arch/arm/include/uapi/asm/kvm.h
@@ -152,6 +152,12 @@ struct kvm_arch_memory_slot {
         (__ARM_CP15_REG(op1, 0, crm, 0) | KVM_REG_SIZE_U64)
 #define ARM_CP15_REG64(...) __ARM_CP15_REG64(__VA_ARGS__)
 
+/* PL1 Physical Timer Registers */
+#define KVM_REG_ARM_PTIMER_CTL          ARM_CP15_REG32(0, 14, 2, 1)
+#define KVM_REG_ARM_PTIMER_CNT          ARM_CP15_REG64(0, 14)
+#define KVM_REG_ARM_PTIMER_CVAL         ARM_CP15_REG64(2, 14)
+
+/* Virtual Timer Registers */
 #define KVM_REG_ARM_TIMER_CTL           ARM_CP15_REG32(0, 14, 3, 1)
 #define KVM_REG_ARM_TIMER_CNT           ARM_CP15_REG64(1, 14)
 #define KVM_REG_ARM_TIMER_CVAL          ARM_CP15_REG64(3, 14)
@@ -216,6 +222,7 @@ struct kvm_arch_memory_slot {
 #define   KVM_DEV_ARM_ITS_SAVE_TABLES           1
 #define   KVM_DEV_ARM_ITS_RESTORE_TABLES        2
 #define   KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES  3
+#define   KVM_DEV_ARM_ITS_CTRL_RESET            4
 
 /* KVM_IRQ_LINE irq field index values */
 #define KVM_ARM_IRQ_TYPE_SHIFT          24
diff --git a/tools/arch/arm64/include/uapi/asm/bpf_perf_event.h b/tools/arch/arm64/include/uapi/asm/bpf_perf_event.h
new file mode 100644
index 000000000000..b551b741653d
--- /dev/null
+++ b/tools/arch/arm64/include/uapi/asm/bpf_perf_event.h
@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _UAPI__ASM_BPF_PERF_EVENT_H__
+#define _UAPI__ASM_BPF_PERF_EVENT_H__
+
+#include <asm/ptrace.h>
+
+typedef struct user_pt_regs bpf_user_pt_regs_t;
+
+#endif /* _UAPI__ASM_BPF_PERF_EVENT_H__ */
diff --git a/tools/arch/arm64/include/uapi/asm/kvm.h b/tools/arch/arm64/include/uapi/asm/kvm.h
index 51149ec75fe4..9abbf3044654 100644
--- a/tools/arch/arm64/include/uapi/asm/kvm.h
+++ b/tools/arch/arm64/include/uapi/asm/kvm.h
@@ -196,6 +196,12 @@ struct kvm_arch_memory_slot {
 
 #define ARM64_SYS_REG(...) (__ARM64_SYS_REG(__VA_ARGS__) | KVM_REG_SIZE_U64)
 
+/* Physical Timer EL0 Registers */
+#define KVM_REG_ARM_PTIMER_CTL          ARM64_SYS_REG(3, 3, 14, 2, 1)
+#define KVM_REG_ARM_PTIMER_CVAL         ARM64_SYS_REG(3, 3, 14, 2, 2)
+#define KVM_REG_ARM_PTIMER_CNT          ARM64_SYS_REG(3, 3, 14, 0, 1)
+
+/* EL0 Virtual Timer Registers */
 #define KVM_REG_ARM_TIMER_CTL           ARM64_SYS_REG(3, 3, 14, 3, 1)
 #define KVM_REG_ARM_TIMER_CNT           ARM64_SYS_REG(3, 3, 14, 3, 2)
 #define KVM_REG_ARM_TIMER_CVAL          ARM64_SYS_REG(3, 3, 14, 0, 2)
@@ -228,6 +234,7 @@ struct kvm_arch_memory_slot {
 #define   KVM_DEV_ARM_ITS_SAVE_TABLES           1
 #define   KVM_DEV_ARM_ITS_RESTORE_TABLES        2
 #define   KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES  3
+#define   KVM_DEV_ARM_ITS_CTRL_RESET            4
 
 /* Device Control API on vcpu fd */
 #define KVM_ARM_VCPU_PMU_V3_CTRL        0
diff --git a/tools/arch/s390/include/uapi/asm/bpf_perf_event.h b/tools/arch/s390/include/uapi/asm/bpf_perf_event.h
new file mode 100644
index 000000000000..0a8e37a519f2
--- /dev/null
+++ b/tools/arch/s390/include/uapi/asm/bpf_perf_event.h
@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _UAPI__ASM_BPF_PERF_EVENT_H__
+#define _UAPI__ASM_BPF_PERF_EVENT_H__
+
+#include "ptrace.h"
+
+typedef user_pt_regs bpf_user_pt_regs_t;
+
+#endif /* _UAPI__ASM_BPF_PERF_EVENT_H__ */
diff --git a/tools/arch/s390/include/uapi/asm/kvm.h b/tools/arch/s390/include/uapi/asm/kvm.h
index 9ad172dcd912..38535a57fef8 100644
--- a/tools/arch/s390/include/uapi/asm/kvm.h
+++ b/tools/arch/s390/include/uapi/asm/kvm.h
@@ -6,10 +6,6 @@
  *
  * Copyright IBM Corp. 2008
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
- *
  *    Author(s): Carsten Otte <cotte@de.ibm.com>
  *               Christian Borntraeger <borntraeger@de.ibm.com>
  */
diff --git a/tools/arch/s390/include/uapi/asm/kvm_perf.h b/tools/arch/s390/include/uapi/asm/kvm_perf.h
index c36c97ffdc6f..84606b8cc49e 100644
--- a/tools/arch/s390/include/uapi/asm/kvm_perf.h
+++ b/tools/arch/s390/include/uapi/asm/kvm_perf.h
@@ -4,10 +4,6 @@
  *
  * Copyright 2014 IBM Corp.
  * Author(s): Alexander Yarygin <yarygin@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
  */
 
 #ifndef __LINUX_KVM_PERF_S390_H
diff --git a/tools/arch/s390/include/uapi/asm/perf_regs.h b/tools/arch/s390/include/uapi/asm/perf_regs.h
new file mode 100644
index 000000000000..d17dd9e5d516
--- /dev/null
+++ b/tools/arch/s390/include/uapi/asm/perf_regs.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _ASM_S390_PERF_REGS_H
+#define _ASM_S390_PERF_REGS_H
+
+enum perf_event_s390_regs {
+        PERF_REG_S390_R0,
+        PERF_REG_S390_R1,
+        PERF_REG_S390_R2,
+        PERF_REG_S390_R3,
+        PERF_REG_S390_R4,
+        PERF_REG_S390_R5,
+        PERF_REG_S390_R6,
+        PERF_REG_S390_R7,
+        PERF_REG_S390_R8,
+        PERF_REG_S390_R9,
+        PERF_REG_S390_R10,
+        PERF_REG_S390_R11,
+        PERF_REG_S390_R12,
+        PERF_REG_S390_R13,
+        PERF_REG_S390_R14,
+        PERF_REG_S390_R15,
+        PERF_REG_S390_FP0,
+        PERF_REG_S390_FP1,
+        PERF_REG_S390_FP2,
+        PERF_REG_S390_FP3,
+        PERF_REG_S390_FP4,
+        PERF_REG_S390_FP5,
+        PERF_REG_S390_FP6,
+        PERF_REG_S390_FP7,
+        PERF_REG_S390_FP8,
+        PERF_REG_S390_FP9,
+        PERF_REG_S390_FP10,
+        PERF_REG_S390_FP11,
+        PERF_REG_S390_FP12,
+        PERF_REG_S390_FP13,
+        PERF_REG_S390_FP14,
+        PERF_REG_S390_FP15,
+        PERF_REG_S390_MASK,
+        PERF_REG_S390_PC,
+
+        PERF_REG_S390_MAX
+};
+
+#endif /* _ASM_S390_PERF_REGS_H */
diff --git a/tools/arch/s390/include/uapi/asm/ptrace.h b/tools/arch/s390/include/uapi/asm/ptrace.h
new file mode 100644
index 000000000000..543dd70e12c8
--- /dev/null
+++ b/tools/arch/s390/include/uapi/asm/ptrace.h
@@ -0,0 +1,457 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ *  S390 version
+ *    Copyright IBM Corp. 1999, 2000
+ *    Author(s): Denis Joseph Barrow (djbarrow@de.ibm.com,barrow_dj@yahoo.com)
+ */
+
+#ifndef _UAPI_S390_PTRACE_H
+#define _UAPI_S390_PTRACE_H
+
+/*
+ * Offsets in the user_regs_struct. They are used for the ptrace
+ * system call and in entry.S
+ */
+#ifndef __s390x__
+
+#define PT_PSWMASK  0x00
+#define PT_PSWADDR  0x04
+#define PT_GPR0     0x08
+#define PT_GPR1     0x0C
+#define PT_GPR2     0x10
+#define PT_GPR3     0x14
+#define PT_GPR4     0x18
+#define PT_GPR5     0x1C
+#define PT_GPR6     0x20
+#define PT_GPR7     0x24
+#define PT_GPR8     0x28
+#define PT_GPR9     0x2C
+#define PT_GPR10    0x30
+#define PT_GPR11    0x34
+#define PT_GPR12    0x38
+#define PT_GPR13    0x3C
+#define PT_GPR14    0x40
+#define PT_GPR15    0x44
+#define PT_ACR0     0x48
+#define PT_ACR1     0x4C
+#define PT_ACR2     0x50
+#define PT_ACR3     0x54
+#define PT_ACR4     0x58
+#define PT_ACR5     0x5C
+#define PT_ACR6     0x60
+#define PT_ACR7     0x64
+#define PT_ACR8     0x68
+#define PT_ACR9     0x6C
+#define PT_ACR10    0x70
+#define PT_ACR11    0x74
+#define PT_ACR12    0x78
+#define PT_ACR13    0x7C
+#define PT_ACR14    0x80
+#define PT_ACR15    0x84
+#define PT_ORIGGPR2 0x88
+#define PT_FPC      0x90
+/*
+ * A nasty fact of life that the ptrace api
+ * only supports passing of longs.
+ */
+#define PT_FPR0_HI  0x98
+#define PT_FPR0_LO  0x9C
+#define PT_FPR1_HI  0xA0
+#define PT_FPR1_LO  0xA4
+#define PT_FPR2_HI  0xA8
+#define PT_FPR2_LO  0xAC
+#define PT_FPR3_HI  0xB0
+#define PT_FPR3_LO  0xB4
+#define PT_FPR4_HI  0xB8
+#define PT_FPR4_LO  0xBC
+#define PT_FPR5_HI  0xC0
+#define PT_FPR5_LO  0xC4
+#define PT_FPR6_HI  0xC8
+#define PT_FPR6_LO  0xCC
+#define PT_FPR7_HI  0xD0
+#define PT_FPR7_LO  0xD4
+#define PT_FPR8_HI  0xD8
+#define PT_FPR8_LO  0XDC
+#define PT_FPR9_HI  0xE0
+#define PT_FPR9_LO  0xE4
+#define PT_FPR10_HI 0xE8
+#define PT_FPR10_LO 0xEC
+#define PT_FPR11_HI 0xF0
+#define PT_FPR11_LO 0xF4
+#define PT_FPR12_HI 0xF8
+#define PT_FPR12_LO 0xFC
+#define PT_FPR13_HI 0x100
+#define PT_FPR13_LO 0x104
+#define PT_FPR14_HI 0x108
+#define PT_FPR14_LO 0x10C
+#define PT_FPR15_HI 0x110
+#define PT_FPR15_LO 0x114
+#define PT_CR_9     0x118
+#define PT_CR_10    0x11C
+#define PT_CR_11    0x120
+#define PT_IEEE_IP  0x13C
+#define PT_LASTOFF  PT_IEEE_IP
+#define PT_ENDREGS  0x140-1
+
+#define GPR_SIZE        4
+#define CR_SIZE         4
+
+#define STACK_FRAME_OVERHEAD    96      /* size of minimum stack frame */
+
+#else /* __s390x__ */
+
+#define PT_PSWMASK  0x00
+#define PT_PSWADDR  0x08
+#define PT_GPR0     0x10
+#define PT_GPR1     0x18
+#define PT_GPR2     0x20
+#define PT_GPR3     0x28
+#define PT_GPR4     0x30
+#define PT_GPR5     0x38
+#define PT_GPR6     0x40
+#define PT_GPR7     0x48
+#define PT_GPR8     0x50
+#define PT_GPR9     0x58
+#define PT_GPR10    0x60
+#define PT_GPR11    0x68
+#define PT_GPR12    0x70
+#define PT_GPR13    0x78
+#define PT_GPR14    0x80
+#define PT_GPR15    0x88
+#define PT_ACR0     0x90
+#define PT_ACR1     0x94
+#define PT_ACR2     0x98
+#define PT_ACR3     0x9C
+#define PT_ACR4     0xA0
+#define PT_ACR5     0xA4
+#define PT_ACR6     0xA8
+#define PT_ACR7     0xAC
+#define PT_ACR8     0xB0
+#define PT_ACR9     0xB4
+#define PT_ACR10    0xB8
+#define PT_ACR11    0xBC
+#define PT_ACR12    0xC0
+#define PT_ACR13    0xC4
+#define PT_ACR14    0xC8
+#define PT_ACR15    0xCC
+#define PT_ORIGGPR2 0xD0
+#define PT_FPC      0xD8
+#define PT_FPR0     0xE0
+#define PT_FPR1     0xE8
+#define PT_FPR2     0xF0
+#define PT_FPR3     0xF8
+#define PT_FPR4     0x100
+#define PT_FPR5     0x108
+#define PT_FPR6     0x110
+#define PT_FPR7     0x118
+#define PT_FPR8     0x120
+#define PT_FPR9     0x128
+#define PT_FPR10    0x130
+#define PT_FPR11    0x138
+#define PT_FPR12    0x140
+#define PT_FPR13    0x148
+#define PT_FPR14    0x150
+#define PT_FPR15    0x158
+#define PT_CR_9     0x160
+#define PT_CR_10    0x168
+#define PT_CR_11    0x170
+#define PT_IEEE_IP  0x1A8
+#define PT_LASTOFF  PT_IEEE_IP
+#define PT_ENDREGS  0x1B0-1
+
+#define GPR_SIZE        8
+#define CR_SIZE         8
+
+#define STACK_FRAME_OVERHEAD    160      /* size of minimum stack frame */
+
+#endif /* __s390x__ */
+
+#define NUM_GPRS        16
+#define NUM_FPRS        16
+#define NUM_CRS         16
+#define NUM_ACRS        16
+
+#define NUM_CR_WORDS    3
+
+#define FPR_SIZE        8
+#define FPC_SIZE        4
+#define FPC_PAD_SIZE    4 /* gcc insists on aligning the fpregs */
+#define ACR_SIZE        4
+
+
+#define PTRACE_OLDSETOPTIONS         21
+
+#ifndef __ASSEMBLY__
+#include <linux/stddef.h>
+#include <linux/types.h>
+
+typedef union {
+        float   f;
+        double  d;
+        __u64   ui;
+        struct
+        {
+                __u32 hi;
+                __u32 lo;
+        } fp;
+} freg_t;
+
+typedef struct {
+        __u32   fpc;
+        __u32   pad;
+        freg_t  fprs[NUM_FPRS];
+} s390_fp_regs;
+
+#define FPC_EXCEPTION_MASK      0xF8000000
+#define FPC_FLAGS_MASK          0x00F80000
+#define FPC_DXC_MASK            0x0000FF00
+#define FPC_RM_MASK             0x00000003
+
+/* this typedef defines how a Program Status Word looks like */
+typedef struct {
+        unsigned long mask;
+        unsigned long addr;
+} __attribute__ ((aligned(8))) psw_t;
+
+#ifndef __s390x__
+
+#define PSW_MASK_PER            0x40000000UL
+#define PSW_MASK_DAT            0x04000000UL
+#define PSW_MASK_IO             0x02000000UL
+#define PSW_MASK_EXT            0x01000000UL
+#define PSW_MASK_KEY            0x00F00000UL
+#define PSW_MASK_BASE           0x00080000UL    /* always one */
+#define PSW_MASK_MCHECK         0x00040000UL
+#define PSW_MASK_WAIT           0x00020000UL
+#define PSW_MASK_PSTATE         0x00010000UL
+#define PSW_MASK_ASC            0x0000C000UL
+#define PSW_MASK_CC             0x00003000UL
+#define PSW_MASK_PM             0x00000F00UL
+#define PSW_MASK_RI             0x00000000UL
+#define PSW_MASK_EA             0x00000000UL
+#define PSW_MASK_BA             0x00000000UL
+
+#define PSW_MASK_USER           0x0000FF00UL
+
+#define PSW_ADDR_AMODE          0x80000000UL
+#define PSW_ADDR_INSN           0x7FFFFFFFUL
+
+#define PSW_DEFAULT_KEY         (((unsigned long) PAGE_DEFAULT_ACC) << 20)
+
+#define PSW_ASC_PRIMARY         0x00000000UL
+#define PSW_ASC_ACCREG          0x00004000UL
+#define PSW_ASC_SECONDARY       0x00008000UL
+#define PSW_ASC_HOME            0x0000C000UL
+
+#else /* __s390x__ */
+
+#define PSW_MASK_PER            0x4000000000000000UL
+#define PSW_MASK_DAT            0x0400000000000000UL
+#define PSW_MASK_IO             0x0200000000000000UL
+#define PSW_MASK_EXT            0x0100000000000000UL
+#define PSW_MASK_BASE           0x0000000000000000UL
+#define PSW_MASK_KEY            0x00F0000000000000UL
+#define PSW_MASK_MCHECK         0x0004000000000000UL
+#define PSW_MASK_WAIT           0x0002000000000000UL
+#define PSW_MASK_PSTATE         0x0001000000000000UL
+#define PSW_MASK_ASC            0x0000C00000000000UL
+#define PSW_MASK_CC             0x0000300000000000UL
+#define PSW_MASK_PM             0x00000F0000000000UL
+#define PSW_MASK_RI             0x0000008000000000UL
+#define PSW_MASK_EA             0x0000000100000000UL
+#define PSW_MASK_BA             0x0000000080000000UL
+
+#define PSW_MASK_USER           0x0000FF0180000000UL
+
+#define PSW_ADDR_AMODE          0x0000000000000000UL
+#define PSW_ADDR_INSN           0xFFFFFFFFFFFFFFFFUL
+
+#define PSW_DEFAULT_KEY         (((unsigned long) PAGE_DEFAULT_ACC) << 52)
+
+#define PSW_ASC_PRIMARY         0x0000000000000000UL
+#define PSW_ASC_ACCREG          0x0000400000000000UL
+#define PSW_ASC_SECONDARY       0x0000800000000000UL
+#define PSW_ASC_HOME            0x0000C00000000000UL
+
+#endif /* __s390x__ */
+
+
+/*
+ * The s390_regs structure is used to define the elf_gregset_t.
+ */
+typedef struct {
+        psw_t psw;
+        unsigned long gprs[NUM_GPRS];
+        unsigned int  acrs[NUM_ACRS];
+        unsigned long orig_gpr2;
+} s390_regs;
+
+/*
+ * The user_pt_regs structure exports the beginning of
+ * the in-kernel pt_regs structure to user space.
+ */
+typedef struct {
+        unsigned long args[1];
+        psw_t psw;
+        unsigned long gprs[NUM_GPRS];
+} user_pt_regs;
+
+/*
+ * Now for the user space program event recording (trace) definitions.
+ * The following structures are used only for the ptrace interface, don't
+ * touch or even look at it if you don't want to modify the user-space
+ * ptrace interface. In particular stay away from it for in-kernel PER.
+ */
+typedef struct {
+        unsigned long cr[NUM_CR_WORDS];
+} per_cr_words;
+
+#define PER_EM_MASK 0xE8000000UL
+
+typedef struct {
+#ifdef __s390x__
+        unsigned                       : 32;
+#endif /* __s390x__ */
+        unsigned em_branching          : 1;
+        unsigned em_instruction_fetch  : 1;
+        /*
+         * Switching on storage alteration automatically fixes
+         * the storage alteration event bit in the users std.
+         */
+        unsigned em_storage_alteration : 1;
+        unsigned em_gpr_alt_unused     : 1;
+        unsigned em_store_real_address : 1;
+        unsigned                       : 3;
+        unsigned branch_addr_ctl       : 1;
+        unsigned                       : 1;
+        unsigned storage_alt_space_ctl : 1;
+        unsigned                       : 21;
+        unsigned long starting_addr;
+        unsigned long ending_addr;
+} per_cr_bits;
+
+typedef struct {
+        unsigned short perc_atmid;
+        unsigned long address;
+        unsigned char access_id;
+} per_lowcore_words;
+
+typedef struct {
+        unsigned perc_branching          : 1;
+        unsigned perc_instruction_fetch  : 1;
+        unsigned perc_storage_alteration : 1;
+        unsigned perc_gpr_alt_unused     : 1;
+        unsigned perc_store_real_address : 1;
+        unsigned                         : 3;
+        unsigned atmid_psw_bit_31        : 1;
+        unsigned atmid_validity_bit      : 1;
+        unsigned atmid_psw_bit_32        : 1;
+        unsigned atmid_psw_bit_5         : 1;
+        unsigned atmid_psw_bit_16        : 1;
+        unsigned atmid_psw_bit_17        : 1;
+        unsigned si                      : 2;
+        unsigned long address;
+        unsigned                         : 4;
+        unsigned access_id               : 4;
+} per_lowcore_bits;
+
+typedef struct {
+        union {
+                per_cr_words   words;
+                per_cr_bits    bits;
+        } control_regs;
+        /*
+         * The single_step and instruction_fetch bits are obsolete,
+         * the kernel always sets them to zero. To enable single
+         * stepping use ptrace(PTRACE_SINGLESTEP) instead.
+         */
+        unsigned  single_step       : 1;
+        unsigned  instruction_fetch : 1;
+        unsigned                    : 30;
+        /*
+         * These addresses are copied into cr10 & cr11 if single
+         * stepping is switched off
+         */
+        unsigned long starting_addr;
+        unsigned long ending_addr;
+        union {
+                per_lowcore_words words;
+                per_lowcore_bits  bits;
+        } lowcore;
+} per_struct;
+
+typedef struct {
+        unsigned int  len;
+        unsigned long kernel_addr;
+        unsigned long process_addr;
+} ptrace_area;
+
+/*
+ * S/390 specific non posix ptrace requests. I chose unusual values so
+ * they are unlikely to clash with future ptrace definitions.
+ */
+#define PTRACE_PEEKUSR_AREA           0x5000
+#define PTRACE_POKEUSR_AREA           0x5001
+#define PTRACE_PEEKTEXT_AREA          0x5002
+#define PTRACE_PEEKDATA_AREA          0x5003
+#define PTRACE_POKETEXT_AREA          0x5004
+#define PTRACE_POKEDATA_AREA          0x5005
+#define PTRACE_GET_LAST_BREAK         0x5006
+#define PTRACE_PEEK_SYSTEM_CALL       0x5007
+#define PTRACE_POKE_SYSTEM_CALL       0x5008
+#define PTRACE_ENABLE_TE              0x5009
+#define PTRACE_DISABLE_TE             0x5010
+#define PTRACE_TE_ABORT_RAND          0x5011
+
+/*
+ * The numbers chosen here are somewhat arbitrary but absolutely MUST
+ * not overlap with any of the number assigned in <linux/ptrace.h>.
+ */
+#define PTRACE_SINGLEBLOCK      12      /* resume execution until next branch */
+
+/*
+ * PT_PROT definition is loosely based on hppa bsd definition in
+ * gdb/hppab-nat.c
+ */
+#define PTRACE_PROT                       21
+
+typedef enum {
+        ptprot_set_access_watchpoint,
+        ptprot_set_write_watchpoint,
+        ptprot_disable_watchpoint
+} ptprot_flags;
+
+typedef struct {
+        unsigned long lowaddr;
+        unsigned long hiaddr;
+        ptprot_flags prot;
+} ptprot_area;
+
+/* Sequence of bytes for breakpoint illegal instruction.  */
+#define S390_BREAKPOINT     {0x0,0x1}
+#define S390_BREAKPOINT_U16 ((__u16)0x0001)
+#define S390_SYSCALL_OPCODE ((__u16)0x0a00)
+#define S390_SYSCALL_SIZE   2
+
+/*
+ * The user_regs_struct defines the way the user registers are
+ * store on the stack for signal handling.
+ */
+struct user_regs_struct {
+        psw_t psw;
+        unsigned long gprs[NUM_GPRS];
+        unsigned int  acrs[NUM_ACRS];
+        unsigned long orig_gpr2;
+        s390_fp_regs fp_regs;
+        /*
+         * These per registers are in here so that gdb can modify them
+         * itself as there is no "official" ptrace interface for hardware
+         * watchpoints. This is the way intel does it.
+         */
+        per_struct per_info;
+        unsigned long ieee_instruction_pointer; /* obsolete, always 0 */
+};
+
+#endif /* __ASSEMBLY__ */
+
+#endif /* _UAPI_S390_PTRACE_H */
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 793690fbda36..800104c8a3ed 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -13,173 +13,176 @@
 /*
  * Defines x86 CPU feature bits
  */
-#define NCAPINTS        18      /* N 32-bit words worth of info */
-#define NBUGINTS        1       /* N 32-bit bug flags */
+#define NCAPINTS                        18         /* N 32-bit words worth of info */
+#define NBUGINTS                        1          /* N 32-bit bug flags */
 
 /*
  * Note: If the comment begins with a quoted string, that string is used
  * in /proc/cpuinfo instead of the macro name.  If the string is "",
  * this feature bit is not displayed in /proc/cpuinfo at all.
+ *
+ * When adding new features here that depend on other features,
+ * please update the table in kernel/cpu/cpuid-deps.c as well.
  */
 
-/* Intel-defined CPU features, CPUID level 0x00000001 (edx), word 0 */
-#define X86_FEATURE_FPU         ( 0*32+ 0) /* Onboard FPU */
-#define X86_FEATURE_VME         ( 0*32+ 1) /* Virtual Mode Extensions */
-#define X86_FEATURE_DE          ( 0*32+ 2) /* Debugging Extensions */
-#define X86_FEATURE_PSE         ( 0*32+ 3) /* Page Size Extensions */
-#define X86_FEATURE_TSC         ( 0*32+ 4) /* Time Stamp Counter */
-#define X86_FEATURE_MSR         ( 0*32+ 5) /* Model-Specific Registers */
-#define X86_FEATURE_PAE         ( 0*32+ 6) /* Physical Address Extensions */
-#define X86_FEATURE_MCE         ( 0*32+ 7) /* Machine Check Exception */
-#define X86_FEATURE_CX8         ( 0*32+ 8) /* CMPXCHG8 instruction */
-#define X86_FEATURE_APIC        ( 0*32+ 9) /* Onboard APIC */
-#define X86_FEATURE_SEP         ( 0*32+11) /* SYSENTER/SYSEXIT */
-#define X86_FEATURE_MTRR        ( 0*32+12) /* Memory Type Range Registers */
-#define X86_FEATURE_PGE         ( 0*32+13) /* Page Global Enable */
-#define X86_FEATURE_MCA         ( 0*32+14) /* Machine Check Architecture */
-#define X86_FEATURE_CMOV        ( 0*32+15) /* CMOV instructions */
-                                          /* (plus FCMOVcc, FCOMI with FPU) */
-#define X86_FEATURE_PAT         ( 0*32+16) /* Page Attribute Table */
-#define X86_FEATURE_PSE36       ( 0*32+17) /* 36-bit PSEs */
-#define X86_FEATURE_PN          ( 0*32+18) /* Processor serial number */
-#define X86_FEATURE_CLFLUSH     ( 0*32+19) /* CLFLUSH instruction */
-#define X86_FEATURE_DS          ( 0*32+21) /* "dts" Debug Store */
-#define X86_FEATURE_ACPI        ( 0*32+22) /* ACPI via MSR */
-#define X86_FEATURE_MMX         ( 0*32+23) /* Multimedia Extensions */
-#define X86_FEATURE_FXSR        ( 0*32+24) /* FXSAVE/FXRSTOR, CR4.OSFXSR */
-#define X86_FEATURE_XMM         ( 0*32+25) /* "sse" */
-#define X86_FEATURE_XMM2        ( 0*32+26) /* "sse2" */
-#define X86_FEATURE_SELFSNOOP   ( 0*32+27) /* "ss" CPU self snoop */
-#define X86_FEATURE_HT          ( 0*32+28) /* Hyper-Threading */
-#define X86_FEATURE_ACC         ( 0*32+29) /* "tm" Automatic clock control */
-#define X86_FEATURE_IA64        ( 0*32+30) /* IA-64 processor */
-#define X86_FEATURE_PBE         ( 0*32+31) /* Pending Break Enable */
+/* Intel-defined CPU features, CPUID level 0x00000001 (EDX), word 0 */
+#define X86_FEATURE_FPU                 ( 0*32+ 0) /* Onboard FPU */
+#define X86_FEATURE_VME                 ( 0*32+ 1) /* Virtual Mode Extensions */
+#define X86_FEATURE_DE                  ( 0*32+ 2) /* Debugging Extensions */
+#define X86_FEATURE_PSE                 ( 0*32+ 3) /* Page Size Extensions */
+#define X86_FEATURE_TSC                 ( 0*32+ 4) /* Time Stamp Counter */
+#define X86_FEATURE_MSR                 ( 0*32+ 5) /* Model-Specific Registers */
+#define X86_FEATURE_PAE                 ( 0*32+ 6) /* Physical Address Extensions */
+#define X86_FEATURE_MCE                 ( 0*32+ 7) /* Machine Check Exception */
+#define X86_FEATURE_CX8                 ( 0*32+ 8) /* CMPXCHG8 instruction */
+#define X86_FEATURE_APIC                ( 0*32+ 9) /* Onboard APIC */
+#define X86_FEATURE_SEP                 ( 0*32+11) /* SYSENTER/SYSEXIT */
+#define X86_FEATURE_MTRR                ( 0*32+12) /* Memory Type Range Registers */
+#define X86_FEATURE_PGE                 ( 0*32+13) /* Page Global Enable */
+#define X86_FEATURE_MCA                 ( 0*32+14) /* Machine Check Architecture */
+#define X86_FEATURE_CMOV                ( 0*32+15) /* CMOV instructions (plus FCMOVcc, FCOMI with FPU) */
+#define X86_FEATURE_PAT                 ( 0*32+16) /* Page Attribute Table */
+#define X86_FEATURE_PSE36               ( 0*32+17) /* 36-bit PSEs */
+#define X86_FEATURE_PN                  ( 0*32+18) /* Processor serial number */
+#define X86_FEATURE_CLFLUSH             ( 0*32+19) /* CLFLUSH instruction */
+#define X86_FEATURE_DS                  ( 0*32+21) /* "dts" Debug Store */
+#define X86_FEATURE_ACPI                ( 0*32+22) /* ACPI via MSR */
+#define X86_FEATURE_MMX                 ( 0*32+23) /* Multimedia Extensions */
+#define X86_FEATURE_FXSR                ( 0*32+24) /* FXSAVE/FXRSTOR, CR4.OSFXSR */
+#define X86_FEATURE_XMM                 ( 0*32+25) /* "sse" */
+#define X86_FEATURE_XMM2                ( 0*32+26) /* "sse2" */
+#define X86_FEATURE_SELFSNOOP           ( 0*32+27) /* "ss" CPU self snoop */
+#define X86_FEATURE_HT                  ( 0*32+28) /* Hyper-Threading */
+#define X86_FEATURE_ACC                 ( 0*32+29) /* "tm" Automatic clock control */
+#define X86_FEATURE_IA64                ( 0*32+30) /* IA-64 processor */
+#define X86_FEATURE_PBE                 ( 0*32+31) /* Pending Break Enable */
 
 /* AMD-defined CPU features, CPUID level 0x80000001, word 1 */
 /* Don't duplicate feature flags which are redundant with Intel! */
-#define X86_FEATURE_SYSCALL     ( 1*32+11) /* SYSCALL/SYSRET */
-#define X86_FEATURE_MP          ( 1*32+19) /* MP Capable. */
-#define X86_FEATURE_NX          ( 1*32+20) /* Execute Disable */
-#define X86_FEATURE_MMXEXT      ( 1*32+22) /* AMD MMX extensions */
-#define X86_FEATURE_FXSR_OPT    ( 1*32+25) /* FXSAVE/FXRSTOR optimizations */
-#define X86_FEATURE_GBPAGES     ( 1*32+26) /* "pdpe1gb" GB pages */
-#define X86_FEATURE_RDTSCP      ( 1*32+27) /* RDTSCP */
-#define X86_FEATURE_LM          ( 1*32+29) /* Long Mode (x86-64) */
-#define X86_FEATURE_3DNOWEXT    ( 1*32+30) /* AMD 3DNow! extensions */
-#define X86_FEATURE_3DNOW       ( 1*32+31) /* 3DNow! */
+#define X86_FEATURE_SYSCALL             ( 1*32+11) /* SYSCALL/SYSRET */
+#define X86_FEATURE_MP                  ( 1*32+19) /* MP Capable */
+#define X86_FEATURE_NX                  ( 1*32+20) /* Execute Disable */
+#define X86_FEATURE_MMXEXT              ( 1*32+22) /* AMD MMX extensions */
+#define X86_FEATURE_FXSR_OPT            ( 1*32+25) /* FXSAVE/FXRSTOR optimizations */
+#define X86_FEATURE_GBPAGES             ( 1*32+26) /* "pdpe1gb" GB pages */
+#define X86_FEATURE_RDTSCP              ( 1*32+27) /* RDTSCP */
+#define X86_FEATURE_LM                  ( 1*32+29) /* Long Mode (x86-64, 64-bit support) */
+#define X86_FEATURE_3DNOWEXT            ( 1*32+30) /* AMD 3DNow extensions */
+#define X86_FEATURE_3DNOW               ( 1*32+31) /* 3DNow */
 
 /* Transmeta-defined CPU features, CPUID level 0x80860001, word 2 */
-#define X86_FEATURE_RECOVERY    ( 2*32+ 0) /* CPU in recovery mode */
-#define X86_FEATURE_LONGRUN     ( 2*32+ 1) /* Longrun power control */
-#define X86_FEATURE_LRTI        ( 2*32+ 3) /* LongRun table interface */
+#define X86_FEATURE_RECOVERY            ( 2*32+ 0) /* CPU in recovery mode */
+#define X86_FEATURE_LONGRUN             ( 2*32+ 1) /* Longrun power control */
+#define X86_FEATURE_LRTI                ( 2*32+ 3) /* LongRun table interface */
 
 /* Other features, Linux-defined mapping, word 3 */
 /* This range is used for feature bits which conflict or are synthesized */
-#define X86_FEATURE_CXMMX       ( 3*32+ 0) /* Cyrix MMX extensions */
-#define X86_FEATURE_K6_MTRR     ( 3*32+ 1) /* AMD K6 nonstandard MTRRs */
-#define X86_FEATURE_CYRIX_ARR   ( 3*32+ 2) /* Cyrix ARRs (= MTRRs) */
-#define X86_FEATURE_CENTAUR_MCR ( 3*32+ 3) /* Centaur MCRs (= MTRRs) */
-/* cpu types for specific tunings: */
-#define X86_FEATURE_K8          ( 3*32+ 4) /* "" Opteron, Athlon64 */
-#define X86_FEATURE_K7          ( 3*32+ 5) /* "" Athlon */
-#define X86_FEATURE_P3          ( 3*32+ 6) /* "" P3 */
-#define X86_FEATURE_P4          ( 3*32+ 7) /* "" P4 */
-#define X86_FEATURE_CONSTANT_TSC ( 3*32+ 8) /* TSC ticks at a constant rate */
-#define X86_FEATURE_UP          ( 3*32+ 9) /* smp kernel running on up */
-#define X86_FEATURE_ART         ( 3*32+10) /* Platform has always running timer (ART) */
-#define X86_FEATURE_ARCH_PERFMON ( 3*32+11) /* Intel Architectural PerfMon */
-#define X86_FEATURE_PEBS        ( 3*32+12) /* Precise-Event Based Sampling */
-#define X86_FEATURE_BTS         ( 3*32+13) /* Branch Trace Store */
-#define X86_FEATURE_SYSCALL32   ( 3*32+14) /* "" syscall in ia32 userspace */
-#define X86_FEATURE_SYSENTER32  ( 3*32+15) /* "" sysenter in ia32 userspace */
-#define X86_FEATURE_REP_GOOD    ( 3*32+16) /* rep microcode works well */
-#define X86_FEATURE_MFENCE_RDTSC ( 3*32+17) /* "" Mfence synchronizes RDTSC */
-#define X86_FEATURE_LFENCE_RDTSC ( 3*32+18) /* "" Lfence synchronizes RDTSC */
-#define X86_FEATURE_ACC_POWER   ( 3*32+19) /* AMD Accumulated Power Mechanism */
-#define X86_FEATURE_NOPL        ( 3*32+20) /* The NOPL (0F 1F) instructions */
-#define X86_FEATURE_ALWAYS      ( 3*32+21) /* "" Always-present feature */
-#define X86_FEATURE_XTOPOLOGY   ( 3*32+22) /* cpu topology enum extensions */
-#define X86_FEATURE_TSC_RELIABLE ( 3*32+23) /* TSC is known to be reliable */
-#define X86_FEATURE_NONSTOP_TSC ( 3*32+24) /* TSC does not stop in C states */
-#define X86_FEATURE_CPUID       ( 3*32+25) /* CPU has CPUID instruction itself */
-#define X86_FEATURE_EXTD_APICID ( 3*32+26) /* has extended APICID (8 bits) */
-#define X86_FEATURE_AMD_DCM     ( 3*32+27) /* multi-node processor */
-#define X86_FEATURE_APERFMPERF  ( 3*32+28) /* APERFMPERF */
-#define X86_FEATURE_NONSTOP_TSC_S3 ( 3*32+30) /* TSC doesn't stop in S3 state */
-#define X86_FEATURE_TSC_KNOWN_FREQ ( 3*32+31) /* TSC has known frequency */
+#define X86_FEATURE_CXMMX               ( 3*32+ 0) /* Cyrix MMX extensions */
+#define X86_FEATURE_K6_MTRR             ( 3*32+ 1) /* AMD K6 nonstandard MTRRs */
+#define X86_FEATURE_CYRIX_ARR           ( 3*32+ 2) /* Cyrix ARRs (= MTRRs) */
+#define X86_FEATURE_CENTAUR_MCR         ( 3*32+ 3) /* Centaur MCRs (= MTRRs) */
+
+/* CPU types for specific tunings: */
+#define X86_FEATURE_K8                  ( 3*32+ 4) /* "" Opteron, Athlon64 */
+#define X86_FEATURE_K7                  ( 3*32+ 5) /* "" Athlon */
+#define X86_FEATURE_P3                  ( 3*32+ 6) /* "" P3 */
+#define X86_FEATURE_P4                  ( 3*32+ 7) /* "" P4 */
+#define X86_FEATURE_CONSTANT_TSC        ( 3*32+ 8) /* TSC ticks at a constant rate */
+#define X86_FEATURE_UP                  ( 3*32+ 9) /* SMP kernel running on UP */
+#define X86_FEATURE_ART                 ( 3*32+10) /* Always running timer (ART) */
+#define X86_FEATURE_ARCH_PERFMON        ( 3*32+11) /* Intel Architectural PerfMon */
+#define X86_FEATURE_PEBS                ( 3*32+12) /* Precise-Event Based Sampling */
+#define X86_FEATURE_BTS                 ( 3*32+13) /* Branch Trace Store */
+#define X86_FEATURE_SYSCALL32           ( 3*32+14) /* "" syscall in IA32 userspace */
+#define X86_FEATURE_SYSENTER32          ( 3*32+15) /* "" sysenter in IA32 userspace */
+#define X86_FEATURE_REP_GOOD            ( 3*32+16) /* REP microcode works well */
+#define X86_FEATURE_MFENCE_RDTSC        ( 3*32+17) /* "" MFENCE synchronizes RDTSC */
+#define X86_FEATURE_LFENCE_RDTSC        ( 3*32+18) /* "" LFENCE synchronizes RDTSC */
+#define X86_FEATURE_ACC_POWER           ( 3*32+19) /* AMD Accumulated Power Mechanism */
+#define X86_FEATURE_NOPL                ( 3*32+20) /* The NOPL (0F 1F) instructions */
+#define X86_FEATURE_ALWAYS              ( 3*32+21) /* "" Always-present feature */
+#define X86_FEATURE_XTOPOLOGY           ( 3*32+22) /* CPU topology enum extensions */
+#define X86_FEATURE_TSC_RELIABLE        ( 3*32+23) /* TSC is known to be reliable */
+#define X86_FEATURE_NONSTOP_TSC         ( 3*32+24) /* TSC does not stop in C states */
+#define X86_FEATURE_CPUID               ( 3*32+25) /* CPU has CPUID instruction itself */
+#define X86_FEATURE_EXTD_APICID         ( 3*32+26) /* Extended APICID (8 bits) */
+#define X86_FEATURE_AMD_DCM             ( 3*32+27) /* AMD multi-node processor */
+#define X86_FEATURE_APERFMPERF          ( 3*32+28) /* P-State hardware coordination feedback capability (APERF/MPERF MSRs) */
+#define X86_FEATURE_NONSTOP_TSC_S3      ( 3*32+30) /* TSC doesn't stop in S3 state */
+#define X86_FEATURE_TSC_KNOWN_FREQ      ( 3*32+31) /* TSC has known frequency */
 
-/* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */
-#define X86_FEATURE_XMM3        ( 4*32+ 0) /* "pni" SSE-3 */
-#define X86_FEATURE_PCLMULQDQ   ( 4*32+ 1) /* PCLMULQDQ instruction */
-#define X86_FEATURE_DTES64      ( 4*32+ 2) /* 64-bit Debug Store */
-#define X86_FEATURE_MWAIT       ( 4*32+ 3) /* "monitor" Monitor/Mwait support */
-#define X86_FEATURE_DSCPL       ( 4*32+ 4) /* "ds_cpl" CPL Qual. Debug Store */
-#define X86_FEATURE_VMX         ( 4*32+ 5) /* Hardware virtualization */
-#define X86_FEATURE_SMX         ( 4*32+ 6) /* Safer mode */
-#define X86_FEATURE_EST         ( 4*32+ 7) /* Enhanced SpeedStep */
-#define X86_FEATURE_TM2         ( 4*32+ 8) /* Thermal Monitor 2 */
-#define X86_FEATURE_SSSE3       ( 4*32+ 9) /* Supplemental SSE-3 */
-#define X86_FEATURE_CID         ( 4*32+10) /* Context ID */
-#define X86_FEATURE_SDBG        ( 4*32+11) /* Silicon Debug */
-#define X86_FEATURE_FMA         ( 4*32+12) /* Fused multiply-add */
-#define X86_FEATURE_CX16        ( 4*32+13) /* CMPXCHG16B */
-#define X86_FEATURE_XTPR        ( 4*32+14) /* Send Task Priority Messages */
-#define X86_FEATURE_PDCM        ( 4*32+15) /* Performance Capabilities */
-#define X86_FEATURE_PCID        ( 4*32+17) /* Process Context Identifiers */
-#define X86_FEATURE_DCA         ( 4*32+18) /* Direct Cache Access */
-#define X86_FEATURE_XMM4_1      ( 4*32+19) /* "sse4_1" SSE-4.1 */
-#define X86_FEATURE_XMM4_2      ( 4*32+20) /* "sse4_2" SSE-4.2 */
-#define X86_FEATURE_X2APIC      ( 4*32+21) /* x2APIC */
-#define X86_FEATURE_MOVBE       ( 4*32+22) /* MOVBE instruction */
-#define X86_FEATURE_POPCNT      ( 4*32+23) /* POPCNT instruction */
-#define X86_FEATURE_TSC_DEADLINE_TIMER  ( 4*32+24) /* Tsc deadline timer */
-#define X86_FEATURE_AES         ( 4*32+25) /* AES instructions */
-#define X86_FEATURE_XSAVE       ( 4*32+26) /* XSAVE/XRSTOR/XSETBV/XGETBV */
-#define X86_FEATURE_OSXSAVE     ( 4*32+27) /* "" XSAVE enabled in the OS */
-#define X86_FEATURE_AVX         ( 4*32+28) /* Advanced Vector Extensions */
-#define X86_FEATURE_F16C        ( 4*32+29) /* 16-bit fp conversions */
-#define X86_FEATURE_RDRAND      ( 4*32+30) /* The RDRAND instruction */
-#define X86_FEATURE_HYPERVISOR  ( 4*32+31) /* Running on a hypervisor */
+/* Intel-defined CPU features, CPUID level 0x00000001 (ECX), word 4 */
+#define X86_FEATURE_XMM3                ( 4*32+ 0) /* "pni" SSE-3 */
+#define X86_FEATURE_PCLMULQDQ           ( 4*32+ 1) /* PCLMULQDQ instruction */
+#define X86_FEATURE_DTES64              ( 4*32+ 2) /* 64-bit Debug Store */
+#define X86_FEATURE_MWAIT               ( 4*32+ 3) /* "monitor" MONITOR/MWAIT support */
+#define X86_FEATURE_DSCPL               ( 4*32+ 4) /* "ds_cpl" CPL-qualified (filtered) Debug Store */
+#define X86_FEATURE_VMX                 ( 4*32+ 5) /* Hardware virtualization */
+#define X86_FEATURE_SMX                 ( 4*32+ 6) /* Safer Mode eXtensions */
+#define X86_FEATURE_EST                 ( 4*32+ 7) /* Enhanced SpeedStep */
+#define X86_FEATURE_TM2                 ( 4*32+ 8) /* Thermal Monitor 2 */
+#define X86_FEATURE_SSSE3               ( 4*32+ 9) /* Supplemental SSE-3 */
+#define X86_FEATURE_CID                 ( 4*32+10) /* Context ID */
+#define X86_FEATURE_SDBG                ( 4*32+11) /* Silicon Debug */
+#define X86_FEATURE_FMA                 ( 4*32+12) /* Fused multiply-add */
+#define X86_FEATURE_CX16                ( 4*32+13) /* CMPXCHG16B instruction */
+#define X86_FEATURE_XTPR                ( 4*32+14) /* Send Task Priority Messages */
+#define X86_FEATURE_PDCM                ( 4*32+15) /* Perf/Debug Capabilities MSR */
+#define X86_FEATURE_PCID                ( 4*32+17) /* Process Context Identifiers */
+#define X86_FEATURE_DCA                 ( 4*32+18) /* Direct Cache Access */
+#define X86_FEATURE_XMM4_1              ( 4*32+19) /* "sse4_1" SSE-4.1 */
+#define X86_FEATURE_XMM4_2              ( 4*32+20) /* "sse4_2" SSE-4.2 */
+#define X86_FEATURE_X2APIC              ( 4*32+21) /* X2APIC */
+#define X86_FEATURE_MOVBE               ( 4*32+22) /* MOVBE instruction */
+#define X86_FEATURE_POPCNT              ( 4*32+23) /* POPCNT instruction */
+#define X86_FEATURE_TSC_DEADLINE_TIMER  ( 4*32+24) /* TSC deadline timer */
+#define X86_FEATURE_AES                 ( 4*32+25) /* AES instructions */
+#define X86_FEATURE_XSAVE               ( 4*32+26) /* XSAVE/XRSTOR/XSETBV/XGETBV instructions */
+#define X86_FEATURE_OSXSAVE             ( 4*32+27) /* "" XSAVE instruction enabled in the OS */
+#define X86_FEATURE_AVX                 ( 4*32+28) /* Advanced Vector Extensions */
+#define X86_FEATURE_F16C                ( 4*32+29) /* 16-bit FP conversions */
+#define X86_FEATURE_RDRAND              ( 4*32+30) /* RDRAND instruction */
+#define X86_FEATURE_HYPERVISOR          ( 4*32+31) /* Running on a hypervisor */
 
 /* VIA/Cyrix/Centaur-defined CPU features, CPUID level 0xC0000001, word 5 */
-#define X86_FEATURE_XSTORE      ( 5*32+ 2) /* "rng" RNG present (xstore) */
-#define X86_FEATURE_XSTORE_EN   ( 5*32+ 3) /* "rng_en" RNG enabled */
-#define X86_FEATURE_XCRYPT      ( 5*32+ 6) /* "ace" on-CPU crypto (xcrypt) */
-#define X86_FEATURE_XCRYPT_EN   ( 5*32+ 7) /* "ace_en" on-CPU crypto enabled */
-#define X86_FEATURE_ACE2        ( 5*32+ 8) /* Advanced Cryptography Engine v2 */
-#define X86_FEATURE_ACE2_EN     ( 5*32+ 9) /* ACE v2 enabled */
-#define X86_FEATURE_PHE         ( 5*32+10) /* PadLock Hash Engine */
-#define X86_FEATURE_PHE_EN      ( 5*32+11) /* PHE enabled */
-#define X86_FEATURE_PMM         ( 5*32+12) /* PadLock Montgomery Multiplier */
-#define X86_FEATURE_PMM_EN      ( 5*32+13) /* PMM enabled */
+#define X86_FEATURE_XSTORE              ( 5*32+ 2) /* "rng" RNG present (xstore) */
+#define X86_FEATURE_XSTORE_EN           ( 5*32+ 3) /* "rng_en" RNG enabled */
+#define X86_FEATURE_XCRYPT              ( 5*32+ 6) /* "ace" on-CPU crypto (xcrypt) */
+#define X86_FEATURE_XCRYPT_EN           ( 5*32+ 7) /* "ace_en" on-CPU crypto enabled */
+#define X86_FEATURE_ACE2                ( 5*32+ 8) /* Advanced Cryptography Engine v2 */
+#define X86_FEATURE_ACE2_EN             ( 5*32+ 9) /* ACE v2 enabled */
+#define X86_FEATURE_PHE                 ( 5*32+10) /* PadLock Hash Engine */
+#define X86_FEATURE_PHE_EN              ( 5*32+11) /* PHE enabled */
+#define X86_FEATURE_PMM                 ( 5*32+12) /* PadLock Montgomery Multiplier */
+#define X86_FEATURE_PMM_EN              ( 5*32+13) /* PMM enabled */
 
-/* More extended AMD flags: CPUID level 0x80000001, ecx, word 6 */
-#define X86_FEATURE_LAHF_LM     ( 6*32+ 0) /* LAHF/SAHF in long mode */
-#define X86_FEATURE_CMP_LEGACY  ( 6*32+ 1) /* If yes HyperThreading not valid */
-#define X86_FEATURE_SVM         ( 6*32+ 2) /* Secure virtual machine */
-#define X86_FEATURE_EXTAPIC     ( 6*32+ 3) /* Extended APIC space */
-#define X86_FEATURE_CR8_LEGACY  ( 6*32+ 4) /* CR8 in 32-bit mode */
-#define X86_FEATURE_ABM         ( 6*32+ 5) /* Advanced bit manipulation */
-#define X86_FEATURE_SSE4A       ( 6*32+ 6) /* SSE-4A */
-#define X86_FEATURE_MISALIGNSSE ( 6*32+ 7) /* Misaligned SSE mode */
-#define X86_FEATURE_3DNOWPREFETCH ( 6*32+ 8) /* 3DNow prefetch instructions */
-#define X86_FEATURE_OSVW        ( 6*32+ 9) /* OS Visible Workaround */
-#define X86_FEATURE_IBS         ( 6*32+10) /* Instruction Based Sampling */
-#define X86_FEATURE_XOP         ( 6*32+11) /* extended AVX instructions */
-#define X86_FEATURE_SKINIT      ( 6*32+12) /* SKINIT/STGI instructions */
-#define X86_FEATURE_WDT         ( 6*32+13) /* Watchdog timer */
-#define X86_FEATURE_LWP         ( 6*32+15) /* Light Weight Profiling */
-#define X86_FEATURE_FMA4        ( 6*32+16) /* 4 operands MAC instructions */
-#define X86_FEATURE_TCE         ( 6*32+17) /* translation cache extension */
-#define X86_FEATURE_NODEID_MSR  ( 6*32+19) /* NodeId MSR */
-#define X86_FEATURE_TBM         ( 6*32+21) /* trailing bit manipulations */
-#define X86_FEATURE_TOPOEXT     ( 6*32+22) /* topology extensions CPUID leafs */
-#define X86_FEATURE_PERFCTR_CORE ( 6*32+23) /* core performance counter extensions */
-#define X86_FEATURE_PERFCTR_NB  ( 6*32+24) /* NB performance counter extensions */
-#define X86_FEATURE_BPEXT       (6*32+26) /* data breakpoint extension */
-#define X86_FEATURE_PTSC        ( 6*32+27) /* performance time-stamp counter */
-#define X86_FEATURE_PERFCTR_LLC ( 6*32+28) /* Last Level Cache performance counter extensions */
-#define X86_FEATURE_MWAITX      ( 6*32+29) /* MWAIT extension (MONITORX/MWAITX) */
+/* More extended AMD flags: CPUID level 0x80000001, ECX, word 6 */
+#define X86_FEATURE_LAHF_LM             ( 6*32+ 0) /* LAHF/SAHF in long mode */
+#define X86_FEATURE_CMP_LEGACY          ( 6*32+ 1) /* If yes HyperThreading not valid */
+#define X86_FEATURE_SVM                 ( 6*32+ 2) /* Secure Virtual Machine */
+#define X86_FEATURE_EXTAPIC             ( 6*32+ 3) /* Extended APIC space */
+#define X86_FEATURE_CR8_LEGACY          ( 6*32+ 4) /* CR8 in 32-bit mode */
+#define X86_FEATURE_ABM                 ( 6*32+ 5) /* Advanced bit manipulation */
+#define X86_FEATURE_SSE4A               ( 6*32+ 6) /* SSE-4A */
+#define X86_FEATURE_MISALIGNSSE         ( 6*32+ 7) /* Misaligned SSE mode */
+#define X86_FEATURE_3DNOWPREFETCH       ( 6*32+ 8) /* 3DNow prefetch instructions */
+#define X86_FEATURE_OSVW                ( 6*32+ 9) /* OS Visible Workaround */
+#define X86_FEATURE_IBS                 ( 6*32+10) /* Instruction Based Sampling */
+#define X86_FEATURE_XOP                 ( 6*32+11) /* extended AVX instructions */
+#define X86_FEATURE_SKINIT              ( 6*32+12) /* SKINIT/STGI instructions */
+#define X86_FEATURE_WDT                 ( 6*32+13) /* Watchdog timer */
+#define X86_FEATURE_LWP                 ( 6*32+15) /* Light Weight Profiling */
+#define X86_FEATURE_FMA4                ( 6*32+16) /* 4 operands MAC instructions */
+#define X86_FEATURE_TCE                 ( 6*32+17) /* Translation Cache Extension */
+#define X86_FEATURE_NODEID_MSR          ( 6*32+19) /* NodeId MSR */
+#define X86_FEATURE_TBM                 ( 6*32+21) /* Trailing Bit Manipulations */
+#define X86_FEATURE_TOPOEXT             ( 6*32+22) /* Topology extensions CPUID leafs */
+#define X86_FEATURE_PERFCTR_CORE        ( 6*32+23) /* Core performance counter extensions */
+#define X86_FEATURE_PERFCTR_NB          ( 6*32+24) /* NB performance counter extensions */
+#define X86_FEATURE_BPEXT               ( 6*32+26) /* Data breakpoint extension */
+#define X86_FEATURE_PTSC                ( 6*32+27) /* Performance time-stamp counter */
+#define X86_FEATURE_PERFCTR_LLC         ( 6*32+28) /* Last Level Cache performance counter extensions */
+#define X86_FEATURE_MWAITX              ( 6*32+29) /* MWAIT extension (MONITORX/MWAITX instructions) */
 
 /*
  * Auxiliary flags: Linux defined - For features scattered in various
@@ -187,146 +190,155 @@
  *
  * Reuse free bits when adding new feature flags!
  */
-#define X86_FEATURE_RING3MWAIT  ( 7*32+ 0) /* Ring 3 MONITOR/MWAIT */
-#define X86_FEATURE_CPUID_FAULT ( 7*32+ 1) /* Intel CPUID faulting */
-#define X86_FEATURE_CPB         ( 7*32+ 2) /* AMD Core Performance Boost */
-#define X86_FEATURE_EPB         ( 7*32+ 3) /* IA32_ENERGY_PERF_BIAS support */
-#define X86_FEATURE_CAT_L3      ( 7*32+ 4) /* Cache Allocation Technology L3 */
-#define X86_FEATURE_CAT_L2      ( 7*32+ 5) /* Cache Allocation Technology L2 */
-#define X86_FEATURE_CDP_L3      ( 7*32+ 6) /* Code and Data Prioritization L3 */
+#define X86_FEATURE_RING3MWAIT          ( 7*32+ 0) /* Ring 3 MONITOR/MWAIT instructions */
+#define X86_FEATURE_CPUID_FAULT         ( 7*32+ 1) /* Intel CPUID faulting */
+#define X86_FEATURE_CPB                 ( 7*32+ 2) /* AMD Core Performance Boost */
+#define X86_FEATURE_EPB                 ( 7*32+ 3) /* IA32_ENERGY_PERF_BIAS support */
+#define X86_FEATURE_CAT_L3              ( 7*32+ 4) /* Cache Allocation Technology L3 */
+#define X86_FEATURE_CAT_L2              ( 7*32+ 5) /* Cache Allocation Technology L2 */
+#define X86_FEATURE_CDP_L3              ( 7*32+ 6) /* Code and Data Prioritization L3 */
 
-#define X86_FEATURE_HW_PSTATE   ( 7*32+ 8) /* AMD HW-PState */
-#define X86_FEATURE_PROC_FEEDBACK ( 7*32+ 9) /* AMD ProcFeedbackInterface */
-#define X86_FEATURE_SME         ( 7*32+10) /* AMD Secure Memory Encryption */
+#define X86_FEATURE_HW_PSTATE           ( 7*32+ 8) /* AMD HW-PState */
+#define X86_FEATURE_PROC_FEEDBACK       ( 7*32+ 9) /* AMD ProcFeedbackInterface */
+#define X86_FEATURE_SME                 ( 7*32+10) /* AMD Secure Memory Encryption */
 
-#define X86_FEATURE_INTEL_PPIN  ( 7*32+14) /* Intel Processor Inventory Number */
-#define X86_FEATURE_INTEL_PT    ( 7*32+15) /* Intel Processor Trace */
-#define X86_FEATURE_AVX512_4VNNIW (7*32+16) /* AVX-512 Neural Network Instructions */
-#define X86_FEATURE_AVX512_4FMAPS (7*32+17) /* AVX-512 Multiply Accumulation Single precision */
+#define X86_FEATURE_INTEL_PPIN          ( 7*32+14) /* Intel Processor Inventory Number */
+#define X86_FEATURE_INTEL_PT            ( 7*32+15) /* Intel Processor Trace */
+#define X86_FEATURE_AVX512_4VNNIW       ( 7*32+16) /* AVX-512 Neural Network Instructions */
+#define X86_FEATURE_AVX512_4FMAPS       ( 7*32+17) /* AVX-512 Multiply Accumulation Single precision */
 
-#define X86_FEATURE_MBA         ( 7*32+18) /* Memory Bandwidth Allocation */
+#define X86_FEATURE_MBA                 ( 7*32+18) /* Memory Bandwidth Allocation */
 
 /* Virtualization flags: Linux defined, word 8 */
-#define X86_FEATURE_TPR_SHADOW  ( 8*32+ 0) /* Intel TPR Shadow */
-#define X86_FEATURE_VNMI        ( 8*32+ 1) /* Intel Virtual NMI */
-#define X86_FEATURE_FLEXPRIORITY ( 8*32+ 2) /* Intel FlexPriority */
-#define X86_FEATURE_EPT         ( 8*32+ 3) /* Intel Extended Page Table */
-#define X86_FEATURE_VPID        ( 8*32+ 4) /* Intel Virtual Processor ID */
+#define X86_FEATURE_TPR_SHADOW          ( 8*32+ 0) /* Intel TPR Shadow */
+#define X86_FEATURE_VNMI                ( 8*32+ 1) /* Intel Virtual NMI */
+#define X86_FEATURE_FLEXPRIORITY        ( 8*32+ 2) /* Intel FlexPriority */
+#define X86_FEATURE_EPT                 ( 8*32+ 3) /* Intel Extended Page Table */
+#define X86_FEATURE_VPID                ( 8*32+ 4) /* Intel Virtual Processor ID */
 
-#define X86_FEATURE_VMMCALL     ( 8*32+15) /* Prefer vmmcall to vmcall */
-#define X86_FEATURE_XENPV       ( 8*32+16) /* "" Xen paravirtual guest */
+#define X86_FEATURE_VMMCALL             ( 8*32+15) /* Prefer VMMCALL to VMCALL */
+#define X86_FEATURE_XENPV               ( 8*32+16) /* "" Xen paravirtual guest */
 
 
-/* Intel-defined CPU features, CPUID level 0x00000007:0 (ebx), word 9 */
-#define X86_FEATURE_FSGSBASE    ( 9*32+ 0) /* {RD/WR}{FS/GS}BASE instructions*/
-#define X86_FEATURE_TSC_ADJUST  ( 9*32+ 1) /* TSC adjustment MSR 0x3b */
-#define X86_FEATURE_BMI1        ( 9*32+ 3) /* 1st group bit manipulation extensions */
-#define X86_FEATURE_HLE         ( 9*32+ 4) /* Hardware Lock Elision */
-#define X86_FEATURE_AVX2        ( 9*32+ 5) /* AVX2 instructions */
-#define X86_FEATURE_SMEP        ( 9*32+ 7) /* Supervisor Mode Execution Protection */
-#define X86_FEATURE_BMI2        ( 9*32+ 8) /* 2nd group bit manipulation extensions */
-#define X86_FEATURE_ERMS        ( 9*32+ 9) /* Enhanced REP MOVSB/STOSB */
-#define X86_FEATURE_INVPCID     ( 9*32+10) /* Invalidate Processor Context ID */
-#define X86_FEATURE_RTM         ( 9*32+11) /* Restricted Transactional Memory */
-#define X86_FEATURE_CQM         ( 9*32+12) /* Cache QoS Monitoring */
-#define X86_FEATURE_MPX         ( 9*32+14) /* Memory Protection Extension */
-#define X86_FEATURE_RDT_A       ( 9*32+15) /* Resource Director Technology Allocation */
-#define X86_FEATURE_AVX512F     ( 9*32+16) /* AVX-512 Foundation */
-#define X86_FEATURE_AVX512DQ    ( 9*32+17) /* AVX-512 DQ (Double/Quad granular) Instructions */
-#define X86_FEATURE_RDSEED      ( 9*32+18) /* The RDSEED instruction */
-#define X86_FEATURE_ADX         ( 9*32+19) /* The ADCX and ADOX instructions */
-#define X86_FEATURE_SMAP        ( 9*32+20) /* Supervisor Mode Access Prevention */
-#define X86_FEATURE_AVX512IFMA  ( 9*32+21) /* AVX-512 Integer Fused Multiply-Add instructions */
-#define X86_FEATURE_CLFLUSHOPT  ( 9*32+23) /* CLFLUSHOPT instruction */
-#define X86_FEATURE_CLWB        ( 9*32+24) /* CLWB instruction */
-#define X86_FEATURE_AVX512PF    ( 9*32+26) /* AVX-512 Prefetch */
-#define X86_FEATURE_AVX512ER    ( 9*32+27) /* AVX-512 Exponential and Reciprocal */
-#define X86_FEATURE_AVX512CD    ( 9*32+28) /* AVX-512 Conflict Detection */
-#define X86_FEATURE_SHA_NI      ( 9*32+29) /* SHA1/SHA256 Instruction Extensions */
-#define X86_FEATURE_AVX512BW    ( 9*32+30) /* AVX-512 BW (Byte/Word granular) Instructions */
-#define X86_FEATURE_AVX512VL    ( 9*32+31) /* AVX-512 VL (128/256 Vector Length) Extensions */
+/* Intel-defined CPU features, CPUID level 0x00000007:0 (EBX), word 9 */
+#define X86_FEATURE_FSGSBASE            ( 9*32+ 0) /* RDFSBASE, WRFSBASE, RDGSBASE, WRGSBASE instructions*/
+#define X86_FEATURE_TSC_ADJUST          ( 9*32+ 1) /* TSC adjustment MSR 0x3B */
+#define X86_FEATURE_BMI1                ( 9*32+ 3) /* 1st group bit manipulation extensions */
+#define X86_FEATURE_HLE                 ( 9*32+ 4) /* Hardware Lock Elision */
+#define X86_FEATURE_AVX2                ( 9*32+ 5) /* AVX2 instructions */
+#define X86_FEATURE_SMEP                ( 9*32+ 7) /* Supervisor Mode Execution Protection */
+#define X86_FEATURE_BMI2                ( 9*32+ 8) /* 2nd group bit manipulation extensions */
+#define X86_FEATURE_ERMS                ( 9*32+ 9) /* Enhanced REP MOVSB/STOSB instructions */
+#define X86_FEATURE_INVPCID             ( 9*32+10) /* Invalidate Processor Context ID */
+#define X86_FEATURE_RTM                 ( 9*32+11) /* Restricted Transactional Memory */
+#define X86_FEATURE_CQM                 ( 9*32+12) /* Cache QoS Monitoring */
+#define X86_FEATURE_MPX                 ( 9*32+14) /* Memory Protection Extension */
+#define X86_FEATURE_RDT_A               ( 9*32+15) /* Resource Director Technology Allocation */
+#define X86_FEATURE_AVX512F             ( 9*32+16) /* AVX-512 Foundation */
+#define X86_FEATURE_AVX512DQ            ( 9*32+17) /* AVX-512 DQ (Double/Quad granular) Instructions */
+#define X86_FEATURE_RDSEED              ( 9*32+18) /* RDSEED instruction */
+#define X86_FEATURE_ADX                 ( 9*32+19) /* ADCX and ADOX instructions */
+#define X86_FEATURE_SMAP                ( 9*32+20) /* Supervisor Mode Access Prevention */
+#define X86_FEATURE_AVX512IFMA          ( 9*32+21) /* AVX-512 Integer Fused Multiply-Add instructions */
+#define X86_FEATURE_CLFLUSHOPT          ( 9*32+23) /* CLFLUSHOPT instruction */
+#define X86_FEATURE_CLWB                ( 9*32+24) /* CLWB instruction */
+#define X86_FEATURE_AVX512PF            ( 9*32+26) /* AVX-512 Prefetch */
+#define X86_FEATURE_AVX512ER            ( 9*32+27) /* AVX-512 Exponential and Reciprocal */
+#define X86_FEATURE_AVX512CD            ( 9*32+28) /* AVX-512 Conflict Detection */
+#define X86_FEATURE_SHA_NI              ( 9*32+29) /* SHA1/SHA256 Instruction Extensions */
+#define X86_FEATURE_AVX512BW            ( 9*32+30) /* AVX-512 BW (Byte/Word granular) Instructions */
+#define X86_FEATURE_AVX512VL            ( 9*32+31) /* AVX-512 VL (128/256 Vector Length) Extensions */
 
-/* Extended state features, CPUID level 0x0000000d:1 (eax), word 10 */
-#define X86_FEATURE_XSAVEOPT    (10*32+ 0) /* XSAVEOPT */
-#define X86_FEATURE_XSAVEC      (10*32+ 1) /* XSAVEC */
-#define X86_FEATURE_XGETBV1     (10*32+ 2) /* XGETBV with ECX = 1 */
-#define X86_FEATURE_XSAVES      (10*32+ 3) /* XSAVES/XRSTORS */
+/* Extended state features, CPUID level 0x0000000d:1 (EAX), word 10 */
+#define X86_FEATURE_XSAVEOPT            (10*32+ 0) /* XSAVEOPT instruction */
+#define X86_FEATURE_XSAVEC              (10*32+ 1) /* XSAVEC instruction */
+#define X86_FEATURE_XGETBV1             (10*32+ 2) /* XGETBV with ECX = 1 instruction */
+#define X86_FEATURE_XSAVES              (10*32+ 3) /* XSAVES/XRSTORS instructions */
 
-/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:0 (edx), word 11 */
-#define X86_FEATURE_CQM_LLC     (11*32+ 1) /* LLC QoS if 1 */
+/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:0 (EDX), word 11 */
+#define X86_FEATURE_CQM_LLC             (11*32+ 1) /* LLC QoS if 1 */
 
-/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:1 (edx), word 12 */
-#define X86_FEATURE_CQM_OCCUP_LLC (12*32+ 0) /* LLC occupancy monitoring if 1 */
-#define X86_FEATURE_CQM_MBM_TOTAL (12*32+ 1) /* LLC Total MBM monitoring */
-#define X86_FEATURE_CQM_MBM_LOCAL (12*32+ 2) /* LLC Local MBM monitoring */
+/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:1 (EDX), word 12 */
+#define X86_FEATURE_CQM_OCCUP_LLC       (12*32+ 0) /* LLC occupancy monitoring */
+#define X86_FEATURE_CQM_MBM_TOTAL       (12*32+ 1) /* LLC Total MBM monitoring */
+#define X86_FEATURE_CQM_MBM_LOCAL       (12*32+ 2) /* LLC Local MBM monitoring */
 
-/* AMD-defined CPU features, CPUID level 0x80000008 (ebx), word 13 */
-#define X86_FEATURE_CLZERO      (13*32+0) /* CLZERO instruction */
-#define X86_FEATURE_IRPERF      (13*32+1) /* Instructions Retired Count */
+/* AMD-defined CPU features, CPUID level 0x80000008 (EBX), word 13 */
+#define X86_FEATURE_CLZERO              (13*32+ 0) /* CLZERO instruction */
+#define X86_FEATURE_IRPERF              (13*32+ 1) /* Instructions Retired Count */
+#define X86_FEATURE_XSAVEERPTR          (13*32+ 2) /* Always save/restore FP error pointers */
 
-/* Thermal and Power Management Leaf, CPUID level 0x00000006 (eax), word 14 */
-#define X86_FEATURE_DTHERM      (14*32+ 0) /* Digital Thermal Sensor */
-#define X86_FEATURE_IDA         (14*32+ 1) /* Intel Dynamic Acceleration */
-#define X86_FEATURE_ARAT        (14*32+ 2) /* Always Running APIC Timer */
-#define X86_FEATURE_PLN         (14*32+ 4) /* Intel Power Limit Notification */
-#define X86_FEATURE_PTS         (14*32+ 6) /* Intel Package Thermal Status */
-#define X86_FEATURE_HWP         (14*32+ 7) /* Intel Hardware P-states */
-#define X86_FEATURE_HWP_NOTIFY  (14*32+ 8) /* HWP Notification */
-#define X86_FEATURE_HWP_ACT_WINDOW (14*32+ 9) /* HWP Activity Window */
-#define X86_FEATURE_HWP_EPP     (14*32+10) /* HWP Energy Perf. Preference */
-#define X86_FEATURE_HWP_PKG_REQ (14*32+11) /* HWP Package Level Request */
+/* Thermal and Power Management Leaf, CPUID level 0x00000006 (EAX), word 14 */
+#define X86_FEATURE_DTHERM              (14*32+ 0) /* Digital Thermal Sensor */
+#define X86_FEATURE_IDA                 (14*32+ 1) /* Intel Dynamic Acceleration */
+#define X86_FEATURE_ARAT                (14*32+ 2) /* Always Running APIC Timer */
+#define X86_FEATURE_PLN                 (14*32+ 4) /* Intel Power Limit Notification */
+#define X86_FEATURE_PTS                 (14*32+ 6) /* Intel Package Thermal Status */
+#define X86_FEATURE_HWP                 (14*32+ 7) /* Intel Hardware P-states */
+#define X86_FEATURE_HWP_NOTIFY          (14*32+ 8) /* HWP Notification */
+#define X86_FEATURE_HWP_ACT_WINDOW      (14*32+ 9) /* HWP Activity Window */
+#define X86_FEATURE_HWP_EPP             (14*32+10) /* HWP Energy Perf. Preference */
+#define X86_FEATURE_HWP_PKG_REQ         (14*32+11) /* HWP Package Level Request */
 
-/* AMD SVM Feature Identification, CPUID level 0x8000000a (edx), word 15 */
-#define X86_FEATURE_NPT         (15*32+ 0) /* Nested Page Table support */
-#define X86_FEATURE_LBRV        (15*32+ 1) /* LBR Virtualization support */
-#define X86_FEATURE_SVML        (15*32+ 2) /* "svm_lock" SVM locking MSR */
-#define X86_FEATURE_NRIPS       (15*32+ 3) /* "nrip_save" SVM next_rip save */
-#define X86_FEATURE_TSCRATEMSR  (15*32+ 4) /* "tsc_scale" TSC scaling support */
-#define X86_FEATURE_VMCBCLEAN   (15*32+ 5) /* "vmcb_clean" VMCB clean bits support */
-#define X86_FEATURE_FLUSHBYASID (15*32+ 6) /* flush-by-ASID support */
-#define X86_FEATURE_DECODEASSISTS (15*32+ 7) /* Decode Assists support */
-#define X86_FEATURE_PAUSEFILTER (15*32+10) /* filtered pause intercept */
-#define X86_FEATURE_PFTHRESHOLD (15*32+12) /* pause filter threshold */
-#define X86_FEATURE_AVIC        (15*32+13) /* Virtual Interrupt Controller */
-#define X86_FEATURE_V_VMSAVE_VMLOAD (15*32+15) /* Virtual VMSAVE VMLOAD */
-#define X86_FEATURE_VGIF        (15*32+16) /* Virtual GIF */
+/* AMD SVM Feature Identification, CPUID level 0x8000000a (EDX), word 15 */
+#define X86_FEATURE_NPT                 (15*32+ 0) /* Nested Page Table support */
+#define X86_FEATURE_LBRV                (15*32+ 1) /* LBR Virtualization support */
+#define X86_FEATURE_SVML                (15*32+ 2) /* "svm_lock" SVM locking MSR */
+#define X86_FEATURE_NRIPS               (15*32+ 3) /* "nrip_save" SVM next_rip save */
+#define X86_FEATURE_TSCRATEMSR          (15*32+ 4) /* "tsc_scale" TSC scaling support */
+#define X86_FEATURE_VMCBCLEAN           (15*32+ 5) /* "vmcb_clean" VMCB clean bits support */
+#define X86_FEATURE_FLUSHBYASID         (15*32+ 6) /* flush-by-ASID support */
+#define X86_FEATURE_DECODEASSISTS       (15*32+ 7) /* Decode Assists support */
+#define X86_FEATURE_PAUSEFILTER         (15*32+10) /* filtered pause intercept */
+#define X86_FEATURE_PFTHRESHOLD         (15*32+12) /* pause filter threshold */
+#define X86_FEATURE_AVIC                (15*32+13) /* Virtual Interrupt Controller */
+#define X86_FEATURE_V_VMSAVE_VMLOAD     (15*32+15) /* Virtual VMSAVE VMLOAD */
+#define X86_FEATURE_VGIF                (15*32+16) /* Virtual GIF */
 
-/* Intel-defined CPU features, CPUID level 0x00000007:0 (ecx), word 16 */
-#define X86_FEATURE_AVX512VBMI  (16*32+ 1) /* AVX512 Vector Bit Manipulation instructions*/
-#define X86_FEATURE_PKU         (16*32+ 3) /* Protection Keys for Userspace */
-#define X86_FEATURE_OSPKE       (16*32+ 4) /* OS Protection Keys Enable */
-#define X86_FEATURE_AVX512_VPOPCNTDQ (16*32+14) /* POPCNT for vectors of DW/QW */
-#define X86_FEATURE_LA57        (16*32+16) /* 5-level page tables */
-#define X86_FEATURE_RDPID       (16*32+22) /* RDPID instruction */
+/* Intel-defined CPU features, CPUID level 0x00000007:0 (ECX), word 16 */
+#define X86_FEATURE_AVX512VBMI          (16*32+ 1) /* AVX512 Vector Bit Manipulation instructions*/
+#define X86_FEATURE_UMIP                (16*32+ 2) /* User Mode Instruction Protection */
+#define X86_FEATURE_PKU                 (16*32+ 3) /* Protection Keys for Userspace */
+#define X86_FEATURE_OSPKE               (16*32+ 4) /* OS Protection Keys Enable */
+#define X86_FEATURE_AVX512_VBMI2        (16*32+ 6) /* Additional AVX512 Vector Bit Manipulation Instructions */
+#define X86_FEATURE_GFNI                (16*32+ 8) /* Galois Field New Instructions */
+#define X86_FEATURE_VAES                (16*32+ 9) /* Vector AES */
+#define X86_FEATURE_VPCLMULQDQ          (16*32+10) /* Carry-Less Multiplication Double Quadword */
+#define X86_FEATURE_AVX512_VNNI         (16*32+11) /* Vector Neural Network Instructions */
+#define X86_FEATURE_AVX512_BITALG       (16*32+12) /* Support for VPOPCNT[B,W] and VPSHUF-BITQMB instructions */
+#define X86_FEATURE_AVX512_VPOPCNTDQ    (16*32+14) /* POPCNT for vectors of DW/QW */
+#define X86_FEATURE_LA57                (16*32+16) /* 5-level page tables */
+#define X86_FEATURE_RDPID               (16*32+22) /* RDPID instruction */
 
-/* AMD-defined CPU features, CPUID level 0x80000007 (ebx), word 17 */
-#define X86_FEATURE_OVERFLOW_RECOV (17*32+0) /* MCA overflow recovery support */
-#define X86_FEATURE_SUCCOR      (17*32+1) /* Uncorrectable error containment and recovery */
-#define X86_FEATURE_SMCA        (17*32+3) /* Scalable MCA */
+/* AMD-defined CPU features, CPUID level 0x80000007 (EBX), word 17 */
+#define X86_FEATURE_OVERFLOW_RECOV      (17*32+ 0) /* MCA overflow recovery support */
+#define X86_FEATURE_SUCCOR              (17*32+ 1) /* Uncorrectable error containment and recovery */
+#define X86_FEATURE_SMCA                (17*32+ 3) /* Scalable MCA */
 
 /*
  * BUG word(s)
  */
-#define X86_BUG(x)              (NCAPINTS*32 + (x))
+#define X86_BUG(x)                      (NCAPINTS*32 + (x))
 
-#define X86_BUG_F00F            X86_BUG(0) /* Intel F00F */
-#define X86_BUG_FDIV            X86_BUG(1) /* FPU FDIV */
-#define X86_BUG_COMA            X86_BUG(2) /* Cyrix 6x86 coma */
-#define X86_BUG_AMD_TLB_MMATCH  X86_BUG(3) /* "tlb_mmatch" AMD Erratum 383 */
-#define X86_BUG_AMD_APIC_C1E    X86_BUG(4) /* "apic_c1e" AMD Erratum 400 */
-#define X86_BUG_11AP            X86_BUG(5) /* Bad local APIC aka 11AP */
-#define X86_BUG_FXSAVE_LEAK     X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */
-#define X86_BUG_CLFLUSH_MONITOR X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */
-#define X86_BUG_SYSRET_SS_ATTRS X86_BUG(8) /* SYSRET doesn't fix up SS attrs */
+#define X86_BUG_F00F                    X86_BUG(0) /* Intel F00F */
+#define X86_BUG_FDIV                    X86_BUG(1) /* FPU FDIV */
+#define X86_BUG_COMA                    X86_BUG(2) /* Cyrix 6x86 coma */
+#define X86_BUG_AMD_TLB_MMATCH          X86_BUG(3) /* "tlb_mmatch" AMD Erratum 383 */
+#define X86_BUG_AMD_APIC_C1E            X86_BUG(4) /* "apic_c1e" AMD Erratum 400 */
+#define X86_BUG_11AP                    X86_BUG(5) /* Bad local APIC aka 11AP */
+#define X86_BUG_FXSAVE_LEAK             X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */
+#define X86_BUG_CLFLUSH_MONITOR         X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */
+#define X86_BUG_SYSRET_SS_ATTRS         X86_BUG(8) /* SYSRET doesn't fix up SS attrs */
 #ifdef CONFIG_X86_32
 /*
  * 64-bit kernels don't use X86_BUG_ESPFIX.  Make the define conditional
  * to avoid confusion.
  */
-#define X86_BUG_ESPFIX          X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */
+#define X86_BUG_ESPFIX                  X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */
 #endif
-#define X86_BUG_NULL_SEG        X86_BUG(10) /* Nulling a selector preserves the base */
-#define X86_BUG_SWAPGS_FENCE    X86_BUG(11) /* SWAPGS without input dep on GS */
-#define X86_BUG_MONITOR         X86_BUG(12) /* IPI required to wake up remote CPU */
-#define X86_BUG_AMD_E400        X86_BUG(13) /* CPU is among the affected by Erratum 400 */
+#define X86_BUG_NULL_SEG                X86_BUG(10) /* Nulling a selector preserves the base */
+#define X86_BUG_SWAPGS_FENCE            X86_BUG(11) /* SWAPGS without input dep on GS */
+#define X86_BUG_MONITOR                 X86_BUG(12) /* IPI required to wake up remote CPU */
+#define X86_BUG_AMD_E400                X86_BUG(13) /* CPU is among the affected by Erratum 400 */
+
 #endif /* _ASM_X86_CPUFEATURES_H */
diff --git a/tools/arch/x86/include/asm/disabled-features.h b/tools/arch/x86/include/asm/disabled-features.h
index c10c9128f54e..14d6d5007314 100644
--- a/tools/arch/x86/include/asm/disabled-features.h
+++ b/tools/arch/x86/include/asm/disabled-features.h
@@ -16,6 +16,12 @@
 # define DISABLE_MPX    (1<<(X86_FEATURE_MPX & 31))
 #endif
 
+#ifdef CONFIG_X86_INTEL_UMIP
+# define DISABLE_UMIP   0
+#else
+# define DISABLE_UMIP   (1<<(X86_FEATURE_UMIP & 31))
+#endif
+
 #ifdef CONFIG_X86_64
 # define DISABLE_VME            (1<<(X86_FEATURE_VME & 31))
 # define DISABLE_K6_MTRR        (1<<(X86_FEATURE_K6_MTRR & 31))
@@ -63,7 +69,7 @@
 #define DISABLED_MASK13 0
 #define DISABLED_MASK14 0
 #define DISABLED_MASK15 0
-#define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57)
+#define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57|DISABLE_UMIP)
 #define DISABLED_MASK17 0
 #define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 18)
 
diff --git a/tools/bpf/bpftool/Documentation/Makefile b/tools/bpf/bpftool/Documentation/Makefile
index bde77d7c4390..37292bb5ce60 100644
--- a/tools/bpf/bpftool/Documentation/Makefile
+++ b/tools/bpf/bpftool/Documentation/Makefile
@@ -6,7 +6,7 @@ RM ?= rm -f
 
 # Make the path relative to DESTDIR, not prefix
 ifndef DESTDIR
-prefix?=$(HOME)
+prefix ?= /usr/local
 endif
 mandir ?= $(prefix)/share/man
 man8dir = $(mandir)/man8
diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
index 813826c50936..ec3052c0b004 100644
--- a/tools/bpf/bpftool/Makefile
+++ b/tools/bpf/bpftool/Makefile
@@ -45,8 +45,8 @@ $(LIBBPF)-clean:
         $(call QUIET_CLEAN, libbpf)
         $(Q)$(MAKE) -C $(BPF_DIR) OUTPUT=$(OUTPUT) clean >/dev/null
 
-prefix = /usr
-bash_compdir ?= $(prefix)/share/bash-completion/completions
+prefix = /usr/local
+bash_compdir ?= /usr/share/bash-completion/completions
 
 CC = gcc
 
@@ -76,6 +76,7 @@ clean: $(LIBBPF)-clean
         $(Q)rm -rf $(OUTPUT)bpftool $(OUTPUT)*.o $(OUTPUT)*.d
 
 install:
+        install -m 0755 -d $(prefix)/sbin
         install $(OUTPUT)bpftool $(prefix)/sbin/bpftool
         install -m 0755 -d $(bash_compdir)
         install -m 0644 bash-completion/bpftool $(bash_compdir)
@@ -88,5 +89,5 @@ doc-install:
 
 FORCE:
 
-.PHONY: all clean FORCE
+.PHONY: all clean FORCE install doc doc-install
 .DEFAULT_GOAL := all
diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c
index d6e4762170a4..d294bc8168be 100644
--- a/tools/bpf/bpftool/main.c
+++ b/tools/bpf/bpftool/main.c
@@ -58,11 +58,19 @@ bool show_pinned;
 struct pinned_obj_table prog_table;
 struct pinned_obj_table map_table;
 
+static void __noreturn clean_and_exit(int i)
+{
+        if (json_output)
+                jsonw_destroy(&json_wtr);
+
+        exit(i);
+}
+
 void usage(void)
 {
         last_do_help(last_argc - 1, last_argv + 1);
 
-        exit(-1);
+        clean_and_exit(-1);
 }
 
 static int do_help(int argc, char **argv)
@@ -280,6 +288,7 @@ int main(int argc, char **argv)
         hash_init(prog_table.table);
         hash_init(map_table.table);
 
+        opterr = 0;
         while ((opt = getopt_long(argc, argv, "Vhpjf",
                                   options, NULL)) >= 0) {
                 switch (opt) {
@@ -291,13 +300,25 @@ int main(int argc, char **argv)
                         pretty_output = true;
                         /* fall through */
                 case 'j':
-                        json_output = true;
+                        if (!json_output) {
+                                json_wtr = jsonw_new(stdout);
+                                if (!json_wtr) {
+                                        p_err("failed to create JSON writer");
+                                        return -1;
+                                }
+                                json_output = true;
+                        }
+                        jsonw_pretty(json_wtr, pretty_output);
                         break;
                 case 'f':
                         show_pinned = true;
                         break;
                 default:
-                        usage();
+                        p_err("unrecognized option '%s'", argv[optind - 1]);
+                        if (json_output)
+                                clean_and_exit(-1);
+                        else
+                                usage();
                 }
         }
 
@@ -306,15 +327,6 @@ int main(int argc, char **argv)
         if (argc < 0)
                 usage();
 
-        if (json_output) {
-                json_wtr = jsonw_new(stdout);
-                if (!json_wtr) {
-                        p_err("failed to create JSON writer");
-                        return -1;
-                }
-                jsonw_pretty(json_wtr, pretty_output);
-        }
-
         bfd_init();
 
         ret = cmd_select(cmds, argc, argv, do_help);
diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
index 9c191e222d6f..bff330b49791 100644
--- a/tools/bpf/bpftool/main.h
+++ b/tools/bpf/bpftool/main.h
@@ -41,6 +41,7 @@
 #include <stdbool.h>
 #include <stdio.h>
 #include <linux/bpf.h>
+#include <linux/compiler.h>
 #include <linux/kernel.h>
 #include <linux/hashtable.h>
 
@@ -50,7 +51,7 @@
 
 #define NEXT_ARG()      ({ argc--; argv++; if (argc < 0) usage(); })
 #define NEXT_ARGP()     ({ (*argc)--; (*argv)++; if (*argc < 0) usage(); })
-#define BAD_ARG()       ({ p_err("what is '%s'?\n", *argv); -1; })
+#define BAD_ARG()       ({ p_err("what is '%s'?", *argv); -1; })
 
 #define ERR_MAX_LEN     1024
 
@@ -80,7 +81,7 @@ void p_info(const char *fmt, ...);
 
 bool is_prefix(const char *pfx, const char *str);
 void fprint_hex(FILE *f, void *arg, unsigned int n, const char *sep);
-void usage(void) __attribute__((noreturn));
+void usage(void) __noreturn;
 
 struct pinned_obj_table {
         DECLARE_HASHTABLE(table, 16);
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index e2450c8e88e6..a8c3a33dd185 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -523,21 +523,23 @@ static int do_show(int argc, char **argv)
                                 break;
                         p_err("can't get next map: %s%s", strerror(errno),
                               errno == EINVAL ? " -- kernel too old?" : "");
-                        return -1;
+                        break;
                 }
 
                 fd = bpf_map_get_fd_by_id(id);
                 if (fd < 0) {
+                        if (errno == ENOENT)
+                                continue;
                         p_err("can't get map by id (%u): %s",
                               id, strerror(errno));
-                        return -1;
+                        break;
                 }
 
                 err = bpf_obj_get_info_by_fd(fd, &info, &len);
                 if (err) {
                         p_err("can't get map info: %s", strerror(errno));
                         close(fd);
-                        return -1;
+                        break;
                 }
 
                 if (json_output)
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index ad619b96c276..dded77345bfb 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -382,6 +382,8 @@ static int do_show(int argc, char **argv)
 
                 fd = bpf_prog_get_fd_by_id(id);
                 if (fd < 0) {
+                        if (errno == ENOENT)
+                                continue;
                         p_err("can't get prog by id (%u): %s",
                               id, strerror(errno));
                         err = -1;
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index eaa3bec273c8..4c99c57736ce 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -193,11 +193,14 @@ static void kvp_update_mem_state(int pool)
         for (;;) {
                 readp = &record[records_read];
                 records_read += fread(readp, sizeof(struct kvp_record),
-                                        ENTRIES_PER_BLOCK * num_blocks,
-                                        filep);
+                                ENTRIES_PER_BLOCK * num_blocks - records_read,
+                                filep);
 
                 if (ferror(filep)) {
-                        syslog(LOG_ERR, "Failed to read file, pool: %d", pool);
+                        syslog(LOG_ERR,
+                                "Failed to read file, pool: %d; error: %d %s",
+                                 pool, errno, strerror(errno));
+                        kvp_release_lock(pool);
                         exit(EXIT_FAILURE);
                 }
 
@@ -210,6 +213,7 @@ static void kvp_update_mem_state(int pool)
 
                         if (record == NULL) {
                                 syslog(LOG_ERR, "malloc failed");
+                                kvp_release_lock(pool);
                                 exit(EXIT_FAILURE);
                         }
                         continue;
@@ -224,15 +228,11 @@ static void kvp_update_mem_state(int pool)
         fclose(filep);
         kvp_release_lock(pool);
 }
+
 static int kvp_file_init(void)
 {
         int  fd;
-        FILE *filep;
-        size_t records_read;
         char *fname;
-        struct kvp_record *record;
-        struct kvp_record *readp;
-        int num_blocks;
         int i;
         int alloc_unit = sizeof(struct kvp_record) * ENTRIES_PER_BLOCK;
 
@@ -246,61 +246,19 @@ static int kvp_file_init(void)
 
         for (i = 0; i < KVP_POOL_COUNT; i++) {
                 fname = kvp_file_info[i].fname;
-                records_read = 0;
-                num_blocks = 1;
                 sprintf(fname, "%s/.kvp_pool_%d", KVP_CONFIG_LOC, i);
                 fd = open(fname, O_RDWR | O_CREAT | O_CLOEXEC, 0644 /* rw-r--r-- */);
 
                 if (fd == -1)
                         return 1;
 
-
-                filep = fopen(fname, "re");
-                if (!filep) {
-                        close(fd);
-                        return 1;
-                }
-
-                record = malloc(alloc_unit * num_blocks);
-                if (record == NULL) {
-                        fclose(filep);
-                        close(fd);
-                        return 1;
-                }
-                for (;;) {
-                        readp = &record[records_read];
-                        records_read += fread(readp, sizeof(struct kvp_record),
-                                        ENTRIES_PER_BLOCK,
-                                        filep);
-
-                        if (ferror(filep)) {
-                                syslog(LOG_ERR, "Failed to read file, pool: %d",
-                                       i);
-                                exit(EXIT_FAILURE);
-                        }
-
-                        if (!feof(filep)) {
-                                /*
-                                 * We have more data to read.
-                                 */
-                                num_blocks++;
-                                record = realloc(record, alloc_unit *
-                                                num_blocks);
-                                if (record == NULL) {
-                                        fclose(filep);
-                                        close(fd);
-                                        return 1;
-                                }
-                                continue;
-                        }
-                        break;
-                }
                 kvp_file_info[i].fd = fd;
-                kvp_file_info[i].num_blocks = num_blocks;
-                kvp_file_info[i].records = record;
-                kvp_file_info[i].num_records = records_read;
-                fclose(filep);
-
+                kvp_file_info[i].num_blocks = 1;
+                kvp_file_info[i].records = malloc(alloc_unit);
+                if (kvp_file_info[i].records == NULL)
+                        return 1;
+                kvp_file_info[i].num_records = 0;
+                kvp_update_mem_state(i);
         }
 
         return 0;
diff --git a/tools/include/linux/compiler.h b/tools/include/linux/compiler.h
index 07fd03c74a77..04e32f965ad7 100644
--- a/tools/include/linux/compiler.h
+++ b/tools/include/linux/compiler.h
@@ -84,8 +84,6 @@
 
 #define uninitialized_var(x) x = *(&(x))
 
-#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
-
 #include <linux/types.h>
 
 /*
@@ -135,20 +133,19 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
 /*
  * Prevent the compiler from merging or refetching reads or writes. The
  * compiler is also forbidden from reordering successive instances of
- * READ_ONCE, WRITE_ONCE and ACCESS_ONCE (see below), but only when the
- * compiler is aware of some particular ordering.  One way to make the
- * compiler aware of ordering is to put the two invocations of READ_ONCE,
- * WRITE_ONCE or ACCESS_ONCE() in different C statements.
+ * READ_ONCE and WRITE_ONCE, but only when the compiler is aware of some
+ * particular ordering. One way to make the compiler aware of ordering is to
+ * put the two invocations of READ_ONCE or WRITE_ONCE in different C
+ * statements.
  *
- * In contrast to ACCESS_ONCE these two macros will also work on aggregate
- * data types like structs or unions. If the size of the accessed data
- * type exceeds the word size of the machine (e.g., 32 bits or 64 bits)
- * READ_ONCE() and WRITE_ONCE()  will fall back to memcpy and print a
- * compile-time warning.
+ * These two macros will also work on aggregate data types like structs or
+ * unions. If the size of the accessed data type exceeds the word size of
+ * the machine (e.g., 32 bits or 64 bits) READ_ONCE() and WRITE_ONCE() will
+ * fall back to memcpy and print a compile-time warning.
  *
  * Their two major use cases are: (1) Mediating communication between
  * process-level code and irq/NMI handlers, all running on the same CPU,
- * and (2) Ensuring that the compiler does not  fold, spindle, or otherwise
+ * and (2) Ensuring that the compiler does not fold, spindle, or otherwise
  * mutilate accesses that either do not require ordering or that interact
  * with an explicit memory barrier or atomic instruction that provides the
  * required ordering.
diff --git a/tools/include/linux/kmemcheck.h b/tools/include/linux/kmemcheck.h
deleted file mode 100644
index ea32a7d3cf1b..000000000000
--- a/tools/include/linux/kmemcheck.h
+++ /dev/null
@@ -1 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
diff --git a/tools/include/linux/lockdep.h b/tools/include/linux/lockdep.h
index 940c1b075659..6b0c36a58fcb 100644
--- a/tools/include/linux/lockdep.h
+++ b/tools/include/linux/lockdep.h
@@ -48,6 +48,7 @@ static inline int debug_locks_off(void)
 #define printk(...) dprintf(STDOUT_FILENO, __VA_ARGS__)
 #define pr_err(format, ...) fprintf (stderr, format, ## __VA_ARGS__)
 #define pr_warn pr_err
+#define pr_cont pr_err
 
 #define list_del_rcu list_del
 
diff --git a/tools/include/uapi/asm-generic/bpf_perf_event.h b/tools/include/uapi/asm-generic/bpf_perf_event.h
new file mode 100644
index 000000000000..53815d2cd047
--- /dev/null
+++ b/tools/include/uapi/asm-generic/bpf_perf_event.h
@@ -0,0 +1,9 @@
+#ifndef _UAPI__ASM_GENERIC_BPF_PERF_EVENT_H__
+#define _UAPI__ASM_GENERIC_BPF_PERF_EVENT_H__
+
+#include <linux/ptrace.h>
+
+/* Export kernel pt_regs structure */
+typedef struct pt_regs bpf_user_pt_regs_t;
+
+#endif /* _UAPI__ASM_GENERIC_BPF_PERF_EVENT_H__ */
diff --git a/tools/include/uapi/asm-generic/mman.h b/tools/include/uapi/asm-generic/mman.h
index 2dffcbf705b3..653687d9771b 100644
--- a/tools/include/uapi/asm-generic/mman.h
+++ b/tools/include/uapi/asm-generic/mman.h
@@ -13,6 +13,7 @@
 #define MAP_NONBLOCK    0x10000         /* do not block on IO */
 #define MAP_STACK       0x20000         /* give out an address that is best suited for process/thread stacks */
 #define MAP_HUGETLB     0x40000         /* create a huge page mapping */
+#define MAP_SYNC        0x80000         /* perform synchronous page faults for the mapping */
 
 /* Bits [26:31] are reserved, see mman-common.h for MAP_HUGETLB usage */
 
diff --git a/tools/include/uapi/asm/bpf_perf_event.h b/tools/include/uapi/asm/bpf_perf_event.h
new file mode 100644
index 000000000000..13a58531e6fa
--- /dev/null
+++ b/tools/include/uapi/asm/bpf_perf_event.h
@@ -0,0 +1,7 @@
+#if defined(__aarch64__)
+#include "../../arch/arm64/include/uapi/asm/bpf_perf_event.h"
+#elif defined(__s390__)
+#include "../../arch/s390/include/uapi/asm/bpf_perf_event.h"
+#else
+#include <uapi/asm-generic/bpf_perf_event.h>
+#endif
diff --git a/tools/include/uapi/drm/drm.h b/tools/include/uapi/drm/drm.h
index 97677cd6964d..6fdff5945c8a 100644
--- a/tools/include/uapi/drm/drm.h
+++ b/tools/include/uapi/drm/drm.h
@@ -737,6 +737,28 @@ struct drm_syncobj_array {
         __u32 pad;
 };
 
+/* Query current scanout sequence number */
+struct drm_crtc_get_sequence {
+        __u32 crtc_id;          /* requested crtc_id */
+        __u32 active;           /* return: crtc output is active */
+        __u64 sequence;         /* return: most recent vblank sequence */
+        __s64 sequence_ns;      /* return: most recent time of first pixel out */
+};
+
+/* Queue event to be delivered at specified sequence. Time stamp marks
+ * when the first pixel of the refresh cycle leaves the display engine
+ * for the display
+ */
+#define DRM_CRTC_SEQUENCE_RELATIVE              0x00000001      /* sequence is relative to current */
+#define DRM_CRTC_SEQUENCE_NEXT_ON_MISS          0x00000002      /* Use next sequence if we've missed */
+
+struct drm_crtc_queue_sequence {
+        __u32 crtc_id;
+        __u32 flags;
+        __u64 sequence;         /* on input, target sequence. on output, actual sequence */
+        __u64 user_data;        /* user data passed to event */
+};
+
 #if defined(__cplusplus)
 }
 #endif
@@ -819,6 +841,9 @@ extern "C" {
 
 #define DRM_IOCTL_WAIT_VBLANK           DRM_IOWR(0x3a, union drm_wait_vblank)
 
+#define DRM_IOCTL_CRTC_GET_SEQUENCE     DRM_IOWR(0x3b, struct drm_crtc_get_sequence)
+#define DRM_IOCTL_CRTC_QUEUE_SEQUENCE   DRM_IOWR(0x3c, struct drm_crtc_queue_sequence)
+
 #define DRM_IOCTL_UPDATE_DRAW           DRM_IOW(0x3f, struct drm_update_draw)
 
 #define DRM_IOCTL_MODE_GETRESOURCES     DRM_IOWR(0xA0, struct drm_mode_card_res)
@@ -863,6 +888,11 @@ extern "C" {
 #define DRM_IOCTL_SYNCOBJ_RESET         DRM_IOWR(0xC4, struct drm_syncobj_array)
 #define DRM_IOCTL_SYNCOBJ_SIGNAL        DRM_IOWR(0xC5, struct drm_syncobj_array)
 
+#define DRM_IOCTL_MODE_CREATE_LEASE     DRM_IOWR(0xC6, struct drm_mode_create_lease)
+#define DRM_IOCTL_MODE_LIST_LESSEES     DRM_IOWR(0xC7, struct drm_mode_list_lessees)
+#define DRM_IOCTL_MODE_GET_LEASE        DRM_IOWR(0xC8, struct drm_mode_get_lease)
+#define DRM_IOCTL_MODE_REVOKE_LEASE     DRM_IOWR(0xC9, struct drm_mode_revoke_lease)
+
 /**
  * Device specific ioctls should only be in their respective headers
  * The device specific ioctl range is from 0x40 to 0x9f.
@@ -893,6 +923,7 @@ struct drm_event {
 
 #define DRM_EVENT_VBLANK 0x01
 #define DRM_EVENT_FLIP_COMPLETE 0x02
+#define DRM_EVENT_CRTC_SEQUENCE 0x03
 
 struct drm_event_vblank {
         struct drm_event base;
@@ -903,6 +934,16 @@ struct drm_event_vblank {
         __u32 crtc_id; /* 0 on older kernels that do not support this */
 };
 
+/* Event delivered at sequence. Time stamp marks when the first pixel
+ * of the refresh cycle leaves the display engine for the display
+ */
+struct drm_event_crtc_sequence {
+        struct drm_event        base;
+        __u64                   user_data;
+        __s64                   time_ns;
+        __u64                   sequence;
+};
+
 /* typedef area */
 #ifndef __KERNEL__
 typedef struct drm_clip_rect drm_clip_rect_t;
diff --git a/tools/include/uapi/drm/i915_drm.h b/tools/include/uapi/drm/i915_drm.h
index 9816590d3ad2..ac3c6503ca27 100644
--- a/tools/include/uapi/drm/i915_drm.h
+++ b/tools/include/uapi/drm/i915_drm.h
@@ -397,10 +397,20 @@ typedef struct drm_i915_irq_wait {
 #define I915_PARAM_MIN_EU_IN_POOL        39
 #define I915_PARAM_MMAP_GTT_VERSION      40
 
-/* Query whether DRM_I915_GEM_EXECBUFFER2 supports user defined execution
+/*
+ * Query whether DRM_I915_GEM_EXECBUFFER2 supports user defined execution
  * priorities and the driver will attempt to execute batches in priority order.
+ * The param returns a capability bitmask, nonzero implies that the scheduler
+ * is enabled, with different features present according to the mask.
+ *
+ * The initial priority for each batch is supplied by the context and is
+ * controlled via I915_CONTEXT_PARAM_PRIORITY.
  */
 #define I915_PARAM_HAS_SCHEDULER         41
+#define   I915_SCHEDULER_CAP_ENABLED    (1ul << 0)
+#define   I915_SCHEDULER_CAP_PRIORITY   (1ul << 1)
+#define   I915_SCHEDULER_CAP_PREEMPTION (1ul << 2)
+
 #define I915_PARAM_HUC_STATUS            42
 
 /* Query whether DRM_I915_GEM_EXECBUFFER2 supports the ability to opt-out of
@@ -1309,14 +1319,16 @@ struct drm_i915_reg_read {
          * be specified
          */
         __u64 offset;
+#define I915_REG_READ_8B_WA (1ul << 0)
+
         __u64 val; /* Return value */
 };
 /* Known registers:
  *
  * Render engine timestamp - 0x2358 + 64bit - gen7+
  * - Note this register returns an invalid value if using the default
- *   single instruction 8byte read, in order to workaround that use
- *   offset (0x2538 | 1) instead.
+ *   single instruction 8byte read, in order to workaround that pass
+ *   flag I915_REG_READ_8B_WA in offset field.
  *
  */
 
@@ -1359,6 +1371,10 @@ struct drm_i915_gem_context_param {
 #define I915_CONTEXT_PARAM_GTT_SIZE     0x3
 #define I915_CONTEXT_PARAM_NO_ERROR_CAPTURE     0x4
 #define I915_CONTEXT_PARAM_BANNABLE     0x5
+#define I915_CONTEXT_PARAM_PRIORITY     0x6
+#define   I915_CONTEXT_MAX_USER_PRIORITY        1023 /* inclusive */
+#define   I915_CONTEXT_DEFAULT_PRIORITY         0
+#define   I915_CONTEXT_MIN_USER_PRIORITY        -1023 /* inclusive */
         __u64 value;
 };
 
@@ -1510,9 +1526,14 @@ struct drm_i915_perf_oa_config {
         __u32 n_boolean_regs;
         __u32 n_flex_regs;
 
-        __u64 __user mux_regs_ptr;
-        __u64 __user boolean_regs_ptr;
-        __u64 __user flex_regs_ptr;
+        /*
+         * These fields are pointers to tuples of u32 values (register
+         * address, value). For example the expected length of the buffer
+         * pointed by mux_regs_ptr is (2 * sizeof(u32) * n_mux_regs).
+         */
+        __u64 mux_regs_ptr;
+        __u64 boolean_regs_ptr;
+        __u64 flex_regs_ptr;
 };
 
 #if defined(__cplusplus)
diff --git a/tools/include/uapi/linux/bpf_perf_event.h b/tools/include/uapi/linux/bpf_perf_event.h
index 067427259820..8f95303f9d80 100644
--- a/tools/include/uapi/linux/bpf_perf_event.h
+++ b/tools/include/uapi/linux/bpf_perf_event.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 /* Copyright (c) 2016 Facebook
  *
  * This program is free software; you can redistribute it and/or
@@ -7,11 +8,10 @@
 #ifndef _UAPI__LINUX_BPF_PERF_EVENT_H__
 #define _UAPI__LINUX_BPF_PERF_EVENT_H__
 
-#include <linux/types.h>
-#include <linux/ptrace.h>
+#include <asm/bpf_perf_event.h>
 
 struct bpf_perf_event_data {
-        struct pt_regs regs;
+        bpf_user_pt_regs_t regs;
         __u64 sample_period;
 };
 
diff --git a/tools/include/uapi/linux/kcmp.h b/tools/include/uapi/linux/kcmp.h
index 481e103da78e..ef1305010925 100644
--- a/tools/include/uapi/linux/kcmp.h
+++ b/tools/include/uapi/linux/kcmp.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 #ifndef _UAPI_LINUX_KCMP_H
 #define _UAPI_LINUX_KCMP_H
 
diff --git a/tools/include/uapi/linux/kvm.h b/tools/include/uapi/linux/kvm.h
index 7e99999d6236..496e59a2738b 100644
--- a/tools/include/uapi/linux/kvm.h
+++ b/tools/include/uapi/linux/kvm.h
@@ -630,9 +630,9 @@ struct kvm_s390_irq {
 
 struct kvm_s390_irq_state {
         __u64 buf;
-        __u32 flags;
+        __u32 flags;        /* will stay unused for compatibility reasons */
         __u32 len;
-        __u32 reserved[4];
+        __u32 reserved[4];  /* will stay unused for compatibility reasons */
 };
 
 /* for KVM_SET_GUEST_DEBUG */
@@ -931,6 +931,7 @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_PPC_SMT_POSSIBLE 147
 #define KVM_CAP_HYPERV_SYNIC2 148
 #define KVM_CAP_HYPERV_VP_INDEX 149
+#define KVM_CAP_S390_AIS_MIGRATION 150
 
 #ifdef KVM_CAP_IRQ_ROUTING
 
diff --git a/tools/include/uapi/linux/perf_event.h b/tools/include/uapi/linux/perf_event.h
index 362493a2f950..b9a4953018ed 100644
--- a/tools/include/uapi/linux/perf_event.h
+++ b/tools/include/uapi/linux/perf_event.h
@@ -942,6 +942,7 @@ enum perf_callchain_context {
 #define PERF_AUX_FLAG_TRUNCATED         0x01    /* record was truncated to fit */
 #define PERF_AUX_FLAG_OVERWRITE         0x02    /* snapshot from overwrite mode */
 #define PERF_AUX_FLAG_PARTIAL           0x04    /* record contains gaps */
+#define PERF_AUX_FLAG_COLLISION         0x08    /* sample collided with another */
 
 #define PERF_FLAG_FD_NO_GROUP           (1UL << 0)
 #define PERF_FLAG_FD_OUTPUT             (1UL << 1)
diff --git a/tools/include/uapi/linux/prctl.h b/tools/include/uapi/linux/prctl.h
index a8d0759a9e40..af5f8c2df87a 100644
--- a/tools/include/uapi/linux/prctl.h
+++ b/tools/include/uapi/linux/prctl.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 #ifndef _LINUX_PRCTL_H
 #define _LINUX_PRCTL_H
 
@@ -197,4 +198,13 @@ struct prctl_mm_map {
 # define PR_CAP_AMBIENT_LOWER           3
 # define PR_CAP_AMBIENT_CLEAR_ALL       4
 
+/* arm64 Scalable Vector Extension controls */
+/* Flag values must be kept in sync with ptrace NT_ARM_SVE interface */
+#define PR_SVE_SET_VL                   50      /* set task vector length */
+# define PR_SVE_SET_VL_ONEXEC           (1 << 18) /* defer effect until exec */
+#define PR_SVE_GET_VL                   51      /* get task vector length */
+/* Bits common to PR_SVE_SET_VL and PR_SVE_GET_VL */
+# define PR_SVE_VL_LEN_MASK             0xffff
+# define PR_SVE_VL_INHERIT              (1 << 17) /* inherit across exec */
+
 #endif /* _LINUX_PRCTL_H */
diff --git a/tools/kvm/kvm_stat/kvm_stat b/tools/kvm/kvm_stat/kvm_stat
index 217cf6f95c36..a5684d0968b4 100755
--- a/tools/kvm/kvm_stat/kvm_stat
+++ b/tools/kvm/kvm_stat/kvm_stat
@@ -478,7 +478,7 @@ class Provider(object):
     @staticmethod
     def is_field_wanted(fields_filter, field):
         """Indicate whether field is valid according to fields_filter."""
-        if not fields_filter or fields_filter == "help":
+        if not fields_filter:
             return True
         return re.match(fields_filter, field) is not None
 
@@ -549,8 +549,8 @@ class TracepointProvider(Provider):
 
     def update_fields(self, fields_filter):
         """Refresh fields, applying fields_filter"""
-        self._fields = [field for field in self.get_available_fields()
-                        if self.is_field_wanted(fields_filter, field)]
+        self.fields = [field for field in self.get_available_fields()
+                       if self.is_field_wanted(fields_filter, field)]
 
     @staticmethod
     def get_online_cpus():
@@ -950,7 +950,8 @@ class Tui(object):
             curses.nocbreak()
             curses.endwin()
 
-    def get_all_gnames(self):
+    @staticmethod
+    def get_all_gnames():
         """Returns a list of (pid, gname) tuples of all running guests"""
         res = []
         try:
@@ -963,7 +964,7 @@ class Tui(object):
             # perform a sanity check before calling the more expensive
             # function to possibly extract the guest name
             if ' -name ' in line[1]:
-                res.append((line[0], self.get_gname_from_pid(line[0])))
+                res.append((line[0], Tui.get_gname_from_pid(line[0])))
         child.stdout.close()
 
         return res
@@ -984,7 +985,8 @@ class Tui(object):
         except Exception:
             self.screen.addstr(row + 1, 2, 'Not available')
 
-    def get_pid_from_gname(self, gname):
+    @staticmethod
+    def get_pid_from_gname(gname):
         """Fuzzy function to convert guest name to QEMU process pid.
 
         Returns a list of potential pids, can be empty if no match found.
@@ -992,7 +994,7 @@ class Tui(object):
 
         """
         pids = []
-        for line in self.get_all_gnames():
+        for line in Tui.get_all_gnames():
             if gname == line[1]:
                 pids.append(int(line[0]))
 
@@ -1090,15 +1092,16 @@ class Tui(object):
             # sort by totals
             return (0, -stats[x][0])
         total = 0.
-        for val in stats.values():
-            total += val[0]
+        for key in stats.keys():
+            if key.find('(') is -1:
+                total += stats[key][0]
         if self._sorting == SORT_DEFAULT:
             sortkey = sortCurAvg
         else:
             sortkey = sortTotal
+        tavg = 0
         for key in sorted(stats.keys(), key=sortkey):
-
-            if row >= self.screen.getmaxyx()[0]:
+            if row >= self.screen.getmaxyx()[0] - 1:
                 break
             values = stats[key]
             if not values[0] and not values[1]:
@@ -1110,9 +1113,15 @@ class Tui(object):
                 self.screen.addstr(row, 1, '%-40s %10d%7.1f %8s' %
                                    (key, values[0], values[0] * 100 / total,
                                     cur))
+                if cur is not '' and key.find('(') is -1:
+                    tavg += cur
             row += 1
         if row == 3:
             self.screen.addstr(4, 1, 'No matching events reported yet')
+        else:
+            self.screen.addstr(row, 1, '%-40s %10d        %8s' %
+                               ('Total', total, tavg if tavg else ''),
+                               curses.A_BOLD)
         self.screen.refresh()
 
     def show_msg(self, text):
@@ -1358,7 +1367,7 @@ class Tui(object):
                 if char == 'x':
                     self.update_drilldown()
                     # prevents display of current values on next refresh
-                    self.stats.get()
+                    self.stats.get(self._display_guests)
             except KeyboardInterrupt:
                 break
             except curses.error:
@@ -1451,16 +1460,13 @@ Press any other key to refresh statistics immediately.
         try:
             pids = Tui.get_pid_from_gname(val)
         except:
-            raise optparse.OptionValueError('Error while searching for guest '
-                                            '"{}", use "-p" to specify a pid '
-                                            'instead'.format(val))
+            sys.exit('Error while searching for guest "{}". Use "-p" to '
+                     'specify a pid instead?'.format(val))
         if len(pids) == 0:
-            raise optparse.OptionValueError('No guest by the name "{}" '
-                                            'found'.format(val))
+            sys.exit('Error: No guest by the name "{}" found'.format(val))
         if len(pids) > 1:
-            raise optparse.OptionValueError('Multiple processes found (pids: '
-                                            '{}) - use "-p" to specify a pid '
-                                            'instead'.format(" ".join(pids)))
+            sys.exit('Error: Multiple processes found (pids: {}). Use "-p" '
+                     'to specify the desired pid'.format(" ".join(pids)))
         parser.values.pid = pids[0]
 
     optparser = optparse.OptionParser(description=description_text,
@@ -1518,7 +1524,16 @@ Press any other key to refresh statistics immediately.
                          help='restrict statistics to guest by name',
                          callback=cb_guest_to_pid,
                          )
-    (options, _) = optparser.parse_args(sys.argv)
+    options, unkn = optparser.parse_args(sys.argv)
+    if len(unkn) != 1:
+        sys.exit('Error: Extra argument(s): ' + ' '.join(unkn[1:]))
+    try:
+        # verify that we were passed a valid regex up front
+        re.compile(options.fields)
+    except re.error:
+        sys.exit('Error: "' + options.fields + '" is not a valid regular '
+                 'expression')
+
     return options
 
 
@@ -1564,16 +1579,13 @@ def main():
 
     stats = Stats(options)
 
-    if options.fields == "help":
-        event_list = "\n"
-        s = stats.get()
-        for key in s.keys():
-            if key.find('(') != -1:
-                key = key[0:key.find('(')]
-            if event_list.find('\n' + key + '\n') == -1:
-                event_list += key + '\n'
-        sys.stdout.write(event_list)
-        return ""
+    if options.fields == 'help':
+        stats.fields_filter = None
+        event_list = []
+        for key in stats.get().keys():
+            event_list.append(key.split('(', 1)[0])
+        sys.stdout.write('  ' + '\n  '.join(sorted(set(event_list))) + '\n')
+        sys.exit(0)
 
     if options.log:
         log(stats)
diff --git a/tools/kvm/kvm_stat/kvm_stat.txt b/tools/kvm/kvm_stat/kvm_stat.txt
index e5cf836be8a1..b5b3810c9e94 100644
--- a/tools/kvm/kvm_stat/kvm_stat.txt
+++ b/tools/kvm/kvm_stat/kvm_stat.txt
@@ -50,6 +50,8 @@ INTERACTIVE COMMANDS
 *s*::   set update interval
 
 *x*::   toggle reporting of stats for child trace events
+ ::     *Note*: The stats for the parents summarize the respective child trace
+                events
 
 Press any other key to refresh statistics immediately.
 
@@ -86,7 +88,7 @@ OPTIONS
 
 -f<fields>::
 --fields=<fields>::
-        fields to display (regex)
+        fields to display (regex), "-f help" for a list of available events
 
 -h::
 --help::
diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile
index 0f94af3ccaaa..e6acc281dd37 100644
--- a/tools/objtool/Makefile
+++ b/tools/objtool/Makefile
@@ -7,9 +7,11 @@ ARCH := x86
 endif
 
 # always use the host compiler
-CC = gcc
-LD = ld
-AR = ar
+HOSTCC  ?= gcc
+HOSTLD  ?= ld
+CC       = $(HOSTCC)
+LD       = $(HOSTLD)
+AR       = ar
 
 ifeq ($(srctree),)
 srctree := $(patsubst %/,%,$(dir $(CURDIR)))
@@ -44,7 +46,7 @@ $(OBJTOOL_IN): fixdep FORCE
         @$(MAKE) $(build)=objtool
 
 $(OBJTOOL): $(LIBSUBCMD) $(OBJTOOL_IN)
-        @./sync-check.sh
+        @$(CONFIG_SHELL) ./sync-check.sh
         $(QUIET_LINK)$(CC) $(OBJTOOL_IN) $(LDFLAGS) -o $@
 
 
diff --git a/tools/objtool/arch/x86/decode.c b/tools/objtool/arch/x86/decode.c
index 8acfc47af70e..540a209b78ab 100644
--- a/tools/objtool/arch/x86/decode.c
+++ b/tools/objtool/arch/x86/decode.c
@@ -138,7 +138,7 @@ int arch_decode_instruction(struct elf *elf, struct section *sec,
                         *type = INSN_STACK;
                         op->src.type = OP_SRC_ADD;
                         op->src.reg = op_to_cfi_reg[modrm_reg][rex_r];
-                        op->dest.type = OP_SRC_REG;
+                        op->dest.type = OP_DEST_REG;
                         op->dest.reg = CFI_SP;
                 }
                 break;
diff --git a/tools/objtool/arch/x86/lib/x86-opcode-map.txt b/tools/objtool/arch/x86/lib/x86-opcode-map.txt
index 12e377184ee4..e0b85930dd77 100644
--- a/tools/objtool/arch/x86/lib/x86-opcode-map.txt
+++ b/tools/objtool/arch/x86/lib/x86-opcode-map.txt
@@ -607,7 +607,7 @@ fb: psubq Pq,Qq | vpsubq Vx,Hx,Wx (66),(v1)
 fc: paddb Pq,Qq | vpaddb Vx,Hx,Wx (66),(v1)
 fd: paddw Pq,Qq | vpaddw Vx,Hx,Wx (66),(v1)
 fe: paddd Pq,Qq | vpaddd Vx,Hx,Wx (66),(v1)
-ff:
+ff: UD0
 EndTable
 
 Table: 3-byte opcode 1 (0x0f 0x38)
@@ -717,7 +717,7 @@ AVXcode: 2
 7e: vpermt2d/q Vx,Hx,Wx (66),(ev)
 7f: vpermt2ps/d Vx,Hx,Wx (66),(ev)
 80: INVEPT Gy,Mdq (66)
-81: INVPID Gy,Mdq (66)
+81: INVVPID Gy,Mdq (66)
 82: INVPCID Gy,Mdq (66)
 83: vpmultishiftqb Vx,Hx,Wx (66),(ev)
 88: vexpandps/d Vpd,Wpd (66),(ev)
@@ -896,7 +896,7 @@ EndTable
 
 GrpTable: Grp3_1
 0: TEST Eb,Ib
-1:
+1: TEST Eb,Ib
 2: NOT Eb
 3: NEG Eb
 4: MUL AL,Eb
@@ -970,6 +970,15 @@ GrpTable: Grp9
 EndTable
 
 GrpTable: Grp10
+# all are UD1
+0: UD1
+1: UD1
+2: UD1
+3: UD1
+4: UD1
+5: UD1
+6: UD1
+7: UD1
 EndTable
 
 # Grp11A and Grp11B are expressed as Grp11 in Intel SDM
diff --git a/tools/objtool/builtin-orc.c b/tools/objtool/builtin-orc.c
index 4c6b5c9ef073..91e8e19ff5e0 100644
--- a/tools/objtool/builtin-orc.c
+++ b/tools/objtool/builtin-orc.c
@@ -44,6 +44,9 @@ int cmd_orc(int argc, const char **argv)
         const char *objname;
 
         argc--; argv++;
+        if (argc <= 0)
+                usage_with_options(orc_usage, check_options);
+
         if (!strncmp(argv[0], "gen", 3)) {
                 argc = parse_options(argc, argv, check_options, orc_usage, 0);
                 if (argc != 1)
@@ -52,7 +55,6 @@ int cmd_orc(int argc, const char **argv)
                 objname = argv[0];
 
                 return check(objname, no_fp, no_unreachable, true);
-
         }
 
         if (!strcmp(argv[0], "dump")) {
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 9b341584eb1b..f40d46e24bcc 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -428,6 +428,40 @@ static void add_ignores(struct objtool_file *file)
 }
 
 /*
+ * FIXME: For now, just ignore any alternatives which add retpolines.  This is
+ * a temporary hack, as it doesn't allow ORC to unwind from inside a retpoline.
+ * But it at least allows objtool to understand the control flow *around* the
+ * retpoline.
+ */
+static int add_nospec_ignores(struct objtool_file *file)
+{
+        struct section *sec;
+        struct rela *rela;
+        struct instruction *insn;
+
+        sec = find_section_by_name(file->elf, ".rela.discard.nospec");
+        if (!sec)
+                return 0;
+
+        list_for_each_entry(rela, &sec->rela_list, list) {
+                if (rela->sym->type != STT_SECTION) {
+                        WARN("unexpected relocation symbol type in %s", sec->name);
+                        return -1;
+                }
+
+                insn = find_insn(file, rela->sym->sec, rela->addend);
+                if (!insn) {
+                        WARN("bad .discard.nospec entry");
+                        return -1;
+                }
+
+                insn->ignore_alts = true;
+        }
+
+        return 0;
+}
+
+/*
  * Find the destination instructions for all jumps.
  */
 static int add_jump_destinations(struct objtool_file *file)
@@ -456,6 +490,13 @@ static int add_jump_destinations(struct objtool_file *file)
                 } else if (rela->sym->sec->idx) {
                         dest_sec = rela->sym->sec;
                         dest_off = rela->sym->sym.st_value + rela->addend + 4;
+                } else if (strstr(rela->sym->name, "_indirect_thunk_")) {
+                        /*
+                         * Retpoline jumps are really dynamic jumps in
+                         * disguise, so convert them accordingly.
+                         */
+                        insn->type = INSN_JUMP_DYNAMIC;
+                        continue;
                 } else {
                         /* sibling call */
                         insn->jump_dest = 0;
@@ -502,11 +543,18 @@ static int add_call_destinations(struct objtool_file *file)
                         dest_off = insn->offset + insn->len + insn->immediate;
                         insn->call_dest = find_symbol_by_offset(insn->sec,
                                                                 dest_off);
+                        /*
+                         * FIXME: Thanks to retpolines, it's now considered
+                         * normal for a function to call within itself.  So
+                         * disable this warning for now.
+                         */
+#if 0
                         if (!insn->call_dest) {
                                 WARN_FUNC("can't find call dest symbol at offset 0x%lx",
                                           insn->sec, insn->offset, dest_off);
                                 return -1;
                         }
+#endif
                 } else if (rela->sym->type == STT_SECTION) {
                         insn->call_dest = find_symbol_by_offset(rela->sym->sec,
                                                                 rela->addend+4);
@@ -671,12 +719,6 @@ static int add_special_section_alts(struct objtool_file *file)
                 return ret;
 
         list_for_each_entry_safe(special_alt, tmp, &special_alts, list) {
-                alt = malloc(sizeof(*alt));
-                if (!alt) {
-                        WARN("malloc failed");
-                        ret = -1;
-                        goto out;
-                }
 
                 orig_insn = find_insn(file, special_alt->orig_sec,
                                       special_alt->orig_off);
@@ -687,6 +729,10 @@ static int add_special_section_alts(struct objtool_file *file)
                         goto out;
                 }
 
+                /* Ignore retpoline alternatives. */
+                if (orig_insn->ignore_alts)
+                        continue;
+
                 new_insn = NULL;
                 if (!special_alt->group || special_alt->new_len) {
                         new_insn = find_insn(file, special_alt->new_sec,
@@ -712,6 +758,13 @@ static int add_special_section_alts(struct objtool_file *file)
                                 goto out;
                 }
 
+                alt = malloc(sizeof(*alt));
+                if (!alt) {
+                        WARN("malloc failed");
+                        ret = -1;
+                        goto out;
+                }
+
                 alt->insn = new_insn;
                 list_add_tail(&alt->list, &orig_insn->alts);
 
@@ -1028,6 +1081,10 @@ static int decode_sections(struct objtool_file *file)
 
         add_ignores(file);
 
+        ret = add_nospec_ignores(file);
+        if (ret)
+                return ret;
+
         ret = add_jump_destinations(file);
         if (ret)
                 return ret;
diff --git a/tools/objtool/check.h b/tools/objtool/check.h
index 47d9ea70a83d..dbadb304a410 100644
--- a/tools/objtool/check.h
+++ b/tools/objtool/check.h
@@ -44,7 +44,7 @@ struct instruction {
         unsigned int len;
         unsigned char type;
         unsigned long immediate;
-        bool alt_group, visited, dead_end, ignore, hint, save, restore;
+        bool alt_group, visited, dead_end, ignore, hint, save, restore, ignore_alts;
         struct symbol *call_dest;
         struct instruction *jump_dest;
         struct list_head alts;
diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
index 24460155c82c..c1c338661699 100644
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -26,6 +26,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#include <errno.h>
 
 #include "elf.h"
 #include "warn.h"
@@ -358,7 +359,8 @@ struct elf *elf_open(const char *name, int flags)
 
         elf->fd = open(name, flags);
         if (elf->fd == -1) {
-                perror("open");
+                fprintf(stderr, "objtool: Can't open '%s': %s\n",
+                        name, strerror(errno));
                 goto err;
         }
 
diff --git a/tools/objtool/orc_dump.c b/tools/objtool/orc_dump.c
index 36c5bf6a2675..c3343820916a 100644
--- a/tools/objtool/orc_dump.c
+++ b/tools/objtool/orc_dump.c
@@ -76,7 +76,8 @@ int orc_dump(const char *_objname)
         int fd, nr_entries, i, *orc_ip = NULL, orc_size = 0;
         struct orc_entry *orc = NULL;
         char *name;
-        unsigned long nr_sections, orc_ip_addr = 0;
+        size_t nr_sections;
+        Elf64_Addr orc_ip_addr = 0;
         size_t shstrtab_idx;
         Elf *elf;
         Elf_Scn *scn;
@@ -187,10 +188,10 @@ int orc_dump(const char *_objname)
                                 return -1;
                         }
 
-                        printf("%s+%lx:", name, rela.r_addend);
+                        printf("%s+%llx:", name, (unsigned long long)rela.r_addend);
 
                 } else {
-                        printf("%lx:", orc_ip_addr + (i * sizeof(int)) + orc_ip[i]);
+                        printf("%llx:", (unsigned long long)(orc_ip_addr + (i * sizeof(int)) + orc_ip[i]));
                 }
 
 
diff --git a/tools/objtool/orc_gen.c b/tools/objtool/orc_gen.c
index e5ca31429c9b..e61fe703197b 100644
--- a/tools/objtool/orc_gen.c
+++ b/tools/objtool/orc_gen.c
@@ -165,6 +165,8 @@ int create_orc_sections(struct objtool_file *file)
 
         /* create .orc_unwind_ip and .rela.orc_unwind_ip sections */
         sec = elf_create_section(file->elf, ".orc_unwind_ip", sizeof(int), idx);
+        if (!sec)
+                return -1;
 
         ip_relasec = elf_create_rela_section(file->elf, sec);
         if (!ip_relasec)
diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
index ed65e82f034e..0294bfb6c5f8 100644
--- a/tools/perf/Makefile.config
+++ b/tools/perf/Makefile.config
@@ -188,9 +188,7 @@ ifdef PYTHON_CONFIG
   PYTHON_EMBED_LDFLAGS := $(call strip-libs,$(PYTHON_EMBED_LDOPTS))
   PYTHON_EMBED_LIBADD := $(call grep-libs,$(PYTHON_EMBED_LDOPTS)) -lutil
   PYTHON_EMBED_CCOPTS := $(shell $(PYTHON_CONFIG_SQ) --cflags 2>/dev/null)
-  ifeq ($(CC_NO_CLANG), 1)
-    PYTHON_EMBED_CCOPTS := $(filter-out -specs=%,$(PYTHON_EMBED_CCOPTS))
-  endif
+  PYTHON_EMBED_CCOPTS := $(filter-out -specs=%,$(PYTHON_EMBED_CCOPTS))
   FLAGS_PYTHON_EMBED := $(PYTHON_EMBED_CCOPTS) $(PYTHON_EMBED_LDOPTS)
 endif
 
@@ -576,14 +574,15 @@ ifndef NO_GTK2
   endif
 endif
 
-
 ifdef NO_LIBPERL
   CFLAGS += -DNO_LIBPERL
 else
   PERL_EMBED_LDOPTS = $(shell perl -MExtUtils::Embed -e ldopts 2>/dev/null)
   PERL_EMBED_LDFLAGS = $(call strip-libs,$(PERL_EMBED_LDOPTS))
   PERL_EMBED_LIBADD = $(call grep-libs,$(PERL_EMBED_LDOPTS))
-  PERL_EMBED_CCOPTS = `perl -MExtUtils::Embed -e ccopts 2>/dev/null`
+  PERL_EMBED_CCOPTS = $(shell perl -MExtUtils::Embed -e ccopts 2>/dev/null)
+  PERL_EMBED_CCOPTS := $(filter-out -specs=%,$(PERL_EMBED_CCOPTS))
+  PERL_EMBED_LDOPTS := $(filter-out -specs=%,$(PERL_EMBED_LDOPTS))
   FLAGS_PERL_EMBED=$(PERL_EMBED_CCOPTS) $(PERL_EMBED_LDOPTS)
 
   ifneq ($(feature-libperl), 1)
diff --git a/tools/perf/arch/s390/Makefile b/tools/perf/arch/s390/Makefile
index 21322e0385b8..09ba923debe8 100644
--- a/tools/perf/arch/s390/Makefile
+++ b/tools/perf/arch/s390/Makefile
@@ -2,3 +2,4 @@ ifndef NO_DWARF
 PERF_HAVE_DWARF_REGS := 1
 endif
 HAVE_KVM_STAT_SUPPORT := 1
+PERF_HAVE_ARCH_REGS_QUERY_REGISTER_OFFSET := 1
diff --git a/tools/perf/arch/s390/include/perf_regs.h b/tools/perf/arch/s390/include/perf_regs.h
index d2df54a6bc5a..bcfbaed78cc2 100644
--- a/tools/perf/arch/s390/include/perf_regs.h
+++ b/tools/perf/arch/s390/include/perf_regs.h
@@ -3,7 +3,7 @@
 
 #include <stdlib.h>
 #include <linux/types.h>
-#include <../../../../arch/s390/include/uapi/asm/perf_regs.h>
+#include <asm/perf_regs.h>
 
 void perf_regs_load(u64 *regs);
 
diff --git a/tools/perf/arch/s390/util/dwarf-regs.c b/tools/perf/arch/s390/util/dwarf-regs.c
index f47576ce13ea..a8ace5cc6301 100644
--- a/tools/perf/arch/s390/util/dwarf-regs.c
+++ b/tools/perf/arch/s390/util/dwarf-regs.c
@@ -2,17 +2,43 @@
 /*
  * Mapping of DWARF debug register numbers into register names.
  *
- *    Copyright IBM Corp. 2010
- *    Author(s): Heiko Carstens <heiko.carstens@de.ibm.com>,
+ * Copyright IBM Corp. 2010, 2017
+ * Author(s): Heiko Carstens <heiko.carstens@de.ibm.com>,
+ *            Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
  *
  */
 
+#include <errno.h>
 #include <stddef.h>
-#include <dwarf-regs.h>
+#include <stdlib.h>
 #include <linux/kernel.h>
+#include <asm/ptrace.h>
+#include <string.h>
+#include <dwarf-regs.h>
 #include "dwarf-regs-table.h"
 
 const char *get_arch_regstr(unsigned int n)
 {
         return (n >= ARRAY_SIZE(s390_dwarf_regs)) ? NULL : s390_dwarf_regs[n];
 }
+
+/*
+ * Convert the register name into an offset to struct pt_regs (kernel).
+ * This is required by the BPF prologue generator.  The BPF
+ * program is called in the BPF overflow handler in the perf
+ * core.
+ */
+int regs_query_register_offset(const char *name)
+{
+        unsigned long gpr;
+
+        if (!name || strncmp(name, "%r", 2))
+                return -EINVAL;
+
+        errno = 0;
+        gpr = strtoul(name + 2, NULL, 10);
+        if (errno || gpr >= 16)
+                return -EINVAL;
+
+        return offsetof(user_pt_regs, gprs) + 8 * gpr;
+}
diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
index d95fdcc26f4b..944070e98a2c 100644
--- a/tools/perf/bench/numa.c
+++ b/tools/perf/bench/numa.c
@@ -216,6 +216,47 @@ static const char * const numa_usage[] = {
         NULL
 };
 
+/*
+ * To get number of numa nodes present.
+ */
+static int nr_numa_nodes(void)
+{
+        int i, nr_nodes = 0;
+
+        for (i = 0; i < g->p.nr_nodes; i++) {
+                if (numa_bitmask_isbitset(numa_nodes_ptr, i))
+                        nr_nodes++;
+        }
+
+        return nr_nodes;
+}
+
+/*
+ * To check if given numa node is present.
+ */
+static int is_node_present(int node)
+{
+        return numa_bitmask_isbitset(numa_nodes_ptr, node);
+}
+
+/*
+ * To check given numa node has cpus.
+ */
+static bool node_has_cpus(int node)
+{
+        struct bitmask *cpu = numa_allocate_cpumask();
+        unsigned int i;
+
+        if (cpu && !numa_node_to_cpus(node, cpu)) {
+                for (i = 0; i < cpu->size; i++) {
+                        if (numa_bitmask_isbitset(cpu, i))
+                                return true;
+                }
+        }
+
+        return false; /* lets fall back to nocpus safely */
+}
+
 static cpu_set_t bind_to_cpu(int target_cpu)
 {
         cpu_set_t orig_mask, mask;
@@ -244,12 +285,12 @@ static cpu_set_t bind_to_cpu(int target_cpu)
 
 static cpu_set_t bind_to_node(int target_node)
 {
-        int cpus_per_node = g->p.nr_cpus/g->p.nr_nodes;
+        int cpus_per_node = g->p.nr_cpus / nr_numa_nodes();
         cpu_set_t orig_mask, mask;
         int cpu;
         int ret;
 
-        BUG_ON(cpus_per_node*g->p.nr_nodes != g->p.nr_cpus);
+        BUG_ON(cpus_per_node * nr_numa_nodes() != g->p.nr_cpus);
         BUG_ON(!cpus_per_node);
 
         ret = sched_getaffinity(0, sizeof(orig_mask), &orig_mask);
@@ -649,7 +690,7 @@ static int parse_setup_node_list(void)
                         int i;
 
                         for (i = 0; i < mul; i++) {
-                                if (t >= g->p.nr_tasks) {
+                                if (t >= g->p.nr_tasks || !node_has_cpus(bind_node)) {
                                         printf("\n# NOTE: ignoring bind NODEs starting at NODE#%d\n", bind_node);
                                         goto out;
                                 }
@@ -964,6 +1005,8 @@ static void calc_convergence(double runtime_ns_max, double *convergence)
         sum = 0;
 
         for (node = 0; node < g->p.nr_nodes; node++) {
+                if (!is_node_present(node))
+                        continue;
                 nr = nodes[node];
                 nr_min = min(nr, nr_min);
                 nr_max = max(nr, nr_max);
@@ -984,8 +1027,11 @@ static void calc_convergence(double runtime_ns_max, double *convergence)
         process_groups = 0;
 
         for (node = 0; node < g->p.nr_nodes; node++) {
-                int processes = count_node_processes(node);
+                int processes;
 
+                if (!is_node_present(node))
+                        continue;
+                processes = count_node_processes(node);
                 nr = nodes[node];
                 tprintf(" %2d/%-2d", nr, processes);
 
@@ -1291,7 +1337,7 @@ static void print_summary(void)
 
         printf("\n ###\n");
         printf(" # %d %s will execute (on %d nodes, %d CPUs):\n",
-                g->p.nr_tasks, g->p.nr_tasks == 1 ? "task" : "tasks", g->p.nr_nodes, g->p.nr_cpus);
+                g->p.nr_tasks, g->p.nr_tasks == 1 ? "task" : "tasks", nr_numa_nodes(), g->p.nr_cpus);
         printf(" #      %5dx %5ldMB global  shared mem operations\n",
                         g->p.nr_loops, g->p.bytes_global/1024/1024);
         printf(" #      %5dx %5ldMB process shared mem operations\n",
diff --git a/tools/perf/builtin-help.c b/tools/perf/builtin-help.c
index bd1fedef3d1c..a0f7ed2b869b 100644
--- a/tools/perf/builtin-help.c
+++ b/tools/perf/builtin-help.c
@@ -284,7 +284,7 @@ static int perf_help_config(const char *var, const char *value, void *cb)
                 add_man_viewer(value);
                 return 0;
         }
-        if (!strstarts(var, "man."))
+        if (strstarts(var, "man."))
                 return add_man_viewer_info(var, value);
 
         return 0;
@@ -314,7 +314,7 @@ static const char *cmd_to_page(const char *perf_cmd)
 
         if (!perf_cmd)
                 return "perf";
-        else if (!strstarts(perf_cmd, "perf"))
+        else if (strstarts(perf_cmd, "perf"))
                 return perf_cmd;
 
         return asprintf(&s, "perf-%s", perf_cmd) < 0 ? NULL : s;
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 3d7f33e19df2..003255910c05 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -339,6 +339,22 @@ static int record__open(struct record *rec)
         struct perf_evsel_config_term *err_term;
         int rc = 0;
 
+        /*
+         * For initial_delay we need to add a dummy event so that we can track
+         * PERF_RECORD_MMAP while we wait for the initial delay to enable the
+         * real events, the ones asked by the user.
+         */
+        if (opts->initial_delay) {
+                if (perf_evlist__add_dummy(evlist))
+                        return -ENOMEM;
+
+                pos = perf_evlist__first(evlist);
+                pos->tracking = 0;
+                pos = perf_evlist__last(evlist);
+                pos->tracking = 1;
+                pos->attr.enable_on_exec = 1;
+        }
+
         perf_evlist__config(evlist, opts, &callchain_param);
 
         evlist__for_each_entry(evlist, pos) {
@@ -749,17 +765,19 @@ static int record__synthesize(struct record *rec, bool tail)
                         goto out;
         }
 
-        err = perf_event__synthesize_kernel_mmap(tool, process_synthesized_event,
-                                                 machine);
-        WARN_ONCE(err < 0, "Couldn't record kernel reference relocation symbol\n"
-                           "Symbol resolution may be skewed if relocation was used (e.g. kexec).\n"
-                           "Check /proc/kallsyms permission or run as root.\n");
-
-        err = perf_event__synthesize_modules(tool, process_synthesized_event,
-                                             machine);
-        WARN_ONCE(err < 0, "Couldn't record kernel module information.\n"
-                           "Symbol resolution may be skewed if relocation was used (e.g. kexec).\n"
-                           "Check /proc/modules permission or run as root.\n");
+        if (!perf_evlist__exclude_kernel(rec->evlist)) {
+                err = perf_event__synthesize_kernel_mmap(tool, process_synthesized_event,
+                                                         machine);
+                WARN_ONCE(err < 0, "Couldn't record kernel reference relocation symbol\n"
+                                   "Symbol resolution may be skewed if relocation was used (e.g. kexec).\n"
+                                   "Check /proc/kallsyms permission or run as root.\n");
+
+                err = perf_event__synthesize_modules(tool, process_synthesized_event,
+                                                     machine);
+                WARN_ONCE(err < 0, "Couldn't record kernel module information.\n"
+                                   "Symbol resolution may be skewed if relocation was used (e.g. kexec).\n"
+                                   "Check /proc/modules permission or run as root.\n");
+        }
 
         if (perf_guest) {
                 machines__process_guests(&session->machines,
@@ -1693,7 +1711,7 @@ int cmd_record(int argc, const char **argv)
 
         err = -ENOMEM;
 
-        if (symbol_conf.kptr_restrict)
+        if (symbol_conf.kptr_restrict && !perf_evlist__exclude_kernel(rec->evlist))
                 pr_warning(
 "WARNING: Kernel address maps (/proc/{kallsyms,modules}) are restricted,\n"
 "check /proc/sys/kernel/kptr_restrict.\n\n"
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 1394cd8d96f7..af5dd038195e 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -441,6 +441,9 @@ static void report__warn_kptr_restrict(const struct report *rep)
         struct map *kernel_map = machine__kernel_map(&rep->session->machines.host);
         struct kmap *kernel_kmap = kernel_map ? map__kmap(kernel_map) : NULL;
 
+        if (perf_evlist__exclude_kernel(rep->session->evlist))
+                return;
+
         if (kernel_map == NULL ||
             (kernel_map->dso->hit &&
              (kernel_kmap->ref_reloc_sym == NULL ||
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index 68f36dc0344f..9b43bda45a41 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -1955,6 +1955,16 @@ static int perf_script__fopen_per_event_dump(struct perf_script *script)
         struct perf_evsel *evsel;
 
         evlist__for_each_entry(script->session->evlist, evsel) {
+                /*
+                 * Already setup? I.e. we may be called twice in cases like
+                 * Intel PT, one for the intel_pt// and dummy events, then
+                 * for the evsels syntheized from the auxtrace info.
+                 *
+                 * Ses perf_script__process_auxtrace_info.
+                 */
+                if (evsel->priv != NULL)
+                        continue;
+
                 evsel->priv = perf_evsel_script__new(evsel, script->session->data);
                 if (evsel->priv == NULL)
                         goto out_err_fclose;
@@ -2838,6 +2848,25 @@ int process_cpu_map_event(struct perf_tool *tool __maybe_unused,
         return set_maps(script);
 }
 
+#ifdef HAVE_AUXTRACE_SUPPORT
+static int perf_script__process_auxtrace_info(struct perf_tool *tool,
+                                              union perf_event *event,
+                                              struct perf_session *session)
+{
+        int ret = perf_event__process_auxtrace_info(tool, event, session);
+
+        if (ret == 0) {
+                struct perf_script *script = container_of(tool, struct perf_script, tool);
+
+                ret = perf_script__setup_per_event_dump(script);
+        }
+
+        return ret;
+}
+#else
+#define perf_script__process_auxtrace_info 0
+#endif
+
 int cmd_script(int argc, const char **argv)
 {
         bool show_full_info = false;
@@ -2866,7 +2895,7 @@ int cmd_script(int argc, const char **argv)
                         .feature         = perf_event__process_feature,
                         .build_id        = perf_event__process_build_id,
                         .id_index        = perf_event__process_id_index,
-                        .auxtrace_info   = perf_event__process_auxtrace_info,
+                        .auxtrace_info   = perf_script__process_auxtrace_info,
                         .auxtrace        = perf_event__process_auxtrace,
                         .auxtrace_error  = perf_event__process_auxtrace_error,
                         .stat            = perf_event__process_stat_event,
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 477a8699f0b5..9e0d2645ae13 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -77,6 +77,7 @@
 #include "sane_ctype.h"
 
 static volatile int done;
+static volatile int resize;
 
 #define HEADER_LINE_NR  5
 
@@ -85,11 +86,13 @@ static void perf_top__update_print_entries(struct perf_top *top)
         top->print_entries = top->winsize.ws_row - HEADER_LINE_NR;
 }
 
-static void perf_top__sig_winch(int sig __maybe_unused,
-                                siginfo_t *info __maybe_unused, void *arg)
+static void winch_sig(int sig __maybe_unused)
 {
-        struct perf_top *top = arg;
+        resize = 1;
+}
 
+static void perf_top__resize(struct perf_top *top)
+{
         get_term_dimensions(&top->winsize);
         perf_top__update_print_entries(top);
 }
@@ -473,12 +476,8 @@ static bool perf_top__handle_keypress(struct perf_top *top, int c)
                 case 'e':
                         prompt_integer(&top->print_entries, "Enter display entries (lines)");
                         if (top->print_entries == 0) {
-                                struct sigaction act = {
-                                        .sa_sigaction = perf_top__sig_winch,
-                                        .sa_flags     = SA_SIGINFO,
-                                };
-                                perf_top__sig_winch(SIGWINCH, NULL, top);
-                                sigaction(SIGWINCH, &act, NULL);
+                                perf_top__resize(top);
+                                signal(SIGWINCH, winch_sig);
                         } else {
                                 signal(SIGWINCH, SIG_DFL);
                         }
@@ -732,14 +731,16 @@ static void perf_event__process_sample(struct perf_tool *tool,
         if (!machine->kptr_restrict_warned &&
             symbol_conf.kptr_restrict &&
             al.cpumode == PERF_RECORD_MISC_KERNEL) {
-                ui__warning(
+                if (!perf_evlist__exclude_kernel(top->session->evlist)) {
+                        ui__warning(
 "Kernel address maps (/proc/{kallsyms,modules}) are restricted.\n\n"
 "Check /proc/sys/kernel/kptr_restrict.\n\n"
 "Kernel%s samples will not be resolved.\n",
                           al.map && !RB_EMPTY_ROOT(&al.map->dso->symbols[MAP__FUNCTION]) ?
                           " modules" : "");
-                if (use_browser <= 0)
-                        sleep(5);
+                        if (use_browser <= 0)
+                                sleep(5);
+                }
                 machine->kptr_restrict_warned = true;
         }
 
@@ -1030,6 +1031,11 @@ static int __cmd_top(struct perf_top *top)
 
                 if (hits == top->samples)
                         ret = perf_evlist__poll(top->evlist, 100);
+
+                if (resize) {
+                        perf_top__resize(top);
+                        resize = 0;
+                }
         }
 
         ret = 0;
@@ -1352,12 +1358,8 @@ int cmd_top(int argc, const char **argv)
 
         get_term_dimensions(&top.winsize);
         if (top.print_entries == 0) {
-                struct sigaction act = {
-                        .sa_sigaction = perf_top__sig_winch,
-                        .sa_flags     = SA_SIGINFO,
-                };
                 perf_top__update_print_entries(&top);
-                sigaction(SIGWINCH, &act, NULL);
+                signal(SIGWINCH, winch_sig);
         }
 
         status = __cmd_top(&top);
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index f2757d38c7d7..84debdbad327 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -1152,12 +1152,14 @@ static int trace__symbols_init(struct trace *trace, struct perf_evlist *evlist)
         if (trace->host == NULL)
                 return -ENOMEM;
 
-        if (trace_event__register_resolver(trace->host, trace__machine__resolve_kernel_addr) < 0)
-                return -errno;
+        err = trace_event__register_resolver(trace->host, trace__machine__resolve_kernel_addr);
+        if (err < 0)
+                goto out;
 
         err = __machine__synthesize_threads(trace->host, &trace->tool, &trace->opts.target,
                                             evlist->threads, trace__tool_process, false,
                                             trace->opts.proc_map_timeout, 1);
+out:
         if (err)
                 symbol__exit();
 
diff --git a/tools/perf/check-headers.sh b/tools/perf/check-headers.sh
index 77406d25e521..3e64f10b6d66 100755
--- a/tools/perf/check-headers.sh
+++ b/tools/perf/check-headers.sh
@@ -21,6 +21,7 @@ arch/x86/include/asm/cpufeatures.h
 arch/arm/include/uapi/asm/perf_regs.h
 arch/arm64/include/uapi/asm/perf_regs.h
 arch/powerpc/include/uapi/asm/perf_regs.h
+arch/s390/include/uapi/asm/perf_regs.h
 arch/x86/include/uapi/asm/perf_regs.h
 arch/x86/include/uapi/asm/kvm.h
 arch/x86/include/uapi/asm/kvm_perf.h
@@ -30,6 +31,7 @@ arch/x86/include/uapi/asm/vmx.h
 arch/powerpc/include/uapi/asm/kvm.h
 arch/s390/include/uapi/asm/kvm.h
 arch/s390/include/uapi/asm/kvm_perf.h
+arch/s390/include/uapi/asm/ptrace.h
 arch/s390/include/uapi/asm/sie.h
 arch/arm/include/uapi/asm/kvm.h
 arch/arm64/include/uapi/asm/kvm.h
diff --git a/tools/perf/jvmti/jvmti_agent.c b/tools/perf/jvmti/jvmti_agent.c
index cf36de7ea255..0c6d1002b524 100644
--- a/tools/perf/jvmti/jvmti_agent.c
+++ b/tools/perf/jvmti/jvmti_agent.c
@@ -384,13 +384,13 @@ jvmti_write_code(void *agent, char const *sym,
 }
 
 int
-jvmti_write_debug_info(void *agent, uint64_t code, const char *file,
-                       jvmti_line_info_t *li, int nr_lines)
+jvmti_write_debug_info(void *agent, uint64_t code,
+    int nr_lines, jvmti_line_info_t *li,
+    const char * const * file_names)
 {
         struct jr_code_debug_info rec;
-        size_t sret, len, size, flen;
+        size_t sret, len, size, flen = 0;
         uint64_t addr;
-        const char *fn = file;
         FILE *fp = agent;
         int i;
 
@@ -405,7 +405,9 @@ jvmti_write_debug_info(void *agent, uint64_t code, const char *file,
                 return -1;
         }
 
-        flen = strlen(file) + 1;
+        for (i = 0; i < nr_lines; ++i) {
+            flen += strlen(file_names[i]) + 1;
+        }
 
         rec.p.id        = JIT_CODE_DEBUG_INFO;
         size            = sizeof(rec);
@@ -421,7 +423,7 @@ jvmti_write_debug_info(void *agent, uint64_t code, const char *file,
          * file[]   : source file name
          */
         size += nr_lines * sizeof(struct debug_entry);
-        size += flen * nr_lines;
+        size += flen;
         rec.p.total_size = size;
 
         /*
@@ -452,7 +454,7 @@ jvmti_write_debug_info(void *agent, uint64_t code, const char *file,
                 if (sret != 1)
                         goto error;
 
-                sret = fwrite_unlocked(fn, flen, 1, fp);
+                sret = fwrite_unlocked(file_names[i], strlen(file_names[i]) + 1, 1, fp);
                 if (sret != 1)
                         goto error;
         }
diff --git a/tools/perf/jvmti/jvmti_agent.h b/tools/perf/jvmti/jvmti_agent.h
index fe32d8344a82..6ed82f6c06dd 100644
--- a/tools/perf/jvmti/jvmti_agent.h
+++ b/tools/perf/jvmti/jvmti_agent.h
@@ -14,6 +14,7 @@ typedef struct {
         unsigned long   pc;
         int             line_number;
         int             discrim; /* discriminator -- 0 for now */
+        jmethodID       methodID;
 } jvmti_line_info_t;
 
 void *jvmti_open(void);
@@ -22,11 +23,9 @@ int   jvmti_write_code(void *agent, char const *symbol_name,
                        uint64_t vma, void const *code,
                        const unsigned int code_size);
 
-int   jvmti_write_debug_info(void *agent,
-                             uint64_t code,
-                             const char *file,
+int   jvmti_write_debug_info(void *agent, uint64_t code, int nr_lines,
                              jvmti_line_info_t *li,
-                             int nr_lines);
+                             const char * const * file_names);
 
 #if defined(__cplusplus)
 }
diff --git a/tools/perf/jvmti/libjvmti.c b/tools/perf/jvmti/libjvmti.c
index c62c9fc9a525..6add3e982614 100644
--- a/tools/perf/jvmti/libjvmti.c
+++ b/tools/perf/jvmti/libjvmti.c
@@ -47,6 +47,7 @@ do_get_line_numbers(jvmtiEnv *jvmti, void *pc, jmethodID m, jint bci,
                         tab[lines].pc = (unsigned long)pc;
                         tab[lines].line_number = loc_tab[i].line_number;
                         tab[lines].discrim = 0; /* not yet used */
+                        tab[lines].methodID = m;
                         lines++;
                 } else {
                         break;
@@ -125,6 +126,99 @@ get_line_numbers(jvmtiEnv *jvmti, const void *compile_info, jvmti_line_info_t **
         return JVMTI_ERROR_NONE;
 }
 
+static void
+copy_class_filename(const char * class_sign, const char * file_name, char * result, size_t max_length)
+{
+        /*
+        * Assume path name is class hierarchy, this is a common practice with Java programs
+        */
+        if (*class_sign == 'L') {
+                int j, i = 0;
+                char *p = strrchr(class_sign, '/');
+                if (p) {
+                        /* drop the 'L' prefix and copy up to the final '/' */
+                        for (i = 0; i < (p - class_sign); i++)
+                                result[i] = class_sign[i+1];
+                }
+                /*
+                * append file name, we use loops and not string ops to avoid modifying
+                * class_sign which is used later for the symbol name
+                */
+                for (j = 0; i < (max_length - 1) && file_name && j < strlen(file_name); j++, i++)
+                        result[i] = file_name[j];
+
+                result[i] = '\0';
+        } else {
+                /* fallback case */
+                size_t file_name_len = strlen(file_name);
+                strncpy(result, file_name, file_name_len < max_length ? file_name_len : max_length);
+        }
+}
+
+static jvmtiError
+get_source_filename(jvmtiEnv *jvmti, jmethodID methodID, char ** buffer)
+{
+        jvmtiError ret;
+        jclass decl_class;
+        char *file_name = NULL;
+        char *class_sign = NULL;
+        char fn[PATH_MAX];
+        size_t len;
+
+        ret = (*jvmti)->GetMethodDeclaringClass(jvmti, methodID, &decl_class);
+        if (ret != JVMTI_ERROR_NONE) {
+                print_error(jvmti, "GetMethodDeclaringClass", ret);
+                return ret;
+        }
+
+        ret = (*jvmti)->GetSourceFileName(jvmti, decl_class, &file_name);
+        if (ret != JVMTI_ERROR_NONE) {
+                print_error(jvmti, "GetSourceFileName", ret);
+                return ret;
+        }
+
+        ret = (*jvmti)->GetClassSignature(jvmti, decl_class, &class_sign, NULL);
+        if (ret != JVMTI_ERROR_NONE) {
+                print_error(jvmti, "GetClassSignature", ret);
+                goto free_file_name_error;
+        }
+
+        copy_class_filename(class_sign, file_name, fn, PATH_MAX);
+        len = strlen(fn);
+        *buffer = malloc((len + 1) * sizeof(char));
+        if (!*buffer) {
+                print_error(jvmti, "GetClassSignature", ret);
+                ret = JVMTI_ERROR_OUT_OF_MEMORY;
+                goto free_class_sign_error;
+        }
+        strcpy(*buffer, fn);
+        ret = JVMTI_ERROR_NONE;
+
+free_class_sign_error:
+        (*jvmti)->Deallocate(jvmti, (unsigned char *)class_sign);
+free_file_name_error:
+        (*jvmti)->Deallocate(jvmti, (unsigned char *)file_name);
+
+        return ret;
+}
+
+static jvmtiError
+fill_source_filenames(jvmtiEnv *jvmti, int nr_lines,
+                      const jvmti_line_info_t * line_tab,
+                      char ** file_names)
+{
+        int index;
+        jvmtiError ret;
+
+        for (index = 0; index < nr_lines; ++index) {
+                ret = get_source_filename(jvmti, line_tab[index].methodID, &(file_names[index]));
+                if (ret != JVMTI_ERROR_NONE)
+                        return ret;
+        }
+
+        return JVMTI_ERROR_NONE;
+}
+
 static void JNICALL
 compiled_method_load_cb(jvmtiEnv *jvmti,
                         jmethodID method,
@@ -135,16 +229,18 @@ compiled_method_load_cb(jvmtiEnv *jvmti,
                         const void *compile_info)
 {
         jvmti_line_info_t *line_tab = NULL;
+        char ** line_file_names = NULL;
         jclass decl_class;
         char *class_sign = NULL;
         char *func_name = NULL;
         char *func_sign = NULL;
-        char *file_name= NULL;
+        char *file_name = NULL;
         char fn[PATH_MAX];
         uint64_t addr = (uint64_t)(uintptr_t)code_addr;
         jvmtiError ret;
         int nr_lines = 0; /* in line_tab[] */
         size_t len;
+        int output_debug_info = 0;
 
         ret = (*jvmti)->GetMethodDeclaringClass(jvmti, method,
                                                 &decl_class);
@@ -158,6 +254,19 @@ compiled_method_load_cb(jvmtiEnv *jvmti,
                 if (ret != JVMTI_ERROR_NONE) {
                         warnx("jvmti: cannot get line table for method");
                         nr_lines = 0;
+                } else if (nr_lines > 0) {
+                        line_file_names = malloc(sizeof(char*) * nr_lines);
+                        if (!line_file_names) {
+                                warnx("jvmti: cannot allocate space for line table method names");
+                        } else {
+                                memset(line_file_names, 0, sizeof(char*) * nr_lines);
+                                ret = fill_source_filenames(jvmti, nr_lines, line_tab, line_file_names);
+                                if (ret != JVMTI_ERROR_NONE) {
+                                        warnx("jvmti: fill_source_filenames failed");
+                                } else {
+                                        output_debug_info = 1;
+                                }
+                        }
                 }
         }
 
@@ -181,33 +290,14 @@ compiled_method_load_cb(jvmtiEnv *jvmti,
                 goto error;
         }
 
-        /*
-         * Assume path name is class hierarchy, this is a common practice with Java programs
-         */
-        if (*class_sign == 'L') {
-                int j, i = 0;
-                char *p = strrchr(class_sign, '/');
-                if (p) {
-                        /* drop the 'L' prefix and copy up to the final '/' */
-                        for (i = 0; i < (p - class_sign); i++)
-                                fn[i] = class_sign[i+1];
-                }
-                /*
-                 * append file name, we use loops and not string ops to avoid modifying
-                 * class_sign which is used later for the symbol name
-                 */
-                for (j = 0; i < (PATH_MAX - 1) && file_name && j < strlen(file_name); j++, i++)
-                        fn[i] = file_name[j];
-                fn[i] = '\0';
-        } else {
-                /* fallback case */
-                strcpy(fn, file_name);
-        }
+        copy_class_filename(class_sign, file_name, fn, PATH_MAX);
+
         /*
          * write source line info record if we have it
          */
-        if (jvmti_write_debug_info(jvmti_agent, addr, fn, line_tab, nr_lines))
-                warnx("jvmti: write_debug_info() failed");
+        if (output_debug_info)
+                if (jvmti_write_debug_info(jvmti_agent, addr, nr_lines, line_tab, (const char * const *) line_file_names))
+                        warnx("jvmti: write_debug_info() failed");
 
         len = strlen(func_name) + strlen(class_sign) + strlen(func_sign) + 2;
         {
@@ -223,6 +313,13 @@ error:
         (*jvmti)->Deallocate(jvmti, (unsigned char *)class_sign);
         (*jvmti)->Deallocate(jvmti, (unsigned char *)file_name);
         free(line_tab);
+        while (line_file_names && (nr_lines > 0)) {
+            if (line_file_names[nr_lines - 1]) {
+                free(line_file_names[nr_lines - 1]);
+            }
+            nr_lines -= 1;
+        }
+        free(line_file_names);
 }
 
 static void JNICALL
diff --git a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
index 7a84d73324e3..8b3da21a08f1 100755
--- a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
+++ b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
@@ -10,8 +10,8 @@
 
 . $(dirname $0)/lib/probe.sh
 
-ld=$(realpath /lib64/ld*.so.* | uniq)
-libc=$(echo $ld | sed 's/ld/libc/g')
+libc=$(grep -w libc /proc/self/maps | head -1 | sed -r 's/.*[[:space:]](\/.*)/\1/g')
+nm -g $libc 2>/dev/null | fgrep -q inet_pton || exit 254
 
 trace_libc_inet_pton_backtrace() {
         idx=0
@@ -37,6 +37,9 @@ trace_libc_inet_pton_backtrace() {
         done
 }
 
+# Check for IPv6 interface existence
+ip a sh lo | fgrep -q inet6 || exit 2
+
 skip_if_no_perf_probe && \
 perf probe -q $libc inet_pton && \
 trace_libc_inet_pton_backtrace
diff --git a/tools/perf/tests/shell/trace+probe_vfs_getname.sh b/tools/perf/tests/shell/trace+probe_vfs_getname.sh
index 2e68c5f120da..2a9ef080efd0 100755
--- a/tools/perf/tests/shell/trace+probe_vfs_getname.sh
+++ b/tools/perf/tests/shell/trace+probe_vfs_getname.sh
@@ -17,8 +17,10 @@ skip_if_no_perf_probe || exit 2
 file=$(mktemp /tmp/temporary_file.XXXXX)
 
 trace_open_vfs_getname() {
-        perf trace -e open touch $file 2>&1 | \
-        egrep " +[0-9]+\.[0-9]+ +\( +[0-9]+\.[0-9]+ ms\): +touch\/[0-9]+ open\(filename: +${file}, +flags: CREAT\|NOCTTY\|NONBLOCK\|WRONLY, +mode: +IRUGO\|IWUGO\) += +[0-9]+$"
+        test "$(uname -m)" = s390x && { svc="openat"; txt="dfd: +CWD, +"; }
+
+        perf trace -e ${svc:-open} touch $file 2>&1 | \
+        egrep " +[0-9]+\.[0-9]+ +\( +[0-9]+\.[0-9]+ ms\): +touch\/[0-9]+ ${svc:-open}\(${txt}filename: +${file}, +flags: CREAT\|NOCTTY\|NONBLOCK\|WRONLY, +mode: +IRUGO\|IWUGO\) += +[0-9]+$"
 }
 
 
diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c
index bc4a7344e274..89c8e1604ca7 100644
--- a/tools/perf/tests/task-exit.c
+++ b/tools/perf/tests/task-exit.c
@@ -84,7 +84,11 @@ int test__task_exit(struct test *test __maybe_unused, int subtest __maybe_unused
 
         evsel = perf_evlist__first(evlist);
         evsel->attr.task = 1;
+#ifdef __s390x__
+        evsel->attr.sample_freq = 1000000;
+#else
         evsel->attr.sample_freq = 1;
+#endif
         evsel->attr.inherit = 0;
         evsel->attr.watermark = 0;
         evsel->attr.wakeup_events = 1;
diff --git a/tools/perf/trace/beauty/mmap.c b/tools/perf/trace/beauty/mmap.c
index 9e1668b2c5d7..417e3ecfe9d7 100644
--- a/tools/perf/trace/beauty/mmap.c
+++ b/tools/perf/trace/beauty/mmap.c
@@ -62,6 +62,9 @@ static size_t syscall_arg__scnprintf_mmap_flags(char *bf, size_t size,
         P_MMAP_FLAG(POPULATE);
         P_MMAP_FLAG(STACK);
         P_MMAP_FLAG(UNINITIALIZED);
+#ifdef MAP_SYNC
+        P_MMAP_FLAG(SYNC);
+#endif
 #undef P_MMAP_FLAG
 
         if (flags)
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index da1c4c4a0dd8..3369c7830260 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -165,7 +165,7 @@ static void ins__delete(struct ins_operands *ops)
 static int ins__raw_scnprintf(struct ins *ins, char *bf, size_t size,
                               struct ins_operands *ops)
 {
-        return scnprintf(bf, size, "%-6.6s %s", ins->name, ops->raw);
+        return scnprintf(bf, size, "%-6s %s", ins->name, ops->raw);
 }
 
 int ins__scnprintf(struct ins *ins, char *bf, size_t size,
@@ -230,12 +230,12 @@ static int call__scnprintf(struct ins *ins, char *bf, size_t size,
                            struct ins_operands *ops)
 {
         if (ops->target.name)
-                return scnprintf(bf, size, "%-6.6s %s", ins->name, ops->target.name);
+                return scnprintf(bf, size, "%-6s %s", ins->name, ops->target.name);
 
         if (ops->target.addr == 0)
                 return ins__raw_scnprintf(ins, bf, size, ops);
 
-        return scnprintf(bf, size, "%-6.6s *%" PRIx64, ins->name, ops->target.addr);
+        return scnprintf(bf, size, "%-6s *%" PRIx64, ins->name, ops->target.addr);
 }
 
 static struct ins_ops call_ops = {
@@ -299,7 +299,7 @@ static int jump__scnprintf(struct ins *ins, char *bf, size_t size,
                         c++;
         }
 
-        return scnprintf(bf, size, "%-6.6s %.*s%" PRIx64,
+        return scnprintf(bf, size, "%-6s %.*s%" PRIx64,
                          ins->name, c ? c - ops->raw : 0, ops->raw,
                          ops->target.offset);
 }
@@ -372,7 +372,7 @@ static int lock__scnprintf(struct ins *ins, char *bf, size_t size,
         if (ops->locked.ins.ops == NULL)
                 return ins__raw_scnprintf(ins, bf, size, ops);
 
-        printed = scnprintf(bf, size, "%-6.6s ", ins->name);
+        printed = scnprintf(bf, size, "%-6s ", ins->name);
         return printed + ins__scnprintf(&ops->locked.ins, bf + printed,
                                         size - printed, ops->locked.ops);
 }
@@ -448,7 +448,7 @@ out_free_source:
 static int mov__scnprintf(struct ins *ins, char *bf, size_t size,
                            struct ins_operands *ops)
 {
-        return scnprintf(bf, size, "%-6.6s %s,%s", ins->name,
+        return scnprintf(bf, size, "%-6s %s,%s", ins->name,
                          ops->source.name ?: ops->source.raw,
                          ops->target.name ?: ops->target.raw);
 }
@@ -488,7 +488,7 @@ static int dec__parse(struct arch *arch __maybe_unused, struct ins_operands *ops
 static int dec__scnprintf(struct ins *ins, char *bf, size_t size,
                            struct ins_operands *ops)
 {
-        return scnprintf(bf, size, "%-6.6s %s", ins->name,
+        return scnprintf(bf, size, "%-6s %s", ins->name,
                          ops->target.name ?: ops->target.raw);
 }
 
@@ -500,7 +500,7 @@ static struct ins_ops dec_ops = {
 static int nop__scnprintf(struct ins *ins __maybe_unused, char *bf, size_t size,
                           struct ins_operands *ops __maybe_unused)
 {
-        return scnprintf(bf, size, "%-6.6s", "nop");
+        return scnprintf(bf, size, "%-6s", "nop");
 }
 
 static struct ins_ops nop_ops = {
@@ -924,7 +924,7 @@ void disasm_line__free(struct disasm_line *dl)
 int disasm_line__scnprintf(struct disasm_line *dl, char *bf, size_t size, bool raw)
 {
         if (raw || !dl->ins.ops)
-                return scnprintf(bf, size, "%-6.6s %s", dl->ins.name, dl->ops.raw);
+                return scnprintf(bf, size, "%-6s %s", dl->ins.name, dl->ops.raw);
 
         return ins__scnprintf(&dl->ins, bf, size, &dl->ops);
 }
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index c6c891e154a6..b62e523a7035 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -257,7 +257,7 @@ int perf_evlist__add_dummy(struct perf_evlist *evlist)
                 .config = PERF_COUNT_SW_DUMMY,
                 .size   = sizeof(attr), /* to capture ABI version */
         };
-        struct perf_evsel *evsel = perf_evsel__new(&attr);
+        struct perf_evsel *evsel = perf_evsel__new_idx(&attr, evlist->nr_entries);
 
         if (evsel == NULL)
                 return -ENOMEM;
@@ -1786,3 +1786,15 @@ void perf_evlist__toggle_bkw_mmap(struct perf_evlist *evlist,
 state_err:
         return;
 }
+
+bool perf_evlist__exclude_kernel(struct perf_evlist *evlist)
+{
+        struct perf_evsel *evsel;
+
+        evlist__for_each_entry(evlist, evsel) {
+                if (!evsel->attr.exclude_kernel)
+                        return false;
+        }
+
+        return true;
+}
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index e72ae64c11ac..491f69542920 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -312,4 +312,6 @@ perf_evlist__find_evsel_by_str(struct perf_evlist *evlist, const char *str);
 
 struct perf_evsel *perf_evlist__event2evsel(struct perf_evlist *evlist,
                                             union perf_event *event);
+
+bool perf_evlist__exclude_kernel(struct perf_evlist *evlist);
 #endif /* __PERF_EVLIST_H */
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index f894893c203d..d5fbcf8c7aa7 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -733,12 +733,16 @@ static void apply_config_terms(struct perf_evsel *evsel,
         list_for_each_entry(term, config_terms, list) {
                 switch (term->type) {
                 case PERF_EVSEL__CONFIG_TERM_PERIOD:
-                        attr->sample_period = term->val.period;
-                        attr->freq = 0;
+                        if (!(term->weak && opts->user_interval != ULLONG_MAX)) {
+                                attr->sample_period = term->val.period;
+                                attr->freq = 0;
+                        }
                         break;
                 case PERF_EVSEL__CONFIG_TERM_FREQ:
-                        attr->sample_freq = term->val.freq;
-                        attr->freq = 1;
+                        if (!(term->weak && opts->user_freq != UINT_MAX)) {
+                                attr->sample_freq = term->val.freq;
+                                attr->freq = 1;
+                        }
                         break;
                 case PERF_EVSEL__CONFIG_TERM_TIME:
                         if (term->val.time)
@@ -1371,7 +1375,7 @@ perf_evsel__process_group_data(struct perf_evsel *leader,
 static int
 perf_evsel__read_group(struct perf_evsel *leader, int cpu, int thread)
 {
-        struct perf_stat_evsel *ps = leader->priv;
+        struct perf_stat_evsel *ps = leader->stats;
         u64 read_format = leader->attr.read_format;
         int size = perf_evsel__read_size(leader);
         u64 *data = ps->group_data;
diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
index 9277df96ffda..157f49e8a772 100644
--- a/tools/perf/util/evsel.h
+++ b/tools/perf/util/evsel.h
@@ -67,6 +67,7 @@ struct perf_evsel_config_term {
                 bool    overwrite;
                 char    *branch;
         } val;
+        bool weak;
 };
 
 struct perf_stat_evsel;
diff --git a/tools/perf/util/intel-pt-decoder/inat.h b/tools/perf/util/intel-pt-decoder/inat.h
index 125ecd2a300d..52dc8d911173 100644
--- a/tools/perf/util/intel-pt-decoder/inat.h
+++ b/tools/perf/util/intel-pt-decoder/inat.h
@@ -97,6 +97,16 @@
 #define INAT_MAKE_GROUP(grp)    ((grp << INAT_GRP_OFFS) | INAT_MODRM)
 #define INAT_MAKE_IMM(imm)      (imm << INAT_IMM_OFFS)
 
+/* Identifiers for segment registers */
+#define INAT_SEG_REG_IGNORE     0
+#define INAT_SEG_REG_DEFAULT    1
+#define INAT_SEG_REG_CS         2
+#define INAT_SEG_REG_SS         3
+#define INAT_SEG_REG_DS         4
+#define INAT_SEG_REG_ES         5
+#define INAT_SEG_REG_FS         6
+#define INAT_SEG_REG_GS         7
+
 /* Attribute search APIs */
 extern insn_attr_t inat_get_opcode_attribute(insn_byte_t opcode);
 extern int inat_get_last_prefix_id(insn_byte_t last_pfx);
diff --git a/tools/perf/util/intel-pt-decoder/x86-opcode-map.txt b/tools/perf/util/intel-pt-decoder/x86-opcode-map.txt
index 12e377184ee4..e0b85930dd77 100644
--- a/tools/perf/util/intel-pt-decoder/x86-opcode-map.txt
+++ b/tools/perf/util/intel-pt-decoder/x86-opcode-map.txt
@@ -607,7 +607,7 @@ fb: psubq Pq,Qq | vpsubq Vx,Hx,Wx (66),(v1)
 fc: paddb Pq,Qq | vpaddb Vx,Hx,Wx (66),(v1)
 fd: paddw Pq,Qq | vpaddw Vx,Hx,Wx (66),(v1)
 fe: paddd Pq,Qq | vpaddd Vx,Hx,Wx (66),(v1)
-ff:
+ff: UD0
 EndTable
 
 Table: 3-byte opcode 1 (0x0f 0x38)
@@ -717,7 +717,7 @@ AVXcode: 2
 7e: vpermt2d/q Vx,Hx,Wx (66),(ev)
 7f: vpermt2ps/d Vx,Hx,Wx (66),(ev)
 80: INVEPT Gy,Mdq (66)
-81: INVPID Gy,Mdq (66)
+81: INVVPID Gy,Mdq (66)
 82: INVPCID Gy,Mdq (66)
 83: vpmultishiftqb Vx,Hx,Wx (66),(ev)
 88: vexpandps/d Vpd,Wpd (66),(ev)
@@ -896,7 +896,7 @@ EndTable
 
 GrpTable: Grp3_1
 0: TEST Eb,Ib
-1:
+1: TEST Eb,Ib
 2: NOT Eb
 3: NEG Eb
 4: MUL AL,Eb
@@ -970,6 +970,15 @@ GrpTable: Grp9
 EndTable
 
 GrpTable: Grp10
+# all are UD1
+0: UD1
+1: UD1
+2: UD1
+3: UD1
+4: UD1
+5: UD1
+6: UD1
+7: UD1
 EndTable
 
 # Grp11A and Grp11B are expressed as Grp11 in Intel SDM
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 6a8d03c3d9b7..270f3223c6df 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -172,6 +172,9 @@ void machine__exit(struct machine *machine)
 {
         int i;
 
+        if (machine == NULL)
+                return;
+
         machine__destroy_kernel_maps(machine);
         map_groups__exit(&machine->kmaps);
         dsos__exit(&machine->dsos);
diff --git a/tools/perf/util/mmap.h b/tools/perf/util/mmap.h
index efd78b827b05..3a5cb5a6e94a 100644
--- a/tools/perf/util/mmap.h
+++ b/tools/perf/util/mmap.h
@@ -70,7 +70,7 @@ void perf_mmap__read_catchup(struct perf_mmap *md);
 static inline u64 perf_mmap__read_head(struct perf_mmap *mm)
 {
         struct perf_event_mmap_page *pc = mm->base;
-        u64 head = ACCESS_ONCE(pc->data_head);
+        u64 head = READ_ONCE(pc->data_head);
         rmb();
         return head;
 }
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index a7fcd95961ef..170316795a18 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -1116,6 +1116,7 @@ do {								\
         INIT_LIST_HEAD(&__t->list);                             \
         __t->type       = PERF_EVSEL__CONFIG_TERM_ ## __type;   \
         __t->val.__name = __val;                                \
+        __t->weak       = term->weak;                           \
         list_add_tail(&__t->list, head_terms);                  \
 } while (0)
 
@@ -2410,6 +2411,7 @@ static int new_term(struct parse_events_term **_term,
 
         *term = *temp;
         INIT_LIST_HEAD(&term->list);
+        term->weak = false;
 
         switch (term->type_val) {
         case PARSE_EVENTS__TERM_TYPE_NUM:
diff --git a/tools/perf/util/parse-events.h b/tools/perf/util/parse-events.h
index be337c266697..88108cd11b4c 100644
--- a/tools/perf/util/parse-events.h
+++ b/tools/perf/util/parse-events.h
@@ -101,6 +101,9 @@ struct parse_events_term {
         /* error string indexes for within parsed string */
         int err_term;
         int err_val;
+
+        /* Coming from implicit alias */
+        bool weak;
 };
 
 struct parse_events_error {
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index 07cb2ac041d7..80fb1593913a 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -405,6 +405,11 @@ static int pmu_alias_terms(struct perf_pmu_alias *alias,
                         parse_events_terms__purge(&list);
                         return ret;
                 }
+                /*
+                 * Weak terms don't override command line options,
+                 * which we don't want for implicit terms in aliases.
+                 */
+                cloned->weak = true;
                 list_add_tail(&cloned->list, &list);
         }
         list_splice(&list, terms);
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 333a48655ee0..9316e648a880 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -1,4 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
+
 LIBDIR := ../../../lib
 BPFDIR := $(LIBDIR)/bpf
 APIDIR := ../../../include/uapi
@@ -10,7 +11,7 @@ ifneq ($(wildcard $(GENHDR)),)
 endif
 
 CFLAGS += -Wall -O2 -I$(APIDIR) -I$(LIBDIR) -I$(GENDIR) $(GENFLAGS) -I../../../include
-LDLIBS += -lcap -lelf
+LDLIBS += -lcap -lelf -lrt
 
 TEST_GEN_PROGS = test_verifier test_tag test_maps test_lru_map test_lpm_map test_progs \
         test_align test_verifier_log test_dev_cgroup
@@ -38,7 +39,7 @@ $(BPFOBJ): force
 CLANG ?= clang
 LLC   ?= llc
 
-PROBE := $(shell llc -march=bpf -mcpu=probe -filetype=null /dev/null 2>&1)
+PROBE := $(shell $(LLC) -march=bpf -mcpu=probe -filetype=null /dev/null 2>&1)
 
 # Let newer LLVM versions transparently probe the kernel for availability
 # of full BPF instruction set.
diff --git a/tools/testing/selftests/bpf/test_align.c b/tools/testing/selftests/bpf/test_align.c
index 8591c89c0828..471bbbdb94db 100644
--- a/tools/testing/selftests/bpf/test_align.c
+++ b/tools/testing/selftests/bpf/test_align.c
@@ -474,27 +474,7 @@ static struct bpf_align_test tests[] = {
                 .result = REJECT,
                 .matches = {
                         {4, "R5=pkt(id=0,off=0,r=0,imm=0)"},
-                        /* ptr & 0x40 == either 0 or 0x40 */
-                        {5, "R5=inv(id=0,umax_value=64,var_off=(0x0; 0x40))"},
-                        /* ptr << 2 == unknown, (4n) */
-                        {7, "R5=inv(id=0,smax_value=9223372036854775804,umax_value=18446744073709551612,var_off=(0x0; 0xfffffffffffffffc))"},
-                        /* (4n) + 14 == (4n+2).  We blow our bounds, because
-                         * the add could overflow.
-                         */
-                        {8, "R5=inv(id=0,var_off=(0x2; 0xfffffffffffffffc))"},
-                        /* Checked s>=0 */
-                        {10, "R5=inv(id=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"},
-                        /* packet pointer + nonnegative (4n+2) */
-                        {12, "R6=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"},
-                        {14, "R4=pkt(id=1,off=4,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"},
-                        /* NET_IP_ALIGN + (4n+2) == (4n), alignment is fine.
-                         * We checked the bounds, but it might have been able
-                         * to overflow if the packet pointer started in the
-                         * upper half of the address space.
-                         * So we did not get a 'range' on R6, and the access
-                         * attempt will fail.
-                         */
-                        {16, "R6=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"},
+                        /* R5 bitwise operator &= on pointer prohibited */
                 }
         },
         {
diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index 69427531408d..6761be18a91f 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -351,7 +351,7 @@ static void test_bpf_obj_id(void)
                           info_len != sizeof(struct bpf_map_info) ||
                           strcmp((char *)map_infos[i].name, expected_map_name),
                           "get-map-info(fd)",
-                          "err %d errno %d type %d(%d) info_len %u(%lu) key_size %u value_size %u max_entries %u map_flags %X name %s(%s)\n",
+                          "err %d errno %d type %d(%d) info_len %u(%Zu) key_size %u value_size %u max_entries %u map_flags %X name %s(%s)\n",
                           err, errno,
                           map_infos[i].type, BPF_MAP_TYPE_ARRAY,
                           info_len, sizeof(struct bpf_map_info),
@@ -395,7 +395,7 @@ static void test_bpf_obj_id(void)
                           *(int *)prog_infos[i].map_ids != map_infos[i].id ||
                           strcmp((char *)prog_infos[i].name, expected_prog_name),
                           "get-prog-info(fd)",
-                          "err %d errno %d i %d type %d(%d) info_len %u(%lu) jit_enabled %d jited_prog_len %u xlated_prog_len %u jited_prog %d xlated_prog %d load_time %lu(%lu) uid %u(%u) nr_map_ids %u(%u) map_id %u(%u) name %s(%s)\n",
+                          "err %d errno %d i %d type %d(%d) info_len %u(%Zu) jit_enabled %d jited_prog_len %u xlated_prog_len %u jited_prog %d xlated_prog %d load_time %lu(%lu) uid %u(%u) nr_map_ids %u(%u) map_id %u(%u) name %s(%s)\n",
                           err, errno, i,
                           prog_infos[i].type, BPF_PROG_TYPE_SOCKET_FILTER,
                           info_len, sizeof(struct bpf_prog_info),
@@ -463,7 +463,7 @@ static void test_bpf_obj_id(void)
                       memcmp(&prog_info, &prog_infos[i], info_len) ||
                       *(int *)prog_info.map_ids != saved_map_id,
                       "get-prog-info(next_id->fd)",
-                      "err %d errno %d info_len %u(%lu) memcmp %d map_id %u(%u)\n",
+                      "err %d errno %d info_len %u(%Zu) memcmp %d map_id %u(%u)\n",
                       err, errno, info_len, sizeof(struct bpf_prog_info),
                       memcmp(&prog_info, &prog_infos[i], info_len),
                       *(int *)prog_info.map_ids, saved_map_id);
@@ -509,7 +509,7 @@ static void test_bpf_obj_id(void)
                       memcmp(&map_info, &map_infos[i], info_len) ||
                       array_value != array_magic_value,
                       "check get-map-info(next_id->fd)",
-                      "err %d errno %d info_len %u(%lu) memcmp %d array_value %llu(%llu)\n",
+                      "err %d errno %d info_len %u(%Zu) memcmp %d array_value %llu(%llu)\n",
                       err, errno, info_len, sizeof(struct bpf_map_info),
                       memcmp(&map_info, &map_infos[i], info_len),
                       array_value, array_magic_value);
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 3c64f30cf63c..5ed4175c4ff8 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -273,6 +273,46 @@ static struct bpf_test tests[] = {
                 .result = REJECT,
         },
         {
+                "arsh32 on imm",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_ALU32_IMM(BPF_ARSH, BPF_REG_0, 5),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "BPF_ARSH not supported for 32 bit ALU",
+        },
+        {
+                "arsh32 on reg",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_MOV64_IMM(BPF_REG_1, 5),
+                        BPF_ALU32_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "BPF_ARSH not supported for 32 bit ALU",
+        },
+        {
+                "arsh64 on imm",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_ALU64_IMM(BPF_ARSH, BPF_REG_0, 5),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+        },
+        {
+                "arsh64 on reg",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_MOV64_IMM(BPF_REG_1, 5),
+                        BPF_ALU64_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+        },
+        {
                 "no bpf_exit",
                 .insns = {
                         BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
@@ -422,9 +462,7 @@ static struct bpf_test tests[] = {
                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
                         BPF_EXIT_INSN(),
                 },
-                .errstr_unpriv = "R1 subtraction from stack pointer",
-                .result_unpriv = REJECT,
-                .errstr = "R1 invalid mem access",
+                .errstr = "R1 subtraction from stack pointer",
                 .result = REJECT,
         },
         {
@@ -606,7 +644,6 @@ static struct bpf_test tests[] = {
                 },
                 .errstr = "misaligned stack access",
                 .result = REJECT,
-                .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
         },
         {
                 "invalid map_fd for function call",
@@ -1797,7 +1834,6 @@ static struct bpf_test tests[] = {
                 },
                 .result = REJECT,
                 .errstr = "misaligned stack access off (0x0; 0x0)+-8+2 size 8",
-                .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
         },
         {
                 "PTR_TO_STACK store/load - bad alignment on reg",
@@ -1810,7 +1846,6 @@ static struct bpf_test tests[] = {
                 },
                 .result = REJECT,
                 .errstr = "misaligned stack access off (0x0; 0x0)+-10+8 size 8",
-                .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
         },
         {
                 "PTR_TO_STACK store/load - out of bounds low",
@@ -1862,9 +1897,8 @@ static struct bpf_test tests[] = {
                         BPF_MOV64_IMM(BPF_REG_0, 0),
                         BPF_EXIT_INSN(),
                 },
-                .result = ACCEPT,
-                .result_unpriv = REJECT,
-                .errstr_unpriv = "R1 pointer += pointer",
+                .result = REJECT,
+                .errstr = "R1 pointer += pointer",
         },
         {
                 "unpriv: neg pointer",
@@ -2559,6 +2593,29 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
         },
         {
+                "context stores via ST",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_1, offsetof(struct __sk_buff, mark), 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "BPF_ST stores into R1 context is not allowed",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        },
+        {
+                "context stores via XADD",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_W, BPF_REG_1,
+                                     BPF_REG_0, offsetof(struct __sk_buff, mark), 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "BPF_XADD stores into R1 context is not allowed",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        },
+        {
                 "direct packet access: test1",
                 .insns = {
                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
@@ -2592,7 +2649,8 @@ static struct bpf_test tests[] = {
                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
                                     offsetof(struct __sk_buff, data)),
                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
-                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct __sk_buff, len)),
                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 49),
                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 49),
                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
@@ -2899,7 +2957,7 @@ static struct bpf_test tests[] = {
                         BPF_MOV64_IMM(BPF_REG_0, 0),
                         BPF_EXIT_INSN(),
                 },
-                .errstr = "invalid access to packet",
+                .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
                 .result = REJECT,
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
         },
@@ -3885,9 +3943,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map2 = { 3, 11 },
-                .errstr_unpriv = "R0 pointer += pointer",
-                .errstr = "R0 invalid mem access 'inv'",
-                .result_unpriv = REJECT,
+                .errstr = "R0 pointer += pointer",
                 .result = REJECT,
                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
@@ -3928,7 +3984,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map1 = { 4 },
-                .errstr = "R4 invalid mem access",
+                .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
                 .result = REJECT,
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
         },
@@ -3949,7 +4005,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map1 = { 4 },
-                .errstr = "R4 invalid mem access",
+                .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
                 .result = REJECT,
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
         },
@@ -3970,7 +4026,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map1 = { 4 },
-                .errstr = "R4 invalid mem access",
+                .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
                 .result = REJECT,
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
         },
@@ -4279,7 +4335,8 @@ static struct bpf_test tests[] = {
                 .fixup_map1 = { 2 },
                 .errstr_unpriv = "R2 leaks addr into mem",
                 .result_unpriv = REJECT,
-                .result = ACCEPT,
+                .result = REJECT,
+                .errstr = "BPF_XADD stores into R1 context is not allowed",
         },
         {
                 "leak pointer into ctx 2",
@@ -4293,7 +4350,8 @@ static struct bpf_test tests[] = {
                 },
                 .errstr_unpriv = "R10 leaks addr into mem",
                 .result_unpriv = REJECT,
-                .result = ACCEPT,
+                .result = REJECT,
+                .errstr = "BPF_XADD stores into R1 context is not allowed",
         },
         {
                 "leak pointer into ctx 3",
@@ -5195,10 +5253,8 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map2 = { 3 },
-                .errstr_unpriv = "R0 bitwise operator &= on pointer",
-                .errstr = "invalid mem access 'inv'",
+                .errstr = "R0 bitwise operator &= on pointer",
                 .result = REJECT,
-                .result_unpriv = REJECT,
         },
         {
                 "map element value illegal alu op, 2",
@@ -5214,10 +5270,8 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map2 = { 3 },
-                .errstr_unpriv = "R0 32-bit pointer arithmetic prohibited",
-                .errstr = "invalid mem access 'inv'",
+                .errstr = "R0 32-bit pointer arithmetic prohibited",
                 .result = REJECT,
-                .result_unpriv = REJECT,
         },
         {
                 "map element value illegal alu op, 3",
@@ -5233,10 +5287,8 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map2 = { 3 },
-                .errstr_unpriv = "R0 pointer arithmetic with /= operator",
-                .errstr = "invalid mem access 'inv'",
+                .errstr = "R0 pointer arithmetic with /= operator",
                 .result = REJECT,
-                .result_unpriv = REJECT,
         },
         {
                 "map element value illegal alu op, 4",
@@ -6019,8 +6071,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map_in_map = { 3 },
-                .errstr = "R1 type=inv expected=map_ptr",
-                .errstr_unpriv = "R1 pointer arithmetic on CONST_PTR_TO_MAP prohibited",
+                .errstr = "R1 pointer arithmetic on CONST_PTR_TO_MAP prohibited",
                 .result = REJECT,
         },
         {
@@ -6117,6 +6168,30 @@ static struct bpf_test tests[] = {
                 .result = ACCEPT,
         },
         {
+                "ld_abs: tests on r6 and skb data reload helper",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_LD_ABS(BPF_B, 0),
+                        BPF_LD_ABS(BPF_H, 0),
+                        BPF_LD_ABS(BPF_W, 0),
+                        BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
+                        BPF_MOV64_IMM(BPF_REG_6, 0),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
+                        BPF_MOV64_IMM(BPF_REG_2, 1),
+                        BPF_MOV64_IMM(BPF_REG_3, 2),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_skb_vlan_push),
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
+                        BPF_LD_ABS(BPF_B, 0),
+                        BPF_LD_ABS(BPF_H, 0),
+                        BPF_LD_ABS(BPF_W, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 42),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .result = ACCEPT,
+        },
+        {
                 "ld_ind: check calling conv, r1",
                 .insns = {
                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
@@ -6300,7 +6375,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map1 = { 3 },
-                .errstr = "R0 min value is negative",
+                .errstr = "unbounded min value",
                 .result = REJECT,
         },
         {
@@ -6324,7 +6399,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map1 = { 3 },
-                .errstr = "R0 min value is negative",
+                .errstr = "unbounded min value",
                 .result = REJECT,
         },
         {
@@ -6350,7 +6425,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map1 = { 3 },
-                .errstr = "R8 invalid mem access 'inv'",
+                .errstr = "unbounded min value",
                 .result = REJECT,
         },
         {
@@ -6375,7 +6450,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map1 = { 3 },
-                .errstr = "R8 invalid mem access 'inv'",
+                .errstr = "unbounded min value",
                 .result = REJECT,
         },
         {
@@ -6423,7 +6498,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map1 = { 3 },
-                .errstr = "R0 min value is negative",
+                .errstr = "unbounded min value",
                 .result = REJECT,
         },
         {
@@ -6494,7 +6569,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map1 = { 3 },
-                .errstr = "R0 min value is negative",
+                .errstr = "unbounded min value",
                 .result = REJECT,
         },
         {
@@ -6545,7 +6620,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map1 = { 3 },
-                .errstr = "R0 min value is negative",
+                .errstr = "unbounded min value",
                 .result = REJECT,
         },
         {
@@ -6572,7 +6647,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map1 = { 3 },
-                .errstr = "R0 min value is negative",
+                .errstr = "unbounded min value",
                 .result = REJECT,
         },
         {
@@ -6598,7 +6673,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map1 = { 3 },
-                .errstr = "R0 min value is negative",
+                .errstr = "unbounded min value",
                 .result = REJECT,
         },
         {
@@ -6627,7 +6702,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map1 = { 3 },
-                .errstr = "R0 min value is negative",
+                .errstr = "unbounded min value",
                 .result = REJECT,
         },
         {
@@ -6657,7 +6732,7 @@ static struct bpf_test tests[] = {
                         BPF_JMP_IMM(BPF_JA, 0, 0, -7),
                 },
                 .fixup_map1 = { 4 },
-                .errstr = "R0 min value is negative",
+                .errstr = "R0 invalid mem access 'inv'",
                 .result = REJECT,
         },
         {
@@ -6685,8 +6760,7 @@ static struct bpf_test tests[] = {
                         BPF_EXIT_INSN(),
                 },
                 .fixup_map1 = { 3 },
-                .errstr_unpriv = "R0 pointer comparison prohibited",
-                .errstr = "R0 min value is negative",
+                .errstr = "unbounded min value",
                 .result = REJECT,
                 .result_unpriv = REJECT,
         },
@@ -6742,6 +6816,462 @@ static struct bpf_test tests[] = {
                 .result = REJECT,
         },
         {
+                "bounds check based on zero-extended MOV",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+                        /* r2 = 0x0000'0000'ffff'ffff */
+                        BPF_MOV32_IMM(BPF_REG_2, 0xffffffff),
+                        /* r2 = 0 */
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
+                        /* no-op */
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
+                        /* access at offset 0 */
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+                        /* exit */
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .result = ACCEPT
+        },
+        {
+                "bounds check based on sign-extended MOV. test1",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+                        /* r2 = 0xffff'ffff'ffff'ffff */
+                        BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
+                        /* r2 = 0xffff'ffff */
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
+                        /* r0 = <oob pointer> */
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
+                        /* access to OOB pointer */
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+                        /* exit */
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr = "map_value pointer and 4294967295",
+                .result = REJECT
+        },
+        {
+                "bounds check based on sign-extended MOV. test2",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+                        /* r2 = 0xffff'ffff'ffff'ffff */
+                        BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
+                        /* r2 = 0xfff'ffff */
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 36),
+                        /* r0 = <oob pointer> */
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
+                        /* access to OOB pointer */
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+                        /* exit */
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr = "R0 min value is outside of the array range",
+                .result = REJECT
+        },
+        {
+                "bounds check based on reg_off + var_off + insn_off. test1",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                                    offsetof(struct __sk_buff, mark)),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+                        BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 29) - 1),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 4 },
+                .errstr = "value_size=8 off=1073741825",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        },
+        {
+                "bounds check based on reg_off + var_off + insn_off. test2",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                                    offsetof(struct __sk_buff, mark)),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+                        BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 30) - 1),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 4 },
+                .errstr = "value 1073741823",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        },
+        {
+                "bounds check after truncation of non-boundary-crossing range",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+                        /* r1 = [0x00, 0xff] */
+                        BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+                        BPF_MOV64_IMM(BPF_REG_2, 1),
+                        /* r2 = 0x10'0000'0000 */
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 36),
+                        /* r1 = [0x10'0000'0000, 0x10'0000'00ff] */
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
+                        /* r1 = [0x10'7fff'ffff, 0x10'8000'00fe] */
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
+                        /* r1 = [0x00, 0xff] */
+                        BPF_ALU32_IMM(BPF_SUB, BPF_REG_1, 0x7fffffff),
+                        /* r1 = 0 */
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
+                        /* no-op */
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        /* access at offset 0 */
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+                        /* exit */
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .result = ACCEPT
+        },
+        {
+                "bounds check after truncation of boundary-crossing range (1)",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+                        /* r1 = [0x00, 0xff] */
+                        BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
+                        /* r1 = [0xffff'ff80, 0x1'0000'007f] */
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
+                        /* r1 = [0xffff'ff80, 0xffff'ffff] or
+                         *      [0x0000'0000, 0x0000'007f]
+                         */
+                        BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 0),
+                        BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
+                        /* r1 = [0x00, 0xff] or
+                         *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
+                         */
+                        BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
+                        /* r1 = 0 or
+                         *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
+                         */
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
+                        /* no-op or OOB pointer computation */
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        /* potentially OOB access */
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+                        /* exit */
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                /* not actually fully unbounded, but the bound is very high */
+                .errstr = "R0 unbounded memory access",
+                .result = REJECT
+        },
+        {
+                "bounds check after truncation of boundary-crossing range (2)",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+                        /* r1 = [0x00, 0xff] */
+                        BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
+                        /* r1 = [0xffff'ff80, 0x1'0000'007f] */
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
+                        /* r1 = [0xffff'ff80, 0xffff'ffff] or
+                         *      [0x0000'0000, 0x0000'007f]
+                         * difference to previous test: truncation via MOV32
+                         * instead of ALU32.
+                         */
+                        BPF_MOV32_REG(BPF_REG_1, BPF_REG_1),
+                        BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
+                        /* r1 = [0x00, 0xff] or
+                         *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
+                         */
+                        BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
+                        /* r1 = 0 or
+                         *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
+                         */
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
+                        /* no-op or OOB pointer computation */
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        /* potentially OOB access */
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+                        /* exit */
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                /* not actually fully unbounded, but the bound is very high */
+                .errstr = "R0 unbounded memory access",
+                .result = REJECT
+        },
+        {
+                "bounds check after wrapping 32-bit addition",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+                        /* r1 = 0x7fff'ffff */
+                        BPF_MOV64_IMM(BPF_REG_1, 0x7fffffff),
+                        /* r1 = 0xffff'fffe */
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
+                        /* r1 = 0 */
+                        BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 2),
+                        /* no-op */
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        /* access at offset 0 */
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+                        /* exit */
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .result = ACCEPT
+        },
+        {
+                "bounds check after shift with oversized count operand",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+                        BPF_MOV64_IMM(BPF_REG_2, 32),
+                        BPF_MOV64_IMM(BPF_REG_1, 1),
+                        /* r1 = (u32)1 << (u32)32 = ? */
+                        BPF_ALU32_REG(BPF_LSH, BPF_REG_1, BPF_REG_2),
+                        /* r1 = [0x0000, 0xffff] */
+                        BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xffff),
+                        /* computes unknown pointer, potentially OOB */
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        /* potentially OOB access */
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+                        /* exit */
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr = "R0 max value is outside of the array range",
+                .result = REJECT
+        },
+        {
+                "bounds check after right shift of maybe-negative number",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+                        /* r1 = [0x00, 0xff] */
+                        BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+                        /* r1 = [-0x01, 0xfe] */
+                        BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
+                        /* r1 = 0 or 0xff'ffff'ffff'ffff */
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
+                        /* r1 = 0 or 0xffff'ffff'ffff */
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
+                        /* computes unknown pointer, potentially OOB */
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        /* potentially OOB access */
+                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+                        /* exit */
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr = "R0 unbounded memory access",
+                .result = REJECT
+        },
+        {
+                "bounds check map access with off+size signed 32bit overflow. test1",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7ffffffe),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
+                        BPF_JMP_A(0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr = "map_value pointer and 2147483646",
+                .result = REJECT
+        },
+        {
+                "bounds check map access with off+size signed 32bit overflow. test2",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
+                        BPF_JMP_A(0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr = "pointer offset 1073741822",
+                .result = REJECT
+        },
+        {
+                "bounds check map access with off+size signed 32bit overflow. test3",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
+                        BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
+                        BPF_JMP_A(0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr = "pointer offset -1073741822",
+                .result = REJECT
+        },
+        {
+                "bounds check map access with off+size signed 32bit overflow. test4",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_MOV64_IMM(BPF_REG_1, 1000000),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 1000000),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
+                        BPF_JMP_A(0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr = "map_value pointer and 1000000000000",
+                .result = REJECT
+        },
+        {
+                "pointer/scalar confusion in state equality check (way 1)",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
+                        BPF_JMP_A(1),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
+                        BPF_JMP_A(0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .result = ACCEPT,
+                .result_unpriv = REJECT,
+                .errstr_unpriv = "R0 leaks addr as return value"
+        },
+        {
+                "pointer/scalar confusion in state equality check (way 2)",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
+                        BPF_JMP_A(1),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .result = ACCEPT,
+                .result_unpriv = REJECT,
+                .errstr_unpriv = "R0 leaks addr as return value"
+        },
+        {
                 "variable-offset ctx access",
                 .insns = {
                         /* Get an unknown value */
@@ -6783,6 +7313,71 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_LWT_IN,
         },
         {
+                "indirect variable-offset stack access",
+                .insns = {
+                        /* Fill the top 8 bytes of the stack */
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        /* Get an unknown value */
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
+                        /* Make it small and 4-byte aligned */
+                        BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
+                        BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
+                        /* add it to fp.  We now have either fp-4 or fp-8, but
+                         * we don't know which
+                         */
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
+                        /* dereference it indirectly */
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 5 },
+                .errstr = "variable stack read R2",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_LWT_IN,
+        },
+        {
+                "direct stack access with 32-bit wraparound. test1",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
+                        BPF_MOV32_IMM(BPF_REG_0, 0),
+                        BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+                        BPF_EXIT_INSN()
+                },
+                .errstr = "fp pointer and 2147483647",
+                .result = REJECT
+        },
+        {
+                "direct stack access with 32-bit wraparound. test2",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
+                        BPF_MOV32_IMM(BPF_REG_0, 0),
+                        BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+                        BPF_EXIT_INSN()
+                },
+                .errstr = "fp pointer and 1073741823",
+                .result = REJECT
+        },
+        {
+                "direct stack access with 32-bit wraparound. test3",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
+                        BPF_MOV32_IMM(BPF_REG_0, 0),
+                        BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+                        BPF_EXIT_INSN()
+                },
+                .errstr = "fp pointer offset 1073741822",
+                .result = REJECT
+        },
+        {
                 "liveness pruning and write screening",
                 .insns = {
                         /* Get an unknown value */
@@ -7104,6 +7699,19 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
         },
         {
+                "pkt_end - pkt_start is allowed",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data_end)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data)),
+                        BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        },
+        {
                 "XDP pkt read, pkt_end mangling, bad access 1",
                 .insns = {
                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
@@ -7118,7 +7726,7 @@ static struct bpf_test tests[] = {
                         BPF_MOV64_IMM(BPF_REG_0, 0),
                         BPF_EXIT_INSN(),
                 },
-                .errstr = "R1 offset is outside of the packet",
+                .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
                 .result = REJECT,
                 .prog_type = BPF_PROG_TYPE_XDP,
         },
@@ -7137,7 +7745,7 @@ static struct bpf_test tests[] = {
                         BPF_MOV64_IMM(BPF_REG_0, 0),
                         BPF_EXIT_INSN(),
                 },
-                .errstr = "R1 offset is outside of the packet",
+                .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
                 .result = REJECT,
                 .prog_type = BPF_PROG_TYPE_XDP,
         },
@@ -8026,6 +8634,127 @@ static struct bpf_test tests[] = {
                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
+                "check deducing bounds from const, 1",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
+                        BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "R0 tried to subtract pointer from scalar",
+        },
+        {
+                "check deducing bounds from const, 2",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 1),
+                        BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+        },
+        {
+                "check deducing bounds from const, 3",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
+                        BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "R0 tried to subtract pointer from scalar",
+        },
+        {
+                "check deducing bounds from const, 4",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+        },
+        {
+                "check deducing bounds from const, 5",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
+                        BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "R0 tried to subtract pointer from scalar",
+        },
+        {
+                "check deducing bounds from const, 6",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "R0 tried to subtract pointer from scalar",
+        },
+        {
+                "check deducing bounds from const, 7",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, ~0),
+                        BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
+                        BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                    offsetof(struct __sk_buff, mark)),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "dereference of modified ctx ptr",
+        },
+        {
+                "check deducing bounds from const, 8",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, ~0),
+                        BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                    offsetof(struct __sk_buff, mark)),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "dereference of modified ctx ptr",
+        },
+        {
+                "check deducing bounds from const, 9",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
+                        BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "R0 tried to subtract pointer from scalar",
+        },
+        {
+                "check deducing bounds from const, 10",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
+                        /* Marks reg as unknown. */
+                        BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
+                        BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+                        BPF_EXIT_INSN(),
+                },
+                .result = REJECT,
+                .errstr = "math between ctx pointer and register with unbounded min value is not allowed",
+        },
+        {
                 "bpf_exit with invalid return code. test1",
                 .insns = {
                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
diff --git a/tools/testing/selftests/bpf/test_verifier_log.c b/tools/testing/selftests/bpf/test_verifier_log.c
index 3cc0b561489e..e9626cf5607a 100644
--- a/tools/testing/selftests/bpf/test_verifier_log.c
+++ b/tools/testing/selftests/bpf/test_verifier_log.c
@@ -3,6 +3,8 @@
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
+#include <sys/time.h>
+#include <sys/resource.h>
 
 #include <linux/bpf.h>
 #include <linux/filter.h>
@@ -131,11 +133,16 @@ static void test_log_bad(char *log, size_t log_len, int log_level)
 
 int main(int argc, char **argv)
 {
+        struct rlimit limit  = { RLIM_INFINITY, RLIM_INFINITY };
         char full_log[LOG_SIZE];
         char log[LOG_SIZE];
         size_t want_len;
         int i;
 
+        /* allow unlimited locked memory to have more consistent error code */
+        if (setrlimit(RLIMIT_MEMLOCK, &limit) < 0)
+                perror("Unable to lift memlock rlimit");
+
         memset(log, 1, LOG_SIZE);
 
         /* Test incorrect attr */
diff --git a/tools/testing/selftests/net/config b/tools/testing/selftests/net/config
index e57b4ac40e72..7177bea1fdfa 100644
--- a/tools/testing/selftests/net/config
+++ b/tools/testing/selftests/net/config
@@ -1,3 +1,4 @@
 CONFIG_USER_NS=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_TEST_BPF=m
+CONFIG_NUMA=y
diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index 939a337128db..5d4f10ac2af2 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -7,7 +7,7 @@ include ../lib.mk
 
 TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt ptrace_syscall test_mremap_vdso \
                         check_initial_reg_state sigreturn ldt_gdt iopl mpx-mini-test ioperm \
-                        protection_keys test_vdso
+                        protection_keys test_vdso test_vsyscall
 TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault test_syscall_vdso unwind_vdso \
                         test_FCMOV test_FCOMI test_FISTTP \
                         vdso_restorer
diff --git a/tools/testing/selftests/x86/ldt_gdt.c b/tools/testing/selftests/x86/ldt_gdt.c
index 66e5ce5b91f0..1aef72df20a1 100644
--- a/tools/testing/selftests/x86/ldt_gdt.c
+++ b/tools/testing/selftests/x86/ldt_gdt.c
@@ -122,8 +122,7 @@ static void check_valid_segment(uint16_t index, int ldt,
          * NB: Different Linux versions do different things with the
          * accessed bit in set_thread_area().
          */
-        if (ar != expected_ar &&
-            (ldt || ar != (expected_ar | AR_ACCESSED))) {
+        if (ar != expected_ar && ar != (expected_ar | AR_ACCESSED)) {
                 printf("[FAIL]\t%s entry %hu has AR 0x%08X but expected 0x%08X\n",
                        (ldt ? "LDT" : "GDT"), index, ar, expected_ar);
                 nerrs++;
@@ -627,13 +626,10 @@ static void do_multicpu_tests(void)
 static int finish_exec_test(void)
 {
         /*
-         * In a sensible world, this would be check_invalid_segment(0, 1);
-         * For better or for worse, though, the LDT is inherited across exec.
-         * We can probably change this safely, but for now we test it.
+         * Older kernel versions did inherit the LDT on exec() which is
+         * wrong because exec() starts from a clean state.
          */
-        check_valid_segment(0, 1,
-                            AR_DPL3 | AR_TYPE_XRCODE | AR_S | AR_P | AR_DB,
-                            42, true);
+        check_invalid_segment(0, 1);
 
         return nerrs ? 1 : 0;
 }
diff --git a/tools/testing/selftests/x86/test_vsyscall.c b/tools/testing/selftests/x86/test_vsyscall.c
new file mode 100644
index 000000000000..7a744fa7b786
--- /dev/null
+++ b/tools/testing/selftests/x86/test_vsyscall.c
@@ -0,0 +1,500 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#define _GNU_SOURCE
+
+#include <stdio.h>
+#include <sys/time.h>
+#include <time.h>
+#include <stdlib.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+#include <dlfcn.h>
+#include <string.h>
+#include <inttypes.h>
+#include <signal.h>
+#include <sys/ucontext.h>
+#include <errno.h>
+#include <err.h>
+#include <sched.h>
+#include <stdbool.h>
+#include <setjmp.h>
+
+#ifdef __x86_64__
+# define VSYS(x) (x)
+#else
+# define VSYS(x) 0
+#endif
+
+#ifndef SYS_getcpu
+# ifdef __x86_64__
+#  define SYS_getcpu 309
+# else
+#  define SYS_getcpu 318
+# endif
+#endif
+
+static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
+                       int flags)
+{
+        struct sigaction sa;
+        memset(&sa, 0, sizeof(sa));
+        sa.sa_sigaction = handler;
+        sa.sa_flags = SA_SIGINFO | flags;
+        sigemptyset(&sa.sa_mask);
+        if (sigaction(sig, &sa, 0))
+                err(1, "sigaction");
+}
+
+/* vsyscalls and vDSO */
+bool should_read_vsyscall = false;
+
+typedef long (*gtod_t)(struct timeval *tv, struct timezone *tz);
+gtod_t vgtod = (gtod_t)VSYS(0xffffffffff600000);
+gtod_t vdso_gtod;
+
+typedef int (*vgettime_t)(clockid_t, struct timespec *);
+vgettime_t vdso_gettime;
+
+typedef long (*time_func_t)(time_t *t);
+time_func_t vtime = (time_func_t)VSYS(0xffffffffff600400);
+time_func_t vdso_time;
+
+typedef long (*getcpu_t)(unsigned *, unsigned *, void *);
+getcpu_t vgetcpu = (getcpu_t)VSYS(0xffffffffff600800);
+getcpu_t vdso_getcpu;
+
+static void init_vdso(void)
+{
+        void *vdso = dlopen("linux-vdso.so.1", RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);
+        if (!vdso)
+                vdso = dlopen("linux-gate.so.1", RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);
+        if (!vdso) {
+                printf("[WARN]\tfailed to find vDSO\n");
+                return;
+        }
+
+        vdso_gtod = (gtod_t)dlsym(vdso, "__vdso_gettimeofday");
+        if (!vdso_gtod)
+                printf("[WARN]\tfailed to find gettimeofday in vDSO\n");
+
+        vdso_gettime = (vgettime_t)dlsym(vdso, "__vdso_clock_gettime");
+        if (!vdso_gettime)
+                printf("[WARN]\tfailed to find clock_gettime in vDSO\n");
+
+        vdso_time = (time_func_t)dlsym(vdso, "__vdso_time");
+        if (!vdso_time)
+                printf("[WARN]\tfailed to find time in vDSO\n");
+
+        vdso_getcpu = (getcpu_t)dlsym(vdso, "__vdso_getcpu");
+        if (!vdso_getcpu) {
+                /* getcpu() was never wired up in the 32-bit vDSO. */
+                printf("[%s]\tfailed to find getcpu in vDSO\n",
+                       sizeof(long) == 8 ? "WARN" : "NOTE");
+        }
+}
+
+static int init_vsys(void)
+{
+#ifdef __x86_64__
+        int nerrs = 0;
+        FILE *maps;
+        char line[128];
+        bool found = false;
+
+        maps = fopen("/proc/self/maps", "r");
+        if (!maps) {
+                printf("[WARN]\tCould not open /proc/self/maps -- assuming vsyscall is r-x\n");
+                should_read_vsyscall = true;
+                return 0;
+        }
+
+        while (fgets(line, sizeof(line), maps)) {
+                char r, x;
+                void *start, *end;
+                char name[128];
+                if (sscanf(line, "%p-%p %c-%cp %*x %*x:%*x %*u %s",
+                           &start, &end, &r, &x, name) != 5)
+                        continue;
+
+                if (strcmp(name, "[vsyscall]"))
+                        continue;
+
+                printf("\tvsyscall map: %s", line);
+
+                if (start != (void *)0xffffffffff600000 ||
+                    end != (void *)0xffffffffff601000) {
+                        printf("[FAIL]\taddress range is nonsense\n");
+                        nerrs++;
+                }
+
+                printf("\tvsyscall permissions are %c-%c\n", r, x);
+                should_read_vsyscall = (r == 'r');
+                if (x != 'x') {
+                        vgtod = NULL;
+                        vtime = NULL;
+                        vgetcpu = NULL;
+                }
+
+                found = true;
+                break;
+        }
+
+        fclose(maps);
+
+        if (!found) {
+                printf("\tno vsyscall map in /proc/self/maps\n");
+                should_read_vsyscall = false;
+                vgtod = NULL;
+                vtime = NULL;
+                vgetcpu = NULL;
+        }
+
+        return nerrs;
+#else
+        return 0;
+#endif
+}
+
+/* syscalls */
+static inline long sys_gtod(struct timeval *tv, struct timezone *tz)
+{
+        return syscall(SYS_gettimeofday, tv, tz);
+}
+
+static inline int sys_clock_gettime(clockid_t id, struct timespec *ts)
+{
+        return syscall(SYS_clock_gettime, id, ts);
+}
+
+static inline long sys_time(time_t *t)
+{
+        return syscall(SYS_time, t);
+}
+
+static inline long sys_getcpu(unsigned * cpu, unsigned * node,
+                              void* cache)
+{
+        return syscall(SYS_getcpu, cpu, node, cache);
+}
+
+static jmp_buf jmpbuf;
+
+static void sigsegv(int sig, siginfo_t *info, void *ctx_void)
+{
+        siglongjmp(jmpbuf, 1);
+}
+
+static double tv_diff(const struct timeval *a, const struct timeval *b)
+{
+        return (double)(a->tv_sec - b->tv_sec) +
+                (double)((int)a->tv_usec - (int)b->tv_usec) * 1e-6;
+}
+
+static int check_gtod(const struct timeval *tv_sys1,
+                      const struct timeval *tv_sys2,
+                      const struct timezone *tz_sys,
+                      const char *which,
+                      const struct timeval *tv_other,
+                      const struct timezone *tz_other)
+{
+        int nerrs = 0;
+        double d1, d2;
+
+        if (tz_other && (tz_sys->tz_minuteswest != tz_other->tz_minuteswest || tz_sys->tz_dsttime != tz_other->tz_dsttime)) {
+                printf("[FAIL] %s tz mismatch\n", which);
+                nerrs++;
+        }
+
+        d1 = tv_diff(tv_other, tv_sys1);
+        d2 = tv_diff(tv_sys2, tv_other); 
+        printf("\t%s time offsets: %lf %lf\n", which, d1, d2);
+
+        if (d1 < 0 || d2 < 0) {
+                printf("[FAIL]\t%s time was inconsistent with the syscall\n", which);
+                nerrs++;
+        } else {
+                printf("[OK]\t%s gettimeofday()'s timeval was okay\n", which);
+        }
+
+        return nerrs;
+}
+
+static int test_gtod(void)
+{
+        struct timeval tv_sys1, tv_sys2, tv_vdso, tv_vsys;
+        struct timezone tz_sys, tz_vdso, tz_vsys;
+        long ret_vdso = -1;
+        long ret_vsys = -1;
+        int nerrs = 0;
+
+        printf("[RUN]\ttest gettimeofday()\n");
+
+        if (sys_gtod(&tv_sys1, &tz_sys) != 0)
+                err(1, "syscall gettimeofday");
+        if (vdso_gtod)
+                ret_vdso = vdso_gtod(&tv_vdso, &tz_vdso);
+        if (vgtod)
+                ret_vsys = vgtod(&tv_vsys, &tz_vsys);
+        if (sys_gtod(&tv_sys2, &tz_sys) != 0)
+                err(1, "syscall gettimeofday");
+
+        if (vdso_gtod) {
+                if (ret_vdso == 0) {
+                        nerrs += check_gtod(&tv_sys1, &tv_sys2, &tz_sys, "vDSO", &tv_vdso, &tz_vdso);
+                } else {
+                        printf("[FAIL]\tvDSO gettimeofday() failed: %ld\n", ret_vdso);
+                        nerrs++;
+                }
+        }
+
+        if (vgtod) {
+                if (ret_vsys == 0) {
+                        nerrs += check_gtod(&tv_sys1, &tv_sys2, &tz_sys, "vsyscall", &tv_vsys, &tz_vsys);
+                } else {
+                        printf("[FAIL]\tvsys gettimeofday() failed: %ld\n", ret_vsys);
+                        nerrs++;
+                }
+        }
+
+        return nerrs;
+}
+
+static int test_time(void) {
+        int nerrs = 0;
+
+        printf("[RUN]\ttest time()\n");
+        long t_sys1, t_sys2, t_vdso = 0, t_vsys = 0;
+        long t2_sys1 = -1, t2_sys2 = -1, t2_vdso = -1, t2_vsys = -1;
+        t_sys1 = sys_time(&t2_sys1);
+        if (vdso_time)
+                t_vdso = vdso_time(&t2_vdso);
+        if (vtime)
+                t_vsys = vtime(&t2_vsys);
+        t_sys2 = sys_time(&t2_sys2);
+        if (t_sys1 < 0 || t_sys1 != t2_sys1 || t_sys2 < 0 || t_sys2 != t2_sys2) {
+                printf("[FAIL]\tsyscall failed (ret1:%ld output1:%ld ret2:%ld output2:%ld)\n", t_sys1, t2_sys1, t_sys2, t2_sys2);
+                nerrs++;
+                return nerrs;
+        }
+
+        if (vdso_time) {
+                if (t_vdso < 0 || t_vdso != t2_vdso) {
+                        printf("[FAIL]\tvDSO failed (ret:%ld output:%ld)\n", t_vdso, t2_vdso);
+                        nerrs++;
+                } else if (t_vdso < t_sys1 || t_vdso > t_sys2) {
+                        printf("[FAIL]\tvDSO returned the wrong time (%ld %ld %ld)\n", t_sys1, t_vdso, t_sys2);
+                        nerrs++;
+                } else {
+                        printf("[OK]\tvDSO time() is okay\n");
+                }
+        }
+
+        if (vtime) {
+                if (t_vsys < 0 || t_vsys != t2_vsys) {
+                        printf("[FAIL]\tvsyscall failed (ret:%ld output:%ld)\n", t_vsys, t2_vsys);
+                        nerrs++;
+                } else if (t_vsys < t_sys1 || t_vsys > t_sys2) {
+                        printf("[FAIL]\tvsyscall returned the wrong time (%ld %ld %ld)\n", t_sys1, t_vsys, t_sys2);
+                        nerrs++;
+                } else {
+                        printf("[OK]\tvsyscall time() is okay\n");
+                }
+        }
+
+        return nerrs;
+}
+
+static int test_getcpu(int cpu)
+{
+        int nerrs = 0;
+        long ret_sys, ret_vdso = -1, ret_vsys = -1;
+
+        printf("[RUN]\tgetcpu() on CPU %d\n", cpu);
+
+        cpu_set_t cpuset;
+        CPU_ZERO(&cpuset);
+        CPU_SET(cpu, &cpuset);
+        if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) {
+                printf("[SKIP]\tfailed to force CPU %d\n", cpu);
+                return nerrs;
+        }
+
+        unsigned cpu_sys, cpu_vdso, cpu_vsys, node_sys, node_vdso, node_vsys;
+        unsigned node = 0;
+        bool have_node = false;
+        ret_sys = sys_getcpu(&cpu_sys, &node_sys, 0);
+        if (vdso_getcpu)
+                ret_vdso = vdso_getcpu(&cpu_vdso, &node_vdso, 0);
+        if (vgetcpu)
+                ret_vsys = vgetcpu(&cpu_vsys, &node_vsys, 0);
+
+        if (ret_sys == 0) {
+                if (cpu_sys != cpu) {
+                        printf("[FAIL]\tsyscall reported CPU %hu but should be %d\n", cpu_sys, cpu);
+                        nerrs++;
+                }
+
+                have_node = true;
+                node = node_sys;
+        }
+
+        if (vdso_getcpu) {
+                if (ret_vdso) {
+                        printf("[FAIL]\tvDSO getcpu() failed\n");
+                        nerrs++;
+                } else {
+                        if (!have_node) {
+                                have_node = true;
+                                node = node_vdso;
+                        }
+
+                        if (cpu_vdso != cpu) {
+                                printf("[FAIL]\tvDSO reported CPU %hu but should be %d\n", cpu_vdso, cpu);
+                                nerrs++;
+                        } else {
+                                printf("[OK]\tvDSO reported correct CPU\n");
+                        }
+
+                        if (node_vdso != node) {
+                                printf("[FAIL]\tvDSO reported node %hu but should be %hu\n", node_vdso, node);
+                                nerrs++;
+                        } else {
+                                printf("[OK]\tvDSO reported correct node\n");
+                        }
+                }
+        }
+
+        if (vgetcpu) {
+                if (ret_vsys) {
+                        printf("[FAIL]\tvsyscall getcpu() failed\n");
+                        nerrs++;
+                } else {
+                        if (!have_node) {
+                                have_node = true;
+                                node = node_vsys;
+                        }
+
+                        if (cpu_vsys != cpu) {
+                                printf("[FAIL]\tvsyscall reported CPU %hu but should be %d\n", cpu_vsys, cpu);
+                                nerrs++;
+                        } else {
+                                printf("[OK]\tvsyscall reported correct CPU\n");
+                        }
+
+                        if (node_vsys != node) {
+                                printf("[FAIL]\tvsyscall reported node %hu but should be %hu\n", node_vsys, node);
+                                nerrs++;
+                        } else {
+                                printf("[OK]\tvsyscall reported correct node\n");
+                        }
+                }
+        }
+
+        return nerrs;
+}
+
+static int test_vsys_r(void)
+{
+#ifdef __x86_64__
+        printf("[RUN]\tChecking read access to the vsyscall page\n");
+        bool can_read;
+        if (sigsetjmp(jmpbuf, 1) == 0) {
+                *(volatile int *)0xffffffffff600000;
+                can_read = true;
+        } else {
+                can_read = false;
+        }
+
+        if (can_read && !should_read_vsyscall) {
+                printf("[FAIL]\tWe have read access, but we shouldn't\n");
+                return 1;
+        } else if (!can_read && should_read_vsyscall) {
+                printf("[FAIL]\tWe don't have read access, but we should\n");
+                return 1;
+        } else {
+                printf("[OK]\tgot expected result\n");
+        }
+#endif
+
+        return 0;
+}
+
+
+#ifdef __x86_64__
+#define X86_EFLAGS_TF (1UL << 8)
+static volatile sig_atomic_t num_vsyscall_traps;
+
+static unsigned long get_eflags(void)
+{
+        unsigned long eflags;
+        asm volatile ("pushfq\n\tpopq %0" : "=rm" (eflags));
+        return eflags;
+}
+
+static void set_eflags(unsigned long eflags)
+{
+        asm volatile ("pushq %0\n\tpopfq" : : "rm" (eflags) : "flags");
+}
+
+static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
+{
+        ucontext_t *ctx = (ucontext_t *)ctx_void;
+        unsigned long ip = ctx->uc_mcontext.gregs[REG_RIP];
+
+        if (((ip ^ 0xffffffffff600000UL) & ~0xfffUL) == 0)
+                num_vsyscall_traps++;
+}
+
+static int test_native_vsyscall(void)
+{
+        time_t tmp;
+        bool is_native;
+
+        if (!vtime)
+                return 0;
+
+        printf("[RUN]\tchecking for native vsyscall\n");
+        sethandler(SIGTRAP, sigtrap, 0);
+        set_eflags(get_eflags() | X86_EFLAGS_TF);
+        vtime(&tmp);
+        set_eflags(get_eflags() & ~X86_EFLAGS_TF);
+
+        /*
+         * If vsyscalls are emulated, we expect a single trap in the
+         * vsyscall page -- the call instruction will trap with RIP
+         * pointing to the entry point before emulation takes over.
+         * In native mode, we expect two traps, since whatever code
+         * the vsyscall page contains will be more than just a ret
+         * instruction.
+         */
+        is_native = (num_vsyscall_traps > 1);
+
+        printf("\tvsyscalls are %s (%d instructions in vsyscall page)\n",
+               (is_native ? "native" : "emulated"),
+               (int)num_vsyscall_traps);
+
+        return 0;
+}
+#endif
+
+int main(int argc, char **argv)
+{
+        int nerrs = 0;
+
+        init_vdso();
+        nerrs += init_vsys();
+
+        nerrs += test_gtod();
+        nerrs += test_time();
+        nerrs += test_getcpu(0);
+        nerrs += test_getcpu(1);
+
+        sethandler(SIGSEGV, sigsegv, 0);
+        nerrs += test_vsys_r();
+
+#ifdef __x86_64__
+        nerrs += test_native_vsyscall();
+#endif
+
+        return nerrs ? 1 : 0;
+}
diff --git a/tools/usb/usbip/libsrc/vhci_driver.c b/tools/usb/usbip/libsrc/vhci_driver.c
index 5727dfb15a83..c9c81614a66a 100644
--- a/tools/usb/usbip/libsrc/vhci_driver.c
+++ b/tools/usb/usbip/libsrc/vhci_driver.c
@@ -50,14 +50,14 @@ static int parse_status(const char *value)
 
         while (*c != '\0') {
                 int port, status, speed, devid;
-                unsigned long socket;
+                int sockfd;
                 char lbusid[SYSFS_BUS_ID_SIZE];
                 struct usbip_imported_device *idev;
                 char hub[3];
 
-                ret = sscanf(c, "%2s  %d %d %d %x %lx %31s\n",
+                ret = sscanf(c, "%2s  %d %d %d %x %u %31s\n",
                                 hub, &port, &status, &speed,
-                                &devid, &socket, lbusid);
+                                &devid, &sockfd, lbusid);
 
                 if (ret < 5) {
                         dbg("sscanf failed: %d", ret);
@@ -66,7 +66,7 @@ static int parse_status(const char *value)
 
                 dbg("hub %s port %d status %d speed %d devid %x",
                                 hub, port, status, speed, devid);
-                dbg("socket %lx lbusid %s", socket, lbusid);
+                dbg("sockfd %u lbusid %s", sockfd, lbusid);
 
                 /* if a device is connected, look at it */
                 idev = &vhci_driver->idev[port];
@@ -106,7 +106,7 @@ static int parse_status(const char *value)
         return 0;
 }
 
-#define MAX_STATUS_NAME 16
+#define MAX_STATUS_NAME 18
 
 static int refresh_imported_device_list(void)
 {
@@ -329,9 +329,17 @@ err:
 int usbip_vhci_get_free_port(uint32_t speed)
 {
         for (int i = 0; i < vhci_driver->nports; i++) {
-                if (speed == USB_SPEED_SUPER &&
-                    vhci_driver->idev[i].hub != HUB_SPEED_SUPER)
-                        continue;
+
+                switch (speed) {
+                case    USB_SPEED_SUPER:
+                        if (vhci_driver->idev[i].hub != HUB_SPEED_SUPER)
+                                continue;
+                break;
+                default:
+                        if (vhci_driver->idev[i].hub != HUB_SPEED_HIGH)
+                                continue;
+                break;
+                }
 
                 if (vhci_driver->idev[i].status == VDEV_ST_NULL)
                         return vhci_driver->idev[i].port;
diff --git a/tools/usb/usbip/src/utils.c b/tools/usb/usbip/src/utils.c
index 2b3d6d235015..3d7b42e77299 100644
--- a/tools/usb/usbip/src/utils.c
+++ b/tools/usb/usbip/src/utils.c
@@ -30,6 +30,7 @@ int modify_match_busid(char *busid, int add)
         char command[SYSFS_BUS_ID_SIZE + 4];
         char match_busid_attr_path[SYSFS_PATH_MAX];
         int rc;
+        int cmd_size;
 
         snprintf(match_busid_attr_path, sizeof(match_busid_attr_path),
                  "%s/%s/%s/%s/%s/%s", SYSFS_MNT_PATH, SYSFS_BUS_NAME,
@@ -37,12 +38,14 @@ int modify_match_busid(char *busid, int add)
                  attr_name);
 
         if (add)
-                snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s", busid);
+                cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s",
+                                    busid);
         else
-                snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s", busid);
+                cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s",
+                                    busid);
 
         rc = write_sysfs_attribute(match_busid_attr_path, command,
-                                   sizeof(command));
+                                   cmd_size);
         if (rc < 0) {
                 dbg("failed to write match_busid: %s", strerror(errno));
                 return -1;
diff --git a/tools/virtio/ringtest/ptr_ring.c b/tools/virtio/ringtest/ptr_ring.c
index 38bb171aceba..e6e81305ef46 100644
--- a/tools/virtio/ringtest/ptr_ring.c
+++ b/tools/virtio/ringtest/ptr_ring.c
@@ -16,24 +16,41 @@
 #define unlikely(x)    (__builtin_expect(!!(x), 0))
 #define likely(x)    (__builtin_expect(!!(x), 1))
 #define ALIGN(x, a) (((x) + (a) - 1) / (a) * (a))
+#define SIZE_MAX        (~(size_t)0)
+
 typedef pthread_spinlock_t  spinlock_t;
 
 typedef int gfp_t;
-static void *kmalloc(unsigned size, gfp_t gfp)
-{
-        return memalign(64, size);
-}
+#define __GFP_ZERO 0x1
 
-static void *kzalloc(unsigned size, gfp_t gfp)
+static void *kmalloc(unsigned size, gfp_t gfp)
 {
         void *p = memalign(64, size);
         if (!p)
                 return p;
-        memset(p, 0, size);
 
+        if (gfp & __GFP_ZERO)
+                memset(p, 0, size);
         return p;
 }
 
+static inline void *kzalloc(unsigned size, gfp_t flags)
+{
+        return kmalloc(size, flags | __GFP_ZERO);
+}
+
+static inline void *kmalloc_array(size_t n, size_t size, gfp_t flags)
+{
+        if (size != 0 && n > SIZE_MAX / size)
+                return NULL;
+        return kmalloc(n * size, flags);
+}
+
+static inline void *kcalloc(size_t n, size_t size, gfp_t flags)
+{
+        return kmalloc_array(n, size, flags | __GFP_ZERO);
+}
+
 static void kfree(void *p)
 {
         if (p)
diff --git a/tools/vm/slabinfo-gnuplot.sh b/tools/vm/slabinfo-gnuplot.sh
index 35b039864b77..0cf28aa6f21c 100644
--- a/tools/vm/slabinfo-gnuplot.sh
+++ b/tools/vm/slabinfo-gnuplot.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 
 # Sergey Senozhatsky, 2015
 # sergey.senozhatsky.work@gmail.com
diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
index 4151250ce8da..cc29a8148328 100644
--- a/virt/kvm/arm/arch_timer.c
+++ b/virt/kvm/arm/arch_timer.c
@@ -92,16 +92,23 @@ static irqreturn_t kvm_arch_timer_handler(int irq, void *dev_id)
 {
         struct kvm_vcpu *vcpu = *(struct kvm_vcpu **)dev_id;
         struct arch_timer_context *vtimer;
+        u32 cnt_ctl;
 
-        if (!vcpu) {
-                pr_warn_once("Spurious arch timer IRQ on non-VCPU thread\n");
-                return IRQ_NONE;
-        }
-        vtimer = vcpu_vtimer(vcpu);
+        /*
+         * We may see a timer interrupt after vcpu_put() has been called which
+         * sets the CPU's vcpu pointer to NULL, because even though the timer
+         * has been disabled in vtimer_save_state(), the hardware interrupt
+         * signal may not have been retired from the interrupt controller yet.
+         */
+        if (!vcpu)
+                return IRQ_HANDLED;
 
+        vtimer = vcpu_vtimer(vcpu);
         if (!vtimer->irq.level) {
-                vtimer->cnt_ctl = read_sysreg_el0(cntv_ctl);
-                if (kvm_timer_irq_can_fire(vtimer))
+                cnt_ctl = read_sysreg_el0(cntv_ctl);
+                cnt_ctl &= ARCH_TIMER_CTRL_ENABLE | ARCH_TIMER_CTRL_IT_STAT |
+                           ARCH_TIMER_CTRL_IT_MASK;
+                if (cnt_ctl == (ARCH_TIMER_CTRL_ENABLE | ARCH_TIMER_CTRL_IT_STAT))
                         kvm_timer_update_irq(vcpu, true, vtimer);
         }
 
@@ -355,6 +362,7 @@ static void vtimer_save_state(struct kvm_vcpu *vcpu)
 
         /* Disable the virtual timer */
         write_sysreg_el0(0, cntv_ctl);
+        isb();
 
         vtimer->loaded = false;
 out:
@@ -479,9 +487,6 @@ void kvm_timer_vcpu_load(struct kvm_vcpu *vcpu)
 
         vtimer_restore_state(vcpu);
 
-        if (has_vhe())
-                disable_el1_phys_timer_access();
-
         /* Set the background timer for the physical timer emulation. */
         phys_timer_emulate(vcpu);
 }
@@ -510,9 +515,6 @@ void kvm_timer_vcpu_put(struct kvm_vcpu *vcpu)
         if (unlikely(!timer->enabled))
                 return;
 
-        if (has_vhe())
-                enable_el1_phys_timer_access();
-
         vtimer_save_state(vcpu);
 
         /*
@@ -726,7 +728,7 @@ static int kvm_timer_dying_cpu(unsigned int cpu)
         return 0;
 }
 
-int kvm_timer_hyp_init(void)
+int kvm_timer_hyp_init(bool has_gic)
 {
         struct arch_timer_kvm_info *info;
         int err;
@@ -762,10 +764,13 @@ int kvm_timer_hyp_init(void)
                 return err;
         }
 
-        err = irq_set_vcpu_affinity(host_vtimer_irq, kvm_get_running_vcpus());
-        if (err) {
-                kvm_err("kvm_arch_timer: error setting vcpu affinity\n");
-                goto out_free_irq;
+        if (has_gic) {
+                err = irq_set_vcpu_affinity(host_vtimer_irq,
+                                            kvm_get_running_vcpus());
+                if (err) {
+                        kvm_err("kvm_arch_timer: error setting vcpu affinity\n");
+                        goto out_free_irq;
+                }
         }
 
         kvm_info("virtual timer IRQ%d\n", host_vtimer_irq);
@@ -841,7 +846,7 @@ int kvm_timer_enable(struct kvm_vcpu *vcpu)
 no_vgic:
         preempt_disable();
         timer->enabled = 1;
-        kvm_timer_vcpu_load_vgic(vcpu);
+        kvm_timer_vcpu_load(vcpu);
         preempt_enable();
 
         return 0;
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index a67c106d73f5..2e43f9d42bd5 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -188,6 +188,7 @@ void kvm_arch_destroy_vm(struct kvm *kvm)
                         kvm->vcpus[i] = NULL;
                 }
         }
+        atomic_set(&kvm->online_vcpus, 0);
 }
 
 int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
@@ -296,7 +297,6 @@ void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu)
 {
         kvm_mmu_free_memory_caches(vcpu);
         kvm_timer_vcpu_terminate(vcpu);
-        kvm_vgic_vcpu_destroy(vcpu);
         kvm_pmu_vcpu_destroy(vcpu);
         kvm_vcpu_uninit(vcpu);
         kmem_cache_free(kvm_vcpu_cache, vcpu);
@@ -627,6 +627,9 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
                 ret = kvm_handle_mmio_return(vcpu, vcpu->run);
                 if (ret)
                         return ret;
+                if (kvm_arm_handle_step_debug(vcpu, vcpu->run))
+                        return 0;
+
         }
 
         if (run->immediate_exit)
@@ -1323,7 +1326,7 @@ static int init_subsystems(void)
         /*
          * Init HYP architected timer support
          */
-        err = kvm_timer_hyp_init();
+        err = kvm_timer_hyp_init(vgic_present);
         if (err)
                 goto out;
 
@@ -1502,7 +1505,7 @@ int kvm_arch_init(void *opaque)
         bool in_hyp_mode;
 
         if (!is_hyp_mode_available()) {
-                kvm_err("HYP mode not available\n");
+                kvm_info("HYP mode not available\n");
                 return -ENODEV;
         }
 
diff --git a/virt/kvm/arm/hyp/timer-sr.c b/virt/kvm/arm/hyp/timer-sr.c
index f39861639f08..f24404b3c8df 100644
--- a/virt/kvm/arm/hyp/timer-sr.c
+++ b/virt/kvm/arm/hyp/timer-sr.c
@@ -27,42 +27,34 @@ void __hyp_text __kvm_timer_set_cntvoff(u32 cntvoff_low, u32 cntvoff_high)
         write_sysreg(cntvoff, cntvoff_el2);
 }
 
-void __hyp_text enable_el1_phys_timer_access(void)
-{
-        u64 val;
-
-        /* Allow physical timer/counter access for the host */
-        val = read_sysreg(cnthctl_el2);
-        val |= CNTHCTL_EL1PCTEN | CNTHCTL_EL1PCEN;
-        write_sysreg(val, cnthctl_el2);
-}
-
-void __hyp_text disable_el1_phys_timer_access(void)
-{
-        u64 val;
-
-        /*
-         * Disallow physical timer access for the guest
-         * Physical counter access is allowed
-         */
-        val = read_sysreg(cnthctl_el2);
-        val &= ~CNTHCTL_EL1PCEN;
-        val |= CNTHCTL_EL1PCTEN;
-        write_sysreg(val, cnthctl_el2);
-}
-
 void __hyp_text __timer_disable_traps(struct kvm_vcpu *vcpu)
 {
         /*
          * We don't need to do this for VHE since the host kernel runs in EL2
          * with HCR_EL2.TGE ==1, which makes those bits have no impact.
          */
-        if (!has_vhe())
-                enable_el1_phys_timer_access();
+        if (!has_vhe()) {
+                u64 val;
+
+                /* Allow physical timer/counter access for the host */
+                val = read_sysreg(cnthctl_el2);
+                val |= CNTHCTL_EL1PCTEN | CNTHCTL_EL1PCEN;
+                write_sysreg(val, cnthctl_el2);
+        }
 }
 
 void __hyp_text __timer_enable_traps(struct kvm_vcpu *vcpu)
 {
-        if (!has_vhe())
-                disable_el1_phys_timer_access();
+        if (!has_vhe()) {
+                u64 val;
+
+                /*
+                 * Disallow physical timer access for the guest
+                 * Physical counter access is allowed
+                 */
+                val = read_sysreg(cnthctl_el2);
+                val &= ~CNTHCTL_EL1PCEN;
+                val |= CNTHCTL_EL1PCTEN;
+                write_sysreg(val, cnthctl_el2);
+        }
 }
diff --git a/virt/kvm/arm/hyp/vgic-v2-sr.c b/virt/kvm/arm/hyp/vgic-v2-sr.c
index a3f18d362366..d7fd46fe9efb 100644
--- a/virt/kvm/arm/hyp/vgic-v2-sr.c
+++ b/virt/kvm/arm/hyp/vgic-v2-sr.c
@@ -34,11 +34,7 @@ static void __hyp_text save_elrsr(struct kvm_vcpu *vcpu, void __iomem *base)
         else
                 elrsr1 = 0;
 
-#ifdef CONFIG_CPU_BIG_ENDIAN
-        cpu_if->vgic_elrsr = ((u64)elrsr0 << 32) | elrsr1;
-#else
         cpu_if->vgic_elrsr = ((u64)elrsr1 << 32) | elrsr0;
-#endif
 }
 
 static void __hyp_text save_lrs(struct kvm_vcpu *vcpu, void __iomem *base)
diff --git a/virt/kvm/arm/mmio.c b/virt/kvm/arm/mmio.c
index b6e715fd3c90..dac7ceb1a677 100644
--- a/virt/kvm/arm/mmio.c
+++ b/virt/kvm/arm/mmio.c
@@ -112,7 +112,7 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run)
                 }
 
                 trace_kvm_mmio(KVM_TRACE_MMIO_READ, len, run->mmio.phys_addr,
-                               data);
+                               &data);
                 data = vcpu_data_host_to_guest(vcpu, data, len);
                 vcpu_set_reg(vcpu, vcpu->arch.mmio_decode.rt, data);
         }
@@ -182,14 +182,14 @@ int io_mem_abort(struct kvm_vcpu *vcpu, struct kvm_run *run,
                 data = vcpu_data_guest_to_host(vcpu, vcpu_get_reg(vcpu, rt),
                                                len);
 
-                trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, len, fault_ipa, data);
+                trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, len, fault_ipa, &data);
                 kvm_mmio_write_buf(data_buf, len, data);
 
                 ret = kvm_io_bus_write(vcpu, KVM_MMIO_BUS, fault_ipa, len,
                                        data_buf);
         } else {
                 trace_kvm_mmio(KVM_TRACE_MMIO_READ_UNSATISFIED, len,
-                               fault_ipa, 0);
+                               fault_ipa, NULL);
 
                 ret = kvm_io_bus_read(vcpu, KVM_MMIO_BUS, fault_ipa, len,
                                       data_buf);
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index b36945d49986..9dea96380339 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -509,8 +509,6 @@ static void unmap_hyp_range(pgd_t *pgdp, phys_addr_t start, u64 size)
  */
 void free_hyp_pgds(void)
 {
-        unsigned long addr;
-
         mutex_lock(&kvm_hyp_pgd_mutex);
 
         if (boot_hyp_pgd) {
@@ -521,10 +519,10 @@ void free_hyp_pgds(void)
 
         if (hyp_pgd) {
                 unmap_hyp_range(hyp_pgd, hyp_idmap_start, PAGE_SIZE);
-                for (addr = PAGE_OFFSET; virt_addr_valid(addr); addr += PGDIR_SIZE)
-                        unmap_hyp_range(hyp_pgd, kern_hyp_va(addr), PGDIR_SIZE);
-                for (addr = VMALLOC_START; is_vmalloc_addr((void*)addr); addr += PGDIR_SIZE)
-                        unmap_hyp_range(hyp_pgd, kern_hyp_va(addr), PGDIR_SIZE);
+                unmap_hyp_range(hyp_pgd, kern_hyp_va(PAGE_OFFSET),
+                                (uintptr_t)high_memory - PAGE_OFFSET);
+                unmap_hyp_range(hyp_pgd, kern_hyp_va(VMALLOC_START),
+                                VMALLOC_END - VMALLOC_START);
 
                 free_pages((unsigned long)hyp_pgd, hyp_pgd_order);
                 hyp_pgd = NULL;
@@ -1312,7 +1310,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
                 return -EFAULT;
         }
 
-        if (is_vm_hugetlb_page(vma) && !logging_active) {
+        if (vma_kernel_pagesize(vma) == PMD_SIZE && !logging_active) {
                 hugetlb = true;
                 gfn = (fault_ipa & PMD_MASK) >> PAGE_SHIFT;
         } else {
diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
index 62310122ee78..743ca5cb05ef 100644
--- a/virt/kvm/arm/vgic/vgic-init.c
+++ b/virt/kvm/arm/vgic/vgic-init.c
@@ -285,9 +285,11 @@ int vgic_init(struct kvm *kvm)
         if (ret)
                 goto out;
 
-        ret = vgic_v4_init(kvm);
-        if (ret)
-                goto out;
+        if (vgic_has_its(kvm)) {
+                ret = vgic_v4_init(kvm);
+                if (ret)
+                        goto out;
+        }
 
         kvm_for_each_vcpu(i, vcpu, kvm)
                 kvm_vgic_vcpu_enable(vcpu);
diff --git a/virt/kvm/arm/vgic/vgic-irqfd.c b/virt/kvm/arm/vgic/vgic-irqfd.c
index b7baf581611a..99e026d2dade 100644
--- a/virt/kvm/arm/vgic/vgic-irqfd.c
+++ b/virt/kvm/arm/vgic/vgic-irqfd.c
@@ -112,8 +112,7 @@ int kvm_vgic_setup_default_irq_routing(struct kvm *kvm)
         u32 nr = dist->nr_spis;
         int i, ret;
 
-        entries = kcalloc(nr, sizeof(struct kvm_kernel_irq_routing_entry),
-                          GFP_KERNEL);
+        entries = kcalloc(nr, sizeof(*entries), GFP_KERNEL);
         if (!entries)
                 return -ENOMEM;
 
diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
index 1f761a9991e7..8e633bd9cc1e 100644
--- a/virt/kvm/arm/vgic/vgic-its.c
+++ b/virt/kvm/arm/vgic/vgic-its.c
@@ -421,6 +421,7 @@ static int its_sync_lpi_pending_table(struct kvm_vcpu *vcpu)
         u32 *intids;
         int nr_irqs, i;
         unsigned long flags;
+        u8 pendmask;
 
         nr_irqs = vgic_copy_lpi_list(vcpu, &intids);
         if (nr_irqs < 0)
@@ -428,7 +429,6 @@ static int its_sync_lpi_pending_table(struct kvm_vcpu *vcpu)
 
         for (i = 0; i < nr_irqs; i++) {
                 int byte_offset, bit_nr;
-                u8 pendmask;
 
                 byte_offset = intids[i] / BITS_PER_BYTE;
                 bit_nr = intids[i] % BITS_PER_BYTE;
@@ -821,6 +821,8 @@ static int vgic_its_alloc_collection(struct vgic_its *its,
                 return E_ITS_MAPC_COLLECTION_OOR;
 
         collection = kzalloc(sizeof(*collection), GFP_KERNEL);
+        if (!collection)
+                return -ENOMEM;
 
         collection->collection_id = coll_id;
         collection->target_addr = COLLECTION_NOT_MAPPED;
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 2f05f732d3fd..f47e8481fa45 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -327,13 +327,13 @@ int vgic_v3_save_pending_tables(struct kvm *kvm)
         int last_byte_offset = -1;
         struct vgic_irq *irq;
         int ret;
+        u8 val;
 
         list_for_each_entry(irq, &dist->lpi_list_head, lpi_list) {
                 int byte_offset, bit_nr;
                 struct kvm_vcpu *vcpu;
                 gpa_t pendbase, ptr;
                 bool stored;
-                u8 val;
 
                 vcpu = irq->target_vcpu;
                 if (!vcpu)
diff --git a/virt/kvm/arm/vgic/vgic-v4.c b/virt/kvm/arm/vgic/vgic-v4.c
index 53c324aa44ef..bc4265154bac 100644
--- a/virt/kvm/arm/vgic/vgic-v4.c
+++ b/virt/kvm/arm/vgic/vgic-v4.c
@@ -118,7 +118,7 @@ int vgic_v4_init(struct kvm *kvm)
         struct kvm_vcpu *vcpu;
         int i, nr_vcpus, ret;
 
-        if (!vgic_supports_direct_msis(kvm))
+        if (!kvm_vgic_global_state.has_gicv4)
                 return 0; /* Nothing to see here... move along. */
 
         if (dist->its_vm.vpes)
@@ -337,8 +337,10 @@ int kvm_vgic_v4_unset_forwarding(struct kvm *kvm, int virq,
                 goto out;
 
         WARN_ON(!(irq->hw && irq->host_irq == virq));
-        irq->hw = false;
-        ret = its_unmap_vlpi(virq);
+        if (irq->hw) {
+                irq->hw = false;
+                ret = its_unmap_vlpi(virq);
+        }
 
 out:
         mutex_unlock(&its->its_lock);
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index b168a328a9e0..ecb8e25f5fe5 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -492,6 +492,7 @@ int kvm_vgic_unmap_phys_irq(struct kvm_vcpu *vcpu, unsigned int vintid)
 int kvm_vgic_set_owner(struct kvm_vcpu *vcpu, unsigned int intid, void *owner)
 {
         struct vgic_irq *irq;
+        unsigned long flags;
         int ret = 0;
 
         if (!vgic_initialized(vcpu->kvm))
@@ -502,12 +503,12 @@ int kvm_vgic_set_owner(struct kvm_vcpu *vcpu, unsigned int intid, void *owner)
                 return -EINVAL;
 
         irq = vgic_get_irq(vcpu->kvm, vcpu, intid);
-        spin_lock(&irq->irq_lock);
+        spin_lock_irqsave(&irq->irq_lock, flags);
         if (irq->owner && irq->owner != owner)
                 ret = -EEXIST;
         else
                 irq->owner = owner;
-        spin_unlock(&irq->irq_lock);
+        spin_unlock_irqrestore(&irq->irq_lock, flags);
 
         return ret;
 }
@@ -823,13 +824,14 @@ void vgic_kick_vcpus(struct kvm *kvm)
 
 bool kvm_vgic_map_is_active(struct kvm_vcpu *vcpu, unsigned int vintid)
 {
-        struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, vintid);
+        struct vgic_irq *irq;
         bool map_is_active;
         unsigned long flags;
 
         if (!vgic_initialized(vcpu->kvm))
                 return false;
 
+        irq = vgic_get_irq(vcpu->kvm, vcpu, vintid);
         spin_lock_irqsave(&irq->irq_lock, flags);
         map_is_active = irq->hw && irq->active;
         spin_unlock_irqrestore(&irq->irq_lock, flags);
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index c422c10cd1dd..210bf820385a 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -135,6 +135,11 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm);
 static unsigned long long kvm_createvm_count;
 static unsigned long long kvm_active_vms;
 
+__weak void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
+                unsigned long start, unsigned long end)
+{
+}
+
 bool kvm_is_reserved_pfn(kvm_pfn_t pfn)
 {
         if (pfn_valid(pfn))
@@ -360,6 +365,9 @@ static void kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn,
                 kvm_flush_remote_tlbs(kvm);
 
         spin_unlock(&kvm->mmu_lock);
+
+        kvm_arch_mmu_notifier_invalidate_range(kvm, start, end);
+
         srcu_read_unlock(&kvm->srcu, idx);
 }