43 files changed, 1055 insertions, 396 deletions
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index 7e2baf7304ae..29786c87e864 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -115,6 +115,8 @@ obj-$(CONFIG_PARAVIRT_SPINLOCKS)+= paravirt-spinlocks.o
 obj-$(CONFIG_PARAVIRT_CLOCK)    += pvclock.o
 obj-$(CONFIG_X86_PMEM_LEGACY_DEVICE) += pmem.o
+obj-$(CONFIG_JAILHOUSE_GUEST)   += jailhouse.o
 obj-$(CONFIG_EISA)              += eisa.o
 obj-$(CONFIG_PCSPKR_PLATFORM)   += pcspeaker.o
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index 4817d743c263..a481763a3776 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -46,17 +46,6 @@ static int __init setup_noreplace_smp(char *str)
 }
 __setup("noreplace-smp", setup_noreplace_smp);
-#ifdef CONFIG_PARAVIRT
-static int __initdata_or_module noreplace_paravirt = 0;
-static int __init setup_noreplace_paravirt(char *str)
-{
-        noreplace_paravirt = 1;
-        return 1;
-}
-__setup("noreplace-paravirt", setup_noreplace_paravirt);
-#endif
 #define DPRINTK(fmt, args...)                                           \
 do {                                                                    \
        if (debug_alternative)                                          \
@@ -298,7 +287,7 @@ recompute_jump(struct alt_instr *a, u8 *orig_insn, u8 *repl_insn, u8 *insnbuf)
        tgt_rip  = next_rip + o_dspl;
        n_dspl = tgt_rip - orig_insn;
-        DPRINTK("target RIP: %p, new_displ: 0x%x", tgt_rip, n_dspl);
+        DPRINTK("target RIP: %px, new_displ: 0x%x", tgt_rip, n_dspl);
        if (tgt_rip - orig_insn >= 0) {
                if (n_dspl - 2 <= 127)
@@ -355,7 +344,7 @@ static void __init_or_module noinline optimize_nops(struct alt_instr *a, u8 *ins
        add_nops(instr + (a->instrlen - a->padlen), a->padlen);
        local_irq_restore(flags);
-        DUMP_BYTES(instr, a->instrlen, "%p: [%d:%d) optimized NOPs: ",
+        DUMP_BYTES(instr, a->instrlen, "%px: [%d:%d) optimized NOPs: ",
                   instr, a->instrlen - a->padlen, a->padlen);
 }
@@ -376,7 +365,7 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start,
        u8 *instr, *replacement;
        u8 insnbuf[MAX_PATCH_LEN];
-        DPRINTK("alt table %p -> %p", start, end);
+        DPRINTK("alt table %px, -> %px", start, end);
        /*
         * The scan order should be from start to end. A later scanned
         * alternative code can overwrite previously scanned alternative code.
@@ -400,14 +389,14 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start,
                        continue;
                }
-                DPRINTK("feat: %d*32+%d, old: (%p, len: %d), repl: (%p, len: %d), pad: %d",
+                DPRINTK("feat: %d*32+%d, old: (%px len: %d), repl: (%px, len: %d), pad: %d",
                        a->cpuid >> 5,
                        a->cpuid & 0x1f,
                        instr, a->instrlen,
                        replacement, a->replacementlen, a->padlen);
-                DUMP_BYTES(instr, a->instrlen, "%p: old_insn: ", instr);
+                DUMP_BYTES(instr, a->instrlen, "%px: old_insn: ", instr);
-                DUMP_BYTES(replacement, a->replacementlen, "%p: rpl_insn: ", replacement);
+                DUMP_BYTES(replacement, a->replacementlen, "%px: rpl_insn: ", replacement);
                memcpy(insnbuf, replacement, a->replacementlen);
                insnbuf_sz = a->replacementlen;
@@ -433,7 +422,7 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start,
                                 a->instrlen - a->replacementlen);
                        insnbuf_sz += a->instrlen - a->replacementlen;
                }
-                DUMP_BYTES(insnbuf, insnbuf_sz, "%p: final_insn: ", instr);
+                DUMP_BYTES(insnbuf, insnbuf_sz, "%px: final_insn: ", instr);
                text_poke_early(instr, insnbuf, insnbuf_sz);
        }
@@ -599,9 +588,6 @@ void __init_or_module apply_paravirt(struct paravirt_patch_site *start,
        struct paravirt_patch_site *p;
        char insnbuf[MAX_PATCH_LEN];
-        if (noreplace_paravirt)
-                return;
        for (p = start; p < end; p++) {
                unsigned int used;
diff --git a/arch/x86/kernel/amd_gart_64.c b/arch/x86/kernel/amd_gart_64.c
index cc0e8bc0ea3f..ecd486cb06ab 100644
--- a/arch/x86/kernel/amd_gart_64.c
+++ b/arch/x86/kernel/amd_gart_64.c
@@ -31,6 +31,7 @@
 #include <linux/io.h>
 #include <linux/gfp.h>
 #include <linux/atomic.h>
+#include <linux/dma-direct.h>
 #include <asm/mtrr.h>
 #include <asm/pgtable.h>
 #include <asm/proto.h>
diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
index f5d92bc3b884..2c4d5ece7456 100644
--- a/arch/x86/kernel/aperture_64.c
+++ b/arch/x86/kernel/aperture_64.c
@@ -30,6 +30,7 @@
 #include <asm/dma.h>
 #include <asm/amd_nb.h>
 #include <asm/x86_init.h>
+#include <linux/crash_dump.h>
 /*
 * Using 512M as goal, in case kexec will load kernel_big
@@ -56,6 +57,33 @@ int fallback_aper_force __initdata;
 int fix_aperture __initdata = 1;
+#ifdef CONFIG_PROC_VMCORE
+/*
+ * If the first kernel maps the aperture over e820 RAM, the kdump kernel will
+ * use the same range because it will remain configured in the northbridge.
+ * Trying to dump this area via /proc/vmcore may crash the machine, so exclude
+ * it from vmcore.
+ */
+static unsigned long aperture_pfn_start, aperture_page_count;
+static int gart_oldmem_pfn_is_ram(unsigned long pfn)
+{
+        return likely((pfn < aperture_pfn_start) ||
+                      (pfn >= aperture_pfn_start + aperture_page_count));
+}
+static void exclude_from_vmcore(u64 aper_base, u32 aper_order)
+{
+        aperture_pfn_start = aper_base >> PAGE_SHIFT;
+        aperture_page_count = (32 * 1024 * 1024) << aper_order >> PAGE_SHIFT;
+        WARN_ON(register_oldmem_pfn_is_ram(&gart_oldmem_pfn_is_ram));
+}
+#else
+static void exclude_from_vmcore(u64 aper_base, u32 aper_order)
+{
+}
+#endif
 /* This code runs before the PCI subsystem is initialized, so just
   access the northbridge directly. */
@@ -435,8 +463,16 @@ int __init gart_iommu_hole_init(void)
 out:
        if (!fix && !fallback_aper_force) {
-                if (last_aper_base)
+                if (last_aper_base) {
+                        /*
+                         * If this is the kdump kernel, the first kernel
+                         * may have allocated the range over its e820 RAM
+                         * and fixed up the northbridge
+                         */
+                        exclude_from_vmcore(last_aper_base, last_aper_order);
                        return 1;
+                }
                return 0;
        }
@@ -473,6 +509,14 @@ out:
                return 0;
        }
+        /*
+         * If this is the kdump kernel _and_ the first kernel did not
+         * configure the aperture in the northbridge, this range may
+         * overlap with the first kernel's memory. We can't access the
+         * range through vmcore even though it should be part of the dump.
+         */
+        exclude_from_vmcore(aper_alloc, aper_order);
        /* Fix up the north bridges */
        for (i = 0; i < amd_nb_bus_dev_ranges[i].dev_limit; i++) {
                int bus, dev_base, dev_limit;
diff --git a/arch/x86/kernel/apic/apic_flat_64.c b/arch/x86/kernel/apic/apic_flat_64.c
index 25a87028cb3f..e84c9eb4e5b4 100644
--- a/arch/x86/kernel/apic/apic_flat_64.c
+++ b/arch/x86/kernel/apic/apic_flat_64.c
@@ -19,6 +19,7 @@
 #include <asm/smp.h>
 #include <asm/apic.h>
 #include <asm/ipi.h>
+#include <asm/jailhouse_para.h>
 #include <linux/acpi.h>
@@ -84,12 +85,8 @@ flat_send_IPI_mask_allbutself(const struct cpumask *cpumask, int vector)
 static void flat_send_IPI_allbutself(int vector)
 {
        int cpu = smp_processor_id();
-#ifdef  CONFIG_HOTPLUG_CPU
-        int hotplug = 1;
+        if (IS_ENABLED(CONFIG_HOTPLUG_CPU) || vector == NMI_VECTOR) {
-#else
-        int hotplug = 0;
-#endif
-        if (hotplug || vector == NMI_VECTOR) {
                if (!cpumask_equal(cpu_online_mask, cpumask_of(cpu))) {
                        unsigned long mask = cpumask_bits(cpu_online_mask)[0];
@@ -218,6 +215,15 @@ static int physflat_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
        return 0;
 }
+static void physflat_init_apic_ldr(void)
+{
+        /*
+         * LDR and DFR are not involved in physflat mode, rather:
+         * "In physical destination mode, the destination processor is
+         * specified by its local APIC ID [...]." (Intel SDM, 10.6.2.1)
+         */
+}
 static void physflat_send_IPI_allbutself(int vector)
 {
        default_send_IPI_mask_allbutself_phys(cpu_online_mask, vector);
@@ -230,7 +236,8 @@ static void physflat_send_IPI_all(int vector)
 static int physflat_probe(void)
 {
-        if (apic == &apic_physflat || num_possible_cpus() > 8)
+        if (apic == &apic_physflat || num_possible_cpus() > 8 ||
+            jailhouse_paravirt())
                return 1;
        return 0;
@@ -251,8 +258,7 @@ static struct apic apic_physflat __ro_after_init = {
        .dest_logical                   = 0,
        .check_apicid_used              = NULL,
-        /* not needed, but shouldn't hurt: */
+        .init_apic_ldr                  = physflat_init_apic_ldr,
-        .init_apic_ldr                  = flat_init_apic_ldr,
        .ioapic_phys_id_map             = NULL,
        .setup_apic_routing             = NULL,
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 8a7963421460..8ad2e410974f 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -800,18 +800,18 @@ static int irq_polarity(int idx)
        /*
         * Determine IRQ line polarity (high active or low active):
         */
-        switch (mp_irqs[idx].irqflag & 0x03) {
+        switch (mp_irqs[idx].irqflag & MP_IRQPOL_MASK) {
-        case 0:
+        case MP_IRQPOL_DEFAULT:
                /* conforms to spec, ie. bus-type dependent polarity */
                if (test_bit(bus, mp_bus_not_pci))
                        return default_ISA_polarity(idx);
                else
                        return default_PCI_polarity(idx);
-        case 1:
+        case MP_IRQPOL_ACTIVE_HIGH:
                return IOAPIC_POL_HIGH;
-        case 2:
+        case MP_IRQPOL_RESERVED:
                pr_warn("IOAPIC: Invalid polarity: 2, defaulting to low\n");
-        case 3:
+        case MP_IRQPOL_ACTIVE_LOW:
        default: /* Pointless default required due to do gcc stupidity */
                return IOAPIC_POL_LOW;
        }
@@ -845,8 +845,8 @@ static int irq_trigger(int idx)
        /*
         * Determine IRQ trigger mode (edge or level sensitive):
         */
-        switch ((mp_irqs[idx].irqflag >> 2) & 0x03) {
+        switch (mp_irqs[idx].irqflag & MP_IRQTRIG_MASK) {
-        case 0:
+        case MP_IRQTRIG_DEFAULT:
                /* conforms to spec, ie. bus-type dependent trigger mode */
                if (test_bit(bus, mp_bus_not_pci))
                        trigger = default_ISA_trigger(idx);
@@ -854,11 +854,11 @@ static int irq_trigger(int idx)
                        trigger = default_PCI_trigger(idx);
                /* Take EISA into account */
                return eisa_irq_trigger(idx, bus, trigger);
-        case 1:
+        case MP_IRQTRIG_EDGE:
                return IOAPIC_EDGE;
-        case 2:
+        case MP_IRQTRIG_RESERVED:
                pr_warn("IOAPIC: Invalid trigger mode 2 defaulting to level\n");
-        case 3:
+        case MP_IRQTRIG_LEVEL:
        default: /* Pointless default required due to do gcc stupidity */
                return IOAPIC_LEVEL;
        }
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index e1b8e8bf6b3c..46b675aaf20b 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -137,6 +137,8 @@ static int __init early_get_pnodeid(void)
        case UV3_HUB_PART_NUMBER_X:
                uv_min_hub_revision_id += UV3_HUB_REVISION_BASE;
                break;
+        /* Update: UV4A has only a modified revision to indicate HUB fixes */
        case UV4_HUB_PART_NUMBER:
                uv_min_hub_revision_id += UV4_HUB_REVISION_BASE - 1;
                uv_cpuid.gnode_shift = 2; /* min partition is 4 sockets */
@@ -316,6 +318,7 @@ static int __init uv_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
        } else if (!strcmp(oem_table_id, "UVH")) {
                /* Only UV1 systems: */
                uv_system_type = UV_NON_UNIQUE_APIC;
+                x86_platform.legacy.warm_reset = 0;
                __this_cpu_write(x2apic_extra_bits, pnodeid << uvh_apicid.s.pnode_shift);
                uv_set_apicid_hibit();
                uv_apic = 1;
@@ -767,6 +770,7 @@ static __init void map_gru_high(int max_pnode)
                return;
        }
+        /* Only UV3 has distributed GRU mode */
        if (is_uv3_hub() && gru.s3.mode) {
                map_gru_distributed(gru.v);
                return;
@@ -790,63 +794,61 @@ static __init void map_mmr_high(int max_pnode)
                pr_info("UV: MMR disabled\n");
 }
-/*
+/* UV3/4 have identical MMIOH overlay configs, UV4A is slightly different */
- * This commonality works because both 0 & 1 versions of the MMIOH OVERLAY
+static __init void map_mmioh_high_uv34(int index, int min_pnode, int max_pnode)
- * and REDIRECT MMR regs are exactly the same on UV3.
- */
-struct mmioh_config {
-        unsigned long overlay;
-        unsigned long redirect;
-        char *id;
-};
-static __initdata struct mmioh_config mmiohs[] = {
-        {
-                UV3H_RH_GAM_MMIOH_OVERLAY_CONFIG0_MMR,
-                UV3H_RH_GAM_MMIOH_REDIRECT_CONFIG0_MMR,
-                "MMIOH0"
-        },
-        {
-                UV3H_RH_GAM_MMIOH_OVERLAY_CONFIG1_MMR,
-                UV3H_RH_GAM_MMIOH_REDIRECT_CONFIG1_MMR,
-                "MMIOH1"
-        },
-};
-/* UV3 & UV4 have identical MMIOH overlay configs */
-static __init void map_mmioh_high_uv3(int index, int min_pnode, int max_pnode)
 {
-        union uv3h_rh_gam_mmioh_overlay_config0_mmr_u overlay;
+        unsigned long overlay;
        unsigned long mmr;
        unsigned long base;
+        unsigned long nasid_mask;
+        unsigned long m_overlay;
        int i, n, shift, m_io, max_io;
        int nasid, lnasid, fi, li;
        char *id;
-        id = mmiohs[index].id;
+        if (index == 0) {
-        overlay.v = uv_read_local_mmr(mmiohs[index].overlay);
+                id = "MMIOH0";
+                m_overlay = UVH_RH_GAM_MMIOH_OVERLAY_CONFIG0_MMR;
-        pr_info("UV: %s overlay 0x%lx base:0x%x m_io:%d\n", id, overlay.v, overlay.s3.base, overlay.s3.m_io);
+                overlay = uv_read_local_mmr(m_overlay);
-        if (!overlay.s3.enable) {
+                base = overlay & UVH_RH_GAM_MMIOH_OVERLAY_CONFIG0_MMR_BASE_MASK;
+                mmr = UVH_RH_GAM_MMIOH_REDIRECT_CONFIG0_MMR;
+                m_io = (overlay & UVH_RH_GAM_MMIOH_OVERLAY_CONFIG0_MMR_M_IO_MASK)
+                        >> UVH_RH_GAM_MMIOH_OVERLAY_CONFIG0_MMR_M_IO_SHFT;
+                shift = UVH_RH_GAM_MMIOH_OVERLAY_CONFIG0_MMR_M_IO_SHFT;
+                n = UVH_RH_GAM_MMIOH_REDIRECT_CONFIG0_MMR_DEPTH;
+                nasid_mask = UVH_RH_GAM_MMIOH_REDIRECT_CONFIG0_MMR_NASID_MASK;
+        } else {
+                id = "MMIOH1";
+                m_overlay = UVH_RH_GAM_MMIOH_OVERLAY_CONFIG1_MMR;
+                overlay = uv_read_local_mmr(m_overlay);
+                base = overlay & UVH_RH_GAM_MMIOH_OVERLAY_CONFIG1_MMR_BASE_MASK;
+                mmr = UVH_RH_GAM_MMIOH_REDIRECT_CONFIG1_MMR;
+                m_io = (overlay & UVH_RH_GAM_MMIOH_OVERLAY_CONFIG1_MMR_M_IO_MASK)
+                        >> UVH_RH_GAM_MMIOH_OVERLAY_CONFIG1_MMR_M_IO_SHFT;
+                shift = UVH_RH_GAM_MMIOH_OVERLAY_CONFIG1_MMR_M_IO_SHFT;
+                n = UVH_RH_GAM_MMIOH_REDIRECT_CONFIG1_MMR_DEPTH;
+                nasid_mask = UVH_RH_GAM_MMIOH_REDIRECT_CONFIG1_MMR_NASID_MASK;
+        }
+        pr_info("UV: %s overlay 0x%lx base:0x%lx m_io:%d\n", id, overlay, base, m_io);
+        if (!(overlay & UVH_RH_GAM_MMIOH_OVERLAY_CONFIG0_MMR_ENABLE_MASK)) {
                pr_info("UV: %s disabled\n", id);
                return;
        }
-        shift = UV3H_RH_GAM_MMIOH_OVERLAY_CONFIG0_MMR_BASE_SHFT;
-        base = (unsigned long)overlay.s3.base;
-        m_io = overlay.s3.m_io;
-        mmr = mmiohs[index].redirect;
-        n = UV3H_RH_GAM_MMIOH_REDIRECT_CONFIG0_MMR_DEPTH;
        /* Convert to NASID: */
        min_pnode *= 2;
        max_pnode *= 2;
        max_io = lnasid = fi = li = -1;
        for (i = 0; i < n; i++) {
-                union uv3h_rh_gam_mmioh_redirect_config0_mmr_u redirect;
+                unsigned long m_redirect = mmr + i * 8;
+                unsigned long redirect = uv_read_local_mmr(m_redirect);
+                nasid = redirect & nasid_mask;
+                if (i == 0)
+                        pr_info("UV: %s redirect base 0x%lx(@0x%lx) 0x%04x\n",
+                                id, redirect, m_redirect, nasid);
-                redirect.v = uv_read_local_mmr(mmr + i * 8);
-                nasid = redirect.s3.nasid;
                /* Invalid NASID: */
                if (nasid < min_pnode || max_pnode < nasid)
                        nasid = -1;
@@ -894,8 +896,8 @@ static __init void map_mmioh_high(int min_pnode, int max_pnode)
        if (is_uv3_hub() || is_uv4_hub()) {
                /* Map both MMIOH regions: */
-                map_mmioh_high_uv3(0, min_pnode, max_pnode);
+                map_mmioh_high_uv34(0, min_pnode, max_pnode);
-                map_mmioh_high_uv3(1, min_pnode, max_pnode);
+                map_mmioh_high_uv34(1, min_pnode, max_pnode);
                return;
        }
diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
index e4b0d92b3ae0..dc0ca8e29c75 100644
--- a/arch/x86/kernel/apm_32.c
+++ b/arch/x86/kernel/apm_32.c
@@ -1506,7 +1506,7 @@ static ssize_t do_read(struct file *fp, char __user *buf, size_t count, loff_t *
        return 0;
 }
-static unsigned int do_poll(struct file *fp, poll_table *wait)
+static __poll_t do_poll(struct file *fp, poll_table *wait)
 {
        struct apm_user *as;
@@ -2389,6 +2389,7 @@ static int __init apm_init(void)
        if (HZ != 100)
                idle_period = (idle_period * HZ) / 100;
        if (idle_threshold < 100) {
+                cpuidle_poll_state_init(&apm_idle_driver);
                if (!cpuidle_register_driver(&apm_idle_driver))
                        if (cpuidle_register_device(&apm_cpuidle_device))
                                cpuidle_unregister_driver(&apm_idle_driver);
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 390b3dc3d438..71949bf2de5a 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -11,6 +11,7 @@
 #include <linux/init.h>
 #include <linux/utsname.h>
 #include <linux/cpu.h>
+#include <linux/module.h>
 #include <asm/nospec-branch.h>
 #include <asm/cmdline.h>
@@ -90,20 +91,41 @@ static const char *spectre_v2_strings[] = {
 };
 #undef pr_fmt
-#define pr_fmt(fmt)     "Spectre V2 mitigation: " fmt
+#define pr_fmt(fmt)     "Spectre V2 : " fmt
 static enum spectre_v2_mitigation spectre_v2_enabled = SPECTRE_V2_NONE;
+#ifdef RETPOLINE
+static bool spectre_v2_bad_module;
+bool retpoline_module_ok(bool has_retpoline)
+{
+        if (spectre_v2_enabled == SPECTRE_V2_NONE || has_retpoline)
+                return true;
+        pr_err("System may be vulnerable to spectre v2\n");
+        spectre_v2_bad_module = true;
+        return false;
+}
+static inline const char *spectre_v2_module_string(void)
+{
+        return spectre_v2_bad_module ? " - vulnerable module loaded" : "";
+}
+#else
+static inline const char *spectre_v2_module_string(void) { return ""; }
+#endif
 static void __init spec2_print_if_insecure(const char *reason)
 {
        if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
-                pr_info("%s\n", reason);
+                pr_info("%s selected on command line.\n", reason);
 }
 static void __init spec2_print_if_secure(const char *reason)
 {
        if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
-                pr_info("%s\n", reason);
+                pr_info("%s selected on command line.\n", reason);
 }
 static inline bool retp_compiler(void)
@@ -118,42 +140,68 @@ static inline bool match_option(const char *arg, int arglen, const char *opt)
        return len == arglen && !strncmp(arg, opt, len);
 }
+static const struct {
+        const char *option;
+        enum spectre_v2_mitigation_cmd cmd;
+        bool secure;
+} mitigation_options[] = {
+        { "off",               SPECTRE_V2_CMD_NONE,              false },
+        { "on",                SPECTRE_V2_CMD_FORCE,             true },
+        { "retpoline",         SPECTRE_V2_CMD_RETPOLINE,         false },
+        { "retpoline,amd",     SPECTRE_V2_CMD_RETPOLINE_AMD,     false },
+        { "retpoline,generic", SPECTRE_V2_CMD_RETPOLINE_GENERIC, false },
+        { "auto",              SPECTRE_V2_CMD_AUTO,              false },
+};
 static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
 {
        char arg[20];
-        int ret;
+        int ret, i;
+        enum spectre_v2_mitigation_cmd cmd = SPECTRE_V2_CMD_AUTO;
-        ret = cmdline_find_option(boot_command_line, "spectre_v2", arg,
-                                  sizeof(arg));
+        if (cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
-        if (ret > 0)  {
+                return SPECTRE_V2_CMD_NONE;
-                if (match_option(arg, ret, "off")) {
+        else {
-                        goto disable;
+                ret = cmdline_find_option(boot_command_line, "spectre_v2", arg,
-                } else if (match_option(arg, ret, "on")) {
+                                          sizeof(arg));
-                        spec2_print_if_secure("force enabled on command line.");
+                if (ret < 0)
-                        return SPECTRE_V2_CMD_FORCE;
+                        return SPECTRE_V2_CMD_AUTO;
-                } else if (match_option(arg, ret, "retpoline")) {
-                        spec2_print_if_insecure("retpoline selected on command line.");
+                for (i = 0; i < ARRAY_SIZE(mitigation_options); i++) {
-                        return SPECTRE_V2_CMD_RETPOLINE;
+                        if (!match_option(arg, ret, mitigation_options[i].option))
-                } else if (match_option(arg, ret, "retpoline,amd")) {
+                                continue;
-                        if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD) {
+                        cmd = mitigation_options[i].cmd;
-                                pr_err("retpoline,amd selected but CPU is not AMD. Switching to AUTO select\n");
+                        break;
-                                return SPECTRE_V2_CMD_AUTO;
+                }
-                        }
-                        spec2_print_if_insecure("AMD retpoline selected on command line.");
+                if (i >= ARRAY_SIZE(mitigation_options)) {
-                        return SPECTRE_V2_CMD_RETPOLINE_AMD;
+                        pr_err("unknown option (%s). Switching to AUTO select\n",
-                } else if (match_option(arg, ret, "retpoline,generic")) {
+                               mitigation_options[i].option);
-                        spec2_print_if_insecure("generic retpoline selected on command line.");
-                        return SPECTRE_V2_CMD_RETPOLINE_GENERIC;
-                } else if (match_option(arg, ret, "auto")) {
                        return SPECTRE_V2_CMD_AUTO;
                }
        }
-        if (!cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
+        if ((cmd == SPECTRE_V2_CMD_RETPOLINE ||
+             cmd == SPECTRE_V2_CMD_RETPOLINE_AMD ||
+             cmd == SPECTRE_V2_CMD_RETPOLINE_GENERIC) &&
+            !IS_ENABLED(CONFIG_RETPOLINE)) {
+                pr_err("%s selected but not compiled in. Switching to AUTO select\n",
+                       mitigation_options[i].option);
                return SPECTRE_V2_CMD_AUTO;
-disable:
+        }
-        spec2_print_if_insecure("disabled on command line.");
-        return SPECTRE_V2_CMD_NONE;
+        if (cmd == SPECTRE_V2_CMD_RETPOLINE_AMD &&
+            boot_cpu_data.x86_vendor != X86_VENDOR_AMD) {
+                pr_err("retpoline,amd selected but CPU is not AMD. Switching to AUTO select\n");
+                return SPECTRE_V2_CMD_AUTO;
+        }
+        if (mitigation_options[i].secure)
+                spec2_print_if_secure(mitigation_options[i].option);
+        else
+                spec2_print_if_insecure(mitigation_options[i].option);
+        return cmd;
 }
 /* Check for Skylake-like CPUs (for RSB handling) */
@@ -191,10 +239,10 @@ static void __init spectre_v2_select_mitigation(void)
                return;
        case SPECTRE_V2_CMD_FORCE:
-                /* FALLTRHU */
        case SPECTRE_V2_CMD_AUTO:
-                goto retpoline_auto;
+                if (IS_ENABLED(CONFIG_RETPOLINE))
+                        goto retpoline_auto;
+                break;
        case SPECTRE_V2_CMD_RETPOLINE_AMD:
                if (IS_ENABLED(CONFIG_RETPOLINE))
                        goto retpoline_amd;
@@ -249,6 +297,12 @@ retpoline_auto:
                setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
                pr_info("Filling RSB on context switch\n");
        }
+        /* Initialize Indirect Branch Prediction Barrier if supported */
+        if (boot_cpu_has(X86_FEATURE_IBPB)) {
+                setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
+                pr_info("Enabling Indirect Branch Prediction Barrier\n");
+        }
 }
 #undef pr_fmt
@@ -269,7 +323,7 @@ ssize_t cpu_show_spectre_v1(struct device *dev,
 {
        if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V1))
                return sprintf(buf, "Not affected\n");
-        return sprintf(buf, "Vulnerable\n");
+        return sprintf(buf, "Mitigation: __user pointer sanitization\n");
 }
 ssize_t cpu_show_spectre_v2(struct device *dev,
@@ -278,6 +332,14 @@ ssize_t cpu_show_spectre_v2(struct device *dev,
        if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
                return sprintf(buf, "Not affected\n");
-        return sprintf(buf, "%s\n", spectre_v2_strings[spectre_v2_enabled]);
+        return sprintf(buf, "%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+                       boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
+                       spectre_v2_module_string());
 }
 #endif
+void __ibp_barrier(void)
+{
+        __wrmsr(MSR_IA32_PRED_CMD, PRED_CMD_IBPB, 0);
+}
+EXPORT_SYMBOL_GPL(__ibp_barrier);
diff --git a/arch/x86/kernel/cpu/centaur.c b/arch/x86/kernel/cpu/centaur.c
index 68bc6d9b3132..c578cd29c2d2 100644
--- a/arch/x86/kernel/cpu/centaur.c
+++ b/arch/x86/kernel/cpu/centaur.c
@@ -106,6 +106,10 @@ static void early_init_centaur(struct cpuinfo_x86 *c)
 #ifdef CONFIG_X86_64
        set_cpu_cap(c, X86_FEATURE_SYSENTER32);
 #endif
+        if (c->x86_power & (1 << 8)) {
+                set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
+                set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC);
+        }
 }
 static void init_centaur(struct cpuinfo_x86 *c)
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index ef29ad001991..d63f4b5706e4 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -47,6 +47,8 @@
 #include <asm/pat.h>
 #include <asm/microcode.h>
 #include <asm/microcode_intel.h>
+#include <asm/intel-family.h>
+#include <asm/cpu_device_id.h>
 #ifdef CONFIG_X86_LOCAL_APIC
 #include <asm/uv/uv.h>
@@ -748,6 +750,26 @@ static void apply_forced_caps(struct cpuinfo_x86 *c)
        }
 }
+static void init_speculation_control(struct cpuinfo_x86 *c)
+{
+        /*
+         * The Intel SPEC_CTRL CPUID bit implies IBRS and IBPB support,
+         * and they also have a different bit for STIBP support. Also,
+         * a hypervisor might have set the individual AMD bits even on
+         * Intel CPUs, for finer-grained selection of what's available.
+         *
+         * We use the AMD bits in 0x8000_0008 EBX as the generic hardware
+         * features, which are visible in /proc/cpuinfo and used by the
+         * kernel. So set those accordingly from the Intel bits.
+         */
+        if (cpu_has(c, X86_FEATURE_SPEC_CTRL)) {
+                set_cpu_cap(c, X86_FEATURE_IBRS);
+                set_cpu_cap(c, X86_FEATURE_IBPB);
+        }
+        if (cpu_has(c, X86_FEATURE_INTEL_STIBP))
+                set_cpu_cap(c, X86_FEATURE_STIBP);
+}
 void get_cpu_cap(struct cpuinfo_x86 *c)
 {
        u32 eax, ebx, ecx, edx;
@@ -769,6 +791,7 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
                cpuid_count(0x00000007, 0, &eax, &ebx, &ecx, &edx);
                c->x86_capability[CPUID_7_0_EBX] = ebx;
                c->x86_capability[CPUID_7_ECX] = ecx;
+                c->x86_capability[CPUID_7_EDX] = edx;
        }
        /* Extended state features: level 0x0000000d */
@@ -841,6 +864,7 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
                c->x86_capability[CPUID_8000_000A_EDX] = cpuid_edx(0x8000000a);
        init_scattered_cpuid_features(c);
+        init_speculation_control(c);
        /*
         * Clear/Set all flags overridden by options, after probe.
@@ -876,6 +900,41 @@ static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c)
 #endif
 }
+static const __initconst struct x86_cpu_id cpu_no_speculation[] = {
+        { X86_VENDOR_INTEL,     6, INTEL_FAM6_ATOM_CEDARVIEW,   X86_FEATURE_ANY },
+        { X86_VENDOR_INTEL,     6, INTEL_FAM6_ATOM_CLOVERVIEW,  X86_FEATURE_ANY },
+        { X86_VENDOR_INTEL,     6, INTEL_FAM6_ATOM_LINCROFT,    X86_FEATURE_ANY },
+        { X86_VENDOR_INTEL,     6, INTEL_FAM6_ATOM_PENWELL,     X86_FEATURE_ANY },
+        { X86_VENDOR_INTEL,     6, INTEL_FAM6_ATOM_PINEVIEW,    X86_FEATURE_ANY },
+        { X86_VENDOR_CENTAUR,   5 },
+        { X86_VENDOR_INTEL,     5 },
+        { X86_VENDOR_NSC,       5 },
+        { X86_VENDOR_ANY,       4 },
+        {}
+};
+static const __initconst struct x86_cpu_id cpu_no_meltdown[] = {
+        { X86_VENDOR_AMD },
+        {}
+};
+static bool __init cpu_vulnerable_to_meltdown(struct cpuinfo_x86 *c)
+{
+        u64 ia32_cap = 0;
+        if (x86_match_cpu(cpu_no_meltdown))
+                return false;
+        if (cpu_has(c, X86_FEATURE_ARCH_CAPABILITIES))
+                rdmsrl(MSR_IA32_ARCH_CAPABILITIES, ia32_cap);
+        /* Rogue Data Cache Load? No! */
+        if (ia32_cap & ARCH_CAP_RDCL_NO)
+                return false;
+        return true;
+}
 /*
 * Do minimum CPU detection early.
 * Fields really needed: vendor, cpuid_level, family, model, mask,
@@ -923,11 +982,12 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
        setup_force_cpu_cap(X86_FEATURE_ALWAYS);
-        if (c->x86_vendor != X86_VENDOR_AMD)
+        if (!x86_match_cpu(cpu_no_speculation)) {
-                setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN);
+                if (cpu_vulnerable_to_meltdown(c))
+                        setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN);
-        setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
+                setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
-        setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
+                setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
+        }
        fpu__init_system(c);
diff --git a/arch/x86/kernel/cpu/hypervisor.c b/arch/x86/kernel/cpu/hypervisor.c
index bea8d3e24f50..479ca4728de0 100644
--- a/arch/x86/kernel/cpu/hypervisor.c
+++ b/arch/x86/kernel/cpu/hypervisor.c
@@ -31,6 +31,7 @@ extern const struct hypervisor_x86 x86_hyper_ms_hyperv;
 extern const struct hypervisor_x86 x86_hyper_xen_pv;
 extern const struct hypervisor_x86 x86_hyper_xen_hvm;
 extern const struct hypervisor_x86 x86_hyper_kvm;
+extern const struct hypervisor_x86 x86_hyper_jailhouse;
 static const __initconst struct hypervisor_x86 * const hypervisors[] =
 {
@@ -45,6 +46,9 @@ static const __initconst struct hypervisor_x86 * const hypervisors[] =
 #ifdef CONFIG_KVM_GUEST
        &x86_hyper_kvm,
 #endif
+#ifdef CONFIG_JAILHOUSE_GUEST
+        &x86_hyper_jailhouse,
+#endif
 };
 enum x86_hypervisor_type x86_hyper_type;
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index b1af22073e28..319bf989fad1 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -102,6 +102,59 @@ static void probe_xeon_phi_r3mwait(struct cpuinfo_x86 *c)
                ELF_HWCAP2 |= HWCAP2_RING3MWAIT;
 }
+/*
+ * Early microcode releases for the Spectre v2 mitigation were broken.
+ * Information taken from;
+ * - https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/microcode-update-guidance.pdf
+ * - https://kb.vmware.com/s/article/52345
+ * - Microcode revisions observed in the wild
+ * - Release note from 20180108 microcode release
+ */
+struct sku_microcode {
+        u8 model;
+        u8 stepping;
+        u32 microcode;
+};
+static const struct sku_microcode spectre_bad_microcodes[] = {
+        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0B,   0x84 },
+        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0A,   0x84 },
+        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x09,   0x84 },
+        { INTEL_FAM6_KABYLAKE_MOBILE,   0x0A,   0x84 },
+        { INTEL_FAM6_KABYLAKE_MOBILE,   0x09,   0x84 },
+        { INTEL_FAM6_SKYLAKE_X,         0x03,   0x0100013e },
+        { INTEL_FAM6_SKYLAKE_X,         0x04,   0x0200003c },
+        { INTEL_FAM6_SKYLAKE_MOBILE,    0x03,   0xc2 },
+        { INTEL_FAM6_SKYLAKE_DESKTOP,   0x03,   0xc2 },
+        { INTEL_FAM6_BROADWELL_CORE,    0x04,   0x28 },
+        { INTEL_FAM6_BROADWELL_GT3E,    0x01,   0x1b },
+        { INTEL_FAM6_BROADWELL_XEON_D,  0x02,   0x14 },
+        { INTEL_FAM6_BROADWELL_XEON_D,  0x03,   0x07000011 },
+        { INTEL_FAM6_BROADWELL_X,       0x01,   0x0b000025 },
+        { INTEL_FAM6_HASWELL_ULT,       0x01,   0x21 },
+        { INTEL_FAM6_HASWELL_GT3E,      0x01,   0x18 },
+        { INTEL_FAM6_HASWELL_CORE,      0x03,   0x23 },
+        { INTEL_FAM6_HASWELL_X,         0x02,   0x3b },
+        { INTEL_FAM6_HASWELL_X,         0x04,   0x10 },
+        { INTEL_FAM6_IVYBRIDGE_X,       0x04,   0x42a },
+        /* Updated in the 20180108 release; blacklist until we know otherwise */
+        { INTEL_FAM6_ATOM_GEMINI_LAKE,  0x01,   0x22 },
+        /* Observed in the wild */
+        { INTEL_FAM6_SANDYBRIDGE_X,     0x06,   0x61b },
+        { INTEL_FAM6_SANDYBRIDGE_X,     0x07,   0x712 },
+};
+static bool bad_spectre_microcode(struct cpuinfo_x86 *c)
+{
+        int i;
+        for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) {
+                if (c->x86_model == spectre_bad_microcodes[i].model &&
+                    c->x86_mask == spectre_bad_microcodes[i].stepping)
+                        return (c->microcode <= spectre_bad_microcodes[i].microcode);
+        }
+        return false;
+}
 static void early_init_intel(struct cpuinfo_x86 *c)
 {
        u64 misc_enable;
@@ -122,6 +175,19 @@ static void early_init_intel(struct cpuinfo_x86 *c)
        if (c->x86 >= 6 && !cpu_has(c, X86_FEATURE_IA64))
                c->microcode = intel_get_microcode_revision();
+        /* Now if any of them are set, check the blacklist and clear the lot */
+        if ((cpu_has(c, X86_FEATURE_SPEC_CTRL) ||
+             cpu_has(c, X86_FEATURE_INTEL_STIBP) ||
+             cpu_has(c, X86_FEATURE_IBRS) || cpu_has(c, X86_FEATURE_IBPB) ||
+             cpu_has(c, X86_FEATURE_STIBP)) && bad_spectre_microcode(c)) {
+                pr_warn("Intel Spectre v2 broken microcode detected; disabling Speculation Control\n");
+                setup_clear_cpu_cap(X86_FEATURE_IBRS);
+                setup_clear_cpu_cap(X86_FEATURE_IBPB);
+                setup_clear_cpu_cap(X86_FEATURE_STIBP);
+                setup_clear_cpu_cap(X86_FEATURE_SPEC_CTRL);
+                setup_clear_cpu_cap(X86_FEATURE_INTEL_STIBP);
+        }
        /*
         * Atom erratum AAE44/AAF40/AAG38/AAH41:
         *
diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c
index 99442370de40..410629f10ad3 100644
--- a/arch/x86/kernel/cpu/intel_rdt.c
+++ b/arch/x86/kernel/cpu/intel_rdt.c
@@ -135,6 +135,40 @@ struct rdt_resource rdt_resources_all[] = {
                .format_str             = "%d=%0*x",
                .fflags                 = RFTYPE_RES_CACHE,
        },
+        [RDT_RESOURCE_L2DATA] =
+        {
+                .rid                    = RDT_RESOURCE_L2DATA,
+                .name                   = "L2DATA",
+                .domains                = domain_init(RDT_RESOURCE_L2DATA),
+                .msr_base               = IA32_L2_CBM_BASE,
+                .msr_update             = cat_wrmsr,
+                .cache_level            = 2,
+                .cache = {
+                        .min_cbm_bits   = 1,
+                        .cbm_idx_mult   = 2,
+                        .cbm_idx_offset = 0,
+                },
+                .parse_ctrlval          = parse_cbm,
+                .format_str             = "%d=%0*x",
+                .fflags                 = RFTYPE_RES_CACHE,
+        },
+        [RDT_RESOURCE_L2CODE] =
+        {
+                .rid                    = RDT_RESOURCE_L2CODE,
+                .name                   = "L2CODE",
+                .domains                = domain_init(RDT_RESOURCE_L2CODE),
+                .msr_base               = IA32_L2_CBM_BASE,
+                .msr_update             = cat_wrmsr,
+                .cache_level            = 2,
+                .cache = {
+                        .min_cbm_bits   = 1,
+                        .cbm_idx_mult   = 2,
+                        .cbm_idx_offset = 1,
+                },
+                .parse_ctrlval          = parse_cbm,
+                .format_str             = "%d=%0*x",
+                .fflags                 = RFTYPE_RES_CACHE,
+        },
        [RDT_RESOURCE_MBA] =
        {
                .rid                    = RDT_RESOURCE_MBA,
@@ -259,15 +293,15 @@ static void rdt_get_cache_alloc_cfg(int idx, struct rdt_resource *r)
        r->alloc_enabled = true;
 }
-static void rdt_get_cdp_l3_config(int type)
+static void rdt_get_cdp_config(int level, int type)
 {
-        struct rdt_resource *r_l3 = &rdt_resources_all[RDT_RESOURCE_L3];
+        struct rdt_resource *r_l = &rdt_resources_all[level];
        struct rdt_resource *r = &rdt_resources_all[type];
-        r->num_closid = r_l3->num_closid / 2;
+        r->num_closid = r_l->num_closid / 2;
-        r->cache.cbm_len = r_l3->cache.cbm_len;
+        r->cache.cbm_len = r_l->cache.cbm_len;
-        r->default_ctrl = r_l3->default_ctrl;
+        r->default_ctrl = r_l->default_ctrl;
-        r->cache.shareable_bits = r_l3->cache.shareable_bits;
+        r->cache.shareable_bits = r_l->cache.shareable_bits;
        r->data_width = (r->cache.cbm_len + 3) / 4;
        r->alloc_capable = true;
        /*
@@ -277,6 +311,18 @@ static void rdt_get_cdp_l3_config(int type)
        r->alloc_enabled = false;
 }
+static void rdt_get_cdp_l3_config(void)
+{
+        rdt_get_cdp_config(RDT_RESOURCE_L3, RDT_RESOURCE_L3DATA);
+        rdt_get_cdp_config(RDT_RESOURCE_L3, RDT_RESOURCE_L3CODE);
+}
+static void rdt_get_cdp_l2_config(void)
+{
+        rdt_get_cdp_config(RDT_RESOURCE_L2, RDT_RESOURCE_L2DATA);
+        rdt_get_cdp_config(RDT_RESOURCE_L2, RDT_RESOURCE_L2CODE);
+}
 static int get_cache_id(int cpu, int level)
 {
        struct cpu_cacheinfo *ci = get_cpu_cacheinfo(cpu);
@@ -645,6 +691,7 @@ enum {
        RDT_FLAG_L3_CAT,
        RDT_FLAG_L3_CDP,
        RDT_FLAG_L2_CAT,
+        RDT_FLAG_L2_CDP,
        RDT_FLAG_MBA,
 };
@@ -667,6 +714,7 @@ static struct rdt_options rdt_options[]  __initdata = {
        RDT_OPT(RDT_FLAG_L3_CAT,    "l3cat",    X86_FEATURE_CAT_L3),
        RDT_OPT(RDT_FLAG_L3_CDP,    "l3cdp",    X86_FEATURE_CDP_L3),
        RDT_OPT(RDT_FLAG_L2_CAT,    "l2cat",    X86_FEATURE_CAT_L2),
+        RDT_OPT(RDT_FLAG_L2_CDP,    "l2cdp",    X86_FEATURE_CDP_L2),
        RDT_OPT(RDT_FLAG_MBA,       "mba",      X86_FEATURE_MBA),
 };
 #define NUM_RDT_OPTIONS ARRAY_SIZE(rdt_options)
@@ -729,15 +777,15 @@ static __init bool get_rdt_alloc_resources(void)
        if (rdt_cpu_has(X86_FEATURE_CAT_L3)) {
                rdt_get_cache_alloc_cfg(1, &rdt_resources_all[RDT_RESOURCE_L3]);
-                if (rdt_cpu_has(X86_FEATURE_CDP_L3)) {
+                if (rdt_cpu_has(X86_FEATURE_CDP_L3))
-                        rdt_get_cdp_l3_config(RDT_RESOURCE_L3DATA);
+                        rdt_get_cdp_l3_config();
-                        rdt_get_cdp_l3_config(RDT_RESOURCE_L3CODE);
-                }
                ret = true;
        }
        if (rdt_cpu_has(X86_FEATURE_CAT_L2)) {
                /* CPUID 0x10.2 fields are same format at 0x10.1 */
                rdt_get_cache_alloc_cfg(2, &rdt_resources_all[RDT_RESOURCE_L2]);
+                if (rdt_cpu_has(X86_FEATURE_CDP_L2))
+                        rdt_get_cdp_l2_config();
                ret = true;
        }
diff --git a/arch/x86/kernel/cpu/intel_rdt.h b/arch/x86/kernel/cpu/intel_rdt.h
index 3397244984f5..3fd7a70ee04a 100644
--- a/arch/x86/kernel/cpu/intel_rdt.h
+++ b/arch/x86/kernel/cpu/intel_rdt.h
@@ -7,12 +7,15 @@
 #include <linux/jump_label.h>
 #define IA32_L3_QOS_CFG         0xc81
+#define IA32_L2_QOS_CFG         0xc82
 #define IA32_L3_CBM_BASE        0xc90
 #define IA32_L2_CBM_BASE        0xd10
 #define IA32_MBA_THRTL_BASE     0xd50
 #define L3_QOS_CDP_ENABLE       0x01ULL
+#define L2_QOS_CDP_ENABLE       0x01ULL
 /*
 * Event IDs are used to program IA32_QM_EVTSEL before reading event
 * counter from IA32_QM_CTR
@@ -357,6 +360,8 @@ enum {
        RDT_RESOURCE_L3DATA,
        RDT_RESOURCE_L3CODE,
        RDT_RESOURCE_L2,
+        RDT_RESOURCE_L2DATA,
+        RDT_RESOURCE_L2CODE,
        RDT_RESOURCE_MBA,
        /* Must be the last */
diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
index 64c5ff97ee0d..bdab7d2f51af 100644
--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
@@ -990,6 +990,7 @@ out_destroy:
        kernfs_remove(kn);
        return ret;
 }
 static void l3_qos_cfg_update(void *arg)
 {
        bool *enable = arg;
@@ -997,8 +998,17 @@ static void l3_qos_cfg_update(void *arg)
        wrmsrl(IA32_L3_QOS_CFG, *enable ? L3_QOS_CDP_ENABLE : 0ULL);
 }
-static int set_l3_qos_cfg(struct rdt_resource *r, bool enable)
+static void l2_qos_cfg_update(void *arg)
 {
+        bool *enable = arg;
+        wrmsrl(IA32_L2_QOS_CFG, *enable ? L2_QOS_CDP_ENABLE : 0ULL);
+}
+static int set_cache_qos_cfg(int level, bool enable)
+{
+        void (*update)(void *arg);
+        struct rdt_resource *r_l;
        cpumask_var_t cpu_mask;
        struct rdt_domain *d;
        int cpu;
@@ -1006,16 +1016,24 @@ static int set_l3_qos_cfg(struct rdt_resource *r, bool enable)
        if (!zalloc_cpumask_var(&cpu_mask, GFP_KERNEL))
                return -ENOMEM;
-        list_for_each_entry(d, &r->domains, list) {
+        if (level == RDT_RESOURCE_L3)
+                update = l3_qos_cfg_update;
+        else if (level == RDT_RESOURCE_L2)
+                update = l2_qos_cfg_update;
+        else
+                return -EINVAL;
+        r_l = &rdt_resources_all[level];
+        list_for_each_entry(d, &r_l->domains, list) {
                /* Pick one CPU from each domain instance to update MSR */
                cpumask_set_cpu(cpumask_any(&d->cpu_mask), cpu_mask);
        }
        cpu = get_cpu();
        /* Update QOS_CFG MSR on this cpu if it's in cpu_mask. */
        if (cpumask_test_cpu(cpu, cpu_mask))
-                l3_qos_cfg_update(&enable);
+                update(&enable);
        /* Update QOS_CFG MSR on all other cpus in cpu_mask. */
-        smp_call_function_many(cpu_mask, l3_qos_cfg_update, &enable, 1);
+        smp_call_function_many(cpu_mask, update, &enable, 1);
        put_cpu();
        free_cpumask_var(cpu_mask);
@@ -1023,52 +1041,99 @@ static int set_l3_qos_cfg(struct rdt_resource *r, bool enable)
        return 0;
 }
-static int cdp_enable(void)
+static int cdp_enable(int level, int data_type, int code_type)
 {
-        struct rdt_resource *r_l3data = &rdt_resources_all[RDT_RESOURCE_L3DATA];
+        struct rdt_resource *r_ldata = &rdt_resources_all[data_type];
-        struct rdt_resource *r_l3code = &rdt_resources_all[RDT_RESOURCE_L3CODE];
+        struct rdt_resource *r_lcode = &rdt_resources_all[code_type];
-        struct rdt_resource *r_l3 = &rdt_resources_all[RDT_RESOURCE_L3];
+        struct rdt_resource *r_l = &rdt_resources_all[level];
        int ret;
-        if (!r_l3->alloc_capable || !r_l3data->alloc_capable ||
+        if (!r_l->alloc_capable || !r_ldata->alloc_capable ||
-            !r_l3code->alloc_capable)
+            !r_lcode->alloc_capable)
                return -EINVAL;
-        ret = set_l3_qos_cfg(r_l3, true);
+        ret = set_cache_qos_cfg(level, true);
        if (!ret) {
-                r_l3->alloc_enabled = false;
+                r_l->alloc_enabled = false;
-                r_l3data->alloc_enabled = true;
+                r_ldata->alloc_enabled = true;
-                r_l3code->alloc_enabled = true;
+                r_lcode->alloc_enabled = true;
        }
        return ret;
 }
-static void cdp_disable(void)
+static int cdpl3_enable(void)
 {
-        struct rdt_resource *r = &rdt_resources_all[RDT_RESOURCE_L3];
+        return cdp_enable(RDT_RESOURCE_L3, RDT_RESOURCE_L3DATA,
+                          RDT_RESOURCE_L3CODE);
+}
+static int cdpl2_enable(void)
+{
+        return cdp_enable(RDT_RESOURCE_L2, RDT_RESOURCE_L2DATA,
+                          RDT_RESOURCE_L2CODE);
+}
+static void cdp_disable(int level, int data_type, int code_type)
+{
+        struct rdt_resource *r = &rdt_resources_all[level];
        r->alloc_enabled = r->alloc_capable;
-        if (rdt_resources_all[RDT_RESOURCE_L3DATA].alloc_enabled) {
+        if (rdt_resources_all[data_type].alloc_enabled) {
-                rdt_resources_all[RDT_RESOURCE_L3DATA].alloc_enabled = false;
+                rdt_resources_all[data_type].alloc_enabled = false;
-                rdt_resources_all[RDT_RESOURCE_L3CODE].alloc_enabled = false;
+                rdt_resources_all[code_type].alloc_enabled = false;
-                set_l3_qos_cfg(r, false);
+                set_cache_qos_cfg(level, false);
        }
 }
+static void cdpl3_disable(void)
+{
+        cdp_disable(RDT_RESOURCE_L3, RDT_RESOURCE_L3DATA, RDT_RESOURCE_L3CODE);
+}
+static void cdpl2_disable(void)
+{
+        cdp_disable(RDT_RESOURCE_L2, RDT_RESOURCE_L2DATA, RDT_RESOURCE_L2CODE);
+}
+static void cdp_disable_all(void)
+{
+        if (rdt_resources_all[RDT_RESOURCE_L3DATA].alloc_enabled)
+                cdpl3_disable();
+        if (rdt_resources_all[RDT_RESOURCE_L2DATA].alloc_enabled)
+                cdpl2_disable();
+}
 static int parse_rdtgroupfs_options(char *data)
 {
        char *token, *o = data;
        int ret = 0;
        while ((token = strsep(&o, ",")) != NULL) {
-                if (!*token)
+                if (!*token) {
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto out;
+                }
-                if (!strcmp(token, "cdp"))
+                if (!strcmp(token, "cdp")) {
-                        ret = cdp_enable();
+                        ret = cdpl3_enable();
+                        if (ret)
+                                goto out;
+                } else if (!strcmp(token, "cdpl2")) {
+                        ret = cdpl2_enable();
+                        if (ret)
+                                goto out;
+                } else {
+                        ret = -EINVAL;
+                        goto out;
+                }
        }
+        return 0;
+out:
+        pr_err("Invalid mount option \"%s\"\n", token);
        return ret;
 }
@@ -1223,7 +1288,7 @@ out_mongrp:
 out_info:
        kernfs_remove(kn_info);
 out_cdp:
-        cdp_disable();
+        cdp_disable_all();
 out:
        rdt_last_cmd_clear();
        mutex_unlock(&rdtgroup_mutex);
@@ -1383,7 +1448,7 @@ static void rdt_kill_sb(struct super_block *sb)
        /*Put everything back to default values. */
        for_each_alloc_enabled_rdt_resource(r)
                reset_all_ctrls(r);
-        cdp_disable();
+        cdp_disable_all();
        rmdir_all_sub();
        static_branch_disable_cpuslocked(&rdt_alloc_enable_key);
        static_branch_disable_cpuslocked(&rdt_mon_enable_key);
diff --git a/arch/x86/kernel/cpu/mcheck/dev-mcelog.c b/arch/x86/kernel/cpu/mcheck/dev-mcelog.c
index 7f85b76f43bc..213e8c2ca702 100644
--- a/arch/x86/kernel/cpu/mcheck/dev-mcelog.c
+++ b/arch/x86/kernel/cpu/mcheck/dev-mcelog.c
@@ -243,7 +243,7 @@ out:
        return err ? err : buf - ubuf;
 }
-static unsigned int mce_chrdev_poll(struct file *file, poll_table *wait)
+static __poll_t mce_chrdev_poll(struct file *file, poll_table *wait)
 {
        poll_wait(file, &mce_chrdev_wait, wait);
        if (READ_ONCE(mcelog.next))
diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c b/arch/x86/kernel/cpu/mcheck/mce-severity.c
index 4ca632a06e0b..5bbd06f38ff6 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-severity.c
+++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c
@@ -59,6 +59,7 @@ static struct severity {
 #define  MCGMASK(x, y)  .mcgmask = x, .mcgres = y
 #define  MASK(x, y)     .mask = x, .result = y
 #define MCI_UC_S (MCI_STATUS_UC|MCI_STATUS_S)
+#define MCI_UC_AR (MCI_STATUS_UC|MCI_STATUS_AR)
 #define MCI_UC_SAR (MCI_STATUS_UC|MCI_STATUS_S|MCI_STATUS_AR)
 #define MCI_ADDR (MCI_STATUS_ADDRV|MCI_STATUS_MISCV)
@@ -101,6 +102,22 @@ static struct severity {
                NOSER, BITCLR(MCI_STATUS_UC)
                ),
+        /*
+         * known AO MCACODs reported via MCE or CMC:
+         *
+         * SRAO could be signaled either via a machine check exception or
+         * CMCI with the corresponding bit S 1 or 0. So we don't need to
+         * check bit S for SRAO.
+         */
+        MCESEV(
+                AO, "Action optional: memory scrubbing error",
+                SER, MASK(MCI_STATUS_OVER|MCI_UC_AR|MCACOD_SCRUBMSK, MCI_STATUS_UC|MCACOD_SCRUB)
+                ),
+        MCESEV(
+                AO, "Action optional: last level cache writeback error",
+                SER, MASK(MCI_STATUS_OVER|MCI_UC_AR|MCACOD, MCI_STATUS_UC|MCACOD_L3WB)
+                ),
        /* ignore OVER for UCNA */
        MCESEV(
                UCNA, "Uncorrected no action required",
@@ -149,15 +166,6 @@ static struct severity {
                SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR, MCI_UC_SAR)
                ),
-        /* known AO MCACODs: */
-        MCESEV(
-                AO, "Action optional: memory scrubbing error",
-                SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCACOD_SCRUBMSK, MCI_UC_S|MCACOD_SCRUB)
-                ),
-        MCESEV(
-                AO, "Action optional: last level cache writeback error",
-                SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCACOD, MCI_UC_S|MCACOD_L3WB)
-                ),
        MCESEV(
                SOME, "Action optional: unknown MCACOD",
                SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR, MCI_UC_S)
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 868e412b4f0c..3a8e88a611eb 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -14,7 +14,6 @@
 #include <linux/capability.h>
 #include <linux/miscdevice.h>
 #include <linux/ratelimit.h>
-#include <linux/kallsyms.h>
 #include <linux/rcupdate.h>
 #include <linux/kobject.h>
 #include <linux/uaccess.h>
@@ -235,7 +234,7 @@ static void __print_mce(struct mce *m)
                        m->cs, m->ip);
                if (m->cs == __KERNEL_CS)
-                        print_symbol("{%s}", m->ip);
+                        pr_cont("{%pS}", (void *)m->ip);
                pr_cont("\n");
        }
@@ -503,10 +502,8 @@ static int mce_usable_address(struct mce *m)
 bool mce_is_memory_error(struct mce *m)
 {
        if (m->cpuvendor == X86_VENDOR_AMD) {
-                /* ErrCodeExt[20:16] */
+                return amd_mce_is_memory_error(m);
-                u8 xec = (m->status >> 16) & 0x1f;
-                return (xec == 0x0 || xec == 0x8);
        } else if (m->cpuvendor == X86_VENDOR_INTEL) {
                /*
                 * Intel SDM Volume 3B - 15.9.2 Compound Error Codes
@@ -530,6 +527,17 @@ bool mce_is_memory_error(struct mce *m)
 }
 EXPORT_SYMBOL_GPL(mce_is_memory_error);
+static bool mce_is_correctable(struct mce *m)
+{
+        if (m->cpuvendor == X86_VENDOR_AMD && m->status & MCI_STATUS_DEFERRED)
+                return false;
+        if (m->status & MCI_STATUS_UC)
+                return false;
+        return true;
+}
 static bool cec_add_mce(struct mce *m)
 {
        if (!m)
@@ -537,7 +545,7 @@ static bool cec_add_mce(struct mce *m)
        /* We eat only correctable DRAM errors with usable addresses. */
        if (mce_is_memory_error(m) &&
-            !(m->status & MCI_STATUS_UC) &&
+            mce_is_correctable(m)  &&
            mce_usable_address(m))
                if (!cec_add_elem(m->addr >> PAGE_SHIFT))
                        return true;
@@ -582,7 +590,7 @@ static int srao_decode_notifier(struct notifier_block *nb, unsigned long val,
        if (mce_usable_address(mce) && (mce->severity == MCE_AO_SEVERITY)) {
                pfn = mce->addr >> PAGE_SHIFT;
-                memory_failure(pfn, MCE_VECTOR, 0);
+                memory_failure(pfn, 0);
        }
        return NOTIFY_OK;
@@ -1046,7 +1054,7 @@ static int do_memory_failure(struct mce *m)
        pr_err("Uncorrected hardware memory error in user-access at %llx", m->addr);
        if (!(m->mcgstatus & MCG_STATUS_RIPV))
                flags |= MF_MUST_KILL;
-        ret = memory_failure(m->addr >> PAGE_SHIFT, MCE_VECTOR, flags);
+        ret = memory_failure(m->addr >> PAGE_SHIFT, flags);
        if (ret)
                pr_err("Memory error not recovered");
        return ret;
@@ -1325,7 +1333,7 @@ out_ist:
 EXPORT_SYMBOL_GPL(do_machine_check);
 #ifndef CONFIG_MEMORY_FAILURE
-int memory_failure(unsigned long pfn, int vector, int flags)
+int memory_failure(unsigned long pfn, int flags)
 {
        /* mce_severity() should not hand us an ACTION_REQUIRED error */
        BUG_ON(flags & MF_ACTION_REQUIRED);
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index 486f640b02ef..0f32ad242324 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -110,6 +110,20 @@ const char *smca_get_long_name(enum smca_bank_types t)
 }
 EXPORT_SYMBOL_GPL(smca_get_long_name);
+static enum smca_bank_types smca_get_bank_type(struct mce *m)
+{
+        struct smca_bank *b;
+        if (m->bank >= N_SMCA_BANK_TYPES)
+                return N_SMCA_BANK_TYPES;
+        b = &smca_banks[m->bank];
+        if (!b->hwid)
+                return N_SMCA_BANK_TYPES;
+        return b->hwid->bank_type;
+}
 static struct smca_hwid smca_hwid_mcatypes[] = {
        /* { bank_type, hwid_mcatype, xec_bitmap } */
@@ -407,7 +421,9 @@ static void deferred_error_interrupt_enable(struct cpuinfo_x86 *c)
            (deferred_error_int_vector != amd_deferred_error_interrupt))
                deferred_error_int_vector = amd_deferred_error_interrupt;
-        low = (low & ~MASK_DEF_INT_TYPE) | DEF_INT_TYPE_APIC;
+        if (!mce_flags.smca)
+                low = (low & ~MASK_DEF_INT_TYPE) | DEF_INT_TYPE_APIC;
        wrmsr(MSR_CU_DEF_ERR, low, high);
 }
@@ -738,6 +754,17 @@ out_err:
 }
 EXPORT_SYMBOL_GPL(umc_normaddr_to_sysaddr);
+bool amd_mce_is_memory_error(struct mce *m)
+{
+        /* ErrCodeExt[20:16] */
+        u8 xec = (m->status >> 16) & 0x1f;
+        if (mce_flags.smca)
+                return smca_get_bank_type(m) == SMCA_UMC && xec == 0x0;
+        return m->bank == 4 && xec == 0x8;
+}
 static void __log_error(unsigned int bank, u64 status, u64 addr, u64 misc)
 {
        struct mce m;
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index e4fc595cd6ea..319dd65f98a2 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -560,7 +560,7 @@ static ssize_t pf_show(struct device *dev,
        return sprintf(buf, "0x%x\n", uci->cpu_sig.pf);
 }
-static DEVICE_ATTR(reload, 0200, NULL, reload_store);
+static DEVICE_ATTR_WO(reload);
 static DEVICE_ATTR(version, 0400, version_show, NULL);
 static DEVICE_ATTR(processor_flags, 0400, pf_show, NULL);
diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c
index d0e69769abfd..4075d2be5357 100644
--- a/arch/x86/kernel/cpu/scattered.c
+++ b/arch/x86/kernel/cpu/scattered.c
@@ -21,11 +21,10 @@ struct cpuid_bit {
 static const struct cpuid_bit cpuid_bits[] = {
        { X86_FEATURE_APERFMPERF,       CPUID_ECX,  0, 0x00000006, 0 },
        { X86_FEATURE_EPB,              CPUID_ECX,  3, 0x00000006, 0 },
-        { X86_FEATURE_AVX512_4VNNIW,    CPUID_EDX,  2, 0x00000007, 0 },
-        { X86_FEATURE_AVX512_4FMAPS,    CPUID_EDX,  3, 0x00000007, 0 },
        { X86_FEATURE_CAT_L3,           CPUID_EBX,  1, 0x00000010, 0 },
        { X86_FEATURE_CAT_L2,           CPUID_EBX,  2, 0x00000010, 0 },
        { X86_FEATURE_CDP_L3,           CPUID_ECX,  2, 0x00000010, 1 },
+        { X86_FEATURE_CDP_L2,           CPUID_ECX,  2, 0x00000010, 2 },
        { X86_FEATURE_MBA,              CPUID_EBX,  3, 0x00000010, 0 },
        { X86_FEATURE_HW_PSTATE,        CPUID_EDX,  7, 0x80000007, 0 },
        { X86_FEATURE_CPB,              CPUID_EDX,  9, 0x80000007, 0 },
diff --git a/arch/x86/kernel/devicetree.c b/arch/x86/kernel/devicetree.c
index 76e07698e6d1..25de5f6ca997 100644
--- a/arch/x86/kernel/devicetree.c
+++ b/arch/x86/kernel/devicetree.c
@@ -2,7 +2,6 @@
 /*
 * Architecture specific OF callbacks.
 */
-#include <linux/bootmem.h>
 #include <linux/export.h>
 #include <linux/io.h>
 #include <linux/interrupt.h>
@@ -39,11 +38,6 @@ void __init early_init_dt_add_memory_arch(u64 base, u64 size)
        BUG();
 }
-void * __init early_init_dt_alloc_memory_arch(u64 size, u64 align)
-{
-        return __alloc_bootmem(size, align, __pa(MAX_DMA_ADDRESS));
-}
 void __init add_dtb(u64 data)
 {
        initial_dtb = data + offsetof(struct setup_data, data);
diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
index afbecff161d1..a2d8a3908670 100644
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -109,7 +109,7 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
        struct stack_info stack_info = {0};
        unsigned long visit_mask = 0;
        int graph_idx = 0;
-        bool partial;
+        bool partial = false;
        printk("%sCall Trace:\n", log_lvl);
diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
index 1e82f787c160..bae0d32e327b 100644
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -243,7 +243,7 @@ static void __init intel_remapping_check(int num, int slot, int func)
 #define KB(x)   ((x) * 1024UL)
 #define MB(x)   (KB (KB (x)))
-static size_t __init i830_tseg_size(void)
+static resource_size_t __init i830_tseg_size(void)
 {
        u8 esmramc = read_pci_config_byte(0, 0, 0, I830_ESMRAMC);
@@ -256,7 +256,7 @@ static size_t __init i830_tseg_size(void)
                return KB(512);
 }
-static size_t __init i845_tseg_size(void)
+static resource_size_t __init i845_tseg_size(void)
 {
        u8 esmramc = read_pci_config_byte(0, 0, 0, I845_ESMRAMC);
        u8 tseg_size = esmramc & I845_TSEG_SIZE_MASK;
@@ -273,7 +273,7 @@ static size_t __init i845_tseg_size(void)
        return 0;
 }
-static size_t __init i85x_tseg_size(void)
+static resource_size_t __init i85x_tseg_size(void)
 {
        u8 esmramc = read_pci_config_byte(0, 0, 0, I85X_ESMRAMC);
@@ -283,12 +283,12 @@ static size_t __init i85x_tseg_size(void)
        return MB(1);
 }
-static size_t __init i830_mem_size(void)
+static resource_size_t __init i830_mem_size(void)
 {
        return read_pci_config_byte(0, 0, 0, I830_DRB3) * MB(32);
 }
-static size_t __init i85x_mem_size(void)
+static resource_size_t __init i85x_mem_size(void)
 {
        return read_pci_config_byte(0, 0, 1, I85X_DRB3) * MB(32);
 }
@@ -297,36 +297,36 @@ static size_t __init i85x_mem_size(void)
 * On 830/845/85x the stolen memory base isn't available in any
 * register. We need to calculate it as TOM-TSEG_SIZE-stolen_size.
 */
-static phys_addr_t __init i830_stolen_base(int num, int slot, int func,
+static resource_size_t __init i830_stolen_base(int num, int slot, int func,
-                                           size_t stolen_size)
+                                               resource_size_t stolen_size)
 {
-        return (phys_addr_t)i830_mem_size() - i830_tseg_size() - stolen_size;
+        return i830_mem_size() - i830_tseg_size() - stolen_size;
 }
-static phys_addr_t __init i845_stolen_base(int num, int slot, int func,
+static resource_size_t __init i845_stolen_base(int num, int slot, int func,
-                                           size_t stolen_size)
+                                               resource_size_t stolen_size)
 {
-        return (phys_addr_t)i830_mem_size() - i845_tseg_size() - stolen_size;
+        return i830_mem_size() - i845_tseg_size() - stolen_size;
 }
-static phys_addr_t __init i85x_stolen_base(int num, int slot, int func,
+static resource_size_t __init i85x_stolen_base(int num, int slot, int func,
-                                           size_t stolen_size)
+                                               resource_size_t stolen_size)
 {
-        return (phys_addr_t)i85x_mem_size() - i85x_tseg_size() - stolen_size;
+        return i85x_mem_size() - i85x_tseg_size() - stolen_size;
 }
-static phys_addr_t __init i865_stolen_base(int num, int slot, int func,
+static resource_size_t __init i865_stolen_base(int num, int slot, int func,
-                                           size_t stolen_size)
+                                               resource_size_t stolen_size)
 {
        u16 toud = 0;
        toud = read_pci_config_16(0, 0, 0, I865_TOUD);
-        return (phys_addr_t)(toud << 16) + i845_tseg_size();
+        return toud * KB(64) + i845_tseg_size();
 }
-static phys_addr_t __init gen3_stolen_base(int num, int slot, int func,
+static resource_size_t __init gen3_stolen_base(int num, int slot, int func,
-                                           size_t stolen_size)
+                                               resource_size_t stolen_size)
 {
        u32 bsm;
@@ -337,10 +337,10 @@ static phys_addr_t __init gen3_stolen_base(int num, int slot, int func,
         */
        bsm = read_pci_config(num, slot, func, INTEL_BSM);
-        return (phys_addr_t)bsm & INTEL_BSM_MASK;
+        return bsm & INTEL_BSM_MASK;
 }
-static size_t __init i830_stolen_size(int num, int slot, int func)
+static resource_size_t __init i830_stolen_size(int num, int slot, int func)
 {
        u16 gmch_ctrl;
        u16 gms;
@@ -361,7 +361,7 @@ static size_t __init i830_stolen_size(int num, int slot, int func)
        return 0;
 }
-static size_t __init gen3_stolen_size(int num, int slot, int func)
+static resource_size_t __init gen3_stolen_size(int num, int slot, int func)
 {
        u16 gmch_ctrl;
        u16 gms;
@@ -390,7 +390,7 @@ static size_t __init gen3_stolen_size(int num, int slot, int func)
        return 0;
 }
-static size_t __init gen6_stolen_size(int num, int slot, int func)
+static resource_size_t __init gen6_stolen_size(int num, int slot, int func)
 {
        u16 gmch_ctrl;
        u16 gms;
@@ -398,10 +398,10 @@ static size_t __init gen6_stolen_size(int num, int slot, int func)
        gmch_ctrl = read_pci_config_16(num, slot, func, SNB_GMCH_CTRL);
        gms = (gmch_ctrl >> SNB_GMCH_GMS_SHIFT) & SNB_GMCH_GMS_MASK;
-        return (size_t)gms * MB(32);
+        return gms * MB(32);
 }
-static size_t __init gen8_stolen_size(int num, int slot, int func)
+static resource_size_t __init gen8_stolen_size(int num, int slot, int func)
 {
        u16 gmch_ctrl;
        u16 gms;
@@ -409,10 +409,10 @@ static size_t __init gen8_stolen_size(int num, int slot, int func)
        gmch_ctrl = read_pci_config_16(num, slot, func, SNB_GMCH_CTRL);
        gms = (gmch_ctrl >> BDW_GMCH_GMS_SHIFT) & BDW_GMCH_GMS_MASK;
-        return (size_t)gms * MB(32);
+        return gms * MB(32);
 }
-static size_t __init chv_stolen_size(int num, int slot, int func)
+static resource_size_t __init chv_stolen_size(int num, int slot, int func)
 {
        u16 gmch_ctrl;
        u16 gms;
@@ -426,14 +426,14 @@ static size_t __init chv_stolen_size(int num, int slot, int func)
         * 0x17 to 0x1d: 4MB increments start at 36MB
         */
        if (gms < 0x11)
-                return (size_t)gms * MB(32);
+                return gms * MB(32);
        else if (gms < 0x17)
-                return (size_t)(gms - 0x11 + 2) * MB(4);
+                return (gms - 0x11) * MB(4) + MB(8);
        else
-                return (size_t)(gms - 0x17 + 9) * MB(4);
+                return (gms - 0x17) * MB(4) + MB(36);
 }
-static size_t __init gen9_stolen_size(int num, int slot, int func)
+static resource_size_t __init gen9_stolen_size(int num, int slot, int func)
 {
        u16 gmch_ctrl;
        u16 gms;
@@ -444,14 +444,15 @@ static size_t __init gen9_stolen_size(int num, int slot, int func)
        /* 0x0  to 0xef: 32MB increments starting at 0MB */
        /* 0xf0 to 0xfe: 4MB increments starting at 4MB */
        if (gms < 0xf0)
-                return (size_t)gms * MB(32);
+                return gms * MB(32);
        else
-                return (size_t)(gms - 0xf0 + 1) * MB(4);
+                return (gms - 0xf0) * MB(4) + MB(4);
 }
 struct intel_early_ops {
-        size_t (*stolen_size)(int num, int slot, int func);
+        resource_size_t (*stolen_size)(int num, int slot, int func);
-        phys_addr_t (*stolen_base)(int num, int slot, int func, size_t size);
+        resource_size_t (*stolen_base)(int num, int slot, int func,
+                                       resource_size_t size);
 };
 static const struct intel_early_ops i830_early_ops __initconst = {
@@ -527,16 +528,20 @@ static const struct pci_device_id intel_early_ids[] __initconst = {
        INTEL_SKL_IDS(&gen9_early_ops),
        INTEL_BXT_IDS(&gen9_early_ops),
        INTEL_KBL_IDS(&gen9_early_ops),
+        INTEL_CFL_IDS(&gen9_early_ops),
        INTEL_GLK_IDS(&gen9_early_ops),
        INTEL_CNL_IDS(&gen9_early_ops),
 };
+struct resource intel_graphics_stolen_res __ro_after_init = DEFINE_RES_MEM(0, 0);
+EXPORT_SYMBOL(intel_graphics_stolen_res);
 static void __init
 intel_graphics_stolen(int num, int slot, int func,
                      const struct intel_early_ops *early_ops)
 {
-        phys_addr_t base, end;
+        resource_size_t base, size;
-        size_t size;
+        resource_size_t end;
        size = early_ops->stolen_size(num, slot, func);
        base = early_ops->stolen_base(num, slot, func, size);
@@ -545,8 +550,12 @@ intel_graphics_stolen(int num, int slot, int func,
                return;
        end = base + size - 1;
-        printk(KERN_INFO "Reserving Intel graphics memory at %pa-%pa\n",
-               &base, &end);
+        intel_graphics_stolen_res.start = base;
+        intel_graphics_stolen_res.end = end;
+        printk(KERN_INFO "Reserving Intel graphics memory at %pR\n",
+               &intel_graphics_stolen_res);
        /* Mark this space as reserved */
        e820__range_add(base, size, E820_TYPE_RESERVED);
diff --git a/arch/x86/kernel/itmt.c b/arch/x86/kernel/itmt.c
index f73f475d0573..d177940aa090 100644
--- a/arch/x86/kernel/itmt.c
+++ b/arch/x86/kernel/itmt.c
@@ -24,7 +24,6 @@
 #include <linux/cpumask.h>
 #include <linux/cpuset.h>
 #include <linux/mutex.h>
-#include <linux/sched.h>
 #include <linux/sysctl.h>
 #include <linux/nodemask.h>
diff --git a/arch/x86/kernel/jailhouse.c b/arch/x86/kernel/jailhouse.c
new file mode 100644
index 000000000000..b68fd895235a
--- /dev/null
+++ b/arch/x86/kernel/jailhouse.c
@@ -0,0 +1,211 @@
+// SPDX-License-Identifier: GPL2.0
+/*
+ * Jailhouse paravirt_ops implementation
+ *
+ * Copyright (c) Siemens AG, 2015-2017
+ *
+ * Authors:
+ *  Jan Kiszka <jan.kiszka@siemens.com>
+ */
+#include <linux/acpi_pmtmr.h>
+#include <linux/kernel.h>
+#include <linux/reboot.h>
+#include <asm/apic.h>
+#include <asm/cpu.h>
+#include <asm/hypervisor.h>
+#include <asm/i8259.h>
+#include <asm/irqdomain.h>
+#include <asm/pci_x86.h>
+#include <asm/reboot.h>
+#include <asm/setup.h>
+static __initdata struct jailhouse_setup_data setup_data;
+static unsigned int precalibrated_tsc_khz;
+static uint32_t jailhouse_cpuid_base(void)
+{
+        if (boot_cpu_data.cpuid_level < 0 ||
+            !boot_cpu_has(X86_FEATURE_HYPERVISOR))
+                return 0;
+        return hypervisor_cpuid_base("Jailhouse\0\0\0", 0);
+}
+static uint32_t __init jailhouse_detect(void)
+{
+        return jailhouse_cpuid_base();
+}
+static void jailhouse_get_wallclock(struct timespec *now)
+{
+        memset(now, 0, sizeof(*now));
+}
+static void __init jailhouse_timer_init(void)
+{
+        lapic_timer_frequency = setup_data.apic_khz * (1000 / HZ);
+}
+static unsigned long jailhouse_get_tsc(void)
+{
+        return precalibrated_tsc_khz;
+}
+static void __init jailhouse_x2apic_init(void)
+{
+#ifdef CONFIG_X86_X2APIC
+        if (!x2apic_enabled())
+                return;
+        /*
+         * We do not have access to IR inside Jailhouse non-root cells.  So
+         * we have to run in physical mode.
+         */
+        x2apic_phys = 1;
+        /*
+         * This will trigger the switch to apic_x2apic_phys.  Empty OEM IDs
+         * ensure that only this APIC driver picks up the call.
+         */
+        default_acpi_madt_oem_check("", "");
+#endif
+}
+static void __init jailhouse_get_smp_config(unsigned int early)
+{
+        struct ioapic_domain_cfg ioapic_cfg = {
+                .type = IOAPIC_DOMAIN_STRICT,
+                .ops = &mp_ioapic_irqdomain_ops,
+        };
+        struct mpc_intsrc mp_irq = {
+                .type = MP_INTSRC,
+                .irqtype = mp_INT,
+                .irqflag = MP_IRQPOL_ACTIVE_HIGH | MP_IRQTRIG_EDGE,
+        };
+        unsigned int cpu;
+        jailhouse_x2apic_init();
+        register_lapic_address(0xfee00000);
+        for (cpu = 0; cpu < setup_data.num_cpus; cpu++) {
+                generic_processor_info(setup_data.cpu_ids[cpu],
+                                       boot_cpu_apic_version);
+        }
+        smp_found_config = 1;
+        if (setup_data.standard_ioapic) {
+                mp_register_ioapic(0, 0xfec00000, gsi_top, &ioapic_cfg);
+                /* Register 1:1 mapping for legacy UART IRQs 3 and 4 */
+                mp_irq.srcbusirq = mp_irq.dstirq = 3;
+                mp_save_irq(&mp_irq);
+                mp_irq.srcbusirq = mp_irq.dstirq = 4;
+                mp_save_irq(&mp_irq);
+        }
+}
+static void jailhouse_no_restart(void)
+{
+        pr_notice("Jailhouse: Restart not supported, halting\n");
+        machine_halt();
+}
+static int __init jailhouse_pci_arch_init(void)
+{
+        pci_direct_init(1);
+        /*
+         * There are no bridges on the virtual PCI root bus under Jailhouse,
+         * thus no other way to discover all devices than a full scan.
+         * Respect any overrides via the command line, though.
+         */
+        if (pcibios_last_bus < 0)
+                pcibios_last_bus = 0xff;
+        return 0;
+}
+static void __init jailhouse_init_platform(void)
+{
+        u64 pa_data = boot_params.hdr.setup_data;
+        struct setup_data header;
+        void *mapping;
+        x86_init.irqs.pre_vector_init   = x86_init_noop;
+        x86_init.timers.timer_init      = jailhouse_timer_init;
+        x86_init.mpparse.get_smp_config = jailhouse_get_smp_config;
+        x86_init.pci.arch_init          = jailhouse_pci_arch_init;
+        x86_platform.calibrate_cpu      = jailhouse_get_tsc;
+        x86_platform.calibrate_tsc      = jailhouse_get_tsc;
+        x86_platform.get_wallclock      = jailhouse_get_wallclock;
+        x86_platform.legacy.rtc         = 0;
+        x86_platform.legacy.warm_reset  = 0;
+        x86_platform.legacy.i8042       = X86_LEGACY_I8042_PLATFORM_ABSENT;
+        legacy_pic                      = &null_legacy_pic;
+        machine_ops.emergency_restart   = jailhouse_no_restart;
+        while (pa_data) {
+                mapping = early_memremap(pa_data, sizeof(header));
+                memcpy(&header, mapping, sizeof(header));
+                early_memunmap(mapping, sizeof(header));
+                if (header.type == SETUP_JAILHOUSE &&
+                    header.len >= sizeof(setup_data)) {
+                        pa_data += offsetof(struct setup_data, data);
+                        mapping = early_memremap(pa_data, sizeof(setup_data));
+                        memcpy(&setup_data, mapping, sizeof(setup_data));
+                        early_memunmap(mapping, sizeof(setup_data));
+                        break;
+                }
+                pa_data = header.next;
+        }
+        if (!pa_data)
+                panic("Jailhouse: No valid setup data found");
+        if (setup_data.compatible_version > JAILHOUSE_SETUP_REQUIRED_VERSION)
+                panic("Jailhouse: Unsupported setup data structure");
+        pmtmr_ioport = setup_data.pm_timer_address;
+        pr_debug("Jailhouse: PM-Timer IO Port: %#x\n", pmtmr_ioport);
+        precalibrated_tsc_khz = setup_data.tsc_khz;
+        setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ);
+        pci_probe = 0;
+        /*
+         * Avoid that the kernel complains about missing ACPI tables - there
+         * are none in a non-root cell.
+         */
+        disable_acpi();
+}
+bool jailhouse_paravirt(void)
+{
+        return jailhouse_cpuid_base() != 0;
+}
+static bool jailhouse_x2apic_available(void)
+{
+        /*
+         * The x2APIC is only available if the root cell enabled it. Jailhouse
+         * does not support switching between xAPIC and x2APIC.
+         */
+        return x2apic_enabled();
+}
+const struct hypervisor_x86 x86_hyper_jailhouse __refconst = {
+        .name                   = "Jailhouse",
+        .detect                 = jailhouse_detect,
+        .init.init_platform     = jailhouse_init_platform,
+        .init.x2apic_available  = jailhouse_x2apic_available,
+};
diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
index 3a4b12809ab5..27d0a1712663 100644
--- a/arch/x86/kernel/mpparse.c
+++ b/arch/x86/kernel/mpparse.c
@@ -281,7 +281,7 @@ static void __init construct_default_ioirq_mptable(int mpc_default_type)
        int ELCR_fallback = 0;
        intsrc.type = MP_INTSRC;
-        intsrc.irqflag = 0;     /* conforming */
+        intsrc.irqflag = MP_IRQTRIG_DEFAULT | MP_IRQPOL_DEFAULT;
        intsrc.srcbus = 0;
        intsrc.dstapic = mpc_ioapic_id(0);
@@ -324,10 +324,13 @@ static void __init construct_default_ioirq_mptable(int mpc_default_type)
                         *  copy that information over to the MP table in the
                         *  irqflag field (level sensitive, active high polarity).
                         */
-                        if (ELCR_trigger(i))
+                        if (ELCR_trigger(i)) {
-                                intsrc.irqflag = 13;
+                                intsrc.irqflag = MP_IRQTRIG_LEVEL |
-                        else
+                                                 MP_IRQPOL_ACTIVE_HIGH;
-                                intsrc.irqflag = 0;
+                        } else {
+                                intsrc.irqflag = MP_IRQTRIG_DEFAULT |
+                                                 MP_IRQPOL_DEFAULT;
+                        }
                }
                intsrc.srcbusirq = i;
@@ -419,7 +422,7 @@ static inline void __init construct_default_ISA_mptable(int mpc_default_type)
        construct_ioapic_table(mpc_default_type);
        lintsrc.type = MP_LINTSRC;
-        lintsrc.irqflag = 0;            /* conforming */
+        lintsrc.irqflag = MP_IRQTRIG_DEFAULT | MP_IRQPOL_DEFAULT;
        lintsrc.srcbusid = 0;
        lintsrc.srcbusirq = 0;
        lintsrc.destapic = MP_APIC_ALL;
@@ -664,7 +667,7 @@ static int  __init get_MP_intsrc_index(struct mpc_intsrc *m)
        if (m->irqtype != mp_INT)
                return 0;
-        if (m->irqflag != 0x0f)
+        if (m->irqflag != (MP_IRQTRIG_LEVEL | MP_IRQPOL_ACTIVE_LOW))
                return 0;
        /* not legacy */
@@ -673,7 +676,8 @@ static int  __init get_MP_intsrc_index(struct mpc_intsrc *m)
                if (mp_irqs[i].irqtype != mp_INT)
                        continue;
-                if (mp_irqs[i].irqflag != 0x0f)
+                if (mp_irqs[i].irqflag != (MP_IRQTRIG_LEVEL |
+                                           MP_IRQPOL_ACTIVE_LOW))
                        continue;
                if (mp_irqs[i].srcbus != m->srcbus)
@@ -784,7 +788,8 @@ static int  __init replace_intsrc_all(struct mpc_table *mpc,
                if (mp_irqs[i].irqtype != mp_INT)
                        continue;
-                if (mp_irqs[i].irqflag != 0x0f)
+                if (mp_irqs[i].irqflag != (MP_IRQTRIG_LEVEL |
+                                           MP_IRQPOL_ACTIVE_LOW))
                        continue;
                if (nr_m_spare > 0) {
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index 599d7462eccc..df7ab02f959f 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-#include <linux/dma-mapping.h>
+#include <linux/dma-direct.h>
 #include <linux/dma-debug.h>
 #include <linux/dmar.h>
 #include <linux/export.h>
@@ -87,7 +87,6 @@ void *dma_generic_alloc_coherent(struct device *dev, size_t size,
        dma_mask = dma_alloc_coherent_mask(dev, flag);
-        flag &= ~__GFP_ZERO;
 again:
        page = NULL;
        /* CMA can be used only in the context which permits sleeping */
@@ -139,7 +138,6 @@ bool arch_dma_alloc_attrs(struct device **dev, gfp_t *gfp)
        if (!*dev)
                *dev = &x86_dma_fallback_dev;
-        *gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
        *gfp = dma_alloc_coherent_gfp_flags(*dev, *gfp);
        if (!is_device_dma_capable(*dev))
@@ -217,7 +215,7 @@ static __init int iommu_setup(char *p)
 }
 early_param("iommu", iommu_setup);
-int x86_dma_supported(struct device *dev, u64 mask)
+int arch_dma_supported(struct device *dev, u64 mask)
 {
 #ifdef CONFIG_PCI
        if (mask > 0xffffffff && forbid_dac > 0) {
@@ -226,12 +224,6 @@ int x86_dma_supported(struct device *dev, u64 mask)
        }
 #endif
-        /* Copied from i386. Doesn't make much sense, because it will
-           only work for pci_alloc_coherent.
-           The caller just has to use GFP_DMA in this case. */
-        if (mask < DMA_BIT_MASK(24))
-                return 0;
        /* Tell the device to use SAC when IOMMU force is on.  This
           allows the driver to use cheaper accesses in some cases.
@@ -251,6 +243,17 @@ int x86_dma_supported(struct device *dev, u64 mask)
        return 1;
 }
+EXPORT_SYMBOL(arch_dma_supported);
+int x86_dma_supported(struct device *dev, u64 mask)
+{
+        /* Copied from i386. Doesn't make much sense, because it will
+           only work for pci_alloc_coherent.
+           The caller just has to use GFP_DMA in this case. */
+        if (mask < DMA_BIT_MASK(24))
+                return 0;
+        return 1;
+}
 static int __init pci_iommu_init(void)
 {
diff --git a/arch/x86/kernel/pci-nommu.c b/arch/x86/kernel/pci-nommu.c
index b0caae27e1b7..618285e475c6 100644
--- a/arch/x86/kernel/pci-nommu.c
+++ b/arch/x86/kernel/pci-nommu.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Fallback functions when the main IOMMU code is not compiled in. This
   code is roughly equivalent to i386. */
-#include <linux/dma-mapping.h>
+#include <linux/dma-direct.h>
 #include <linux/scatterlist.h>
 #include <linux/string.h>
 #include <linux/gfp.h>
diff --git a/arch/x86/kernel/pci-swiotlb.c b/arch/x86/kernel/pci-swiotlb.c
index 53bd05ea90d8..0ee0f8f34251 100644
--- a/arch/x86/kernel/pci-swiotlb.c
+++ b/arch/x86/kernel/pci-swiotlb.c
@@ -6,7 +6,7 @@
 #include <linux/init.h>
 #include <linux/swiotlb.h>
 #include <linux/bootmem.h>
-#include <linux/dma-mapping.h>
+#include <linux/dma-direct.h>
 #include <linux/mem_encrypt.h>
 #include <asm/iommu.h>
@@ -48,7 +48,7 @@ void x86_swiotlb_free_coherent(struct device *dev, size_t size,
                dma_generic_free_coherent(dev, size, vaddr, dma_addr, attrs);
 }
-static const struct dma_map_ops swiotlb_dma_ops = {
+static const struct dma_map_ops x86_swiotlb_dma_ops = {
        .mapping_error = swiotlb_dma_mapping_error,
        .alloc = x86_swiotlb_alloc_coherent,
        .free = x86_swiotlb_free_coherent,
@@ -112,7 +112,7 @@ void __init pci_swiotlb_init(void)
 {
        if (swiotlb) {
                swiotlb_init(0);
-                dma_ops = &swiotlb_dma_ops;
+                dma_ops = &x86_swiotlb_dma_ops;
        }
 }
@@ -120,7 +120,7 @@ void __init pci_swiotlb_late_init(void)
 {
        /* An IOMMU turned us off. */
        if (!swiotlb)
-                swiotlb_free();
+                swiotlb_exit();
        else {
                printk(KERN_INFO "PCI-DMA: "
                       "Using software bounce buffering for IO (SWIOTLB)\n");
diff --git a/arch/x86/kernel/platform-quirks.c b/arch/x86/kernel/platform-quirks.c
index 39a59299bfa0..235fe6008ac8 100644
--- a/arch/x86/kernel/platform-quirks.c
+++ b/arch/x86/kernel/platform-quirks.c
@@ -9,6 +9,7 @@ void __init x86_early_init_platform_quirks(void)
 {
        x86_platform.legacy.i8042 = X86_LEGACY_I8042_EXPECTED_PRESENT;
        x86_platform.legacy.rtc = 1;
+        x86_platform.legacy.warm_reset = 1;
        x86_platform.legacy.reserve_bios_regions = 0;
        x86_platform.legacy.devices.pnpbios = 1;
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index cb368c2a22ab..03408b942adb 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -21,7 +21,6 @@
 #include <linux/dmi.h>
 #include <linux/utsname.h>
 #include <linux/stackprotector.h>
-#include <linux/tick.h>
 #include <linux/cpuidle.h>
 #include <trace/events/power.h>
 #include <linux/hw_breakpoint.h>
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index c75466232016..9eb448c7859d 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -557,7 +557,7 @@ static void __set_personality_x32(void)
         * Pretend to come from a x32 execve.
         */
        task_pt_regs(current)->orig_ax = __NR_x32_execve | __X32_SYSCALL_BIT;
-        current->thread.status &= ~TS_COMPAT;
+        current_thread_info()->status &= ~TS_COMPAT;
 #endif
 }
@@ -571,7 +571,7 @@ static void __set_personality_ia32(void)
        current->personality |= force_personality32;
        /* Prepare the first "return" to user space */
        task_pt_regs(current)->orig_ax = __NR_ia32_execve;
-        current->thread.status |= TS_COMPAT;
+        current_thread_info()->status |= TS_COMPAT;
 #endif
 }
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index f37d18124648..ed5c4cdf0a34 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -935,7 +935,7 @@ static int putreg32(struct task_struct *child, unsigned regno, u32 value)
                 */
                regs->orig_ax = value;
                if (syscall_get_nr(child, regs) >= 0)
-                        child->thread.status |= TS_I386_REGS_POKED;
+                        child->thread_info.status |= TS_I386_REGS_POKED;
                break;
        case offsetof(struct user32, regs.eflags):
diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
index 307d3bac5f04..11eda21eb697 100644
--- a/arch/x86/kernel/relocate_kernel_64.S
+++ b/arch/x86/kernel/relocate_kernel_64.S
@@ -68,6 +68,9 @@ relocate_kernel:
        movq    %cr4, %rax
        movq    %rax, CR4(%r11)
+        /* Save CR4. Required to enable the right paging mode later. */
+        movq    %rax, %r13
        /* zero out flags, and disable interrupts */
        pushq $0
        popfq
@@ -126,8 +129,13 @@ identity_mapped:
        /*
         * Set cr4 to a known state:
         *  - physical address extension enabled
+         *  - 5-level paging, if it was enabled before
         */
        movl    $X86_CR4_PAE, %eax
+        testq   $X86_CR4_LA57, %r13
+        jz      1f
+        orl     $X86_CR4_LA57, %eax
+1:
        movq    %rax, %cr4
        jmp 1f
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 68d7ab81c62f..1ae67e982af7 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -114,7 +114,6 @@
 #include <asm/alternative.h>
 #include <asm/prom.h>
 #include <asm/microcode.h>
-#include <asm/mmu_context.h>
 #include <asm/kaslr.h>
 #include <asm/unwind.h>
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index b9e00e8f1c9b..4cdc0b27ec82 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -787,7 +787,7 @@ static inline unsigned long get_nr_restart_syscall(const struct pt_regs *regs)
         * than the tracee.
         */
 #ifdef CONFIG_IA32_EMULATION
-        if (current->thread.status & (TS_COMPAT|TS_I386_REGS_POKED))
+        if (current_thread_info()->status & (TS_COMPAT|TS_I386_REGS_POKED))
                return __NR_ia32_restart_syscall;
 #endif
 #ifdef CONFIG_X86_X32_ABI
diff --git a/arch/x86/kernel/signal_compat.c b/arch/x86/kernel/signal_compat.c
index 8c6da1a643da..ac057f9b0763 100644
--- a/arch/x86/kernel/signal_compat.c
+++ b/arch/x86/kernel/signal_compat.c
@@ -25,8 +25,8 @@ static inline void signal_compat_build_tests(void)
         * limits also have to look at this code.  Make sure any
         * new fields are handled in copy_siginfo_to_user32()!
         */
-        BUILD_BUG_ON(NSIGILL  != 8);
+        BUILD_BUG_ON(NSIGILL  != 11);
-        BUILD_BUG_ON(NSIGFPE  != 8);
+        BUILD_BUG_ON(NSIGFPE  != 13);
        BUILD_BUG_ON(NSIGSEGV != 4);
        BUILD_BUG_ON(NSIGBUS  != 5);
        BUILD_BUG_ON(NSIGTRAP != 4);
@@ -64,7 +64,7 @@ static inline void signal_compat_build_tests(void)
        CHECK_SI_SIZE   (_kill, 2*sizeof(int));
        CHECK_CSI_OFFSET(_timer);
-        CHECK_CSI_SIZE  (_timer, 5*sizeof(int));
+        CHECK_CSI_SIZE  (_timer, 3*sizeof(int));
        CHECK_SI_SIZE   (_timer, 6*sizeof(int));
        CHECK_CSI_OFFSET(_rt);
@@ -75,9 +75,11 @@ static inline void signal_compat_build_tests(void)
        CHECK_CSI_SIZE  (_sigchld, 5*sizeof(int));
        CHECK_SI_SIZE   (_sigchld, 8*sizeof(int));
+#ifdef CONFIG_X86_X32_ABI
        CHECK_CSI_OFFSET(_sigchld_x32);
        CHECK_CSI_SIZE  (_sigchld_x32, 7*sizeof(int));
        /* no _sigchld_x32 in the generic siginfo_t */
+#endif
        CHECK_CSI_OFFSET(_sigfault);
        CHECK_CSI_SIZE  (_sigfault, 4*sizeof(int));
@@ -96,6 +98,8 @@ static inline void signal_compat_build_tests(void)
 void sigaction_compat_abi(struct k_sigaction *act, struct k_sigaction *oact)
 {
+        signal_compat_build_tests();
        /* Don't leak in-kernel non-uapi flags to user-space */
        if (oact)
                oact->sa.sa_flags &= ~(SA_IA32_ABI | SA_X32_ABI);
@@ -111,116 +115,3 @@ void sigaction_compat_abi(struct k_sigaction *act, struct k_sigaction *oact)
        if (in_x32_syscall())
                act->sa.sa_flags |= SA_X32_ABI;
 }
-int __copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from,
-                bool x32_ABI)
-{
-        int err = 0;
-        signal_compat_build_tests();
-        if (!access_ok(VERIFY_WRITE, to, sizeof(compat_siginfo_t)))
-                return -EFAULT;
-        put_user_try {
-                /* If you change siginfo_t structure, please make sure that
-                   this code is fixed accordingly.
-                   It should never copy any pad contained in the structure
-                   to avoid security leaks, but must copy the generic
-                   3 ints plus the relevant union member.  */
-                put_user_ex(from->si_signo, &to->si_signo);
-                put_user_ex(from->si_errno, &to->si_errno);
-                put_user_ex(from->si_code, &to->si_code);
-                if (from->si_code < 0) {
-                        put_user_ex(from->si_pid, &to->si_pid);
-                        put_user_ex(from->si_uid, &to->si_uid);
-                        put_user_ex(ptr_to_compat(from->si_ptr), &to->si_ptr);
-                } else {
-                        /*
-                         * First 32bits of unions are always present:
-                         * si_pid === si_band === si_tid === si_addr(LS half)
-                         */
-                        put_user_ex(from->_sifields._pad[0],
-                                          &to->_sifields._pad[0]);
-                        switch (siginfo_layout(from->si_signo, from->si_code)) {
-                        case SIL_FAULT:
-                                if (from->si_signo == SIGBUS &&
-                                    (from->si_code == BUS_MCEERR_AR ||
-                                     from->si_code == BUS_MCEERR_AO))
-                                        put_user_ex(from->si_addr_lsb, &to->si_addr_lsb);
-                                if (from->si_signo == SIGSEGV) {
-                                        if (from->si_code == SEGV_BNDERR) {
-                                                compat_uptr_t lower = (unsigned long)from->si_lower;
-                                                compat_uptr_t upper = (unsigned long)from->si_upper;
-                                                put_user_ex(lower, &to->si_lower);
-                                                put_user_ex(upper, &to->si_upper);
-                                        }
-                                        if (from->si_code == SEGV_PKUERR)
-                                                put_user_ex(from->si_pkey, &to->si_pkey);
-                                }
-                                break;
-                        case SIL_SYS:
-                                put_user_ex(from->si_syscall, &to->si_syscall);
-                                put_user_ex(from->si_arch, &to->si_arch);
-                                break;
-                        case SIL_CHLD:
-                                if (!x32_ABI) {
-                                        put_user_ex(from->si_utime, &to->si_utime);
-                                        put_user_ex(from->si_stime, &to->si_stime);
-                                } else {
-                                        put_user_ex(from->si_utime, &to->_sifields._sigchld_x32._utime);
-                                        put_user_ex(from->si_stime, &to->_sifields._sigchld_x32._stime);
-                                }
-                                put_user_ex(from->si_status, &to->si_status);
-                                /* FALL THROUGH */
-                        case SIL_KILL:
-                                put_user_ex(from->si_uid, &to->si_uid);
-                                break;
-                        case SIL_POLL:
-                                put_user_ex(from->si_fd, &to->si_fd);
-                                break;
-                        case SIL_TIMER:
-                                put_user_ex(from->si_overrun, &to->si_overrun);
-                                put_user_ex(ptr_to_compat(from->si_ptr),
-                                            &to->si_ptr);
-                                break;
-                        case SIL_RT:
-                                put_user_ex(from->si_uid, &to->si_uid);
-                                put_user_ex(from->si_int, &to->si_int);
-                                break;
-                        }
-                }
-        } put_user_catch(err);
-        return err;
-}
-/* from syscall's path, where we know the ABI */
-int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
-{
-        return __copy_siginfo_to_user32(to, from, in_x32_syscall());
-}
-int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
-{
-        int err = 0;
-        u32 ptr32;
-        if (!access_ok(VERIFY_READ, from, sizeof(compat_siginfo_t)))
-                return -EFAULT;
-        get_user_try {
-                get_user_ex(to->si_signo, &from->si_signo);
-                get_user_ex(to->si_errno, &from->si_errno);
-                get_user_ex(to->si_code, &from->si_code);
-                get_user_ex(to->si_pid, &from->si_pid);
-                get_user_ex(to->si_uid, &from->si_uid);
-                get_user_ex(ptr32, &from->si_ptr);
-                to->si_ptr = compat_ptr(ptr32);
-        } get_user_catch(err);
-        return err;
-}
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index ed556d50d7ed..6f27facbaa9b 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -75,7 +75,6 @@
 #include <asm/uv/uv.h>
 #include <linux/mc146818rtc.h>
 #include <asm/i8259.h>
-#include <asm/realmode.h>
 #include <asm/misc.h>
 #include <asm/qspinlock.h>
@@ -934,7 +933,7 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle,
         * the targeted processor.
         */
-        if (get_uv_system_type() != UV_NON_UNIQUE_APIC) {
+        if (x86_platform.legacy.warm_reset) {
                pr_debug("Setting warm reset code and vector.\n");
@@ -1006,7 +1005,7 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle,
        /* mark "stuck" area as not stuck */
        *trampoline_status = 0;
-        if (get_uv_system_type() != UV_NON_UNIQUE_APIC) {
+        if (x86_platform.legacy.warm_reset) {
                /*
                 * Cleanup possible dangling ends...
                 */
diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c
index 749d189f8cd4..774ebafa97c4 100644
--- a/arch/x86/kernel/time.c
+++ b/arch/x86/kernel/time.c
@@ -69,9 +69,12 @@ static struct irqaction irq0  = {
 static void __init setup_default_timer_irq(void)
 {
-        if (!nr_legacy_irqs())
+        /*
-                return;
+         * Unconditionally register the legacy timer; even without legacy
-        setup_irq(0, &irq0);
+         * PIC/PIT we need this for the HPET0 in legacy replacement mode.
+         */
+        if (setup_irq(0, &irq0))
+                pr_info("Failed to register legacy timer interrupt\n");
 }
 /* Default timer init function */
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index e169e85db434..fb4302738410 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -25,6 +25,7 @@
 #include <asm/geode.h>
 #include <asm/apic.h>
 #include <asm/intel-family.h>
+#include <asm/i8259.h>
 unsigned int __read_mostly cpu_khz;     /* TSC clocks / usec, not used here */
 EXPORT_SYMBOL(cpu_khz);
@@ -363,6 +364,20 @@ static unsigned long pit_calibrate_tsc(u32 latch, unsigned long ms, int loopmin)
        unsigned long tscmin, tscmax;
        int pitcnt;
+        if (!has_legacy_pic()) {
+                /*
+                 * Relies on tsc_early_delay_calibrate() to have given us semi
+                 * usable udelay(), wait for the same 50ms we would have with
+                 * the PIT loop below.
+                 */
+                udelay(10 * USEC_PER_MSEC);
+                udelay(10 * USEC_PER_MSEC);
+                udelay(10 * USEC_PER_MSEC);
+                udelay(10 * USEC_PER_MSEC);
+                udelay(10 * USEC_PER_MSEC);
+                return ULONG_MAX;
+        }
        /* Set the Gate high, disable speaker */
        outb((inb(0x61) & ~0x02) | 0x01, 0x61);
@@ -487,6 +502,9 @@ static unsigned long quick_pit_calibrate(void)
        u64 tsc, delta;
        unsigned long d1, d2;
+        if (!has_legacy_pic())
+                return 0;
        /* Set the Gate high, disable speaker */
        outb((inb(0x61) & ~0x02) | 0x01, 0x61);
@@ -988,8 +1006,6 @@ static void __init detect_art(void)
 /* clocksource code */
-static struct clocksource clocksource_tsc;
 static void tsc_resume(struct clocksource *cs)
 {
        tsc_verify_tsc_adjust(true);
@@ -1040,12 +1056,31 @@ static void tsc_cs_tick_stable(struct clocksource *cs)
 /*
 * .mask MUST be CLOCKSOURCE_MASK(64). See comment above read_tsc()
 */
+static struct clocksource clocksource_tsc_early = {
+        .name                   = "tsc-early",
+        .rating                 = 299,
+        .read                   = read_tsc,
+        .mask                   = CLOCKSOURCE_MASK(64),
+        .flags                  = CLOCK_SOURCE_IS_CONTINUOUS |
+                                  CLOCK_SOURCE_MUST_VERIFY,
+        .archdata               = { .vclock_mode = VCLOCK_TSC },
+        .resume                 = tsc_resume,
+        .mark_unstable          = tsc_cs_mark_unstable,
+        .tick_stable            = tsc_cs_tick_stable,
+};
+/*
+ * Must mark VALID_FOR_HRES early such that when we unregister tsc_early
+ * this one will immediately take over. We will only register if TSC has
+ * been found good.
+ */
 static struct clocksource clocksource_tsc = {
        .name                   = "tsc",
        .rating                 = 300,
        .read                   = read_tsc,
        .mask                   = CLOCKSOURCE_MASK(64),
        .flags                  = CLOCK_SOURCE_IS_CONTINUOUS |
+                                  CLOCK_SOURCE_VALID_FOR_HRES |
                                  CLOCK_SOURCE_MUST_VERIFY,
        .archdata               = { .vclock_mode = VCLOCK_TSC },
        .resume                 = tsc_resume,
@@ -1169,8 +1204,8 @@ static void tsc_refine_calibration_work(struct work_struct *work)
        int cpu;
        /* Don't bother refining TSC on unstable systems */
-        if (check_tsc_unstable())
+        if (tsc_unstable)
-                goto out;
+                return;
        /*
         * Since the work is started early in boot, we may be
@@ -1222,9 +1257,13 @@ static void tsc_refine_calibration_work(struct work_struct *work)
                set_cyc2ns_scale(tsc_khz, cpu, tsc_stop);
 out:
+        if (tsc_unstable)
+                return;
        if (boot_cpu_has(X86_FEATURE_ART))
                art_related_clocksource = &clocksource_tsc;
        clocksource_register_khz(&clocksource_tsc, tsc_khz);
+        clocksource_unregister(&clocksource_tsc_early);
 }
@@ -1233,13 +1272,11 @@ static int __init init_tsc_clocksource(void)
        if (!boot_cpu_has(X86_FEATURE_TSC) || tsc_disabled > 0 || !tsc_khz)
                return 0;
+        if (check_tsc_unstable())
+                return 0;
        if (tsc_clocksource_reliable)
                clocksource_tsc.flags &= ~CLOCK_SOURCE_MUST_VERIFY;
-        /* lower the rating if we already know its unstable: */
-        if (check_tsc_unstable()) {
-                clocksource_tsc.rating = 0;
-                clocksource_tsc.flags &= ~CLOCK_SOURCE_IS_CONTINUOUS;
-        }
        if (boot_cpu_has(X86_FEATURE_NONSTOP_TSC_S3))
                clocksource_tsc.flags |= CLOCK_SOURCE_SUSPEND_NONSTOP;
@@ -1252,6 +1289,7 @@ static int __init init_tsc_clocksource(void)
                if (boot_cpu_has(X86_FEATURE_ART))
                        art_related_clocksource = &clocksource_tsc;
                clocksource_register_khz(&clocksource_tsc, tsc_khz);
+                clocksource_unregister(&clocksource_tsc_early);
                return 0;
        }
@@ -1356,9 +1394,12 @@ void __init tsc_init(void)
        check_system_tsc_reliable();
-        if (unsynchronized_tsc())
+        if (unsynchronized_tsc()) {
                mark_tsc_unstable("TSCs unsynchronized");
+                return;
+        }
+        clocksource_register_khz(&clocksource_tsc_early, tsc_khz);
        detect_art();
 }
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index a3755d293a48..85c7ef23d99f 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -528,11 +528,11 @@ static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
        return 0;
 }
-static int push_ret_address(struct pt_regs *regs, unsigned long ip)
+static int emulate_push_stack(struct pt_regs *regs, unsigned long val)
 {
        unsigned long new_sp = regs->sp - sizeof_long();
-        if (copy_to_user((void __user *)new_sp, &ip, sizeof_long()))
+        if (copy_to_user((void __user *)new_sp, &val, sizeof_long()))
                return -EFAULT;
        regs->sp = new_sp;
@@ -566,7 +566,7 @@ static int default_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs
                regs->ip += correction;
        } else if (auprobe->defparam.fixups & UPROBE_FIX_CALL) {
                regs->sp += sizeof_long(); /* Pop incorrect return address */
-                if (push_ret_address(regs, utask->vaddr + auprobe->defparam.ilen))
+                if (emulate_push_stack(regs, utask->vaddr + auprobe->defparam.ilen))
                        return -ERESTART;
        }
        /* popf; tell the caller to not touch TF */
@@ -655,7 +655,7 @@ static bool branch_emulate_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
                 *
                 * But there is corner case, see the comment in ->post_xol().
                 */
-                if (push_ret_address(regs, new_ip))
+                if (emulate_push_stack(regs, new_ip))
                        return false;
        } else if (!check_jmp_cond(auprobe, regs)) {
                offs = 0;
@@ -665,6 +665,16 @@ static bool branch_emulate_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
        return true;
 }
+static bool push_emulate_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
+{
+        unsigned long *src_ptr = (void *)regs + auprobe->push.reg_offset;
+        if (emulate_push_stack(regs, *src_ptr))
+                return false;
+        regs->ip += auprobe->push.ilen;
+        return true;
+}
 static int branch_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
 {
        BUG_ON(!branch_is_call(auprobe));
@@ -703,6 +713,10 @@ static const struct uprobe_xol_ops branch_xol_ops = {
        .post_xol = branch_post_xol_op,
 };
+static const struct uprobe_xol_ops push_xol_ops = {
+        .emulate  = push_emulate_op,
+};
 /* Returns -ENOSYS if branch_xol_ops doesn't handle this insn */
 static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn)
 {
@@ -750,6 +764,87 @@ static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn)
        return 0;
 }
+/* Returns -ENOSYS if push_xol_ops doesn't handle this insn */
+static int push_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn)
+{
+        u8 opc1 = OPCODE1(insn), reg_offset = 0;
+        if (opc1 < 0x50 || opc1 > 0x57)
+                return -ENOSYS;
+        if (insn->length > 2)
+                return -ENOSYS;
+        if (insn->length == 2) {
+                /* only support rex_prefix 0x41 (x64 only) */
+#ifdef CONFIG_X86_64
+                if (insn->rex_prefix.nbytes != 1 ||
+                    insn->rex_prefix.bytes[0] != 0x41)
+                        return -ENOSYS;
+                switch (opc1) {
+                case 0x50:
+                        reg_offset = offsetof(struct pt_regs, r8);
+                        break;
+                case 0x51:
+                        reg_offset = offsetof(struct pt_regs, r9);
+                        break;
+                case 0x52:
+                        reg_offset = offsetof(struct pt_regs, r10);
+                        break;
+                case 0x53:
+                        reg_offset = offsetof(struct pt_regs, r11);
+                        break;
+                case 0x54:
+                        reg_offset = offsetof(struct pt_regs, r12);
+                        break;
+                case 0x55:
+                        reg_offset = offsetof(struct pt_regs, r13);
+                        break;
+                case 0x56:
+                        reg_offset = offsetof(struct pt_regs, r14);
+                        break;
+                case 0x57:
+                        reg_offset = offsetof(struct pt_regs, r15);
+                        break;
+                }
+#else
+                return -ENOSYS;
+#endif
+        } else {
+                switch (opc1) {
+                case 0x50:
+                        reg_offset = offsetof(struct pt_regs, ax);
+                        break;
+                case 0x51:
+                        reg_offset = offsetof(struct pt_regs, cx);
+                        break;
+                case 0x52:
+                        reg_offset = offsetof(struct pt_regs, dx);
+                        break;
+                case 0x53:
+                        reg_offset = offsetof(struct pt_regs, bx);
+                        break;
+                case 0x54:
+                        reg_offset = offsetof(struct pt_regs, sp);
+                        break;
+                case 0x55:
+                        reg_offset = offsetof(struct pt_regs, bp);
+                        break;
+                case 0x56:
+                        reg_offset = offsetof(struct pt_regs, si);
+                        break;
+                case 0x57:
+                        reg_offset = offsetof(struct pt_regs, di);
+                        break;
+                }
+        }
+        auprobe->push.reg_offset = reg_offset;
+        auprobe->push.ilen = insn->length;
+        auprobe->ops = &push_xol_ops;
+        return 0;
+}
 /**
 * arch_uprobe_analyze_insn - instruction analysis including validity and fixups.
 * @mm: the probed address space.
@@ -771,6 +866,10 @@ int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
        if (ret != -ENOSYS)
                return ret;
+        ret = push_setup_xol_ops(auprobe, &insn);
+        if (ret != -ENOSYS)
+                return ret;
        /*
         * Figure out which fixups default_post_xol_op() will need to perform,
         * and annotate defparam->fixups accordingly.