[gentoo-commits] proj/linux-patches:4.15 commit in: /

[Mike Pagano]

commit:     0efeda7197763f237f87dab43a52676839e87f2d
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Feb 22 23:24:31 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Feb 22 23:24:31 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=0efeda71

Linux patch 4.15.5

 0000_README             |    4 +
 1004_linux-4.15.5.patch | 6693 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 6697 insertions(+)

diff --git a/0000_README b/0000_README
index ffe8729..f22a6fe 100644
--- a/0000_README
+++ b/0000_README
@@ -59,6 +59,10 @@ Patch:  1003_linux-4.15.4.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.15.4
 
+Patch:  1004_linux-4.15.5.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.15.5
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1004_linux-4.15.5.patch b/1004_linux-4.15.5.patch
new file mode 100644
index 0000000..5340f07
--- /dev/null
+++ b/1004_linux-4.15.5.patch
@@ -0,0 +1,6693 @@
+diff --git a/Documentation/devicetree/bindings/dma/snps-dma.txt b/Documentation/devicetree/bindings/dma/snps-dma.txt
+index a122723907ac..99acc712f83a 100644
+--- a/Documentation/devicetree/bindings/dma/snps-dma.txt
++++ b/Documentation/devicetree/bindings/dma/snps-dma.txt
+@@ -64,6 +64,6 @@ Example:
+ 		reg = <0xe0000000 0x1000>;
+ 		interrupts = <0 35 0x4>;
+ 		dmas = <&dmahost 12 0 1>,
+-			<&dmahost 13 0 1 0>;
++			<&dmahost 13 1 0>;
+ 		dma-names = "rx", "rx";
+ 	};
+diff --git a/Documentation/filesystems/ext4.txt b/Documentation/filesystems/ext4.txt
+index 75236c0c2ac2..d081ce0482cc 100644
+--- a/Documentation/filesystems/ext4.txt
++++ b/Documentation/filesystems/ext4.txt
+@@ -233,7 +233,7 @@ data_err=ignore(*)	Just print an error message if an error occurs
+ data_err=abort		Abort the journal if an error occurs in a file
+ 			data buffer in ordered mode.
+ 
+-grpid			Give objects the same group ID as their creator.
++grpid			New objects have the group ID of their parent.
+ bsdgroups
+ 
+ nogrpid		(*)	New objects have the group ID of their creator.
+diff --git a/Makefile b/Makefile
+index 8495e1ca052e..28c537fbe328 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 15
+-SUBLEVEL = 4
++SUBLEVEL = 5
+ EXTRAVERSION =
+ NAME = Fearless Coyote
+ 
+diff --git a/arch/arm/boot/dts/arm-realview-eb-mp.dtsi b/arch/arm/boot/dts/arm-realview-eb-mp.dtsi
+index 7b8d90b7aeea..29b636fce23f 100644
+--- a/arch/arm/boot/dts/arm-realview-eb-mp.dtsi
++++ b/arch/arm/boot/dts/arm-realview-eb-mp.dtsi
+@@ -150,11 +150,6 @@
+ 	interrupts = <0 8 IRQ_TYPE_LEVEL_HIGH>;
+ };
+ 
+-&charlcd {
+-	interrupt-parent = <&intc>;
+-	interrupts = <0  IRQ_TYPE_LEVEL_HIGH>;
+-};
+-
+ &serial0 {
+ 	interrupt-parent = <&intc>;
+ 	interrupts = <0 4 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm/boot/dts/exynos5410.dtsi b/arch/arm/boot/dts/exynos5410.dtsi
+index 06713ec86f0d..d2174727df9a 100644
+--- a/arch/arm/boot/dts/exynos5410.dtsi
++++ b/arch/arm/boot/dts/exynos5410.dtsi
+@@ -333,7 +333,6 @@
+ &rtc {
+ 	clocks = <&clock CLK_RTC>;
+ 	clock-names = "rtc";
+-	interrupt-parent = <&pmu_system_controller>;
+ 	status = "disabled";
+ };
+ 
+diff --git a/arch/arm/boot/dts/lpc3250-ea3250.dts b/arch/arm/boot/dts/lpc3250-ea3250.dts
+index c43adb7b4d7c..58ea0a4e7afa 100644
+--- a/arch/arm/boot/dts/lpc3250-ea3250.dts
++++ b/arch/arm/boot/dts/lpc3250-ea3250.dts
+@@ -156,8 +156,8 @@
+ 	uda1380: uda1380@18 {
+ 		compatible = "nxp,uda1380";
+ 		reg = <0x18>;
+-		power-gpio = <&gpio 0x59 0>;
+-		reset-gpio = <&gpio 0x51 0>;
++		power-gpio = <&gpio 3 10 0>;
++		reset-gpio = <&gpio 3 2 0>;
+ 		dac-clk = "wspll";
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/lpc3250-phy3250.dts b/arch/arm/boot/dts/lpc3250-phy3250.dts
+index c72eb9845603..1e1c2f517a82 100644
+--- a/arch/arm/boot/dts/lpc3250-phy3250.dts
++++ b/arch/arm/boot/dts/lpc3250-phy3250.dts
+@@ -81,8 +81,8 @@
+ 	uda1380: uda1380@18 {
+ 		compatible = "nxp,uda1380";
+ 		reg = <0x18>;
+-		power-gpio = <&gpio 0x59 0>;
+-		reset-gpio = <&gpio 0x51 0>;
++		power-gpio = <&gpio 3 10 0>;
++		reset-gpio = <&gpio 3 2 0>;
+ 		dac-clk = "wspll";
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/mt2701.dtsi b/arch/arm/boot/dts/mt2701.dtsi
+index 965ddfbc9953..05557fce0f1d 100644
+--- a/arch/arm/boot/dts/mt2701.dtsi
++++ b/arch/arm/boot/dts/mt2701.dtsi
+@@ -604,6 +604,7 @@
+ 		compatible = "mediatek,mt2701-hifsys", "syscon";
+ 		reg = <0 0x1a000000 0 0x1000>;
+ 		#clock-cells = <1>;
++		#reset-cells = <1>;
+ 	};
+ 
+ 	usb0: usb@1a1c0000 {
+@@ -688,6 +689,7 @@
+ 		compatible = "mediatek,mt2701-ethsys", "syscon";
+ 		reg = <0 0x1b000000 0 0x1000>;
+ 		#clock-cells = <1>;
++		#reset-cells = <1>;
+ 	};
+ 
+ 	eth: ethernet@1b100000 {
+diff --git a/arch/arm/boot/dts/mt7623.dtsi b/arch/arm/boot/dts/mt7623.dtsi
+index 0640fb75bf59..3a442a16ea06 100644
+--- a/arch/arm/boot/dts/mt7623.dtsi
++++ b/arch/arm/boot/dts/mt7623.dtsi
+@@ -758,6 +758,7 @@
+ 			     "syscon";
+ 		reg = <0 0x1b000000 0 0x1000>;
+ 		#clock-cells = <1>;
++		#reset-cells = <1>;
+ 	};
+ 
+ 	eth: ethernet@1b100000 {
+diff --git a/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts b/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts
+index 688a86378cee..7bf5aa2237c9 100644
+--- a/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts
++++ b/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts
+@@ -204,7 +204,7 @@
+ 	bus-width = <4>;
+ 	max-frequency = <50000000>;
+ 	cap-sd-highspeed;
+-	cd-gpios = <&pio 261 0>;
++	cd-gpios = <&pio 261 GPIO_ACTIVE_LOW>;
+ 	vmmc-supply = <&mt6323_vmch_reg>;
+ 	vqmmc-supply = <&mt6323_vio18_reg>;
+ };
+diff --git a/arch/arm/boot/dts/s5pv210.dtsi b/arch/arm/boot/dts/s5pv210.dtsi
+index 726c5d0dbd5b..b290a5abb901 100644
+--- a/arch/arm/boot/dts/s5pv210.dtsi
++++ b/arch/arm/boot/dts/s5pv210.dtsi
+@@ -463,6 +463,7 @@
+ 			compatible = "samsung,exynos4210-ohci";
+ 			reg = <0xec300000 0x100>;
+ 			interrupts = <23>;
++			interrupt-parent = <&vic1>;
+ 			clocks = <&clocks CLK_USB_HOST>;
+ 			clock-names = "usbhost";
+ 			#address-cells = <1>;
+diff --git a/arch/arm/boot/dts/spear1310-evb.dts b/arch/arm/boot/dts/spear1310-evb.dts
+index 84101e4eebbf..0f5f379323a8 100644
+--- a/arch/arm/boot/dts/spear1310-evb.dts
++++ b/arch/arm/boot/dts/spear1310-evb.dts
+@@ -349,7 +349,7 @@
+ 			spi0: spi@e0100000 {
+ 				status = "okay";
+ 				num-cs = <3>;
+-				cs-gpios = <&gpio1 7 0>, <&spics 0>, <&spics 1>;
++				cs-gpios = <&gpio1 7 0>, <&spics 0 0>, <&spics 1 0>;
+ 
+ 				stmpe610@0 {
+ 					compatible = "st,stmpe610";
+diff --git a/arch/arm/boot/dts/spear1340.dtsi b/arch/arm/boot/dts/spear1340.dtsi
+index 5f347054527d..d4dbc4098653 100644
+--- a/arch/arm/boot/dts/spear1340.dtsi
++++ b/arch/arm/boot/dts/spear1340.dtsi
+@@ -142,8 +142,8 @@
+ 				reg = <0xb4100000 0x1000>;
+ 				interrupts = <0 105 0x4>;
+ 				status = "disabled";
+-				dmas = <&dwdma0 0x600 0 0 1>, /* 0xC << 11 */
+-					<&dwdma0 0x680 0 1 0>; /* 0xD << 7 */
++				dmas = <&dwdma0 12 0 1>,
++					<&dwdma0 13 1 0>;
+ 				dma-names = "tx", "rx";
+ 			};
+ 
+diff --git a/arch/arm/boot/dts/spear13xx.dtsi b/arch/arm/boot/dts/spear13xx.dtsi
+index 17ea0abcdbd7..086b4b333249 100644
+--- a/arch/arm/boot/dts/spear13xx.dtsi
++++ b/arch/arm/boot/dts/spear13xx.dtsi
+@@ -100,7 +100,7 @@
+ 			reg = <0xb2800000 0x1000>;
+ 			interrupts = <0 29 0x4>;
+ 			status = "disabled";
+-			dmas = <&dwdma0 0 0 0 0>;
++			dmas = <&dwdma0 0 0 0>;
+ 			dma-names = "data";
+ 		};
+ 
+@@ -290,8 +290,8 @@
+ 				#size-cells = <0>;
+ 				interrupts = <0 31 0x4>;
+ 				status = "disabled";
+-				dmas = <&dwdma0 0x2000 0 0 0>, /* 0x4 << 11 */
+-					<&dwdma0 0x0280 0 0 0>;  /* 0x5 << 7 */
++				dmas = <&dwdma0 4 0 0>,
++					<&dwdma0 5 0 0>;
+ 				dma-names = "tx", "rx";
+ 			};
+ 
+diff --git a/arch/arm/boot/dts/spear600.dtsi b/arch/arm/boot/dts/spear600.dtsi
+index 6b32d20acc9f..00166eb9be86 100644
+--- a/arch/arm/boot/dts/spear600.dtsi
++++ b/arch/arm/boot/dts/spear600.dtsi
+@@ -194,6 +194,7 @@
+ 			rtc: rtc@fc900000 {
+ 				compatible = "st,spear600-rtc";
+ 				reg = <0xfc900000 0x1000>;
++				interrupt-parent = <&vic0>;
+ 				interrupts = <10>;
+ 				status = "disabled";
+ 			};
+diff --git a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
+index 68aab50a73ab..733678b75b88 100644
+--- a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
++++ b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi
+@@ -750,6 +750,7 @@
+ 			reg = <0x10120000 0x1000>;
+ 			interrupt-names = "combined";
+ 			interrupts = <14>;
++			interrupt-parent = <&vica>;
+ 			clocks = <&clcdclk>, <&hclkclcd>;
+ 			clock-names = "clcdclk", "apb_pclk";
+ 			status = "disabled";
+diff --git a/arch/arm/boot/dts/stih407.dtsi b/arch/arm/boot/dts/stih407.dtsi
+index fa149837df14..11fdecd9312e 100644
+--- a/arch/arm/boot/dts/stih407.dtsi
++++ b/arch/arm/boot/dts/stih407.dtsi
+@@ -8,6 +8,7 @@
+  */
+ #include "stih407-clock.dtsi"
+ #include "stih407-family.dtsi"
++#include <dt-bindings/gpio/gpio.h>
+ / {
+ 	soc {
+ 		sti-display-subsystem {
+@@ -122,7 +123,7 @@
+ 					 <&clk_s_d2_quadfs 0>,
+ 					 <&clk_s_d2_quadfs 1>;
+ 
+-				hdmi,hpd-gpio = <&pio5 3>;
++				hdmi,hpd-gpio = <&pio5 3 GPIO_ACTIVE_LOW>;
+ 				reset-names = "hdmi";
+ 				resets = <&softreset STIH407_HDMI_TX_PHY_SOFTRESET>;
+ 				ddc = <&hdmiddc>;
+diff --git a/arch/arm/boot/dts/stih410.dtsi b/arch/arm/boot/dts/stih410.dtsi
+index cffa50db5d72..68b5ff91d6a7 100644
+--- a/arch/arm/boot/dts/stih410.dtsi
++++ b/arch/arm/boot/dts/stih410.dtsi
+@@ -9,6 +9,7 @@
+ #include "stih410-clock.dtsi"
+ #include "stih407-family.dtsi"
+ #include "stih410-pinctrl.dtsi"
++#include <dt-bindings/gpio/gpio.h>
+ / {
+ 	aliases {
+ 		bdisp0 = &bdisp0;
+@@ -213,7 +214,7 @@
+ 					 <&clk_s_d2_quadfs 0>,
+ 					 <&clk_s_d2_quadfs 1>;
+ 
+-				hdmi,hpd-gpio = <&pio5 3>;
++				hdmi,hpd-gpio = <&pio5 3 GPIO_ACTIVE_LOW>;
+ 				reset-names = "hdmi";
+ 				resets = <&softreset STIH407_HDMI_TX_PHY_SOFTRESET>;
+ 				ddc = <&hdmiddc>;
+diff --git a/arch/arm/mach-pxa/tosa-bt.c b/arch/arm/mach-pxa/tosa-bt.c
+index 107f37210fb9..83606087edc7 100644
+--- a/arch/arm/mach-pxa/tosa-bt.c
++++ b/arch/arm/mach-pxa/tosa-bt.c
+@@ -132,3 +132,7 @@ static struct platform_driver tosa_bt_driver = {
+ 	},
+ };
+ module_platform_driver(tosa_bt_driver);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Dmitry Baryshkov");
++MODULE_DESCRIPTION("Bluetooth built-in chip control");
+diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+index 6b2127a6ced1..b84c0ca4f84a 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -906,6 +906,7 @@
+ 					    "dsi_phy_regulator";
+ 
+ 				#clock-cells = <1>;
++				#phy-cells = <0>;
+ 
+ 				clocks = <&gcc GCC_MDSS_AHB_CLK>;
+ 				clock-names = "iface_clk";
+@@ -1435,8 +1436,8 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		qcom,ipc-1 = <&apcs 0 13>;
+-		qcom,ipc-6 = <&apcs 0 19>;
++		qcom,ipc-1 = <&apcs 8 13>;
++		qcom,ipc-3 = <&apcs 8 19>;
+ 
+ 		apps_smsm: apps@0 {
+ 			reg = <0>;
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index 07823595b7f0..52f15cd896e1 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -406,6 +406,15 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
+ 		.capability = ARM64_HARDEN_BP_POST_GUEST_EXIT,
+ 		MIDR_ALL_VERSIONS(MIDR_QCOM_FALKOR_V1),
+ 	},
++	{
++		.capability = ARM64_HARDEN_BRANCH_PREDICTOR,
++		MIDR_ALL_VERSIONS(MIDR_QCOM_FALKOR),
++		.enable = qcom_enable_link_stack_sanitization,
++	},
++	{
++		.capability = ARM64_HARDEN_BP_POST_GUEST_EXIT,
++		MIDR_ALL_VERSIONS(MIDR_QCOM_FALKOR),
++	},
+ 	{
+ 		.capability = ARM64_HARDEN_BRANCH_PREDICTOR,
+ 		MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
+diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
+index 0b5ab4d8b57d..30b5495b82b5 100644
+--- a/arch/arm64/kvm/hyp/switch.c
++++ b/arch/arm64/kvm/hyp/switch.c
+@@ -400,8 +400,10 @@ int __hyp_text __kvm_vcpu_run(struct kvm_vcpu *vcpu)
+ 		u32 midr = read_cpuid_id();
+ 
+ 		/* Apply BTAC predictors mitigation to all Falkor chips */
+-		if ((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR_V1)
++		if (((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR) ||
++		    ((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR_V1)) {
+ 			__qcom_hyp_sanitize_btac_predictors();
++		}
+ 	}
+ 
+ 	fp_enabled = __fpsimd_enabled();
+diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
+index 08572f95bd8a..248f2e7b24ab 100644
+--- a/arch/arm64/mm/proc.S
++++ b/arch/arm64/mm/proc.S
+@@ -189,7 +189,8 @@ ENDPROC(idmap_cpu_replace_ttbr1)
+ 	dc	cvac, cur_\()\type\()p		// Ensure any existing dirty
+ 	dmb	sy				// lines are written back before
+ 	ldr	\type, [cur_\()\type\()p]	// loading the entry
+-	tbz	\type, #0, next_\()\type	// Skip invalid entries
++	tbz	\type, #0, skip_\()\type	// Skip invalid and
++	tbnz	\type, #11, skip_\()\type	// non-global entries
+ 	.endm
+ 
+ 	.macro __idmap_kpti_put_pgtable_ent_ng, type
+@@ -249,8 +250,9 @@ ENTRY(idmap_kpti_install_ng_mappings)
+ 	add	end_pgdp, cur_pgdp, #(PTRS_PER_PGD * 8)
+ do_pgd:	__idmap_kpti_get_pgtable_ent	pgd
+ 	tbnz	pgd, #1, walk_puds
+-	__idmap_kpti_put_pgtable_ent_ng	pgd
+ next_pgd:
++	__idmap_kpti_put_pgtable_ent_ng	pgd
++skip_pgd:
+ 	add	cur_pgdp, cur_pgdp, #8
+ 	cmp	cur_pgdp, end_pgdp
+ 	b.ne	do_pgd
+@@ -278,8 +280,9 @@ walk_puds:
+ 	add	end_pudp, cur_pudp, #(PTRS_PER_PUD * 8)
+ do_pud:	__idmap_kpti_get_pgtable_ent	pud
+ 	tbnz	pud, #1, walk_pmds
+-	__idmap_kpti_put_pgtable_ent_ng	pud
+ next_pud:
++	__idmap_kpti_put_pgtable_ent_ng	pud
++skip_pud:
+ 	add	cur_pudp, cur_pudp, 8
+ 	cmp	cur_pudp, end_pudp
+ 	b.ne	do_pud
+@@ -298,8 +301,9 @@ walk_pmds:
+ 	add	end_pmdp, cur_pmdp, #(PTRS_PER_PMD * 8)
+ do_pmd:	__idmap_kpti_get_pgtable_ent	pmd
+ 	tbnz	pmd, #1, walk_ptes
+-	__idmap_kpti_put_pgtable_ent_ng	pmd
+ next_pmd:
++	__idmap_kpti_put_pgtable_ent_ng	pmd
++skip_pmd:
+ 	add	cur_pmdp, cur_pmdp, #8
+ 	cmp	cur_pmdp, end_pmdp
+ 	b.ne	do_pmd
+@@ -317,7 +321,7 @@ walk_ptes:
+ 	add	end_ptep, cur_ptep, #(PTRS_PER_PTE * 8)
+ do_pte:	__idmap_kpti_get_pgtable_ent	pte
+ 	__idmap_kpti_put_pgtable_ent_ng	pte
+-next_pte:
++skip_pte:
+ 	add	cur_ptep, cur_ptep, #8
+ 	cmp	cur_ptep, end_ptep
+ 	b.ne	do_pte
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index 8e0b3702f1c0..efaa3b130f4d 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -119,12 +119,12 @@ config MIPS_GENERIC
+ 	select SYS_SUPPORTS_MULTITHREADING
+ 	select SYS_SUPPORTS_RELOCATABLE
+ 	select SYS_SUPPORTS_SMARTMIPS
+-	select USB_EHCI_BIG_ENDIAN_DESC if BIG_ENDIAN
+-	select USB_EHCI_BIG_ENDIAN_MMIO if BIG_ENDIAN
+-	select USB_OHCI_BIG_ENDIAN_DESC if BIG_ENDIAN
+-	select USB_OHCI_BIG_ENDIAN_MMIO if BIG_ENDIAN
+-	select USB_UHCI_BIG_ENDIAN_DESC if BIG_ENDIAN
+-	select USB_UHCI_BIG_ENDIAN_MMIO if BIG_ENDIAN
++	select USB_EHCI_BIG_ENDIAN_DESC if CPU_BIG_ENDIAN
++	select USB_EHCI_BIG_ENDIAN_MMIO if CPU_BIG_ENDIAN
++	select USB_OHCI_BIG_ENDIAN_DESC if CPU_BIG_ENDIAN
++	select USB_OHCI_BIG_ENDIAN_MMIO if CPU_BIG_ENDIAN
++	select USB_UHCI_BIG_ENDIAN_DESC if CPU_BIG_ENDIAN
++	select USB_UHCI_BIG_ENDIAN_MMIO if CPU_BIG_ENDIAN
+ 	select USE_OF
+ 	help
+ 	  Select this to build a kernel which aims to support multiple boards,
+diff --git a/arch/mips/kernel/cps-vec.S b/arch/mips/kernel/cps-vec.S
+index e68e6e04063a..1025f937ab0e 100644
+--- a/arch/mips/kernel/cps-vec.S
++++ b/arch/mips/kernel/cps-vec.S
+@@ -388,15 +388,16 @@ LEAF(mips_cps_boot_vpes)
+ 
+ #elif defined(CONFIG_MIPS_MT)
+ 
+-	.set	push
+-	.set	MIPS_ISA_LEVEL_RAW
+-	.set	mt
+-
+ 	/* If the core doesn't support MT then return */
+ 	has_mt	t0, 5f
+ 
+ 	/* Enter VPE configuration state */
++	.set	push
++	.set	MIPS_ISA_LEVEL_RAW
++	.set	mt
+ 	dvpe
++	.set	pop
++
+ 	PTR_LA	t1, 1f
+ 	jr.hb	t1
+ 	 nop
+@@ -422,6 +423,10 @@ LEAF(mips_cps_boot_vpes)
+ 	mtc0	t0, CP0_VPECONTROL
+ 	ehb
+ 
++	.set	push
++	.set	MIPS_ISA_LEVEL_RAW
++	.set	mt
++
+ 	/* Skip the VPE if its TC is not halted */
+ 	mftc0	t0, CP0_TCHALT
+ 	beqz	t0, 2f
+@@ -495,6 +500,8 @@ LEAF(mips_cps_boot_vpes)
+ 	ehb
+ 	evpe
+ 
++	.set	pop
++
+ 	/* Check whether this VPE is meant to be running */
+ 	li	t0, 1
+ 	sll	t0, t0, a1
+@@ -509,7 +516,7 @@ LEAF(mips_cps_boot_vpes)
+ 1:	jr.hb	t0
+ 	 nop
+ 
+-2:	.set	pop
++2:
+ 
+ #endif /* CONFIG_MIPS_MT_SMP */
+ 
+diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
+index 702c678de116..e4a1581ce822 100644
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -375,6 +375,7 @@ static void __init bootmem_init(void)
+ 	unsigned long reserved_end;
+ 	unsigned long mapstart = ~0UL;
+ 	unsigned long bootmap_size;
++	phys_addr_t ramstart = (phys_addr_t)ULLONG_MAX;
+ 	bool bootmap_valid = false;
+ 	int i;
+ 
+@@ -395,7 +396,8 @@ static void __init bootmem_init(void)
+ 	max_low_pfn = 0;
+ 
+ 	/*
+-	 * Find the highest page frame number we have available.
++	 * Find the highest page frame number we have available
++	 * and the lowest used RAM address
+ 	 */
+ 	for (i = 0; i < boot_mem_map.nr_map; i++) {
+ 		unsigned long start, end;
+@@ -407,6 +409,8 @@ static void __init bootmem_init(void)
+ 		end = PFN_DOWN(boot_mem_map.map[i].addr
+ 				+ boot_mem_map.map[i].size);
+ 
++		ramstart = min(ramstart, boot_mem_map.map[i].addr);
++
+ #ifndef CONFIG_HIGHMEM
+ 		/*
+ 		 * Skip highmem here so we get an accurate max_low_pfn if low
+@@ -436,6 +440,13 @@ static void __init bootmem_init(void)
+ 		mapstart = max(reserved_end, start);
+ 	}
+ 
++	/*
++	 * Reserve any memory between the start of RAM and PHYS_OFFSET
++	 */
++	if (ramstart > PHYS_OFFSET)
++		add_memory_region(PHYS_OFFSET, ramstart - PHYS_OFFSET,
++				  BOOT_MEM_RESERVED);
++
+ 	if (min_low_pfn >= max_low_pfn)
+ 		panic("Incorrect memory mapping !!!");
+ 	if (min_low_pfn > ARCH_PFN_OFFSET) {
+@@ -664,9 +675,6 @@ static int __init early_parse_mem(char *p)
+ 
+ 	add_memory_region(start, size, BOOT_MEM_RAM);
+ 
+-	if (start && start > PHYS_OFFSET)
+-		add_memory_region(PHYS_OFFSET, start - PHYS_OFFSET,
+-				BOOT_MEM_RESERVED);
+ 	return 0;
+ }
+ early_param("mem", early_parse_mem);
+diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
+index 88187c285c70..1c02e6900f78 100644
+--- a/arch/powerpc/include/asm/topology.h
++++ b/arch/powerpc/include/asm/topology.h
+@@ -44,6 +44,11 @@ extern int sysfs_add_device_to_node(struct device *dev, int nid);
+ extern void sysfs_remove_device_from_node(struct device *dev, int nid);
+ extern int numa_update_cpu_topology(bool cpus_locked);
+ 
++static inline void update_numa_cpu_lookup_table(unsigned int cpu, int node)
++{
++	numa_cpu_lookup_table[cpu] = node;
++}
++
+ static inline int early_cpu_to_node(int cpu)
+ {
+ 	int nid;
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index 72be0c32e902..2010e4c827b7 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -1509,14 +1509,15 @@ static int assign_thread_tidr(void)
+ {
+ 	int index;
+ 	int err;
++	unsigned long flags;
+ 
+ again:
+ 	if (!ida_pre_get(&vas_thread_ida, GFP_KERNEL))
+ 		return -ENOMEM;
+ 
+-	spin_lock(&vas_thread_id_lock);
++	spin_lock_irqsave(&vas_thread_id_lock, flags);
+ 	err = ida_get_new_above(&vas_thread_ida, 1, &index);
+-	spin_unlock(&vas_thread_id_lock);
++	spin_unlock_irqrestore(&vas_thread_id_lock, flags);
+ 
+ 	if (err == -EAGAIN)
+ 		goto again;
+@@ -1524,9 +1525,9 @@ static int assign_thread_tidr(void)
+ 		return err;
+ 
+ 	if (index > MAX_THREAD_CONTEXT) {
+-		spin_lock(&vas_thread_id_lock);
++		spin_lock_irqsave(&vas_thread_id_lock, flags);
+ 		ida_remove(&vas_thread_ida, index);
+-		spin_unlock(&vas_thread_id_lock);
++		spin_unlock_irqrestore(&vas_thread_id_lock, flags);
+ 		return -ENOMEM;
+ 	}
+ 
+@@ -1535,9 +1536,11 @@ static int assign_thread_tidr(void)
+ 
+ static void free_thread_tidr(int id)
+ {
+-	spin_lock(&vas_thread_id_lock);
++	unsigned long flags;
++
++	spin_lock_irqsave(&vas_thread_id_lock, flags);
+ 	ida_remove(&vas_thread_ida, id);
+-	spin_unlock(&vas_thread_id_lock);
++	spin_unlock_irqrestore(&vas_thread_id_lock, flags);
+ }
+ 
+ /*
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index adb6364f4091..09be66fcea68 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -142,11 +142,6 @@ static void reset_numa_cpu_lookup_table(void)
+ 		numa_cpu_lookup_table[cpu] = -1;
+ }
+ 
+-static void update_numa_cpu_lookup_table(unsigned int cpu, int node)
+-{
+-	numa_cpu_lookup_table[cpu] = node;
+-}
+-
+ static void map_cpu_to_node(int cpu, int node)
+ {
+ 	update_numa_cpu_lookup_table(cpu, node);
+diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
+index cfbbee941a76..17ae5c15a9e0 100644
+--- a/arch/powerpc/mm/pgtable-radix.c
++++ b/arch/powerpc/mm/pgtable-radix.c
+@@ -17,6 +17,7 @@
+ #include <linux/of_fdt.h>
+ #include <linux/mm.h>
+ #include <linux/string_helpers.h>
++#include <linux/stop_machine.h>
+ 
+ #include <asm/pgtable.h>
+ #include <asm/pgalloc.h>
+@@ -671,6 +672,30 @@ static void free_pmd_table(pmd_t *pmd_start, pud_t *pud)
+ 	pud_clear(pud);
+ }
+ 
++struct change_mapping_params {
++	pte_t *pte;
++	unsigned long start;
++	unsigned long end;
++	unsigned long aligned_start;
++	unsigned long aligned_end;
++};
++
++static int stop_machine_change_mapping(void *data)
++{
++	struct change_mapping_params *params =
++			(struct change_mapping_params *)data;
++
++	if (!data)
++		return -1;
++
++	spin_unlock(&init_mm.page_table_lock);
++	pte_clear(&init_mm, params->aligned_start, params->pte);
++	create_physical_mapping(params->aligned_start, params->start);
++	create_physical_mapping(params->end, params->aligned_end);
++	spin_lock(&init_mm.page_table_lock);
++	return 0;
++}
++
+ static void remove_pte_table(pte_t *pte_start, unsigned long addr,
+ 			     unsigned long end)
+ {
+@@ -699,6 +724,52 @@ static void remove_pte_table(pte_t *pte_start, unsigned long addr,
+ 	}
+ }
+ 
++/*
++ * clear the pte and potentially split the mapping helper
++ */
++static void split_kernel_mapping(unsigned long addr, unsigned long end,
++				unsigned long size, pte_t *pte)
++{
++	unsigned long mask = ~(size - 1);
++	unsigned long aligned_start = addr & mask;
++	unsigned long aligned_end = addr + size;
++	struct change_mapping_params params;
++	bool split_region = false;
++
++	if ((end - addr) < size) {
++		/*
++		 * We're going to clear the PTE, but not flushed
++		 * the mapping, time to remap and flush. The
++		 * effects if visible outside the processor or
++		 * if we are running in code close to the
++		 * mapping we cleared, we are in trouble.
++		 */
++		if (overlaps_kernel_text(aligned_start, addr) ||
++			overlaps_kernel_text(end, aligned_end)) {
++			/*
++			 * Hack, just return, don't pte_clear
++			 */
++			WARN_ONCE(1, "Linear mapping %lx->%lx overlaps kernel "
++				  "text, not splitting\n", addr, end);
++			return;
++		}
++		split_region = true;
++	}
++
++	if (split_region) {
++		params.pte = pte;
++		params.start = addr;
++		params.end = end;
++		params.aligned_start = addr & ~(size - 1);
++		params.aligned_end = min_t(unsigned long, aligned_end,
++				(unsigned long)__va(memblock_end_of_DRAM()));
++		stop_machine(stop_machine_change_mapping, &params, NULL);
++		return;
++	}
++
++	pte_clear(&init_mm, addr, pte);
++}
++
+ static void remove_pmd_table(pmd_t *pmd_start, unsigned long addr,
+ 			     unsigned long end)
+ {
+@@ -714,13 +785,7 @@ static void remove_pmd_table(pmd_t *pmd_start, unsigned long addr,
+ 			continue;
+ 
+ 		if (pmd_huge(*pmd)) {
+-			if (!IS_ALIGNED(addr, PMD_SIZE) ||
+-			    !IS_ALIGNED(next, PMD_SIZE)) {
+-				WARN_ONCE(1, "%s: unaligned range\n", __func__);
+-				continue;
+-			}
+-
+-			pte_clear(&init_mm, addr, (pte_t *)pmd);
++			split_kernel_mapping(addr, end, PMD_SIZE, (pte_t *)pmd);
+ 			continue;
+ 		}
+ 
+@@ -745,13 +810,7 @@ static void remove_pud_table(pud_t *pud_start, unsigned long addr,
+ 			continue;
+ 
+ 		if (pud_huge(*pud)) {
+-			if (!IS_ALIGNED(addr, PUD_SIZE) ||
+-			    !IS_ALIGNED(next, PUD_SIZE)) {
+-				WARN_ONCE(1, "%s: unaligned range\n", __func__);
+-				continue;
+-			}
+-
+-			pte_clear(&init_mm, addr, (pte_t *)pud);
++			split_kernel_mapping(addr, end, PUD_SIZE, (pte_t *)pud);
+ 			continue;
+ 		}
+ 
+@@ -777,13 +836,7 @@ static void remove_pagetable(unsigned long start, unsigned long end)
+ 			continue;
+ 
+ 		if (pgd_huge(*pgd)) {
+-			if (!IS_ALIGNED(addr, PGDIR_SIZE) ||
+-			    !IS_ALIGNED(next, PGDIR_SIZE)) {
+-				WARN_ONCE(1, "%s: unaligned range\n", __func__);
+-				continue;
+-			}
+-
+-			pte_clear(&init_mm, addr, (pte_t *)pgd);
++			split_kernel_mapping(addr, end, PGDIR_SIZE, (pte_t *)pgd);
+ 			continue;
+ 		}
+ 
+diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
+index 813ea22c3e00..eec1367c2f32 100644
+--- a/arch/powerpc/mm/pgtable_64.c
++++ b/arch/powerpc/mm/pgtable_64.c
+@@ -483,6 +483,8 @@ void mmu_partition_table_set_entry(unsigned int lpid, unsigned long dw0,
+ 	if (old & PATB_HR) {
+ 		asm volatile(PPC_TLBIE_5(%0,%1,2,0,1) : :
+ 			     "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
++		asm volatile(PPC_TLBIE_5(%0,%1,2,1,1) : :
++			     "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
+ 		trace_tlbie(lpid, 0, TLBIEL_INVAL_SET_LPID, lpid, 2, 0, 1);
+ 	} else {
+ 		asm volatile(PPC_TLBIE_5(%0,%1,2,0,0) : :
+diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
+index 884f4b705b57..913a2b81b177 100644
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -600,14 +600,12 @@ void radix__flush_tlb_all(void)
+ 	 */
+ 	asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
+ 		     : : "r"(rb), "i"(r), "i"(1), "i"(ric), "r"(rs) : "memory");
+-	trace_tlbie(0, 0, rb, rs, ric, prs, r);
+ 	/*
+ 	 * now flush host entires by passing PRS = 0 and LPID == 0
+ 	 */
+ 	asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
+ 		     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(0) : "memory");
+ 	asm volatile("eieio; tlbsync; ptesync": : :"memory");
+-	trace_tlbie(0, 0, rb, 0, ric, prs, r);
+ }
+ 
+ void radix__flush_tlb_pte_p9_dd1(unsigned long old_pte, struct mm_struct *mm,
+diff --git a/arch/powerpc/platforms/powernv/vas-window.c b/arch/powerpc/platforms/powernv/vas-window.c
+index 2b3eb01ab110..b7c53a51c31b 100644
+--- a/arch/powerpc/platforms/powernv/vas-window.c
++++ b/arch/powerpc/platforms/powernv/vas-window.c
+@@ -1063,16 +1063,16 @@ struct vas_window *vas_tx_win_open(int vasid, enum vas_cop_type cop,
+ 			rc = PTR_ERR(txwin->paste_kaddr);
+ 			goto free_window;
+ 		}
++	} else {
++		/*
++		 * A user mapping must ensure that context switch issues
++		 * CP_ABORT for this thread.
++		 */
++		rc = set_thread_uses_vas();
++		if (rc)
++			goto free_window;
+ 	}
+ 
+-	/*
+-	 * Now that we have a send window, ensure context switch issues
+-	 * CP_ABORT for this thread.
+-	 */
+-	rc = -EINVAL;
+-	if (set_thread_uses_vas() < 0)
+-		goto free_window;
+-
+ 	set_vinst_win(vinst, txwin);
+ 
+ 	return txwin;
+diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+index a7d14aa7bb7c..09083ad82f7a 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+@@ -36,6 +36,7 @@
+ #include <asm/xics.h>
+ #include <asm/xive.h>
+ #include <asm/plpar_wrappers.h>
++#include <asm/topology.h>
+ 
+ #include "pseries.h"
+ #include "offline_states.h"
+@@ -331,6 +332,7 @@ static void pseries_remove_processor(struct device_node *np)
+ 			BUG_ON(cpu_online(cpu));
+ 			set_cpu_present(cpu, false);
+ 			set_hard_smp_processor_id(cpu, -1);
++			update_numa_cpu_lookup_table(cpu, -1);
+ 			break;
+ 		}
+ 		if (cpu >= nr_cpu_ids)
+diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c
+index d9c4c9366049..091f1d0d0af1 100644
+--- a/arch/powerpc/sysdev/xive/spapr.c
++++ b/arch/powerpc/sysdev/xive/spapr.c
+@@ -356,7 +356,8 @@ static int xive_spapr_configure_queue(u32 target, struct xive_q *q, u8 prio,
+ 
+ 	rc = plpar_int_get_queue_info(0, target, prio, &esn_page, &esn_size);
+ 	if (rc) {
+-		pr_err("Error %lld getting queue info prio %d\n", rc, prio);
++		pr_err("Error %lld getting queue info CPU %d prio %d\n", rc,
++		       target, prio);
+ 		rc = -EIO;
+ 		goto fail;
+ 	}
+@@ -370,7 +371,8 @@ static int xive_spapr_configure_queue(u32 target, struct xive_q *q, u8 prio,
+ 	/* Configure and enable the queue in HW */
+ 	rc = plpar_int_set_queue_config(flags, target, prio, qpage_phys, order);
+ 	if (rc) {
+-		pr_err("Error %lld setting queue for prio %d\n", rc, prio);
++		pr_err("Error %lld setting queue for CPU %d prio %d\n", rc,
++		       target, prio);
+ 		rc = -EIO;
+ 	} else {
+ 		q->qpage = qpage;
+@@ -389,8 +391,8 @@ static int xive_spapr_setup_queue(unsigned int cpu, struct xive_cpu *xc,
+ 	if (IS_ERR(qpage))
+ 		return PTR_ERR(qpage);
+ 
+-	return xive_spapr_configure_queue(cpu, q, prio, qpage,
+-					  xive_queue_shift);
++	return xive_spapr_configure_queue(get_hard_smp_processor_id(cpu),
++					  q, prio, qpage, xive_queue_shift);
+ }
+ 
+ static void xive_spapr_cleanup_queue(unsigned int cpu, struct xive_cpu *xc,
+@@ -399,10 +401,12 @@ static void xive_spapr_cleanup_queue(unsigned int cpu, struct xive_cpu *xc,
+ 	struct xive_q *q = &xc->queue[prio];
+ 	unsigned int alloc_order;
+ 	long rc;
++	int hw_cpu = get_hard_smp_processor_id(cpu);
+ 
+-	rc = plpar_int_set_queue_config(0, cpu, prio, 0, 0);
++	rc = plpar_int_set_queue_config(0, hw_cpu, prio, 0, 0);
+ 	if (rc)
+-		pr_err("Error %ld setting queue for prio %d\n", rc, prio);
++		pr_err("Error %ld setting queue for CPU %d prio %d\n", rc,
++		       hw_cpu, prio);
+ 
+ 	alloc_order = xive_alloc_order(xive_queue_shift);
+ 	free_pages((unsigned long)q->qpage, alloc_order);
+diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c
+index 59eea9c65d3e..79b7a3438d54 100644
+--- a/arch/s390/kernel/compat_linux.c
++++ b/arch/s390/kernel/compat_linux.c
+@@ -110,7 +110,7 @@ COMPAT_SYSCALL_DEFINE2(s390_setregid16, u16, rgid, u16, egid)
+ 
+ COMPAT_SYSCALL_DEFINE1(s390_setgid16, u16, gid)
+ {
+-	return sys_setgid((gid_t)gid);
++	return sys_setgid(low2highgid(gid));
+ }
+ 
+ COMPAT_SYSCALL_DEFINE2(s390_setreuid16, u16, ruid, u16, euid)
+@@ -120,7 +120,7 @@ COMPAT_SYSCALL_DEFINE2(s390_setreuid16, u16, ruid, u16, euid)
+ 
+ COMPAT_SYSCALL_DEFINE1(s390_setuid16, u16, uid)
+ {
+-	return sys_setuid((uid_t)uid);
++	return sys_setuid(low2highuid(uid));
+ }
+ 
+ COMPAT_SYSCALL_DEFINE3(s390_setresuid16, u16, ruid, u16, euid, u16, suid)
+@@ -173,12 +173,12 @@ COMPAT_SYSCALL_DEFINE3(s390_getresgid16, u16 __user *, rgidp,
+ 
+ COMPAT_SYSCALL_DEFINE1(s390_setfsuid16, u16, uid)
+ {
+-	return sys_setfsuid((uid_t)uid);
++	return sys_setfsuid(low2highuid(uid));
+ }
+ 
+ COMPAT_SYSCALL_DEFINE1(s390_setfsgid16, u16, gid)
+ {
+-	return sys_setfsgid((gid_t)gid);
++	return sys_setfsgid(low2highgid(gid));
+ }
+ 
+ static int groups16_to_user(u16 __user *grouplist, struct group_info *group_info)
+diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
+index 3f48f695d5e6..dce7092ab24a 100644
+--- a/arch/x86/entry/calling.h
++++ b/arch/x86/entry/calling.h
+@@ -97,80 +97,69 @@ For 32-bit we have the following conventions - kernel is built with
+ 
+ #define SIZEOF_PTREGS	21*8
+ 
+-	.macro ALLOC_PT_GPREGS_ON_STACK
+-	addq	$-(15*8), %rsp
+-	.endm
++.macro PUSH_AND_CLEAR_REGS rdx=%rdx rax=%rax
++	/*
++	 * Push registers and sanitize registers of values that a
++	 * speculation attack might otherwise want to exploit. The
++	 * lower registers are likely clobbered well before they
++	 * could be put to use in a speculative execution gadget.
++	 * Interleave XOR with PUSH for better uop scheduling:
++	 */
++	pushq   %rdi		/* pt_regs->di */
++	pushq   %rsi		/* pt_regs->si */
++	pushq	\rdx		/* pt_regs->dx */
++	pushq   %rcx		/* pt_regs->cx */
++	pushq   \rax		/* pt_regs->ax */
++	pushq   %r8		/* pt_regs->r8 */
++	xorq    %r8, %r8	/* nospec   r8 */
++	pushq   %r9		/* pt_regs->r9 */
++	xorq    %r9, %r9	/* nospec   r9 */
++	pushq   %r10		/* pt_regs->r10 */
++	xorq    %r10, %r10	/* nospec   r10 */
++	pushq   %r11		/* pt_regs->r11 */
++	xorq    %r11, %r11	/* nospec   r11*/
++	pushq	%rbx		/* pt_regs->rbx */
++	xorl    %ebx, %ebx	/* nospec   rbx*/
++	pushq	%rbp		/* pt_regs->rbp */
++	xorl    %ebp, %ebp	/* nospec   rbp*/
++	pushq	%r12		/* pt_regs->r12 */
++	xorq    %r12, %r12	/* nospec   r12*/
++	pushq	%r13		/* pt_regs->r13 */
++	xorq    %r13, %r13	/* nospec   r13*/
++	pushq	%r14		/* pt_regs->r14 */
++	xorq    %r14, %r14	/* nospec   r14*/
++	pushq	%r15		/* pt_regs->r15 */
++	xorq    %r15, %r15	/* nospec   r15*/
++	UNWIND_HINT_REGS
++.endm
+ 
+-	.macro SAVE_C_REGS_HELPER offset=0 rax=1 rcx=1 r8910=1 r11=1
+-	.if \r11
+-	movq %r11, 6*8+\offset(%rsp)
+-	.endif
+-	.if \r8910
+-	movq %r10, 7*8+\offset(%rsp)
+-	movq %r9,  8*8+\offset(%rsp)
+-	movq %r8,  9*8+\offset(%rsp)
+-	.endif
+-	.if \rax
+-	movq %rax, 10*8+\offset(%rsp)
+-	.endif
+-	.if \rcx
+-	movq %rcx, 11*8+\offset(%rsp)
+-	.endif
+-	movq %rdx, 12*8+\offset(%rsp)
+-	movq %rsi, 13*8+\offset(%rsp)
+-	movq %rdi, 14*8+\offset(%rsp)
+-	UNWIND_HINT_REGS offset=\offset extra=0
+-	.endm
+-	.macro SAVE_C_REGS offset=0
+-	SAVE_C_REGS_HELPER \offset, 1, 1, 1, 1
+-	.endm
+-	.macro SAVE_C_REGS_EXCEPT_RAX_RCX offset=0
+-	SAVE_C_REGS_HELPER \offset, 0, 0, 1, 1
+-	.endm
+-	.macro SAVE_C_REGS_EXCEPT_R891011
+-	SAVE_C_REGS_HELPER 0, 1, 1, 0, 0
+-	.endm
+-	.macro SAVE_C_REGS_EXCEPT_RCX_R891011
+-	SAVE_C_REGS_HELPER 0, 1, 0, 0, 0
+-	.endm
+-	.macro SAVE_C_REGS_EXCEPT_RAX_RCX_R11
+-	SAVE_C_REGS_HELPER 0, 0, 0, 1, 0
+-	.endm
+-
+-	.macro SAVE_EXTRA_REGS offset=0
+-	movq %r15, 0*8+\offset(%rsp)
+-	movq %r14, 1*8+\offset(%rsp)
+-	movq %r13, 2*8+\offset(%rsp)
+-	movq %r12, 3*8+\offset(%rsp)
+-	movq %rbp, 4*8+\offset(%rsp)
+-	movq %rbx, 5*8+\offset(%rsp)
+-	UNWIND_HINT_REGS offset=\offset
+-	.endm
+-
+-	.macro POP_EXTRA_REGS
++.macro POP_REGS pop_rdi=1 skip_r11rcx=0
+ 	popq %r15
+ 	popq %r14
+ 	popq %r13
+ 	popq %r12
+ 	popq %rbp
+ 	popq %rbx
+-	.endm
+-
+-	.macro POP_C_REGS
++	.if \skip_r11rcx
++	popq %rsi
++	.else
+ 	popq %r11
++	.endif
+ 	popq %r10
+ 	popq %r9
+ 	popq %r8
+ 	popq %rax
++	.if \skip_r11rcx
++	popq %rsi
++	.else
+ 	popq %rcx
++	.endif
+ 	popq %rdx
+ 	popq %rsi
++	.if \pop_rdi
+ 	popq %rdi
+-	.endm
+-
+-	.macro icebp
+-	.byte 0xf1
+-	.endm
++	.endif
++.endm
+ 
+ /*
+  * This is a sneaky trick to help the unwinder find pt_regs on the stack.  The
+@@ -178,7 +167,7 @@ For 32-bit we have the following conventions - kernel is built with
+  * is just setting the LSB, which makes it an invalid stack address and is also
+  * a signal to the unwinder that it's a pt_regs pointer in disguise.
+  *
+- * NOTE: This macro must be used *after* SAVE_EXTRA_REGS because it corrupts
++ * NOTE: This macro must be used *after* PUSH_AND_CLEAR_REGS because it corrupts
+  * the original rbp.
+  */
+ .macro ENCODE_FRAME_POINTER ptregs_offset=0
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index c752abe89d80..4fd9044e72e7 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -213,7 +213,7 @@ ENTRY(entry_SYSCALL_64)
+ 
+ 	swapgs
+ 	/*
+-	 * This path is not taken when PAGE_TABLE_ISOLATION is disabled so it
++	 * This path is only taken when PAGE_TABLE_ISOLATION is disabled so it
+ 	 * is not required to switch CR3.
+ 	 */
+ 	movq	%rsp, PER_CPU_VAR(rsp_scratch)
+@@ -227,22 +227,8 @@ ENTRY(entry_SYSCALL_64)
+ 	pushq	%rcx				/* pt_regs->ip */
+ GLOBAL(entry_SYSCALL_64_after_hwframe)
+ 	pushq	%rax				/* pt_regs->orig_ax */
+-	pushq	%rdi				/* pt_regs->di */
+-	pushq	%rsi				/* pt_regs->si */
+-	pushq	%rdx				/* pt_regs->dx */
+-	pushq	%rcx				/* pt_regs->cx */
+-	pushq	$-ENOSYS			/* pt_regs->ax */
+-	pushq	%r8				/* pt_regs->r8 */
+-	pushq	%r9				/* pt_regs->r9 */
+-	pushq	%r10				/* pt_regs->r10 */
+-	pushq	%r11				/* pt_regs->r11 */
+-	pushq	%rbx				/* pt_regs->rbx */
+-	pushq	%rbp				/* pt_regs->rbp */
+-	pushq	%r12				/* pt_regs->r12 */
+-	pushq	%r13				/* pt_regs->r13 */
+-	pushq	%r14				/* pt_regs->r14 */
+-	pushq	%r15				/* pt_regs->r15 */
+-	UNWIND_HINT_REGS
++
++	PUSH_AND_CLEAR_REGS rax=$-ENOSYS
+ 
+ 	TRACE_IRQS_OFF
+ 
+@@ -321,15 +307,7 @@ GLOBAL(entry_SYSCALL_64_after_hwframe)
+ syscall_return_via_sysret:
+ 	/* rcx and r11 are already restored (see code above) */
+ 	UNWIND_HINT_EMPTY
+-	POP_EXTRA_REGS
+-	popq	%rsi	/* skip r11 */
+-	popq	%r10
+-	popq	%r9
+-	popq	%r8
+-	popq	%rax
+-	popq	%rsi	/* skip rcx */
+-	popq	%rdx
+-	popq	%rsi
++	POP_REGS pop_rdi=0 skip_r11rcx=1
+ 
+ 	/*
+ 	 * Now all regs are restored except RSP and RDI.
+@@ -559,9 +537,7 @@ END(irq_entries_start)
+ 	call	switch_to_thread_stack
+ 1:
+ 
+-	ALLOC_PT_GPREGS_ON_STACK
+-	SAVE_C_REGS
+-	SAVE_EXTRA_REGS
++	PUSH_AND_CLEAR_REGS
+ 	ENCODE_FRAME_POINTER
+ 
+ 	testb	$3, CS(%rsp)
+@@ -622,15 +598,7 @@ GLOBAL(swapgs_restore_regs_and_return_to_usermode)
+ 	ud2
+ 1:
+ #endif
+-	POP_EXTRA_REGS
+-	popq	%r11
+-	popq	%r10
+-	popq	%r9
+-	popq	%r8
+-	popq	%rax
+-	popq	%rcx
+-	popq	%rdx
+-	popq	%rsi
++	POP_REGS pop_rdi=0
+ 
+ 	/*
+ 	 * The stack is now user RDI, orig_ax, RIP, CS, EFLAGS, RSP, SS.
+@@ -688,8 +656,7 @@ GLOBAL(restore_regs_and_return_to_kernel)
+ 	ud2
+ 1:
+ #endif
+-	POP_EXTRA_REGS
+-	POP_C_REGS
++	POP_REGS
+ 	addq	$8, %rsp	/* skip regs->orig_ax */
+ 	INTERRUPT_RETURN
+ 
+@@ -904,7 +871,9 @@ ENTRY(\sym)
+ 	pushq	$-1				/* ORIG_RAX: no syscall to restart */
+ 	.endif
+ 
+-	ALLOC_PT_GPREGS_ON_STACK
++	/* Save all registers in pt_regs */
++	PUSH_AND_CLEAR_REGS
++	ENCODE_FRAME_POINTER
+ 
+ 	.if \paranoid < 2
+ 	testb	$3, CS(%rsp)			/* If coming from userspace, switch stacks */
+@@ -1117,9 +1086,7 @@ ENTRY(xen_failsafe_callback)
+ 	addq	$0x30, %rsp
+ 	UNWIND_HINT_IRET_REGS
+ 	pushq	$-1 /* orig_ax = -1 => not a system call */
+-	ALLOC_PT_GPREGS_ON_STACK
+-	SAVE_C_REGS
+-	SAVE_EXTRA_REGS
++	PUSH_AND_CLEAR_REGS
+ 	ENCODE_FRAME_POINTER
+ 	jmp	error_exit
+ END(xen_failsafe_callback)
+@@ -1156,16 +1123,13 @@ idtentry machine_check		do_mce			has_error_code=0	paranoid=1
+ #endif
+ 
+ /*
+- * Save all registers in pt_regs, and switch gs if needed.
++ * Switch gs if needed.
+  * Use slow, but surefire "are we in kernel?" check.
+  * Return: ebx=0: need swapgs on exit, ebx=1: otherwise
+  */
+ ENTRY(paranoid_entry)
+ 	UNWIND_HINT_FUNC
+ 	cld
+-	SAVE_C_REGS 8
+-	SAVE_EXTRA_REGS 8
+-	ENCODE_FRAME_POINTER 8
+ 	movl	$1, %ebx
+ 	movl	$MSR_GS_BASE, %ecx
+ 	rdmsr
+@@ -1204,21 +1168,18 @@ ENTRY(paranoid_exit)
+ 	jmp	.Lparanoid_exit_restore
+ .Lparanoid_exit_no_swapgs:
+ 	TRACE_IRQS_IRETQ_DEBUG
++	RESTORE_CR3	scratch_reg=%rbx save_reg=%r14
+ .Lparanoid_exit_restore:
+ 	jmp restore_regs_and_return_to_kernel
+ END(paranoid_exit)
+ 
+ /*
+- * Save all registers in pt_regs, and switch gs if needed.
++ * Switch gs if needed.
+  * Return: EBX=0: came from user mode; EBX=1: otherwise
+  */
+ ENTRY(error_entry)
+-	UNWIND_HINT_FUNC
++	UNWIND_HINT_REGS offset=8
+ 	cld
+-	SAVE_C_REGS 8
+-	SAVE_EXTRA_REGS 8
+-	ENCODE_FRAME_POINTER 8
+-	xorl	%ebx, %ebx
+ 	testb	$3, CS+8(%rsp)
+ 	jz	.Lerror_kernelspace
+ 
+@@ -1399,22 +1360,7 @@ ENTRY(nmi)
+ 	pushq	1*8(%rdx)	/* pt_regs->rip */
+ 	UNWIND_HINT_IRET_REGS
+ 	pushq   $-1		/* pt_regs->orig_ax */
+-	pushq   %rdi		/* pt_regs->di */
+-	pushq   %rsi		/* pt_regs->si */
+-	pushq   (%rdx)		/* pt_regs->dx */
+-	pushq   %rcx		/* pt_regs->cx */
+-	pushq   %rax		/* pt_regs->ax */
+-	pushq   %r8		/* pt_regs->r8 */
+-	pushq   %r9		/* pt_regs->r9 */
+-	pushq   %r10		/* pt_regs->r10 */
+-	pushq   %r11		/* pt_regs->r11 */
+-	pushq	%rbx		/* pt_regs->rbx */
+-	pushq	%rbp		/* pt_regs->rbp */
+-	pushq	%r12		/* pt_regs->r12 */
+-	pushq	%r13		/* pt_regs->r13 */
+-	pushq	%r14		/* pt_regs->r14 */
+-	pushq	%r15		/* pt_regs->r15 */
+-	UNWIND_HINT_REGS
++	PUSH_AND_CLEAR_REGS rdx=(%rdx)
+ 	ENCODE_FRAME_POINTER
+ 
+ 	/*
+@@ -1624,7 +1570,8 @@ end_repeat_nmi:
+ 	 * frame to point back to repeat_nmi.
+ 	 */
+ 	pushq	$-1				/* ORIG_RAX: no syscall to restart */
+-	ALLOC_PT_GPREGS_ON_STACK
++	PUSH_AND_CLEAR_REGS
++	ENCODE_FRAME_POINTER
+ 
+ 	/*
+ 	 * Use paranoid_entry to handle SWAPGS, but no need to use paranoid_exit
+@@ -1648,8 +1595,7 @@ end_repeat_nmi:
+ nmi_swapgs:
+ 	SWAPGS_UNSAFE_STACK
+ nmi_restore:
+-	POP_EXTRA_REGS
+-	POP_C_REGS
++	POP_REGS
+ 
+ 	/*
+ 	 * Skip orig_ax and the "outermost" frame to point RSP at the "iret"
+diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
+index 98d5358e4041..fd65e016e413 100644
+--- a/arch/x86/entry/entry_64_compat.S
++++ b/arch/x86/entry/entry_64_compat.S
+@@ -85,15 +85,25 @@ ENTRY(entry_SYSENTER_compat)
+ 	pushq	%rcx			/* pt_regs->cx */
+ 	pushq	$-ENOSYS		/* pt_regs->ax */
+ 	pushq   $0			/* pt_regs->r8  = 0 */
++	xorq	%r8, %r8		/* nospec   r8 */
+ 	pushq   $0			/* pt_regs->r9  = 0 */
++	xorq	%r9, %r9		/* nospec   r9 */
+ 	pushq   $0			/* pt_regs->r10 = 0 */
++	xorq	%r10, %r10		/* nospec   r10 */
+ 	pushq   $0			/* pt_regs->r11 = 0 */
++	xorq	%r11, %r11		/* nospec   r11 */
+ 	pushq   %rbx                    /* pt_regs->rbx */
++	xorl	%ebx, %ebx		/* nospec   rbx */
+ 	pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
++	xorl	%ebp, %ebp		/* nospec   rbp */
+ 	pushq   $0			/* pt_regs->r12 = 0 */
++	xorq	%r12, %r12		/* nospec   r12 */
+ 	pushq   $0			/* pt_regs->r13 = 0 */
++	xorq	%r13, %r13		/* nospec   r13 */
+ 	pushq   $0			/* pt_regs->r14 = 0 */
++	xorq	%r14, %r14		/* nospec   r14 */
+ 	pushq   $0			/* pt_regs->r15 = 0 */
++	xorq	%r15, %r15		/* nospec   r15 */
+ 	cld
+ 
+ 	/*
+@@ -214,15 +224,25 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe)
+ 	pushq	%rbp			/* pt_regs->cx (stashed in bp) */
+ 	pushq	$-ENOSYS		/* pt_regs->ax */
+ 	pushq   $0			/* pt_regs->r8  = 0 */
++	xorq	%r8, %r8		/* nospec   r8 */
+ 	pushq   $0			/* pt_regs->r9  = 0 */
++	xorq	%r9, %r9		/* nospec   r9 */
+ 	pushq   $0			/* pt_regs->r10 = 0 */
++	xorq	%r10, %r10		/* nospec   r10 */
+ 	pushq   $0			/* pt_regs->r11 = 0 */
++	xorq	%r11, %r11		/* nospec   r11 */
+ 	pushq   %rbx                    /* pt_regs->rbx */
++	xorl	%ebx, %ebx		/* nospec   rbx */
+ 	pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
++	xorl	%ebp, %ebp		/* nospec   rbp */
+ 	pushq   $0			/* pt_regs->r12 = 0 */
++	xorq	%r12, %r12		/* nospec   r12 */
+ 	pushq   $0			/* pt_regs->r13 = 0 */
++	xorq	%r13, %r13		/* nospec   r13 */
+ 	pushq   $0			/* pt_regs->r14 = 0 */
++	xorq	%r14, %r14		/* nospec   r14 */
+ 	pushq   $0			/* pt_regs->r15 = 0 */
++	xorq	%r15, %r15		/* nospec   r15 */
+ 
+ 	/*
+ 	 * User mode is traced as though IRQs are on, and SYSENTER
+@@ -338,15 +358,25 @@ ENTRY(entry_INT80_compat)
+ 	pushq	%rcx			/* pt_regs->cx */
+ 	pushq	$-ENOSYS		/* pt_regs->ax */
+ 	pushq   $0			/* pt_regs->r8  = 0 */
++	xorq	%r8, %r8		/* nospec   r8 */
+ 	pushq   $0			/* pt_regs->r9  = 0 */
++	xorq	%r9, %r9		/* nospec   r9 */
+ 	pushq   $0			/* pt_regs->r10 = 0 */
++	xorq	%r10, %r10		/* nospec   r10 */
+ 	pushq   $0			/* pt_regs->r11 = 0 */
++	xorq	%r11, %r11		/* nospec   r11 */
+ 	pushq   %rbx                    /* pt_regs->rbx */
++	xorl	%ebx, %ebx		/* nospec   rbx */
+ 	pushq   %rbp                    /* pt_regs->rbp */
++	xorl	%ebp, %ebp		/* nospec   rbp */
+ 	pushq   %r12                    /* pt_regs->r12 */
++	xorq	%r12, %r12		/* nospec   r12 */
+ 	pushq   %r13                    /* pt_regs->r13 */
++	xorq	%r13, %r13		/* nospec   r13 */
+ 	pushq   %r14                    /* pt_regs->r14 */
++	xorq	%r14, %r14		/* nospec   r14 */
+ 	pushq   %r15                    /* pt_regs->r15 */
++	xorq	%r15, %r15		/* nospec   r15 */
+ 	cld
+ 
+ 	/*
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 731153a4681e..56457cb73448 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3559,7 +3559,7 @@ static int intel_snb_pebs_broken(int cpu)
+ 		break;
+ 
+ 	case INTEL_FAM6_SANDYBRIDGE_X:
+-		switch (cpu_data(cpu).x86_mask) {
++		switch (cpu_data(cpu).x86_stepping) {
+ 		case 6: rev = 0x618; break;
+ 		case 7: rev = 0x70c; break;
+ 		}
+diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
+index ae64d0b69729..cf372b90557e 100644
+--- a/arch/x86/events/intel/lbr.c
++++ b/arch/x86/events/intel/lbr.c
+@@ -1186,7 +1186,7 @@ void __init intel_pmu_lbr_init_atom(void)
+ 	 * on PMU interrupt
+ 	 */
+ 	if (boot_cpu_data.x86_model == 28
+-	    && boot_cpu_data.x86_mask < 10) {
++	    && boot_cpu_data.x86_stepping < 10) {
+ 		pr_cont("LBR disabled due to erratum");
+ 		return;
+ 	}
+diff --git a/arch/x86/events/intel/p6.c b/arch/x86/events/intel/p6.c
+index a5604c352930..408879b0c0d4 100644
+--- a/arch/x86/events/intel/p6.c
++++ b/arch/x86/events/intel/p6.c
+@@ -234,7 +234,7 @@ static __initconst const struct x86_pmu p6_pmu = {
+ 
+ static __init void p6_pmu_rdpmc_quirk(void)
+ {
+-	if (boot_cpu_data.x86_mask < 9) {
++	if (boot_cpu_data.x86_stepping < 9) {
+ 		/*
+ 		 * PPro erratum 26; fixed in stepping 9 and above.
+ 		 */
+diff --git a/arch/x86/include/asm/acpi.h b/arch/x86/include/asm/acpi.h
+index 8d0ec9df1cbe..f077401869ee 100644
+--- a/arch/x86/include/asm/acpi.h
++++ b/arch/x86/include/asm/acpi.h
+@@ -94,7 +94,7 @@ static inline unsigned int acpi_processor_cstate_check(unsigned int max_cstate)
+ 	if (boot_cpu_data.x86 == 0x0F &&
+ 	    boot_cpu_data.x86_vendor == X86_VENDOR_AMD &&
+ 	    boot_cpu_data.x86_model <= 0x05 &&
+-	    boot_cpu_data.x86_mask < 0x0A)
++	    boot_cpu_data.x86_stepping < 0x0A)
+ 		return 1;
+ 	else if (boot_cpu_has(X86_BUG_AMD_APIC_C1E))
+ 		return 1;
+diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
+index 30d406146016..e1259f043ae9 100644
+--- a/arch/x86/include/asm/barrier.h
++++ b/arch/x86/include/asm/barrier.h
+@@ -40,7 +40,7 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
+ 
+ 	asm ("cmp %1,%2; sbb %0,%0;"
+ 			:"=r" (mask)
+-			:"r"(size),"r" (index)
++			:"g"(size),"r" (index)
+ 			:"cc");
+ 	return mask;
+ }
+diff --git a/arch/x86/include/asm/bug.h b/arch/x86/include/asm/bug.h
+index 34d99af43994..6804d6642767 100644
+--- a/arch/x86/include/asm/bug.h
++++ b/arch/x86/include/asm/bug.h
+@@ -5,23 +5,20 @@
+ #include <linux/stringify.h>
+ 
+ /*
+- * Since some emulators terminate on UD2, we cannot use it for WARN.
+- * Since various instruction decoders disagree on the length of UD1,
+- * we cannot use it either. So use UD0 for WARN.
++ * Despite that some emulators terminate on UD2, we use it for WARN().
+  *
+- * (binutils knows about "ud1" but {en,de}codes it as 2 bytes, whereas
+- *  our kernel decoder thinks it takes a ModRM byte, which seems consistent
+- *  with various things like the Intel SDM instruction encoding rules)
++ * Since various instruction decoders/specs disagree on the encoding of
++ * UD0/UD1.
+  */
+ 
+-#define ASM_UD0		".byte 0x0f, 0xff"
++#define ASM_UD0		".byte 0x0f, 0xff" /* + ModRM (for Intel) */
+ #define ASM_UD1		".byte 0x0f, 0xb9" /* + ModRM */
+ #define ASM_UD2		".byte 0x0f, 0x0b"
+ 
+ #define INSN_UD0	0xff0f
+ #define INSN_UD2	0x0b0f
+ 
+-#define LEN_UD0		2
++#define LEN_UD2		2
+ 
+ #ifdef CONFIG_GENERIC_BUG
+ 
+@@ -77,7 +74,11 @@ do {								\
+ 	unreachable();						\
+ } while (0)
+ 
+-#define __WARN_FLAGS(flags)	_BUG_FLAGS(ASM_UD0, BUGFLAG_WARNING|(flags))
++#define __WARN_FLAGS(flags)					\
++do {								\
++	_BUG_FLAGS(ASM_UD2, BUGFLAG_WARNING|(flags));		\
++	annotate_reachable();					\
++} while (0)
+ 
+ #include <asm-generic/bug.h>
+ 
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index 4d57894635f2..76b058533e47 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -6,6 +6,7 @@
+ #include <asm/alternative.h>
+ #include <asm/alternative-asm.h>
+ #include <asm/cpufeatures.h>
++#include <asm/msr-index.h>
+ 
+ #ifdef __ASSEMBLY__
+ 
+@@ -164,10 +165,15 @@ static inline void vmexit_fill_RSB(void)
+ 
+ static inline void indirect_branch_prediction_barrier(void)
+ {
+-	alternative_input("",
+-			  "call __ibp_barrier",
+-			  X86_FEATURE_USE_IBPB,
+-			  ASM_NO_INPUT_CLOBBER("eax", "ecx", "edx", "memory"));
++	asm volatile(ALTERNATIVE("",
++				 "movl %[msr], %%ecx\n\t"
++				 "movl %[val], %%eax\n\t"
++				 "movl $0, %%edx\n\t"
++				 "wrmsr",
++				 X86_FEATURE_USE_IBPB)
++		     : : [msr] "i" (MSR_IA32_PRED_CMD),
++			 [val] "i" (PRED_CMD_IBPB)
++		     : "eax", "ecx", "edx", "memory");
+ }
+ 
+ #endif /* __ASSEMBLY__ */
+diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
+index 4baa6bceb232..d652a3808065 100644
+--- a/arch/x86/include/asm/page_64.h
++++ b/arch/x86/include/asm/page_64.h
+@@ -52,10 +52,6 @@ static inline void clear_page(void *page)
+ 
+ void copy_page(void *to, void *from);
+ 
+-#ifdef CONFIG_X86_MCE
+-#define arch_unmap_kpfn arch_unmap_kpfn
+-#endif
+-
+ #endif	/* !__ASSEMBLY__ */
+ 
+ #ifdef CONFIG_X86_VSYSCALL_EMULATION
+diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
+index 892df375b615..554841fab717 100644
+--- a/arch/x86/include/asm/paravirt.h
++++ b/arch/x86/include/asm/paravirt.h
+@@ -297,9 +297,9 @@ static inline void __flush_tlb_global(void)
+ {
+ 	PVOP_VCALL0(pv_mmu_ops.flush_tlb_kernel);
+ }
+-static inline void __flush_tlb_single(unsigned long addr)
++static inline void __flush_tlb_one_user(unsigned long addr)
+ {
+-	PVOP_VCALL1(pv_mmu_ops.flush_tlb_single, addr);
++	PVOP_VCALL1(pv_mmu_ops.flush_tlb_one_user, addr);
+ }
+ 
+ static inline void flush_tlb_others(const struct cpumask *cpumask,
+diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
+index 6ec54d01972d..f624f1f10316 100644
+--- a/arch/x86/include/asm/paravirt_types.h
++++ b/arch/x86/include/asm/paravirt_types.h
+@@ -217,7 +217,7 @@ struct pv_mmu_ops {
+ 	/* TLB operations */
+ 	void (*flush_tlb_user)(void);
+ 	void (*flush_tlb_kernel)(void);
+-	void (*flush_tlb_single)(unsigned long addr);
++	void (*flush_tlb_one_user)(unsigned long addr);
+ 	void (*flush_tlb_others)(const struct cpumask *cpus,
+ 				 const struct flush_tlb_info *info);
+ 
+diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
+index e67c0620aec2..e55466760ff8 100644
+--- a/arch/x86/include/asm/pgtable_32.h
++++ b/arch/x86/include/asm/pgtable_32.h
+@@ -61,7 +61,7 @@ void paging_init(void);
+ #define kpte_clear_flush(ptep, vaddr)		\
+ do {						\
+ 	pte_clear(&init_mm, (vaddr), (ptep));	\
+-	__flush_tlb_one((vaddr));		\
++	__flush_tlb_one_kernel((vaddr));		\
+ } while (0)
+ 
+ #endif /* !__ASSEMBLY__ */
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index 513f9604c192..44c2c4ec6d60 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -91,7 +91,7 @@ struct cpuinfo_x86 {
+ 	__u8			x86;		/* CPU family */
+ 	__u8			x86_vendor;	/* CPU vendor */
+ 	__u8			x86_model;
+-	__u8			x86_mask;
++	__u8			x86_stepping;
+ #ifdef CONFIG_X86_64
+ 	/* Number of 4K pages in DTLB/ITLB combined(in pages): */
+ 	int			x86_tlbsize;
+@@ -109,7 +109,7 @@ struct cpuinfo_x86 {
+ 	char			x86_vendor_id[16];
+ 	char			x86_model_id[64];
+ 	/* in KB - valid for CPUS which support this call: */
+-	int			x86_cache_size;
++	unsigned int		x86_cache_size;
+ 	int			x86_cache_alignment;	/* In bytes */
+ 	/* Cache QoS architectural values: */
+ 	int			x86_cache_max_rmid;	/* max index */
+@@ -969,7 +969,4 @@ bool xen_set_default_idle(void);
+ 
+ void stop_this_cpu(void *dummy);
+ void df_debug(struct pt_regs *regs, long error_code);
+-
+-void __ibp_barrier(void);
+-
+ #endif /* _ASM_X86_PROCESSOR_H */
+diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
+index 2b8f18ca5874..84137c22fdfa 100644
+--- a/arch/x86/include/asm/tlbflush.h
++++ b/arch/x86/include/asm/tlbflush.h
+@@ -140,7 +140,7 @@ static inline unsigned long build_cr3_noflush(pgd_t *pgd, u16 asid)
+ #else
+ #define __flush_tlb() __native_flush_tlb()
+ #define __flush_tlb_global() __native_flush_tlb_global()
+-#define __flush_tlb_single(addr) __native_flush_tlb_single(addr)
++#define __flush_tlb_one_user(addr) __native_flush_tlb_one_user(addr)
+ #endif
+ 
+ static inline bool tlb_defer_switch_to_init_mm(void)
+@@ -400,7 +400,7 @@ static inline void __native_flush_tlb_global(void)
+ /*
+  * flush one page in the user mapping
+  */
+-static inline void __native_flush_tlb_single(unsigned long addr)
++static inline void __native_flush_tlb_one_user(unsigned long addr)
+ {
+ 	u32 loaded_mm_asid = this_cpu_read(cpu_tlbstate.loaded_mm_asid);
+ 
+@@ -437,18 +437,31 @@ static inline void __flush_tlb_all(void)
+ /*
+  * flush one page in the kernel mapping
+  */
+-static inline void __flush_tlb_one(unsigned long addr)
++static inline void __flush_tlb_one_kernel(unsigned long addr)
+ {
+ 	count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ONE);
+-	__flush_tlb_single(addr);
++
++	/*
++	 * If PTI is off, then __flush_tlb_one_user() is just INVLPG or its
++	 * paravirt equivalent.  Even with PCID, this is sufficient: we only
++	 * use PCID if we also use global PTEs for the kernel mapping, and
++	 * INVLPG flushes global translations across all address spaces.
++	 *
++	 * If PTI is on, then the kernel is mapped with non-global PTEs, and
++	 * __flush_tlb_one_user() will flush the given address for the current
++	 * kernel address space and for its usermode counterpart, but it does
++	 * not flush it for other address spaces.
++	 */
++	__flush_tlb_one_user(addr);
+ 
+ 	if (!static_cpu_has(X86_FEATURE_PTI))
+ 		return;
+ 
+ 	/*
+-	 * __flush_tlb_single() will have cleared the TLB entry for this ASID,
+-	 * but since kernel space is replicated across all, we must also
+-	 * invalidate all others.
++	 * See above.  We need to propagate the flush to all other address
++	 * spaces.  In principle, we only need to propagate it to kernelmode
++	 * address spaces, but the extra bookkeeping we would need is not
++	 * worth it.
+ 	 */
+ 	invalidate_other_asid();
+ }
+diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
+index 6db28f17ff28..c88e0b127810 100644
+--- a/arch/x86/kernel/amd_nb.c
++++ b/arch/x86/kernel/amd_nb.c
+@@ -235,7 +235,7 @@ int amd_cache_northbridges(void)
+ 	if (boot_cpu_data.x86 == 0x10 &&
+ 	    boot_cpu_data.x86_model >= 0x8 &&
+ 	    (boot_cpu_data.x86_model > 0x9 ||
+-	     boot_cpu_data.x86_mask >= 0x1))
++	     boot_cpu_data.x86_stepping >= 0x1))
+ 		amd_northbridges.flags |= AMD_NB_L3_INDEX_DISABLE;
+ 
+ 	if (boot_cpu_data.x86 == 0x15)
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 25ddf02598d2..b203af0855b5 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -546,7 +546,7 @@ static DEFINE_PER_CPU(struct clock_event_device, lapic_events);
+ 
+ static u32 hsx_deadline_rev(void)
+ {
+-	switch (boot_cpu_data.x86_mask) {
++	switch (boot_cpu_data.x86_stepping) {
+ 	case 0x02: return 0x3a; /* EP */
+ 	case 0x04: return 0x0f; /* EX */
+ 	}
+@@ -556,7 +556,7 @@ static u32 hsx_deadline_rev(void)
+ 
+ static u32 bdx_deadline_rev(void)
+ {
+-	switch (boot_cpu_data.x86_mask) {
++	switch (boot_cpu_data.x86_stepping) {
+ 	case 0x02: return 0x00000011;
+ 	case 0x03: return 0x0700000e;
+ 	case 0x04: return 0x0f00000c;
+@@ -568,7 +568,7 @@ static u32 bdx_deadline_rev(void)
+ 
+ static u32 skx_deadline_rev(void)
+ {
+-	switch (boot_cpu_data.x86_mask) {
++	switch (boot_cpu_data.x86_stepping) {
+ 	case 0x03: return 0x01000136;
+ 	case 0x04: return 0x02000014;
+ 	}
+diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
+index e4b0d92b3ae0..2a7fd56e67b3 100644
+--- a/arch/x86/kernel/apm_32.c
++++ b/arch/x86/kernel/apm_32.c
+@@ -2389,6 +2389,7 @@ static int __init apm_init(void)
+ 	if (HZ != 100)
+ 		idle_period = (idle_period * HZ) / 100;
+ 	if (idle_threshold < 100) {
++		cpuidle_poll_state_init(&apm_idle_driver);
+ 		if (!cpuidle_register_driver(&apm_idle_driver))
+ 			if (cpuidle_register_device(&apm_cpuidle_device))
+ 				cpuidle_unregister_driver(&apm_idle_driver);
+diff --git a/arch/x86/kernel/asm-offsets_32.c b/arch/x86/kernel/asm-offsets_32.c
+index fa1261eefa16..f91ba53e06c8 100644
+--- a/arch/x86/kernel/asm-offsets_32.c
++++ b/arch/x86/kernel/asm-offsets_32.c
+@@ -18,7 +18,7 @@ void foo(void)
+ 	OFFSET(CPUINFO_x86, cpuinfo_x86, x86);
+ 	OFFSET(CPUINFO_x86_vendor, cpuinfo_x86, x86_vendor);
+ 	OFFSET(CPUINFO_x86_model, cpuinfo_x86, x86_model);
+-	OFFSET(CPUINFO_x86_mask, cpuinfo_x86, x86_mask);
++	OFFSET(CPUINFO_x86_stepping, cpuinfo_x86, x86_stepping);
+ 	OFFSET(CPUINFO_cpuid_level, cpuinfo_x86, cpuid_level);
+ 	OFFSET(CPUINFO_x86_capability, cpuinfo_x86, x86_capability);
+ 	OFFSET(CPUINFO_x86_vendor_id, cpuinfo_x86, x86_vendor_id);
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index ea831c858195..e7d5a7883632 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -119,7 +119,7 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
+ 		return;
+ 	}
+ 
+-	if (c->x86_model == 6 && c->x86_mask == 1) {
++	if (c->x86_model == 6 && c->x86_stepping == 1) {
+ 		const int K6_BUG_LOOP = 1000000;
+ 		int n;
+ 		void (*f_vide)(void);
+@@ -149,7 +149,7 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
+ 
+ 	/* K6 with old style WHCR */
+ 	if (c->x86_model < 8 ||
+-	   (c->x86_model == 8 && c->x86_mask < 8)) {
++	   (c->x86_model == 8 && c->x86_stepping < 8)) {
+ 		/* We can only write allocate on the low 508Mb */
+ 		if (mbytes > 508)
+ 			mbytes = 508;
+@@ -168,7 +168,7 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
+ 		return;
+ 	}
+ 
+-	if ((c->x86_model == 8 && c->x86_mask > 7) ||
++	if ((c->x86_model == 8 && c->x86_stepping > 7) ||
+ 	     c->x86_model == 9 || c->x86_model == 13) {
+ 		/* The more serious chips .. */
+ 
+@@ -221,7 +221,7 @@ static void init_amd_k7(struct cpuinfo_x86 *c)
+ 	 * are more robust with CLK_CTL set to 200xxxxx instead of 600xxxxx
+ 	 * As per AMD technical note 27212 0.2
+ 	 */
+-	if ((c->x86_model == 8 && c->x86_mask >= 1) || (c->x86_model > 8)) {
++	if ((c->x86_model == 8 && c->x86_stepping >= 1) || (c->x86_model > 8)) {
+ 		rdmsr(MSR_K7_CLK_CTL, l, h);
+ 		if ((l & 0xfff00000) != 0x20000000) {
+ 			pr_info("CPU: CLK_CTL MSR was %x. Reprogramming to %x\n",
+@@ -241,12 +241,12 @@ static void init_amd_k7(struct cpuinfo_x86 *c)
+ 	 * but they are not certified as MP capable.
+ 	 */
+ 	/* Athlon 660/661 is valid. */
+-	if ((c->x86_model == 6) && ((c->x86_mask == 0) ||
+-	    (c->x86_mask == 1)))
++	if ((c->x86_model == 6) && ((c->x86_stepping == 0) ||
++	    (c->x86_stepping == 1)))
+ 		return;
+ 
+ 	/* Duron 670 is valid */
+-	if ((c->x86_model == 7) && (c->x86_mask == 0))
++	if ((c->x86_model == 7) && (c->x86_stepping == 0))
+ 		return;
+ 
+ 	/*
+@@ -256,8 +256,8 @@ static void init_amd_k7(struct cpuinfo_x86 *c)
+ 	 * See http://www.heise.de/newsticker/data/jow-18.10.01-000 for
+ 	 * more.
+ 	 */
+-	if (((c->x86_model == 6) && (c->x86_mask >= 2)) ||
+-	    ((c->x86_model == 7) && (c->x86_mask >= 1)) ||
++	if (((c->x86_model == 6) && (c->x86_stepping >= 2)) ||
++	    ((c->x86_model == 7) && (c->x86_stepping >= 1)) ||
+ 	     (c->x86_model > 7))
+ 		if (cpu_has(c, X86_FEATURE_MP))
+ 			return;
+@@ -583,7 +583,7 @@ static void early_init_amd(struct cpuinfo_x86 *c)
+ 	/*  Set MTRR capability flag if appropriate */
+ 	if (c->x86 == 5)
+ 		if (c->x86_model == 13 || c->x86_model == 9 ||
+-		    (c->x86_model == 8 && c->x86_mask >= 8))
++		    (c->x86_model == 8 && c->x86_stepping >= 8))
+ 			set_cpu_cap(c, X86_FEATURE_K6_MTRR);
+ #endif
+ #if defined(CONFIG_X86_LOCAL_APIC) && defined(CONFIG_PCI)
+@@ -769,7 +769,7 @@ static void init_amd_zn(struct cpuinfo_x86 *c)
+ 	 * Fix erratum 1076: CPB feature bit not being set in CPUID. It affects
+ 	 * all up to and including B1.
+ 	 */
+-	if (c->x86_model <= 1 && c->x86_mask <= 1)
++	if (c->x86_model <= 1 && c->x86_stepping <= 1)
+ 		set_cpu_cap(c, X86_FEATURE_CPB);
+ }
+ 
+@@ -880,11 +880,11 @@ static unsigned int amd_size_cache(struct cpuinfo_x86 *c, unsigned int size)
+ 	/* AMD errata T13 (order #21922) */
+ 	if ((c->x86 == 6)) {
+ 		/* Duron Rev A0 */
+-		if (c->x86_model == 3 && c->x86_mask == 0)
++		if (c->x86_model == 3 && c->x86_stepping == 0)
+ 			size = 64;
+ 		/* Tbird rev A1/A2 */
+ 		if (c->x86_model == 4 &&
+-			(c->x86_mask == 0 || c->x86_mask == 1))
++			(c->x86_stepping == 0 || c->x86_stepping == 1))
+ 			size = 256;
+ 	}
+ 	return size;
+@@ -1021,7 +1021,7 @@ static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum)
+ 	}
+ 
+ 	/* OSVW unavailable or ID unknown, match family-model-stepping range */
+-	ms = (cpu->x86_model << 4) | cpu->x86_mask;
++	ms = (cpu->x86_model << 4) | cpu->x86_stepping;
+ 	while ((range = *erratum++))
+ 		if ((cpu->x86 == AMD_MODEL_RANGE_FAMILY(range)) &&
+ 		    (ms >= AMD_MODEL_RANGE_START(range)) &&
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 71949bf2de5a..d71c8b54b696 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -162,8 +162,7 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+ 	if (cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
+ 		return SPECTRE_V2_CMD_NONE;
+ 	else {
+-		ret = cmdline_find_option(boot_command_line, "spectre_v2", arg,
+-					  sizeof(arg));
++		ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, sizeof(arg));
+ 		if (ret < 0)
+ 			return SPECTRE_V2_CMD_AUTO;
+ 
+@@ -175,8 +174,7 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+ 		}
+ 
+ 		if (i >= ARRAY_SIZE(mitigation_options)) {
+-			pr_err("unknown option (%s). Switching to AUTO select\n",
+-			       mitigation_options[i].option);
++			pr_err("unknown option (%s). Switching to AUTO select\n", arg);
+ 			return SPECTRE_V2_CMD_AUTO;
+ 		}
+ 	}
+@@ -185,8 +183,7 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+ 	     cmd == SPECTRE_V2_CMD_RETPOLINE_AMD ||
+ 	     cmd == SPECTRE_V2_CMD_RETPOLINE_GENERIC) &&
+ 	    !IS_ENABLED(CONFIG_RETPOLINE)) {
+-		pr_err("%s selected but not compiled in. Switching to AUTO select\n",
+-		       mitigation_options[i].option);
++		pr_err("%s selected but not compiled in. Switching to AUTO select\n", mitigation_options[i].option);
+ 		return SPECTRE_V2_CMD_AUTO;
+ 	}
+ 
+@@ -256,14 +253,14 @@ static void __init spectre_v2_select_mitigation(void)
+ 			goto retpoline_auto;
+ 		break;
+ 	}
+-	pr_err("kernel not compiled with retpoline; no mitigation available!");
++	pr_err("Spectre mitigation: kernel not compiled with retpoline; no mitigation available!");
+ 	return;
+ 
+ retpoline_auto:
+ 	if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) {
+ 	retpoline_amd:
+ 		if (!boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) {
+-			pr_err("LFENCE not serializing. Switching to generic retpoline\n");
++			pr_err("Spectre mitigation: LFENCE not serializing, switching to generic retpoline\n");
+ 			goto retpoline_generic;
+ 		}
+ 		mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_AMD :
+@@ -281,7 +278,7 @@ static void __init spectre_v2_select_mitigation(void)
+ 	pr_info("%s\n", spectre_v2_strings[mode]);
+ 
+ 	/*
+-	 * If neither SMEP or KPTI are available, there is a risk of
++	 * If neither SMEP nor PTI are available, there is a risk of
+ 	 * hitting userspace addresses in the RSB after a context switch
+ 	 * from a shallow call stack to a deeper one. To prevent this fill
+ 	 * the entire RSB, even when using IBRS.
+@@ -295,21 +292,20 @@ static void __init spectre_v2_select_mitigation(void)
+ 	if ((!boot_cpu_has(X86_FEATURE_PTI) &&
+ 	     !boot_cpu_has(X86_FEATURE_SMEP)) || is_skylake_era()) {
+ 		setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
+-		pr_info("Filling RSB on context switch\n");
++		pr_info("Spectre v2 mitigation: Filling RSB on context switch\n");
+ 	}
+ 
+ 	/* Initialize Indirect Branch Prediction Barrier if supported */
+ 	if (boot_cpu_has(X86_FEATURE_IBPB)) {
+ 		setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
+-		pr_info("Enabling Indirect Branch Prediction Barrier\n");
++		pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n");
+ 	}
+ }
+ 
+ #undef pr_fmt
+ 
+ #ifdef CONFIG_SYSFS
+-ssize_t cpu_show_meltdown(struct device *dev,
+-			  struct device_attribute *attr, char *buf)
++ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf)
+ {
+ 	if (!boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN))
+ 		return sprintf(buf, "Not affected\n");
+@@ -318,16 +314,14 @@ ssize_t cpu_show_meltdown(struct device *dev,
+ 	return sprintf(buf, "Vulnerable\n");
+ }
+ 
+-ssize_t cpu_show_spectre_v1(struct device *dev,
+-			    struct device_attribute *attr, char *buf)
++ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, char *buf)
+ {
+ 	if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V1))
+ 		return sprintf(buf, "Not affected\n");
+ 	return sprintf(buf, "Mitigation: __user pointer sanitization\n");
+ }
+ 
+-ssize_t cpu_show_spectre_v2(struct device *dev,
+-			    struct device_attribute *attr, char *buf)
++ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, char *buf)
+ {
+ 	if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
+ 		return sprintf(buf, "Not affected\n");
+@@ -337,9 +331,3 @@ ssize_t cpu_show_spectre_v2(struct device *dev,
+ 		       spectre_v2_module_string());
+ }
+ #endif
+-
+-void __ibp_barrier(void)
+-{
+-	__wrmsr(MSR_IA32_PRED_CMD, PRED_CMD_IBPB, 0);
+-}
+-EXPORT_SYMBOL_GPL(__ibp_barrier);
+diff --git a/arch/x86/kernel/cpu/centaur.c b/arch/x86/kernel/cpu/centaur.c
+index 68bc6d9b3132..595be776727d 100644
+--- a/arch/x86/kernel/cpu/centaur.c
++++ b/arch/x86/kernel/cpu/centaur.c
+@@ -136,7 +136,7 @@ static void init_centaur(struct cpuinfo_x86 *c)
+ 			clear_cpu_cap(c, X86_FEATURE_TSC);
+ 			break;
+ 		case 8:
+-			switch (c->x86_mask) {
++			switch (c->x86_stepping) {
+ 			default:
+ 			name = "2";
+ 				break;
+@@ -211,7 +211,7 @@ centaur_size_cache(struct cpuinfo_x86 *c, unsigned int size)
+ 	 *  - Note, it seems this may only be in engineering samples.
+ 	 */
+ 	if ((c->x86 == 6) && (c->x86_model == 9) &&
+-				(c->x86_mask == 1) && (size == 65))
++				(c->x86_stepping == 1) && (size == 65))
+ 		size -= 1;
+ 	return size;
+ }
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index d63f4b5706e4..824aee0117bb 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -731,7 +731,7 @@ void cpu_detect(struct cpuinfo_x86 *c)
+ 		cpuid(0x00000001, &tfms, &misc, &junk, &cap0);
+ 		c->x86		= x86_family(tfms);
+ 		c->x86_model	= x86_model(tfms);
+-		c->x86_mask	= x86_stepping(tfms);
++		c->x86_stepping	= x86_stepping(tfms);
+ 
+ 		if (cap0 & (1<<19)) {
+ 			c->x86_clflush_size = ((misc >> 8) & 0xff) * 8;
+@@ -1184,9 +1184,9 @@ static void identify_cpu(struct cpuinfo_x86 *c)
+ 	int i;
+ 
+ 	c->loops_per_jiffy = loops_per_jiffy;
+-	c->x86_cache_size = -1;
++	c->x86_cache_size = 0;
+ 	c->x86_vendor = X86_VENDOR_UNKNOWN;
+-	c->x86_model = c->x86_mask = 0;	/* So far unknown... */
++	c->x86_model = c->x86_stepping = 0;	/* So far unknown... */
+ 	c->x86_vendor_id[0] = '\0'; /* Unset */
+ 	c->x86_model_id[0] = '\0';  /* Unset */
+ 	c->x86_max_cores = 1;
+@@ -1378,8 +1378,8 @@ void print_cpu_info(struct cpuinfo_x86 *c)
+ 
+ 	pr_cont(" (family: 0x%x, model: 0x%x", c->x86, c->x86_model);
+ 
+-	if (c->x86_mask || c->cpuid_level >= 0)
+-		pr_cont(", stepping: 0x%x)\n", c->x86_mask);
++	if (c->x86_stepping || c->cpuid_level >= 0)
++		pr_cont(", stepping: 0x%x)\n", c->x86_stepping);
+ 	else
+ 		pr_cont(")\n");
+ }
+diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
+index 6b4bb335641f..8949b7ae6d92 100644
+--- a/arch/x86/kernel/cpu/cyrix.c
++++ b/arch/x86/kernel/cpu/cyrix.c
+@@ -215,7 +215,7 @@ static void init_cyrix(struct cpuinfo_x86 *c)
+ 
+ 	/* common case step number/rev -- exceptions handled below */
+ 	c->x86_model = (dir1 >> 4) + 1;
+-	c->x86_mask = dir1 & 0xf;
++	c->x86_stepping = dir1 & 0xf;
+ 
+ 	/* Now cook; the original recipe is by Channing Corn, from Cyrix.
+ 	 * We do the same thing for each generation: we work out
+diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
+index 319bf989fad1..d19e903214b4 100644
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -116,14 +116,13 @@ struct sku_microcode {
+ 	u32 microcode;
+ };
+ static const struct sku_microcode spectre_bad_microcodes[] = {
+-	{ INTEL_FAM6_KABYLAKE_DESKTOP,	0x0B,	0x84 },
+-	{ INTEL_FAM6_KABYLAKE_DESKTOP,	0x0A,	0x84 },
+-	{ INTEL_FAM6_KABYLAKE_DESKTOP,	0x09,	0x84 },
+-	{ INTEL_FAM6_KABYLAKE_MOBILE,	0x0A,	0x84 },
+-	{ INTEL_FAM6_KABYLAKE_MOBILE,	0x09,	0x84 },
++	{ INTEL_FAM6_KABYLAKE_DESKTOP,	0x0B,	0x80 },
++	{ INTEL_FAM6_KABYLAKE_DESKTOP,	0x0A,	0x80 },
++	{ INTEL_FAM6_KABYLAKE_DESKTOP,	0x09,	0x80 },
++	{ INTEL_FAM6_KABYLAKE_MOBILE,	0x0A,	0x80 },
++	{ INTEL_FAM6_KABYLAKE_MOBILE,	0x09,	0x80 },
+ 	{ INTEL_FAM6_SKYLAKE_X,		0x03,	0x0100013e },
+ 	{ INTEL_FAM6_SKYLAKE_X,		0x04,	0x0200003c },
+-	{ INTEL_FAM6_SKYLAKE_MOBILE,	0x03,	0xc2 },
+ 	{ INTEL_FAM6_SKYLAKE_DESKTOP,	0x03,	0xc2 },
+ 	{ INTEL_FAM6_BROADWELL_CORE,	0x04,	0x28 },
+ 	{ INTEL_FAM6_BROADWELL_GT3E,	0x01,	0x1b },
+@@ -136,8 +135,6 @@ static const struct sku_microcode spectre_bad_microcodes[] = {
+ 	{ INTEL_FAM6_HASWELL_X,		0x02,	0x3b },
+ 	{ INTEL_FAM6_HASWELL_X,		0x04,	0x10 },
+ 	{ INTEL_FAM6_IVYBRIDGE_X,	0x04,	0x42a },
+-	/* Updated in the 20180108 release; blacklist until we know otherwise */
+-	{ INTEL_FAM6_ATOM_GEMINI_LAKE,	0x01,	0x22 },
+ 	/* Observed in the wild */
+ 	{ INTEL_FAM6_SANDYBRIDGE_X,	0x06,	0x61b },
+ 	{ INTEL_FAM6_SANDYBRIDGE_X,	0x07,	0x712 },
+@@ -149,7 +146,7 @@ static bool bad_spectre_microcode(struct cpuinfo_x86 *c)
+ 
+ 	for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) {
+ 		if (c->x86_model == spectre_bad_microcodes[i].model &&
+-		    c->x86_mask == spectre_bad_microcodes[i].stepping)
++		    c->x86_stepping == spectre_bad_microcodes[i].stepping)
+ 			return (c->microcode <= spectre_bad_microcodes[i].microcode);
+ 	}
+ 	return false;
+@@ -196,7 +193,7 @@ static void early_init_intel(struct cpuinfo_x86 *c)
+ 	 * need the microcode to have already been loaded... so if it is
+ 	 * not, recommend a BIOS update and disable large pages.
+ 	 */
+-	if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_mask <= 2 &&
++	if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_stepping <= 2 &&
+ 	    c->microcode < 0x20e) {
+ 		pr_warn("Atom PSE erratum detected, BIOS microcode update recommended\n");
+ 		clear_cpu_cap(c, X86_FEATURE_PSE);
+@@ -212,7 +209,7 @@ static void early_init_intel(struct cpuinfo_x86 *c)
+ 
+ 	/* CPUID workaround for 0F33/0F34 CPU */
+ 	if (c->x86 == 0xF && c->x86_model == 0x3
+-	    && (c->x86_mask == 0x3 || c->x86_mask == 0x4))
++	    && (c->x86_stepping == 0x3 || c->x86_stepping == 0x4))
+ 		c->x86_phys_bits = 36;
+ 
+ 	/*
+@@ -310,7 +307,7 @@ int ppro_with_ram_bug(void)
+ 	if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+ 	    boot_cpu_data.x86 == 6 &&
+ 	    boot_cpu_data.x86_model == 1 &&
+-	    boot_cpu_data.x86_mask < 8) {
++	    boot_cpu_data.x86_stepping < 8) {
+ 		pr_info("Pentium Pro with Errata#50 detected. Taking evasive action.\n");
+ 		return 1;
+ 	}
+@@ -327,7 +324,7 @@ static void intel_smp_check(struct cpuinfo_x86 *c)
+ 	 * Mask B, Pentium, but not Pentium MMX
+ 	 */
+ 	if (c->x86 == 5 &&
+-	    c->x86_mask >= 1 && c->x86_mask <= 4 &&
++	    c->x86_stepping >= 1 && c->x86_stepping <= 4 &&
+ 	    c->x86_model <= 3) {
+ 		/*
+ 		 * Remember we have B step Pentia with bugs
+@@ -370,7 +367,7 @@ static void intel_workarounds(struct cpuinfo_x86 *c)
+ 	 * SEP CPUID bug: Pentium Pro reports SEP but doesn't have it until
+ 	 * model 3 mask 3
+ 	 */
+-	if ((c->x86<<8 | c->x86_model<<4 | c->x86_mask) < 0x633)
++	if ((c->x86<<8 | c->x86_model<<4 | c->x86_stepping) < 0x633)
+ 		clear_cpu_cap(c, X86_FEATURE_SEP);
+ 
+ 	/*
+@@ -388,7 +385,7 @@ static void intel_workarounds(struct cpuinfo_x86 *c)
+ 	 * P4 Xeon erratum 037 workaround.
+ 	 * Hardware prefetcher may cause stale data to be loaded into the cache.
+ 	 */
+-	if ((c->x86 == 15) && (c->x86_model == 1) && (c->x86_mask == 1)) {
++	if ((c->x86 == 15) && (c->x86_model == 1) && (c->x86_stepping == 1)) {
+ 		if (msr_set_bit(MSR_IA32_MISC_ENABLE,
+ 				MSR_IA32_MISC_ENABLE_PREFETCH_DISABLE_BIT) > 0) {
+ 			pr_info("CPU: C0 stepping P4 Xeon detected.\n");
+@@ -403,7 +400,7 @@ static void intel_workarounds(struct cpuinfo_x86 *c)
+ 	 * Specification Update").
+ 	 */
+ 	if (boot_cpu_has(X86_FEATURE_APIC) && (c->x86<<8 | c->x86_model<<4) == 0x520 &&
+-	    (c->x86_mask < 0x6 || c->x86_mask == 0xb))
++	    (c->x86_stepping < 0x6 || c->x86_stepping == 0xb))
+ 		set_cpu_bug(c, X86_BUG_11AP);
+ 
+ 
+@@ -650,7 +647,7 @@ static void init_intel(struct cpuinfo_x86 *c)
+ 		case 6:
+ 			if (l2 == 128)
+ 				p = "Celeron (Mendocino)";
+-			else if (c->x86_mask == 0 || c->x86_mask == 5)
++			else if (c->x86_stepping == 0 || c->x86_stepping == 5)
+ 				p = "Celeron-A";
+ 			break;
+ 
+diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c
+index 99442370de40..18dd8f22e353 100644
+--- a/arch/x86/kernel/cpu/intel_rdt.c
++++ b/arch/x86/kernel/cpu/intel_rdt.c
+@@ -771,7 +771,7 @@ static __init void rdt_quirks(void)
+ 			cache_alloc_hsw_probe();
+ 		break;
+ 	case INTEL_FAM6_SKYLAKE_X:
+-		if (boot_cpu_data.x86_mask <= 4)
++		if (boot_cpu_data.x86_stepping <= 4)
+ 			set_rdt_options("!cmt,!mbmtotal,!mbmlocal,!l3cat");
+ 	}
+ }
+diff --git a/arch/x86/kernel/cpu/mcheck/mce-internal.h b/arch/x86/kernel/cpu/mcheck/mce-internal.h
+index aa0d5df9dc60..e956eb267061 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce-internal.h
++++ b/arch/x86/kernel/cpu/mcheck/mce-internal.h
+@@ -115,4 +115,19 @@ static inline void mce_unregister_injector_chain(struct notifier_block *nb)	{ }
+ 
+ extern struct mca_config mca_cfg;
+ 
++#ifndef CONFIG_X86_64
++/*
++ * On 32-bit systems it would be difficult to safely unmap a poison page
++ * from the kernel 1:1 map because there are no non-canonical addresses that
++ * we can use to refer to the address without risking a speculative access.
++ * However, this isn't much of an issue because:
++ * 1) Few unmappable pages are in the 1:1 map. Most are in HIGHMEM which
++ *    are only mapped into the kernel as needed
++ * 2) Few people would run a 32-bit kernel on a machine that supports
++ *    recoverable errors because they have too much memory to boot 32-bit.
++ */
++static inline void mce_unmap_kpfn(unsigned long pfn) {}
++#define mce_unmap_kpfn mce_unmap_kpfn
++#endif
++
+ #endif /* __X86_MCE_INTERNAL_H__ */
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 868e412b4f0c..2fe482f6ecd8 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -106,6 +106,10 @@ static struct irq_work mce_irq_work;
+ 
+ static void (*quirk_no_way_out)(int bank, struct mce *m, struct pt_regs *regs);
+ 
++#ifndef mce_unmap_kpfn
++static void mce_unmap_kpfn(unsigned long pfn);
++#endif
++
+ /*
+  * CPU/chipset specific EDAC code can register a notifier call here to print
+  * MCE errors in a human-readable form.
+@@ -582,7 +586,8 @@ static int srao_decode_notifier(struct notifier_block *nb, unsigned long val,
+ 
+ 	if (mce_usable_address(mce) && (mce->severity == MCE_AO_SEVERITY)) {
+ 		pfn = mce->addr >> PAGE_SHIFT;
+-		memory_failure(pfn, MCE_VECTOR, 0);
++		if (memory_failure(pfn, MCE_VECTOR, 0))
++			mce_unmap_kpfn(pfn);
+ 	}
+ 
+ 	return NOTIFY_OK;
+@@ -1049,12 +1054,13 @@ static int do_memory_failure(struct mce *m)
+ 	ret = memory_failure(m->addr >> PAGE_SHIFT, MCE_VECTOR, flags);
+ 	if (ret)
+ 		pr_err("Memory error not recovered");
++	else
++		mce_unmap_kpfn(m->addr >> PAGE_SHIFT);
+ 	return ret;
+ }
+ 
+-#if defined(arch_unmap_kpfn) && defined(CONFIG_MEMORY_FAILURE)
+-
+-void arch_unmap_kpfn(unsigned long pfn)
++#ifndef mce_unmap_kpfn
++static void mce_unmap_kpfn(unsigned long pfn)
+ {
+ 	unsigned long decoy_addr;
+ 
+@@ -1065,7 +1071,7 @@ void arch_unmap_kpfn(unsigned long pfn)
+ 	 * We would like to just call:
+ 	 *	set_memory_np((unsigned long)pfn_to_kaddr(pfn), 1);
+ 	 * but doing that would radically increase the odds of a
+-	 * speculative access to the posion page because we'd have
++	 * speculative access to the poison page because we'd have
+ 	 * the virtual address of the kernel 1:1 mapping sitting
+ 	 * around in registers.
+ 	 * Instead we get tricky.  We create a non-canonical address
+@@ -1090,7 +1096,6 @@ void arch_unmap_kpfn(unsigned long pfn)
+ 
+ 	if (set_memory_np(decoy_addr, 1))
+ 		pr_warn("Could not invalidate pfn=0x%lx from 1:1 map\n", pfn);
+-
+ }
+ #endif
+ 
+diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
+index f7c55b0e753a..a15db2b4e0d6 100644
+--- a/arch/x86/kernel/cpu/microcode/intel.c
++++ b/arch/x86/kernel/cpu/microcode/intel.c
+@@ -921,7 +921,7 @@ static bool is_blacklisted(unsigned int cpu)
+ 	 */
+ 	if (c->x86 == 6 &&
+ 	    c->x86_model == INTEL_FAM6_BROADWELL_X &&
+-	    c->x86_mask == 0x01 &&
++	    c->x86_stepping == 0x01 &&
+ 	    llc_size_per_core > 2621440 &&
+ 	    c->microcode < 0x0b000021) {
+ 		pr_err_once("Erratum BDF90: late loading with revision < 0x0b000021 (0x%x) disabled.\n", c->microcode);
+@@ -944,7 +944,7 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device,
+ 		return UCODE_NFOUND;
+ 
+ 	sprintf(name, "intel-ucode/%02x-%02x-%02x",
+-		c->x86, c->x86_model, c->x86_mask);
++		c->x86, c->x86_model, c->x86_stepping);
+ 
+ 	if (request_firmware_direct(&firmware, name, device)) {
+ 		pr_debug("data file %s load failed\n", name);
+@@ -982,7 +982,7 @@ static struct microcode_ops microcode_intel_ops = {
+ 
+ static int __init calc_llc_size_per_core(struct cpuinfo_x86 *c)
+ {
+-	u64 llc_size = c->x86_cache_size * 1024;
++	u64 llc_size = c->x86_cache_size * 1024ULL;
+ 
+ 	do_div(llc_size, c->x86_max_cores);
+ 
+diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
+index fdc55215d44d..e12ee86906c6 100644
+--- a/arch/x86/kernel/cpu/mtrr/generic.c
++++ b/arch/x86/kernel/cpu/mtrr/generic.c
+@@ -859,7 +859,7 @@ int generic_validate_add_page(unsigned long base, unsigned long size,
+ 	 */
+ 	if (is_cpu(INTEL) && boot_cpu_data.x86 == 6 &&
+ 	    boot_cpu_data.x86_model == 1 &&
+-	    boot_cpu_data.x86_mask <= 7) {
++	    boot_cpu_data.x86_stepping <= 7) {
+ 		if (base & ((1 << (22 - PAGE_SHIFT)) - 1)) {
+ 			pr_warn("mtrr: base(0x%lx000) is not 4 MiB aligned\n", base);
+ 			return -EINVAL;
+diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
+index 40d5a8a75212..7468de429087 100644
+--- a/arch/x86/kernel/cpu/mtrr/main.c
++++ b/arch/x86/kernel/cpu/mtrr/main.c
+@@ -711,8 +711,8 @@ void __init mtrr_bp_init(void)
+ 			if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+ 			    boot_cpu_data.x86 == 0xF &&
+ 			    boot_cpu_data.x86_model == 0x3 &&
+-			    (boot_cpu_data.x86_mask == 0x3 ||
+-			     boot_cpu_data.x86_mask == 0x4))
++			    (boot_cpu_data.x86_stepping == 0x3 ||
++			     boot_cpu_data.x86_stepping == 0x4))
+ 				phys_addr = 36;
+ 
+ 			size_or_mask = SIZE_OR_MASK_BITS(phys_addr);
+diff --git a/arch/x86/kernel/cpu/proc.c b/arch/x86/kernel/cpu/proc.c
+index e7ecedafa1c8..2c8522a39ed5 100644
+--- a/arch/x86/kernel/cpu/proc.c
++++ b/arch/x86/kernel/cpu/proc.c
+@@ -72,8 +72,8 @@ static int show_cpuinfo(struct seq_file *m, void *v)
+ 		   c->x86_model,
+ 		   c->x86_model_id[0] ? c->x86_model_id : "unknown");
+ 
+-	if (c->x86_mask || c->cpuid_level >= 0)
+-		seq_printf(m, "stepping\t: %d\n", c->x86_mask);
++	if (c->x86_stepping || c->cpuid_level >= 0)
++		seq_printf(m, "stepping\t: %d\n", c->x86_stepping);
+ 	else
+ 		seq_puts(m, "stepping\t: unknown\n");
+ 	if (c->microcode)
+@@ -91,8 +91,8 @@ static int show_cpuinfo(struct seq_file *m, void *v)
+ 	}
+ 
+ 	/* Cache size */
+-	if (c->x86_cache_size >= 0)
+-		seq_printf(m, "cache size\t: %d KB\n", c->x86_cache_size);
++	if (c->x86_cache_size)
++		seq_printf(m, "cache size\t: %u KB\n", c->x86_cache_size);
+ 
+ 	show_cpuinfo_core(m, c, cpu);
+ 	show_cpuinfo_misc(m, c);
+diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
+index 1e82f787c160..c87560e1e3ef 100644
+--- a/arch/x86/kernel/early-quirks.c
++++ b/arch/x86/kernel/early-quirks.c
+@@ -527,6 +527,7 @@ static const struct pci_device_id intel_early_ids[] __initconst = {
+ 	INTEL_SKL_IDS(&gen9_early_ops),
+ 	INTEL_BXT_IDS(&gen9_early_ops),
+ 	INTEL_KBL_IDS(&gen9_early_ops),
++	INTEL_CFL_IDS(&gen9_early_ops),
+ 	INTEL_GLK_IDS(&gen9_early_ops),
+ 	INTEL_CNL_IDS(&gen9_early_ops),
+ };
+diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
+index c29020907886..b59e4fb40fd9 100644
+--- a/arch/x86/kernel/head_32.S
++++ b/arch/x86/kernel/head_32.S
+@@ -37,7 +37,7 @@
+ #define X86		new_cpu_data+CPUINFO_x86
+ #define X86_VENDOR	new_cpu_data+CPUINFO_x86_vendor
+ #define X86_MODEL	new_cpu_data+CPUINFO_x86_model
+-#define X86_MASK	new_cpu_data+CPUINFO_x86_mask
++#define X86_STEPPING	new_cpu_data+CPUINFO_x86_stepping
+ #define X86_HARD_MATH	new_cpu_data+CPUINFO_hard_math
+ #define X86_CPUID	new_cpu_data+CPUINFO_cpuid_level
+ #define X86_CAPABILITY	new_cpu_data+CPUINFO_x86_capability
+@@ -332,7 +332,7 @@ ENTRY(startup_32_smp)
+ 	shrb $4,%al
+ 	movb %al,X86_MODEL
+ 	andb $0x0f,%cl		# mask mask revision
+-	movb %cl,X86_MASK
++	movb %cl,X86_STEPPING
+ 	movl %edx,X86_CAPABILITY
+ 
+ .Lis486:
+diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
+index 3a4b12809ab5..bc6bc6689e68 100644
+--- a/arch/x86/kernel/mpparse.c
++++ b/arch/x86/kernel/mpparse.c
+@@ -407,7 +407,7 @@ static inline void __init construct_default_ISA_mptable(int mpc_default_type)
+ 	processor.apicver = mpc_default_type > 4 ? 0x10 : 0x01;
+ 	processor.cpuflag = CPU_ENABLED;
+ 	processor.cpufeature = (boot_cpu_data.x86 << 8) |
+-	    (boot_cpu_data.x86_model << 4) | boot_cpu_data.x86_mask;
++	    (boot_cpu_data.x86_model << 4) | boot_cpu_data.x86_stepping;
+ 	processor.featureflag = boot_cpu_data.x86_capability[CPUID_1_EDX];
+ 	processor.reserved[0] = 0;
+ 	processor.reserved[1] = 0;
+diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
+index 041096bdef86..99dc79e76bdc 100644
+--- a/arch/x86/kernel/paravirt.c
++++ b/arch/x86/kernel/paravirt.c
+@@ -200,9 +200,9 @@ static void native_flush_tlb_global(void)
+ 	__native_flush_tlb_global();
+ }
+ 
+-static void native_flush_tlb_single(unsigned long addr)
++static void native_flush_tlb_one_user(unsigned long addr)
+ {
+-	__native_flush_tlb_single(addr);
++	__native_flush_tlb_one_user(addr);
+ }
+ 
+ struct static_key paravirt_steal_enabled;
+@@ -401,7 +401,7 @@ struct pv_mmu_ops pv_mmu_ops __ro_after_init = {
+ 
+ 	.flush_tlb_user = native_flush_tlb,
+ 	.flush_tlb_kernel = native_flush_tlb_global,
+-	.flush_tlb_single = native_flush_tlb_single,
++	.flush_tlb_one_user = native_flush_tlb_one_user,
+ 	.flush_tlb_others = native_flush_tlb_others,
+ 
+ 	.pgd_alloc = __paravirt_pgd_alloc,
+diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
+index 307d3bac5f04..11eda21eb697 100644
+--- a/arch/x86/kernel/relocate_kernel_64.S
++++ b/arch/x86/kernel/relocate_kernel_64.S
+@@ -68,6 +68,9 @@ relocate_kernel:
+ 	movq	%cr4, %rax
+ 	movq	%rax, CR4(%r11)
+ 
++	/* Save CR4. Required to enable the right paging mode later. */
++	movq	%rax, %r13
++
+ 	/* zero out flags, and disable interrupts */
+ 	pushq $0
+ 	popfq
+@@ -126,8 +129,13 @@ identity_mapped:
+ 	/*
+ 	 * Set cr4 to a known state:
+ 	 *  - physical address extension enabled
++	 *  - 5-level paging, if it was enabled before
+ 	 */
+ 	movl	$X86_CR4_PAE, %eax
++	testq	$X86_CR4_LA57, %r13
++	jz	1f
++	orl	$X86_CR4_LA57, %eax
++1:
+ 	movq	%rax, %cr4
+ 
+ 	jmp 1f
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index ed556d50d7ed..844279c3ff4a 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -1431,7 +1431,6 @@ static void remove_siblinginfo(int cpu)
+ 	cpumask_clear(cpu_llc_shared_mask(cpu));
+ 	cpumask_clear(topology_sibling_cpumask(cpu));
+ 	cpumask_clear(topology_core_cpumask(cpu));
+-	c->phys_proc_id = 0;
+ 	c->cpu_core_id = 0;
+ 	cpumask_clear_cpu(cpu, cpu_sibling_setup_mask);
+ 	recompute_smt_state();
+diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
+index 446c9ef8cfc3..3d9b2308e7fa 100644
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -181,7 +181,7 @@ int fixup_bug(struct pt_regs *regs, int trapnr)
+ 		break;
+ 
+ 	case BUG_TRAP_TYPE_WARN:
+-		regs->ip += LEN_UD0;
++		regs->ip += LEN_UD2;
+ 		return 1;
+ 	}
+ 
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 2b8eb4da4d08..cc83bdcb65d1 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -5058,7 +5058,7 @@ void kvm_mmu_uninit_vm(struct kvm *kvm)
+ typedef bool (*slot_level_handler) (struct kvm *kvm, struct kvm_rmap_head *rmap_head);
+ 
+ /* The caller should hold mmu-lock before calling this function. */
+-static bool
++static __always_inline bool
+ slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot,
+ 			slot_level_handler fn, int start_level, int end_level,
+ 			gfn_t start_gfn, gfn_t end_gfn, bool lock_flush_tlb)
+@@ -5088,7 +5088,7 @@ slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot,
+ 	return flush;
+ }
+ 
+-static bool
++static __always_inline bool
+ slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
+ 		  slot_level_handler fn, int start_level, int end_level,
+ 		  bool lock_flush_tlb)
+@@ -5099,7 +5099,7 @@ slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
+ 			lock_flush_tlb);
+ }
+ 
+-static bool
++static __always_inline bool
+ slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
+ 		      slot_level_handler fn, bool lock_flush_tlb)
+ {
+@@ -5107,7 +5107,7 @@ slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
+ 				 PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
+ }
+ 
+-static bool
++static __always_inline bool
+ slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
+ 			slot_level_handler fn, bool lock_flush_tlb)
+ {
+@@ -5115,7 +5115,7 @@ slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
+ 				 PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
+ }
+ 
+-static bool
++static __always_inline bool
+ slot_handle_leaf(struct kvm *kvm, struct kvm_memory_slot *memslot,
+ 		 slot_level_handler fn, bool lock_flush_tlb)
+ {
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 6f623848260f..561d8937fac5 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -10131,7 +10131,8 @@ static void nested_get_vmcs12_pages(struct kvm_vcpu *vcpu,
+ 	if (cpu_has_vmx_msr_bitmap() &&
+ 	    nested_cpu_has(vmcs12, CPU_BASED_USE_MSR_BITMAPS) &&
+ 	    nested_vmx_merge_msr_bitmap(vcpu, vmcs12))
+-		;
++		vmcs_set_bits(CPU_BASED_VM_EXEC_CONTROL,
++			      CPU_BASED_USE_MSR_BITMAPS);
+ 	else
+ 		vmcs_clear_bits(CPU_BASED_VM_EXEC_CONTROL,
+ 				CPU_BASED_USE_MSR_BITMAPS);
+@@ -10220,8 +10221,8 @@ static inline bool nested_vmx_merge_msr_bitmap(struct kvm_vcpu *vcpu,
+ 	 *    updated to reflect this when L1 (or its L2s) actually write to
+ 	 *    the MSR.
+ 	 */
+-	bool pred_cmd = msr_write_intercepted_l01(vcpu, MSR_IA32_PRED_CMD);
+-	bool spec_ctrl = msr_write_intercepted_l01(vcpu, MSR_IA32_SPEC_CTRL);
++	bool pred_cmd = !msr_write_intercepted_l01(vcpu, MSR_IA32_PRED_CMD);
++	bool spec_ctrl = !msr_write_intercepted_l01(vcpu, MSR_IA32_SPEC_CTRL);
+ 
+ 	if (!nested_cpu_has_virt_x2apic_mode(vmcs12) &&
+ 	    !pred_cmd && !spec_ctrl)
+diff --git a/arch/x86/lib/cpu.c b/arch/x86/lib/cpu.c
+index d6f848d1211d..2dd1fe13a37b 100644
+--- a/arch/x86/lib/cpu.c
++++ b/arch/x86/lib/cpu.c
+@@ -18,7 +18,7 @@ unsigned int x86_model(unsigned int sig)
+ {
+ 	unsigned int fam, model;
+ 
+-	 fam = x86_family(sig);
++	fam = x86_family(sig);
+ 
+ 	model = (sig >> 4) & 0xf;
+ 
+diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
+index 4a837289f2ad..60ae1fe3609f 100644
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -256,7 +256,7 @@ static void __set_pte_vaddr(pud_t *pud, unsigned long vaddr, pte_t new_pte)
+ 	 * It's enough to flush this one mapping.
+ 	 * (PGE mappings get flushed as well)
+ 	 */
+-	__flush_tlb_one(vaddr);
++	__flush_tlb_one_kernel(vaddr);
+ }
+ 
+ void set_pte_vaddr_p4d(p4d_t *p4d_page, unsigned long vaddr, pte_t new_pte)
+diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
+index c45b6ec5357b..e2db83bebc3b 100644
+--- a/arch/x86/mm/ioremap.c
++++ b/arch/x86/mm/ioremap.c
+@@ -820,5 +820,5 @@ void __init __early_set_fixmap(enum fixed_addresses idx,
+ 		set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
+ 	else
+ 		pte_clear(&init_mm, addr, pte);
+-	__flush_tlb_one(addr);
++	__flush_tlb_one_kernel(addr);
+ }
+diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c
+index 58477ec3d66d..7c8686709636 100644
+--- a/arch/x86/mm/kmmio.c
++++ b/arch/x86/mm/kmmio.c
+@@ -168,7 +168,7 @@ static int clear_page_presence(struct kmmio_fault_page *f, bool clear)
+ 		return -1;
+ 	}
+ 
+-	__flush_tlb_one(f->addr);
++	__flush_tlb_one_kernel(f->addr);
+ 	return 0;
+ }
+ 
+diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
+index c3c5274410a9..9bb7f0ab9fe6 100644
+--- a/arch/x86/mm/pgtable_32.c
++++ b/arch/x86/mm/pgtable_32.c
+@@ -63,7 +63,7 @@ void set_pte_vaddr(unsigned long vaddr, pte_t pteval)
+ 	 * It's enough to flush this one mapping.
+ 	 * (PGE mappings get flushed as well)
+ 	 */
+-	__flush_tlb_one(vaddr);
++	__flush_tlb_one_kernel(vaddr);
+ }
+ 
+ unsigned long __FIXADDR_TOP = 0xfffff000;
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index 012d02624848..0c936435ea93 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -492,7 +492,7 @@ static void flush_tlb_func_common(const struct flush_tlb_info *f,
+ 	 *    flush that changes context.tlb_gen from 2 to 3.  If they get
+ 	 *    processed on this CPU in reverse order, we'll see
+ 	 *     local_tlb_gen == 1, mm_tlb_gen == 3, and end != TLB_FLUSH_ALL.
+-	 *    If we were to use __flush_tlb_single() and set local_tlb_gen to
++	 *    If we were to use __flush_tlb_one_user() and set local_tlb_gen to
+ 	 *    3, we'd be break the invariant: we'd update local_tlb_gen above
+ 	 *    1 without the full flush that's needed for tlb_gen 2.
+ 	 *
+@@ -513,7 +513,7 @@ static void flush_tlb_func_common(const struct flush_tlb_info *f,
+ 
+ 		addr = f->start;
+ 		while (addr < f->end) {
+-			__flush_tlb_single(addr);
++			__flush_tlb_one_user(addr);
+ 			addr += PAGE_SIZE;
+ 		}
+ 		if (local)
+@@ -660,7 +660,7 @@ static void do_kernel_range_flush(void *info)
+ 
+ 	/* flush range by one by one 'invlpg' */
+ 	for (addr = f->start; addr < f->end; addr += PAGE_SIZE)
+-		__flush_tlb_one(addr);
++		__flush_tlb_one_kernel(addr);
+ }
+ 
+ void flush_tlb_kernel_range(unsigned long start, unsigned long end)
+diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
+index 8538a6723171..7d5d53f36a7a 100644
+--- a/arch/x86/platform/uv/tlb_uv.c
++++ b/arch/x86/platform/uv/tlb_uv.c
+@@ -299,7 +299,7 @@ static void bau_process_message(struct msg_desc *mdp, struct bau_control *bcp,
+ 		local_flush_tlb();
+ 		stat->d_alltlb++;
+ 	} else {
+-		__flush_tlb_single(msg->address);
++		__flush_tlb_one_user(msg->address);
+ 		stat->d_onetlb++;
+ 	}
+ 	stat->d_requestee++;
+diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
+index d85076223a69..aae88fec9941 100644
+--- a/arch/x86/xen/mmu_pv.c
++++ b/arch/x86/xen/mmu_pv.c
+@@ -1300,12 +1300,12 @@ static void xen_flush_tlb(void)
+ 	preempt_enable();
+ }
+ 
+-static void xen_flush_tlb_single(unsigned long addr)
++static void xen_flush_tlb_one_user(unsigned long addr)
+ {
+ 	struct mmuext_op *op;
+ 	struct multicall_space mcs;
+ 
+-	trace_xen_mmu_flush_tlb_single(addr);
++	trace_xen_mmu_flush_tlb_one_user(addr);
+ 
+ 	preempt_disable();
+ 
+@@ -2370,7 +2370,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
+ 
+ 	.flush_tlb_user = xen_flush_tlb,
+ 	.flush_tlb_kernel = xen_flush_tlb,
+-	.flush_tlb_single = xen_flush_tlb_single,
++	.flush_tlb_one_user = xen_flush_tlb_one_user,
+ 	.flush_tlb_others = xen_flush_tlb_others,
+ 
+ 	.pgd_alloc = xen_pgd_alloc,
+diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
+index 13b4f19b9131..159a897151d6 100644
+--- a/arch/x86/xen/p2m.c
++++ b/arch/x86/xen/p2m.c
+@@ -694,6 +694,9 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
+ 	int i, ret = 0;
+ 	pte_t *pte;
+ 
++	if (xen_feature(XENFEAT_auto_translated_physmap))
++		return 0;
++
+ 	if (kmap_ops) {
+ 		ret = HYPERVISOR_grant_table_op(GNTTABOP_map_grant_ref,
+ 						kmap_ops, count);
+@@ -736,6 +739,9 @@ int clear_foreign_p2m_mapping(struct gnttab_unmap_grant_ref *unmap_ops,
+ {
+ 	int i, ret = 0;
+ 
++	if (xen_feature(XENFEAT_auto_translated_physmap))
++		return 0;
++
+ 	for (i = 0; i < count; i++) {
+ 		unsigned long mfn = __pfn_to_mfn(page_to_pfn(pages[i]));
+ 		unsigned long pfn = page_to_pfn(pages[i]);
+diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
+index 497cc55a0c16..96f26e026783 100644
+--- a/arch/x86/xen/xen-head.S
++++ b/arch/x86/xen/xen-head.S
+@@ -9,7 +9,9 @@
+ 
+ #include <asm/boot.h>
+ #include <asm/asm.h>
++#include <asm/msr.h>
+ #include <asm/page_types.h>
++#include <asm/percpu.h>
+ #include <asm/unwind_hints.h>
+ 
+ #include <xen/interface/elfnote.h>
+@@ -35,6 +37,20 @@ ENTRY(startup_xen)
+ 	mov %_ASM_SI, xen_start_info
+ 	mov $init_thread_union+THREAD_SIZE, %_ASM_SP
+ 
++#ifdef CONFIG_X86_64
++	/* Set up %gs.
++	 *
++	 * The base of %gs always points to the bottom of the irqstack
++	 * union.  If the stack protector canary is enabled, it is
++	 * located at %gs:40.  Note that, on SMP, the boot cpu uses
++	 * init data section till per cpu areas are set up.
++	 */
++	movl	$MSR_GS_BASE,%ecx
++	movq	$INIT_PER_CPU_VAR(irq_stack_union),%rax
++	cdq
++	wrmsr
++#endif
++
+ 	jmp xen_start_kernel
+ END(startup_xen)
+ 	__FINIT
+diff --git a/block/blk-wbt.c b/block/blk-wbt.c
+index ae8de9780085..f92fc84b5e2c 100644
+--- a/block/blk-wbt.c
++++ b/block/blk-wbt.c
+@@ -697,7 +697,15 @@ u64 wbt_default_latency_nsec(struct request_queue *q)
+ 
+ static int wbt_data_dir(const struct request *rq)
+ {
+-	return rq_data_dir(rq);
++	const int op = req_op(rq);
++
++	if (op == REQ_OP_READ)
++		return READ;
++	else if (op == REQ_OP_WRITE || op == REQ_OP_FLUSH)
++		return WRITE;
++
++	/* don't account */
++	return -1;
+ }
+ 
+ int wbt_init(struct request_queue *q)
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 110230d86527..6835736daf2d 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -313,6 +313,9 @@ static void __device_link_del(struct device_link *link)
+ 	dev_info(link->consumer, "Dropping the link to %s\n",
+ 		 dev_name(link->supplier));
+ 
++	if (link->flags & DL_FLAG_PM_RUNTIME)
++		pm_runtime_drop_link(link->consumer);
++
+ 	list_del(&link->s_node);
+ 	list_del(&link->c_node);
+ 	device_link_free(link);
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index cc93522a6d41..1bbf14338bdb 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -124,11 +124,13 @@ static int atomic_dec_return_safe(atomic_t *v)
+ #define RBD_FEATURE_STRIPINGV2		(1ULL<<1)
+ #define RBD_FEATURE_EXCLUSIVE_LOCK	(1ULL<<2)
+ #define RBD_FEATURE_DATA_POOL		(1ULL<<7)
++#define RBD_FEATURE_OPERATIONS		(1ULL<<8)
+ 
+ #define RBD_FEATURES_ALL	(RBD_FEATURE_LAYERING |		\
+ 				 RBD_FEATURE_STRIPINGV2 |	\
+ 				 RBD_FEATURE_EXCLUSIVE_LOCK |	\
+-				 RBD_FEATURE_DATA_POOL)
++				 RBD_FEATURE_DATA_POOL |	\
++				 RBD_FEATURE_OPERATIONS)
+ 
+ /* Features supported by this (client software) implementation. */
+ 
+diff --git a/drivers/char/hw_random/via-rng.c b/drivers/char/hw_random/via-rng.c
+index d1f5bb534e0e..6e9df558325b 100644
+--- a/drivers/char/hw_random/via-rng.c
++++ b/drivers/char/hw_random/via-rng.c
+@@ -162,7 +162,7 @@ static int via_rng_init(struct hwrng *rng)
+ 	/* Enable secondary noise source on CPUs where it is present. */
+ 
+ 	/* Nehemiah stepping 8 and higher */
+-	if ((c->x86_model == 9) && (c->x86_mask > 7))
++	if ((c->x86_model == 9) && (c->x86_stepping > 7))
+ 		lo |= VIA_NOISESRC2;
+ 
+ 	/* Esther */
+diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
+index 3a2ca0f79daf..d0c34df0529c 100644
+--- a/drivers/cpufreq/acpi-cpufreq.c
++++ b/drivers/cpufreq/acpi-cpufreq.c
+@@ -629,7 +629,7 @@ static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c)
+ 	if (c->x86_vendor == X86_VENDOR_INTEL) {
+ 		if ((c->x86 == 15) &&
+ 		    (c->x86_model == 6) &&
+-		    (c->x86_mask == 8)) {
++		    (c->x86_stepping == 8)) {
+ 			pr_info("Intel(R) Xeon(R) 7100 Errata AL30, processors may lock up on frequency changes: disabling acpi-cpufreq\n");
+ 			return -ENODEV;
+ 		    }
+diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
+index c46a12df40dd..d5e27bc7585a 100644
+--- a/drivers/cpufreq/longhaul.c
++++ b/drivers/cpufreq/longhaul.c
+@@ -775,7 +775,7 @@ static int longhaul_cpu_init(struct cpufreq_policy *policy)
+ 		break;
+ 
+ 	case 7:
+-		switch (c->x86_mask) {
++		switch (c->x86_stepping) {
+ 		case 0:
+ 			longhaul_version = TYPE_LONGHAUL_V1;
+ 			cpu_model = CPU_SAMUEL2;
+@@ -787,7 +787,7 @@ static int longhaul_cpu_init(struct cpufreq_policy *policy)
+ 			break;
+ 		case 1 ... 15:
+ 			longhaul_version = TYPE_LONGHAUL_V2;
+-			if (c->x86_mask < 8) {
++			if (c->x86_stepping < 8) {
+ 				cpu_model = CPU_SAMUEL2;
+ 				cpuname = "C3 'Samuel 2' [C5B]";
+ 			} else {
+@@ -814,7 +814,7 @@ static int longhaul_cpu_init(struct cpufreq_policy *policy)
+ 		numscales = 32;
+ 		memcpy(mults, nehemiah_mults, sizeof(nehemiah_mults));
+ 		memcpy(eblcr, nehemiah_eblcr, sizeof(nehemiah_eblcr));
+-		switch (c->x86_mask) {
++		switch (c->x86_stepping) {
+ 		case 0 ... 1:
+ 			cpu_model = CPU_NEHEMIAH;
+ 			cpuname = "C3 'Nehemiah A' [C5XLOE]";
+diff --git a/drivers/cpufreq/p4-clockmod.c b/drivers/cpufreq/p4-clockmod.c
+index fd77812313f3..a25741b1281b 100644
+--- a/drivers/cpufreq/p4-clockmod.c
++++ b/drivers/cpufreq/p4-clockmod.c
+@@ -168,7 +168,7 @@ static int cpufreq_p4_cpu_init(struct cpufreq_policy *policy)
+ #endif
+ 
+ 	/* Errata workaround */
+-	cpuid = (c->x86 << 8) | (c->x86_model << 4) | c->x86_mask;
++	cpuid = (c->x86 << 8) | (c->x86_model << 4) | c->x86_stepping;
+ 	switch (cpuid) {
+ 	case 0x0f07:
+ 	case 0x0f0a:
+diff --git a/drivers/cpufreq/powernow-k7.c b/drivers/cpufreq/powernow-k7.c
+index 80ac313e6c59..302e9ce793a0 100644
+--- a/drivers/cpufreq/powernow-k7.c
++++ b/drivers/cpufreq/powernow-k7.c
+@@ -131,7 +131,7 @@ static int check_powernow(void)
+ 		return 0;
+ 	}
+ 
+-	if ((c->x86_model == 6) && (c->x86_mask == 0)) {
++	if ((c->x86_model == 6) && (c->x86_stepping == 0)) {
+ 		pr_info("K7 660[A0] core detected, enabling errata workarounds\n");
+ 		have_a0 = 1;
+ 	}
+diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
+index b6d7c4c98d0a..da7fdb4b661a 100644
+--- a/drivers/cpufreq/powernv-cpufreq.c
++++ b/drivers/cpufreq/powernv-cpufreq.c
+@@ -288,9 +288,9 @@ static int init_powernv_pstates(void)
+ 
+ 		if (id == pstate_max)
+ 			powernv_pstate_info.max = i;
+-		else if (id == pstate_nominal)
++		if (id == pstate_nominal)
+ 			powernv_pstate_info.nominal = i;
+-		else if (id == pstate_min)
++		if (id == pstate_min)
+ 			powernv_pstate_info.min = i;
+ 
+ 		if (powernv_pstate_info.wof_enabled && id == pstate_turbo) {
+diff --git a/drivers/cpufreq/speedstep-centrino.c b/drivers/cpufreq/speedstep-centrino.c
+index 41bc5397f4bb..4fa5adf16c70 100644
+--- a/drivers/cpufreq/speedstep-centrino.c
++++ b/drivers/cpufreq/speedstep-centrino.c
+@@ -37,7 +37,7 @@ struct cpu_id
+ {
+ 	__u8	x86;            /* CPU family */
+ 	__u8	x86_model;	/* model */
+-	__u8	x86_mask;	/* stepping */
++	__u8	x86_stepping;	/* stepping */
+ };
+ 
+ enum {
+@@ -277,7 +277,7 @@ static int centrino_verify_cpu_id(const struct cpuinfo_x86 *c,
+ {
+ 	if ((c->x86 == x->x86) &&
+ 	    (c->x86_model == x->x86_model) &&
+-	    (c->x86_mask == x->x86_mask))
++	    (c->x86_stepping == x->x86_stepping))
+ 		return 1;
+ 	return 0;
+ }
+diff --git a/drivers/cpufreq/speedstep-lib.c b/drivers/cpufreq/speedstep-lib.c
+index 8085ec9000d1..e3a9962ee410 100644
+--- a/drivers/cpufreq/speedstep-lib.c
++++ b/drivers/cpufreq/speedstep-lib.c
+@@ -272,9 +272,9 @@ unsigned int speedstep_detect_processor(void)
+ 		ebx = cpuid_ebx(0x00000001);
+ 		ebx &= 0x000000FF;
+ 
+-		pr_debug("ebx value is %x, x86_mask is %x\n", ebx, c->x86_mask);
++		pr_debug("ebx value is %x, x86_stepping is %x\n", ebx, c->x86_stepping);
+ 
+-		switch (c->x86_mask) {
++		switch (c->x86_stepping) {
+ 		case 4:
+ 			/*
+ 			 * B-stepping [M-P4-M]
+@@ -361,7 +361,7 @@ unsigned int speedstep_detect_processor(void)
+ 				msr_lo, msr_hi);
+ 		if ((msr_hi & (1<<18)) &&
+ 		    (relaxed_check ? 1 : (msr_hi & (3<<24)))) {
+-			if (c->x86_mask == 0x01) {
++			if (c->x86_stepping == 0x01) {
+ 				pr_debug("early PIII version\n");
+ 				return SPEEDSTEP_CPU_PIII_C_EARLY;
+ 			} else
+diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
+index 4b6642a25df5..1c6cbda56afe 100644
+--- a/drivers/crypto/padlock-aes.c
++++ b/drivers/crypto/padlock-aes.c
+@@ -512,7 +512,7 @@ static int __init padlock_init(void)
+ 
+ 	printk(KERN_NOTICE PFX "Using VIA PadLock ACE for AES algorithm.\n");
+ 
+-	if (c->x86 == 6 && c->x86_model == 15 && c->x86_mask == 2) {
++	if (c->x86 == 6 && c->x86_model == 15 && c->x86_stepping == 2) {
+ 		ecb_fetch_blocks = MAX_ECB_FETCH_BLOCKS;
+ 		cbc_fetch_blocks = MAX_CBC_FETCH_BLOCKS;
+ 		printk(KERN_NOTICE PFX "VIA Nano stepping 2 detected: enabling workaround.\n");
+diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-prng.c b/drivers/crypto/sunxi-ss/sun4i-ss-prng.c
+index 0d01d1624252..63d636424161 100644
+--- a/drivers/crypto/sunxi-ss/sun4i-ss-prng.c
++++ b/drivers/crypto/sunxi-ss/sun4i-ss-prng.c
+@@ -28,7 +28,7 @@ int sun4i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src,
+ 	algt = container_of(alg, struct sun4i_ss_alg_template, alg.rng);
+ 	ss = algt->ss;
+ 
+-	spin_lock(&ss->slock);
++	spin_lock_bh(&ss->slock);
+ 
+ 	writel(mode, ss->base + SS_CTL);
+ 
+@@ -51,6 +51,6 @@ int sun4i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src,
+ 	}
+ 
+ 	writel(0, ss->base + SS_CTL);
+-	spin_unlock(&ss->slock);
+-	return dlen;
++	spin_unlock_bh(&ss->slock);
++	return 0;
+ }
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index 78fb496ecb4e..99c4021fc33b 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -737,7 +737,7 @@ struct devfreq *devm_devfreq_add_device(struct device *dev,
+ 	devfreq = devfreq_add_device(dev, profile, governor_name, data);
+ 	if (IS_ERR(devfreq)) {
+ 		devres_free(ptr);
+-		return ERR_PTR(-ENOMEM);
++		return devfreq;
+ 	}
+ 
+ 	*ptr = devfreq;
+diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c
+index b44d9d7db347..012fa3d1f407 100644
+--- a/drivers/dma-buf/reservation.c
++++ b/drivers/dma-buf/reservation.c
+@@ -455,13 +455,15 @@ long reservation_object_wait_timeout_rcu(struct reservation_object *obj,
+ 					 unsigned long timeout)
+ {
+ 	struct dma_fence *fence;
+-	unsigned seq, shared_count, i = 0;
++	unsigned seq, shared_count;
+ 	long ret = timeout ? timeout : 1;
++	int i;
+ 
+ retry:
+ 	shared_count = 0;
+ 	seq = read_seqcount_begin(&obj->seq);
+ 	rcu_read_lock();
++	i = -1;
+ 
+ 	fence = rcu_dereference(obj->fence_excl);
+ 	if (fence && !test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags)) {
+@@ -477,14 +479,14 @@ long reservation_object_wait_timeout_rcu(struct reservation_object *obj,
+ 		fence = NULL;
+ 	}
+ 
+-	if (!fence && wait_all) {
++	if (wait_all) {
+ 		struct reservation_object_list *fobj =
+ 						rcu_dereference(obj->fence);
+ 
+ 		if (fobj)
+ 			shared_count = fobj->shared_count;
+ 
+-		for (i = 0; i < shared_count; ++i) {
++		for (i = 0; !fence && i < shared_count; ++i) {
+ 			struct dma_fence *lfence = rcu_dereference(fobj->shared[i]);
+ 
+ 			if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT,
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index 8b16ec595fa7..329cb96f886f 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -3147,7 +3147,7 @@ static struct amd64_family_type *per_family_init(struct amd64_pvt *pvt)
+ 	struct amd64_family_type *fam_type = NULL;
+ 
+ 	pvt->ext_model  = boot_cpu_data.x86_model >> 4;
+-	pvt->stepping	= boot_cpu_data.x86_mask;
++	pvt->stepping	= boot_cpu_data.x86_stepping;
+ 	pvt->model	= boot_cpu_data.x86_model;
+ 	pvt->fam	= boot_cpu_data.x86;
+ 
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/rv_smumgr.h b/drivers/gpu/drm/amd/powerplay/smumgr/rv_smumgr.h
+index 58888400f1b8..caebdbebdcd8 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/rv_smumgr.h
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/rv_smumgr.h
+@@ -40,7 +40,7 @@ struct smu_table_entry {
+ 	uint32_t table_addr_high;
+ 	uint32_t table_addr_low;
+ 	uint8_t *table;
+-	uint32_t handle;
++	unsigned long handle;
+ };
+ 
+ struct smu_table_array {
+diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
+index 9555a3542022..831b73392d82 100644
+--- a/drivers/gpu/drm/ast/ast_mode.c
++++ b/drivers/gpu/drm/ast/ast_mode.c
+@@ -644,6 +644,7 @@ static void ast_crtc_commit(struct drm_crtc *crtc)
+ {
+ 	struct ast_private *ast = crtc->dev->dev_private;
+ 	ast_set_index_reg_mask(ast, AST_IO_SEQ_PORT, 0x1, 0xdf, 0);
++	ast_crtc_load_lut(crtc);
+ }
+ 
+ 
+diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
+index aad468d170a7..d9c0f7573905 100644
+--- a/drivers/gpu/drm/drm_auth.c
++++ b/drivers/gpu/drm/drm_auth.c
+@@ -230,6 +230,12 @@ int drm_dropmaster_ioctl(struct drm_device *dev, void *data,
+ 	if (!dev->master)
+ 		goto out_unlock;
+ 
++	if (file_priv->master->lessor != NULL) {
++		DRM_DEBUG_LEASE("Attempt to drop lessee %d as master\n", file_priv->master->lessee_id);
++		ret = -EINVAL;
++		goto out_unlock;
++	}
++
+ 	ret = 0;
+ 	drm_drop_master(dev, file_priv);
+ out_unlock:
+diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
+index 4756b3c9bf2c..9a9214ae0fb5 100644
+--- a/drivers/gpu/drm/qxl/qxl_display.c
++++ b/drivers/gpu/drm/qxl/qxl_display.c
+@@ -289,6 +289,7 @@ static void qxl_crtc_destroy(struct drm_crtc *crtc)
+ {
+ 	struct qxl_crtc *qxl_crtc = to_qxl_crtc(crtc);
+ 
++	qxl_bo_unref(&qxl_crtc->cursor_bo);
+ 	drm_crtc_cleanup(crtc);
+ 	kfree(qxl_crtc);
+ }
+@@ -495,6 +496,53 @@ static int qxl_primary_atomic_check(struct drm_plane *plane,
+ 	return 0;
+ }
+ 
++static int qxl_primary_apply_cursor(struct drm_plane *plane)
++{
++	struct drm_device *dev = plane->dev;
++	struct qxl_device *qdev = dev->dev_private;
++	struct drm_framebuffer *fb = plane->state->fb;
++	struct qxl_crtc *qcrtc = to_qxl_crtc(plane->state->crtc);
++	struct qxl_cursor_cmd *cmd;
++	struct qxl_release *release;
++	int ret = 0;
++
++	if (!qcrtc->cursor_bo)
++		return 0;
++
++	ret = qxl_alloc_release_reserved(qdev, sizeof(*cmd),
++					 QXL_RELEASE_CURSOR_CMD,
++					 &release, NULL);
++	if (ret)
++		return ret;
++
++	ret = qxl_release_list_add(release, qcrtc->cursor_bo);
++	if (ret)
++		goto out_free_release;
++
++	ret = qxl_release_reserve_list(release, false);
++	if (ret)
++		goto out_free_release;
++
++	cmd = (struct qxl_cursor_cmd *)qxl_release_map(qdev, release);
++	cmd->type = QXL_CURSOR_SET;
++	cmd->u.set.position.x = plane->state->crtc_x + fb->hot_x;
++	cmd->u.set.position.y = plane->state->crtc_y + fb->hot_y;
++
++	cmd->u.set.shape = qxl_bo_physical_address(qdev, qcrtc->cursor_bo, 0);
++
++	cmd->u.set.visible = 1;
++	qxl_release_unmap(qdev, release, &cmd->release_info);
++
++	qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
++	qxl_release_fence_buffer_objects(release);
++
++	return ret;
++
++out_free_release:
++	qxl_release_free(qdev, release);
++	return ret;
++}
++
+ static void qxl_primary_atomic_update(struct drm_plane *plane,
+ 				      struct drm_plane_state *old_state)
+ {
+@@ -510,6 +558,7 @@ static void qxl_primary_atomic_update(struct drm_plane *plane,
+ 	    .x2 = qfb->base.width,
+ 	    .y2 = qfb->base.height
+ 	};
++	int ret;
+ 	bool same_shadow = false;
+ 
+ 	if (old_state->fb) {
+@@ -531,6 +580,11 @@ static void qxl_primary_atomic_update(struct drm_plane *plane,
+ 		if (!same_shadow)
+ 			qxl_io_destroy_primary(qdev);
+ 		bo_old->is_primary = false;
++
++		ret = qxl_primary_apply_cursor(plane);
++		if (ret)
++			DRM_ERROR(
++			"could not set cursor after creating primary");
+ 	}
+ 
+ 	if (!bo->is_primary) {
+@@ -571,11 +625,12 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
+ 	struct drm_device *dev = plane->dev;
+ 	struct qxl_device *qdev = dev->dev_private;
+ 	struct drm_framebuffer *fb = plane->state->fb;
++	struct qxl_crtc *qcrtc = to_qxl_crtc(plane->state->crtc);
+ 	struct qxl_release *release;
+ 	struct qxl_cursor_cmd *cmd;
+ 	struct qxl_cursor *cursor;
+ 	struct drm_gem_object *obj;
+-	struct qxl_bo *cursor_bo, *user_bo = NULL;
++	struct qxl_bo *cursor_bo = NULL, *user_bo = NULL;
+ 	int ret;
+ 	void *user_ptr;
+ 	int size = 64*64*4;
+@@ -628,6 +683,10 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
+ 		cmd->u.set.shape = qxl_bo_physical_address(qdev,
+ 							   cursor_bo, 0);
+ 		cmd->type = QXL_CURSOR_SET;
++
++		qxl_bo_unref(&qcrtc->cursor_bo);
++		qcrtc->cursor_bo = cursor_bo;
++		cursor_bo = NULL;
+ 	} else {
+ 
+ 		ret = qxl_release_reserve_list(release, true);
+@@ -645,6 +704,8 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
+ 	qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
+ 	qxl_release_fence_buffer_objects(release);
+ 
++	qxl_bo_unref(&cursor_bo);
++
+ 	return;
+ 
+ out_backoff:
+diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
+index 08752c0ffb35..00a1a66b052a 100644
+--- a/drivers/gpu/drm/qxl/qxl_drv.h
++++ b/drivers/gpu/drm/qxl/qxl_drv.h
+@@ -111,6 +111,8 @@ struct qxl_bo_list {
+ struct qxl_crtc {
+ 	struct drm_crtc base;
+ 	int index;
++
++	struct qxl_bo *cursor_bo;
+ };
+ 
+ struct qxl_output {
+diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
+index d34d1cf33895..95f4db70dd22 100644
+--- a/drivers/gpu/drm/radeon/radeon_uvd.c
++++ b/drivers/gpu/drm/radeon/radeon_uvd.c
+@@ -995,7 +995,7 @@ int radeon_uvd_calc_upll_dividers(struct radeon_device *rdev,
+ 		/* calc dclk divider with current vco freq */
+ 		dclk_div = radeon_uvd_calc_upll_post_div(vco_freq, dclk,
+ 							 pd_min, pd_even);
+-		if (vclk_div > pd_max)
++		if (dclk_div > pd_max)
+ 			break; /* vco is too big, it has to stop */
+ 
+ 		/* calc score with current vco freq */
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index ee3e74266a13..97a0a639dad9 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2984,6 +2984,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ 		    (rdev->pdev->device == 0x6667)) {
+ 			max_sclk = 75000;
+ 		}
++		if ((rdev->pdev->revision == 0xC3) ||
++		    (rdev->pdev->device == 0x6665)) {
++			max_sclk = 60000;
++			max_mclk = 80000;
++		}
+ 	} else if (rdev->family == CHIP_OLAND) {
+ 		if ((rdev->pdev->revision == 0xC7) ||
+ 		    (rdev->pdev->revision == 0x80) ||
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index c088703777e2..68eed684dff5 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -175,7 +175,8 @@ void ttm_bo_add_to_lru(struct ttm_buffer_object *bo)
+ 		list_add_tail(&bo->lru, &man->lru[bo->priority]);
+ 		kref_get(&bo->list_kref);
+ 
+-		if (bo->ttm && !(bo->ttm->page_flags & TTM_PAGE_FLAG_SG)) {
++		if (bo->ttm && !(bo->ttm->page_flags &
++				 (TTM_PAGE_FLAG_SG | TTM_PAGE_FLAG_SWAPPED))) {
+ 			list_add_tail(&bo->swap,
+ 				      &bo->glob->swap_lru[bo->priority]);
+ 			kref_get(&bo->list_kref);
+diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+index c8ebb757e36b..b17d0d38f290 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+@@ -299,7 +299,7 @@ static void ttm_bo_vm_close(struct vm_area_struct *vma)
+ 
+ static int ttm_bo_vm_access_kmap(struct ttm_buffer_object *bo,
+ 				 unsigned long offset,
+-				 void *buf, int len, int write)
++				 uint8_t *buf, int len, int write)
+ {
+ 	unsigned long page = offset >> PAGE_SHIFT;
+ 	unsigned long bytes_left = len;
+@@ -328,6 +328,7 @@ static int ttm_bo_vm_access_kmap(struct ttm_buffer_object *bo,
+ 		ttm_bo_kunmap(&map);
+ 
+ 		page++;
++		buf += bytes;
+ 		bytes_left -= bytes;
+ 		offset = 0;
+ 	} while (bytes_left);
+diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
+index c13a4fd86b3c..a42744c7665b 100644
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -268,13 +268,13 @@ static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
+ 	for (i = 0; i < ARRAY_SIZE(tjmax_model_table); i++) {
+ 		const struct tjmax_model *tm = &tjmax_model_table[i];
+ 		if (c->x86_model == tm->model &&
+-		    (tm->mask == ANY || c->x86_mask == tm->mask))
++		    (tm->mask == ANY || c->x86_stepping == tm->mask))
+ 			return tm->tjmax;
+ 	}
+ 
+ 	/* Early chips have no MSR for TjMax */
+ 
+-	if (c->x86_model == 0xf && c->x86_mask < 4)
++	if (c->x86_model == 0xf && c->x86_stepping < 4)
+ 		usemsr_ee = 0;
+ 
+ 	if (c->x86_model > 0xe && usemsr_ee) {
+@@ -425,7 +425,7 @@ static int chk_ucode_version(unsigned int cpu)
+ 	 * Readings might stop update when processor visited too deep sleep,
+ 	 * fixed for stepping D0 (6EC).
+ 	 */
+-	if (c->x86_model == 0xe && c->x86_mask < 0xc && c->microcode < 0x39) {
++	if (c->x86_model == 0xe && c->x86_stepping < 0xc && c->microcode < 0x39) {
+ 		pr_err("Errata AE18 not fixed, update BIOS or microcode of the CPU!\n");
+ 		return -ENODEV;
+ 	}
+diff --git a/drivers/hwmon/hwmon-vid.c b/drivers/hwmon/hwmon-vid.c
+index ef91b8a67549..84e91286fc4f 100644
+--- a/drivers/hwmon/hwmon-vid.c
++++ b/drivers/hwmon/hwmon-vid.c
+@@ -293,7 +293,7 @@ u8 vid_which_vrm(void)
+ 	if (c->x86 < 6)		/* Any CPU with family lower than 6 */
+ 		return 0;	/* doesn't have VID */
+ 
+-	vrm_ret = find_vrm(c->x86, c->x86_model, c->x86_mask, c->x86_vendor);
++	vrm_ret = find_vrm(c->x86, c->x86_model, c->x86_stepping, c->x86_vendor);
+ 	if (vrm_ret == 134)
+ 		vrm_ret = get_via_model_d_vrm();
+ 	if (vrm_ret == 0)
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index 0721e175664a..b960015cb073 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -226,7 +226,7 @@ static bool has_erratum_319(struct pci_dev *pdev)
+ 	 * and AM3 formats, but that's the best we can do.
+ 	 */
+ 	return boot_cpu_data.x86_model < 4 ||
+-	       (boot_cpu_data.x86_model == 4 && boot_cpu_data.x86_mask <= 2);
++	       (boot_cpu_data.x86_model == 4 && boot_cpu_data.x86_stepping <= 2);
+ }
+ 
+ static int k10temp_probe(struct pci_dev *pdev,
+diff --git a/drivers/hwmon/k8temp.c b/drivers/hwmon/k8temp.c
+index 5a632bcf869b..e59f9113fb93 100644
+--- a/drivers/hwmon/k8temp.c
++++ b/drivers/hwmon/k8temp.c
+@@ -187,7 +187,7 @@ static int k8temp_probe(struct pci_dev *pdev,
+ 		return -ENOMEM;
+ 
+ 	model = boot_cpu_data.x86_model;
+-	stepping = boot_cpu_data.x86_mask;
++	stepping = boot_cpu_data.x86_stepping;
+ 
+ 	/* feature available since SH-C0, exclude older revisions */
+ 	if ((model == 4 && stepping == 0) ||
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index 465520627e4b..d7d042a20ab4 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -462,7 +462,6 @@ int ib_register_device(struct ib_device *device,
+ 	struct ib_udata uhw = {.outlen = 0, .inlen = 0};
+ 	struct device *parent = device->dev.parent;
+ 
+-	WARN_ON_ONCE(!parent);
+ 	WARN_ON_ONCE(device->dma_device);
+ 	if (device->dev.dma_ops) {
+ 		/*
+@@ -471,16 +470,25 @@ int ib_register_device(struct ib_device *device,
+ 		 * into device->dev.
+ 		 */
+ 		device->dma_device = &device->dev;
+-		if (!device->dev.dma_mask)
+-			device->dev.dma_mask = parent->dma_mask;
+-		if (!device->dev.coherent_dma_mask)
+-			device->dev.coherent_dma_mask =
+-				parent->coherent_dma_mask;
++		if (!device->dev.dma_mask) {
++			if (parent)
++				device->dev.dma_mask = parent->dma_mask;
++			else
++				WARN_ON_ONCE(true);
++		}
++		if (!device->dev.coherent_dma_mask) {
++			if (parent)
++				device->dev.coherent_dma_mask =
++					parent->coherent_dma_mask;
++			else
++				WARN_ON_ONCE(true);
++		}
+ 	} else {
+ 		/*
+ 		 * The caller did not provide custom DMA operations. Use the
+ 		 * DMA mapping operations of the parent device.
+ 		 */
++		WARN_ON_ONCE(!parent);
+ 		device->dma_device = parent;
+ 	}
+ 
+diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
+index e30d86fa1855..8ae1308eecc7 100644
+--- a/drivers/infiniband/core/sysfs.c
++++ b/drivers/infiniband/core/sysfs.c
+@@ -1276,7 +1276,6 @@ int ib_device_register_sysfs(struct ib_device *device,
+ 	int ret;
+ 	int i;
+ 
+-	WARN_ON_ONCE(!device->dev.parent);
+ 	ret = dev_set_name(class_dev, "%s", device->name);
+ 	if (ret)
+ 		return ret;
+diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
+index 4b64dd02e090..3205800f9579 100644
+--- a/drivers/infiniband/core/user_mad.c
++++ b/drivers/infiniband/core/user_mad.c
+@@ -500,7 +500,7 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
+ 	}
+ 
+ 	memset(&ah_attr, 0, sizeof ah_attr);
+-	ah_attr.type = rdma_ah_find_type(file->port->ib_dev,
++	ah_attr.type = rdma_ah_find_type(agent->device,
+ 					 file->port->port_num);
+ 	rdma_ah_set_dlid(&ah_attr, be16_to_cpu(packet->mad.hdr.lid));
+ 	rdma_ah_set_sl(&ah_attr, packet->mad.hdr.sl);
+diff --git a/drivers/infiniband/core/uverbs_std_types.c b/drivers/infiniband/core/uverbs_std_types.c
+index c3ee5d9b336d..cca70d36ee15 100644
+--- a/drivers/infiniband/core/uverbs_std_types.c
++++ b/drivers/infiniband/core/uverbs_std_types.c
+@@ -315,7 +315,7 @@ static int uverbs_create_cq_handler(struct ib_device *ib_dev,
+ 	cq->uobject       = &obj->uobject;
+ 	cq->comp_handler  = ib_uverbs_comp_handler;
+ 	cq->event_handler = ib_uverbs_cq_event_handler;
+-	cq->cq_context    = &ev_file->ev_queue;
++	cq->cq_context    = ev_file ? &ev_file->ev_queue : NULL;
+ 	obj->uobject.object = cq;
+ 	obj->uobject.user_handle = user_handle;
+ 	atomic_set(&cq->usecnt, 0);
+diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
+index 8c8a16791a3f..5caf37ba7fff 100644
+--- a/drivers/infiniband/hw/mlx4/main.c
++++ b/drivers/infiniband/hw/mlx4/main.c
+@@ -2995,9 +2995,8 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
+ 	kfree(ibdev->ib_uc_qpns_bitmap);
+ 
+ err_steer_qp_release:
+-	if (ibdev->steering_support == MLX4_STEERING_MODE_DEVICE_MANAGED)
+-		mlx4_qp_release_range(dev, ibdev->steer_qpn_base,
+-				      ibdev->steer_qpn_count);
++	mlx4_qp_release_range(dev, ibdev->steer_qpn_base,
++			      ibdev->steer_qpn_count);
+ err_counter:
+ 	for (i = 0; i < ibdev->num_ports; ++i)
+ 		mlx4_ib_delete_counters_table(ibdev, &ibdev->counters_table[i]);
+@@ -3102,11 +3101,9 @@ static void mlx4_ib_remove(struct mlx4_dev *dev, void *ibdev_ptr)
+ 		ibdev->iboe.nb.notifier_call = NULL;
+ 	}
+ 
+-	if (ibdev->steering_support == MLX4_STEERING_MODE_DEVICE_MANAGED) {
+-		mlx4_qp_release_range(dev, ibdev->steer_qpn_base,
+-				      ibdev->steer_qpn_count);
+-		kfree(ibdev->ib_uc_qpns_bitmap);
+-	}
++	mlx4_qp_release_range(dev, ibdev->steer_qpn_base,
++			      ibdev->steer_qpn_count);
++	kfree(ibdev->ib_uc_qpns_bitmap);
+ 
+ 	iounmap(ibdev->uar_map);
+ 	for (p = 0; p < ibdev->num_ports; ++p)
+diff --git a/drivers/infiniband/hw/qib/qib_rc.c b/drivers/infiniband/hw/qib/qib_rc.c
+index 8f5754fb8579..e4a9ba1dd9ba 100644
+--- a/drivers/infiniband/hw/qib/qib_rc.c
++++ b/drivers/infiniband/hw/qib/qib_rc.c
+@@ -434,13 +434,13 @@ int qib_make_rc_req(struct rvt_qp *qp, unsigned long *flags)
+ 				qp->s_state = OP(COMPARE_SWAP);
+ 				put_ib_ateth_swap(wqe->atomic_wr.swap,
+ 						  &ohdr->u.atomic_eth);
+-				put_ib_ateth_swap(wqe->atomic_wr.compare_add,
+-						  &ohdr->u.atomic_eth);
++				put_ib_ateth_compare(wqe->atomic_wr.compare_add,
++						     &ohdr->u.atomic_eth);
+ 			} else {
+ 				qp->s_state = OP(FETCH_ADD);
+ 				put_ib_ateth_swap(wqe->atomic_wr.compare_add,
+ 						  &ohdr->u.atomic_eth);
+-				put_ib_ateth_swap(0, &ohdr->u.atomic_eth);
++				put_ib_ateth_compare(0, &ohdr->u.atomic_eth);
+ 			}
+ 			put_ib_ateth_vaddr(wqe->atomic_wr.remote_addr,
+ 					   &ohdr->u.atomic_eth);
+diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h
+index d7472a442a2c..96c3a6c5c4b5 100644
+--- a/drivers/infiniband/sw/rxe/rxe_loc.h
++++ b/drivers/infiniband/sw/rxe/rxe_loc.h
+@@ -237,7 +237,6 @@ int rxe_srq_from_attr(struct rxe_dev *rxe, struct rxe_srq *srq,
+ 
+ void rxe_release(struct kref *kref);
+ 
+-void rxe_drain_req_pkts(struct rxe_qp *qp, bool notify);
+ int rxe_completer(void *arg);
+ int rxe_requester(void *arg);
+ int rxe_responder(void *arg);
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index 4469592b839d..137d6c0c49d4 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -824,9 +824,9 @@ void rxe_qp_destroy(struct rxe_qp *qp)
+ }
+ 
+ /* called when the last reference to the qp is dropped */
+-void rxe_qp_cleanup(struct rxe_pool_entry *arg)
++static void rxe_qp_do_cleanup(struct work_struct *work)
+ {
+-	struct rxe_qp *qp = container_of(arg, typeof(*qp), pelem);
++	struct rxe_qp *qp = container_of(work, typeof(*qp), cleanup_work.work);
+ 
+ 	rxe_drop_all_mcast_groups(qp);
+ 
+@@ -859,3 +859,11 @@ void rxe_qp_cleanup(struct rxe_pool_entry *arg)
+ 	kernel_sock_shutdown(qp->sk, SHUT_RDWR);
+ 	sock_release(qp->sk);
+ }
++
++/* called when the last reference to the qp is dropped */
++void rxe_qp_cleanup(struct rxe_pool_entry *arg)
++{
++	struct rxe_qp *qp = container_of(arg, typeof(*qp), pelem);
++
++	execute_in_process_context(rxe_qp_do_cleanup, &qp->cleanup_work);
++}
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index 26a7f923045b..7bdaf71b8221 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -594,15 +594,8 @@ int rxe_requester(void *arg)
+ 	rxe_add_ref(qp);
+ 
+ next_wqe:
+-	if (unlikely(!qp->valid)) {
+-		rxe_drain_req_pkts(qp, true);
++	if (unlikely(!qp->valid || qp->req.state == QP_STATE_ERROR))
+ 		goto exit;
+-	}
+-
+-	if (unlikely(qp->req.state == QP_STATE_ERROR)) {
+-		rxe_drain_req_pkts(qp, true);
+-		goto exit;
+-	}
+ 
+ 	if (unlikely(qp->req.state == QP_STATE_RESET)) {
+ 		qp->req.wqe_index = consumer_index(qp->sq.queue);
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index 4240866a5331..01f926fd9029 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -1210,7 +1210,7 @@ static enum resp_states do_class_d1e_error(struct rxe_qp *qp)
+ 	}
+ }
+ 
+-void rxe_drain_req_pkts(struct rxe_qp *qp, bool notify)
++static void rxe_drain_req_pkts(struct rxe_qp *qp, bool notify)
+ {
+ 	struct sk_buff *skb;
+ 
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
+index d03002b9d84d..7210a784abb4 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
+@@ -814,6 +814,8 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, struct ib_send_wr *wr,
+ 			(queue_count(qp->sq.queue) > 1);
+ 
+ 	rxe_run_task(&qp->req.task, must_sched);
++	if (unlikely(qp->req.state == QP_STATE_ERROR))
++		rxe_run_task(&qp->comp.task, 1);
+ 
+ 	return err;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index 0c2dbe45c729..1019f5e7dbdd 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -35,6 +35,7 @@
+ #define RXE_VERBS_H
+ 
+ #include <linux/interrupt.h>
++#include <linux/workqueue.h>
+ #include <rdma/rdma_user_rxe.h>
+ #include "rxe_pool.h"
+ #include "rxe_task.h"
+@@ -281,6 +282,8 @@ struct rxe_qp {
+ 	struct timer_list rnr_nak_timer;
+ 
+ 	spinlock_t		state_lock; /* guard requester and completer */
++
++	struct execute_work	cleanup_work;
+ };
+ 
+ enum rxe_mem_state {
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index de17b7193299..1c42b00d3be2 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -817,7 +817,8 @@ static void dec_pending(struct dm_io *io, blk_status_t error)
+ 			queue_io(md, bio);
+ 		} else {
+ 			/* done with normal IO or empty flush */
+-			bio->bi_status = io_error;
++			if (io_error)
++				bio->bi_status = io_error;
+ 			bio_endio(bio);
+ 		}
+ 	}
+diff --git a/drivers/media/tuners/r820t.c b/drivers/media/tuners/r820t.c
+index ba80376a3b86..d097eb04a0e9 100644
+--- a/drivers/media/tuners/r820t.c
++++ b/drivers/media/tuners/r820t.c
+@@ -396,9 +396,11 @@ static int r820t_write(struct r820t_priv *priv, u8 reg, const u8 *val,
+ 	return 0;
+ }
+ 
+-static int r820t_write_reg(struct r820t_priv *priv, u8 reg, u8 val)
++static inline int r820t_write_reg(struct r820t_priv *priv, u8 reg, u8 val)
+ {
+-	return r820t_write(priv, reg, &val, 1);
++	u8 tmp = val; /* work around GCC PR81715 with asan-stack=1 */
++
++	return r820t_write(priv, reg, &tmp, 1);
+ }
+ 
+ static int r820t_read_cache_reg(struct r820t_priv *priv, int reg)
+@@ -411,17 +413,18 @@ static int r820t_read_cache_reg(struct r820t_priv *priv, int reg)
+ 		return -EINVAL;
+ }
+ 
+-static int r820t_write_reg_mask(struct r820t_priv *priv, u8 reg, u8 val,
++static inline int r820t_write_reg_mask(struct r820t_priv *priv, u8 reg, u8 val,
+ 				u8 bit_mask)
+ {
++	u8 tmp = val;
+ 	int rc = r820t_read_cache_reg(priv, reg);
+ 
+ 	if (rc < 0)
+ 		return rc;
+ 
+-	val = (rc & ~bit_mask) | (val & bit_mask);
++	tmp = (rc & ~bit_mask) | (tmp & bit_mask);
+ 
+-	return r820t_write(priv, reg, &val, 1);
++	return r820t_write(priv, reg, &tmp, 1);
+ }
+ 
+ static int r820t_read(struct r820t_priv *priv, u8 reg, u8 *val, int len)
+diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
+index 229dc18f0581..768972af8b85 100644
+--- a/drivers/mmc/host/bcm2835.c
++++ b/drivers/mmc/host/bcm2835.c
+@@ -1265,7 +1265,8 @@ static int bcm2835_add_host(struct bcm2835_host *host)
+ 	char pio_limit_string[20];
+ 	int ret;
+ 
+-	mmc->f_max = host->max_clk;
++	if (!mmc->f_max || mmc->f_max > host->max_clk)
++		mmc->f_max = host->max_clk;
+ 	mmc->f_min = host->max_clk / SDCDIV_MAX_CDIV;
+ 
+ 	mmc->max_busy_timeout = ~0 / (mmc->f_max / 1000);
+diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
+index e0862d3f65b3..730fbe01726d 100644
+--- a/drivers/mmc/host/meson-gx-mmc.c
++++ b/drivers/mmc/host/meson-gx-mmc.c
+@@ -716,22 +716,6 @@ static int meson_mmc_clk_phase_tuning(struct mmc_host *mmc, u32 opcode,
+ static int meson_mmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ {
+ 	struct meson_host *host = mmc_priv(mmc);
+-	int ret;
+-
+-	/*
+-	 * If this is the initial tuning, try to get a sane Rx starting
+-	 * phase before doing the actual tuning.
+-	 */
+-	if (!mmc->doing_retune) {
+-		ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
+-
+-		if (ret)
+-			return ret;
+-	}
+-
+-	ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->tx_clk);
+-	if (ret)
+-		return ret;
+ 
+ 	return meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
+ }
+@@ -762,9 +746,8 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ 		if (!IS_ERR(mmc->supply.vmmc))
+ 			mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
+ 
+-		/* Reset phases */
++		/* Reset rx phase */
+ 		clk_set_phase(host->rx_clk, 0);
+-		clk_set_phase(host->tx_clk, 270);
+ 
+ 		break;
+ 
+diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
+index 1f424374bbbb..4ffa6b173a21 100644
+--- a/drivers/mmc/host/sdhci-of-esdhc.c
++++ b/drivers/mmc/host/sdhci-of-esdhc.c
+@@ -589,10 +589,18 @@ static void esdhc_pltfm_set_bus_width(struct sdhci_host *host, int width)
+ 
+ static void esdhc_reset(struct sdhci_host *host, u8 mask)
+ {
++	u32 val;
++
+ 	sdhci_reset(host, mask);
+ 
+ 	sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
+ 	sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
++
++	if (mask & SDHCI_RESET_ALL) {
++		val = sdhci_readl(host, ESDHC_TBCTL);
++		val &= ~ESDHC_TB_EN;
++		sdhci_writel(host, val, ESDHC_TBCTL);
++	}
+ }
+ 
+ /* The SCFG, Supplemental Configuration Unit, provides SoC specific
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index e9290a3439d5..d24306b2b839 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -21,6 +21,7 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/slab.h>
+ #include <linux/scatterlist.h>
++#include <linux/sizes.h>
+ #include <linux/swiotlb.h>
+ #include <linux/regulator/consumer.h>
+ #include <linux/pm_runtime.h>
+@@ -502,8 +503,35 @@ static int sdhci_pre_dma_transfer(struct sdhci_host *host,
+ 	if (data->host_cookie == COOKIE_PRE_MAPPED)
+ 		return data->sg_count;
+ 
+-	sg_count = dma_map_sg(mmc_dev(host->mmc), data->sg, data->sg_len,
+-			      mmc_get_dma_dir(data));
++	/* Bounce write requests to the bounce buffer */
++	if (host->bounce_buffer) {
++		unsigned int length = data->blksz * data->blocks;
++
++		if (length > host->bounce_buffer_size) {
++			pr_err("%s: asked for transfer of %u bytes exceeds bounce buffer %u bytes\n",
++			       mmc_hostname(host->mmc), length,
++			       host->bounce_buffer_size);
++			return -EIO;
++		}
++		if (mmc_get_dma_dir(data) == DMA_TO_DEVICE) {
++			/* Copy the data to the bounce buffer */
++			sg_copy_to_buffer(data->sg, data->sg_len,
++					  host->bounce_buffer,
++					  length);
++		}
++		/* Switch ownership to the DMA */
++		dma_sync_single_for_device(host->mmc->parent,
++					   host->bounce_addr,
++					   host->bounce_buffer_size,
++					   mmc_get_dma_dir(data));
++		/* Just a dummy value */
++		sg_count = 1;
++	} else {
++		/* Just access the data directly from memory */
++		sg_count = dma_map_sg(mmc_dev(host->mmc),
++				      data->sg, data->sg_len,
++				      mmc_get_dma_dir(data));
++	}
+ 
+ 	if (sg_count == 0)
+ 		return -ENOSPC;
+@@ -673,6 +701,14 @@ static void sdhci_adma_table_post(struct sdhci_host *host,
+ 	}
+ }
+ 
++static u32 sdhci_sdma_address(struct sdhci_host *host)
++{
++	if (host->bounce_buffer)
++		return host->bounce_addr;
++	else
++		return sg_dma_address(host->data->sg);
++}
++
+ static u8 sdhci_calc_timeout(struct sdhci_host *host, struct mmc_command *cmd)
+ {
+ 	u8 count;
+@@ -858,8 +894,8 @@ static void sdhci_prepare_data(struct sdhci_host *host, struct mmc_command *cmd)
+ 					     SDHCI_ADMA_ADDRESS_HI);
+ 		} else {
+ 			WARN_ON(sg_cnt != 1);
+-			sdhci_writel(host, sg_dma_address(data->sg),
+-				SDHCI_DMA_ADDRESS);
++			sdhci_writel(host, sdhci_sdma_address(host),
++				     SDHCI_DMA_ADDRESS);
+ 		}
+ 	}
+ 
+@@ -2248,7 +2284,12 @@ static void sdhci_pre_req(struct mmc_host *mmc, struct mmc_request *mrq)
+ 
+ 	mrq->data->host_cookie = COOKIE_UNMAPPED;
+ 
+-	if (host->flags & SDHCI_REQ_USE_DMA)
++	/*
++	 * No pre-mapping in the pre hook if we're using the bounce buffer,
++	 * for that we would need two bounce buffers since one buffer is
++	 * in flight when this is getting called.
++	 */
++	if (host->flags & SDHCI_REQ_USE_DMA && !host->bounce_buffer)
+ 		sdhci_pre_dma_transfer(host, mrq->data, COOKIE_PRE_MAPPED);
+ }
+ 
+@@ -2352,8 +2393,45 @@ static bool sdhci_request_done(struct sdhci_host *host)
+ 		struct mmc_data *data = mrq->data;
+ 
+ 		if (data && data->host_cookie == COOKIE_MAPPED) {
+-			dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len,
+-				     mmc_get_dma_dir(data));
++			if (host->bounce_buffer) {
++				/*
++				 * On reads, copy the bounced data into the
++				 * sglist
++				 */
++				if (mmc_get_dma_dir(data) == DMA_FROM_DEVICE) {
++					unsigned int length = data->bytes_xfered;
++
++					if (length > host->bounce_buffer_size) {
++						pr_err("%s: bounce buffer is %u bytes but DMA claims to have transferred %u bytes\n",
++						       mmc_hostname(host->mmc),
++						       host->bounce_buffer_size,
++						       data->bytes_xfered);
++						/* Cap it down and continue */
++						length = host->bounce_buffer_size;
++					}
++					dma_sync_single_for_cpu(
++						host->mmc->parent,
++						host->bounce_addr,
++						host->bounce_buffer_size,
++						DMA_FROM_DEVICE);
++					sg_copy_from_buffer(data->sg,
++						data->sg_len,
++						host->bounce_buffer,
++						length);
++				} else {
++					/* No copying, just switch ownership */
++					dma_sync_single_for_cpu(
++						host->mmc->parent,
++						host->bounce_addr,
++						host->bounce_buffer_size,
++						mmc_get_dma_dir(data));
++				}
++			} else {
++				/* Unmap the raw data */
++				dma_unmap_sg(mmc_dev(host->mmc), data->sg,
++					     data->sg_len,
++					     mmc_get_dma_dir(data));
++			}
+ 			data->host_cookie = COOKIE_UNMAPPED;
+ 		}
+ 	}
+@@ -2636,7 +2714,8 @@ static void sdhci_data_irq(struct sdhci_host *host, u32 intmask)
+ 		 */
+ 		if (intmask & SDHCI_INT_DMA_END) {
+ 			u32 dmastart, dmanow;
+-			dmastart = sg_dma_address(host->data->sg);
++
++			dmastart = sdhci_sdma_address(host);
+ 			dmanow = dmastart + host->data->bytes_xfered;
+ 			/*
+ 			 * Force update to the next DMA block boundary.
+@@ -3217,6 +3296,68 @@ void __sdhci_read_caps(struct sdhci_host *host, u16 *ver, u32 *caps, u32 *caps1)
+ }
+ EXPORT_SYMBOL_GPL(__sdhci_read_caps);
+ 
++static int sdhci_allocate_bounce_buffer(struct sdhci_host *host)
++{
++	struct mmc_host *mmc = host->mmc;
++	unsigned int max_blocks;
++	unsigned int bounce_size;
++	int ret;
++
++	/*
++	 * Cap the bounce buffer at 64KB. Using a bigger bounce buffer
++	 * has diminishing returns, this is probably because SD/MMC
++	 * cards are usually optimized to handle this size of requests.
++	 */
++	bounce_size = SZ_64K;
++	/*
++	 * Adjust downwards to maximum request size if this is less
++	 * than our segment size, else hammer down the maximum
++	 * request size to the maximum buffer size.
++	 */
++	if (mmc->max_req_size < bounce_size)
++		bounce_size = mmc->max_req_size;
++	max_blocks = bounce_size / 512;
++
++	/*
++	 * When we just support one segment, we can get significant
++	 * speedups by the help of a bounce buffer to group scattered
++	 * reads/writes together.
++	 */
++	host->bounce_buffer = devm_kmalloc(mmc->parent,
++					   bounce_size,
++					   GFP_KERNEL);
++	if (!host->bounce_buffer) {
++		pr_err("%s: failed to allocate %u bytes for bounce buffer, falling back to single segments\n",
++		       mmc_hostname(mmc),
++		       bounce_size);
++		/*
++		 * Exiting with zero here makes sure we proceed with
++		 * mmc->max_segs == 1.
++		 */
++		return 0;
++	}
++
++	host->bounce_addr = dma_map_single(mmc->parent,
++					   host->bounce_buffer,
++					   bounce_size,
++					   DMA_BIDIRECTIONAL);
++	ret = dma_mapping_error(mmc->parent, host->bounce_addr);
++	if (ret)
++		/* Again fall back to max_segs == 1 */
++		return 0;
++	host->bounce_buffer_size = bounce_size;
++
++	/* Lie about this since we're bouncing */
++	mmc->max_segs = max_blocks;
++	mmc->max_seg_size = bounce_size;
++	mmc->max_req_size = bounce_size;
++
++	pr_info("%s bounce up to %u segments into one, max segment size %u bytes\n",
++		mmc_hostname(mmc), max_blocks, bounce_size);
++
++	return 0;
++}
++
+ int sdhci_setup_host(struct sdhci_host *host)
+ {
+ 	struct mmc_host *mmc;
+@@ -3713,6 +3854,13 @@ int sdhci_setup_host(struct sdhci_host *host)
+ 	 */
+ 	mmc->max_blk_count = (host->quirks & SDHCI_QUIRK_NO_MULTIBLOCK) ? 1 : 65535;
+ 
++	if (mmc->max_segs == 1) {
++		/* This may alter mmc->*_blk_* parameters */
++		ret = sdhci_allocate_bounce_buffer(host);
++		if (ret)
++			return ret;
++	}
++
+ 	return 0;
+ 
+ unreg:
+diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
+index 54bc444c317f..1d7d61e25dbf 100644
+--- a/drivers/mmc/host/sdhci.h
++++ b/drivers/mmc/host/sdhci.h
+@@ -440,6 +440,9 @@ struct sdhci_host {
+ 
+ 	int irq;		/* Device IRQ */
+ 	void __iomem *ioaddr;	/* Mapped address */
++	char *bounce_buffer;	/* For packing SDMA reads/writes */
++	dma_addr_t bounce_addr;
++	unsigned int bounce_buffer_size;
+ 
+ 	const struct sdhci_ops *ops;	/* Low level hw interface */
+ 
+diff --git a/drivers/mtd/nand/vf610_nfc.c b/drivers/mtd/nand/vf610_nfc.c
+index 8037d4b48a05..e2583a539b41 100644
+--- a/drivers/mtd/nand/vf610_nfc.c
++++ b/drivers/mtd/nand/vf610_nfc.c
+@@ -752,10 +752,8 @@ static int vf610_nfc_probe(struct platform_device *pdev)
+ 		if (mtd->oobsize > 64)
+ 			mtd->oobsize = 64;
+ 
+-		/*
+-		 * mtd->ecclayout is not specified here because we're using the
+-		 * default large page ECC layout defined in NAND core.
+-		 */
++		/* Use default large page ECC layout defined in NAND core */
++		mtd_set_ooblayout(mtd, &nand_ooblayout_lp_ops);
+ 		if (chip->ecc.strength == 32) {
+ 			nfc->ecc_mode = ECC_60_BYTE;
+ 			chip->ecc.bytes = 60;
+diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
+index 634b2f41cc9e..908acd4624e8 100644
+--- a/drivers/net/ethernet/marvell/mvpp2.c
++++ b/drivers/net/ethernet/marvell/mvpp2.c
+@@ -7127,6 +7127,7 @@ static void mvpp2_set_rx_mode(struct net_device *dev)
+ 	int id = port->id;
+ 	bool allmulti = dev->flags & IFF_ALLMULTI;
+ 
++retry:
+ 	mvpp2_prs_mac_promisc_set(priv, id, dev->flags & IFF_PROMISC);
+ 	mvpp2_prs_mac_multi_set(priv, id, MVPP2_PE_MAC_MC_ALL, allmulti);
+ 	mvpp2_prs_mac_multi_set(priv, id, MVPP2_PE_MAC_MC_IP6, allmulti);
+@@ -7134,9 +7135,13 @@ static void mvpp2_set_rx_mode(struct net_device *dev)
+ 	/* Remove all port->id's mcast enries */
+ 	mvpp2_prs_mcast_del_all(priv, id);
+ 
+-	if (allmulti && !netdev_mc_empty(dev)) {
+-		netdev_for_each_mc_addr(ha, dev)
+-			mvpp2_prs_mac_da_accept(priv, id, ha->addr, true);
++	if (!allmulti) {
++		netdev_for_each_mc_addr(ha, dev) {
++			if (mvpp2_prs_mac_da_accept(priv, id, ha->addr, true)) {
++				allmulti = true;
++				goto retry;
++			}
++		}
+ 	}
+ }
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
+index 769598f7b6c8..3aaf4bad6c5a 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
++++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
+@@ -287,6 +287,9 @@ void mlx4_qp_release_range(struct mlx4_dev *dev, int base_qpn, int cnt)
+ 	u64 in_param = 0;
+ 	int err;
+ 
++	if (!cnt)
++		return;
++
+ 	if (mlx4_is_mfunc(dev)) {
+ 		set_param_l(&in_param, base_qpn);
+ 		set_param_h(&in_param, cnt);
+diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
+index cd314946452c..9511f5fe62f4 100644
+--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
+@@ -2781,7 +2781,10 @@ static void mwifiex_pcie_card_reset_work(struct mwifiex_adapter *adapter)
+ {
+ 	struct pcie_service_card *card = adapter->card;
+ 
+-	pci_reset_function(card->dev);
++	/* We can't afford to wait here; remove() might be waiting on us. If we
++	 * can't grab the device lock, maybe we'll get another chance later.
++	 */
++	pci_try_reset_function(card->dev);
+ }
+ 
+ static void mwifiex_pcie_work(struct work_struct *work)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+index 43e18c4c1e68..999ddd947b2a 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+@@ -1123,7 +1123,7 @@ static u8 _rtl8821ae_dbi_read(struct rtl_priv *rtlpriv, u16 addr)
+ 	}
+ 	if (0 == tmp) {
+ 		read_addr = REG_DBI_RDATA + addr % 4;
+-		ret = rtl_read_word(rtlpriv, read_addr);
++		ret = rtl_read_byte(rtlpriv, read_addr);
+ 	}
+ 	return ret;
+ }
+@@ -1165,7 +1165,8 @@ static void _rtl8821ae_enable_aspm_back_door(struct ieee80211_hw *hw)
+ 	}
+ 
+ 	tmp = _rtl8821ae_dbi_read(rtlpriv, 0x70f);
+-	_rtl8821ae_dbi_write(rtlpriv, 0x70f, tmp | BIT(7));
++	_rtl8821ae_dbi_write(rtlpriv, 0x70f, tmp | BIT(7) |
++			     ASPM_L1_LATENCY << 3);
+ 
+ 	tmp = _rtl8821ae_dbi_read(rtlpriv, 0x719);
+ 	_rtl8821ae_dbi_write(rtlpriv, 0x719, tmp | BIT(3) | BIT(4));
+diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+index 92d4859ec906..2a37125b2ef5 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+@@ -99,6 +99,7 @@
+ #define RTL_USB_MAX_RX_COUNT			100
+ #define QBSS_LOAD_SIZE				5
+ #define MAX_WMMELE_LENGTH			64
++#define ASPM_L1_LATENCY				7
+ 
+ #define TOTAL_CAM_ENTRY				32
+ 
+diff --git a/drivers/pci/dwc/pci-keystone.c b/drivers/pci/dwc/pci-keystone.c
+index 5bee3af47588..39405598b22d 100644
+--- a/drivers/pci/dwc/pci-keystone.c
++++ b/drivers/pci/dwc/pci-keystone.c
+@@ -178,7 +178,7 @@ static int ks_pcie_get_irq_controller_info(struct keystone_pcie *ks_pcie,
+ 	}
+ 
+ 	/* interrupt controller is in a child node */
+-	*np_temp = of_find_node_by_name(np_pcie, controller);
++	*np_temp = of_get_child_by_name(np_pcie, controller);
+ 	if (!(*np_temp)) {
+ 		dev_err(dev, "Node for %s is absent\n", controller);
+ 		return -EINVAL;
+@@ -187,6 +187,7 @@ static int ks_pcie_get_irq_controller_info(struct keystone_pcie *ks_pcie,
+ 	temp = of_irq_count(*np_temp);
+ 	if (!temp) {
+ 		dev_err(dev, "No IRQ entries in %s\n", controller);
++		of_node_put(*np_temp);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -204,6 +205,8 @@ static int ks_pcie_get_irq_controller_info(struct keystone_pcie *ks_pcie,
+ 			break;
+ 	}
+ 
++	of_node_put(*np_temp);
++
+ 	if (temp) {
+ 		*num_irqs = temp;
+ 		return 0;
+diff --git a/drivers/pci/host/pcie-iproc-platform.c b/drivers/pci/host/pcie-iproc-platform.c
+index a5073a921a04..32228d41f746 100644
+--- a/drivers/pci/host/pcie-iproc-platform.c
++++ b/drivers/pci/host/pcie-iproc-platform.c
+@@ -92,6 +92,13 @@ static int iproc_pcie_pltfm_probe(struct platform_device *pdev)
+ 		pcie->need_ob_cfg = true;
+ 	}
+ 
++	/*
++	 * DT nodes are not used by all platforms that use the iProc PCIe
++	 * core driver. For platforms that require explict inbound mapping
++	 * configuration, "dma-ranges" would have been present in DT
++	 */
++	pcie->need_ib_cfg = of_property_read_bool(np, "dma-ranges");
++
+ 	/* PHY use is optional */
+ 	pcie->phy = devm_phy_get(dev, "pcie-phy");
+ 	if (IS_ERR(pcie->phy)) {
+diff --git a/drivers/pci/host/pcie-iproc.c b/drivers/pci/host/pcie-iproc.c
+index 935909bbe5c4..75836067f538 100644
+--- a/drivers/pci/host/pcie-iproc.c
++++ b/drivers/pci/host/pcie-iproc.c
+@@ -1378,9 +1378,11 @@ int iproc_pcie_setup(struct iproc_pcie *pcie, struct list_head *res)
+ 		}
+ 	}
+ 
+-	ret = iproc_pcie_map_dma_ranges(pcie);
+-	if (ret && ret != -ENOENT)
+-		goto err_power_off_phy;
++	if (pcie->need_ib_cfg) {
++		ret = iproc_pcie_map_dma_ranges(pcie);
++		if (ret && ret != -ENOENT)
++			goto err_power_off_phy;
++	}
+ 
+ #ifdef CONFIG_ARM
+ 	pcie->sysdata.private_data = pcie;
+diff --git a/drivers/pci/host/pcie-iproc.h b/drivers/pci/host/pcie-iproc.h
+index a6b55cec9a66..4ac6282f2bfd 100644
+--- a/drivers/pci/host/pcie-iproc.h
++++ b/drivers/pci/host/pcie-iproc.h
+@@ -74,6 +74,7 @@ struct iproc_msi;
+  * @ob: outbound mapping related parameters
+  * @ob_map: outbound mapping related parameters specific to the controller
+  *
++ * @need_ib_cfg: indicates SW needs to configure the inbound mapping window
+  * @ib: inbound mapping related parameters
+  * @ib_map: outbound mapping region related parameters
+  *
+@@ -101,6 +102,7 @@ struct iproc_pcie {
+ 	struct iproc_pcie_ob ob;
+ 	const struct iproc_pcie_ob_map *ob_map;
+ 
++	bool need_ib_cfg;
+ 	struct iproc_pcie_ib ib;
+ 	const struct iproc_pcie_ib_map *ib_map;
+ 
+diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
+index 7bab0606f1a9..a89d8b990228 100644
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -848,6 +848,13 @@ struct controller *pcie_init(struct pcie_device *dev)
+ 	if (pdev->hotplug_user_indicators)
+ 		slot_cap &= ~(PCI_EXP_SLTCAP_AIP | PCI_EXP_SLTCAP_PIP);
+ 
++	/*
++	 * We assume no Thunderbolt controllers support Command Complete events,
++	 * but some controllers falsely claim they do.
++	 */
++	if (pdev->is_thunderbolt)
++		slot_cap |= PCI_EXP_SLTCAP_NCCS;
++
+ 	ctrl->slot_cap = slot_cap;
+ 	mutex_init(&ctrl->ctrl_lock);
+ 	init_waitqueue_head(&ctrl->queue);
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 10684b17d0bd..d22750ea7444 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1636,8 +1636,8 @@ static void quirk_pcie_mch(struct pci_dev *pdev)
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_E7520_MCH,	quirk_pcie_mch);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_E7320_MCH,	quirk_pcie_mch);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_E7525_MCH,	quirk_pcie_mch);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_HUAWEI,	0x1610,	quirk_pcie_mch);
+ 
++DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_HUAWEI, 0x1610, PCI_CLASS_BRIDGE_PCI, 8, quirk_pcie_mch);
+ 
+ /*
+  * It's possible for the MSI to get corrupted if shpc and acpi
+diff --git a/drivers/platform/x86/apple-gmux.c b/drivers/platform/x86/apple-gmux.c
+index 623d322447a2..7c4eb86c851e 100644
+--- a/drivers/platform/x86/apple-gmux.c
++++ b/drivers/platform/x86/apple-gmux.c
+@@ -24,7 +24,6 @@
+ #include <linux/delay.h>
+ #include <linux/pci.h>
+ #include <linux/vga_switcheroo.h>
+-#include <linux/vgaarb.h>
+ #include <acpi/video.h>
+ #include <asm/io.h>
+ 
+@@ -54,7 +53,6 @@ struct apple_gmux_data {
+ 	bool indexed;
+ 	struct mutex index_lock;
+ 
+-	struct pci_dev *pdev;
+ 	struct backlight_device *bdev;
+ 
+ 	/* switcheroo data */
+@@ -599,23 +597,6 @@ static int gmux_resume(struct device *dev)
+ 	return 0;
+ }
+ 
+-static struct pci_dev *gmux_get_io_pdev(void)
+-{
+-	struct pci_dev *pdev = NULL;
+-
+-	while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev))) {
+-		u16 cmd;
+-
+-		pci_read_config_word(pdev, PCI_COMMAND, &cmd);
+-		if (!(cmd & PCI_COMMAND_IO))
+-			continue;
+-
+-		return pdev;
+-	}
+-
+-	return NULL;
+-}
+-
+ static int is_thunderbolt(struct device *dev, void *data)
+ {
+ 	return to_pci_dev(dev)->is_thunderbolt;
+@@ -631,7 +612,6 @@ static int gmux_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
+ 	int ret = -ENXIO;
+ 	acpi_status status;
+ 	unsigned long long gpe;
+-	struct pci_dev *pdev = NULL;
+ 
+ 	if (apple_gmux_data)
+ 		return -EBUSY;
+@@ -682,7 +662,7 @@ static int gmux_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
+ 			ver_minor = (version >> 16) & 0xff;
+ 			ver_release = (version >> 8) & 0xff;
+ 		} else {
+-			pr_info("gmux device not present or IO disabled\n");
++			pr_info("gmux device not present\n");
+ 			ret = -ENODEV;
+ 			goto err_release;
+ 		}
+@@ -690,23 +670,6 @@ static int gmux_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
+ 	pr_info("Found gmux version %d.%d.%d [%s]\n", ver_major, ver_minor,
+ 		ver_release, (gmux_data->indexed ? "indexed" : "classic"));
+ 
+-	/*
+-	 * Apple systems with gmux are EFI based and normally don't use
+-	 * VGA. In addition changing IO+MEM ownership between IGP and dGPU
+-	 * disables IO/MEM used for backlight control on some systems.
+-	 * Lock IO+MEM to GPU with active IO to prevent switch.
+-	 */
+-	pdev = gmux_get_io_pdev();
+-	if (pdev && vga_tryget(pdev,
+-			       VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM)) {
+-		pr_err("IO+MEM vgaarb-locking for PCI:%s failed\n",
+-			pci_name(pdev));
+-		ret = -EBUSY;
+-		goto err_release;
+-	} else if (pdev)
+-		pr_info("locked IO for PCI:%s\n", pci_name(pdev));
+-	gmux_data->pdev = pdev;
+-
+ 	memset(&props, 0, sizeof(props));
+ 	props.type = BACKLIGHT_PLATFORM;
+ 	props.max_brightness = gmux_read32(gmux_data, GMUX_PORT_MAX_BRIGHTNESS);
+@@ -822,10 +785,6 @@ static int gmux_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
+ err_notify:
+ 	backlight_device_unregister(bdev);
+ err_release:
+-	if (gmux_data->pdev)
+-		vga_put(gmux_data->pdev,
+-			VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM);
+-	pci_dev_put(pdev);
+ 	release_region(gmux_data->iostart, gmux_data->iolen);
+ err_free:
+ 	kfree(gmux_data);
+@@ -845,11 +804,6 @@ static void gmux_remove(struct pnp_dev *pnp)
+ 					   &gmux_notify_handler);
+ 	}
+ 
+-	if (gmux_data->pdev) {
+-		vga_put(gmux_data->pdev,
+-			VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM);
+-		pci_dev_put(gmux_data->pdev);
+-	}
+ 	backlight_device_unregister(gmux_data->bdev);
+ 
+ 	release_region(gmux_data->iostart, gmux_data->iolen);
+diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
+index daa68acbc900..c0c8945603cb 100644
+--- a/drivers/platform/x86/wmi.c
++++ b/drivers/platform/x86/wmi.c
+@@ -933,7 +933,7 @@ static int wmi_dev_probe(struct device *dev)
+ 			goto probe_failure;
+ 		}
+ 
+-		buf = kmalloc(strlen(wdriver->driver.name) + 4, GFP_KERNEL);
++		buf = kmalloc(strlen(wdriver->driver.name) + 5, GFP_KERNEL);
+ 		if (!buf) {
+ 			ret = -ENOMEM;
+ 			goto probe_string_failure;
+diff --git a/drivers/rtc/rtc-opal.c b/drivers/rtc/rtc-opal.c
+index e2a946c0e667..304e891e35fc 100644
+--- a/drivers/rtc/rtc-opal.c
++++ b/drivers/rtc/rtc-opal.c
+@@ -58,6 +58,7 @@ static void tm_to_opal(struct rtc_time *tm, u32 *y_m_d, u64 *h_m_s_ms)
+ static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm)
+ {
+ 	long rc = OPAL_BUSY;
++	int retries = 10;
+ 	u32 y_m_d;
+ 	u64 h_m_s_ms;
+ 	__be32 __y_m_d;
+@@ -67,8 +68,11 @@ static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm)
+ 		rc = opal_rtc_read(&__y_m_d, &__h_m_s_ms);
+ 		if (rc == OPAL_BUSY_EVENT)
+ 			opal_poll_events(NULL);
+-		else
++		else if (retries-- && (rc == OPAL_HARDWARE
++				       || rc == OPAL_INTERNAL_ERROR))
+ 			msleep(10);
++		else if (rc != OPAL_BUSY && rc != OPAL_BUSY_EVENT)
++			break;
+ 	}
+ 
+ 	if (rc != OPAL_SUCCESS)
+@@ -84,6 +88,7 @@ static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm)
+ static int opal_set_rtc_time(struct device *dev, struct rtc_time *tm)
+ {
+ 	long rc = OPAL_BUSY;
++	int retries = 10;
+ 	u32 y_m_d = 0;
+ 	u64 h_m_s_ms = 0;
+ 
+@@ -92,8 +97,11 @@ static int opal_set_rtc_time(struct device *dev, struct rtc_time *tm)
+ 		rc = opal_rtc_write(y_m_d, h_m_s_ms);
+ 		if (rc == OPAL_BUSY_EVENT)
+ 			opal_poll_events(NULL);
+-		else
++		else if (retries-- && (rc == OPAL_HARDWARE
++				       || rc == OPAL_INTERNAL_ERROR))
+ 			msleep(10);
++		else if (rc != OPAL_BUSY && rc != OPAL_BUSY_EVENT)
++			break;
+ 	}
+ 
+ 	return rc == OPAL_SUCCESS ? 0 : -EIO;
+diff --git a/drivers/scsi/smartpqi/Makefile b/drivers/scsi/smartpqi/Makefile
+index 0f42a225a664..e6b779930230 100644
+--- a/drivers/scsi/smartpqi/Makefile
++++ b/drivers/scsi/smartpqi/Makefile
+@@ -1,3 +1,3 @@
+ ccflags-y += -I.
+-obj-m		+= smartpqi.o
++obj-$(CONFIG_SCSI_SMARTPQI) += smartpqi.o
+ smartpqi-objs := smartpqi_init.o smartpqi_sis.o smartpqi_sas_transport.o
+diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
+index f9bc8ec6fb6b..9518ffd8b8ba 100644
+--- a/drivers/target/iscsi/iscsi_target_auth.c
++++ b/drivers/target/iscsi/iscsi_target_auth.c
+@@ -421,7 +421,8 @@ static int chap_server_compute_md5(
+ 	auth_ret = 0;
+ out:
+ 	kzfree(desc);
+-	crypto_free_shash(tfm);
++	if (tfm)
++		crypto_free_shash(tfm);
+ 	kfree(challenge);
+ 	kfree(challenge_binhex);
+ 	return auth_ret;
+diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
+index b686e2ce9c0e..8a5e8d17a942 100644
+--- a/drivers/target/iscsi/iscsi_target_nego.c
++++ b/drivers/target/iscsi/iscsi_target_nego.c
+@@ -432,6 +432,9 @@ static void iscsi_target_sk_data_ready(struct sock *sk)
+ 	if (test_and_set_bit(LOGIN_FLAGS_READ_ACTIVE, &conn->login_flags)) {
+ 		write_unlock_bh(&sk->sk_callback_lock);
+ 		pr_debug("Got LOGIN_FLAGS_READ_ACTIVE=1, conn: %p >>>>\n", conn);
++		if (iscsi_target_sk_data_ready == conn->orig_data_ready)
++			return;
++		conn->orig_data_ready(sk);
+ 		return;
+ 	}
+ 
+diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
+index f699abab1787..65812a2f60b4 100644
+--- a/drivers/usb/Kconfig
++++ b/drivers/usb/Kconfig
+@@ -19,6 +19,14 @@ config USB_EHCI_BIG_ENDIAN_MMIO
+ config USB_EHCI_BIG_ENDIAN_DESC
+ 	bool
+ 
++config USB_UHCI_BIG_ENDIAN_MMIO
++	bool
++	default y if SPARC_LEON
++
++config USB_UHCI_BIG_ENDIAN_DESC
++	bool
++	default y if SPARC_LEON
++
+ menuconfig USB_SUPPORT
+ 	bool "USB support"
+ 	depends on HAS_IOMEM
+diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
+index b80a94e632af..2763a640359f 100644
+--- a/drivers/usb/host/Kconfig
++++ b/drivers/usb/host/Kconfig
+@@ -625,14 +625,6 @@ config USB_UHCI_ASPEED
+        bool
+        default y if ARCH_ASPEED
+ 
+-config USB_UHCI_BIG_ENDIAN_MMIO
+-	bool
+-	default y if SPARC_LEON
+-
+-config USB_UHCI_BIG_ENDIAN_DESC
+-	bool
+-	default y if SPARC_LEON
+-
+ config USB_FHCI_HCD
+ 	tristate "Freescale QE USB Host Controller support"
+ 	depends on OF_GPIO && QE_GPIO && QUICC_ENGINE
+diff --git a/drivers/video/console/dummycon.c b/drivers/video/console/dummycon.c
+index 9269d5685239..b90ef96e43d6 100644
+--- a/drivers/video/console/dummycon.c
++++ b/drivers/video/console/dummycon.c
+@@ -67,7 +67,6 @@ const struct consw dummy_con = {
+     .con_switch =	DUMMY,
+     .con_blank =	DUMMY,
+     .con_font_set =	DUMMY,
+-    .con_font_get =	DUMMY,
+     .con_font_default =	DUMMY,
+     .con_font_copy =	DUMMY,
+ };
+diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
+index e06358da4b99..3dee267d7c75 100644
+--- a/drivers/video/fbdev/atmel_lcdfb.c
++++ b/drivers/video/fbdev/atmel_lcdfb.c
+@@ -1119,7 +1119,7 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
+ 		goto put_display_node;
+ 	}
+ 
+-	timings_np = of_find_node_by_name(display_np, "display-timings");
++	timings_np = of_get_child_by_name(display_np, "display-timings");
+ 	if (!timings_np) {
+ 		dev_err(dev, "failed to find display-timings node\n");
+ 		ret = -ENODEV;
+@@ -1140,6 +1140,12 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
+ 		fb_add_videomode(&fb_vm, &info->modelist);
+ 	}
+ 
++	/*
++	 * FIXME: Make sure we are not referencing any fields in display_np
++	 * and timings_np and drop our references to them before returning to
++	 * avoid leaking the nodes on probe deferral and driver unbind.
++	 */
++
+ 	return 0;
+ 
+ put_timings_node:
+diff --git a/drivers/video/fbdev/geode/video_gx.c b/drivers/video/fbdev/geode/video_gx.c
+index 6082f653c68a..67773e8bbb95 100644
+--- a/drivers/video/fbdev/geode/video_gx.c
++++ b/drivers/video/fbdev/geode/video_gx.c
+@@ -127,7 +127,7 @@ void gx_set_dclk_frequency(struct fb_info *info)
+ 	int timeout = 1000;
+ 
+ 	/* Rev. 1 Geode GXs use a 14 MHz reference clock instead of 48 MHz. */
+-	if (cpu_data(0).x86_mask == 1) {
++	if (cpu_data(0).x86_stepping == 1) {
+ 		pll_table = gx_pll_table_14MHz;
+ 		pll_table_len = ARRAY_SIZE(gx_pll_table_14MHz);
+ 	} else {
+diff --git a/drivers/xen/xenbus/xenbus.h b/drivers/xen/xenbus/xenbus.h
+index 149c5e7efc89..092981171df1 100644
+--- a/drivers/xen/xenbus/xenbus.h
++++ b/drivers/xen/xenbus/xenbus.h
+@@ -76,6 +76,7 @@ struct xb_req_data {
+ 	struct list_head list;
+ 	wait_queue_head_t wq;
+ 	struct xsd_sockmsg msg;
++	uint32_t caller_req_id;
+ 	enum xsd_sockmsg_type type;
+ 	char *body;
+ 	const struct kvec *vec;
+diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c
+index 5b081a01779d..d239fc3c5e3d 100644
+--- a/drivers/xen/xenbus/xenbus_comms.c
++++ b/drivers/xen/xenbus/xenbus_comms.c
+@@ -309,6 +309,7 @@ static int process_msg(void)
+ 			goto out;
+ 
+ 		if (req->state == xb_req_state_wait_reply) {
++			req->msg.req_id = req->caller_req_id;
+ 			req->msg.type = state.msg.type;
+ 			req->msg.len = state.msg.len;
+ 			req->body = state.body;
+diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
+index 3e59590c7254..3f3b29398ab8 100644
+--- a/drivers/xen/xenbus/xenbus_xs.c
++++ b/drivers/xen/xenbus/xenbus_xs.c
+@@ -227,6 +227,8 @@ static void xs_send(struct xb_req_data *req, struct xsd_sockmsg *msg)
+ 	req->state = xb_req_state_queued;
+ 	init_waitqueue_head(&req->wq);
+ 
++	/* Save the caller req_id and restore it later in the reply */
++	req->caller_req_id = req->msg.req_id;
+ 	req->msg.req_id = xs_request_enter(req);
+ 
+ 	mutex_lock(&xb_write_mutex);
+@@ -310,6 +312,7 @@ static void *xs_talkv(struct xenbus_transaction t,
+ 	req->num_vecs = num_vecs;
+ 	req->cb = xs_wake_up;
+ 
++	msg.req_id = 0;
+ 	msg.tx_id = t.id;
+ 	msg.type = type;
+ 	msg.len = 0;
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 0f57602092cf..c04183cc2117 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -1330,8 +1330,11 @@ static noinline int run_delalloc_nocow(struct inode *inode,
+ 		leaf = path->nodes[0];
+ 		if (path->slots[0] >= btrfs_header_nritems(leaf)) {
+ 			ret = btrfs_next_leaf(root, path);
+-			if (ret < 0)
++			if (ret < 0) {
++				if (cow_start != (u64)-1)
++					cur_offset = cow_start;
+ 				goto error;
++			}
+ 			if (ret > 0)
+ 				break;
+ 			leaf = path->nodes[0];
+@@ -3366,6 +3369,11 @@ int btrfs_orphan_add(struct btrfs_trans_handle *trans,
+ 		ret = btrfs_orphan_reserve_metadata(trans, inode);
+ 		ASSERT(!ret);
+ 		if (ret) {
++			/*
++			 * dec doesn't need spin_lock as ->orphan_block_rsv
++			 * would be released only if ->orphan_inodes is
++			 * zero.
++			 */
+ 			atomic_dec(&root->orphan_inodes);
+ 			clear_bit(BTRFS_INODE_ORPHAN_META_RESERVED,
+ 				  &inode->runtime_flags);
+@@ -3380,12 +3388,17 @@ int btrfs_orphan_add(struct btrfs_trans_handle *trans,
+ 	if (insert >= 1) {
+ 		ret = btrfs_insert_orphan_item(trans, root, btrfs_ino(inode));
+ 		if (ret) {
+-			atomic_dec(&root->orphan_inodes);
+ 			if (reserve) {
+ 				clear_bit(BTRFS_INODE_ORPHAN_META_RESERVED,
+ 					  &inode->runtime_flags);
+ 				btrfs_orphan_release_metadata(inode);
+ 			}
++			/*
++			 * btrfs_orphan_commit_root may race with us and set
++			 * ->orphan_block_rsv to zero, in order to avoid that,
++			 * decrease ->orphan_inodes after everything is done.
++			 */
++			atomic_dec(&root->orphan_inodes);
+ 			if (ret != -EEXIST) {
+ 				clear_bit(BTRFS_INODE_HAS_ORPHAN_ITEM,
+ 					  &inode->runtime_flags);
+@@ -3417,28 +3430,26 @@ static int btrfs_orphan_del(struct btrfs_trans_handle *trans,
+ {
+ 	struct btrfs_root *root = inode->root;
+ 	int delete_item = 0;
+-	int release_rsv = 0;
+ 	int ret = 0;
+ 
+-	spin_lock(&root->orphan_lock);
+ 	if (test_and_clear_bit(BTRFS_INODE_HAS_ORPHAN_ITEM,
+ 			       &inode->runtime_flags))
+ 		delete_item = 1;
+ 
++	if (delete_item && trans)
++		ret = btrfs_del_orphan_item(trans, root, btrfs_ino(inode));
++
+ 	if (test_and_clear_bit(BTRFS_INODE_ORPHAN_META_RESERVED,
+ 			       &inode->runtime_flags))
+-		release_rsv = 1;
+-	spin_unlock(&root->orphan_lock);
++		btrfs_orphan_release_metadata(inode);
+ 
+-	if (delete_item) {
++	/*
++	 * btrfs_orphan_commit_root may race with us and set ->orphan_block_rsv
++	 * to zero, in order to avoid that, decrease ->orphan_inodes after
++	 * everything is done.
++	 */
++	if (delete_item)
+ 		atomic_dec(&root->orphan_inodes);
+-		if (trans)
+-			ret = btrfs_del_orphan_item(trans, root,
+-						    btrfs_ino(inode));
+-	}
+-
+-	if (release_rsv)
+-		btrfs_orphan_release_metadata(inode);
+ 
+ 	return ret;
+ }
+@@ -5263,7 +5274,7 @@ void btrfs_evict_inode(struct inode *inode)
+ 	trace_btrfs_inode_evict(inode);
+ 
+ 	if (!root) {
+-		kmem_cache_free(btrfs_inode_cachep, BTRFS_I(inode));
++		clear_inode(inode);
+ 		return;
+ 	}
+ 
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 7bf9b31561db..b5e1afb30f36 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -28,6 +28,7 @@
+ #include "hash.h"
+ #include "compression.h"
+ #include "qgroup.h"
++#include "inode-map.h"
+ 
+ /* magic values for the inode_only field in btrfs_log_inode:
+  *
+@@ -2494,6 +2495,9 @@ static noinline int walk_down_log_tree(struct btrfs_trans_handle *trans,
+ 					clean_tree_block(fs_info, next);
+ 					btrfs_wait_tree_block_writeback(next);
+ 					btrfs_tree_unlock(next);
++				} else {
++					if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags))
++						clear_extent_buffer_dirty(next);
+ 				}
+ 
+ 				WARN_ON(root_owner !=
+@@ -2574,6 +2578,9 @@ static noinline int walk_up_log_tree(struct btrfs_trans_handle *trans,
+ 					clean_tree_block(fs_info, next);
+ 					btrfs_wait_tree_block_writeback(next);
+ 					btrfs_tree_unlock(next);
++				} else {
++					if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags))
++						clear_extent_buffer_dirty(next);
+ 				}
+ 
+ 				WARN_ON(root_owner != BTRFS_TREE_LOG_OBJECTID);
+@@ -2652,6 +2659,9 @@ static int walk_log_tree(struct btrfs_trans_handle *trans,
+ 				clean_tree_block(fs_info, next);
+ 				btrfs_wait_tree_block_writeback(next);
+ 				btrfs_tree_unlock(next);
++			} else {
++				if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags))
++					clear_extent_buffer_dirty(next);
+ 			}
+ 
+ 			WARN_ON(log->root_key.objectid !=
+@@ -3040,13 +3050,14 @@ static void free_log_tree(struct btrfs_trans_handle *trans,
+ 
+ 	while (1) {
+ 		ret = find_first_extent_bit(&log->dirty_log_pages,
+-				0, &start, &end, EXTENT_DIRTY | EXTENT_NEW,
++				0, &start, &end,
++				EXTENT_DIRTY | EXTENT_NEW | EXTENT_NEED_WAIT,
+ 				NULL);
+ 		if (ret)
+ 			break;
+ 
+ 		clear_extent_bits(&log->dirty_log_pages, start, end,
+-				  EXTENT_DIRTY | EXTENT_NEW);
++				  EXTENT_DIRTY | EXTENT_NEW | EXTENT_NEED_WAIT);
+ 	}
+ 
+ 	/*
+@@ -5705,6 +5716,23 @@ int btrfs_recover_log_trees(struct btrfs_root *log_root_tree)
+ 						      path);
+ 		}
+ 
++		if (!ret && wc.stage == LOG_WALK_REPLAY_ALL) {
++			struct btrfs_root *root = wc.replay_dest;
++
++			btrfs_release_path(path);
++
++			/*
++			 * We have just replayed everything, and the highest
++			 * objectid of fs roots probably has changed in case
++			 * some inode_item's got replayed.
++			 *
++			 * root->objectid_mutex is not acquired as log replay
++			 * could only happen during mount.
++			 */
++			ret = btrfs_find_highest_objectid(root,
++						  &root->highest_objectid);
++		}
++
+ 		key.offset = found_key.offset - 1;
+ 		wc.replay_dest->log_root = NULL;
+ 		free_extent_buffer(log->node);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 534a9130f625..4c2f8b57bdc7 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -3767,10 +3767,18 @@ static ssize_t ext4_direct_IO_write(struct kiocb *iocb, struct iov_iter *iter)
+ 		/* Credits for sb + inode write */
+ 		handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
+ 		if (IS_ERR(handle)) {
+-			/* This is really bad luck. We've written the data
+-			 * but cannot extend i_size. Bail out and pretend
+-			 * the write failed... */
+-			ret = PTR_ERR(handle);
++			/*
++			 * We wrote the data but cannot extend
++			 * i_size. Bail out. In async io case, we do
++			 * not return error here because we have
++			 * already submmitted the corresponding
++			 * bio. Returning error here makes the caller
++			 * think that this IO is done and failed
++			 * resulting in race with bio's completion
++			 * handler.
++			 */
++			if (!ret)
++				ret = PTR_ERR(handle);
+ 			if (inode->i_nlink)
+ 				ext4_orphan_del(NULL, inode);
+ 
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 7c46693a14d7..71594382e195 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -742,6 +742,7 @@ __acquires(bitlock)
+ 	}
+ 
+ 	ext4_unlock_group(sb, grp);
++	ext4_commit_super(sb, 1);
+ 	ext4_handle_error(sb);
+ 	/*
+ 	 * We only get here in the ERRORS_RO case; relocking the group
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index d5f0d96169c5..8c50d6878aa5 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -736,7 +736,7 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
+ 	__be64 *ptr;
+ 	sector_t lblock;
+ 	sector_t lend;
+-	int ret;
++	int ret = 0;
+ 	int eob;
+ 	unsigned int len;
+ 	struct buffer_head *bh;
+@@ -748,12 +748,14 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
+ 		goto out;
+ 	}
+ 
+-	if ((flags & IOMAP_REPORT) && gfs2_is_stuffed(ip)) {
+-		gfs2_stuffed_iomap(inode, iomap);
+-		if (pos >= iomap->length)
+-			return -ENOENT;
+-		ret = 0;
+-		goto out;
++	if (gfs2_is_stuffed(ip)) {
++		if (flags & IOMAP_REPORT) {
++			gfs2_stuffed_iomap(inode, iomap);
++			if (pos >= iomap->length)
++				ret = -ENOENT;
++			goto out;
++		}
++		BUG_ON(!(flags & IOMAP_WRITE));
+ 	}
+ 
+ 	lblock = pos >> inode->i_blkbits;
+@@ -764,7 +766,7 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
+ 	iomap->type = IOMAP_HOLE;
+ 	iomap->length = (u64)(lend - lblock) << inode->i_blkbits;
+ 	iomap->flags = IOMAP_F_MERGED;
+-	bmap_lock(ip, 0);
++	bmap_lock(ip, flags & IOMAP_WRITE);
+ 
+ 	/*
+ 	 * Directory data blocks have a struct gfs2_meta_header header, so the
+@@ -807,27 +809,28 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
+ 		iomap->flags |= IOMAP_F_BOUNDARY;
+ 	iomap->length = (u64)len << inode->i_blkbits;
+ 
+-	ret = 0;
+-
+ out_release:
+ 	release_metapath(&mp);
+-	bmap_unlock(ip, 0);
++	bmap_unlock(ip, flags & IOMAP_WRITE);
+ out:
+ 	trace_gfs2_iomap_end(ip, iomap, ret);
+ 	return ret;
+ 
+ do_alloc:
+-	if (!(flags & IOMAP_WRITE)) {
+-		if (pos >= i_size_read(inode)) {
++	if (flags & IOMAP_WRITE) {
++		ret = gfs2_iomap_alloc(inode, iomap, flags, &mp);
++	} else if (flags & IOMAP_REPORT) {
++		loff_t size = i_size_read(inode);
++		if (pos >= size)
+ 			ret = -ENOENT;
+-			goto out_release;
+-		}
+-		ret = 0;
+-		iomap->length = hole_size(inode, lblock, &mp);
+-		goto out_release;
++		else if (height <= ip->i_height)
++			iomap->length = hole_size(inode, lblock, &mp);
++		else
++			iomap->length = size - pos;
++	} else {
++		if (height <= ip->i_height)
++			iomap->length = hole_size(inode, lblock, &mp);
+ 	}
+-
+-	ret = gfs2_iomap_alloc(inode, iomap, flags, &mp);
+ 	goto out_release;
+ }
+ 
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index 8b08044b3120..c0681814c379 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -495,8 +495,10 @@ void jbd2_journal_free_reserved(handle_t *handle)
+ EXPORT_SYMBOL(jbd2_journal_free_reserved);
+ 
+ /**
+- * int jbd2_journal_start_reserved(handle_t *handle) - start reserved handle
++ * int jbd2_journal_start_reserved() - start reserved handle
+  * @handle: handle to start
++ * @type: for handle statistics
++ * @line_no: for handle statistics
+  *
+  * Start handle that has been previously reserved with jbd2_journal_reserve().
+  * This attaches @handle to the running transaction (or creates one if there's
+@@ -626,6 +628,7 @@ int jbd2_journal_extend(handle_t *handle, int nblocks)
+  * int jbd2_journal_restart() - restart a handle .
+  * @handle:  handle to restart
+  * @nblocks: nr credits requested
++ * @gfp_mask: memory allocation flags (for start_this_handle)
+  *
+  * Restart a handle for a multi-transaction filesystem
+  * operation.
+diff --git a/fs/mbcache.c b/fs/mbcache.c
+index b8b8b9ced9f8..46b23bb432fe 100644
+--- a/fs/mbcache.c
++++ b/fs/mbcache.c
+@@ -94,6 +94,7 @@ int mb_cache_entry_create(struct mb_cache *cache, gfp_t mask, u32 key,
+ 	entry->e_key = key;
+ 	entry->e_value = value;
+ 	entry->e_reusable = reusable;
++	entry->e_referenced = 0;
+ 	head = mb_cache_entry_head(cache, key);
+ 	hlist_bl_lock(head);
+ 	hlist_bl_for_each_entry(dup, dup_node, head, e_hash_list) {
+diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
+index 4689940a953c..5193218f5889 100644
+--- a/fs/ocfs2/dlmglue.c
++++ b/fs/ocfs2/dlmglue.c
+@@ -2486,6 +2486,15 @@ int ocfs2_inode_lock_with_page(struct inode *inode,
+ 	ret = ocfs2_inode_lock_full(inode, ret_bh, ex, OCFS2_LOCK_NONBLOCK);
+ 	if (ret == -EAGAIN) {
+ 		unlock_page(page);
++		/*
++		 * If we can't get inode lock immediately, we should not return
++		 * directly here, since this will lead to a softlockup problem.
++		 * The method is to get a blocking lock and immediately unlock
++		 * before returning, this can avoid CPU resource waste due to
++		 * lots of retries, and benefits fairness in getting lock.
++		 */
++		if (ocfs2_inode_lock(inode, ret_bh, ex) == 0)
++			ocfs2_inode_unlock(inode, ex);
+ 		ret = AOP_TRUNCATED_PAGE;
+ 	}
+ 
+diff --git a/fs/seq_file.c b/fs/seq_file.c
+index 4be761c1a03d..eea09f6d8830 100644
+--- a/fs/seq_file.c
++++ b/fs/seq_file.c
+@@ -181,8 +181,11 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
+ 	 * if request is to read from zero offset, reset iterator to first
+ 	 * record as it might have been already advanced by previous requests
+ 	 */
+-	if (*ppos == 0)
++	if (*ppos == 0) {
+ 		m->index = 0;
++		m->version = 0;
++		m->count = 0;
++	}
+ 
+ 	/* Don't assume *ppos is where we left it */
+ 	if (unlikely(*ppos != m->read_pos)) {
+diff --git a/include/drm/i915_pciids.h b/include/drm/i915_pciids.h
+index 972a25633525..c65e4489006d 100644
+--- a/include/drm/i915_pciids.h
++++ b/include/drm/i915_pciids.h
+@@ -392,6 +392,12 @@
+ 	INTEL_VGA_DEVICE(0x3EA8, info), /* ULT GT3 */ \
+ 	INTEL_VGA_DEVICE(0x3EA5, info)  /* ULT GT3 */
+ 
++#define INTEL_CFL_IDS(info) \
++	INTEL_CFL_S_GT1_IDS(info), \
++	INTEL_CFL_S_GT2_IDS(info), \
++	INTEL_CFL_H_GT2_IDS(info), \
++	INTEL_CFL_U_GT3_IDS(info)
++
+ /* CNL U 2+2 */
+ #define INTEL_CNL_U_GT2_IDS(info) \
+ 	INTEL_VGA_DEVICE(0x5A52, info), \
+diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
+index 631354acfa72..73bc63e0a1c4 100644
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -167,8 +167,6 @@
+ 
+ #if GCC_VERSION >= 40100
+ # define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
+-
+-#define __nostackprotector	__attribute__((__optimize__("no-stack-protector")))
+ #endif
+ 
+ #if GCC_VERSION >= 40300
+@@ -196,6 +194,11 @@
+ #endif /* __CHECKER__ */
+ #endif /* GCC_VERSION >= 40300 */
+ 
++#if GCC_VERSION >= 40400
++#define __optimize(level)	__attribute__((__optimize__(level)))
++#define __nostackprotector	__optimize("no-stack-protector")
++#endif /* GCC_VERSION >= 40400 */
++
+ #if GCC_VERSION >= 40500
+ 
+ #ifndef __CHECKER__
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 52e611ab9a6c..5ff818e9a836 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -271,6 +271,10 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
+ 
+ #endif /* __ASSEMBLY__ */
+ 
++#ifndef __optimize
++# define __optimize(level)
++#endif
++
+ /* Compile time object size, -1 for unknown */
+ #ifndef __compiletime_object_size
+ # define __compiletime_object_size(obj) -1
+diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
+index 8f7788d23b57..a6989e02d0a0 100644
+--- a/include/linux/cpuidle.h
++++ b/include/linux/cpuidle.h
+@@ -225,7 +225,7 @@ static inline void cpuidle_coupled_parallel_barrier(struct cpuidle_device *dev,
+ }
+ #endif
+ 
+-#ifdef CONFIG_ARCH_HAS_CPU_RELAX
++#if defined(CONFIG_CPU_IDLE) && defined(CONFIG_ARCH_HAS_CPU_RELAX)
+ void cpuidle_poll_state_init(struct cpuidle_driver *drv);
+ #else
+ static inline void cpuidle_poll_state_init(struct cpuidle_driver *drv) {}
+diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
+index 296d1e0ea87b..b708e5169d1d 100644
+--- a/include/linux/jbd2.h
++++ b/include/linux/jbd2.h
+@@ -418,26 +418,41 @@ static inline void jbd_unlock_bh_journal_head(struct buffer_head *bh)
+ #define JI_WAIT_DATA (1 << __JI_WAIT_DATA)
+ 
+ /**
+- * struct jbd_inode is the structure linking inodes in ordered mode
+- *   present in a transaction so that we can sync them during commit.
++ * struct jbd_inode - The jbd_inode type is the structure linking inodes in
++ * ordered mode present in a transaction so that we can sync them during commit.
+  */
+ struct jbd2_inode {
+-	/* Which transaction does this inode belong to? Either the running
+-	 * transaction or the committing one. [j_list_lock] */
++	/**
++	 * @i_transaction:
++	 *
++	 * Which transaction does this inode belong to? Either the running
++	 * transaction or the committing one. [j_list_lock]
++	 */
+ 	transaction_t *i_transaction;
+ 
+-	/* Pointer to the running transaction modifying inode's data in case
+-	 * there is already a committing transaction touching it. [j_list_lock] */
++	/**
++	 * @i_next_transaction:
++	 *
++	 * Pointer to the running transaction modifying inode's data in case
++	 * there is already a committing transaction touching it. [j_list_lock]
++	 */
+ 	transaction_t *i_next_transaction;
+ 
+-	/* List of inodes in the i_transaction [j_list_lock] */
++	/**
++	 * @i_list: List of inodes in the i_transaction [j_list_lock]
++	 */
+ 	struct list_head i_list;
+ 
+-	/* VFS inode this inode belongs to [constant during the lifetime
+-	 * of the structure] */
++	/**
++	 * @i_vfs_inode:
++	 *
++	 * VFS inode this inode belongs to [constant for lifetime of structure]
++	 */
+ 	struct inode *i_vfs_inode;
+ 
+-	/* Flags of inode [j_list_lock] */
++	/**
++	 * @i_flags: Flags of inode [j_list_lock]
++	 */
+ 	unsigned long i_flags;
+ };
+ 
+@@ -447,12 +462,20 @@ struct jbd2_revoke_table_s;
+  * struct handle_s - The handle_s type is the concrete type associated with
+  *     handle_t.
+  * @h_transaction: Which compound transaction is this update a part of?
++ * @h_journal: Which journal handle belongs to - used iff h_reserved set.
++ * @h_rsv_handle: Handle reserved for finishing the logical operation.
+  * @h_buffer_credits: Number of remaining buffers we are allowed to dirty.
+- * @h_ref: Reference count on this handle
+- * @h_err: Field for caller's use to track errors through large fs operations
+- * @h_sync: flag for sync-on-close
+- * @h_jdata: flag to force data journaling
+- * @h_aborted: flag indicating fatal error on handle
++ * @h_ref: Reference count on this handle.
++ * @h_err: Field for caller's use to track errors through large fs operations.
++ * @h_sync: Flag for sync-on-close.
++ * @h_jdata: Flag to force data journaling.
++ * @h_reserved: Flag for handle for reserved credits.
++ * @h_aborted: Flag indicating fatal error on handle.
++ * @h_type: For handle statistics.
++ * @h_line_no: For handle statistics.
++ * @h_start_jiffies: Handle Start time.
++ * @h_requested_credits: Holds @h_buffer_credits after handle is started.
++ * @saved_alloc_context: Saved context while transaction is open.
+  **/
+ 
+ /* Docbook can't yet cope with the bit fields, but will leave the documentation
+@@ -462,32 +485,23 @@ struct jbd2_revoke_table_s;
+ struct jbd2_journal_handle
+ {
+ 	union {
+-		/* Which compound transaction is this update a part of? */
+ 		transaction_t	*h_transaction;
+ 		/* Which journal handle belongs to - used iff h_reserved set */
+ 		journal_t	*h_journal;
+ 	};
+ 
+-	/* Handle reserved for finishing the logical operation */
+ 	handle_t		*h_rsv_handle;
+-
+-	/* Number of remaining buffers we are allowed to dirty: */
+ 	int			h_buffer_credits;
+-
+-	/* Reference count on this handle */
+ 	int			h_ref;
+-
+-	/* Field for caller's use to track errors through large fs */
+-	/* operations */
+ 	int			h_err;
+ 
+ 	/* Flags [no locking] */
+-	unsigned int	h_sync:		1;	/* sync-on-close */
+-	unsigned int	h_jdata:	1;	/* force data journaling */
+-	unsigned int	h_reserved:	1;	/* handle with reserved credits */
+-	unsigned int	h_aborted:	1;	/* fatal error on handle */
+-	unsigned int	h_type:		8;	/* for handle statistics */
+-	unsigned int	h_line_no:	16;	/* for handle statistics */
++	unsigned int	h_sync:		1;
++	unsigned int	h_jdata:	1;
++	unsigned int	h_reserved:	1;
++	unsigned int	h_aborted:	1;
++	unsigned int	h_type:		8;
++	unsigned int	h_line_no:	16;
+ 
+ 	unsigned long		h_start_jiffies;
+ 	unsigned int		h_requested_credits;
+@@ -729,228 +743,253 @@ jbd2_time_diff(unsigned long start, unsigned long end)
+ /**
+  * struct journal_s - The journal_s type is the concrete type associated with
+  *     journal_t.
+- * @j_flags:  General journaling state flags
+- * @j_errno:  Is there an outstanding uncleared error on the journal (from a
+- *     prior abort)?
+- * @j_sb_buffer: First part of superblock buffer
+- * @j_superblock: Second part of superblock buffer
+- * @j_format_version: Version of the superblock format
+- * @j_state_lock: Protect the various scalars in the journal
+- * @j_barrier_count:  Number of processes waiting to create a barrier lock
+- * @j_barrier: The barrier lock itself
+- * @j_running_transaction: The current running transaction..
+- * @j_committing_transaction: the transaction we are pushing to disk
+- * @j_checkpoint_transactions: a linked circular list of all transactions
+- *  waiting for checkpointing
+- * @j_wait_transaction_locked: Wait queue for waiting for a locked transaction
+- *  to start committing, or for a barrier lock to be released
+- * @j_wait_done_commit: Wait queue for waiting for commit to complete
+- * @j_wait_commit: Wait queue to trigger commit
+- * @j_wait_updates: Wait queue to wait for updates to complete
+- * @j_wait_reserved: Wait queue to wait for reserved buffer credits to drop
+- * @j_checkpoint_mutex: Mutex for locking against concurrent checkpoints
+- * @j_head: Journal head - identifies the first unused block in the journal
+- * @j_tail: Journal tail - identifies the oldest still-used block in the
+- *  journal.
+- * @j_free: Journal free - how many free blocks are there in the journal?
+- * @j_first: The block number of the first usable block
+- * @j_last: The block number one beyond the last usable block
+- * @j_dev: Device where we store the journal
+- * @j_blocksize: blocksize for the location where we store the journal.
+- * @j_blk_offset: starting block offset for into the device where we store the
+- *     journal
+- * @j_fs_dev: Device which holds the client fs.  For internal journal this will
+- *     be equal to j_dev
+- * @j_reserved_credits: Number of buffers reserved from the running transaction
+- * @j_maxlen: Total maximum capacity of the journal region on disk.
+- * @j_list_lock: Protects the buffer lists and internal buffer state.
+- * @j_inode: Optional inode where we store the journal.  If present, all journal
+- *     block numbers are mapped into this inode via bmap().
+- * @j_tail_sequence:  Sequence number of the oldest transaction in the log
+- * @j_transaction_sequence: Sequence number of the next transaction to grant
+- * @j_commit_sequence: Sequence number of the most recently committed
+- *  transaction
+- * @j_commit_request: Sequence number of the most recent transaction wanting
+- *     commit
+- * @j_uuid: Uuid of client object.
+- * @j_task: Pointer to the current commit thread for this journal
+- * @j_max_transaction_buffers:  Maximum number of metadata buffers to allow in a
+- *     single compound commit transaction
+- * @j_commit_interval: What is the maximum transaction lifetime before we begin
+- *  a commit?
+- * @j_commit_timer:  The timer used to wakeup the commit thread
+- * @j_revoke_lock: Protect the revoke table
+- * @j_revoke: The revoke table - maintains the list of revoked blocks in the
+- *     current transaction.
+- * @j_revoke_table: alternate revoke tables for j_revoke
+- * @j_wbuf: array of buffer_heads for jbd2_journal_commit_transaction
+- * @j_wbufsize: maximum number of buffer_heads allowed in j_wbuf, the
+- *	number that will fit in j_blocksize
+- * @j_last_sync_writer: most recent pid which did a synchronous write
+- * @j_history_lock: Protect the transactions statistics history
+- * @j_proc_entry: procfs entry for the jbd statistics directory
+- * @j_stats: Overall statistics
+- * @j_private: An opaque pointer to fs-private information.
+- * @j_trans_commit_map: Lockdep entity to track transaction commit dependencies
+  */
+-
+ struct journal_s
+ {
+-	/* General journaling state flags [j_state_lock] */
++	/**
++	 * @j_flags: General journaling state flags [j_state_lock]
++	 */
+ 	unsigned long		j_flags;
+ 
+-	/*
++	/**
++	 * @j_errno:
++	 *
+ 	 * Is there an outstanding uncleared error on the journal (from a prior
+ 	 * abort)? [j_state_lock]
+ 	 */
+ 	int			j_errno;
+ 
+-	/* The superblock buffer */
++	/**
++	 * @j_sb_buffer: The first part of the superblock buffer.
++	 */
+ 	struct buffer_head	*j_sb_buffer;
++
++	/**
++	 * @j_superblock: The second part of the superblock buffer.
++	 */
+ 	journal_superblock_t	*j_superblock;
+ 
+-	/* Version of the superblock format */
++	/**
++	 * @j_format_version: Version of the superblock format.
++	 */
+ 	int			j_format_version;
+ 
+-	/*
+-	 * Protect the various scalars in the journal
++	/**
++	 * @j_state_lock: Protect the various scalars in the journal.
+ 	 */
+ 	rwlock_t		j_state_lock;
+ 
+-	/*
++	/**
++	 * @j_barrier_count:
++	 *
+ 	 * Number of processes waiting to create a barrier lock [j_state_lock]
+ 	 */
+ 	int			j_barrier_count;
+ 
+-	/* The barrier lock itself */
++	/**
++	 * @j_barrier: The barrier lock itself.
++	 */
+ 	struct mutex		j_barrier;
+ 
+-	/*
++	/**
++	 * @j_running_transaction:
++	 *
+ 	 * Transactions: The current running transaction...
+ 	 * [j_state_lock] [caller holding open handle]
+ 	 */
+ 	transaction_t		*j_running_transaction;
+ 
+-	/*
++	/**
++	 * @j_committing_transaction:
++	 *
+ 	 * the transaction we are pushing to disk
+ 	 * [j_state_lock] [caller holding open handle]
+ 	 */
+ 	transaction_t		*j_committing_transaction;
+ 
+-	/*
++	/**
++	 * @j_checkpoint_transactions:
++	 *
+ 	 * ... and a linked circular list of all transactions waiting for
+ 	 * checkpointing. [j_list_lock]
+ 	 */
+ 	transaction_t		*j_checkpoint_transactions;
+ 
+-	/*
++	/**
++	 * @j_wait_transaction_locked:
++	 *
+ 	 * Wait queue for waiting for a locked transaction to start committing,
+-	 * or for a barrier lock to be released
++	 * or for a barrier lock to be released.
+ 	 */
+ 	wait_queue_head_t	j_wait_transaction_locked;
+ 
+-	/* Wait queue for waiting for commit to complete */
++	/**
++	 * @j_wait_done_commit: Wait queue for waiting for commit to complete.
++	 */
+ 	wait_queue_head_t	j_wait_done_commit;
+ 
+-	/* Wait queue to trigger commit */
++	/**
++	 * @j_wait_commit: Wait queue to trigger commit.
++	 */
+ 	wait_queue_head_t	j_wait_commit;
+ 
+-	/* Wait queue to wait for updates to complete */
++	/**
++	 * @j_wait_updates: Wait queue to wait for updates to complete.
++	 */
+ 	wait_queue_head_t	j_wait_updates;
+ 
+-	/* Wait queue to wait for reserved buffer credits to drop */
++	/**
++	 * @j_wait_reserved:
++	 *
++	 * Wait queue to wait for reserved buffer credits to drop.
++	 */
+ 	wait_queue_head_t	j_wait_reserved;
+ 
+-	/* Semaphore for locking against concurrent checkpoints */
++	/**
++	 * @j_checkpoint_mutex:
++	 *
++	 * Semaphore for locking against concurrent checkpoints.
++	 */
+ 	struct mutex		j_checkpoint_mutex;
+ 
+-	/*
++	/**
++	 * @j_chkpt_bhs:
++	 *
+ 	 * List of buffer heads used by the checkpoint routine.  This
+ 	 * was moved from jbd2_log_do_checkpoint() to reduce stack
+ 	 * usage.  Access to this array is controlled by the
+-	 * j_checkpoint_mutex.  [j_checkpoint_mutex]
++	 * @j_checkpoint_mutex.  [j_checkpoint_mutex]
+ 	 */
+ 	struct buffer_head	*j_chkpt_bhs[JBD2_NR_BATCH];
+-	
+-	/*
++
++	/**
++	 * @j_head:
++	 *
+ 	 * Journal head: identifies the first unused block in the journal.
+ 	 * [j_state_lock]
+ 	 */
+ 	unsigned long		j_head;
+ 
+-	/*
++	/**
++	 * @j_tail:
++	 *
+ 	 * Journal tail: identifies the oldest still-used block in the journal.
+ 	 * [j_state_lock]
+ 	 */
+ 	unsigned long		j_tail;
+ 
+-	/*
++	/**
++	 * @j_free:
++	 *
+ 	 * Journal free: how many free blocks are there in the journal?
+ 	 * [j_state_lock]
+ 	 */
+ 	unsigned long		j_free;
+ 
+-	/*
+-	 * Journal start and end: the block numbers of the first usable block
+-	 * and one beyond the last usable block in the journal. [j_state_lock]
++	/**
++	 * @j_first:
++	 *
++	 * The block number of the first usable block in the journal
++	 * [j_state_lock].
+ 	 */
+ 	unsigned long		j_first;
++
++	/**
++	 * @j_last:
++	 *
++	 * The block number one beyond the last usable block in the journal
++	 * [j_state_lock].
++	 */
+ 	unsigned long		j_last;
+ 
+-	/*
+-	 * Device, blocksize and starting block offset for the location where we
+-	 * store the journal.
++	/**
++	 * @j_dev: Device where we store the journal.
+ 	 */
+ 	struct block_device	*j_dev;
++
++	/**
++	 * @j_blocksize: Block size for the location where we store the journal.
++	 */
+ 	int			j_blocksize;
++
++	/**
++	 * @j_blk_offset:
++	 *
++	 * Starting block offset into the device where we store the journal.
++	 */
+ 	unsigned long long	j_blk_offset;
++
++	/**
++	 * @j_devname: Journal device name.
++	 */
+ 	char			j_devname[BDEVNAME_SIZE+24];
+ 
+-	/*
++	/**
++	 * @j_fs_dev:
++	 *
+ 	 * Device which holds the client fs.  For internal journal this will be
+ 	 * equal to j_dev.
+ 	 */
+ 	struct block_device	*j_fs_dev;
+ 
+-	/* Total maximum capacity of the journal region on disk. */
++	/**
++	 * @j_maxlen: Total maximum capacity of the journal region on disk.
++	 */
+ 	unsigned int		j_maxlen;
+ 
+-	/* Number of buffers reserved from the running transaction */
++	/**
++	 * @j_reserved_credits:
++	 *
++	 * Number of buffers reserved from the running transaction.
++	 */
+ 	atomic_t		j_reserved_credits;
+ 
+-	/*
+-	 * Protects the buffer lists and internal buffer state.
++	/**
++	 * @j_list_lock: Protects the buffer lists and internal buffer state.
+ 	 */
+ 	spinlock_t		j_list_lock;
+ 
+-	/* Optional inode where we store the journal.  If present, all */
+-	/* journal block numbers are mapped into this inode via */
+-	/* bmap(). */
++	/**
++	 * @j_inode:
++	 *
++	 * Optional inode where we store the journal.  If present, all
++	 * journal block numbers are mapped into this inode via bmap().
++	 */
+ 	struct inode		*j_inode;
+ 
+-	/*
++	/**
++	 * @j_tail_sequence:
++	 *
+ 	 * Sequence number of the oldest transaction in the log [j_state_lock]
+ 	 */
+ 	tid_t			j_tail_sequence;
+ 
+-	/*
++	/**
++	 * @j_transaction_sequence:
++	 *
+ 	 * Sequence number of the next transaction to grant [j_state_lock]
+ 	 */
+ 	tid_t			j_transaction_sequence;
+ 
+-	/*
++	/**
++	 * @j_commit_sequence:
++	 *
+ 	 * Sequence number of the most recently committed transaction
+ 	 * [j_state_lock].
+ 	 */
+ 	tid_t			j_commit_sequence;
+ 
+-	/*
++	/**
++	 * @j_commit_request:
++	 *
+ 	 * Sequence number of the most recent transaction wanting commit
+ 	 * [j_state_lock]
+ 	 */
+ 	tid_t			j_commit_request;
+ 
+-	/*
++	/**
++	 * @j_uuid:
++	 *
+ 	 * Journal uuid: identifies the object (filesystem, LVM volume etc)
+ 	 * backed by this journal.  This will eventually be replaced by an array
+ 	 * of uuids, allowing us to index multiple devices within a single
+@@ -958,85 +997,151 @@ struct journal_s
+ 	 */
+ 	__u8			j_uuid[16];
+ 
+-	/* Pointer to the current commit thread for this journal */
++	/**
++	 * @j_task: Pointer to the current commit thread for this journal.
++	 */
+ 	struct task_struct	*j_task;
+ 
+-	/*
++	/**
++	 * @j_max_transaction_buffers:
++	 *
+ 	 * Maximum number of metadata buffers to allow in a single compound
+-	 * commit transaction
++	 * commit transaction.
+ 	 */
+ 	int			j_max_transaction_buffers;
+ 
+-	/*
++	/**
++	 * @j_commit_interval:
++	 *
+ 	 * What is the maximum transaction lifetime before we begin a commit?
+ 	 */
+ 	unsigned long		j_commit_interval;
+ 
+-	/* The timer used to wakeup the commit thread: */
++	/**
++	 * @j_commit_timer: The timer used to wakeup the commit thread.
++	 */
+ 	struct timer_list	j_commit_timer;
+ 
+-	/*
+-	 * The revoke table: maintains the list of revoked blocks in the
+-	 * current transaction.  [j_revoke_lock]
++	/**
++	 * @j_revoke_lock: Protect the revoke table.
+ 	 */
+ 	spinlock_t		j_revoke_lock;
++
++	/**
++	 * @j_revoke:
++	 *
++	 * The revoke table - maintains the list of revoked blocks in the
++	 * current transaction.
++	 */
+ 	struct jbd2_revoke_table_s *j_revoke;
++
++	/**
++	 * @j_revoke_table: Alternate revoke tables for j_revoke.
++	 */
+ 	struct jbd2_revoke_table_s *j_revoke_table[2];
+ 
+-	/*
+-	 * array of bhs for jbd2_journal_commit_transaction
++	/**
++	 * @j_wbuf: Array of bhs for jbd2_journal_commit_transaction.
+ 	 */
+ 	struct buffer_head	**j_wbuf;
++
++	/**
++	 * @j_wbufsize:
++	 *
++	 * Size of @j_wbuf array.
++	 */
+ 	int			j_wbufsize;
+ 
+-	/*
+-	 * this is the pid of hte last person to run a synchronous operation
+-	 * through the journal
++	/**
++	 * @j_last_sync_writer:
++	 *
++	 * The pid of the last person to run a synchronous operation
++	 * through the journal.
+ 	 */
+ 	pid_t			j_last_sync_writer;
+ 
+-	/*
+-	 * the average amount of time in nanoseconds it takes to commit a
++	/**
++	 * @j_average_commit_time:
++	 *
++	 * The average amount of time in nanoseconds it takes to commit a
+ 	 * transaction to disk. [j_state_lock]
+ 	 */
+ 	u64			j_average_commit_time;
+ 
+-	/*
+-	 * minimum and maximum times that we should wait for
+-	 * additional filesystem operations to get batched into a
+-	 * synchronous handle in microseconds
++	/**
++	 * @j_min_batch_time:
++	 *
++	 * Minimum time that we should wait for additional filesystem operations
++	 * to get batched into a synchronous handle in microseconds.
+ 	 */
+ 	u32			j_min_batch_time;
++
++	/**
++	 * @j_max_batch_time:
++	 *
++	 * Maximum time that we should wait for additional filesystem operations
++	 * to get batched into a synchronous handle in microseconds.
++	 */
+ 	u32			j_max_batch_time;
+ 
+-	/* This function is called when a transaction is closed */
++	/**
++	 * @j_commit_callback:
++	 *
++	 * This function is called when a transaction is closed.
++	 */
+ 	void			(*j_commit_callback)(journal_t *,
+ 						     transaction_t *);
+ 
+ 	/*
+ 	 * Journal statistics
+ 	 */
++
++	/**
++	 * @j_history_lock: Protect the transactions statistics history.
++	 */
+ 	spinlock_t		j_history_lock;
++
++	/**
++	 * @j_proc_entry: procfs entry for the jbd statistics directory.
++	 */
+ 	struct proc_dir_entry	*j_proc_entry;
++
++	/**
++	 * @j_stats: Overall statistics.
++	 */
+ 	struct transaction_stats_s j_stats;
+ 
+-	/* Failed journal commit ID */
++	/**
++	 * @j_failed_commit: Failed journal commit ID.
++	 */
+ 	unsigned int		j_failed_commit;
+ 
+-	/*
++	/**
++	 * @j_private:
++	 *
+ 	 * An opaque pointer to fs-private information.  ext3 puts its
+-	 * superblock pointer here
++	 * superblock pointer here.
+ 	 */
+ 	void *j_private;
+ 
+-	/* Reference to checksum algorithm driver via cryptoapi */
++	/**
++	 * @j_chksum_driver:
++	 *
++	 * Reference to checksum algorithm driver via cryptoapi.
++	 */
+ 	struct crypto_shash *j_chksum_driver;
+ 
+-	/* Precomputed journal UUID checksum for seeding other checksums */
++	/**
++	 * @j_csum_seed:
++	 *
++	 * Precomputed journal UUID checksum for seeding other checksums.
++	 */
+ 	__u32 j_csum_seed;
+ 
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+-	/*
++	/**
++	 * @j_trans_commit_map:
++	 *
+ 	 * Lockdep entity to track transaction commit dependencies. Handles
+ 	 * hold this "lock" for read, when we wait for commit, we acquire the
+ 	 * "lock" for writing. This matches the properties of jbd2 journalling
+diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
+index a0610427e168..b82c4ae92411 100644
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -1238,7 +1238,7 @@ mlx5_get_vector_affinity(struct mlx5_core_dev *dev, int vector)
+ 	int eqn;
+ 	int err;
+ 
+-	err = mlx5_vector2eqn(dev, vector, &eqn, &irq);
++	err = mlx5_vector2eqn(dev, MLX5_EQ_VEC_COMP_BASE + vector, &eqn, &irq);
+ 	if (err)
+ 		return NULL;
+ 
+diff --git a/include/linux/mm_inline.h b/include/linux/mm_inline.h
+index c30b32e3c862..10191c28fc04 100644
+--- a/include/linux/mm_inline.h
++++ b/include/linux/mm_inline.h
+@@ -127,10 +127,4 @@ static __always_inline enum lru_list page_lru(struct page *page)
+ 
+ #define lru_to_page(head) (list_entry((head)->prev, struct page, lru))
+ 
+-#ifdef arch_unmap_kpfn
+-extern void arch_unmap_kpfn(unsigned long pfn);
+-#else
+-static __always_inline void arch_unmap_kpfn(unsigned long pfn) { }
+-#endif
+-
+ #endif
+diff --git a/include/linux/nospec.h b/include/linux/nospec.h
+index b99bced39ac2..fbc98e2c8228 100644
+--- a/include/linux/nospec.h
++++ b/include/linux/nospec.h
+@@ -19,20 +19,6 @@
+ static inline unsigned long array_index_mask_nospec(unsigned long index,
+ 						    unsigned long size)
+ {
+-	/*
+-	 * Warn developers about inappropriate array_index_nospec() usage.
+-	 *
+-	 * Even if the CPU speculates past the WARN_ONCE branch, the
+-	 * sign bit of @index is taken into account when generating the
+-	 * mask.
+-	 *
+-	 * This warning is compiled out when the compiler can infer that
+-	 * @index and @size are less than LONG_MAX.
+-	 */
+-	if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX,
+-			"array_index_nospec() limited to range of [0, LONG_MAX]\n"))
+-		return 0;
+-
+ 	/*
+ 	 * Always calculate and emit the mask even if the compiler
+ 	 * thinks the mask is not needed. The compiler does not take
+@@ -43,6 +29,26 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
+ }
+ #endif
+ 
++/*
++ * Warn developers about inappropriate array_index_nospec() usage.
++ *
++ * Even if the CPU speculates past the WARN_ONCE branch, the
++ * sign bit of @index is taken into account when generating the
++ * mask.
++ *
++ * This warning is compiled out when the compiler can infer that
++ * @index and @size are less than LONG_MAX.
++ */
++#define array_index_mask_nospec_check(index, size)				\
++({										\
++	if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX,			\
++	    "array_index_nospec() limited to range of [0, LONG_MAX]\n"))	\
++		_mask = 0;							\
++	else									\
++		_mask = array_index_mask_nospec(index, size);			\
++	_mask;									\
++})
++
+ /*
+  * array_index_nospec - sanitize an array index after a bounds check
+  *
+@@ -61,7 +67,7 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
+ ({									\
+ 	typeof(index) _i = (index);					\
+ 	typeof(size) _s = (size);					\
+-	unsigned long _mask = array_index_mask_nospec(_i, _s);		\
++	unsigned long _mask = array_index_mask_nospec_check(_i, _s);	\
+ 									\
+ 	BUILD_BUG_ON(sizeof(_i) > sizeof(long));			\
+ 	BUILD_BUG_ON(sizeof(_s) > sizeof(long));			\
+diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
+index fd84cda5ed7c..0d6a110dae7c 100644
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -983,9 +983,9 @@ struct ib_wc {
+ 		u32		invalidate_rkey;
+ 	} ex;
+ 	u32			src_qp;
++	u32			slid;
+ 	int			wc_flags;
+ 	u16			pkey_index;
+-	u32			slid;
+ 	u8			sl;
+ 	u8			dlid_path_bits;
+ 	u8			port_num;	/* valid only for DR SMPs on switches */
+diff --git a/include/trace/events/xen.h b/include/trace/events/xen.h
+index b8adf05c534e..7dd8f34c37df 100644
+--- a/include/trace/events/xen.h
++++ b/include/trace/events/xen.h
+@@ -368,7 +368,7 @@ TRACE_EVENT(xen_mmu_flush_tlb,
+ 	    TP_printk("%s", "")
+ 	);
+ 
+-TRACE_EVENT(xen_mmu_flush_tlb_single,
++TRACE_EVENT(xen_mmu_flush_tlb_one_user,
+ 	    TP_PROTO(unsigned long addr),
+ 	    TP_ARGS(addr),
+ 	    TP_STRUCT__entry(
+diff --git a/kernel/memremap.c b/kernel/memremap.c
+index 403ab9cdb949..4712ce646e04 100644
+--- a/kernel/memremap.c
++++ b/kernel/memremap.c
+@@ -301,7 +301,8 @@ static void devm_memremap_pages_release(struct device *dev, void *data)
+ 
+ 	/* pages are dead and unused, undo the arch mapping */
+ 	align_start = res->start & ~(SECTION_SIZE - 1);
+-	align_size = ALIGN(resource_size(res), SECTION_SIZE);
++	align_size = ALIGN(res->start + resource_size(res), SECTION_SIZE)
++		- align_start;
+ 
+ 	mem_hotplug_begin();
+ 	arch_remove_memory(align_start, align_size);
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index 61e7f0678d33..a764aec3c9a1 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -400,7 +400,6 @@ enum regex_type filter_parse_regex(char *buff, int len, char **search, int *not)
+ 	for (i = 0; i < len; i++) {
+ 		if (buff[i] == '*') {
+ 			if (!i) {
+-				*search = buff + 1;
+ 				type = MATCH_END_ONLY;
+ 			} else if (i == len - 1) {
+ 				if (type == MATCH_END_ONLY)
+@@ -410,14 +409,14 @@ enum regex_type filter_parse_regex(char *buff, int len, char **search, int *not)
+ 				buff[i] = 0;
+ 				break;
+ 			} else {	/* pattern continues, use full glob */
+-				type = MATCH_GLOB;
+-				break;
++				return MATCH_GLOB;
+ 			}
+ 		} else if (strchr("[?\\", buff[i])) {
+-			type = MATCH_GLOB;
+-			break;
++			return MATCH_GLOB;
+ 		}
+ 	}
++	if (buff[0] == '*')
++		*search = buff + 1;
+ 
+ 	return type;
+ }
+diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
+index 40592e7b3568..268029ae1be6 100644
+--- a/kernel/trace/trace_uprobe.c
++++ b/kernel/trace/trace_uprobe.c
+@@ -608,7 +608,7 @@ static int probes_seq_show(struct seq_file *m, void *v)
+ 
+ 	/* Don't print "0x  (null)" when offset is 0 */
+ 	if (tu->offset) {
+-		seq_printf(m, "0x%p", (void *)tu->offset);
++		seq_printf(m, "0x%px", (void *)tu->offset);
+ 	} else {
+ 		switch (sizeof(void *)) {
+ 		case 4:
+diff --git a/lib/swiotlb.c b/lib/swiotlb.c
+index cea19aaf303c..0d7f46fb993a 100644
+--- a/lib/swiotlb.c
++++ b/lib/swiotlb.c
+@@ -586,7 +586,7 @@ phys_addr_t swiotlb_tbl_map_single(struct device *hwdev,
+ 
+ not_found:
+ 	spin_unlock_irqrestore(&io_tlb_lock, flags);
+-	if (printk_ratelimit())
++	if (!(attrs & DMA_ATTR_NO_WARN) && printk_ratelimit())
+ 		dev_warn(hwdev, "swiotlb buffer is full (sz: %zd bytes)\n", size);
+ 	return SWIOTLB_MAP_ERROR;
+ found:
+@@ -713,6 +713,7 @@ void *
+ swiotlb_alloc_coherent(struct device *hwdev, size_t size,
+ 		       dma_addr_t *dma_handle, gfp_t flags)
+ {
++	bool warn = !(flags & __GFP_NOWARN);
+ 	dma_addr_t dev_addr;
+ 	void *ret;
+ 	int order = get_order(size);
+@@ -738,8 +739,8 @@ swiotlb_alloc_coherent(struct device *hwdev, size_t size,
+ 		 * GFP_DMA memory; fall back on map_single(), which
+ 		 * will grab memory from the lowest available address range.
+ 		 */
+-		phys_addr_t paddr = map_single(hwdev, 0, size,
+-					       DMA_FROM_DEVICE, 0);
++		phys_addr_t paddr = map_single(hwdev, 0, size, DMA_FROM_DEVICE,
++					       warn ? 0 : DMA_ATTR_NO_WARN);
+ 		if (paddr == SWIOTLB_MAP_ERROR)
+ 			goto err_warn;
+ 
+@@ -769,9 +770,11 @@ swiotlb_alloc_coherent(struct device *hwdev, size_t size,
+ 	return ret;
+ 
+ err_warn:
+-	pr_warn("swiotlb: coherent allocation failed for device %s size=%zu\n",
+-		dev_name(hwdev), size);
+-	dump_stack();
++	if (warn && printk_ratelimit()) {
++		pr_warn("swiotlb: coherent allocation failed for device %s size=%zu\n",
++			dev_name(hwdev), size);
++		dump_stack();
++	}
+ 
+ 	return NULL;
+ }
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 4acdf393a801..c85fa0038848 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1146,8 +1146,6 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
+ 		return 0;
+ 	}
+ 
+-	arch_unmap_kpfn(pfn);
+-
+ 	orig_head = hpage = compound_head(p);
+ 	num_poisoned_pages_inc();
+ 
+diff --git a/mm/memory.c b/mm/memory.c
+index 793004608332..93e51ad41ba3 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -81,7 +81,7 @@
+ 
+ #include "internal.h"
+ 
+-#ifdef LAST_CPUPID_NOT_IN_PAGE_FLAGS
++#if defined(LAST_CPUPID_NOT_IN_PAGE_FLAGS) && !defined(CONFIG_COMPILE_TEST)
+ #warning Unfortunate NUMA and NUMA Balancing config, growing page-frame for last_cpupid.
+ #endif
+ 
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 76c9688b6a0a..d23818c5465a 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1177,9 +1177,10 @@ static void free_one_page(struct zone *zone,
+ }
+ 
+ static void __meminit __init_single_page(struct page *page, unsigned long pfn,
+-				unsigned long zone, int nid)
++				unsigned long zone, int nid, bool zero)
+ {
+-	mm_zero_struct_page(page);
++	if (zero)
++		mm_zero_struct_page(page);
+ 	set_page_links(page, zone, nid, pfn);
+ 	init_page_count(page);
+ 	page_mapcount_reset(page);
+@@ -1194,9 +1195,9 @@ static void __meminit __init_single_page(struct page *page, unsigned long pfn,
+ }
+ 
+ static void __meminit __init_single_pfn(unsigned long pfn, unsigned long zone,
+-					int nid)
++					int nid, bool zero)
+ {
+-	return __init_single_page(pfn_to_page(pfn), pfn, zone, nid);
++	return __init_single_page(pfn_to_page(pfn), pfn, zone, nid, zero);
+ }
+ 
+ #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT
+@@ -1217,7 +1218,7 @@ static void __meminit init_reserved_page(unsigned long pfn)
+ 		if (pfn >= zone->zone_start_pfn && pfn < zone_end_pfn(zone))
+ 			break;
+ 	}
+-	__init_single_pfn(pfn, zid, nid);
++	__init_single_pfn(pfn, zid, nid, true);
+ }
+ #else
+ static inline void init_reserved_page(unsigned long pfn)
+@@ -1514,7 +1515,7 @@ static unsigned long __init deferred_init_range(int nid, int zid,
+ 					page++;
+ 				else
+ 					page = pfn_to_page(pfn);
+-				__init_single_page(page, pfn, zid, nid);
++				__init_single_page(page, pfn, zid, nid, true);
+ 				cond_resched();
+ 			}
+ 		}
+@@ -5393,15 +5394,20 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
+ 		 * can be created for invalid pages (for alignment)
+ 		 * check here not to call set_pageblock_migratetype() against
+ 		 * pfn out of zone.
++		 *
++		 * Please note that MEMMAP_HOTPLUG path doesn't clear memmap
++		 * because this is done early in sparse_add_one_section
+ 		 */
+ 		if (!(pfn & (pageblock_nr_pages - 1))) {
+ 			struct page *page = pfn_to_page(pfn);
+ 
+-			__init_single_page(page, pfn, zone, nid);
++			__init_single_page(page, pfn, zone, nid,
++					context != MEMMAP_HOTPLUG);
+ 			set_pageblock_migratetype(page, MIGRATE_MOVABLE);
+ 			cond_resched();
+ 		} else {
+-			__init_single_pfn(pfn, zone, nid);
++			__init_single_pfn(pfn, zone, nid,
++					context != MEMMAP_HOTPLUG);
+ 		}
+ 	}
+ }
+diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
+index f3a4efcf1456..3aa5a93ad107 100644
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -160,7 +160,8 @@ static void req_done(struct virtqueue *vq)
+ 		spin_unlock_irqrestore(&chan->lock, flags);
+ 		/* Wakeup if anyone waiting for VirtIO ring space. */
+ 		wake_up(chan->vc_wq);
+-		p9_client_cb(chan->client, req, REQ_STATUS_RCVD);
++		if (len)
++			p9_client_cb(chan->client, req, REQ_STATUS_RCVD);
+ 	}
+ }
+ 
+diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
+index 8ca9915befc8..aae3565c3a92 100644
+--- a/net/mpls/af_mpls.c
++++ b/net/mpls/af_mpls.c
+@@ -8,6 +8,7 @@
+ #include <linux/ipv6.h>
+ #include <linux/mpls.h>
+ #include <linux/netconf.h>
++#include <linux/nospec.h>
+ #include <linux/vmalloc.h>
+ #include <linux/percpu.h>
+ #include <net/ip.h>
+@@ -935,24 +936,27 @@ static int mpls_nh_build_multi(struct mpls_route_config *cfg,
+ 	return err;
+ }
+ 
+-static bool mpls_label_ok(struct net *net, unsigned int index,
++static bool mpls_label_ok(struct net *net, unsigned int *index,
+ 			  struct netlink_ext_ack *extack)
+ {
++	bool is_ok = true;
++
+ 	/* Reserved labels may not be set */
+-	if (index < MPLS_LABEL_FIRST_UNRESERVED) {
++	if (*index < MPLS_LABEL_FIRST_UNRESERVED) {
+ 		NL_SET_ERR_MSG(extack,
+ 			       "Invalid label - must be MPLS_LABEL_FIRST_UNRESERVED or higher");
+-		return false;
++		is_ok = false;
+ 	}
+ 
+ 	/* The full 20 bit range may not be supported. */
+-	if (index >= net->mpls.platform_labels) {
++	if (is_ok && *index >= net->mpls.platform_labels) {
+ 		NL_SET_ERR_MSG(extack,
+ 			       "Label >= configured maximum in platform_labels");
+-		return false;
++		is_ok = false;
+ 	}
+ 
+-	return true;
++	*index = array_index_nospec(*index, net->mpls.platform_labels);
++	return is_ok;
+ }
+ 
+ static int mpls_route_add(struct mpls_route_config *cfg,
+@@ -975,7 +979,7 @@ static int mpls_route_add(struct mpls_route_config *cfg,
+ 		index = find_free_label(net);
+ 	}
+ 
+-	if (!mpls_label_ok(net, index, extack))
++	if (!mpls_label_ok(net, &index, extack))
+ 		goto errout;
+ 
+ 	/* Append makes no sense with mpls */
+@@ -1052,7 +1056,7 @@ static int mpls_route_del(struct mpls_route_config *cfg,
+ 
+ 	index = cfg->rc_label;
+ 
+-	if (!mpls_label_ok(net, index, extack))
++	if (!mpls_label_ok(net, &index, extack))
+ 		goto errout;
+ 
+ 	mpls_route_update(net, index, NULL, &cfg->rc_nlinfo);
+@@ -1810,7 +1814,7 @@ static int rtm_to_route_config(struct sk_buff *skb,
+ 				goto errout;
+ 
+ 			if (!mpls_label_ok(cfg->rc_nlinfo.nl_net,
+-					   cfg->rc_label, extack))
++					   &cfg->rc_label, extack))
+ 				goto errout;
+ 			break;
+ 		}
+@@ -2137,7 +2141,7 @@ static int mpls_getroute(struct sk_buff *in_skb, struct nlmsghdr *in_nlh,
+ 			goto errout;
+ 		}
+ 
+-		if (!mpls_label_ok(net, in_label, extack)) {
++		if (!mpls_label_ok(net, &in_label, extack)) {
+ 			err = -EINVAL;
+ 			goto errout;
+ 		}
+diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
+index a3f2ab283aeb..852b838d37b3 100644
+--- a/net/sunrpc/xprtrdma/rpc_rdma.c
++++ b/net/sunrpc/xprtrdma/rpc_rdma.c
+@@ -143,7 +143,7 @@ static bool rpcrdma_args_inline(struct rpcrdma_xprt *r_xprt,
+ 	if (xdr->page_len) {
+ 		remaining = xdr->page_len;
+ 		offset = offset_in_page(xdr->page_base);
+-		count = 0;
++		count = RPCRDMA_MIN_SEND_SGES;
+ 		while (remaining) {
+ 			remaining -= min_t(unsigned int,
+ 					   PAGE_SIZE - offset, remaining);
+diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
+index 8607c029c0dd..8cd7ee4fa0cd 100644
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -509,7 +509,7 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
+ 		pr_warn("rpcrdma: HCA provides only %d send SGEs\n", max_sge);
+ 		return -ENOMEM;
+ 	}
+-	ia->ri_max_send_sges = max_sge - RPCRDMA_MIN_SEND_SGES;
++	ia->ri_max_send_sges = max_sge;
+ 
+ 	if (ia->ri_device->attrs.max_qp_wr <= RPCRDMA_BACKWARD_WRS) {
+ 		dprintk("RPC:       %s: insufficient wqe's available\n",
+@@ -1476,6 +1476,9 @@ __rpcrdma_dma_map_regbuf(struct rpcrdma_ia *ia, struct rpcrdma_regbuf *rb)
+ static void
+ rpcrdma_dma_unmap_regbuf(struct rpcrdma_regbuf *rb)
+ {
++	if (!rb)
++		return;
++
+ 	if (!rpcrdma_regbuf_is_mapped(rb))
+ 		return;
+ 
+@@ -1491,9 +1494,6 @@ rpcrdma_dma_unmap_regbuf(struct rpcrdma_regbuf *rb)
+ void
+ rpcrdma_free_regbuf(struct rpcrdma_regbuf *rb)
+ {
+-	if (!rb)
+-		return;
+-
+ 	rpcrdma_dma_unmap_regbuf(rb);
+ 	kfree(rb);
+ }
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index d01913404581..a42cbbf2c8d9 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1003,7 +1003,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
+ {
+ 	struct snd_seq_client *client = file->private_data;
+ 	int written = 0, len;
+-	int err = -EINVAL;
++	int err;
+ 	struct snd_seq_event event;
+ 
+ 	if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT))
+@@ -1018,11 +1018,15 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
+ 
+ 	/* allocate the pool now if the pool is not allocated yet */ 
+ 	if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
+-		if (snd_seq_pool_init(client->pool) < 0)
++		mutex_lock(&client->ioctl_mutex);
++		err = snd_seq_pool_init(client->pool);
++		mutex_unlock(&client->ioctl_mutex);
++		if (err < 0)
+ 			return -ENOMEM;
+ 	}
+ 
+ 	/* only process whole events */
++	err = -EINVAL;
+ 	while (count >= sizeof(struct snd_seq_event)) {
+ 		/* Read in the event header from the user */
+ 		len = sizeof(event);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1750e00c5bb4..4ff1f0ca52fc 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3378,6 +3378,19 @@ static void alc269_fixup_pincfg_no_hp_to_lineout(struct hda_codec *codec,
+ 		spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
+ }
+ 
++static void alc269_fixup_pincfg_U7x7_headset_mic(struct hda_codec *codec,
++						 const struct hda_fixup *fix,
++						 int action)
++{
++	unsigned int cfg_headphone = snd_hda_codec_get_pincfg(codec, 0x21);
++	unsigned int cfg_headset_mic = snd_hda_codec_get_pincfg(codec, 0x19);
++
++	if (cfg_headphone && cfg_headset_mic == 0x411111f0)
++		snd_hda_codec_set_pincfg(codec, 0x19,
++			(cfg_headphone & ~AC_DEFCFG_DEVICE) |
++			(AC_JACK_MIC_IN << AC_DEFCFG_DEVICE_SHIFT));
++}
++
+ static void alc269_fixup_hweq(struct hda_codec *codec,
+ 			       const struct hda_fixup *fix, int action)
+ {
+@@ -4850,6 +4863,28 @@ static void alc_fixup_tpt440_dock(struct hda_codec *codec,
+ 	}
+ }
+ 
++static void alc_fixup_tpt470_dock(struct hda_codec *codec,
++				  const struct hda_fixup *fix, int action)
++{
++	static const struct hda_pintbl pincfgs[] = {
++		{ 0x17, 0x21211010 }, /* dock headphone */
++		{ 0x19, 0x21a11010 }, /* dock mic */
++		{ }
++	};
++	struct alc_spec *spec = codec->spec;
++
++	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++		spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
++		/* Enable DOCK device */
++		snd_hda_codec_write(codec, 0x17, 0,
++			    AC_VERB_SET_CONFIG_DEFAULT_BYTES_3, 0);
++		/* Enable DOCK device */
++		snd_hda_codec_write(codec, 0x19, 0,
++			    AC_VERB_SET_CONFIG_DEFAULT_BYTES_3, 0);
++		snd_hda_apply_pincfgs(codec, pincfgs);
++	}
++}
++
+ static void alc_shutup_dell_xps13(struct hda_codec *codec)
+ {
+ 	struct alc_spec *spec = codec->spec;
+@@ -5229,6 +5264,7 @@ enum {
+ 	ALC269_FIXUP_LIFEBOOK_EXTMIC,
+ 	ALC269_FIXUP_LIFEBOOK_HP_PIN,
+ 	ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT,
++	ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC,
+ 	ALC269_FIXUP_AMIC,
+ 	ALC269_FIXUP_DMIC,
+ 	ALC269VB_FIXUP_AMIC,
+@@ -5324,6 +5360,7 @@ enum {
+ 	ALC700_FIXUP_INTEL_REFERENCE,
+ 	ALC274_FIXUP_DELL_BIND_DACS,
+ 	ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
++	ALC298_FIXUP_TPT470_DOCK,
+ };
+ 
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -5434,6 +5471,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc269_fixup_pincfg_no_hp_to_lineout,
+ 	},
++	[ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc269_fixup_pincfg_U7x7_headset_mic,
++	},
+ 	[ALC269_FIXUP_AMIC] = {
+ 		.type = HDA_FIXUP_PINS,
+ 		.v.pins = (const struct hda_pintbl[]) {
+@@ -6149,6 +6190,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.chained = true,
+ 		.chain_id = ALC274_FIXUP_DELL_BIND_DACS
+ 	},
++	[ALC298_FIXUP_TPT470_DOCK] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc_fixup_tpt470_dock,
++		.chained = true,
++		.chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE
++	},
+ };
+ 
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6199,6 +6246,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+ 	SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ 	SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
++	SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
++	SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ 	SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
+@@ -6300,6 +6349,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT),
+ 	SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
+ 	SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
++	SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
+ 	SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
+ 	SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
+@@ -6328,8 +6378,16 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x17aa, 0x2218, "Thinkpad X1 Carbon 2nd", ALC292_FIXUP_TPT440_DOCK),
+ 	SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
+ 	SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
++	SND_PCI_QUIRK(0x17aa, 0x222d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
++	SND_PCI_QUIRK(0x17aa, 0x222e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ 	SND_PCI_QUIRK(0x17aa, 0x2231, "Thinkpad T560", ALC292_FIXUP_TPT460),
+ 	SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460),
++	SND_PCI_QUIRK(0x17aa, 0x2245, "Thinkpad T470", ALC298_FIXUP_TPT470_DOCK),
++	SND_PCI_QUIRK(0x17aa, 0x2246, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
++	SND_PCI_QUIRK(0x17aa, 0x2247, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
++	SND_PCI_QUIRK(0x17aa, 0x224b, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
++	SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
++	SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ 	SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ 	SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ 	SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+@@ -6350,7 +6408,12 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x17aa, 0x5050, "Thinkpad T560p", ALC292_FIXUP_TPT460),
+ 	SND_PCI_QUIRK(0x17aa, 0x5051, "Thinkpad L460", ALC292_FIXUP_TPT460),
+ 	SND_PCI_QUIRK(0x17aa, 0x5053, "Thinkpad T460", ALC292_FIXUP_TPT460),
++	SND_PCI_QUIRK(0x17aa, 0x505d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
++	SND_PCI_QUIRK(0x17aa, 0x505f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
++	SND_PCI_QUIRK(0x17aa, 0x5062, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ 	SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++	SND_PCI_QUIRK(0x17aa, 0x511e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
++	SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ 	SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
+ 	SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
+ 	SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
+@@ -6612,6 +6675,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ 		{0x12, 0xb7a60130},
+ 		{0x14, 0x90170110},
+ 		{0x21, 0x02211020}),
++	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++		{0x12, 0x90a60130},
++		{0x14, 0x90170110},
++		{0x14, 0x01011020},
++		{0x21, 0x0221101f}),
+ 	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 		ALC256_STANDARD_PINS),
+ 	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC,
+@@ -6681,6 +6749,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ 		{0x12, 0x90a60120},
+ 		{0x14, 0x90170110},
+ 		{0x21, 0x0321101f}),
++	SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
++		{0x12, 0xb7a60130},
++		{0x14, 0x90170110},
++		{0x21, 0x04211020}),
+ 	SND_HDA_PIN_QUIRK(0x10ec0290, 0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1,
+ 		ALC290_STANDARD_PINS,
+ 		{0x15, 0x04211040},
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 2b4ceda36291..20b28a5a1456 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -347,17 +347,20 @@ static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request,
+ 			    int validx, int *value_ret)
+ {
+ 	struct snd_usb_audio *chip = cval->head.mixer->chip;
+-	unsigned char buf[4 + 3 * sizeof(__u32)]; /* enough space for one range */
++	/* enough space for one range */
++	unsigned char buf[sizeof(__u16) + 3 * sizeof(__u32)];
+ 	unsigned char *val;
+-	int idx = 0, ret, size;
++	int idx = 0, ret, val_size, size;
+ 	__u8 bRequest;
+ 
++	val_size = uac2_ctl_value_size(cval->val_type);
++
+ 	if (request == UAC_GET_CUR) {
+ 		bRequest = UAC2_CS_CUR;
+-		size = uac2_ctl_value_size(cval->val_type);
++		size = val_size;
+ 	} else {
+ 		bRequest = UAC2_CS_RANGE;
+-		size = sizeof(buf);
++		size = sizeof(__u16) + 3 * val_size;
+ 	}
+ 
+ 	memset(buf, 0, sizeof(buf));
+@@ -390,16 +393,17 @@ static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request,
+ 		val = buf + sizeof(__u16);
+ 		break;
+ 	case UAC_GET_MAX:
+-		val = buf + sizeof(__u16) * 2;
++		val = buf + sizeof(__u16) + val_size;
+ 		break;
+ 	case UAC_GET_RES:
+-		val = buf + sizeof(__u16) * 3;
++		val = buf + sizeof(__u16) + val_size * 2;
+ 		break;
+ 	default:
+ 		return -EINVAL;
+ 	}
+ 
+-	*value_ret = convert_signed_value(cval, snd_usb_combine_bytes(val, sizeof(__u16)));
++	*value_ret = convert_signed_value(cval,
++					  snd_usb_combine_bytes(val, val_size));
+ 
+ 	return 0;
+ }
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index b9c9a19f9588..3cbfae6604f9 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -352,6 +352,15 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ 		ep = 0x86;
+ 		iface = usb_ifnum_to_if(dev, 2);
+ 
++		if (!iface || iface->num_altsetting == 0)
++			return -EINVAL;
++
++		alts = &iface->altsetting[1];
++		goto add_sync_ep;
++	case USB_ID(0x1397, 0x0002):
++		ep = 0x81;
++		iface = usb_ifnum_to_if(dev, 1);
++
+ 		if (!iface || iface->num_altsetting == 0)
+ 			return -EINVAL;
+ 
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index a66ef5777887..ea8f3de92fa4 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1363,8 +1363,11 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ 			return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ 		break;
+ 
+-	/* Amanero Combo384 USB interface with native DSD support */
+-	case USB_ID(0x16d0, 0x071a):
++	/* Amanero Combo384 USB based DACs with native DSD support */
++	case USB_ID(0x16d0, 0x071a):  /* Amanero - Combo384 */
++	case USB_ID(0x2ab6, 0x0004):  /* T+A DAC8DSD-V2.0, MP1000E-V2.0, MP2000R-V2.0, MP2500R-V2.0, MP3100HV-V2.0 */
++	case USB_ID(0x2ab6, 0x0005):  /* T+A USB HD Audio 1 */
++	case USB_ID(0x2ab6, 0x0006):  /* T+A USB HD Audio 2 */
+ 		if (fp->altsetting == 2) {
+ 			switch (le16_to_cpu(chip->dev->descriptor.bcdDevice)) {
+ 			case 0x199:
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 2e458eb45586..c7fb5c2392ee 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -1935,13 +1935,19 @@ static bool ignore_unreachable_insn(struct instruction *insn)
+ 		if (is_kasan_insn(insn) || is_ubsan_insn(insn))
+ 			return true;
+ 
+-		if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest) {
+-			insn = insn->jump_dest;
+-			continue;
++		if (insn->type == INSN_JUMP_UNCONDITIONAL) {
++			if (insn->jump_dest &&
++			    insn->jump_dest->func == insn->func) {
++				insn = insn->jump_dest;
++				continue;
++			}
++
++			break;
+ 		}
+ 
+ 		if (insn->offset + insn->len >= insn->func->offset + insn->func->len)
+ 			break;
++
+ 		insn = list_next_entry(insn, list);
+ 	}
+ 
+diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
+index 24dbf634e2dd..0b457e8e0f0c 100644
+--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
+@@ -1717,7 +1717,7 @@ void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee,
+ 
+ 	if (nr == __NR_getpid)
+ 		change_syscall(_metadata, tracee, __NR_getppid);
+-	if (nr == __NR_open)
++	if (nr == __NR_openat)
+ 		change_syscall(_metadata, tracee, -1);
+ }
+ 
+@@ -1792,7 +1792,7 @@ TEST_F(TRACE_syscall, ptrace_syscall_dropped)
+ 					   true);
+ 
+ 	/* Tracer should skip the open syscall, resulting in EPERM. */
+-	EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_open));
++	EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_openat));
+ }
+ 
+ TEST_F(TRACE_syscall, syscall_allowed)
+diff --git a/tools/testing/selftests/vm/compaction_test.c b/tools/testing/selftests/vm/compaction_test.c
+index a65b016d4c13..1097f04e4d80 100644
+--- a/tools/testing/selftests/vm/compaction_test.c
++++ b/tools/testing/selftests/vm/compaction_test.c
+@@ -137,6 +137,8 @@ int check_compaction(unsigned long mem_free, unsigned int hugepage_size)
+ 	printf("No of huge pages allocated = %d\n",
+ 	       (atoi(nr_hugepages)));
+ 
++	lseek(fd, 0, SEEK_SET);
++
+ 	if (write(fd, initial_nr_hugepages, strlen(initial_nr_hugepages))
+ 	    != strlen(initial_nr_hugepages)) {
+ 		perror("Failed to write value to /proc/sys/vm/nr_hugepages\n");
+diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
+index 5d4f10ac2af2..aa6e2d7f6a1f 100644
+--- a/tools/testing/selftests/x86/Makefile
++++ b/tools/testing/selftests/x86/Makefile
+@@ -5,16 +5,26 @@ include ../lib.mk
+ 
+ .PHONY: all all_32 all_64 warn_32bit_failure clean
+ 
+-TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt ptrace_syscall test_mremap_vdso \
+-			check_initial_reg_state sigreturn ldt_gdt iopl mpx-mini-test ioperm \
++UNAME_M := $(shell uname -m)
++CAN_BUILD_I386 := $(shell ./check_cc.sh $(CC) trivial_32bit_program.c -m32)
++CAN_BUILD_X86_64 := $(shell ./check_cc.sh $(CC) trivial_64bit_program.c)
++
++TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \
++			check_initial_reg_state sigreturn iopl mpx-mini-test ioperm \
+ 			protection_keys test_vdso test_vsyscall
+ TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault test_syscall_vdso unwind_vdso \
+ 			test_FCMOV test_FCOMI test_FISTTP \
+ 			vdso_restorer
+-TARGETS_C_64BIT_ONLY := fsgsbase sysret_rip 5lvl
++TARGETS_C_64BIT_ONLY := fsgsbase sysret_rip
++# Some selftests require 32bit support enabled also on 64bit systems
++TARGETS_C_32BIT_NEEDED := ldt_gdt ptrace_syscall
+ 
+-TARGETS_C_32BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_32BIT_ONLY)
++TARGETS_C_32BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_32BIT_ONLY) $(TARGETS_C_32BIT_NEEDED)
+ TARGETS_C_64BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_64BIT_ONLY)
++ifeq ($(CAN_BUILD_I386)$(CAN_BUILD_X86_64),11)
++TARGETS_C_64BIT_ALL += $(TARGETS_C_32BIT_NEEDED)
++endif
++
+ BINARIES_32 := $(TARGETS_C_32BIT_ALL:%=%_32)
+ BINARIES_64 := $(TARGETS_C_64BIT_ALL:%=%_64)
+ 
+@@ -23,18 +33,16 @@ BINARIES_64 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_64))
+ 
+ CFLAGS := -O2 -g -std=gnu99 -pthread -Wall -no-pie
+ 
+-UNAME_M := $(shell uname -m)
+-CAN_BUILD_I386 := $(shell ./check_cc.sh $(CC) trivial_32bit_program.c -m32)
+-CAN_BUILD_X86_64 := $(shell ./check_cc.sh $(CC) trivial_64bit_program.c)
+-
+ ifeq ($(CAN_BUILD_I386),1)
+ all: all_32
+ TEST_PROGS += $(BINARIES_32)
++EXTRA_CFLAGS += -DCAN_BUILD_32
+ endif
+ 
+ ifeq ($(CAN_BUILD_X86_64),1)
+ all: all_64
+ TEST_PROGS += $(BINARIES_64)
++EXTRA_CFLAGS += -DCAN_BUILD_64
+ endif
+ 
+ all_32: $(BINARIES_32)
+diff --git a/tools/testing/selftests/x86/mpx-mini-test.c b/tools/testing/selftests/x86/mpx-mini-test.c
+index ec0f6b45ce8b..9c0325e1ea68 100644
+--- a/tools/testing/selftests/x86/mpx-mini-test.c
++++ b/tools/testing/selftests/x86/mpx-mini-test.c
+@@ -315,11 +315,39 @@ static inline void *__si_bounds_upper(siginfo_t *si)
+ 	return si->si_upper;
+ }
+ #else
++
++/*
++ * This deals with old version of _sigfault in some distros:
++ *
++
++old _sigfault:
++        struct {
++            void *si_addr;
++	} _sigfault;
++
++new _sigfault:
++	struct {
++		void __user *_addr;
++		int _trapno;
++		short _addr_lsb;
++		union {
++			struct {
++				void __user *_lower;
++				void __user *_upper;
++			} _addr_bnd;
++			__u32 _pkey;
++		};
++	} _sigfault;
++ *
++ */
++
+ static inline void **__si_bounds_hack(siginfo_t *si)
+ {
+ 	void *sigfault = &si->_sifields._sigfault;
+ 	void *end_sigfault = sigfault + sizeof(si->_sifields._sigfault);
+-	void **__si_lower = end_sigfault;
++	int *trapno = (int*)end_sigfault;
++	/* skip _trapno and _addr_lsb */
++	void **__si_lower = (void**)(trapno + 2);
+ 
+ 	return __si_lower;
+ }
+@@ -331,7 +359,7 @@ static inline void *__si_bounds_lower(siginfo_t *si)
+ 
+ static inline void *__si_bounds_upper(siginfo_t *si)
+ {
+-	return (*__si_bounds_hack(si)) + sizeof(void *);
++	return *(__si_bounds_hack(si) + 1);
+ }
+ #endif
+ 
+diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c
+index bc1b0735bb50..f15aa5a76fe3 100644
+--- a/tools/testing/selftests/x86/protection_keys.c
++++ b/tools/testing/selftests/x86/protection_keys.c
+@@ -393,34 +393,6 @@ pid_t fork_lazy_child(void)
+ 	return forkret;
+ }
+ 
+-void davecmp(void *_a, void *_b, int len)
+-{
+-	int i;
+-	unsigned long *a = _a;
+-	unsigned long *b = _b;
+-
+-	for (i = 0; i < len / sizeof(*a); i++) {
+-		if (a[i] == b[i])
+-			continue;
+-
+-		dprintf3("[%3d]: a: %016lx b: %016lx\n", i, a[i], b[i]);
+-	}
+-}
+-
+-void dumpit(char *f)
+-{
+-	int fd = open(f, O_RDONLY);
+-	char buf[100];
+-	int nr_read;
+-
+-	dprintf2("maps fd: %d\n", fd);
+-	do {
+-		nr_read = read(fd, &buf[0], sizeof(buf));
+-		write(1, buf, nr_read);
+-	} while (nr_read > 0);
+-	close(fd);
+-}
+-
+ #define PKEY_DISABLE_ACCESS    0x1
+ #define PKEY_DISABLE_WRITE     0x2
+ 
+diff --git a/tools/testing/selftests/x86/single_step_syscall.c b/tools/testing/selftests/x86/single_step_syscall.c
+index a48da95c18fd..ddfdd635de16 100644
+--- a/tools/testing/selftests/x86/single_step_syscall.c
++++ b/tools/testing/selftests/x86/single_step_syscall.c
+@@ -119,7 +119,9 @@ static void check_result(void)
+ 
+ int main()
+ {
++#ifdef CAN_BUILD_32
+ 	int tmp;
++#endif
+ 
+ 	sethandler(SIGTRAP, sigtrap, 0);
+ 
+@@ -139,12 +141,13 @@ int main()
+ 		      : : "c" (post_nop) : "r11");
+ 	check_result();
+ #endif
+-
++#ifdef CAN_BUILD_32
+ 	printf("[RUN]\tSet TF and check int80\n");
+ 	set_eflags(get_eflags() | X86_EFLAGS_TF);
+ 	asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)
+ 			: INT80_CLOBBERS);
+ 	check_result();
++#endif
+ 
+ 	/*
+ 	 * This test is particularly interesting if fast syscalls use
+diff --git a/tools/testing/selftests/x86/test_mremap_vdso.c b/tools/testing/selftests/x86/test_mremap_vdso.c
+index bf0d687c7db7..64f11c8d9b76 100644
+--- a/tools/testing/selftests/x86/test_mremap_vdso.c
++++ b/tools/testing/selftests/x86/test_mremap_vdso.c
+@@ -90,8 +90,12 @@ int main(int argc, char **argv, char **envp)
+ 			vdso_size += PAGE_SIZE;
+ 		}
+ 
++#ifdef __i386__
+ 		/* Glibc is likely to explode now - exit with raw syscall */
+ 		asm volatile ("int $0x80" : : "a" (__NR_exit), "b" (!!ret));
++#else /* __x86_64__ */
++		syscall(SYS_exit, ret);
++#endif
+ 	} else {
+ 		int status;
+ 
+diff --git a/tools/testing/selftests/x86/test_vdso.c b/tools/testing/selftests/x86/test_vdso.c
+index 29973cde06d3..235259011704 100644
+--- a/tools/testing/selftests/x86/test_vdso.c
++++ b/tools/testing/selftests/x86/test_vdso.c
+@@ -26,20 +26,59 @@
+ # endif
+ #endif
+ 
++/* max length of lines in /proc/self/maps - anything longer is skipped here */
++#define MAPS_LINE_LEN 128
++
+ int nerrs = 0;
+ 
++typedef long (*getcpu_t)(unsigned *, unsigned *, void *);
++
++getcpu_t vgetcpu;
++getcpu_t vdso_getcpu;
++
++static void *vsyscall_getcpu(void)
++{
+ #ifdef __x86_64__
+-# define VSYS(x) (x)
++	FILE *maps;
++	char line[MAPS_LINE_LEN];
++	bool found = false;
++
++	maps = fopen("/proc/self/maps", "r");
++	if (!maps) /* might still be present, but ignore it here, as we test vDSO not vsyscall */
++		return NULL;
++
++	while (fgets(line, MAPS_LINE_LEN, maps)) {
++		char r, x;
++		void *start, *end;
++		char name[MAPS_LINE_LEN];
++
++		/* sscanf() is safe here as strlen(name) >= strlen(line) */
++		if (sscanf(line, "%p-%p %c-%cp %*x %*x:%*x %*u %s",
++			   &start, &end, &r, &x, name) != 5)
++			continue;
++
++		if (strcmp(name, "[vsyscall]"))
++			continue;
++
++		/* assume entries are OK, as we test vDSO here not vsyscall */
++		found = true;
++		break;
++	}
++
++	fclose(maps);
++
++	if (!found) {
++		printf("Warning: failed to find vsyscall getcpu\n");
++		return NULL;
++	}
++	return (void *) (0xffffffffff600800);
+ #else
+-# define VSYS(x) 0
++	return NULL;
+ #endif
++}
+ 
+-typedef long (*getcpu_t)(unsigned *, unsigned *, void *);
+-
+-const getcpu_t vgetcpu = (getcpu_t)VSYS(0xffffffffff600800);
+-getcpu_t vdso_getcpu;
+ 
+-void fill_function_pointers()
++static void fill_function_pointers()
+ {
+ 	void *vdso = dlopen("linux-vdso.so.1",
+ 			    RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);
+@@ -54,6 +93,8 @@ void fill_function_pointers()
+ 	vdso_getcpu = (getcpu_t)dlsym(vdso, "__vdso_getcpu");
+ 	if (!vdso_getcpu)
+ 		printf("Warning: failed to find getcpu in vDSO\n");
++
++	vgetcpu = (getcpu_t) vsyscall_getcpu();
+ }
+ 
+ static long sys_getcpu(unsigned * cpu, unsigned * node,
+diff --git a/tools/testing/selftests/x86/test_vsyscall.c b/tools/testing/selftests/x86/test_vsyscall.c
+index 7a744fa7b786..be81621446f0 100644
+--- a/tools/testing/selftests/x86/test_vsyscall.c
++++ b/tools/testing/selftests/x86/test_vsyscall.c
+@@ -33,6 +33,9 @@
+ # endif
+ #endif
+ 
++/* max length of lines in /proc/self/maps - anything longer is skipped here */
++#define MAPS_LINE_LEN 128
++
+ static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
+ 		       int flags)
+ {
+@@ -98,7 +101,7 @@ static int init_vsys(void)
+ #ifdef __x86_64__
+ 	int nerrs = 0;
+ 	FILE *maps;
+-	char line[128];
++	char line[MAPS_LINE_LEN];
+ 	bool found = false;
+ 
+ 	maps = fopen("/proc/self/maps", "r");
+@@ -108,10 +111,12 @@ static int init_vsys(void)
+ 		return 0;
+ 	}
+ 
+-	while (fgets(line, sizeof(line), maps)) {
++	while (fgets(line, MAPS_LINE_LEN, maps)) {
+ 		char r, x;
+ 		void *start, *end;
+-		char name[128];
++		char name[MAPS_LINE_LEN];
++
++		/* sscanf() is safe here as strlen(name) >= strlen(line) */
+ 		if (sscanf(line, "%p-%p %c-%cp %*x %*x:%*x %*u %s",
+ 			   &start, &end, &r, &x, name) != 5)
+ 			continue;