Merge 4.16-rc3 into staging-next

We want the IIO/Staging fixes in here, and to resolve a merge problem
with the move of the fsl-mc code.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

680 files changed, 6929 insertions, 4271 deletions

diff --git a/.gitignore b/.gitignore
index 705e09913dc2..1be78fd8163b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -127,3 +127,7 @@ all.config
 
 # Kdevelop4
 *.kdev4
+
+#Automatically generated by ASN.1 compiler
+net/ipv4/netfilter/nf_nat_snmp_basic-asn1.c
+net/ipv4/netfilter/nf_nat_snmp_basic-asn1.h
diff --git a/Documentation/ABI/testing/sysfs-devices-platform-dock b/Documentation/ABI/testing/sysfs-devices-platform-dock
new file mode 100644
index 000000000000..1d8c18f905c7
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-devices-platform-dock
@@ -0,0 +1,39 @@
+What:           /sys/devices/platform/dock.N/docked
+Date:           Dec, 2006
+KernelVersion:  2.6.19
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Value 1 or 0 indicates whether the software believes the
+                laptop is docked in a docking station.
+
+What:           /sys/devices/platform/dock.N/undock
+Date:           Dec, 2006
+KernelVersion:  2.6.19
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (WO) Writing to this file causes the software to initiate an
+                undock request to the firmware.
+
+What:           /sys/devices/platform/dock.N/uid
+Date:           Feb, 2007
+KernelVersion:  v2.6.21
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Displays the docking station the laptop is docked to.
+
+What:           /sys/devices/platform/dock.N/flags
+Date:           May, 2007
+KernelVersion:  v2.6.21
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Show dock station flags, useful for checking if undock
+                request has been made by the user (from the immediate_undock
+                option).
+
+What:           /sys/devices/platform/dock.N/type
+Date:           Aug, 2008
+KernelVersion:  v2.6.27
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Display the dock station type- dock_station, ata_bay or
+                battery_bay.
diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
index bfd29bc8d37a..4ed63b6cfb15 100644
--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
@@ -108,6 +108,8 @@ Description:	CPU topology files that describe a logical CPU's relationship
 
 What:           /sys/devices/system/cpu/cpuidle/current_driver
                 /sys/devices/system/cpu/cpuidle/current_governer_ro
+                /sys/devices/system/cpu/cpuidle/available_governors
+                /sys/devices/system/cpu/cpuidle/current_governor
 Date:           September 2007
 Contact:        Linux kernel mailing list <linux-kernel@vger.kernel.org>
 Description:    Discover cpuidle policy and mechanism
@@ -119,13 +121,84 @@ Description:	Discover cpuidle policy and mechanism
                 Idle policy (governor) is differentiated from idle mechanism
                 (driver)
 
-                current_driver: displays current idle mechanism
+                current_driver: (RO) displays current idle mechanism
 
-                current_governor_ro: displays current idle policy
+                current_governor_ro: (RO) displays current idle policy
+
+                With the cpuidle_sysfs_switch boot option enabled (meant for
+                developer testing), the following three attributes are visible
+                instead:
+
+                current_driver: same as described above
+
+                available_governors: (RO) displays a space separated list of
+                available governors
+
+                current_governor: (RW) displays current idle policy. Users can
+                switch the governor at runtime by writing to this file.
 
                 See files in Documentation/cpuidle/ for more information.
 
 
+What:           /sys/devices/system/cpu/cpuX/cpuidle/stateN/name
+                /sys/devices/system/cpu/cpuX/cpuidle/stateN/latency
+                /sys/devices/system/cpu/cpuX/cpuidle/stateN/power
+                /sys/devices/system/cpu/cpuX/cpuidle/stateN/time
+                /sys/devices/system/cpu/cpuX/cpuidle/stateN/usage
+Date:           September 2007
+KernelVersion:  v2.6.24
+Contact:        Linux power management list <linux-pm@vger.kernel.org>
+Description:
+                The directory /sys/devices/system/cpu/cpuX/cpuidle contains per
+                logical CPU specific cpuidle information for each online cpu X.
+                The processor idle states which are available for use have the
+                following attributes:
+
+                name: (RO) Name of the idle state (string).
+
+                latency: (RO) The latency to exit out of this idle state (in
+                microseconds).
+
+                power: (RO) The power consumed while in this idle state (in
+                milliwatts).
+
+                time: (RO) The total time spent in this idle state (in microseconds).
+
+                usage: (RO) Number of times this state was entered (a count).
+
+
+What:           /sys/devices/system/cpu/cpuX/cpuidle/stateN/desc
+Date:           February 2008
+KernelVersion:  v2.6.25
+Contact:        Linux power management list <linux-pm@vger.kernel.org>
+Description:
+                (RO) A small description about the idle state (string).
+
+
+What:           /sys/devices/system/cpu/cpuX/cpuidle/stateN/disable
+Date:           March 2012
+KernelVersion:  v3.10
+Contact:        Linux power management list <linux-pm@vger.kernel.org>
+Description:
+                (RW) Option to disable this idle state (bool). The behavior and
+                the effect of the disable variable depends on the implementation
+                of a particular governor. In the ladder governor, for example,
+                it is not coherent, i.e. if one is disabling a light state, then
+                all deeper states are disabled as well, but the disable variable
+                does not reflect it. Likewise, if one enables a deep state but a
+                lighter state still is disabled, then this has no effect.
+
+
+What:           /sys/devices/system/cpu/cpuX/cpuidle/stateN/residency
+Date:           March 2014
+KernelVersion:  v3.15
+Contact:        Linux power management list <linux-pm@vger.kernel.org>
+Description:
+                (RO) Display the target residency i.e. the minimum amount of
+                time (in microseconds) this cpu should spend in this idle state
+                to make the transition worth the effort.
+
+
 What:           /sys/devices/system/cpu/cpu#/cpufreq/*
 Date:           pre-git history
 Contact:        linux-pm@vger.kernel.org
diff --git a/Documentation/ABI/testing/sysfs-platform-dptf b/Documentation/ABI/testing/sysfs-platform-dptf
new file mode 100644
index 000000000000..325dc0667dbb
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-platform-dptf
@@ -0,0 +1,40 @@
+What:           /sys/bus/platform/devices/INT3407:00/dptf_power/charger_type
+Date:           Jul, 2016
+KernelVersion:  v4.10
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) The charger type - Traditional, Hybrid or NVDC.
+
+What:           /sys/bus/platform/devices/INT3407:00/dptf_power/adapter_rating_mw
+Date:           Jul, 2016
+KernelVersion:  v4.10
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Adapter rating in milliwatts (the maximum Adapter power).
+                Must be 0 if no AC Adaptor is plugged in.
+
+What:           /sys/bus/platform/devices/INT3407:00/dptf_power/max_platform_power_mw
+Date:           Jul, 2016
+KernelVersion:  v4.10
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Maximum platform power that can be supported by the battery
+                in milliwatts.
+
+What:           /sys/bus/platform/devices/INT3407:00/dptf_power/platform_power_source
+Date:           Jul, 2016
+KernelVersion:  v4.10
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Display the platform power source
+                0x00 = DC
+                0x01 = AC
+                0x02 = USB
+                0x03 = Wireless Charger
+
+What:           /sys/bus/platform/devices/INT3407:00/dptf_power/battery_steady_power
+Date:           Jul, 2016
+KernelVersion:  v4.10
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) The maximum sustained power for battery in milliwatts.
diff --git a/Documentation/atomic_bitops.txt b/Documentation/atomic_bitops.txt
index 5550bfdcce5f..be70b32c95d9 100644
--- a/Documentation/atomic_bitops.txt
+++ b/Documentation/atomic_bitops.txt
@@ -58,7 +58,12 @@ Like with atomic_t, the rule of thumb is:
 
  - RMW operations that have a return value are fully ordered.
 
-Except for test_and_set_bit_lock() which has ACQUIRE semantics and
+ - RMW operations that are conditional are unordered on FAILURE,
+   otherwise the above rules apply. In the case of test_and_{}_bit() operations,
+   if the bit in memory is unchanged by the operation then it is deemed to have
+   failed.
+
+Except for a successful test_and_set_bit_lock() which has ACQUIRE semantics and
 clear_bit_unlock() which has RELEASE semantics.
 
 Since a platform only has a single means of achieving atomic operations
diff --git a/Documentation/devicetree/bindings/power/mti,mips-cpc.txt b/Documentation/devicetree/bindings/power/mti,mips-cpc.txt
new file mode 100644
index 000000000000..c6b82511ae8a
--- /dev/null
+++ b/Documentation/devicetree/bindings/power/mti,mips-cpc.txt
@@ -0,0 +1,8 @@
+Binding for MIPS Cluster Power Controller (CPC).
+
+This binding allows a system to specify where the CPC registers are
+located.
+
+Required properties:
+compatible : Should be "mti,mips-cpc".
+regs: Should describe the address & size of the CPC register region.
diff --git a/Documentation/features/sched/membarrier-sync-core/arch-support.txt b/Documentation/features/sched/membarrier-sync-core/arch-support.txt
new file mode 100644
index 000000000000..2c815a7f1ba7
--- /dev/null
+++ b/Documentation/features/sched/membarrier-sync-core/arch-support.txt
@@ -0,0 +1,62 @@
+#
+# Feature name:          membarrier-sync-core
+#         Kconfig:       ARCH_HAS_MEMBARRIER_SYNC_CORE
+#         description:   arch supports core serializing membarrier
+#
+# Architecture requirements
+#
+# * arm64
+#
+# Rely on eret context synchronization when returning from IPI handler, and
+# when returning to user-space.
+#
+# * x86
+#
+# x86-32 uses IRET as return from interrupt, which takes care of the IPI.
+# However, it uses both IRET and SYSEXIT to go back to user-space. The IRET
+# instruction is core serializing, but not SYSEXIT.
+#
+# x86-64 uses IRET as return from interrupt, which takes care of the IPI.
+# However, it can return to user-space through either SYSRETL (compat code),
+# SYSRETQ, or IRET.
+#
+# Given that neither SYSRET{L,Q}, nor SYSEXIT, are core serializing, we rely
+# instead on write_cr3() performed by switch_mm() to provide core serialization
+# after changing the current mm, and deal with the special case of kthread ->
+# uthread (temporarily keeping current mm into active_mm) by issuing a
+# sync_core_before_usermode() in that specific case.
+#
+    -----------------------
+    |         arch |status|
+    -----------------------
+    |       alpha: | TODO |
+    |         arc: | TODO |
+    |         arm: | TODO |
+    |       arm64: |  ok  |
+    |    blackfin: | TODO |
+    |         c6x: | TODO |
+    |        cris: | TODO |
+    |         frv: | TODO |
+    |       h8300: | TODO |
+    |     hexagon: | TODO |
+    |        ia64: | TODO |
+    |        m32r: | TODO |
+    |        m68k: | TODO |
+    |       metag: | TODO |
+    |  microblaze: | TODO |
+    |        mips: | TODO |
+    |     mn10300: | TODO |
+    |       nios2: | TODO |
+    |    openrisc: | TODO |
+    |      parisc: | TODO |
+    |     powerpc: | TODO |
+    |        s390: | TODO |
+    |       score: | TODO |
+    |          sh: | TODO |
+    |       sparc: | TODO |
+    |        tile: | TODO |
+    |          um: | TODO |
+    |   unicore32: | TODO |
+    |         x86: |  ok  |
+    |      xtensa: | TODO |
+    -----------------------
diff --git a/Documentation/gpu/tve200.rst b/Documentation/gpu/tve200.rst
index 69b17b324e12..152ea9398f7e 100644
--- a/Documentation/gpu/tve200.rst
+++ b/Documentation/gpu/tve200.rst
@@ -3,4 +3,4 @@
 ==================================
 
 .. kernel-doc:: drivers/gpu/drm/tve200/tve200_drv.c
-   :doc: Faraday TV Encoder 200
+   :doc: Faraday TV Encoder TVE200 DRM Driver
diff --git a/Documentation/i2c/busses/i2c-i801 b/Documentation/i2c/busses/i2c-i801
index d47702456926..65514c251318 100644
--- a/Documentation/i2c/busses/i2c-i801
+++ b/Documentation/i2c/busses/i2c-i801
@@ -28,8 +28,10 @@ Supported adapters:
   * Intel Wildcat Point (PCH)
   * Intel Wildcat Point-LP (PCH)
   * Intel BayTrail (SOC)
+  * Intel Braswell (SOC)
   * Intel Sunrise Point-H (PCH)
   * Intel Sunrise Point-LP (PCH)
+  * Intel Kaby Lake-H (PCH)
   * Intel DNV (SOC)
   * Intel Broxton (SOC)
   * Intel Lewisburg (PCH)
diff --git a/Documentation/locking/mutex-design.txt b/Documentation/locking/mutex-design.txt
index 60c482df1a38..818aca19612f 100644
--- a/Documentation/locking/mutex-design.txt
+++ b/Documentation/locking/mutex-design.txt
@@ -21,37 +21,23 @@ Implementation
 --------------
 
 Mutexes are represented by 'struct mutex', defined in include/linux/mutex.h
-and implemented in kernel/locking/mutex.c. These locks use a three
-state atomic counter (->count) to represent the different possible
-transitions that can occur during the lifetime of a lock:
-
-          1: unlocked
-          0: locked, no waiters
-   negative: locked, with potential waiters
-
-In its most basic form it also includes a wait-queue and a spinlock
-that serializes access to it. CONFIG_SMP systems can also include
-a pointer to the lock task owner (->owner) as well as a spinner MCS
-lock (->osq), both described below in (ii).
+and implemented in kernel/locking/mutex.c. These locks use an atomic variable
+(->owner) to keep track of the lock state during its lifetime.  Field owner
+actually contains 'struct task_struct *' to the current lock owner and it is
+therefore NULL if not currently owned. Since task_struct pointers are aligned
+at at least L1_CACHE_BYTES, low bits (3) are used to store extra state (e.g.,
+if waiter list is non-empty).  In its most basic form it also includes a
+wait-queue and a spinlock that serializes access to it. Furthermore,
+CONFIG_MUTEX_SPIN_ON_OWNER=y systems use a spinner MCS lock (->osq), described
+below in (ii).
 
 When acquiring a mutex, there are three possible paths that can be
 taken, depending on the state of the lock:
 
-(i) fastpath: tries to atomically acquire the lock by decrementing the
-    counter. If it was already taken by another task it goes to the next
-    possible path. This logic is architecture specific. On x86-64, the
-    locking fastpath is 2 instructions:
-
-    0000000000000e10 <mutex_lock>:
-    e21:   f0 ff 0b                lock decl (%rbx)
-    e24:   79 08                   jns    e2e <mutex_lock+0x1e>
-
-   the unlocking fastpath is equally tight:
-
-    0000000000000bc0 <mutex_unlock>:
-    bc8:   f0 ff 07                lock incl (%rdi)
-    bcb:   7f 0a                   jg     bd7 <mutex_unlock+0x17>
-
+(i) fastpath: tries to atomically acquire the lock by cmpxchg()ing the owner with
+    the current task. This only works in the uncontended case (cmpxchg() checks
+    against 0UL, so all 3 state bits above have to be 0). If the lock is
+    contended it goes to the next possible path.
 
 (ii) midpath: aka optimistic spinning, tries to spin for acquisition
      while the lock owner is running and there are no other tasks ready
@@ -143,11 +129,10 @@ Test if the mutex is taken:
 Disadvantages
 -------------
 
-Unlike its original design and purpose, 'struct mutex' is larger than
-most locks in the kernel. E.g: on x86-64 it is 40 bytes, almost twice
-as large as 'struct semaphore' (24 bytes) and tied, along with rwsems,
-for the largest lock in the kernel. Larger structure sizes mean more
-CPU cache and memory footprint.
+Unlike its original design and purpose, 'struct mutex' is among the largest
+locks in the kernel. E.g: on x86-64 it is 32 bytes, where 'struct semaphore'
+is 24 bytes and rw_semaphore is 40 bytes. Larger structure sizes mean more CPU
+cache and memory footprint.
 
 When to use mutexes
 -------------------
diff --git a/Documentation/networking/segmentation-offloads.txt b/Documentation/networking/segmentation-offloads.txt
index 2f09455a993a..d47480b61ac6 100644
--- a/Documentation/networking/segmentation-offloads.txt
+++ b/Documentation/networking/segmentation-offloads.txt
@@ -13,6 +13,7 @@ The following technologies are described:
  * Generic Segmentation Offload - GSO
  * Generic Receive Offload - GRO
  * Partial Generic Segmentation Offload - GSO_PARTIAL
+ * SCTP accelleration with GSO - GSO_BY_FRAGS
 
 TCP Segmentation Offload
 ========================
@@ -49,6 +50,10 @@ datagram into multiple IPv4 fragments.  Many of the requirements for UDP
 fragmentation offload are the same as TSO.  However the IPv4 ID for
 fragments should not increment as a single IPv4 datagram is fragmented.
 
+UFO is deprecated: modern kernels will no longer generate UFO skbs, but can
+still receive them from tuntap and similar devices. Offload of UDP-based
+tunnel protocols is still supported.
+
 IPIP, SIT, GRE, UDP Tunnel, and Remote Checksum Offloads
 ========================================================
 
@@ -83,10 +88,10 @@ SKB_GSO_UDP_TUNNEL_CSUM.  These two additional tunnel types reflect the
 fact that the outer header also requests to have a non-zero checksum
 included in the outer header.
 
-Finally there is SKB_GSO_REMCSUM which indicates that a given tunnel header
-has requested a remote checksum offload.  In this case the inner headers
-will be left with a partial checksum and only the outer header checksum
-will be computed.
+Finally there is SKB_GSO_TUNNEL_REMCSUM which indicates that a given tunnel
+header has requested a remote checksum offload.  In this case the inner
+headers will be left with a partial checksum and only the outer header
+checksum will be computed.
 
 Generic Segmentation Offload
 ============================
@@ -128,3 +133,28 @@ values for if the header was simply duplicated.  The one exception to this
 is the outer IPv4 ID field.  It is up to the device drivers to guarantee
 that the IPv4 ID field is incremented in the case that a given header does
 not have the DF bit set.
+
+SCTP accelleration with GSO
+===========================
+
+SCTP - despite the lack of hardware support - can still take advantage of
+GSO to pass one large packet through the network stack, rather than
+multiple small packets.
+
+This requires a different approach to other offloads, as SCTP packets
+cannot be just segmented to (P)MTU. Rather, the chunks must be contained in
+IP segments, padding respected. So unlike regular GSO, SCTP can't just
+generate a big skb, set gso_size to the fragmentation point and deliver it
+to IP layer.
+
+Instead, the SCTP protocol layer builds an skb with the segments correctly
+padded and stored as chained skbs, and skb_segment() splits based on those.
+To signal this, gso_size is set to the special value GSO_BY_FRAGS.
+
+Therefore, any code in the core networking stack must be aware of the
+possibility that gso_size will be GSO_BY_FRAGS and handle that case
+appropriately. (For size checks, the skb_gso_validate_*_len family of
+helpers do this automatically.)
+
+This also affects drivers with the NETIF_F_FRAGLIST & NETIF_F_GSO_SCTP bits
+set. Note also that NETIF_F_GSO_SCTP is included in NETIF_F_GSO_SOFTWARE.
diff --git a/Documentation/x86/topology.txt b/Documentation/x86/topology.txt
index f3e9d7e9ed6c..2953e3ec9a02 100644
--- a/Documentation/x86/topology.txt
+++ b/Documentation/x86/topology.txt
@@ -108,7 +108,7 @@ The topology of a system is described in the units of:
 
     The number of online threads is also printed in /proc/cpuinfo "siblings."
 
-  - topology_sibling_mask():
+  - topology_sibling_cpumask():
 
     The cpumask contains all online threads in the core to which a thread
     belongs.
diff --git a/MAINTAINERS b/MAINTAINERS
index 885d20072d97..c3c2b7595cba 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -7909,7 +7909,6 @@ S:	Maintained
 F:      scripts/leaking_addresses.pl
 
 LED SUBSYSTEM
-M:      Richard Purdie <rpurdie@rpsys.net>
 M:      Jacek Anaszewski <jacek.anaszewski@gmail.com>
 M:      Pavel Machek <pavel@ucw.cz>
 L:      linux-leds@vger.kernel.org
@@ -9213,6 +9212,7 @@ MIPS GENERIC PLATFORM
 M:      Paul Burton <paul.burton@mips.com>
 L:      linux-mips@linux-mips.org
 S:      Supported
+F:      Documentation/devicetree/bindings/power/mti,mips-cpc.txt
 F:      arch/mips/generic/
 F:      arch/mips/tools/generic-board-config.sh
 
@@ -9952,6 +9952,7 @@ F:	drivers/nfc/nxp-nci
 
 OBJTOOL
 M:      Josh Poimboeuf <jpoimboe@redhat.com>
+M:      Peter Zijlstra <peterz@infradead.org>
 S:      Supported
 F:      tools/objtool/
 
diff --git a/Makefile b/Makefile
index 79ad2bfa24b6..659a7780aeb3 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 16
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc3
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/cmpxchg.h b/arch/alpha/include/asm/cmpxchg.h
index 46ebf14aed4e..8a2b331e43fe 100644
--- a/arch/alpha/include/asm/cmpxchg.h
+++ b/arch/alpha/include/asm/cmpxchg.h
@@ -6,7 +6,6 @@
  * Atomic exchange routines.
  */
 
-#define __ASM__MB
 #define ____xchg(type, args...)         __xchg ## type ## _local(args)
 #define ____cmpxchg(type, args...)      __cmpxchg ## type ## _local(args)
 #include <asm/xchg.h>
@@ -33,10 +32,6 @@
         cmpxchg_local((ptr), (o), (n));                                 \
 })
 
-#ifdef CONFIG_SMP
-#undef __ASM__MB
-#define __ASM__MB       "\tmb\n"
-#endif
 #undef ____xchg
 #undef ____cmpxchg
 #define ____xchg(type, args...)         __xchg ##type(args)
@@ -64,7 +59,6 @@
         cmpxchg((ptr), (o), (n));                                       \
 })
 
-#undef __ASM__MB
 #undef ____cmpxchg
 
 #endif /* _ALPHA_CMPXCHG_H */
diff --git a/arch/alpha/include/asm/xchg.h b/arch/alpha/include/asm/xchg.h
index 68dfb3cb7145..e2b59fac5257 100644
--- a/arch/alpha/include/asm/xchg.h
+++ b/arch/alpha/include/asm/xchg.h
@@ -12,6 +12,10 @@
  * Atomic exchange.
  * Since it can be used to implement critical sections
  * it must clobber "memory" (also for interrupts in UP).
+ *
+ * The leading and the trailing memory barriers guarantee that these
+ * operations are fully ordered.
+ *
  */
 
 static inline unsigned long
@@ -19,6 +23,7 @@ ____xchg(_u8, volatile char *m, unsigned long val)
 {
         unsigned long ret, tmp, addr64;
 
+        smp_mb();
         __asm__ __volatile__(
         "       andnot  %4,7,%3\n"
         "       insbl   %1,%4,%1\n"
@@ -28,12 +33,12 @@ ____xchg(_u8, volatile char *m, unsigned long val)
         "       or      %1,%2,%2\n"
         "       stq_c   %2,0(%3)\n"
         "       beq     %2,2f\n"
-                __ASM__MB
         ".subsection 2\n"
         "2:     br      1b\n"
         ".previous"
         : "=&r" (ret), "=&r" (val), "=&r" (tmp), "=&r" (addr64)
         : "r" ((long)m), "1" (val) : "memory");
+        smp_mb();
 
         return ret;
 }
@@ -43,6 +48,7 @@ ____xchg(_u16, volatile short *m, unsigned long val)
 {
         unsigned long ret, tmp, addr64;
 
+        smp_mb();
         __asm__ __volatile__(
         "       andnot  %4,7,%3\n"
         "       inswl   %1,%4,%1\n"
@@ -52,12 +58,12 @@ ____xchg(_u16, volatile short *m, unsigned long val)
         "       or      %1,%2,%2\n"
         "       stq_c   %2,0(%3)\n"
         "       beq     %2,2f\n"
-                __ASM__MB
         ".subsection 2\n"
         "2:     br      1b\n"
         ".previous"
         : "=&r" (ret), "=&r" (val), "=&r" (tmp), "=&r" (addr64)
         : "r" ((long)m), "1" (val) : "memory");
+        smp_mb();
 
         return ret;
 }
@@ -67,17 +73,18 @@ ____xchg(_u32, volatile int *m, unsigned long val)
 {
         unsigned long dummy;
 
+        smp_mb();
         __asm__ __volatile__(
         "1:     ldl_l %0,%4\n"
         "       bis $31,%3,%1\n"
         "       stl_c %1,%2\n"
         "       beq %1,2f\n"
-                __ASM__MB
         ".subsection 2\n"
         "2:     br 1b\n"
         ".previous"
         : "=&r" (val), "=&r" (dummy), "=m" (*m)
         : "rI" (val), "m" (*m) : "memory");
+        smp_mb();
 
         return val;
 }
@@ -87,17 +94,18 @@ ____xchg(_u64, volatile long *m, unsigned long val)
 {
         unsigned long dummy;
 
+        smp_mb();
         __asm__ __volatile__(
         "1:     ldq_l %0,%4\n"
         "       bis $31,%3,%1\n"
         "       stq_c %1,%2\n"
         "       beq %1,2f\n"
-                __ASM__MB
         ".subsection 2\n"
         "2:     br 1b\n"
         ".previous"
         : "=&r" (val), "=&r" (dummy), "=m" (*m)
         : "rI" (val), "m" (*m) : "memory");
+        smp_mb();
 
         return val;
 }
@@ -128,10 +136,12 @@ ____xchg(, volatile void *ptr, unsigned long x, int size)
  * store NEW in MEM.  Return the initial value in MEM.  Success is
  * indicated by comparing RETURN with OLD.
  *
- * The memory barrier should be placed in SMP only when we actually
- * make the change. If we don't change anything (so if the returned
- * prev is equal to old) then we aren't acquiring anything new and
- * we don't need any memory barrier as far I can tell.
+ * The leading and the trailing memory barriers guarantee that these
+ * operations are fully ordered.
+ *
+ * The trailing memory barrier is placed in SMP unconditionally, in
+ * order to guarantee that dependency ordering is preserved when a
+ * dependency is headed by an unsuccessful operation.
  */
 
 static inline unsigned long
@@ -139,6 +149,7 @@ ____cmpxchg(_u8, volatile char *m, unsigned char old, unsigned char new)
 {
         unsigned long prev, tmp, cmp, addr64;
 
+        smp_mb();
         __asm__ __volatile__(
         "       andnot  %5,7,%4\n"
         "       insbl   %1,%5,%1\n"
@@ -150,13 +161,13 @@ ____cmpxchg(_u8, volatile char *m, unsigned char old, unsigned char new)
         "       or      %1,%2,%2\n"
         "       stq_c   %2,0(%4)\n"
         "       beq     %2,3f\n"
-                __ASM__MB
         "2:\n"
         ".subsection 2\n"
         "3:     br      1b\n"
         ".previous"
         : "=&r" (prev), "=&r" (new), "=&r" (tmp), "=&r" (cmp), "=&r" (addr64)
         : "r" ((long)m), "Ir" (old), "1" (new) : "memory");
+        smp_mb();
 
         return prev;
 }
@@ -166,6 +177,7 @@ ____cmpxchg(_u16, volatile short *m, unsigned short old, unsigned short new)
 {
         unsigned long prev, tmp, cmp, addr64;
 
+        smp_mb();
         __asm__ __volatile__(
         "       andnot  %5,7,%4\n"
         "       inswl   %1,%5,%1\n"
@@ -177,13 +189,13 @@ ____cmpxchg(_u16, volatile short *m, unsigned short old, unsigned short new)
         "       or      %1,%2,%2\n"
         "       stq_c   %2,0(%4)\n"
         "       beq     %2,3f\n"
-                __ASM__MB
         "2:\n"
         ".subsection 2\n"
         "3:     br      1b\n"
         ".previous"
         : "=&r" (prev), "=&r" (new), "=&r" (tmp), "=&r" (cmp), "=&r" (addr64)
         : "r" ((long)m), "Ir" (old), "1" (new) : "memory");
+        smp_mb();
 
         return prev;
 }
@@ -193,6 +205,7 @@ ____cmpxchg(_u32, volatile int *m, int old, int new)
 {
         unsigned long prev, cmp;
 
+        smp_mb();
         __asm__ __volatile__(
         "1:     ldl_l %0,%5\n"
         "       cmpeq %0,%3,%1\n"
@@ -200,13 +213,13 @@ ____cmpxchg(_u32, volatile int *m, int old, int new)
         "       mov %4,%1\n"
         "       stl_c %1,%2\n"
         "       beq %1,3f\n"
-                __ASM__MB
         "2:\n"
         ".subsection 2\n"
         "3:     br 1b\n"
         ".previous"
         : "=&r"(prev), "=&r"(cmp), "=m"(*m)
         : "r"((long) old), "r"(new), "m"(*m) : "memory");
+        smp_mb();
 
         return prev;
 }
@@ -216,6 +229,7 @@ ____cmpxchg(_u64, volatile long *m, unsigned long old, unsigned long new)
 {
         unsigned long prev, cmp;
 
+        smp_mb();
         __asm__ __volatile__(
         "1:     ldq_l %0,%5\n"
         "       cmpeq %0,%3,%1\n"
@@ -223,13 +237,13 @@ ____cmpxchg(_u64, volatile long *m, unsigned long old, unsigned long new)
         "       mov %4,%1\n"
         "       stq_c %1,%2\n"
         "       beq %1,3f\n"
-                __ASM__MB
         "2:\n"
         ".subsection 2\n"
         "3:     br 1b\n"
         ".previous"
         : "=&r"(prev), "=&r"(cmp), "=m"(*m)
         : "r"((long) old), "r"(new), "m"(*m) : "memory");
+        smp_mb();
 
         return prev;
 }
diff --git a/arch/arc/include/asm/bug.h b/arch/arc/include/asm/bug.h
index ea022d47896c..21ec82466d62 100644
--- a/arch/arc/include/asm/bug.h
+++ b/arch/arc/include/asm/bug.h
@@ -23,7 +23,8 @@ void die(const char *str, struct pt_regs *regs, unsigned long address);
 
 #define BUG()   do {                                                            \
         pr_warn("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \
-        dump_stack();                                                           \
+        barrier_before_unreachable();                                           \
+        __builtin_trap();                                                       \
 } while (0)
 
 #define HAVE_ARCH_BUG
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 9d27331fe69a..ec12fe1c2f07 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -373,7 +373,7 @@ static void arc_chk_core_config(void)
 {
         struct cpuinfo_arc *cpu = &cpuinfo_arc700[smp_processor_id()];
         int saved = 0, present = 0;
-        char *opt_nm = NULL;;
+        char *opt_nm = NULL;
 
         if (!cpu->extn.timer0)
                 panic("Timer0 is not present!\n");
diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
index 333daab7def0..183391d4d33a 100644
--- a/arch/arc/kernel/unwind.c
+++ b/arch/arc/kernel/unwind.c
@@ -366,7 +366,7 @@ static void init_unwind_hdr(struct unwind_table *table,
         return;
 
 ret_err:
-        panic("Attention !!! Dwarf FDE parsing errors\n");;
+        panic("Attention !!! Dwarf FDE parsing errors\n");
 }
 
 #ifdef CONFIG_MODULES
diff --git a/arch/arm/kernel/time.c b/arch/arm/kernel/time.c
index 629f8e9981f1..cf2701cb0de8 100644
--- a/arch/arm/kernel/time.c
+++ b/arch/arm/kernel/time.c
@@ -83,7 +83,7 @@ static void dummy_clock_access(struct timespec64 *ts)
 }
 
 static clock_access_fn __read_persistent_clock = dummy_clock_access;
-static clock_access_fn __read_boot_clock = dummy_clock_access;;
+static clock_access_fn __read_boot_clock = dummy_clock_access;
 
 void read_persistent_clock64(struct timespec64 *ts)
 {
diff --git a/arch/arm/mach-ux500/cpu-db8500.c b/arch/arm/mach-ux500/cpu-db8500.c
index 57058ac46f49..7e5d7a083707 100644
--- a/arch/arm/mach-ux500/cpu-db8500.c
+++ b/arch/arm/mach-ux500/cpu-db8500.c
@@ -23,7 +23,6 @@
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/of_platform.h>
-#include <linux/perf/arm_pmu.h>
 #include <linux/regulator/machine.h>
 
 #include <asm/outercache.h>
@@ -112,37 +111,6 @@ static void ux500_restart(enum reboot_mode mode, const char *cmd)
         prcmu_system_reset(0);
 }
 
-/*
- * The PMU IRQ lines of two cores are wired together into a single interrupt.
- * Bounce the interrupt to the other core if it's not ours.
- */
-static irqreturn_t db8500_pmu_handler(int irq, void *dev, irq_handler_t handler)
-{
-        irqreturn_t ret = handler(irq, dev);
-        int other = !smp_processor_id();
-
-        if (ret == IRQ_NONE && cpu_online(other))
-                irq_set_affinity(irq, cpumask_of(other));
-
-        /*
-         * We should be able to get away with the amount of IRQ_NONEs we give,
-         * while still having the spurious IRQ detection code kick in if the
-         * interrupt really starts hitting spuriously.
-         */
-        return ret;
-}
-
-static struct arm_pmu_platdata db8500_pmu_platdata = {
-        .handle_irq             = db8500_pmu_handler,
-        .irq_flags              = IRQF_NOBALANCING | IRQF_NO_THREAD,
-};
-
-static struct of_dev_auxdata u8500_auxdata_lookup[] __initdata = {
-        /* Requires call-back bindings. */
-        OF_DEV_AUXDATA("arm,cortex-a9-pmu", 0, "arm-pmu", &db8500_pmu_platdata),
-        {},
-};
-
 static struct of_dev_auxdata u8540_auxdata_lookup[] __initdata = {
         OF_DEV_AUXDATA("stericsson,db8500-prcmu", 0x80157000, "db8500-prcmu", NULL),
         {},
@@ -165,9 +133,6 @@ static void __init u8500_init_machine(void)
         if (of_machine_is_compatible("st-ericsson,u8540"))
                 of_platform_populate(NULL, u8500_local_bus_nodes,
                                      u8540_auxdata_lookup, NULL);
-        else
-                of_platform_populate(NULL, u8500_local_bus_nodes,
-                                     u8500_auxdata_lookup, NULL);
 }
 
 static const char * stericsson_dt_platform_compat[] = {
diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
index be7bd19c87ec..350c76a1d15b 100644
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@@ -20,7 +20,7 @@
 
 #define MPIDR_UP_BITMASK        (0x1 << 30)
 #define MPIDR_MT_BITMASK        (0x1 << 24)
-#define MPIDR_HWID_BITMASK      0xff00ffffff
+#define MPIDR_HWID_BITMASK      UL(0xff00ffffff)
 
 #define MPIDR_LEVEL_BITS_SHIFT  3
 #define MPIDR_LEVEL_BITS        (1 << MPIDR_LEVEL_BITS_SHIFT)
diff --git a/arch/arm64/include/asm/hugetlb.h b/arch/arm64/include/asm/hugetlb.h
index 1dca41bea16a..e73f68569624 100644
--- a/arch/arm64/include/asm/hugetlb.h
+++ b/arch/arm64/include/asm/hugetlb.h
@@ -22,7 +22,7 @@
 
 static inline pte_t huge_ptep_get(pte_t *ptep)
 {
-        return *ptep;
+        return READ_ONCE(*ptep);
 }
 
 
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index 9679067a1574..7faed6e48b46 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -185,42 +185,42 @@ static inline pmd_t kvm_s2pmd_mkexec(pmd_t pmd)
         return pmd;
 }
 
-static inline void kvm_set_s2pte_readonly(pte_t *pte)
+static inline void kvm_set_s2pte_readonly(pte_t *ptep)
 {
         pteval_t old_pteval, pteval;
 
-        pteval = READ_ONCE(pte_val(*pte));
+        pteval = READ_ONCE(pte_val(*ptep));
         do {
                 old_pteval = pteval;
                 pteval &= ~PTE_S2_RDWR;
                 pteval |= PTE_S2_RDONLY;
-                pteval = cmpxchg_relaxed(&pte_val(*pte), old_pteval, pteval);
+                pteval = cmpxchg_relaxed(&pte_val(*ptep), old_pteval, pteval);
         } while (pteval != old_pteval);
 }
 
-static inline bool kvm_s2pte_readonly(pte_t *pte)
+static inline bool kvm_s2pte_readonly(pte_t *ptep)
 {
-        return (pte_val(*pte) & PTE_S2_RDWR) == PTE_S2_RDONLY;
+        return (READ_ONCE(pte_val(*ptep)) & PTE_S2_RDWR) == PTE_S2_RDONLY;
 }
 
-static inline bool kvm_s2pte_exec(pte_t *pte)
+static inline bool kvm_s2pte_exec(pte_t *ptep)
 {
-        return !(pte_val(*pte) & PTE_S2_XN);
+        return !(READ_ONCE(pte_val(*ptep)) & PTE_S2_XN);
 }
 
-static inline void kvm_set_s2pmd_readonly(pmd_t *pmd)
+static inline void kvm_set_s2pmd_readonly(pmd_t *pmdp)
 {
-        kvm_set_s2pte_readonly((pte_t *)pmd);
+        kvm_set_s2pte_readonly((pte_t *)pmdp);
 }
 
-static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
+static inline bool kvm_s2pmd_readonly(pmd_t *pmdp)
 {
-        return kvm_s2pte_readonly((pte_t *)pmd);
+        return kvm_s2pte_readonly((pte_t *)pmdp);
 }
 
-static inline bool kvm_s2pmd_exec(pmd_t *pmd)
+static inline bool kvm_s2pmd_exec(pmd_t *pmdp)
 {
-        return !(pmd_val(*pmd) & PMD_S2_XN);
+        return !(READ_ONCE(pmd_val(*pmdp)) & PMD_S2_XN);
 }
 
 static inline bool kvm_page_empty(void *ptr)
diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
index 8d3331985d2e..39ec0b8a689e 100644
--- a/arch/arm64/include/asm/mmu_context.h
+++ b/arch/arm64/include/asm/mmu_context.h
@@ -141,13 +141,13 @@ static inline void cpu_install_idmap(void)
  * Atomically replaces the active TTBR1_EL1 PGD with a new VA-compatible PGD,
  * avoiding the possibility of conflicting TLB entries being allocated.
  */
-static inline void cpu_replace_ttbr1(pgd_t *pgd)
+static inline void cpu_replace_ttbr1(pgd_t *pgdp)
 {
         typedef void (ttbr_replace_func)(phys_addr_t);
         extern ttbr_replace_func idmap_cpu_replace_ttbr1;
         ttbr_replace_func *replace_phys;
 
-        phys_addr_t pgd_phys = virt_to_phys(pgd);
+        phys_addr_t pgd_phys = virt_to_phys(pgdp);
 
         replace_phys = (void *)__pa_symbol(idmap_cpu_replace_ttbr1);
 
diff --git a/arch/arm64/include/asm/pgalloc.h b/arch/arm64/include/asm/pgalloc.h
index e9d9f1b006ef..2e05bcd944c8 100644
--- a/arch/arm64/include/asm/pgalloc.h
+++ b/arch/arm64/include/asm/pgalloc.h
@@ -36,23 +36,23 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
         return (pmd_t *)__get_free_page(PGALLOC_GFP);
 }
 
-static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+static inline void pmd_free(struct mm_struct *mm, pmd_t *pmdp)
 {
-        BUG_ON((unsigned long)pmd & (PAGE_SIZE-1));
-        free_page((unsigned long)pmd);
+        BUG_ON((unsigned long)pmdp & (PAGE_SIZE-1));
+        free_page((unsigned long)pmdp);
 }
 
-static inline void __pud_populate(pud_t *pud, phys_addr_t pmd, pudval_t prot)
+static inline void __pud_populate(pud_t *pudp, phys_addr_t pmdp, pudval_t prot)
 {
-        set_pud(pud, __pud(__phys_to_pud_val(pmd) | prot));
+        set_pud(pudp, __pud(__phys_to_pud_val(pmdp) | prot));
 }
 
-static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
+static inline void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmdp)
 {
-        __pud_populate(pud, __pa(pmd), PMD_TYPE_TABLE);
+        __pud_populate(pudp, __pa(pmdp), PMD_TYPE_TABLE);
 }
 #else
-static inline void __pud_populate(pud_t *pud, phys_addr_t pmd, pudval_t prot)
+static inline void __pud_populate(pud_t *pudp, phys_addr_t pmdp, pudval_t prot)
 {
         BUILD_BUG();
 }
@@ -65,30 +65,30 @@ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
         return (pud_t *)__get_free_page(PGALLOC_GFP);
 }
 
-static inline void pud_free(struct mm_struct *mm, pud_t *pud)
+static inline void pud_free(struct mm_struct *mm, pud_t *pudp)
 {
-        BUG_ON((unsigned long)pud & (PAGE_SIZE-1));
-        free_page((unsigned long)pud);
+        BUG_ON((unsigned long)pudp & (PAGE_SIZE-1));
+        free_page((unsigned long)pudp);
 }
 
-static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pud, pgdval_t prot)
+static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pudp, pgdval_t prot)
 {
-        set_pgd(pgdp, __pgd(__phys_to_pgd_val(pud) | prot));
+        set_pgd(pgdp, __pgd(__phys_to_pgd_val(pudp) | prot));
 }
 
-static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
+static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgdp, pud_t *pudp)
 {
-        __pgd_populate(pgd, __pa(pud), PUD_TYPE_TABLE);
+        __pgd_populate(pgdp, __pa(pudp), PUD_TYPE_TABLE);
 }
 #else
-static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pud, pgdval_t prot)
+static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pudp, pgdval_t prot)
 {
         BUILD_BUG();
 }
 #endif  /* CONFIG_PGTABLE_LEVELS > 3 */
 
 extern pgd_t *pgd_alloc(struct mm_struct *mm);
-extern void pgd_free(struct mm_struct *mm, pgd_t *pgd);
+extern void pgd_free(struct mm_struct *mm, pgd_t *pgdp);
 
 static inline pte_t *
 pte_alloc_one_kernel(struct mm_struct *mm, unsigned long addr)
@@ -114,10 +114,10 @@ pte_alloc_one(struct mm_struct *mm, unsigned long addr)
 /*
  * Free a PTE table.
  */
-static inline void pte_free_kernel(struct mm_struct *mm, pte_t *pte)
+static inline void pte_free_kernel(struct mm_struct *mm, pte_t *ptep)
 {
-        if (pte)
-                free_page((unsigned long)pte);
+        if (ptep)
+                free_page((unsigned long)ptep);
 }
 
 static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
@@ -126,10 +126,10 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         __free_page(pte);
 }
 
-static inline void __pmd_populate(pmd_t *pmdp, phys_addr_t pte,
+static inline void __pmd_populate(pmd_t *pmdp, phys_addr_t ptep,
                                   pmdval_t prot)
 {
-        set_pmd(pmdp, __pmd(__phys_to_pmd_val(pte) | prot));
+        set_pmd(pmdp, __pmd(__phys_to_pmd_val(ptep) | prot));
 }
 
 /*
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 094374c82db0..7e2c27e63cd8 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -218,7 +218,7 @@ static inline pmd_t pmd_mkcont(pmd_t pmd)
 
 static inline void set_pte(pte_t *ptep, pte_t pte)
 {
-        *ptep = pte;
+        WRITE_ONCE(*ptep, pte);
 
         /*
          * Only if the new pte is valid and kernel, otherwise TLB maintenance
@@ -250,6 +250,8 @@ extern void __sync_icache_dcache(pte_t pteval, unsigned long addr);
 static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
                               pte_t *ptep, pte_t pte)
 {
+        pte_t old_pte;
+
         if (pte_present(pte) && pte_user_exec(pte) && !pte_special(pte))
                 __sync_icache_dcache(pte, addr);
 
@@ -258,14 +260,15 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
          * hardware updates of the pte (ptep_set_access_flags safely changes
          * valid ptes without going through an invalid entry).
          */
-        if (IS_ENABLED(CONFIG_DEBUG_VM) && pte_valid(*ptep) && pte_valid(pte) &&
+        old_pte = READ_ONCE(*ptep);
+        if (IS_ENABLED(CONFIG_DEBUG_VM) && pte_valid(old_pte) && pte_valid(pte) &&
            (mm == current->active_mm || atomic_read(&mm->mm_users) > 1)) {
                 VM_WARN_ONCE(!pte_young(pte),
                              "%s: racy access flag clearing: 0x%016llx -> 0x%016llx",
-                             __func__, pte_val(*ptep), pte_val(pte));
-                VM_WARN_ONCE(pte_write(*ptep) && !pte_dirty(pte),
+                             __func__, pte_val(old_pte), pte_val(pte));
+                VM_WARN_ONCE(pte_write(old_pte) && !pte_dirty(pte),
                              "%s: racy dirty state clearing: 0x%016llx -> 0x%016llx",
-                             __func__, pte_val(*ptep), pte_val(pte));
+                             __func__, pte_val(old_pte), pte_val(pte));
         }
 
         set_pte(ptep, pte);
@@ -431,7 +434,7 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
 
 static inline void set_pmd(pmd_t *pmdp, pmd_t pmd)
 {
-        *pmdp = pmd;
+        WRITE_ONCE(*pmdp, pmd);
         dsb(ishst);
         isb();
 }
@@ -482,7 +485,7 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd)
 
 static inline void set_pud(pud_t *pudp, pud_t pud)
 {
-        *pudp = pud;
+        WRITE_ONCE(*pudp, pud);
         dsb(ishst);
         isb();
 }
@@ -500,7 +503,7 @@ static inline phys_addr_t pud_page_paddr(pud_t pud)
 /* Find an entry in the second-level page table. */
 #define pmd_index(addr)         (((addr) >> PMD_SHIFT) & (PTRS_PER_PMD - 1))
 
-#define pmd_offset_phys(dir, addr)      (pud_page_paddr(*(dir)) + pmd_index(addr) * sizeof(pmd_t))
+#define pmd_offset_phys(dir, addr)      (pud_page_paddr(READ_ONCE(*(dir))) + pmd_index(addr) * sizeof(pmd_t))
 #define pmd_offset(dir, addr)           ((pmd_t *)__va(pmd_offset_phys((dir), (addr))))
 
 #define pmd_set_fixmap(addr)            ((pmd_t *)set_fixmap_offset(FIX_PMD, addr))
@@ -535,7 +538,7 @@ static inline phys_addr_t pud_page_paddr(pud_t pud)
 
 static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
 {
-        *pgdp = pgd;
+        WRITE_ONCE(*pgdp, pgd);
         dsb(ishst);
 }
 
@@ -552,7 +555,7 @@ static inline phys_addr_t pgd_page_paddr(pgd_t pgd)
 /* Find an entry in the frst-level page table. */
 #define pud_index(addr)         (((addr) >> PUD_SHIFT) & (PTRS_PER_PUD - 1))
 
-#define pud_offset_phys(dir, addr)      (pgd_page_paddr(*(dir)) + pud_index(addr) * sizeof(pud_t))
+#define pud_offset_phys(dir, addr)      (pgd_page_paddr(READ_ONCE(*(dir))) + pud_index(addr) * sizeof(pud_t))
 #define pud_offset(dir, addr)           ((pud_t *)__va(pud_offset_phys((dir), (addr))))
 
 #define pud_set_fixmap(addr)            ((pud_t *)set_fixmap_offset(FIX_PUD, addr))
diff --git a/arch/arm64/include/asm/stacktrace.h b/arch/arm64/include/asm/stacktrace.h
index 472ef944e932..902f9edacbea 100644
--- a/arch/arm64/include/asm/stacktrace.h
+++ b/arch/arm64/include/asm/stacktrace.h
@@ -28,7 +28,7 @@ struct stackframe {
         unsigned long fp;
         unsigned long pc;
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-        unsigned int graph;
+        int graph;
 #endif
 };
 
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index 543e11f0f657..e66b0fca99c2 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -72,15 +72,15 @@ static inline void set_fs(mm_segment_t fs)
  * This is equivalent to the following test:
  * (u65)addr + (u65)size <= (u65)current->addr_limit + 1
  */
-static inline unsigned long __range_ok(unsigned long addr, unsigned long size)
+static inline unsigned long __range_ok(const void __user *addr, unsigned long size)
 {
-        unsigned long limit = current_thread_info()->addr_limit;
+        unsigned long ret, limit = current_thread_info()->addr_limit;
 
         __chk_user_ptr(addr);
         asm volatile(
         // A + B <= C + 1 for all A,B,C, in four easy steps:
         // 1: X = A + B; X' = X % 2^64
-        "       adds    %0, %0, %2\n"
+        "       adds    %0, %3, %2\n"
         // 2: Set C = 0 if X > 2^64, to guarantee X' > C in step 4
         "       csel    %1, xzr, %1, hi\n"
         // 3: Set X' = ~0 if X >= 2^64. For X == 2^64, this decrements X'
@@ -92,9 +92,9 @@ static inline unsigned long __range_ok(unsigned long addr, unsigned long size)
         //    testing X' - C == 0, subject to the previous adjustments.
         "       sbcs    xzr, %0, %1\n"
         "       cset    %0, ls\n"
-        : "+r" (addr), "+r" (limit) : "Ir" (size) : "cc");
+        : "=&r" (ret), "+r" (limit) : "Ir" (size), "0" (addr) : "cc");
 
-        return addr;
+        return ret;
 }
 
 /*
@@ -104,7 +104,7 @@ static inline unsigned long __range_ok(unsigned long addr, unsigned long size)
  */
 #define untagged_addr(addr)             sign_extend64(addr, 55)
 
-#define access_ok(type, addr, size)     __range_ok((unsigned long)(addr), size)
+#define access_ok(type, addr, size)     __range_ok(addr, size)
 #define user_addr_max                   get_fs
 
 #define _ASM_EXTABLE(from, to)                                          \
diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index c33b5e4010ab..68450e954d47 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -370,6 +370,7 @@ static unsigned int __kprobes aarch32_check_condition(u32 opcode, u32 psr)
 static int swp_handler(struct pt_regs *regs, u32 instr)
 {
         u32 destreg, data, type, address = 0;
+        const void __user *user_ptr;
         int rn, rt2, res = 0;
 
         perf_sw_event(PERF_COUNT_SW_EMULATION_FAULTS, 1, regs, regs->pc);
@@ -401,7 +402,8 @@ static int swp_handler(struct pt_regs *regs, u32 instr)
                 aarch32_insn_extract_reg_num(instr, A32_RT2_OFFSET), data);
 
         /* Check access in reasonable access range for both SWP and SWPB */
-        if (!access_ok(VERIFY_WRITE, (address & ~3), 4)) {
+        user_ptr = (const void __user *)(unsigned long)(address & ~3);
+        if (!access_ok(VERIFY_WRITE, user_ptr, 4)) {
                 pr_debug("SWP{B} emulation: access to 0x%08x not allowed!\n",
                         address);
                 goto fault;
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 07823595b7f0..52f15cd896e1 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -408,6 +408,15 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
         },
         {
                 .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
+                MIDR_ALL_VERSIONS(MIDR_QCOM_FALKOR),
+                .enable = qcom_enable_link_stack_sanitization,
+        },
+        {
+                .capability = ARM64_HARDEN_BP_POST_GUEST_EXIT,
+                MIDR_ALL_VERSIONS(MIDR_QCOM_FALKOR),
+        },
+        {
+                .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
                 MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
                 .enable = enable_smccc_arch_workaround_1,
         },
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 29b1f873e337..2985a067fc13 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -199,9 +199,11 @@ static const struct arm64_ftr_bits ftr_id_aa64mmfr2[] = {
 };
 
 static const struct arm64_ftr_bits ftr_ctr[] = {
-        ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_EXACT, 31, 1, 1),   /* RAO */
+        ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_EXACT, 31, 1, 1),           /* RES1 */
+        ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, 29, 1, 1),      /* DIC */
+        ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, 28, 1, 1),      /* IDC */
         ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_SAFE, 24, 4, 0),     /* CWG */
-        ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, 20, 4, 0),      /* ERG */
+        ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_SAFE, 20, 4, 0),     /* ERG */
         ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, 16, 4, 1),      /* DminLine */
         /*
          * Linux can handle differing I-cache policies. Userspace JITs will
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index f85ac58d08a3..a8bf1c892b90 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -90,7 +90,7 @@ static int __init set_permissions(pte_t *ptep, pgtable_t token,
                                   unsigned long addr, void *data)
 {
         efi_memory_desc_t *md = data;
-        pte_t pte = *ptep;
+        pte_t pte = READ_ONCE(*ptep);
 
         if (md->attribute & EFI_MEMORY_RO)
                 pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index f20cf7e99249..1ec5f28c39fc 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -202,10 +202,10 @@ static int create_safe_exec_page(void *src_start, size_t length,
                                  gfp_t mask)
 {
         int rc = 0;
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
+        pgd_t *pgdp;
+        pud_t *pudp;
+        pmd_t *pmdp;
+        pte_t *ptep;
         unsigned long dst = (unsigned long)allocator(mask);
 
         if (!dst) {
@@ -216,38 +216,38 @@ static int create_safe_exec_page(void *src_start, size_t length,
         memcpy((void *)dst, src_start, length);
         flush_icache_range(dst, dst + length);
 
-        pgd = pgd_offset_raw(allocator(mask), dst_addr);
-        if (pgd_none(*pgd)) {
-                pud = allocator(mask);
-                if (!pud) {
+        pgdp = pgd_offset_raw(allocator(mask), dst_addr);
+        if (pgd_none(READ_ONCE(*pgdp))) {
+                pudp = allocator(mask);
+                if (!pudp) {
                         rc = -ENOMEM;
                         goto out;
                 }
-                pgd_populate(&init_mm, pgd, pud);
+                pgd_populate(&init_mm, pgdp, pudp);
         }
 
-        pud = pud_offset(pgd, dst_addr);
-        if (pud_none(*pud)) {
-                pmd = allocator(mask);
-                if (!pmd) {
+        pudp = pud_offset(pgdp, dst_addr);
+        if (pud_none(READ_ONCE(*pudp))) {
+                pmdp = allocator(mask);
+                if (!pmdp) {
                         rc = -ENOMEM;
                         goto out;
                 }
-                pud_populate(&init_mm, pud, pmd);
+                pud_populate(&init_mm, pudp, pmdp);
         }
 
-        pmd = pmd_offset(pud, dst_addr);
-        if (pmd_none(*pmd)) {
-                pte = allocator(mask);
-                if (!pte) {
+        pmdp = pmd_offset(pudp, dst_addr);
+        if (pmd_none(READ_ONCE(*pmdp))) {
+                ptep = allocator(mask);
+                if (!ptep) {
                         rc = -ENOMEM;
                         goto out;
                 }
-                pmd_populate_kernel(&init_mm, pmd, pte);
+                pmd_populate_kernel(&init_mm, pmdp, ptep);
         }
 
-        pte = pte_offset_kernel(pmd, dst_addr);
-        set_pte(pte, pfn_pte(virt_to_pfn(dst), PAGE_KERNEL_EXEC));
+        ptep = pte_offset_kernel(pmdp, dst_addr);
+        set_pte(ptep, pfn_pte(virt_to_pfn(dst), PAGE_KERNEL_EXEC));
 
         /*
          * Load our new page tables. A strict BBM approach requires that we
@@ -263,7 +263,7 @@ static int create_safe_exec_page(void *src_start, size_t length,
          */
         cpu_set_reserved_ttbr0();
         local_flush_tlb_all();
-        write_sysreg(phys_to_ttbr(virt_to_phys(pgd)), ttbr0_el1);
+        write_sysreg(phys_to_ttbr(virt_to_phys(pgdp)), ttbr0_el1);
         isb();
 
         *phys_dst_addr = virt_to_phys((void *)dst);
@@ -320,9 +320,9 @@ int swsusp_arch_suspend(void)
         return ret;
 }
 
-static void _copy_pte(pte_t *dst_pte, pte_t *src_pte, unsigned long addr)
+static void _copy_pte(pte_t *dst_ptep, pte_t *src_ptep, unsigned long addr)
 {
-        pte_t pte = *src_pte;
+        pte_t pte = READ_ONCE(*src_ptep);
 
         if (pte_valid(pte)) {
                 /*
@@ -330,7 +330,7 @@ static void _copy_pte(pte_t *dst_pte, pte_t *src_pte, unsigned long addr)
                  * read only (code, rodata). Clear the RDONLY bit from
                  * the temporary mappings we use during restore.
                  */
-                set_pte(dst_pte, pte_mkwrite(pte));
+                set_pte(dst_ptep, pte_mkwrite(pte));
         } else if (debug_pagealloc_enabled() && !pte_none(pte)) {
                 /*
                  * debug_pagealloc will removed the PTE_VALID bit if
@@ -343,112 +343,116 @@ static void _copy_pte(pte_t *dst_pte, pte_t *src_pte, unsigned long addr)
                  */
                 BUG_ON(!pfn_valid(pte_pfn(pte)));
 
-                set_pte(dst_pte, pte_mkpresent(pte_mkwrite(pte)));
+                set_pte(dst_ptep, pte_mkpresent(pte_mkwrite(pte)));
         }
 }
 
-static int copy_pte(pmd_t *dst_pmd, pmd_t *src_pmd, unsigned long start,
+static int copy_pte(pmd_t *dst_pmdp, pmd_t *src_pmdp, unsigned long start,
                     unsigned long end)
 {
-        pte_t *src_pte;
-        pte_t *dst_pte;
+        pte_t *src_ptep;
+        pte_t *dst_ptep;
         unsigned long addr = start;
 
-        dst_pte = (pte_t *)get_safe_page(GFP_ATOMIC);
-        if (!dst_pte)
+        dst_ptep = (pte_t *)get_safe_page(GFP_ATOMIC);
+        if (!dst_ptep)
                 return -ENOMEM;
-        pmd_populate_kernel(&init_mm, dst_pmd, dst_pte);
-        dst_pte = pte_offset_kernel(dst_pmd, start);
+        pmd_populate_kernel(&init_mm, dst_pmdp, dst_ptep);
+        dst_ptep = pte_offset_kernel(dst_pmdp, start);
 
-        src_pte = pte_offset_kernel(src_pmd, start);
+        src_ptep = pte_offset_kernel(src_pmdp, start);
         do {
-                _copy_pte(dst_pte, src_pte, addr);
-        } while (dst_pte++, src_pte++, addr += PAGE_SIZE, addr != end);
+                _copy_pte(dst_ptep, src_ptep, addr);
+        } while (dst_ptep++, src_ptep++, addr += PAGE_SIZE, addr != end);
 
         return 0;
 }
 
-static int copy_pmd(pud_t *dst_pud, pud_t *src_pud, unsigned long start,
+static int copy_pmd(pud_t *dst_pudp, pud_t *src_pudp, unsigned long start,
                     unsigned long end)
 {
-        pmd_t *src_pmd;
-        pmd_t *dst_pmd;
+        pmd_t *src_pmdp;
+        pmd_t *dst_pmdp;
         unsigned long next;
         unsigned long addr = start;
 
-        if (pud_none(*dst_pud)) {
-                dst_pmd = (pmd_t *)get_safe_page(GFP_ATOMIC);
-                if (!dst_pmd)
+        if (pud_none(READ_ONCE(*dst_pudp))) {
+                dst_pmdp = (pmd_t *)get_safe_page(GFP_ATOMIC);
+                if (!dst_pmdp)
                         return -ENOMEM;
-                pud_populate(&init_mm, dst_pud, dst_pmd);
+                pud_populate(&init_mm, dst_pudp, dst_pmdp);
         }
-        dst_pmd = pmd_offset(dst_pud, start);
+        dst_pmdp = pmd_offset(dst_pudp, start);
 
-        src_pmd = pmd_offset(src_pud, start);
+        src_pmdp = pmd_offset(src_pudp, start);
         do {
+                pmd_t pmd = READ_ONCE(*src_pmdp);
+
                 next = pmd_addr_end(addr, end);
-                if (pmd_none(*src_pmd))
+                if (pmd_none(pmd))
                         continue;
-                if (pmd_table(*src_pmd)) {
-                        if (copy_pte(dst_pmd, src_pmd, addr, next))
+                if (pmd_table(pmd)) {
+                        if (copy_pte(dst_pmdp, src_pmdp, addr, next))
                                 return -ENOMEM;
                 } else {
-                        set_pmd(dst_pmd,
-                                __pmd(pmd_val(*src_pmd) & ~PMD_SECT_RDONLY));
+                        set_pmd(dst_pmdp,
+                                __pmd(pmd_val(pmd) & ~PMD_SECT_RDONLY));
                 }
-        } while (dst_pmd++, src_pmd++, addr = next, addr != end);
+        } while (dst_pmdp++, src_pmdp++, addr = next, addr != end);
 
         return 0;
 }
 
-static int copy_pud(pgd_t *dst_pgd, pgd_t *src_pgd, unsigned long start,
+static int copy_pud(pgd_t *dst_pgdp, pgd_t *src_pgdp, unsigned long start,
                     unsigned long end)
 {
-        pud_t *dst_pud;
-        pud_t *src_pud;
+        pud_t *dst_pudp;
+        pud_t *src_pudp;
         unsigned long next;
         unsigned long addr = start;
 
-        if (pgd_none(*dst_pgd)) {
-                dst_pud = (pud_t *)get_safe_page(GFP_ATOMIC);
-                if (!dst_pud)
+        if (pgd_none(READ_ONCE(*dst_pgdp))) {
+                dst_pudp = (pud_t *)get_safe_page(GFP_ATOMIC);
+                if (!dst_pudp)
                         return -ENOMEM;
-                pgd_populate(&init_mm, dst_pgd, dst_pud);
+                pgd_populate(&init_mm, dst_pgdp, dst_pudp);
         }
-        dst_pud = pud_offset(dst_pgd, start);
+        dst_pudp = pud_offset(dst_pgdp, start);
 
-        src_pud = pud_offset(src_pgd, start);
+        src_pudp = pud_offset(src_pgdp, start);
         do {
+                pud_t pud = READ_ONCE(*src_pudp);
+
                 next = pud_addr_end(addr, end);
-                if (pud_none(*src_pud))
+                if (pud_none(pud))
                         continue;
-                if (pud_table(*(src_pud))) {
-                        if (copy_pmd(dst_pud, src_pud, addr, next))
+                if (pud_table(pud)) {
+                        if (copy_pmd(dst_pudp, src_pudp, addr, next))
                                 return -ENOMEM;
                 } else {
-                        set_pud(dst_pud,
-                                __pud(pud_val(*src_pud) & ~PMD_SECT_RDONLY));
+                        set_pud(dst_pudp,
+                                __pud(pud_val(pud) & ~PMD_SECT_RDONLY));
                 }
-        } while (dst_pud++, src_pud++, addr = next, addr != end);
+        } while (dst_pudp++, src_pudp++, addr = next, addr != end);
 
         return 0;
 }
 
-static int copy_page_tables(pgd_t *dst_pgd, unsigned long start,
+static int copy_page_tables(pgd_t *dst_pgdp, unsigned long start,
                             unsigned long end)
 {
         unsigned long next;
         unsigned long addr = start;
-        pgd_t *src_pgd = pgd_offset_k(start);
+        pgd_t *src_pgdp = pgd_offset_k(start);
 
-        dst_pgd = pgd_offset_raw(dst_pgd, start);
+        dst_pgdp = pgd_offset_raw(dst_pgdp, start);
         do {
                 next = pgd_addr_end(addr, end);
-                if (pgd_none(*src_pgd))
+                if (pgd_none(READ_ONCE(*src_pgdp)))
                         continue;
-                if (copy_pud(dst_pgd, src_pgd, addr, next))
+                if (copy_pud(dst_pgdp, src_pgdp, addr, next))
                         return -ENOMEM;
-        } while (dst_pgd++, src_pgd++, addr = next, addr != end);
+        } while (dst_pgdp++, src_pgdp++, addr = next, addr != end);
 
         return 0;
 }
diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
index 75b220ba73a3..85a251b6dfa8 100644
--- a/arch/arm64/kernel/perf_event.c
+++ b/arch/arm64/kernel/perf_event.c
@@ -908,9 +908,9 @@ static void __armv8pmu_probe_pmu(void *info)
         int pmuver;
 
         dfr0 = read_sysreg(id_aa64dfr0_el1);
-        pmuver = cpuid_feature_extract_signed_field(dfr0,
+        pmuver = cpuid_feature_extract_unsigned_field(dfr0,
                         ID_AA64DFR0_PMUVER_SHIFT);
-        if (pmuver < 1)
+        if (pmuver == 0xf || pmuver == 0)
                 return;
 
         probe->present = true;
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index ad8aeb098b31..c0da6efe5465 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -220,8 +220,15 @@ void __show_regs(struct pt_regs *regs)
 
         show_regs_print_info(KERN_DEFAULT);
         print_pstate(regs);
-        printk("pc : %pS\n", (void *)regs->pc);
-        printk("lr : %pS\n", (void *)lr);
+
+        if (!user_mode(regs)) {
+                printk("pc : %pS\n", (void *)regs->pc);
+                printk("lr : %pS\n", (void *)lr);
+        } else {
+                printk("pc : %016llx\n", regs->pc);
+                printk("lr : %016llx\n", lr);
+        }
+
         printk("sp : %016llx\n", sp);
 
         i = top_reg;
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 6618036ae6d4..9ae31f7e2243 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -1419,7 +1419,7 @@ static int compat_ptrace_hbp_get(unsigned int note_type,
         u64 addr = 0;
         u32 ctrl = 0;
 
-        int err, idx = compat_ptrace_hbp_num_to_idx(num);;
+        int err, idx = compat_ptrace_hbp_num_to_idx(num);
 
         if (num & 1) {
                 err = ptrace_hbp_get_addr(note_type, tsk, idx, &addr);
diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
index 76809ccd309c..d5718a060672 100644
--- a/arch/arm64/kernel/stacktrace.c
+++ b/arch/arm64/kernel/stacktrace.c
@@ -59,6 +59,11 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
         if (tsk->ret_stack &&
                         (frame->pc == (unsigned long)return_to_handler)) {
+                if (WARN_ON_ONCE(frame->graph == -1))
+                        return -EINVAL;
+                if (frame->graph < -1)
+                        frame->graph += FTRACE_NOTRACE_DEPTH;
+
                 /*
                  * This is a case where function graph tracer has
                  * modified a return address (LR) in a stack frame
diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c
index 8b8bbd3eaa52..a382b2a1b84e 100644
--- a/arch/arm64/kernel/sys_compat.c
+++ b/arch/arm64/kernel/sys_compat.c
@@ -57,7 +57,7 @@ do_compat_cache_op(unsigned long start, unsigned long end, int flags)
         if (end < start || flags)
                 return -EINVAL;
 
-        if (!access_ok(VERIFY_READ, start, end - start))
+        if (!access_ok(VERIFY_READ, (const void __user *)start, end - start))
                 return -EFAULT;
 
         return __do_compat_cache_op(start, end);
diff --git a/arch/arm64/kernel/time.c b/arch/arm64/kernel/time.c
index a4391280fba9..f258636273c9 100644
--- a/arch/arm64/kernel/time.c
+++ b/arch/arm64/kernel/time.c
@@ -52,7 +52,7 @@ unsigned long profile_pc(struct pt_regs *regs)
         frame.fp = regs->regs[29];
         frame.pc = regs->pc;
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-        frame.graph = -1; /* no task info */
+        frame.graph = current->curr_ret_stack;
 #endif
         do {
                 int ret = unwind_frame(NULL, &frame);
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index bbb0fde2780e..eb2d15147e8d 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -57,7 +57,7 @@ static const char *handler[]= {
         "Error"
 };
 
-int show_unhandled_signals = 1;
+int show_unhandled_signals = 0;
 
 static void dump_backtrace_entry(unsigned long where)
 {
@@ -526,14 +526,6 @@ asmlinkage long do_ni_syscall(struct pt_regs *regs)
         }
 #endif
 
-        if (show_unhandled_signals_ratelimited()) {
-                pr_info("%s[%d]: syscall %d\n", current->comm,
-                        task_pid_nr(current), regs->syscallno);
-                dump_instr("", regs);
-                if (user_mode(regs))
-                        __show_regs(regs);
-        }
-
         return sys_ni_syscall();
 }
 
diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index 116252a8d3a5..870f4b1587f9 100644
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -407,8 +407,10 @@ again:
                 u32 midr = read_cpuid_id();
 
                 /* Apply BTAC predictors mitigation to all Falkor chips */
-                if ((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR_V1)
+                if (((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR) ||
+                    ((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR_V1)) {
                         __qcom_hyp_sanitize_btac_predictors();
+                }
         }
 
         fp_enabled = __fpsimd_enabled();
diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
index 7b60d62ac593..65dfc8571bf8 100644
--- a/arch/arm64/mm/dump.c
+++ b/arch/arm64/mm/dump.c
@@ -286,48 +286,52 @@ static void note_page(struct pg_state *st, unsigned long addr, unsigned level,
 
 }
 
-static void walk_pte(struct pg_state *st, pmd_t *pmd, unsigned long start)
+static void walk_pte(struct pg_state *st, pmd_t *pmdp, unsigned long start)
 {
-        pte_t *pte = pte_offset_kernel(pmd, 0UL);
+        pte_t *ptep = pte_offset_kernel(pmdp, 0UL);
         unsigned long addr;
         unsigned i;
 
-        for (i = 0; i < PTRS_PER_PTE; i++, pte++) {
+        for (i = 0; i < PTRS_PER_PTE; i++, ptep++) {
                 addr = start + i * PAGE_SIZE;
-                note_page(st, addr, 4, pte_val(*pte));
+                note_page(st, addr, 4, READ_ONCE(pte_val(*ptep)));
         }
 }
 
-static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
+static void walk_pmd(struct pg_state *st, pud_t *pudp, unsigned long start)
 {
-        pmd_t *pmd = pmd_offset(pud, 0UL);
+        pmd_t *pmdp = pmd_offset(pudp, 0UL);
         unsigned long addr;
         unsigned i;
 
-        for (i = 0; i < PTRS_PER_PMD; i++, pmd++) {
+        for (i = 0; i < PTRS_PER_PMD; i++, pmdp++) {
+                pmd_t pmd = READ_ONCE(*pmdp);
+
                 addr = start + i * PMD_SIZE;
-                if (pmd_none(*pmd) || pmd_sect(*pmd)) {
-                        note_page(st, addr, 3, pmd_val(*pmd));
+                if (pmd_none(pmd) || pmd_sect(pmd)) {
+                        note_page(st, addr, 3, pmd_val(pmd));
                 } else {
-                        BUG_ON(pmd_bad(*pmd));
-                        walk_pte(st, pmd, addr);
+                        BUG_ON(pmd_bad(pmd));
+                        walk_pte(st, pmdp, addr);
                 }
         }
 }
 
-static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
+static void walk_pud(struct pg_state *st, pgd_t *pgdp, unsigned long start)
 {
-        pud_t *pud = pud_offset(pgd, 0UL);
+        pud_t *pudp = pud_offset(pgdp, 0UL);
         unsigned long addr;
         unsigned i;
 
-        for (i = 0; i < PTRS_PER_PUD; i++, pud++) {
+        for (i = 0; i < PTRS_PER_PUD; i++, pudp++) {
+                pud_t pud = READ_ONCE(*pudp);
+
                 addr = start + i * PUD_SIZE;
-                if (pud_none(*pud) || pud_sect(*pud)) {
-                        note_page(st, addr, 2, pud_val(*pud));
+                if (pud_none(pud) || pud_sect(pud)) {
+                        note_page(st, addr, 2, pud_val(pud));
                 } else {
-                        BUG_ON(pud_bad(*pud));
-                        walk_pmd(st, pud, addr);
+                        BUG_ON(pud_bad(pud));
+                        walk_pmd(st, pudp, addr);
                 }
         }
 }
@@ -335,17 +339,19 @@ static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
 static void walk_pgd(struct pg_state *st, struct mm_struct *mm,
                      unsigned long start)
 {
-        pgd_t *pgd = pgd_offset(mm, 0UL);
+        pgd_t *pgdp = pgd_offset(mm, 0UL);
         unsigned i;
         unsigned long addr;
 
-        for (i = 0; i < PTRS_PER_PGD; i++, pgd++) {
+        for (i = 0; i < PTRS_PER_PGD; i++, pgdp++) {
+                pgd_t pgd = READ_ONCE(*pgdp);
+
                 addr = start + i * PGDIR_SIZE;
-                if (pgd_none(*pgd)) {
-                        note_page(st, addr, 1, pgd_val(*pgd));
+                if (pgd_none(pgd)) {
+                        note_page(st, addr, 1, pgd_val(pgd));
                 } else {
-                        BUG_ON(pgd_bad(*pgd));
-                        walk_pud(st, pgd, addr);
+                        BUG_ON(pgd_bad(pgd));
+                        walk_pud(st, pgdp, addr);
                 }
         }
 }
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index f76bb2c3c943..bff11553eb05 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -130,7 +130,8 @@ static void mem_abort_decode(unsigned int esr)
 void show_pte(unsigned long addr)
 {
         struct mm_struct *mm;
-        pgd_t *pgd;
+        pgd_t *pgdp;
+        pgd_t pgd;
 
         if (addr < TASK_SIZE) {
                 /* TTBR0 */
@@ -149,33 +150,37 @@ void show_pte(unsigned long addr)
                 return;
         }
 
-        pr_alert("%s pgtable: %luk pages, %u-bit VAs, pgd = %p\n",
+        pr_alert("%s pgtable: %luk pages, %u-bit VAs, pgdp = %p\n",
                  mm == &init_mm ? "swapper" : "user", PAGE_SIZE / SZ_1K,
                  VA_BITS, mm->pgd);
-        pgd = pgd_offset(mm, addr);
-        pr_alert("[%016lx] *pgd=%016llx", addr, pgd_val(*pgd));
+        pgdp = pgd_offset(mm, addr);
+        pgd = READ_ONCE(*pgdp);
+        pr_alert("[%016lx] pgd=%016llx", addr, pgd_val(pgd));
 
         do {
-                pud_t *pud;
-                pmd_t *pmd;
-                pte_t *pte;
+                pud_t *pudp, pud;
+                pmd_t *pmdp, pmd;
+                pte_t *ptep, pte;
 
-                if (pgd_none(*pgd) || pgd_bad(*pgd))
+                if (pgd_none(pgd) || pgd_bad(pgd))
                         break;
 
-                pud = pud_offset(pgd, addr);
-                pr_cont(", *pud=%016llx", pud_val(*pud));
-                if (pud_none(*pud) || pud_bad(*pud))
+                pudp = pud_offset(pgdp, addr);
+                pud = READ_ONCE(*pudp);
+                pr_cont(", pud=%016llx", pud_val(pud));
+                if (pud_none(pud) || pud_bad(pud))
                         break;
 
-                pmd = pmd_offset(pud, addr);
-                pr_cont(", *pmd=%016llx", pmd_val(*pmd));
-                if (pmd_none(*pmd) || pmd_bad(*pmd))
+                pmdp = pmd_offset(pudp, addr);
+                pmd = READ_ONCE(*pmdp);
+                pr_cont(", pmd=%016llx", pmd_val(pmd));
+                if (pmd_none(pmd) || pmd_bad(pmd))
                         break;
 
-                pte = pte_offset_map(pmd, addr);
-                pr_cont(", *pte=%016llx", pte_val(*pte));
-                pte_unmap(pte);
+                ptep = pte_offset_map(pmdp, addr);
+                pte = READ_ONCE(*ptep);
+                pr_cont(", pte=%016llx", pte_val(pte));
+                pte_unmap(ptep);
         } while(0);
 
         pr_cont("\n");
@@ -196,8 +201,9 @@ int ptep_set_access_flags(struct vm_area_struct *vma,
                           pte_t entry, int dirty)
 {
         pteval_t old_pteval, pteval;
+        pte_t pte = READ_ONCE(*ptep);
 
-        if (pte_same(*ptep, entry))
+        if (pte_same(pte, entry))
                 return 0;
 
         /* only preserve the access flags and write permission */
@@ -210,7 +216,7 @@ int ptep_set_access_flags(struct vm_area_struct *vma,
          * (calculated as: a & b == ~(~a | ~b)).
          */
         pte_val(entry) ^= PTE_RDONLY;
-        pteval = READ_ONCE(pte_val(*ptep));
+        pteval = pte_val(pte);
         do {
                 old_pteval = pteval;
                 pteval ^= PTE_RDONLY;
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 6cb0fa92a651..ecc6818191df 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -54,14 +54,14 @@ static inline pgprot_t pte_pgprot(pte_t pte)
 static int find_num_contig(struct mm_struct *mm, unsigned long addr,
                            pte_t *ptep, size_t *pgsize)
 {
-        pgd_t *pgd = pgd_offset(mm, addr);
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp = pgd_offset(mm, addr);
+        pud_t *pudp;
+        pmd_t *pmdp;
 
         *pgsize = PAGE_SIZE;
-        pud = pud_offset(pgd, addr);
-        pmd = pmd_offset(pud, addr);
-        if ((pte_t *)pmd == ptep) {
+        pudp = pud_offset(pgdp, addr);
+        pmdp = pmd_offset(pudp, addr);
+        if ((pte_t *)pmdp == ptep) {
                 *pgsize = PMD_SIZE;
                 return CONT_PMDS;
         }
@@ -181,11 +181,8 @@ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
 
         clear_flush(mm, addr, ptep, pgsize, ncontig);
 
-        for (i = 0; i < ncontig; i++, ptep++, addr += pgsize, pfn += dpfn) {
-                pr_debug("%s: set pte %p to 0x%llx\n", __func__, ptep,
-                         pte_val(pfn_pte(pfn, hugeprot)));
+        for (i = 0; i < ncontig; i++, ptep++, addr += pgsize, pfn += dpfn)
                 set_pte_at(mm, addr, ptep, pfn_pte(pfn, hugeprot));
-        }
 }
 
 void set_huge_swap_pte_at(struct mm_struct *mm, unsigned long addr,
@@ -203,20 +200,20 @@ void set_huge_swap_pte_at(struct mm_struct *mm, unsigned long addr,
 pte_t *huge_pte_alloc(struct mm_struct *mm,
                       unsigned long addr, unsigned long sz)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pte_t *pte = NULL;
-
-        pr_debug("%s: addr:0x%lx sz:0x%lx\n", __func__, addr, sz);
-        pgd = pgd_offset(mm, addr);
-        pud = pud_alloc(mm, pgd, addr);
-        if (!pud)
+        pgd_t *pgdp;
+        pud_t *pudp;
+        pmd_t *pmdp;
+        pte_t *ptep = NULL;
+
+        pgdp = pgd_offset(mm, addr);
+        pudp = pud_alloc(mm, pgdp, addr);
+        if (!pudp)
                 return NULL;
 
         if (sz == PUD_SIZE) {
-                pte = (pte_t *)pud;
+                ptep = (pte_t *)pudp;
         } else if (sz == (PAGE_SIZE * CONT_PTES)) {
-                pmd_t *pmd = pmd_alloc(mm, pud, addr);
+                pmdp = pmd_alloc(mm, pudp, addr);
 
                 WARN_ON(addr & (sz - 1));
                 /*
@@ -226,60 +223,55 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
                  * will be no pte_unmap() to correspond with this
                  * pte_alloc_map().
                  */
-                pte = pte_alloc_map(mm, pmd, addr);
+                ptep = pte_alloc_map(mm, pmdp, addr);
         } else if (sz == PMD_SIZE) {
                 if (IS_ENABLED(CONFIG_ARCH_WANT_HUGE_PMD_SHARE) &&
-                    pud_none(*pud))
-                        pte = huge_pmd_share(mm, addr, pud);
+                    pud_none(READ_ONCE(*pudp)))
+                        ptep = huge_pmd_share(mm, addr, pudp);
                 else
-                        pte = (pte_t *)pmd_alloc(mm, pud, addr);
+                        ptep = (pte_t *)pmd_alloc(mm, pudp, addr);
         } else if (sz == (PMD_SIZE * CONT_PMDS)) {
-                pmd_t *pmd;
-
-                pmd = pmd_alloc(mm, pud, addr);
+                pmdp = pmd_alloc(mm, pudp, addr);
                 WARN_ON(addr & (sz - 1));
-                return (pte_t *)pmd;
+                return (pte_t *)pmdp;
         }
 
-        pr_debug("%s: addr:0x%lx sz:0x%lx ret pte=%p/0x%llx\n", __func__, addr,
-               sz, pte, pte_val(*pte));
-        return pte;
+        return ptep;
 }
 
 pte_t *huge_pte_offset(struct mm_struct *mm,
                        unsigned long addr, unsigned long sz)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp;
+        pud_t *pudp, pud;
+        pmd_t *pmdp, pmd;
 
-        pgd = pgd_offset(mm, addr);
-        pr_debug("%s: addr:0x%lx pgd:%p\n", __func__, addr, pgd);
-        if (!pgd_present(*pgd))
+        pgdp = pgd_offset(mm, addr);
+        if (!pgd_present(READ_ONCE(*pgdp)))
                 return NULL;
 
-        pud = pud_offset(pgd, addr);
-        if (sz != PUD_SIZE && pud_none(*pud))
+        pudp = pud_offset(pgdp, addr);
+        pud = READ_ONCE(*pudp);
+        if (sz != PUD_SIZE && pud_none(pud))
                 return NULL;
         /* hugepage or swap? */
-        if (pud_huge(*pud) || !pud_present(*pud))
-                return (pte_t *)pud;
+        if (pud_huge(pud) || !pud_present(pud))
+                return (pte_t *)pudp;
         /* table; check the next level */
 
         if (sz == CONT_PMD_SIZE)
                 addr &= CONT_PMD_MASK;
 
-        pmd = pmd_offset(pud, addr);
+        pmdp = pmd_offset(pudp, addr);
+        pmd = READ_ONCE(*pmdp);
         if (!(sz == PMD_SIZE || sz == CONT_PMD_SIZE) &&
-            pmd_none(*pmd))
+            pmd_none(pmd))
                 return NULL;
-        if (pmd_huge(*pmd) || !pmd_present(*pmd))
-                return (pte_t *)pmd;
+        if (pmd_huge(pmd) || !pmd_present(pmd))
+                return (pte_t *)pmdp;
 
-        if (sz == CONT_PTE_SIZE) {
-                pte_t *pte = pte_offset_kernel(pmd, (addr & CONT_PTE_MASK));
-                return pte;
-        }
+        if (sz == CONT_PTE_SIZE)
+                return pte_offset_kernel(pmdp, (addr & CONT_PTE_MASK));
 
         return NULL;
 }
@@ -367,7 +359,7 @@ void huge_ptep_set_wrprotect(struct mm_struct *mm,
         size_t pgsize;
         pte_t pte;
 
-        if (!pte_cont(*ptep)) {
+        if (!pte_cont(READ_ONCE(*ptep))) {
                 ptep_set_wrprotect(mm, addr, ptep);
                 return;
         }
@@ -391,7 +383,7 @@ void huge_ptep_clear_flush(struct vm_area_struct *vma,
         size_t pgsize;
         int ncontig;
 
-        if (!pte_cont(*ptep)) {
+        if (!pte_cont(READ_ONCE(*ptep))) {
                 ptep_clear_flush(vma, addr, ptep);
                 return;
         }
diff --git a/arch/arm64/mm/kasan_init.c b/arch/arm64/mm/kasan_init.c
index 6e02e6fb4c7b..dabfc1ecda3d 100644
--- a/arch/arm64/mm/kasan_init.c
+++ b/arch/arm64/mm/kasan_init.c
@@ -44,92 +44,92 @@ static phys_addr_t __init kasan_alloc_zeroed_page(int node)
         return __pa(p);
 }
 
-static pte_t *__init kasan_pte_offset(pmd_t *pmd, unsigned long addr, int node,
+static pte_t *__init kasan_pte_offset(pmd_t *pmdp, unsigned long addr, int node,
                                       bool early)
 {
-        if (pmd_none(*pmd)) {
+        if (pmd_none(READ_ONCE(*pmdp))) {
                 phys_addr_t pte_phys = early ? __pa_symbol(kasan_zero_pte)
                                              : kasan_alloc_zeroed_page(node);
-                __pmd_populate(pmd, pte_phys, PMD_TYPE_TABLE);
+                __pmd_populate(pmdp, pte_phys, PMD_TYPE_TABLE);
         }
 
-        return early ? pte_offset_kimg(pmd, addr)
-                     : pte_offset_kernel(pmd, addr);
+        return early ? pte_offset_kimg(pmdp, addr)
+                     : pte_offset_kernel(pmdp, addr);
 }
 
-static pmd_t *__init kasan_pmd_offset(pud_t *pud, unsigned long addr, int node,
+static pmd_t *__init kasan_pmd_offset(pud_t *pudp, unsigned long addr, int node,
                                       bool early)
 {
-        if (pud_none(*pud)) {
+        if (pud_none(READ_ONCE(*pudp))) {
                 phys_addr_t pmd_phys = early ? __pa_symbol(kasan_zero_pmd)
                                              : kasan_alloc_zeroed_page(node);
-                __pud_populate(pud, pmd_phys, PMD_TYPE_TABLE);
+                __pud_populate(pudp, pmd_phys, PMD_TYPE_TABLE);
         }
 
-        return early ? pmd_offset_kimg(pud, addr) : pmd_offset(pud, addr);
+        return early ? pmd_offset_kimg(pudp, addr) : pmd_offset(pudp, addr);
 }
 
-static pud_t *__init kasan_pud_offset(pgd_t *pgd, unsigned long addr, int node,
+static pud_t *__init kasan_pud_offset(pgd_t *pgdp, unsigned long addr, int node,
                                       bool early)
 {
-        if (pgd_none(*pgd)) {
+        if (pgd_none(READ_ONCE(*pgdp))) {
                 phys_addr_t pud_phys = early ? __pa_symbol(kasan_zero_pud)
                                              : kasan_alloc_zeroed_page(node);
-                __pgd_populate(pgd, pud_phys, PMD_TYPE_TABLE);
+                __pgd_populate(pgdp, pud_phys, PMD_TYPE_TABLE);
         }
 
-        return early ? pud_offset_kimg(pgd, addr) : pud_offset(pgd, addr);
+        return early ? pud_offset_kimg(pgdp, addr) : pud_offset(pgdp, addr);
 }
 
-static void __init kasan_pte_populate(pmd_t *pmd, unsigned long addr,
+static void __init kasan_pte_populate(pmd_t *pmdp, unsigned long addr,
                                       unsigned long end, int node, bool early)
 {
         unsigned long next;
-        pte_t *pte = kasan_pte_offset(pmd, addr, node, early);
+        pte_t *ptep = kasan_pte_offset(pmdp, addr, node, early);
 
         do {
                 phys_addr_t page_phys = early ? __pa_symbol(kasan_zero_page)
                                               : kasan_alloc_zeroed_page(node);
                 next = addr + PAGE_SIZE;
-                set_pte(pte, pfn_pte(__phys_to_pfn(page_phys), PAGE_KERNEL));
-        } while (pte++, addr = next, addr != end && pte_none(*pte));
+                set_pte(ptep, pfn_pte(__phys_to_pfn(page_phys), PAGE_KERNEL));
+        } while (ptep++, addr = next, addr != end && pte_none(READ_ONCE(*ptep)));
 }
 
-static void __init kasan_pmd_populate(pud_t *pud, unsigned long addr,
+static void __init kasan_pmd_populate(pud_t *pudp, unsigned long addr,
                                       unsigned long end, int node, bool early)
 {
         unsigned long next;
-        pmd_t *pmd = kasan_pmd_offset(pud, addr, node, early);
+        pmd_t *pmdp = kasan_pmd_offset(pudp, addr, node, early);
 
         do {
                 next = pmd_addr_end(addr, end);
-                kasan_pte_populate(pmd, addr, next, node, early);
-        } while (pmd++, addr = next, addr != end && pmd_none(*pmd));
+                kasan_pte_populate(pmdp, addr, next, node, early);
+        } while (pmdp++, addr = next, addr != end && pmd_none(READ_ONCE(*pmdp)));
 }
 
-static void __init kasan_pud_populate(pgd_t *pgd, unsigned long addr,
+static void __init kasan_pud_populate(pgd_t *pgdp, unsigned long addr,
                                       unsigned long end, int node, bool early)
 {
         unsigned long next;
-        pud_t *pud = kasan_pud_offset(pgd, addr, node, early);
+        pud_t *pudp = kasan_pud_offset(pgdp, addr, node, early);
 
         do {
                 next = pud_addr_end(addr, end);
-                kasan_pmd_populate(pud, addr, next, node, early);
-        } while (pud++, addr = next, addr != end && pud_none(*pud));
+                kasan_pmd_populate(pudp, addr, next, node, early);
+        } while (pudp++, addr = next, addr != end && pud_none(READ_ONCE(*pudp)));
 }
 
 static void __init kasan_pgd_populate(unsigned long addr, unsigned long end,
                                       int node, bool early)
 {
         unsigned long next;
-        pgd_t *pgd;
+        pgd_t *pgdp;
 
-        pgd = pgd_offset_k(addr);
+        pgdp = pgd_offset_k(addr);
         do {
                 next = pgd_addr_end(addr, end);
-                kasan_pud_populate(pgd, addr, next, node, early);
-        } while (pgd++, addr = next, addr != end);
+                kasan_pud_populate(pgdp, addr, next, node, early);
+        } while (pgdp++, addr = next, addr != end);
 }
 
 /* The early shadow maps everything to a single page of zeroes */
@@ -155,14 +155,14 @@ static void __init kasan_map_populate(unsigned long start, unsigned long end,
  */
 void __init kasan_copy_shadow(pgd_t *pgdir)
 {
-        pgd_t *pgd, *pgd_new, *pgd_end;
+        pgd_t *pgdp, *pgdp_new, *pgdp_end;
 
-        pgd = pgd_offset_k(KASAN_SHADOW_START);
-        pgd_end = pgd_offset_k(KASAN_SHADOW_END);
-        pgd_new = pgd_offset_raw(pgdir, KASAN_SHADOW_START);
+        pgdp = pgd_offset_k(KASAN_SHADOW_START);
+        pgdp_end = pgd_offset_k(KASAN_SHADOW_END);
+        pgdp_new = pgd_offset_raw(pgdir, KASAN_SHADOW_START);
         do {
-                set_pgd(pgd_new, *pgd);
-        } while (pgd++, pgd_new++, pgd != pgd_end);
+                set_pgd(pgdp_new, READ_ONCE(*pgdp));
+        } while (pgdp++, pgdp_new++, pgdp != pgdp_end);
 }
 
 static void __init clear_pgds(unsigned long start,
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 4694cda823c9..84a019f55022 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -125,45 +125,48 @@ static bool pgattr_change_is_safe(u64 old, u64 new)
         return ((old ^ new) & ~mask) == 0;
 }
 
-static void init_pte(pmd_t *pmd, unsigned long addr, unsigned long end,
+static void init_pte(pmd_t *pmdp, unsigned long addr, unsigned long end,
                      phys_addr_t phys, pgprot_t prot)
 {
-        pte_t *pte;
+        pte_t *ptep;
 
-        pte = pte_set_fixmap_offset(pmd, addr);
+        ptep = pte_set_fixmap_offset(pmdp, addr);
         do {
-                pte_t old_pte = *pte;
+                pte_t old_pte = READ_ONCE(*ptep);
 
-                set_pte(pte, pfn_pte(__phys_to_pfn(phys), prot));
+                set_pte(ptep, pfn_pte(__phys_to_pfn(phys), prot));
 
                 /*
                  * After the PTE entry has been populated once, we
                  * only allow updates to the permission attributes.
                  */
-                BUG_ON(!pgattr_change_is_safe(pte_val(old_pte), pte_val(*pte)));
+                BUG_ON(!pgattr_change_is_safe(pte_val(old_pte),
+                                              READ_ONCE(pte_val(*ptep))));
 
                 phys += PAGE_SIZE;
-        } while (pte++, addr += PAGE_SIZE, addr != end);
+        } while (ptep++, addr += PAGE_SIZE, addr != end);
 
         pte_clear_fixmap();
 }
 
-static void alloc_init_cont_pte(pmd_t *pmd, unsigned long addr,
+static void alloc_init_cont_pte(pmd_t *pmdp, unsigned long addr,
                                 unsigned long end, phys_addr_t phys,
                                 pgprot_t prot,
                                 phys_addr_t (*pgtable_alloc)(void),
                                 int flags)
 {
         unsigned long next;
+        pmd_t pmd = READ_ONCE(*pmdp);
 
-        BUG_ON(pmd_sect(*pmd));
-        if (pmd_none(*pmd)) {
+        BUG_ON(pmd_sect(pmd));
+        if (pmd_none(pmd)) {
                 phys_addr_t pte_phys;
                 BUG_ON(!pgtable_alloc);
                 pte_phys = pgtable_alloc();
-                __pmd_populate(pmd, pte_phys, PMD_TYPE_TABLE);
+                __pmd_populate(pmdp, pte_phys, PMD_TYPE_TABLE);
+                pmd = READ_ONCE(*pmdp);
         }
-        BUG_ON(pmd_bad(*pmd));
+        BUG_ON(pmd_bad(pmd));
 
         do {
                 pgprot_t __prot = prot;
@@ -175,67 +178,69 @@ static void alloc_init_cont_pte(pmd_t *pmd, unsigned long addr,
                     (flags & NO_CONT_MAPPINGS) == 0)
                         __prot = __pgprot(pgprot_val(prot) | PTE_CONT);
 
-                init_pte(pmd, addr, next, phys, __prot);
+                init_pte(pmdp, addr, next, phys, __prot);
 
                 phys += next - addr;
         } while (addr = next, addr != end);
 }
 
-static void init_pmd(pud_t *pud, unsigned long addr, unsigned long end,
+static void init_pmd(pud_t *pudp, unsigned long addr, unsigned long end,
                      phys_addr_t phys, pgprot_t prot,
                      phys_addr_t (*pgtable_alloc)(void), int flags)
 {
         unsigned long next;
-        pmd_t *pmd;
+        pmd_t *pmdp;
 
-        pmd = pmd_set_fixmap_offset(pud, addr);
+        pmdp = pmd_set_fixmap_offset(pudp, addr);
         do {
-                pmd_t old_pmd = *pmd;
+                pmd_t old_pmd = READ_ONCE(*pmdp);
 
                 next = pmd_addr_end(addr, end);
 
                 /* try section mapping first */
                 if (((addr | next | phys) & ~SECTION_MASK) == 0 &&
                     (flags & NO_BLOCK_MAPPINGS) == 0) {
-                        pmd_set_huge(pmd, phys, prot);
+                        pmd_set_huge(pmdp, phys, prot);
 
                         /*
                          * After the PMD entry has been populated once, we
                          * only allow updates to the permission attributes.
                          */
                         BUG_ON(!pgattr_change_is_safe(pmd_val(old_pmd),
-                                                      pmd_val(*pmd)));
+                                                      READ_ONCE(pmd_val(*pmdp))));
                 } else {
-                        alloc_init_cont_pte(pmd, addr, next, phys, prot,
+                        alloc_init_cont_pte(pmdp, addr, next, phys, prot,
                                             pgtable_alloc, flags);
 
                         BUG_ON(pmd_val(old_pmd) != 0 &&
-                               pmd_val(old_pmd) != pmd_val(*pmd));
+                               pmd_val(old_pmd) != READ_ONCE(pmd_val(*pmdp)));
                 }
                 phys += next - addr;
-        } while (pmd++, addr = next, addr != end);
+        } while (pmdp++, addr = next, addr != end);
 
         pmd_clear_fixmap();
 }
 
-static void alloc_init_cont_pmd(pud_t *pud, unsigned long addr,
+static void alloc_init_cont_pmd(pud_t *pudp, unsigned long addr,
                                 unsigned long end, phys_addr_t phys,
                                 pgprot_t prot,
                                 phys_addr_t (*pgtable_alloc)(void), int flags)
 {
         unsigned long next;
+        pud_t pud = READ_ONCE(*pudp);
 
         /*
          * Check for initial section mappings in the pgd/pud.
          */
-        BUG_ON(pud_sect(*pud));
-        if (pud_none(*pud)) {
+        BUG_ON(pud_sect(pud));
+        if (pud_none(pud)) {
                 phys_addr_t pmd_phys;
                 BUG_ON(!pgtable_alloc);
                 pmd_phys = pgtable_alloc();
-                __pud_populate(pud, pmd_phys, PUD_TYPE_TABLE);
+                __pud_populate(pudp, pmd_phys, PUD_TYPE_TABLE);
+                pud = READ_ONCE(*pudp);
         }
-        BUG_ON(pud_bad(*pud));
+        BUG_ON(pud_bad(pud));
 
         do {
                 pgprot_t __prot = prot;
@@ -247,7 +252,7 @@ static void alloc_init_cont_pmd(pud_t *pud, unsigned long addr,
                     (flags & NO_CONT_MAPPINGS) == 0)
                         __prot = __pgprot(pgprot_val(prot) | PTE_CONT);
 
-                init_pmd(pud, addr, next, phys, __prot, pgtable_alloc, flags);
+                init_pmd(pudp, addr, next, phys, __prot, pgtable_alloc, flags);
 
                 phys += next - addr;
         } while (addr = next, addr != end);
@@ -265,25 +270,27 @@ static inline bool use_1G_block(unsigned long addr, unsigned long next,
         return true;
 }
 
-static void alloc_init_pud(pgd_t *pgd, unsigned long addr, unsigned long end,
-                                  phys_addr_t phys, pgprot_t prot,
-                                  phys_addr_t (*pgtable_alloc)(void),
-                                  int flags)
+static void alloc_init_pud(pgd_t *pgdp, unsigned long addr, unsigned long end,
+                           phys_addr_t phys, pgprot_t prot,
+                           phys_addr_t (*pgtable_alloc)(void),
+                           int flags)
 {
-        pud_t *pud;
         unsigned long next;
+        pud_t *pudp;
+        pgd_t pgd = READ_ONCE(*pgdp);
 
-        if (pgd_none(*pgd)) {
+        if (pgd_none(pgd)) {
                 phys_addr_t pud_phys;
                 BUG_ON(!pgtable_alloc);
                 pud_phys = pgtable_alloc();
-                __pgd_populate(pgd, pud_phys, PUD_TYPE_TABLE);
+                __pgd_populate(pgdp, pud_phys, PUD_TYPE_TABLE);
+                pgd = READ_ONCE(*pgdp);
         }
-        BUG_ON(pgd_bad(*pgd));
+        BUG_ON(pgd_bad(pgd));
 
-        pud = pud_set_fixmap_offset(pgd, addr);
+        pudp = pud_set_fixmap_offset(pgdp, addr);
         do {
-                pud_t old_pud = *pud;
+                pud_t old_pud = READ_ONCE(*pudp);
 
                 next = pud_addr_end(addr, end);
 
@@ -292,23 +299,23 @@ static void alloc_init_pud(pgd_t *pgd, unsigned long addr, unsigned long end,
                  */
                 if (use_1G_block(addr, next, phys) &&
                     (flags & NO_BLOCK_MAPPINGS) == 0) {
-                        pud_set_huge(pud, phys, prot);
+                        pud_set_huge(pudp, phys, prot);
 
                         /*
                          * After the PUD entry has been populated once, we
                          * only allow updates to the permission attributes.
                          */
                         BUG_ON(!pgattr_change_is_safe(pud_val(old_pud),
-                                                      pud_val(*pud)));
+                                                      READ_ONCE(pud_val(*pudp))));
                 } else {
-                        alloc_init_cont_pmd(pud, addr, next, phys, prot,
+                        alloc_init_cont_pmd(pudp, addr, next, phys, prot,
                                             pgtable_alloc, flags);
 
                         BUG_ON(pud_val(old_pud) != 0 &&
-                               pud_val(old_pud) != pud_val(*pud));
+                               pud_val(old_pud) != READ_ONCE(pud_val(*pudp)));
                 }
                 phys += next - addr;
-        } while (pud++, addr = next, addr != end);
+        } while (pudp++, addr = next, addr != end);
 
         pud_clear_fixmap();
 }
@@ -320,7 +327,7 @@ static void __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys,
                                  int flags)
 {
         unsigned long addr, length, end, next;
-        pgd_t *pgd = pgd_offset_raw(pgdir, virt);
+        pgd_t *pgdp = pgd_offset_raw(pgdir, virt);
 
         /*
          * If the virtual and physical address don't have the same offset
@@ -336,10 +343,10 @@ static void __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys,
         end = addr + length;
         do {
                 next = pgd_addr_end(addr, end);
-                alloc_init_pud(pgd, addr, next, phys, prot, pgtable_alloc,
+                alloc_init_pud(pgdp, addr, next, phys, prot, pgtable_alloc,
                                flags);
                 phys += next - addr;
-        } while (pgd++, addr = next, addr != end);
+        } while (pgdp++, addr = next, addr != end);
 }
 
 static phys_addr_t pgd_pgtable_alloc(void)
@@ -401,10 +408,10 @@ static void update_mapping_prot(phys_addr_t phys, unsigned long virt,
         flush_tlb_kernel_range(virt, virt + size);
 }
 
-static void __init __map_memblock(pgd_t *pgd, phys_addr_t start,
+static void __init __map_memblock(pgd_t *pgdp, phys_addr_t start,
                                   phys_addr_t end, pgprot_t prot, int flags)
 {
-        __create_pgd_mapping(pgd, start, __phys_to_virt(start), end - start,
+        __create_pgd_mapping(pgdp, start, __phys_to_virt(start), end - start,
                              prot, early_pgtable_alloc, flags);
 }
 
@@ -418,7 +425,7 @@ void __init mark_linear_text_alias_ro(void)
                             PAGE_KERNEL_RO);
 }
 
-static void __init map_mem(pgd_t *pgd)
+static void __init map_mem(pgd_t *pgdp)
 {
         phys_addr_t kernel_start = __pa_symbol(_text);
         phys_addr_t kernel_end = __pa_symbol(__init_begin);
@@ -451,7 +458,7 @@ static void __init map_mem(pgd_t *pgd)
                 if (memblock_is_nomap(reg))
                         continue;
 
-                __map_memblock(pgd, start, end, PAGE_KERNEL, flags);
+                __map_memblock(pgdp, start, end, PAGE_KERNEL, flags);
         }
 
         /*
@@ -464,7 +471,7 @@ static void __init map_mem(pgd_t *pgd)
          * Note that contiguous mappings cannot be remapped in this way,
          * so we should avoid them here.
          */
-        __map_memblock(pgd, kernel_start, kernel_end,
+        __map_memblock(pgdp, kernel_start, kernel_end,
                        PAGE_KERNEL, NO_CONT_MAPPINGS);
         memblock_clear_nomap(kernel_start, kernel_end - kernel_start);
 
@@ -475,7 +482,7 @@ static void __init map_mem(pgd_t *pgd)
          * through /sys/kernel/kexec_crash_size interface.
          */
         if (crashk_res.end) {
-                __map_memblock(pgd, crashk_res.start, crashk_res.end + 1,
+                __map_memblock(pgdp, crashk_res.start, crashk_res.end + 1,
                                PAGE_KERNEL,
                                NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS);
                 memblock_clear_nomap(crashk_res.start,
@@ -499,7 +506,7 @@ void mark_rodata_ro(void)
         debug_checkwx();
 }
 
-static void __init map_kernel_segment(pgd_t *pgd, void *va_start, void *va_end,
+static void __init map_kernel_segment(pgd_t *pgdp, void *va_start, void *va_end,
                                       pgprot_t prot, struct vm_struct *vma,
                                       int flags, unsigned long vm_flags)
 {
@@ -509,7 +516,7 @@ static void __init map_kernel_segment(pgd_t *pgd, void *va_start, void *va_end,
         BUG_ON(!PAGE_ALIGNED(pa_start));
         BUG_ON(!PAGE_ALIGNED(size));
 
-        __create_pgd_mapping(pgd, pa_start, (unsigned long)va_start, size, prot,
+        __create_pgd_mapping(pgdp, pa_start, (unsigned long)va_start, size, prot,
                              early_pgtable_alloc, flags);
 
         if (!(vm_flags & VM_NO_GUARD))
@@ -562,7 +569,7 @@ core_initcall(map_entry_trampoline);
 /*
  * Create fine-grained mappings for the kernel.
  */
-static void __init map_kernel(pgd_t *pgd)
+static void __init map_kernel(pgd_t *pgdp)
 {
         static struct vm_struct vmlinux_text, vmlinux_rodata, vmlinux_inittext,
                                 vmlinux_initdata, vmlinux_data;
@@ -578,24 +585,24 @@ static void __init map_kernel(pgd_t *pgd)
          * Only rodata will be remapped with different permissions later on,
          * all other segments are allowed to use contiguous mappings.
          */
-        map_kernel_segment(pgd, _text, _etext, text_prot, &vmlinux_text, 0,
+        map_kernel_segment(pgdp, _text, _etext, text_prot, &vmlinux_text, 0,
                            VM_NO_GUARD);
-        map_kernel_segment(pgd, __start_rodata, __inittext_begin, PAGE_KERNEL,
+        map_kernel_segment(pgdp, __start_rodata, __inittext_begin, PAGE_KERNEL,
                            &vmlinux_rodata, NO_CONT_MAPPINGS, VM_NO_GUARD);
-        map_kernel_segment(pgd, __inittext_begin, __inittext_end, text_prot,
+        map_kernel_segment(pgdp, __inittext_begin, __inittext_end, text_prot,
                            &vmlinux_inittext, 0, VM_NO_GUARD);
-        map_kernel_segment(pgd, __initdata_begin, __initdata_end, PAGE_KERNEL,
+        map_kernel_segment(pgdp, __initdata_begin, __initdata_end, PAGE_KERNEL,
                            &vmlinux_initdata, 0, VM_NO_GUARD);
-        map_kernel_segment(pgd, _data, _end, PAGE_KERNEL, &vmlinux_data, 0, 0);
+        map_kernel_segment(pgdp, _data, _end, PAGE_KERNEL, &vmlinux_data, 0, 0);
 
-        if (!pgd_val(*pgd_offset_raw(pgd, FIXADDR_START))) {
+        if (!READ_ONCE(pgd_val(*pgd_offset_raw(pgdp, FIXADDR_START)))) {
                 /*
                  * The fixmap falls in a separate pgd to the kernel, and doesn't
                  * live in the carveout for the swapper_pg_dir. We can simply
                  * re-use the existing dir for the fixmap.
                  */
-                set_pgd(pgd_offset_raw(pgd, FIXADDR_START),
-                        *pgd_offset_k(FIXADDR_START));
+                set_pgd(pgd_offset_raw(pgdp, FIXADDR_START),
+                        READ_ONCE(*pgd_offset_k(FIXADDR_START)));
         } else if (CONFIG_PGTABLE_LEVELS > 3) {
                 /*
                  * The fixmap shares its top level pgd entry with the kernel
@@ -604,14 +611,15 @@ static void __init map_kernel(pgd_t *pgd)
                  * entry instead.
                  */
                 BUG_ON(!IS_ENABLED(CONFIG_ARM64_16K_PAGES));
-                pud_populate(&init_mm, pud_set_fixmap_offset(pgd, FIXADDR_START),
+                pud_populate(&init_mm,
+                             pud_set_fixmap_offset(pgdp, FIXADDR_START),
                              lm_alias(bm_pmd));
                 pud_clear_fixmap();
         } else {
                 BUG();
         }
 
-        kasan_copy_shadow(pgd);
+        kasan_copy_shadow(pgdp);
 }
 
 /*
@@ -621,10 +629,10 @@ static void __init map_kernel(pgd_t *pgd)
 void __init paging_init(void)
 {
         phys_addr_t pgd_phys = early_pgtable_alloc();
-        pgd_t *pgd = pgd_set_fixmap(pgd_phys);
+        pgd_t *pgdp = pgd_set_fixmap(pgd_phys);
 
-        map_kernel(pgd);
-        map_mem(pgd);
+        map_kernel(pgdp);
+        map_mem(pgdp);
 
         /*
          * We want to reuse the original swapper_pg_dir so we don't have to
@@ -635,7 +643,7 @@ void __init paging_init(void)
          * To do this we need to go via a temporary pgd.
          */
         cpu_replace_ttbr1(__va(pgd_phys));
-        memcpy(swapper_pg_dir, pgd, PGD_SIZE);
+        memcpy(swapper_pg_dir, pgdp, PGD_SIZE);
         cpu_replace_ttbr1(lm_alias(swapper_pg_dir));
 
         pgd_clear_fixmap();
@@ -655,37 +663,40 @@ void __init paging_init(void)
  */
 int kern_addr_valid(unsigned long addr)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
+        pgd_t *pgdp;
+        pud_t *pudp, pud;
+        pmd_t *pmdp, pmd;
+        pte_t *ptep, pte;
 
         if ((((long)addr) >> VA_BITS) != -1UL)
                 return 0;
 
-        pgd = pgd_offset_k(addr);
-        if (pgd_none(*pgd))
+        pgdp = pgd_offset_k(addr);
+        if (pgd_none(READ_ONCE(*pgdp)))
                 return 0;
 
-        pud = pud_offset(pgd, addr);
-        if (pud_none(*pud))
+        pudp = pud_offset(pgdp, addr);
+        pud = READ_ONCE(*pudp);
+        if (pud_none(pud))
                 return 0;
 
-        if (pud_sect(*pud))
-                return pfn_valid(pud_pfn(*pud));
+        if (pud_sect(pud))
+                return pfn_valid(pud_pfn(pud));
 
-        pmd = pmd_offset(pud, addr);
-        if (pmd_none(*pmd))
+        pmdp = pmd_offset(pudp, addr);
+        pmd = READ_ONCE(*pmdp);
+        if (pmd_none(pmd))
                 return 0;
 
-        if (pmd_sect(*pmd))
-                return pfn_valid(pmd_pfn(*pmd));
+        if (pmd_sect(pmd))
+                return pfn_valid(pmd_pfn(pmd));
 
-        pte = pte_offset_kernel(pmd, addr);
-        if (pte_none(*pte))
+        ptep = pte_offset_kernel(pmdp, addr);
+        pte = READ_ONCE(*ptep);
+        if (pte_none(pte))
                 return 0;
 
-        return pfn_valid(pte_pfn(*pte));
+        return pfn_valid(pte_pfn(pte));
 }
 #ifdef CONFIG_SPARSEMEM_VMEMMAP
 #if !ARM64_SWAPPER_USES_SECTION_MAPS
@@ -700,32 +711,32 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,
 {
         unsigned long addr = start;
         unsigned long next;
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp;
+        pud_t *pudp;
+        pmd_t *pmdp;
 
         do {
                 next = pmd_addr_end(addr, end);
 
-                pgd = vmemmap_pgd_populate(addr, node);
-                if (!pgd)
+                pgdp = vmemmap_pgd_populate(addr, node);
+                if (!pgdp)
                         return -ENOMEM;
 
-                pud = vmemmap_pud_populate(pgd, addr, node);
-                if (!pud)
+                pudp = vmemmap_pud_populate(pgdp, addr, node);
+                if (!pudp)
                         return -ENOMEM;
 
-                pmd = pmd_offset(pud, addr);
-                if (pmd_none(*pmd)) {
+                pmdp = pmd_offset(pudp, addr);
+                if (pmd_none(READ_ONCE(*pmdp))) {
                         void *p = NULL;
 
                         p = vmemmap_alloc_block_buf(PMD_SIZE, node);
                         if (!p)
                                 return -ENOMEM;
 
-                        pmd_set_huge(pmd, __pa(p), __pgprot(PROT_SECT_NORMAL));
+                        pmd_set_huge(pmdp, __pa(p), __pgprot(PROT_SECT_NORMAL));
                 } else
-                        vmemmap_verify((pte_t *)pmd, node, addr, next);
+                        vmemmap_verify((pte_t *)pmdp, node, addr, next);
         } while (addr = next, addr != end);
 
         return 0;
@@ -739,20 +750,22 @@ void vmemmap_free(unsigned long start, unsigned long end,
 
 static inline pud_t * fixmap_pud(unsigned long addr)
 {
-        pgd_t *pgd = pgd_offset_k(addr);
+        pgd_t *pgdp = pgd_offset_k(addr);
+        pgd_t pgd = READ_ONCE(*pgdp);
 
-        BUG_ON(pgd_none(*pgd) || pgd_bad(*pgd));
+        BUG_ON(pgd_none(pgd) || pgd_bad(pgd));
 
-        return pud_offset_kimg(pgd, addr);
+        return pud_offset_kimg(pgdp, addr);
 }
 
 static inline pmd_t * fixmap_pmd(unsigned long addr)
 {
-        pud_t *pud = fixmap_pud(addr);
+        pud_t *pudp = fixmap_pud(addr);
+        pud_t pud = READ_ONCE(*pudp);
 
-        BUG_ON(pud_none(*pud) || pud_bad(*pud));
+        BUG_ON(pud_none(pud) || pud_bad(pud));
 
-        return pmd_offset_kimg(pud, addr);
+        return pmd_offset_kimg(pudp, addr);
 }
 
 static inline pte_t * fixmap_pte(unsigned long addr)
@@ -768,30 +781,31 @@ static inline pte_t * fixmap_pte(unsigned long addr)
  */
 void __init early_fixmap_init(void)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp, pgd;
+        pud_t *pudp;
+        pmd_t *pmdp;
         unsigned long addr = FIXADDR_START;
 
-        pgd = pgd_offset_k(addr);
+        pgdp = pgd_offset_k(addr);
+        pgd = READ_ONCE(*pgdp);
         if (CONFIG_PGTABLE_LEVELS > 3 &&
-            !(pgd_none(*pgd) || pgd_page_paddr(*pgd) == __pa_symbol(bm_pud))) {
+            !(pgd_none(pgd) || pgd_page_paddr(pgd) == __pa_symbol(bm_pud))) {
                 /*
                  * We only end up here if the kernel mapping and the fixmap
                  * share the top level pgd entry, which should only happen on
                  * 16k/4 levels configurations.
                  */
                 BUG_ON(!IS_ENABLED(CONFIG_ARM64_16K_PAGES));
-                pud = pud_offset_kimg(pgd, addr);
+                pudp = pud_offset_kimg(pgdp, addr);
         } else {
-                if (pgd_none(*pgd))
-                        __pgd_populate(pgd, __pa_symbol(bm_pud), PUD_TYPE_TABLE);
-                pud = fixmap_pud(addr);
+                if (pgd_none(pgd))
+                        __pgd_populate(pgdp, __pa_symbol(bm_pud), PUD_TYPE_TABLE);
+                pudp = fixmap_pud(addr);
         }
-        if (pud_none(*pud))
-                __pud_populate(pud, __pa_symbol(bm_pmd), PMD_TYPE_TABLE);
-        pmd = fixmap_pmd(addr);
-        __pmd_populate(pmd, __pa_symbol(bm_pte), PMD_TYPE_TABLE);
+        if (pud_none(READ_ONCE(*pudp)))
+                __pud_populate(pudp, __pa_symbol(bm_pmd), PMD_TYPE_TABLE);
+        pmdp = fixmap_pmd(addr);
+        __pmd_populate(pmdp, __pa_symbol(bm_pte), PMD_TYPE_TABLE);
 
         /*
          * The boot-ioremap range spans multiple pmds, for which
@@ -800,11 +814,11 @@ void __init early_fixmap_init(void)
         BUILD_BUG_ON((__fix_to_virt(FIX_BTMAP_BEGIN) >> PMD_SHIFT)
                      != (__fix_to_virt(FIX_BTMAP_END) >> PMD_SHIFT));
 
-        if ((pmd != fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)))
-             || pmd != fixmap_pmd(fix_to_virt(FIX_BTMAP_END))) {
+        if ((pmdp != fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)))
+             || pmdp != fixmap_pmd(fix_to_virt(FIX_BTMAP_END))) {
                 WARN_ON(1);
-                pr_warn("pmd %p != %p, %p\n",
-                        pmd, fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)),
+                pr_warn("pmdp %p != %p, %p\n",
+                        pmdp, fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)),
                         fixmap_pmd(fix_to_virt(FIX_BTMAP_END)));
                 pr_warn("fix_to_virt(FIX_BTMAP_BEGIN): %08lx\n",
                         fix_to_virt(FIX_BTMAP_BEGIN));
@@ -824,16 +838,16 @@ void __set_fixmap(enum fixed_addresses idx,
                                phys_addr_t phys, pgprot_t flags)
 {
         unsigned long addr = __fix_to_virt(idx);
-        pte_t *pte;
+        pte_t *ptep;
 
         BUG_ON(idx <= FIX_HOLE || idx >= __end_of_fixed_addresses);
 
-        pte = fixmap_pte(addr);
+        ptep = fixmap_pte(addr);
 
         if (pgprot_val(flags)) {
-                set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
+                set_pte(ptep, pfn_pte(phys >> PAGE_SHIFT, flags));
         } else {
-                pte_clear(&init_mm, addr, pte);
+                pte_clear(&init_mm, addr, ptep);
                 flush_tlb_kernel_range(addr, addr+PAGE_SIZE);
         }
 }
@@ -915,36 +929,46 @@ int __init arch_ioremap_pmd_supported(void)
         return 1;
 }
 
-int pud_set_huge(pud_t *pud, phys_addr_t phys, pgprot_t prot)
+int pud_set_huge(pud_t *pudp, phys_addr_t phys, pgprot_t prot)
 {
         pgprot_t sect_prot = __pgprot(PUD_TYPE_SECT |
                                         pgprot_val(mk_sect_prot(prot)));
+
+        /* ioremap_page_range doesn't honour BBM */
+        if (pud_present(READ_ONCE(*pudp)))
+                return 0;
+
         BUG_ON(phys & ~PUD_MASK);
-        set_pud(pud, pfn_pud(__phys_to_pfn(phys), sect_prot));
+        set_pud(pudp, pfn_pud(__phys_to_pfn(phys), sect_prot));
         return 1;
 }
 
-int pmd_set_huge(pmd_t *pmd, phys_addr_t phys, pgprot_t prot)
+int pmd_set_huge(pmd_t *pmdp, phys_addr_t phys, pgprot_t prot)
 {
         pgprot_t sect_prot = __pgprot(PMD_TYPE_SECT |
                                         pgprot_val(mk_sect_prot(prot)));
+
+        /* ioremap_page_range doesn't honour BBM */
+        if (pmd_present(READ_ONCE(*pmdp)))
+                return 0;
+
         BUG_ON(phys & ~PMD_MASK);
-        set_pmd(pmd, pfn_pmd(__phys_to_pfn(phys), sect_prot));
+        set_pmd(pmdp, pfn_pmd(__phys_to_pfn(phys), sect_prot));
         return 1;
 }
 
-int pud_clear_huge(pud_t *pud)
+int pud_clear_huge(pud_t *pudp)
 {
-        if (!pud_sect(*pud))
+        if (!pud_sect(READ_ONCE(*pudp)))
                 return 0;
-        pud_clear(pud);
+        pud_clear(pudp);
         return 1;
 }
 
-int pmd_clear_huge(pmd_t *pmd)
+int pmd_clear_huge(pmd_t *pmdp)
 {
-        if (!pmd_sect(*pmd))
+        if (!pmd_sect(READ_ONCE(*pmdp)))
                 return 0;
-        pmd_clear(pmd);
+        pmd_clear(pmdp);
         return 1;
 }
diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
index a682a0a2a0fa..a56359373d8b 100644
--- a/arch/arm64/mm/pageattr.c
+++ b/arch/arm64/mm/pageattr.c
@@ -29,7 +29,7 @@ static int change_page_range(pte_t *ptep, pgtable_t token, unsigned long addr,
                         void *data)
 {
         struct page_change_data *cdata = data;
-        pte_t pte = *ptep;
+        pte_t pte = READ_ONCE(*ptep);
 
         pte = clear_pte_bit(pte, cdata->clear_mask);
         pte = set_pte_bit(pte, cdata->set_mask);
@@ -156,30 +156,32 @@ void __kernel_map_pages(struct page *page, int numpages, int enable)
  */
 bool kernel_page_present(struct page *page)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
+        pgd_t *pgdp;
+        pud_t *pudp, pud;
+        pmd_t *pmdp, pmd;
+        pte_t *ptep;
         unsigned long addr = (unsigned long)page_address(page);
 
-        pgd = pgd_offset_k(addr);
-        if (pgd_none(*pgd))
+        pgdp = pgd_offset_k(addr);
+        if (pgd_none(READ_ONCE(*pgdp)))
                 return false;
 
-        pud = pud_offset(pgd, addr);
-        if (pud_none(*pud))
+        pudp = pud_offset(pgdp, addr);
+        pud = READ_ONCE(*pudp);
+        if (pud_none(pud))
                 return false;
-        if (pud_sect(*pud))
+        if (pud_sect(pud))
                 return true;
 
-        pmd = pmd_offset(pud, addr);
-        if (pmd_none(*pmd))
+        pmdp = pmd_offset(pudp, addr);
+        pmd = READ_ONCE(*pmdp);
+        if (pmd_none(pmd))
                 return false;
-        if (pmd_sect(*pmd))
+        if (pmd_sect(pmd))
                 return true;
 
-        pte = pte_offset_kernel(pmd, addr);
-        return pte_valid(*pte);
+        ptep = pte_offset_kernel(pmdp, addr);
+        return pte_valid(READ_ONCE(*ptep));
 }
 #endif /* CONFIG_HIBERNATION */
 #endif /* CONFIG_DEBUG_PAGEALLOC */
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index 71baed7e592a..c0af47617299 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -205,7 +205,8 @@ ENDPROC(idmap_cpu_replace_ttbr1)
         dc      cvac, cur_\()\type\()p          // Ensure any existing dirty
         dmb     sy                              // lines are written back before
         ldr     \type, [cur_\()\type\()p]       // loading the entry
-        tbz     \type, #0, next_\()\type        // Skip invalid entries
+        tbz     \type, #0, skip_\()\type        // Skip invalid and
+        tbnz    \type, #11, skip_\()\type       // non-global entries
         .endm
 
         .macro __idmap_kpti_put_pgtable_ent_ng, type
@@ -265,8 +266,9 @@ ENTRY(idmap_kpti_install_ng_mappings)
         add     end_pgdp, cur_pgdp, #(PTRS_PER_PGD * 8)
 do_pgd: __idmap_kpti_get_pgtable_ent    pgd
         tbnz    pgd, #1, walk_puds
-        __idmap_kpti_put_pgtable_ent_ng pgd
 next_pgd:
+        __idmap_kpti_put_pgtable_ent_ng pgd
+skip_pgd:
         add     cur_pgdp, cur_pgdp, #8
         cmp     cur_pgdp, end_pgdp
         b.ne    do_pgd
@@ -294,8 +296,9 @@ walk_puds:
         add     end_pudp, cur_pudp, #(PTRS_PER_PUD * 8)
 do_pud: __idmap_kpti_get_pgtable_ent    pud
         tbnz    pud, #1, walk_pmds
-        __idmap_kpti_put_pgtable_ent_ng pud
 next_pud:
+        __idmap_kpti_put_pgtable_ent_ng pud
+skip_pud:
         add     cur_pudp, cur_pudp, 8
         cmp     cur_pudp, end_pudp
         b.ne    do_pud
@@ -314,8 +317,9 @@ walk_pmds:
         add     end_pmdp, cur_pmdp, #(PTRS_PER_PMD * 8)
 do_pmd: __idmap_kpti_get_pgtable_ent    pmd
         tbnz    pmd, #1, walk_ptes
-        __idmap_kpti_put_pgtable_ent_ng pmd
 next_pmd:
+        __idmap_kpti_put_pgtable_ent_ng pmd
+skip_pmd:
         add     cur_pmdp, cur_pmdp, #8
         cmp     cur_pmdp, end_pmdp
         b.ne    do_pmd
@@ -333,7 +337,7 @@ walk_ptes:
         add     end_ptep, cur_ptep, #(PTRS_PER_PTE * 8)
 do_pte: __idmap_kpti_get_pgtable_ent    pte
         __idmap_kpti_put_pgtable_ent_ng pte
-next_pte:
+skip_pte:
         add     cur_ptep, cur_ptep, #8
         cmp     cur_ptep, end_ptep
         b.ne    do_pte
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 1d4f1da7c58f..a93350451e8e 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -250,8 +250,9 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx)
         off = offsetof(struct bpf_array, map.max_entries);
         emit_a64_mov_i64(tmp, off, ctx);
         emit(A64_LDR32(tmp, r2, tmp), ctx);
+        emit(A64_MOV(0, r3, r3), ctx);
         emit(A64_CMP(0, r3, tmp), ctx);
-        emit(A64_B_(A64_COND_GE, jmp_offset), ctx);
+        emit(A64_B_(A64_COND_CS, jmp_offset), ctx);
 
         /* if (tail_call_cnt > MAX_TAIL_CALL_CNT)
          *     goto out;
@@ -259,7 +260,7 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx)
          */
         emit_a64_mov_i64(tmp, MAX_TAIL_CALL_CNT, ctx);
         emit(A64_CMP(1, tcc, tmp), ctx);
-        emit(A64_B_(A64_COND_GT, jmp_offset), ctx);
+        emit(A64_B_(A64_COND_HI, jmp_offset), ctx);
         emit(A64_ADD_I(1, tcc, tcc, 1), ctx);
 
         /* prog = array->ptrs[index];
diff --git a/arch/cris/include/arch-v10/arch/bug.h b/arch/cris/include/arch-v10/arch/bug.h
index 905afeacfedf..06da9d49152a 100644
--- a/arch/cris/include/arch-v10/arch/bug.h
+++ b/arch/cris/include/arch-v10/arch/bug.h
@@ -44,18 +44,25 @@ struct bug_frame {
  * not be used like this with newer versions of gcc.
  */
 #define BUG()                                                           \
+do {                                                                    \
         __asm__ __volatile__ ("clear.d [" __stringify(BUG_MAGIC) "]\n\t"\
                               "movu.w " __stringify(__LINE__) ",$r0\n\t"\
                               "jump 0f\n\t"                             \
                               ".section .rodata\n"                      \
                               "0:\t.string \"" __FILE__ "\"\n\t"        \
-                              ".previous")
+                              ".previous");                             \
+        unreachable();                                                  \
+} while (0)
 #endif
 
 #else
 
 /* This just causes an oops. */
-#define BUG() (*(int *)0 = 0)
+#define BUG()                                                           \
+do {                                                                    \
+        barrier_before_unreachable();                                   \
+        __builtin_trap();                                               \
+} while (0)
 
 #endif
 
diff --git a/arch/ia64/include/asm/bug.h b/arch/ia64/include/asm/bug.h
index bd3eeb8d1cfa..66b37a532765 100644
--- a/arch/ia64/include/asm/bug.h
+++ b/arch/ia64/include/asm/bug.h
@@ -4,7 +4,11 @@
 
 #ifdef CONFIG_BUG
 #define ia64_abort()    __builtin_trap()
-#define BUG() do { printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); ia64_abort(); } while (0)
+#define BUG() do {                                              \
+        printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__);   \
+        barrier_before_unreachable();                           \
+        ia64_abort();                                           \
+} while (0)
 
 /* should this BUG be made generic? */
 #define HAVE_ARCH_BUG
diff --git a/arch/ia64/kernel/Makefile b/arch/ia64/kernel/Makefile
index 0b4c65a1af25..498f3da3f225 100644
--- a/arch/ia64/kernel/Makefile
+++ b/arch/ia64/kernel/Makefile
@@ -41,7 +41,6 @@ ifneq ($(CONFIG_IA64_ESI),)
 obj-y                           += esi_stub.o   # must be in kernel proper
 endif
 obj-$(CONFIG_INTEL_IOMMU)       += pci-dma.o
-obj-$(CONFIG_SWIOTLB)           += pci-swiotlb.o
 
 obj-$(CONFIG_BINFMT_ELF)        += elfcore.o
 
diff --git a/arch/m68k/include/asm/bug.h b/arch/m68k/include/asm/bug.h
index b7e2bf1ba4a6..275dca1435bf 100644
--- a/arch/m68k/include/asm/bug.h
+++ b/arch/m68k/include/asm/bug.h
@@ -8,16 +8,19 @@
 #ifndef CONFIG_SUN3
 #define BUG() do { \
         pr_crit("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \
+        barrier_before_unreachable(); \
         __builtin_trap(); \
 } while (0)
 #else
 #define BUG() do { \
         pr_crit("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \
+        barrier_before_unreachable(); \
         panic("BUG!"); \
 } while (0)
 #endif
 #else
 #define BUG() do { \
+        barrier_before_unreachable(); \
         __builtin_trap(); \
 } while (0)
 #endif
diff --git a/arch/mips/boot/Makefile b/arch/mips/boot/Makefile
index 1bd5c4f00d19..c22da16d67b8 100644
--- a/arch/mips/boot/Makefile
+++ b/arch/mips/boot/Makefile
@@ -126,6 +126,7 @@ $(obj)/vmlinux.its.S: $(addprefix $(srctree)/arch/mips/$(PLATFORM)/,$(ITS_INPUTS
 
 quiet_cmd_cpp_its_S = ITS     $@
       cmd_cpp_its_S = $(CPP) $(cpp_flags) -P -C -o $@ $< \
+                        -D__ASSEMBLY__ \
                         -DKERNEL_NAME="\"Linux $(KERNELRELEASE)\"" \
                         -DVMLINUX_BINARY="\"$(3)\"" \
                         -DVMLINUX_COMPRESSION="\"$(2)\"" \
diff --git a/arch/mips/include/asm/compat.h b/arch/mips/include/asm/compat.h
index 946681db8dc3..9a0fa66b81ac 100644
--- a/arch/mips/include/asm/compat.h
+++ b/arch/mips/include/asm/compat.h
@@ -86,7 +86,6 @@ struct compat_flock {
         compat_off_t    l_len;
         s32             l_sysid;
         compat_pid_t    l_pid;
-        short           __unused;
         s32             pad[4];
 };
 
diff --git a/arch/mips/kernel/mips-cpc.c b/arch/mips/kernel/mips-cpc.c
index 19c88d770054..fcf9af492d60 100644
--- a/arch/mips/kernel/mips-cpc.c
+++ b/arch/mips/kernel/mips-cpc.c
@@ -10,6 +10,8 @@
 
 #include <linux/errno.h>
 #include <linux/percpu.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
 #include <linux/spinlock.h>
 
 #include <asm/mips-cps.h>
@@ -22,6 +24,17 @@ static DEFINE_PER_CPU_ALIGNED(unsigned long, cpc_core_lock_flags);
 
 phys_addr_t __weak mips_cpc_default_phys_base(void)
 {
+        struct device_node *cpc_node;
+        struct resource res;
+        int err;
+
+        cpc_node = of_find_compatible_node(of_root, NULL, "mti,mips-cpc");
+        if (cpc_node) {
+                err = of_address_to_resource(cpc_node, 0, &res);
+                if (!err)
+                        return res.start;
+        }
+
         return 0;
 }
 
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index 85bc601e9a0d..5f8b0a9e30b3 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -375,6 +375,7 @@ static void __init bootmem_init(void)
         unsigned long reserved_end;
         unsigned long mapstart = ~0UL;
         unsigned long bootmap_size;
+        phys_addr_t ramstart = (phys_addr_t)ULLONG_MAX;
         bool bootmap_valid = false;
         int i;
 
@@ -395,7 +396,8 @@ static void __init bootmem_init(void)
         max_low_pfn = 0;
 
         /*
-         * Find the highest page frame number we have available.
+         * Find the highest page frame number we have available
+         * and the lowest used RAM address
          */
         for (i = 0; i < boot_mem_map.nr_map; i++) {
                 unsigned long start, end;
@@ -407,6 +409,8 @@ static void __init bootmem_init(void)
                 end = PFN_DOWN(boot_mem_map.map[i].addr
                                 + boot_mem_map.map[i].size);
 
+                ramstart = min(ramstart, boot_mem_map.map[i].addr);
+
 #ifndef CONFIG_HIGHMEM
                 /*
                  * Skip highmem here so we get an accurate max_low_pfn if low
@@ -436,6 +440,13 @@ static void __init bootmem_init(void)
                 mapstart = max(reserved_end, start);
         }
 
+        /*
+         * Reserve any memory between the start of RAM and PHYS_OFFSET
+         */
+        if (ramstart > PHYS_OFFSET)
+                add_memory_region(PHYS_OFFSET, ramstart - PHYS_OFFSET,
+                                  BOOT_MEM_RESERVED);
+
         if (min_low_pfn >= max_low_pfn)
                 panic("Incorrect memory mapping !!!");
         if (min_low_pfn > ARCH_PFN_OFFSET) {
@@ -664,9 +675,6 @@ static int __init early_parse_mem(char *p)
 
         add_memory_region(start, size, BOOT_MEM_RAM);
 
-        if (start && start > PHYS_OFFSET)
-                add_memory_region(PHYS_OFFSET, start - PHYS_OFFSET,
-                                BOOT_MEM_RESERVED);
         return 0;
 }
 early_param("mem", early_parse_mem);
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index 87dcac2447c8..9d41732a9146 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -572,7 +572,7 @@ asmlinkage void __weak plat_wired_tlb_setup(void)
          */
 }
 
-void __init bmips_cpu_setup(void)
+void bmips_cpu_setup(void)
 {
         void __iomem __maybe_unused *cbr = BMIPS_GET_CBR();
         u32 __maybe_unused cfg;
diff --git a/arch/powerpc/include/asm/book3s/32/pgtable.h b/arch/powerpc/include/asm/book3s/32/pgtable.h
index 30a155c0a6b0..c615abdce119 100644
--- a/arch/powerpc/include/asm/book3s/32/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/32/pgtable.h
@@ -16,6 +16,7 @@
 #define PGD_INDEX_SIZE  (32 - PGDIR_SHIFT)
 
 #define PMD_CACHE_INDEX PMD_INDEX_SIZE
+#define PUD_CACHE_INDEX PUD_INDEX_SIZE
 
 #ifndef __ASSEMBLY__
 #define PTE_TABLE_SIZE  (sizeof(pte_t) << PTE_INDEX_SIZE)
diff --git a/arch/powerpc/include/asm/book3s/64/hash-4k.h b/arch/powerpc/include/asm/book3s/64/hash-4k.h
index 949d691094a4..67c5475311ee 100644
--- a/arch/powerpc/include/asm/book3s/64/hash-4k.h
+++ b/arch/powerpc/include/asm/book3s/64/hash-4k.h
@@ -63,7 +63,8 @@ static inline int hash__hugepd_ok(hugepd_t hpd)
  * keeping the prototype consistent across the two formats.
  */
 static inline unsigned long pte_set_hidx(pte_t *ptep, real_pte_t rpte,
-                        unsigned int subpg_index, unsigned long hidx)
+                                         unsigned int subpg_index, unsigned long hidx,
+                                         int offset)
 {
         return (hidx << H_PAGE_F_GIX_SHIFT) &
                 (H_PAGE_F_SECOND | H_PAGE_F_GIX);
diff --git a/arch/powerpc/include/asm/book3s/64/hash-64k.h b/arch/powerpc/include/asm/book3s/64/hash-64k.h
index 338b7da468ce..3bcf269f8f55 100644
--- a/arch/powerpc/include/asm/book3s/64/hash-64k.h
+++ b/arch/powerpc/include/asm/book3s/64/hash-64k.h
@@ -45,7 +45,7 @@
  * generic accessors and iterators here
  */
 #define __real_pte __real_pte
-static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep)
+static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep, int offset)
 {
         real_pte_t rpte;
         unsigned long *hidxp;
@@ -59,7 +59,7 @@ static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep)
          */
         smp_rmb();
 
-        hidxp = (unsigned long *)(ptep + PTRS_PER_PTE);
+        hidxp = (unsigned long *)(ptep + offset);
         rpte.hidx = *hidxp;
         return rpte;
 }
@@ -86,9 +86,10 @@ static inline unsigned long __rpte_to_hidx(real_pte_t rpte, unsigned long index)
  * expected to modify the PTE bits accordingly and commit the PTE to memory.
  */
 static inline unsigned long pte_set_hidx(pte_t *ptep, real_pte_t rpte,
-                unsigned int subpg_index, unsigned long hidx)
+                                         unsigned int subpg_index,
+                                         unsigned long hidx, int offset)
 {
-        unsigned long *hidxp = (unsigned long *)(ptep + PTRS_PER_PTE);
+        unsigned long *hidxp = (unsigned long *)(ptep + offset);
 
         rpte.hidx &= ~HIDX_BITS(0xfUL, subpg_index);
         *hidxp = rpte.hidx  | HIDX_BITS(HIDX_SHIFT_BY_ONE(hidx), subpg_index);
@@ -140,13 +141,18 @@ static inline int hash__remap_4k_pfn(struct vm_area_struct *vma, unsigned long a
 }
 
 #define H_PTE_TABLE_SIZE        PTE_FRAG_SIZE
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+#if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined (CONFIG_HUGETLB_PAGE)
 #define H_PMD_TABLE_SIZE        ((sizeof(pmd_t) << PMD_INDEX_SIZE) + \
                                  (sizeof(unsigned long) << PMD_INDEX_SIZE))
 #else
 #define H_PMD_TABLE_SIZE        (sizeof(pmd_t) << PMD_INDEX_SIZE)
 #endif
+#ifdef CONFIG_HUGETLB_PAGE
+#define H_PUD_TABLE_SIZE        ((sizeof(pud_t) << PUD_INDEX_SIZE) +    \
+                                 (sizeof(unsigned long) << PUD_INDEX_SIZE))
+#else
 #define H_PUD_TABLE_SIZE        (sizeof(pud_t) << PUD_INDEX_SIZE)
+#endif
 #define H_PGD_TABLE_SIZE        (sizeof(pgd_t) << PGD_INDEX_SIZE)
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
diff --git a/arch/powerpc/include/asm/book3s/64/hash.h b/arch/powerpc/include/asm/book3s/64/hash.h
index 0920eff731b3..935adcd92a81 100644
--- a/arch/powerpc/include/asm/book3s/64/hash.h
+++ b/arch/powerpc/include/asm/book3s/64/hash.h
@@ -23,7 +23,8 @@
                                  H_PUD_INDEX_SIZE + H_PGD_INDEX_SIZE + PAGE_SHIFT)
 #define H_PGTABLE_RANGE         (ASM_CONST(1) << H_PGTABLE_EADDR_SIZE)
 
-#if defined(CONFIG_TRANSPARENT_HUGEPAGE) &&  defined(CONFIG_PPC_64K_PAGES)
+#if (defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_HUGETLB_PAGE)) && \
+        defined(CONFIG_PPC_64K_PAGES)
 /*
  * only with hash 64k we need to use the second half of pmd page table
  * to store pointer to deposited pgtable_t
@@ -33,6 +34,16 @@
 #define H_PMD_CACHE_INDEX       H_PMD_INDEX_SIZE
 #endif
 /*
+ * We store the slot details in the second half of page table.
+ * Increase the pud level table so that hugetlb ptes can be stored
+ * at pud level.
+ */
+#if defined(CONFIG_HUGETLB_PAGE) &&  defined(CONFIG_PPC_64K_PAGES)
+#define H_PUD_CACHE_INDEX       (H_PUD_INDEX_SIZE + 1)
+#else
+#define H_PUD_CACHE_INDEX       (H_PUD_INDEX_SIZE)
+#endif
+/*
  * Define the address range of the kernel non-linear virtual area
  */
 #define H_KERN_VIRT_START ASM_CONST(0xD000000000000000)
diff --git a/arch/powerpc/include/asm/book3s/64/pgalloc.h b/arch/powerpc/include/asm/book3s/64/pgalloc.h
index 1fcfa425cefa..4746bc68d446 100644
--- a/arch/powerpc/include/asm/book3s/64/pgalloc.h
+++ b/arch/powerpc/include/asm/book3s/64/pgalloc.h
@@ -73,10 +73,16 @@ static inline void radix__pgd_free(struct mm_struct *mm, pgd_t *pgd)
 
 static inline pgd_t *pgd_alloc(struct mm_struct *mm)
 {
+        pgd_t *pgd;
+
         if (radix_enabled())
                 return radix__pgd_alloc(mm);
-        return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
-                pgtable_gfp_flags(mm, GFP_KERNEL));
+
+        pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
+                               pgtable_gfp_flags(mm, GFP_KERNEL));
+        memset(pgd, 0, PGD_TABLE_SIZE);
+
+        return pgd;
 }
 
 static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
@@ -93,13 +99,13 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
 
 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
-        return kmem_cache_alloc(PGT_CACHE(PUD_INDEX_SIZE),
+        return kmem_cache_alloc(PGT_CACHE(PUD_CACHE_INDEX),
                 pgtable_gfp_flags(mm, GFP_KERNEL));
 }
 
 static inline void pud_free(struct mm_struct *mm, pud_t *pud)
 {
-        kmem_cache_free(PGT_CACHE(PUD_INDEX_SIZE), pud);
+        kmem_cache_free(PGT_CACHE(PUD_CACHE_INDEX), pud);
 }
 
 static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
@@ -115,7 +121,7 @@ static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pud,
          * ahead and flush the page walk cache
          */
         flush_tlb_pgtable(tlb, address);
-        pgtable_free_tlb(tlb, pud, PUD_INDEX_SIZE);
+        pgtable_free_tlb(tlb, pud, PUD_CACHE_INDEX);
 }
 
 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
index 51017726d495..a6b9f1d74600 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
@@ -232,11 +232,13 @@ extern unsigned long __pmd_index_size;
 extern unsigned long __pud_index_size;
 extern unsigned long __pgd_index_size;
 extern unsigned long __pmd_cache_index;
+extern unsigned long __pud_cache_index;
 #define PTE_INDEX_SIZE  __pte_index_size
 #define PMD_INDEX_SIZE  __pmd_index_size
 #define PUD_INDEX_SIZE  __pud_index_size
 #define PGD_INDEX_SIZE  __pgd_index_size
 #define PMD_CACHE_INDEX __pmd_cache_index
+#define PUD_CACHE_INDEX __pud_cache_index
 /*
  * Because of use of pte fragments and THP, size of page table
  * are not always derived out of index size above.
@@ -348,7 +350,7 @@ extern unsigned long pci_io_base;
  */
 #ifndef __real_pte
 
-#define __real_pte(e,p)         ((real_pte_t){(e)})
+#define __real_pte(e, p, o)             ((real_pte_t){(e)})
 #define __rpte_to_pte(r)        ((r).pte)
 #define __rpte_to_hidx(r,index) (pte_val(__rpte_to_pte(r)) >> H_PAGE_F_GIX_SHIFT)
 
diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
index 176dfb73d42c..471b2274fbeb 100644
--- a/arch/powerpc/include/asm/exception-64s.h
+++ b/arch/powerpc/include/asm/exception-64s.h
@@ -645,7 +645,7 @@ END_FTR_SECTION_NESTED(ftr,ftr,943)
                                           EXC_HV, SOFTEN_TEST_HV, bitmask)
 
 #define MASKABLE_RELON_EXCEPTION_HV_OOL(vec, label, bitmask)            \
-        MASKABLE_EXCEPTION_PROLOG_1(PACA_EXGEN, SOFTEN_NOTEST_HV, vec, bitmask);\
+        MASKABLE_EXCEPTION_PROLOG_1(PACA_EXGEN, SOFTEN_TEST_HV, vec, bitmask);\
         EXCEPTION_RELON_PROLOG_PSERIES_1(label, EXC_HV)
 
 /*
diff --git a/arch/powerpc/include/asm/firmware.h b/arch/powerpc/include/asm/firmware.h
index 511acfd7ab0d..535add3f7791 100644
--- a/arch/powerpc/include/asm/firmware.h
+++ b/arch/powerpc/include/asm/firmware.h
@@ -52,7 +52,7 @@
 #define FW_FEATURE_TYPE1_AFFINITY ASM_CONST(0x0000000100000000)
 #define FW_FEATURE_PRRN         ASM_CONST(0x0000000200000000)
 #define FW_FEATURE_DRMEM_V2     ASM_CONST(0x0000000400000000)
-#define FW_FEATURE_DRC_INFO     ASM_CONST(0x0000000400000000)
+#define FW_FEATURE_DRC_INFO     ASM_CONST(0x0000000800000000)
 
 #ifndef __ASSEMBLY__
 
diff --git a/arch/powerpc/include/asm/hw_irq.h b/arch/powerpc/include/asm/hw_irq.h
index 88e5e8f17e98..855e17d158b1 100644
--- a/arch/powerpc/include/asm/hw_irq.h
+++ b/arch/powerpc/include/asm/hw_irq.h
@@ -30,6 +30,16 @@
 #define PACA_IRQ_PMI            0x40
 
 /*
+ * Some soft-masked interrupts must be hard masked until they are replayed
+ * (e.g., because the soft-masked handler does not clear the exception).
+ */
+#ifdef CONFIG_PPC_BOOK3S
+#define PACA_IRQ_MUST_HARD_MASK (PACA_IRQ_EE|PACA_IRQ_PMI)
+#else
+#define PACA_IRQ_MUST_HARD_MASK (PACA_IRQ_EE)
+#endif
+
+/*
  * flags for paca->irq_soft_mask
  */
 #define IRQS_ENABLED            0
@@ -244,7 +254,7 @@ static inline bool lazy_irq_pending(void)
 static inline void may_hard_irq_enable(void)
 {
         get_paca()->irq_happened &= ~PACA_IRQ_HARD_DIS;
-        if (!(get_paca()->irq_happened & PACA_IRQ_EE))
+        if (!(get_paca()->irq_happened & PACA_IRQ_MUST_HARD_MASK))
                 __hard_irq_enable();
 }
 
diff --git a/arch/powerpc/include/asm/kexec.h b/arch/powerpc/include/asm/kexec.h
index 9dcbfa6bbb91..d8b1e8e7e035 100644
--- a/arch/powerpc/include/asm/kexec.h
+++ b/arch/powerpc/include/asm/kexec.h
@@ -140,6 +140,12 @@ static inline bool kdump_in_progress(void)
         return false;
 }
 
+static inline void crash_ipi_callback(struct pt_regs *regs) { }
+
+static inline void crash_send_ipi(void (*crash_ipi_callback)(struct pt_regs *))
+{
+}
+
 #endif /* CONFIG_KEXEC_CORE */
 #endif /* ! __ASSEMBLY__ */
 #endif /* __KERNEL__ */
diff --git a/arch/powerpc/include/asm/nohash/32/pgtable.h b/arch/powerpc/include/asm/nohash/32/pgtable.h
index 504a3c36ce5c..03bbd1149530 100644
--- a/arch/powerpc/include/asm/nohash/32/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/32/pgtable.h
@@ -24,6 +24,7 @@ extern int icache_44x_need_flush;
 #define PGD_INDEX_SIZE  (32 - PGDIR_SHIFT)
 
 #define PMD_CACHE_INDEX PMD_INDEX_SIZE
+#define PUD_CACHE_INDEX PUD_INDEX_SIZE
 
 #ifndef __ASSEMBLY__
 #define PTE_TABLE_SIZE  (sizeof(pte_t) << PTE_INDEX_SIZE)
diff --git a/arch/powerpc/include/asm/nohash/64/pgtable.h b/arch/powerpc/include/asm/nohash/64/pgtable.h
index abddf5830ad5..5c5f75d005ad 100644
--- a/arch/powerpc/include/asm/nohash/64/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/64/pgtable.h
@@ -27,6 +27,7 @@
 #else
 #define PMD_CACHE_INDEX PMD_INDEX_SIZE
 #endif
+#define PUD_CACHE_INDEX PUD_INDEX_SIZE
 
 /*
  * Define the address range of the kernel non-linear virtual area
diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
index 88187c285c70..9f421641a35c 100644
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -44,6 +44,11 @@ extern int sysfs_add_device_to_node(struct device *dev, int nid);
 extern void sysfs_remove_device_from_node(struct device *dev, int nid);
 extern int numa_update_cpu_topology(bool cpus_locked);
 
+static inline void update_numa_cpu_lookup_table(unsigned int cpu, int node)
+{
+        numa_cpu_lookup_table[cpu] = node;
+}
+
 static inline int early_cpu_to_node(int cpu)
 {
         int nid;
@@ -76,12 +81,16 @@ static inline int numa_update_cpu_topology(bool cpus_locked)
 {
         return 0;
 }
+
+static inline void update_numa_cpu_lookup_table(unsigned int cpu, int node) {}
+
 #endif /* CONFIG_NUMA */
 
 #if defined(CONFIG_NUMA) && defined(CONFIG_PPC_SPLPAR)
 extern int start_topology_update(void);
 extern int stop_topology_update(void);
 extern int prrn_is_enabled(void);
+extern int find_and_online_cpu_nid(int cpu);
 #else
 static inline int start_topology_update(void)
 {
@@ -95,6 +104,10 @@ static inline int prrn_is_enabled(void)
 {
         return 0;
 }
+static inline int find_and_online_cpu_nid(int cpu)
+{
+        return 0;
+}
 #endif /* CONFIG_NUMA && CONFIG_PPC_SPLPAR */
 
 #if defined(CONFIG_HOTPLUG_CPU) || defined(CONFIG_NEED_MULTIPLE_NODES)
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index beea2182d754..0c0b66fc5bfb 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -384,7 +384,8 @@ static void *eeh_report_resume(void *data, void *userdata)
         eeh_pcid_put(dev);
         pci_uevent_ers(dev, PCI_ERS_RESULT_RECOVERED);
 #ifdef CONFIG_PCI_IOV
-        eeh_ops->notify_resume(eeh_dev_to_pdn(edev));
+        if (eeh_ops->notify_resume && eeh_dev_to_pdn(edev))
+                eeh_ops->notify_resume(eeh_dev_to_pdn(edev));
 #endif
         return NULL;
 }
diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
index ee832d344a5a..9b6e653e501a 100644
--- a/arch/powerpc/kernel/exceptions-64e.S
+++ b/arch/powerpc/kernel/exceptions-64e.S
@@ -943,6 +943,8 @@ kernel_dbg_exc:
 /*
  * An interrupt came in while soft-disabled; We mark paca->irq_happened
  * accordingly and if the interrupt is level sensitive, we hard disable
+ * hard disable (full_mask) corresponds to PACA_IRQ_MUST_HARD_MASK, so
+ * keep these in synch.
  */
 
 .macro masked_interrupt_book3e paca_irq full_mask
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 243d072a225a..3ac87e53b3da 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1426,7 +1426,7 @@ EXC_COMMON_BEGIN(soft_nmi_common)
  *   triggered and won't automatically refire.
  * - If it was a HMI we return immediately since we handled it in realmode
  *   and it won't refire.
- * - else we hard disable and return.
+ * - Else it is one of PACA_IRQ_MUST_HARD_MASK, so hard disable and return.
  * This is called with r10 containing the value to OR to the paca field.
  */
 #define MASKED_INTERRUPT(_H)                            \
@@ -1441,8 +1441,8 @@ masked_##_H##interrupt:					\
         ori     r10,r10,0xffff;                         \
         mtspr   SPRN_DEC,r10;                           \
         b       MASKED_DEC_HANDLER_LABEL;               \
-1:      andi.   r10,r10,(PACA_IRQ_DBELL|PACA_IRQ_HMI);  \
-        bne     2f;                                     \
+1:      andi.   r10,r10,PACA_IRQ_MUST_HARD_MASK;        \
+        beq     2f;                                     \
         mfspr   r10,SPRN_##_H##SRR1;                    \
         xori    r10,r10,MSR_EE; /* clear MSR_EE */      \
         mtspr   SPRN_##_H##SRR1,r10;                    \
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index adf044daafd7..d22c41c26bb3 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -874,7 +874,7 @@ struct ibm_arch_vec __cacheline_aligned ibm_architecture_vec = {
                 .mmu = 0,
                 .hash_ext = 0,
                 .radix_ext = 0,
-                .byte22 = OV5_FEAT(OV5_DRC_INFO),
+                .byte22 = 0,
         },
 
         /* option vector 6: IBM PAPR hints */
diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
index 5a8bfee6e187..04d0bbd7a1dd 100644
--- a/arch/powerpc/kernel/sysfs.c
+++ b/arch/powerpc/kernel/sysfs.c
@@ -788,7 +788,8 @@ static int register_cpu_online(unsigned int cpu)
         if (cpu_has_feature(CPU_FTR_PPCAS_ARCH_V2))
                 device_create_file(s, &dev_attr_pir);
 
-        if (cpu_has_feature(CPU_FTR_ARCH_206))
+        if (cpu_has_feature(CPU_FTR_ARCH_206) &&
+                !firmware_has_feature(FW_FEATURE_LPAR))
                 device_create_file(s, &dev_attr_tscr);
 #endif /* CONFIG_PPC64 */
 
@@ -873,7 +874,8 @@ static int unregister_cpu_online(unsigned int cpu)
         if (cpu_has_feature(CPU_FTR_PPCAS_ARCH_V2))
                 device_remove_file(s, &dev_attr_pir);
 
-        if (cpu_has_feature(CPU_FTR_ARCH_206))
+        if (cpu_has_feature(CPU_FTR_ARCH_206) &&
+                !firmware_has_feature(FW_FEATURE_LPAR))
                 device_remove_file(s, &dev_attr_tscr);
 #endif /* CONFIG_PPC64 */
 
diff --git a/arch/powerpc/kvm/book3s_xive.c b/arch/powerpc/kvm/book3s_xive.c
index f0f5cd4d2fe7..f9818d7d3381 100644
--- a/arch/powerpc/kvm/book3s_xive.c
+++ b/arch/powerpc/kvm/book3s_xive.c
@@ -188,7 +188,7 @@ static int xive_provision_queue(struct kvm_vcpu *vcpu, u8 prio)
         if (!qpage) {
                 pr_err("Failed to allocate queue %d for VCPU %d\n",
                        prio, xc->server_num);
-                return -ENOMEM;;
+                return -ENOMEM;
         }
         memset(qpage, 0, 1 << xive->q_order);
 
diff --git a/arch/powerpc/mm/drmem.c b/arch/powerpc/mm/drmem.c
index 1604110c4238..3f1803672c9b 100644
--- a/arch/powerpc/mm/drmem.c
+++ b/arch/powerpc/mm/drmem.c
@@ -98,7 +98,7 @@ static void init_drconf_v2_cell(struct of_drconf_cell_v2 *dr_cell,
         dr_cell->base_addr = cpu_to_be64(lmb->base_addr);
         dr_cell->drc_index = cpu_to_be32(lmb->drc_index);
         dr_cell->aa_index = cpu_to_be32(lmb->aa_index);
-        dr_cell->flags = cpu_to_be32(lmb->flags);
+        dr_cell->flags = cpu_to_be32(drmem_lmb_flags(lmb));
 }
 
 static int drmem_update_dt_v2(struct device_node *memory,
@@ -121,7 +121,7 @@ static int drmem_update_dt_v2(struct device_node *memory,
                 }
 
                 if (prev_lmb->aa_index != lmb->aa_index ||
-                    prev_lmb->flags != lmb->flags)
+                    drmem_lmb_flags(prev_lmb) != drmem_lmb_flags(lmb))
                         lmb_sets++;
 
                 prev_lmb = lmb;
@@ -150,7 +150,7 @@ static int drmem_update_dt_v2(struct device_node *memory,
                 }
 
                 if (prev_lmb->aa_index != lmb->aa_index ||
-                    prev_lmb->flags != lmb->flags) {
+                    drmem_lmb_flags(prev_lmb) != drmem_lmb_flags(lmb)) {
                         /* end of one set, start of another */
                         dr_cell->seq_lmbs = cpu_to_be32(seq_lmbs);
                         dr_cell++;
@@ -216,6 +216,8 @@ static void __init __walk_drmem_v1_lmbs(const __be32 *prop, const __be32 *usm,
         u32 i, n_lmbs;
 
         n_lmbs = of_read_number(prop++, 1);
+        if (n_lmbs == 0)
+                return;
 
         for (i = 0; i < n_lmbs; i++) {
                 read_drconf_v1_cell(&lmb, &prop);
@@ -245,6 +247,8 @@ static void __init __walk_drmem_v2_lmbs(const __be32 *prop, const __be32 *usm,
         u32 i, j, lmb_sets;
 
         lmb_sets = of_read_number(prop++, 1);
+        if (lmb_sets == 0)
+                return;
 
         for (i = 0; i < lmb_sets; i++) {
                 read_drconf_v2_cell(&dr_cell, &prop);
@@ -354,6 +358,8 @@ static void __init init_drmem_v1_lmbs(const __be32 *prop)
         struct drmem_lmb *lmb;
 
         drmem_info->n_lmbs = of_read_number(prop++, 1);
+        if (drmem_info->n_lmbs == 0)
+                return;
 
         drmem_info->lmbs = kcalloc(drmem_info->n_lmbs, sizeof(*lmb),
                                    GFP_KERNEL);
@@ -373,6 +379,8 @@ static void __init init_drmem_v2_lmbs(const __be32 *prop)
         int lmb_index;
 
         lmb_sets = of_read_number(prop++, 1);
+        if (lmb_sets == 0)
+                return;
 
         /* first pass, calculate the number of LMBs */
         p = prop;
diff --git a/arch/powerpc/mm/hash64_4k.c b/arch/powerpc/mm/hash64_4k.c
index 5a69b51d08a3..d573d7d07f25 100644
--- a/arch/powerpc/mm/hash64_4k.c
+++ b/arch/powerpc/mm/hash64_4k.c
@@ -55,7 +55,7 @@ int __hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid,
          * need to add in 0x1 if it's a read-only user page
          */
         rflags = htab_convert_pte_flags(new_pte);
-        rpte = __real_pte(__pte(old_pte), ptep);
+        rpte = __real_pte(__pte(old_pte), ptep, PTRS_PER_PTE);
 
         if (cpu_has_feature(CPU_FTR_NOEXECUTE) &&
             !cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
@@ -117,7 +117,7 @@ repeat:
                         return -1;
                 }
                 new_pte = (new_pte & ~_PAGE_HPTEFLAGS) | H_PAGE_HASHPTE;
-                new_pte |= pte_set_hidx(ptep, rpte, 0, slot);
+                new_pte |= pte_set_hidx(ptep, rpte, 0, slot, PTRS_PER_PTE);
         }
         *ptep = __pte(new_pte & ~H_PAGE_BUSY);
         return 0;
diff --git a/arch/powerpc/mm/hash64_64k.c b/arch/powerpc/mm/hash64_64k.c
index 2253bbc6a599..e601d95c3b20 100644
--- a/arch/powerpc/mm/hash64_64k.c
+++ b/arch/powerpc/mm/hash64_64k.c
@@ -86,7 +86,7 @@ int __hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid,
 
         subpg_index = (ea & (PAGE_SIZE - 1)) >> shift;
         vpn  = hpt_vpn(ea, vsid, ssize);
-        rpte = __real_pte(__pte(old_pte), ptep);
+        rpte = __real_pte(__pte(old_pte), ptep, PTRS_PER_PTE);
         /*
          *None of the sub 4k page is hashed
          */
@@ -214,7 +214,7 @@ repeat:
                 return -1;
         }
 
-        new_pte |= pte_set_hidx(ptep, rpte, subpg_index, slot);
+        new_pte |= pte_set_hidx(ptep, rpte, subpg_index, slot, PTRS_PER_PTE);
         new_pte |= H_PAGE_HASHPTE;
 
         *ptep = __pte(new_pte & ~H_PAGE_BUSY);
@@ -262,7 +262,7 @@ int __hash_page_64K(unsigned long ea, unsigned long access,
         } while (!pte_xchg(ptep, __pte(old_pte), __pte(new_pte)));
 
         rflags = htab_convert_pte_flags(new_pte);
-        rpte = __real_pte(__pte(old_pte), ptep);
+        rpte = __real_pte(__pte(old_pte), ptep, PTRS_PER_PTE);
 
         if (cpu_has_feature(CPU_FTR_NOEXECUTE) &&
             !cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
@@ -327,7 +327,7 @@ repeat:
                 }
 
                 new_pte = (new_pte & ~_PAGE_HPTEFLAGS) | H_PAGE_HASHPTE;
-                new_pte |= pte_set_hidx(ptep, rpte, 0, slot);
+                new_pte |= pte_set_hidx(ptep, rpte, 0, slot, PTRS_PER_PTE);
         }
         *ptep = __pte(new_pte & ~H_PAGE_BUSY);
         return 0;
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index 7d07c7e17db6..cf290d415dcd 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -1008,6 +1008,7 @@ void __init hash__early_init_mmu(void)
         __pmd_index_size = H_PMD_INDEX_SIZE;
         __pud_index_size = H_PUD_INDEX_SIZE;
         __pgd_index_size = H_PGD_INDEX_SIZE;
+        __pud_cache_index = H_PUD_CACHE_INDEX;
         __pmd_cache_index = H_PMD_CACHE_INDEX;
         __pte_table_size = H_PTE_TABLE_SIZE;
         __pmd_table_size = H_PMD_TABLE_SIZE;
diff --git a/arch/powerpc/mm/hugetlbpage-hash64.c b/arch/powerpc/mm/hugetlbpage-hash64.c
index 12511f5a015f..b320f5097a06 100644
--- a/arch/powerpc/mm/hugetlbpage-hash64.c
+++ b/arch/powerpc/mm/hugetlbpage-hash64.c
@@ -27,7 +27,7 @@ int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
         unsigned long vpn;
         unsigned long old_pte, new_pte;
         unsigned long rflags, pa, sz;
-        long slot;
+        long slot, offset;
 
         BUG_ON(shift != mmu_psize_defs[mmu_psize].shift);
 
@@ -63,7 +63,11 @@ int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
         } while(!pte_xchg(ptep, __pte(old_pte), __pte(new_pte)));
 
         rflags = htab_convert_pte_flags(new_pte);
-        rpte = __real_pte(__pte(old_pte), ptep);
+        if (unlikely(mmu_psize == MMU_PAGE_16G))
+                offset = PTRS_PER_PUD;
+        else
+                offset = PTRS_PER_PMD;
+        rpte = __real_pte(__pte(old_pte), ptep, offset);
 
         sz = ((1UL) << shift);
         if (!cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
@@ -104,7 +108,7 @@ int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
                         return -1;
                 }
 
-                new_pte |= pte_set_hidx(ptep, rpte, 0, slot);
+                new_pte |= pte_set_hidx(ptep, rpte, 0, slot, offset);
         }
 
         /*
diff --git a/arch/powerpc/mm/init-common.c b/arch/powerpc/mm/init-common.c
index eb8c6c8c4851..2b656e67f2ea 100644
--- a/arch/powerpc/mm/init-common.c
+++ b/arch/powerpc/mm/init-common.c
@@ -100,6 +100,6 @@ void pgtable_cache_init(void)
          * same size as either the pgd or pmd index except with THP enabled
          * on book3s 64
          */
-        if (PUD_INDEX_SIZE && !PGT_CACHE(PUD_INDEX_SIZE))
-                pgtable_cache_add(PUD_INDEX_SIZE, pud_ctor);
+        if (PUD_CACHE_INDEX && !PGT_CACHE(PUD_CACHE_INDEX))
+                pgtable_cache_add(PUD_CACHE_INDEX, pud_ctor);
 }
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 314d19ab9385..edd8d0bc9364 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -143,11 +143,6 @@ static void reset_numa_cpu_lookup_table(void)
                 numa_cpu_lookup_table[cpu] = -1;
 }
 
-static void update_numa_cpu_lookup_table(unsigned int cpu, int node)
-{
-        numa_cpu_lookup_table[cpu] = node;
-}
-
 static void map_cpu_to_node(int cpu, int node)
 {
         update_numa_cpu_lookup_table(cpu, node);
diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
index 573a9a2ee455..2e10a964e290 100644
--- a/arch/powerpc/mm/pgtable-radix.c
+++ b/arch/powerpc/mm/pgtable-radix.c
@@ -17,9 +17,11 @@
 #include <linux/of_fdt.h>
 #include <linux/mm.h>
 #include <linux/string_helpers.h>
+#include <linux/stop_machine.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
+#include <asm/mmu_context.h>
 #include <asm/dma.h>
 #include <asm/machdep.h>
 #include <asm/mmu.h>
@@ -333,6 +335,22 @@ static void __init radix_init_pgtable(void)
                      "r" (TLBIEL_INVAL_SET_LPID), "r" (0));
         asm volatile("eieio; tlbsync; ptesync" : : : "memory");
         trace_tlbie(0, 0, TLBIEL_INVAL_SET_LPID, 0, 2, 1, 1);
+
+        /*
+         * The init_mm context is given the first available (non-zero) PID,
+         * which is the "guard PID" and contains no page table. PIDR should
+         * never be set to zero because that duplicates the kernel address
+         * space at the 0x0... offset (quadrant 0)!
+         *
+         * An arbitrary PID that may later be allocated by the PID allocator
+         * for userspace processes must not be used either, because that
+         * would cause stale user mappings for that PID on CPUs outside of
+         * the TLB invalidation scheme (because it won't be in mm_cpumask).
+         *
+         * So permanently carve out one PID for the purpose of a guard PID.
+         */
+        init_mm.context.id = mmu_base_pid;
+        mmu_base_pid++;
 }
 
 static void __init radix_init_partition_table(void)
@@ -535,6 +553,7 @@ void __init radix__early_init_mmu(void)
         __pmd_index_size = RADIX_PMD_INDEX_SIZE;
         __pud_index_size = RADIX_PUD_INDEX_SIZE;
         __pgd_index_size = RADIX_PGD_INDEX_SIZE;
+        __pud_cache_index = RADIX_PUD_INDEX_SIZE;
         __pmd_cache_index = RADIX_PMD_INDEX_SIZE;
         __pte_table_size = RADIX_PTE_TABLE_SIZE;
         __pmd_table_size = RADIX_PMD_TABLE_SIZE;
@@ -579,7 +598,8 @@ void __init radix__early_init_mmu(void)
 
         radix_init_iamr();
         radix_init_pgtable();
-
+        /* Switch to the guard PID before turning on MMU */
+        radix__switch_mmu_context(NULL, &init_mm);
         if (cpu_has_feature(CPU_FTR_HVMODE))
                 tlbiel_all();
 }
@@ -604,6 +624,7 @@ void radix__early_init_mmu_secondary(void)
         }
         radix_init_iamr();
 
+        radix__switch_mmu_context(NULL, &init_mm);
         if (cpu_has_feature(CPU_FTR_HVMODE))
                 tlbiel_all();
 }
@@ -666,6 +687,30 @@ static void free_pmd_table(pmd_t *pmd_start, pud_t *pud)
         pud_clear(pud);
 }
 
+struct change_mapping_params {
+        pte_t *pte;
+        unsigned long start;
+        unsigned long end;
+        unsigned long aligned_start;
+        unsigned long aligned_end;
+};
+
+static int stop_machine_change_mapping(void *data)
+{
+        struct change_mapping_params *params =
+                        (struct change_mapping_params *)data;
+
+        if (!data)
+                return -1;
+
+        spin_unlock(&init_mm.page_table_lock);
+        pte_clear(&init_mm, params->aligned_start, params->pte);
+        create_physical_mapping(params->aligned_start, params->start);
+        create_physical_mapping(params->end, params->aligned_end);
+        spin_lock(&init_mm.page_table_lock);
+        return 0;
+}
+
 static void remove_pte_table(pte_t *pte_start, unsigned long addr,
                              unsigned long end)
 {
@@ -694,6 +739,52 @@ static void remove_pte_table(pte_t *pte_start, unsigned long addr,
         }
 }
 
+/*
+ * clear the pte and potentially split the mapping helper
+ */
+static void split_kernel_mapping(unsigned long addr, unsigned long end,
+                                unsigned long size, pte_t *pte)
+{
+        unsigned long mask = ~(size - 1);
+        unsigned long aligned_start = addr & mask;
+        unsigned long aligned_end = addr + size;
+        struct change_mapping_params params;
+        bool split_region = false;
+
+        if ((end - addr) < size) {
+                /*
+                 * We're going to clear the PTE, but not flushed
+                 * the mapping, time to remap and flush. The
+                 * effects if visible outside the processor or
+                 * if we are running in code close to the
+                 * mapping we cleared, we are in trouble.
+                 */
+                if (overlaps_kernel_text(aligned_start, addr) ||
+                        overlaps_kernel_text(end, aligned_end)) {
+                        /*
+                         * Hack, just return, don't pte_clear
+                         */
+                        WARN_ONCE(1, "Linear mapping %lx->%lx overlaps kernel "
+                                  "text, not splitting\n", addr, end);
+                        return;
+                }
+                split_region = true;
+        }
+
+        if (split_region) {
+                params.pte = pte;
+                params.start = addr;
+                params.end = end;
+                params.aligned_start = addr & ~(size - 1);
+                params.aligned_end = min_t(unsigned long, aligned_end,
+                                (unsigned long)__va(memblock_end_of_DRAM()));
+                stop_machine(stop_machine_change_mapping, &params, NULL);
+                return;
+        }
+
+        pte_clear(&init_mm, addr, pte);
+}
+
 static void remove_pmd_table(pmd_t *pmd_start, unsigned long addr,
                              unsigned long end)
 {
@@ -709,13 +800,7 @@ static void remove_pmd_table(pmd_t *pmd_start, unsigned long addr,
                         continue;
 
                 if (pmd_huge(*pmd)) {
-                        if (!IS_ALIGNED(addr, PMD_SIZE) ||
-                            !IS_ALIGNED(next, PMD_SIZE)) {
-                                WARN_ONCE(1, "%s: unaligned range\n", __func__);
-                                continue;
-                        }
-
-                        pte_clear(&init_mm, addr, (pte_t *)pmd);
+                        split_kernel_mapping(addr, end, PMD_SIZE, (pte_t *)pmd);
                         continue;
                 }
 
@@ -740,13 +825,7 @@ static void remove_pud_table(pud_t *pud_start, unsigned long addr,
                         continue;
 
                 if (pud_huge(*pud)) {
-                        if (!IS_ALIGNED(addr, PUD_SIZE) ||
-                            !IS_ALIGNED(next, PUD_SIZE)) {
-                                WARN_ONCE(1, "%s: unaligned range\n", __func__);
-                                continue;
-                        }
-
-                        pte_clear(&init_mm, addr, (pte_t *)pud);
+                        split_kernel_mapping(addr, end, PUD_SIZE, (pte_t *)pud);
                         continue;
                 }
 
@@ -772,13 +851,7 @@ static void remove_pagetable(unsigned long start, unsigned long end)
                         continue;
 
                 if (pgd_huge(*pgd)) {
-                        if (!IS_ALIGNED(addr, PGDIR_SIZE) ||
-                            !IS_ALIGNED(next, PGDIR_SIZE)) {
-                                WARN_ONCE(1, "%s: unaligned range\n", __func__);
-                                continue;
-                        }
-
-                        pte_clear(&init_mm, addr, (pte_t *)pgd);
+                        split_kernel_mapping(addr, end, PGDIR_SIZE, (pte_t *)pgd);
                         continue;
                 }
 
diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
index c9a623c2d8a2..28c980eb4422 100644
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -82,6 +82,8 @@ unsigned long __pgd_index_size;
 EXPORT_SYMBOL(__pgd_index_size);
 unsigned long __pmd_cache_index;
 EXPORT_SYMBOL(__pmd_cache_index);
+unsigned long __pud_cache_index;
+EXPORT_SYMBOL(__pud_cache_index);
 unsigned long __pte_table_size;
 EXPORT_SYMBOL(__pte_table_size);
 unsigned long __pmd_table_size;
@@ -471,6 +473,8 @@ void mmu_partition_table_set_entry(unsigned int lpid, unsigned long dw0,
         if (old & PATB_HR) {
                 asm volatile(PPC_TLBIE_5(%0,%1,2,0,1) : :
                              "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
+                asm volatile(PPC_TLBIE_5(%0,%1,2,1,1) : :
+                             "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
                 trace_tlbie(lpid, 0, TLBIEL_INVAL_SET_LPID, lpid, 2, 0, 1);
         } else {
                 asm volatile(PPC_TLBIE_5(%0,%1,2,0,0) : :
diff --git a/arch/powerpc/mm/tlb_hash64.c b/arch/powerpc/mm/tlb_hash64.c
index 881ebd53ffc2..9b23f12e863c 100644
--- a/arch/powerpc/mm/tlb_hash64.c
+++ b/arch/powerpc/mm/tlb_hash64.c
@@ -51,7 +51,7 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
         unsigned int psize;
         int ssize;
         real_pte_t rpte;
-        int i;
+        int i, offset;
 
         i = batch->index;
 
@@ -67,6 +67,10 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
                 psize = get_slice_psize(mm, addr);
                 /* Mask the address for the correct page size */
                 addr &= ~((1UL << mmu_psize_defs[psize].shift) - 1);
+                if (unlikely(psize == MMU_PAGE_16G))
+                        offset = PTRS_PER_PUD;
+                else
+                        offset = PTRS_PER_PMD;
 #else
                 BUG();
                 psize = pte_pagesize_index(mm, addr, pte); /* shutup gcc */
@@ -78,6 +82,7 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
                  * support 64k pages, this might be different from the
                  * hardware page size encoded in the slice table. */
                 addr &= PAGE_MASK;
+                offset = PTRS_PER_PTE;
         }
 
 
@@ -91,7 +96,7 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
         }
         WARN_ON(vsid == 0);
         vpn = hpt_vpn(addr, vsid, ssize);
-        rpte = __real_pte(__pte(pte), ptep);
+        rpte = __real_pte(__pte(pte), ptep, offset);
 
         /*
          * Check if we have an active batch on this CPU. If not, just
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index 872d1f6dd11e..a9636d8cba15 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -327,6 +327,9 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
                         BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, len) != 4);
                         PPC_LWZ_OFFS(r_A, r_skb, offsetof(struct sk_buff, len));
                         break;
+                case BPF_LDX | BPF_W | BPF_ABS: /* A = *((u32 *)(seccomp_data + K)); */
+                        PPC_LWZ_OFFS(r_A, r_skb, K);
+                        break;
                 case BPF_LDX | BPF_W | BPF_LEN: /* X = skb->len; */
                         PPC_LWZ_OFFS(r_X, r_skb, offsetof(struct sk_buff, len));
                         break;
diff --git a/arch/powerpc/platforms/powernv/opal-imc.c b/arch/powerpc/platforms/powernv/opal-imc.c
index dd4c9b8b8a81..f6f55ab4980e 100644
--- a/arch/powerpc/platforms/powernv/opal-imc.c
+++ b/arch/powerpc/platforms/powernv/opal-imc.c
@@ -199,9 +199,11 @@ static void disable_nest_pmu_counters(void)
         const struct cpumask *l_cpumask;
 
         get_online_cpus();
-        for_each_online_node(nid) {
+        for_each_node_with_cpus(nid) {
                 l_cpumask = cpumask_of_node(nid);
-                cpu = cpumask_first(l_cpumask);
+                cpu = cpumask_first_and(l_cpumask, cpu_online_mask);
+                if (cpu >= nr_cpu_ids)
+                        continue;
                 opal_imc_counters_stop(OPAL_IMC_COUNTERS_NEST,
                                        get_hard_smp_processor_id(cpu));
         }
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 496e47696ed0..a6c92c78c9b2 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -1854,7 +1854,7 @@ static int pnv_pci_ioda_dma_set_mask(struct pci_dev *pdev, u64 dma_mask)
         s64 rc;
 
         if (WARN_ON(!pdn || pdn->pe_number == IODA_INVALID_PE))
-                return -ENODEV;;
+                return -ENODEV;
 
         pe = &phb->ioda.pe_array[pdn->pe_number];
         if (pe->tce_bypass_enabled) {
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index 4fb21e17504a..092715b9674b 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -80,6 +80,10 @@ static void pnv_setup_rfi_flush(void)
                 if (np && of_property_read_bool(np, "disabled"))
                         enable--;
 
+                np = of_get_child_by_name(fw_features, "speculation-policy-favor-security");
+                if (np && of_property_read_bool(np, "disabled"))
+                        enable = 0;
+
                 of_node_put(np);
                 of_node_put(fw_features);
         }
diff --git a/arch/powerpc/platforms/powernv/vas-window.c b/arch/powerpc/platforms/powernv/vas-window.c
index 2b3eb01ab110..b7c53a51c31b 100644
--- a/arch/powerpc/platforms/powernv/vas-window.c
+++ b/arch/powerpc/platforms/powernv/vas-window.c
@@ -1063,16 +1063,16 @@ struct vas_window *vas_tx_win_open(int vasid, enum vas_cop_type cop,
                         rc = PTR_ERR(txwin->paste_kaddr);
                         goto free_window;
                 }
+        } else {
+                /*
+                 * A user mapping must ensure that context switch issues
+                 * CP_ABORT for this thread.
+                 */
+                rc = set_thread_uses_vas();
+                if (rc)
+                        goto free_window;
         }
 
-        /*
-         * Now that we have a send window, ensure context switch issues
-         * CP_ABORT for this thread.
-         */
-        rc = -EINVAL;
-        if (set_thread_uses_vas() < 0)
-                goto free_window;
-
         set_vinst_win(vinst, txwin);
 
         return txwin;
diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
index dceb51454d8d..652d3e96b812 100644
--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
@@ -36,6 +36,7 @@
 #include <asm/xics.h>
 #include <asm/xive.h>
 #include <asm/plpar_wrappers.h>
+#include <asm/topology.h>
 
 #include "pseries.h"
 #include "offline_states.h"
@@ -331,6 +332,7 @@ static void pseries_remove_processor(struct device_node *np)
                         BUG_ON(cpu_online(cpu));
                         set_cpu_present(cpu, false);
                         set_hard_smp_processor_id(cpu, -1);
+                        update_numa_cpu_lookup_table(cpu, -1);
                         break;
                 }
                 if (cpu >= nr_cpu_ids)
@@ -340,8 +342,6 @@ static void pseries_remove_processor(struct device_node *np)
         cpu_maps_update_done();
 }
 
-extern int find_and_online_cpu_nid(int cpu);
-
 static int dlpar_online_cpu(struct device_node *dn)
 {
         int rc = 0;
diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
index 81d8614e7379..5e1ef9150182 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -49,6 +49,28 @@ static irqreturn_t ras_error_interrupt(int irq, void *dev_id);
 
 
 /*
+ * Enable the hotplug interrupt late because processing them may touch other
+ * devices or systems (e.g. hugepages) that have not been initialized at the
+ * subsys stage.
+ */
+int __init init_ras_hotplug_IRQ(void)
+{
+        struct device_node *np;
+
+        /* Hotplug Events */
+        np = of_find_node_by_path("/event-sources/hot-plug-events");
+        if (np != NULL) {
+                if (dlpar_workqueue_init() == 0)
+                        request_event_sources_irqs(np, ras_hotplug_interrupt,
+                                                   "RAS_HOTPLUG");
+                of_node_put(np);
+        }
+
+        return 0;
+}
+machine_late_initcall(pseries, init_ras_hotplug_IRQ);
+
+/*
  * Initialize handlers for the set of interrupts caused by hardware errors
  * and power system events.
  */
@@ -66,15 +88,6 @@ static int __init init_ras_IRQ(void)
                 of_node_put(np);
         }
 
-        /* Hotplug Events */
-        np = of_find_node_by_path("/event-sources/hot-plug-events");
-        if (np != NULL) {
-                if (dlpar_workqueue_init() == 0)
-                        request_event_sources_irqs(np, ras_hotplug_interrupt,
-                                           "RAS_HOTPLUG");
-                of_node_put(np);
-        }
-
         /* EPOW Events */
         np = of_find_node_by_path("/event-sources/epow-events");
         if (np != NULL) {
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 372d7ada1a0c..1a527625acf7 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -482,7 +482,8 @@ static void pseries_setup_rfi_flush(void)
                 if (types == L1D_FLUSH_NONE)
                         types = L1D_FLUSH_FALLBACK;
 
-                if (!(result.behaviour & H_CPU_BEHAV_L1D_FLUSH_PR))
+                if ((!(result.behaviour & H_CPU_BEHAV_L1D_FLUSH_PR)) ||
+                    (!(result.behaviour & H_CPU_BEHAV_FAVOUR_SECURITY)))
                         enable = false;
         } else {
                 /* Default to fallback if case hcall is not available */
diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c
index d9c4c9366049..091f1d0d0af1 100644
--- a/arch/powerpc/sysdev/xive/spapr.c
+++ b/arch/powerpc/sysdev/xive/spapr.c
@@ -356,7 +356,8 @@ static int xive_spapr_configure_queue(u32 target, struct xive_q *q, u8 prio,
 
         rc = plpar_int_get_queue_info(0, target, prio, &esn_page, &esn_size);
         if (rc) {
-                pr_err("Error %lld getting queue info prio %d\n", rc, prio);
+                pr_err("Error %lld getting queue info CPU %d prio %d\n", rc,
+                       target, prio);
                 rc = -EIO;
                 goto fail;
         }
@@ -370,7 +371,8 @@ static int xive_spapr_configure_queue(u32 target, struct xive_q *q, u8 prio,
         /* Configure and enable the queue in HW */
         rc = plpar_int_set_queue_config(flags, target, prio, qpage_phys, order);
         if (rc) {
-                pr_err("Error %lld setting queue for prio %d\n", rc, prio);
+                pr_err("Error %lld setting queue for CPU %d prio %d\n", rc,
+                       target, prio);
                 rc = -EIO;
         } else {
                 q->qpage = qpage;
@@ -389,8 +391,8 @@ static int xive_spapr_setup_queue(unsigned int cpu, struct xive_cpu *xc,
         if (IS_ERR(qpage))
                 return PTR_ERR(qpage);
 
-        return xive_spapr_configure_queue(cpu, q, prio, qpage,
-                                          xive_queue_shift);
+        return xive_spapr_configure_queue(get_hard_smp_processor_id(cpu),
+                                          q, prio, qpage, xive_queue_shift);
 }
 
 static void xive_spapr_cleanup_queue(unsigned int cpu, struct xive_cpu *xc,
@@ -399,10 +401,12 @@ static void xive_spapr_cleanup_queue(unsigned int cpu, struct xive_cpu *xc,
         struct xive_q *q = &xc->queue[prio];
         unsigned int alloc_order;
         long rc;
+        int hw_cpu = get_hard_smp_processor_id(cpu);
 
-        rc = plpar_int_set_queue_config(0, cpu, prio, 0, 0);
+        rc = plpar_int_set_queue_config(0, hw_cpu, prio, 0, 0);
         if (rc)
-                pr_err("Error %ld setting queue for prio %d\n", rc, prio);
+                pr_err("Error %ld setting queue for CPU %d prio %d\n", rc,
+                       hw_cpu, prio);
 
         alloc_order = xive_alloc_order(xive_queue_shift);
         free_pages((unsigned long)q->qpage, alloc_order);
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index b6722c246d9c..04807c7f64cc 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -8,7 +8,6 @@ config RISCV
         select OF
         select OF_EARLY_FLATTREE
         select OF_IRQ
-        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
         select ARCH_WANT_FRAME_POINTERS
         select CLONE_BACKWARDS
         select COMMON_CLK
@@ -20,7 +19,6 @@ config RISCV
         select GENERIC_STRNLEN_USER
         select GENERIC_SMP_IDLE_THREAD
         select GENERIC_ATOMIC64 if !64BIT || !RISCV_ISA_A
-        select ARCH_WANT_OPTIONAL_GPIOLIB
         select HAVE_MEMBLOCK
         select HAVE_MEMBLOCK_NODE_MAP
         select HAVE_DMA_API_DEBUG
@@ -34,7 +32,6 @@ config RISCV
         select HAVE_ARCH_TRACEHOOK
         select MODULES_USE_ELF_RELA if MODULES
         select THREAD_INFO_IN_TASK
-        select RISCV_IRQ_INTC
         select RISCV_TIMER
 
 config MMU
diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
index 87fc045be51f..56fa592cfa34 100644
--- a/arch/riscv/kernel/entry.S
+++ b/arch/riscv/kernel/entry.S
@@ -172,6 +172,9 @@ ENTRY(handle_exception)
         move a1, sp /* pt_regs */
         tail do_IRQ
 1:
+        /* Exceptions run with interrupts enabled */
+        csrs sstatus, SR_SIE
+
         /* Handle syscalls */
         li t0, EXC_SYSCALL
         beq s4, t0, handle_syscall
@@ -198,8 +201,6 @@ handle_syscall:
          */
         addi s2, s2, 0x4
         REG_S s2, PT_SEPC(sp)
-        /* System calls run with interrupts enabled */
-        csrs sstatus, SR_SIE
         /* Trace syscalls, but only if requested by the user. */
         REG_L t0, TASK_TI_FLAGS(tp)
         andi t0, t0, _TIF_SYSCALL_TRACE
diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S
index 226eeb190f90..6e07ed37bbff 100644
--- a/arch/riscv/kernel/head.S
+++ b/arch/riscv/kernel/head.S
@@ -64,7 +64,7 @@ ENTRY(_start)
         /* Start the kernel */
         mv a0, s0
         mv a1, s1
-        call sbi_save
+        call parse_dtb
         tail start_kernel
 
 relocate:
diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
index 09f7064e898c..c11f40c1b2a8 100644
--- a/arch/riscv/kernel/setup.c
+++ b/arch/riscv/kernel/setup.c
@@ -144,7 +144,7 @@ asmlinkage void __init setup_vm(void)
 #endif
 }
 
-void __init sbi_save(unsigned int hartid, void *dtb)
+void __init parse_dtb(unsigned int hartid, void *dtb)
 {
         early_init_dt_scan(__va(dtb));
 }
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 6bf594ace663..8767e45f1b2b 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -430,6 +430,8 @@ config SPARC_LEON
         depends on SPARC32
         select USB_EHCI_BIG_ENDIAN_MMIO
         select USB_EHCI_BIG_ENDIAN_DESC
+        select USB_UHCI_BIG_ENDIAN_MMIO
+        select USB_UHCI_BIG_ENDIAN_DESC
         ---help---
           If you say Y here if you are running on a SPARC-LEON processor.
           The LEON processor is a synthesizable VHDL model of the
diff --git a/arch/sparc/include/asm/bug.h b/arch/sparc/include/asm/bug.h
index 6f17528356b2..ea53e418f6c0 100644
--- a/arch/sparc/include/asm/bug.h
+++ b/arch/sparc/include/asm/bug.h
@@ -9,10 +9,14 @@
 void do_BUG(const char *file, int line);
 #define BUG() do {                                      \
         do_BUG(__FILE__, __LINE__);                     \
+        barrier_before_unreachable();                   \
         __builtin_trap();                               \
 } while (0)
 #else
-#define BUG()           __builtin_trap()
+#define BUG() do {                                      \
+        barrier_before_unreachable();                   \
+        __builtin_trap();                               \
+} while (0)
 #endif
 
 #define HAVE_ARCH_BUG
diff --git a/arch/x86/.gitignore b/arch/x86/.gitignore
index aff152c87cf4..5a82bac5e0bc 100644
--- a/arch/x86/.gitignore
+++ b/arch/x86/.gitignore
@@ -1,6 +1,7 @@
 boot/compressed/vmlinux
 tools/test_get_len
 tools/insn_sanity
+tools/insn_decoder_test
 purgatory/kexec-purgatory.c
 purgatory/purgatory.ro
 
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 63bf349b2b24..c1236b187824 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -423,12 +423,6 @@ config X86_MPPARSE
           For old smp systems that do not have proper acpi support. Newer systems
           (esp with 64bit cpus) with acpi support, MADT and DSDT will override it
 
-config X86_BIGSMP
-        bool "Support for big SMP systems with more than 8 CPUs"
-        depends on X86_32 && SMP
-        ---help---
-          This option is needed for the systems that have more than 8 CPUs
-
 config GOLDFISH
        def_bool y
        depends on X86_GOLDFISH
@@ -460,6 +454,12 @@ config INTEL_RDT
           Say N if unsure.
 
 if X86_32
+config X86_BIGSMP
+        bool "Support for big SMP systems with more than 8 CPUs"
+        depends on SMP
+        ---help---
+          This option is needed for the systems that have more than 8 CPUs
+
 config X86_EXTENDED_PLATFORM
         bool "Support for extended (non-PC) x86 platforms"
         default y
@@ -949,25 +949,66 @@ config MAXSMP
           Enable maximum number of CPUS and NUMA Nodes for this architecture.
           If unsure, say N.
 
+#
+# The maximum number of CPUs supported:
+#
+# The main config value is NR_CPUS, which defaults to NR_CPUS_DEFAULT,
+# and which can be configured interactively in the
+# [NR_CPUS_RANGE_BEGIN ... NR_CPUS_RANGE_END] range.
+#
+# The ranges are different on 32-bit and 64-bit kernels, depending on
+# hardware capabilities and scalability features of the kernel.
+#
+# ( If MAXSMP is enabled we just use the highest possible value and disable
+#   interactive configuration. )
+#
+
+config NR_CPUS_RANGE_BEGIN
+        int
+        default NR_CPUS_RANGE_END if MAXSMP
+        default    1 if !SMP
+        default    2
+
+config NR_CPUS_RANGE_END
+        int
+        depends on X86_32
+        default   64 if  SMP &&  X86_BIGSMP
+        default    8 if  SMP && !X86_BIGSMP
+        default    1 if !SMP
+
+config NR_CPUS_RANGE_END
+        int
+        depends on X86_64
+        default 8192 if  SMP && ( MAXSMP ||  CPUMASK_OFFSTACK)
+        default  512 if  SMP && (!MAXSMP && !CPUMASK_OFFSTACK)
+        default    1 if !SMP
+
+config NR_CPUS_DEFAULT
+        int
+        depends on X86_32
+        default   32 if  X86_BIGSMP
+        default    8 if  SMP
+        default    1 if !SMP
+
+config NR_CPUS_DEFAULT
+        int
+        depends on X86_64
+        default 8192 if  MAXSMP
+        default   64 if  SMP
+        default    1 if !SMP
+
 config NR_CPUS
         int "Maximum number of CPUs" if SMP && !MAXSMP
-        range 2 8 if SMP && X86_32 && !X86_BIGSMP
-        range 2 64 if SMP && X86_32 && X86_BIGSMP
-        range 2 512 if SMP && !MAXSMP && !CPUMASK_OFFSTACK && X86_64
-        range 2 8192 if SMP && !MAXSMP && CPUMASK_OFFSTACK && X86_64
-        default "1" if !SMP
-        default "8192" if MAXSMP
-        default "32" if SMP && X86_BIGSMP
-        default "8" if SMP && X86_32
-        default "64" if SMP
+        range NR_CPUS_RANGE_BEGIN NR_CPUS_RANGE_END
+        default NR_CPUS_DEFAULT
         ---help---
           This allows you to specify the maximum number of CPUs which this
           kernel will support.  If CPUMASK_OFFSTACK is enabled, the maximum
           supported value is 8192, otherwise the maximum value is 512.  The
           minimum value which makes sense is 2.
 
-          This is purely to save memory - each supported CPU adds
-          approximately eight kilobytes to the kernel image.
+          This is purely to save memory: each supported CPU adds about 8KB
+          to the kernel image.
 
 config SCHED_SMT
         bool "SMT (Hyperthreading) scheduler support"
@@ -1363,7 +1404,7 @@ config HIGHMEM4G
 
 config HIGHMEM64G
         bool "64GB"
-        depends on !M486
+        depends on !M486 && !M586 && !M586TSC && !M586MMX && !MGEODE_LX && !MGEODEGX1 && !MCYRIXIII && !MELAN && !MWINCHIPC6 && !WINCHIP3D && !MK6
         select X86_PAE
         ---help---
           Select this if you have a 32-bit processor and more than 4
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index 65a9a4716e34..8b8d2297d486 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -374,7 +374,7 @@ config X86_TSC
 
 config X86_CMPXCHG64
         def_bool y
-        depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM
+        depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586TSC || M586MMX || MATOM || MGEODE_LX || MGEODEGX1 || MK6 || MK7 || MK8
 
 # this should be set for all -march=.. options where the compiler
 # generates cmov.
@@ -385,7 +385,7 @@ config X86_CMOV
 config X86_MINIMUM_CPU_FAMILY
         int
         default "64" if X86_64
-        default "6" if X86_32 && X86_P6_NOP
+        default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MCRUSOE || MCORE2 || MK7 || MK8)
         default "5" if X86_32 && X86_CMPXCHG64
         default "4"
 
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index 353e20c3f114..886a9115af62 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -439,7 +439,7 @@ setup_uga32(void **uga_handle, unsigned long size, u32 *width, u32 *height)
         struct efi_uga_draw_protocol *uga = NULL, *first_uga;
         efi_guid_t uga_proto = EFI_UGA_PROTOCOL_GUID;
         unsigned long nr_ugas;
-        u32 *handles = (u32 *)uga_handle;;
+        u32 *handles = (u32 *)uga_handle;
         efi_status_t status = EFI_INVALID_PARAMETER;
         int i;
 
@@ -484,7 +484,7 @@ setup_uga64(void **uga_handle, unsigned long size, u32 *width, u32 *height)
         struct efi_uga_draw_protocol *uga = NULL, *first_uga;
         efi_guid_t uga_proto = EFI_UGA_PROTOCOL_GUID;
         unsigned long nr_ugas;
-        u64 *handles = (u64 *)uga_handle;;
+        u64 *handles = (u64 *)uga_handle;
         efi_status_t status = EFI_INVALID_PARAMETER;
         int i;
 
diff --git a/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c b/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c
index 36870b26067a..d08805032f01 100644
--- a/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c
+++ b/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c
@@ -57,10 +57,12 @@ void sha512_mb_mgr_init_avx2(struct sha512_mb_mgr *state)
 {
         unsigned int j;
 
-        state->lens[0] = 0;
-        state->lens[1] = 1;
-        state->lens[2] = 2;
-        state->lens[3] = 3;
+        /* initially all lanes are unused */
+        state->lens[0] = 0xFFFFFFFF00000000;
+        state->lens[1] = 0xFFFFFFFF00000001;
+        state->lens[2] = 0xFFFFFFFF00000002;
+        state->lens[3] = 0xFFFFFFFF00000003;
+
         state->unused_lanes = 0xFF03020100;
         for (j = 0; j < 4; j++)
                 state->ldata[j].job_in_lane = NULL;
diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
index 3f48f695d5e6..dce7092ab24a 100644
--- a/arch/x86/entry/calling.h
+++ b/arch/x86/entry/calling.h
@@ -97,80 +97,69 @@ For 32-bit we have the following conventions - kernel is built with
 
 #define SIZEOF_PTREGS   21*8
 
-        .macro ALLOC_PT_GPREGS_ON_STACK
-        addq    $-(15*8), %rsp
-        .endm
+.macro PUSH_AND_CLEAR_REGS rdx=%rdx rax=%rax
+        /*
+         * Push registers and sanitize registers of values that a
+         * speculation attack might otherwise want to exploit. The
+         * lower registers are likely clobbered well before they
+         * could be put to use in a speculative execution gadget.
+         * Interleave XOR with PUSH for better uop scheduling:
+         */
+        pushq   %rdi            /* pt_regs->di */
+        pushq   %rsi            /* pt_regs->si */
+        pushq   \rdx            /* pt_regs->dx */
+        pushq   %rcx            /* pt_regs->cx */
+        pushq   \rax            /* pt_regs->ax */
+        pushq   %r8             /* pt_regs->r8 */
+        xorq    %r8, %r8        /* nospec   r8 */
+        pushq   %r9             /* pt_regs->r9 */
+        xorq    %r9, %r9        /* nospec   r9 */
+        pushq   %r10            /* pt_regs->r10 */
+        xorq    %r10, %r10      /* nospec   r10 */
+        pushq   %r11            /* pt_regs->r11 */
+        xorq    %r11, %r11      /* nospec   r11*/
+        pushq   %rbx            /* pt_regs->rbx */
+        xorl    %ebx, %ebx      /* nospec   rbx*/
+        pushq   %rbp            /* pt_regs->rbp */
+        xorl    %ebp, %ebp      /* nospec   rbp*/
+        pushq   %r12            /* pt_regs->r12 */
+        xorq    %r12, %r12      /* nospec   r12*/
+        pushq   %r13            /* pt_regs->r13 */
+        xorq    %r13, %r13      /* nospec   r13*/
+        pushq   %r14            /* pt_regs->r14 */
+        xorq    %r14, %r14      /* nospec   r14*/
+        pushq   %r15            /* pt_regs->r15 */
+        xorq    %r15, %r15      /* nospec   r15*/
+        UNWIND_HINT_REGS
+.endm
 
-        .macro SAVE_C_REGS_HELPER offset=0 rax=1 rcx=1 r8910=1 r11=1
-        .if \r11
-        movq %r11, 6*8+\offset(%rsp)
-        .endif
-        .if \r8910
-        movq %r10, 7*8+\offset(%rsp)
-        movq %r9,  8*8+\offset(%rsp)
-        movq %r8,  9*8+\offset(%rsp)
-        .endif
-        .if \rax
-        movq %rax, 10*8+\offset(%rsp)
-        .endif
-        .if \rcx
-        movq %rcx, 11*8+\offset(%rsp)
-        .endif
-        movq %rdx, 12*8+\offset(%rsp)
-        movq %rsi, 13*8+\offset(%rsp)
-        movq %rdi, 14*8+\offset(%rsp)
-        UNWIND_HINT_REGS offset=\offset extra=0
-        .endm
-        .macro SAVE_C_REGS offset=0
-        SAVE_C_REGS_HELPER \offset, 1, 1, 1, 1
-        .endm
-        .macro SAVE_C_REGS_EXCEPT_RAX_RCX offset=0
-        SAVE_C_REGS_HELPER \offset, 0, 0, 1, 1
-        .endm
-        .macro SAVE_C_REGS_EXCEPT_R891011
-        SAVE_C_REGS_HELPER 0, 1, 1, 0, 0
-        .endm
-        .macro SAVE_C_REGS_EXCEPT_RCX_R891011
-        SAVE_C_REGS_HELPER 0, 1, 0, 0, 0
-        .endm
-        .macro SAVE_C_REGS_EXCEPT_RAX_RCX_R11
-        SAVE_C_REGS_HELPER 0, 0, 0, 1, 0
-        .endm
-
-        .macro SAVE_EXTRA_REGS offset=0
-        movq %r15, 0*8+\offset(%rsp)
-        movq %r14, 1*8+\offset(%rsp)
-        movq %r13, 2*8+\offset(%rsp)
-        movq %r12, 3*8+\offset(%rsp)
-        movq %rbp, 4*8+\offset(%rsp)
-        movq %rbx, 5*8+\offset(%rsp)
-        UNWIND_HINT_REGS offset=\offset
-        .endm
-
-        .macro POP_EXTRA_REGS
+.macro POP_REGS pop_rdi=1 skip_r11rcx=0
         popq %r15
         popq %r14
         popq %r13
         popq %r12
         popq %rbp
         popq %rbx
-        .endm
-
-        .macro POP_C_REGS
+        .if \skip_r11rcx
+        popq %rsi
+        .else
         popq %r11
+        .endif
         popq %r10
         popq %r9
         popq %r8
         popq %rax
+        .if \skip_r11rcx
+        popq %rsi
+        .else
         popq %rcx
+        .endif
         popq %rdx
         popq %rsi
+        .if \pop_rdi
         popq %rdi
-        .endm
-
-        .macro icebp
-        .byte 0xf1
-        .endm
+        .endif
+.endm
 
 /*
  * This is a sneaky trick to help the unwinder find pt_regs on the stack.  The
@@ -178,7 +167,7 @@ For 32-bit we have the following conventions - kernel is built with
  * is just setting the LSB, which makes it an invalid stack address and is also
  * a signal to the unwinder that it's a pt_regs pointer in disguise.
  *
- * NOTE: This macro must be used *after* SAVE_EXTRA_REGS because it corrupts
+ * NOTE: This macro must be used *after* PUSH_AND_CLEAR_REGS because it corrupts
  * the original rbp.
  */
 .macro ENCODE_FRAME_POINTER ptregs_offset=0
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 30c8c5344c4a..8971bd64d515 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -213,7 +213,7 @@ ENTRY(entry_SYSCALL_64)
 
         swapgs
         /*
-         * This path is not taken when PAGE_TABLE_ISOLATION is disabled so it
+         * This path is only taken when PAGE_TABLE_ISOLATION is disabled so it
          * is not required to switch CR3.
          */
         movq    %rsp, PER_CPU_VAR(rsp_scratch)
@@ -227,22 +227,8 @@ ENTRY(entry_SYSCALL_64)
         pushq   %rcx                            /* pt_regs->ip */
 GLOBAL(entry_SYSCALL_64_after_hwframe)
         pushq   %rax                            /* pt_regs->orig_ax */
-        pushq   %rdi                            /* pt_regs->di */
-        pushq   %rsi                            /* pt_regs->si */
-        pushq   %rdx                            /* pt_regs->dx */
-        pushq   %rcx                            /* pt_regs->cx */
-        pushq   $-ENOSYS                        /* pt_regs->ax */
-        pushq   %r8                             /* pt_regs->r8 */
-        pushq   %r9                             /* pt_regs->r9 */
-        pushq   %r10                            /* pt_regs->r10 */
-        pushq   %r11                            /* pt_regs->r11 */
-        pushq   %rbx                            /* pt_regs->rbx */
-        pushq   %rbp                            /* pt_regs->rbp */
-        pushq   %r12                            /* pt_regs->r12 */
-        pushq   %r13                            /* pt_regs->r13 */
-        pushq   %r14                            /* pt_regs->r14 */
-        pushq   %r15                            /* pt_regs->r15 */
-        UNWIND_HINT_REGS
+
+        PUSH_AND_CLEAR_REGS rax=$-ENOSYS
 
         TRACE_IRQS_OFF
 
@@ -321,15 +307,7 @@ GLOBAL(entry_SYSCALL_64_after_hwframe)
 syscall_return_via_sysret:
         /* rcx and r11 are already restored (see code above) */
         UNWIND_HINT_EMPTY
-        POP_EXTRA_REGS
-        popq    %rsi    /* skip r11 */
-        popq    %r10
-        popq    %r9
-        popq    %r8
-        popq    %rax
-        popq    %rsi    /* skip rcx */
-        popq    %rdx
-        popq    %rsi
+        POP_REGS pop_rdi=0 skip_r11rcx=1
 
         /*
          * Now all regs are restored except RSP and RDI.
@@ -559,9 +537,7 @@ END(irq_entries_start)
         call    switch_to_thread_stack
 1:
 
-        ALLOC_PT_GPREGS_ON_STACK
-        SAVE_C_REGS
-        SAVE_EXTRA_REGS
+        PUSH_AND_CLEAR_REGS
         ENCODE_FRAME_POINTER
 
         testb   $3, CS(%rsp)
@@ -622,15 +598,7 @@ GLOBAL(swapgs_restore_regs_and_return_to_usermode)
         ud2
 1:
 #endif
-        POP_EXTRA_REGS
-        popq    %r11
-        popq    %r10
-        popq    %r9
-        popq    %r8
-        popq    %rax
-        popq    %rcx
-        popq    %rdx
-        popq    %rsi
+        POP_REGS pop_rdi=0
 
         /*
          * The stack is now user RDI, orig_ax, RIP, CS, EFLAGS, RSP, SS.
@@ -688,8 +656,7 @@ GLOBAL(restore_regs_and_return_to_kernel)
         ud2
 1:
 #endif
-        POP_EXTRA_REGS
-        POP_C_REGS
+        POP_REGS
         addq    $8, %rsp        /* skip regs->orig_ax */
         /*
          * ARCH_HAS_MEMBARRIER_SYNC_CORE rely on IRET core serialization
@@ -908,7 +875,9 @@ ENTRY(\sym)
         pushq   $-1                             /* ORIG_RAX: no syscall to restart */
         .endif
 
-        ALLOC_PT_GPREGS_ON_STACK
+        /* Save all registers in pt_regs */
+        PUSH_AND_CLEAR_REGS
+        ENCODE_FRAME_POINTER
 
         .if \paranoid < 2
         testb   $3, CS(%rsp)                    /* If coming from userspace, switch stacks */
@@ -1121,9 +1090,7 @@ ENTRY(xen_failsafe_callback)
         addq    $0x30, %rsp
         UNWIND_HINT_IRET_REGS
         pushq   $-1 /* orig_ax = -1 => not a system call */
-        ALLOC_PT_GPREGS_ON_STACK
-        SAVE_C_REGS
-        SAVE_EXTRA_REGS
+        PUSH_AND_CLEAR_REGS
         ENCODE_FRAME_POINTER
         jmp     error_exit
 END(xen_failsafe_callback)
@@ -1163,16 +1130,13 @@ idtentry machine_check		do_mce			has_error_code=0	paranoid=1
 #endif
 
 /*
- * Save all registers in pt_regs, and switch gs if needed.
+ * Switch gs if needed.
  * Use slow, but surefire "are we in kernel?" check.
  * Return: ebx=0: need swapgs on exit, ebx=1: otherwise
  */
 ENTRY(paranoid_entry)
         UNWIND_HINT_FUNC
         cld
-        SAVE_C_REGS 8
-        SAVE_EXTRA_REGS 8
-        ENCODE_FRAME_POINTER 8
         movl    $1, %ebx
         movl    $MSR_GS_BASE, %ecx
         rdmsr
@@ -1211,21 +1175,18 @@ ENTRY(paranoid_exit)
         jmp     .Lparanoid_exit_restore
 .Lparanoid_exit_no_swapgs:
         TRACE_IRQS_IRETQ_DEBUG
+        RESTORE_CR3     scratch_reg=%rbx save_reg=%r14
 .Lparanoid_exit_restore:
         jmp restore_regs_and_return_to_kernel
 END(paranoid_exit)
 
 /*
- * Save all registers in pt_regs, and switch gs if needed.
+ * Switch gs if needed.
  * Return: EBX=0: came from user mode; EBX=1: otherwise
  */
 ENTRY(error_entry)
-        UNWIND_HINT_FUNC
+        UNWIND_HINT_REGS offset=8
         cld
-        SAVE_C_REGS 8
-        SAVE_EXTRA_REGS 8
-        ENCODE_FRAME_POINTER 8
-        xorl    %ebx, %ebx
         testb   $3, CS+8(%rsp)
         jz      .Lerror_kernelspace
 
@@ -1406,22 +1367,7 @@ ENTRY(nmi)
         pushq   1*8(%rdx)       /* pt_regs->rip */
         UNWIND_HINT_IRET_REGS
         pushq   $-1             /* pt_regs->orig_ax */
-        pushq   %rdi            /* pt_regs->di */
-        pushq   %rsi            /* pt_regs->si */
-        pushq   (%rdx)          /* pt_regs->dx */
-        pushq   %rcx            /* pt_regs->cx */
-        pushq   %rax            /* pt_regs->ax */
-        pushq   %r8             /* pt_regs->r8 */
-        pushq   %r9             /* pt_regs->r9 */
-        pushq   %r10            /* pt_regs->r10 */
-        pushq   %r11            /* pt_regs->r11 */
-        pushq   %rbx            /* pt_regs->rbx */
-        pushq   %rbp            /* pt_regs->rbp */
-        pushq   %r12            /* pt_regs->r12 */
-        pushq   %r13            /* pt_regs->r13 */
-        pushq   %r14            /* pt_regs->r14 */
-        pushq   %r15            /* pt_regs->r15 */
-        UNWIND_HINT_REGS
+        PUSH_AND_CLEAR_REGS rdx=(%rdx)
         ENCODE_FRAME_POINTER
 
         /*
@@ -1631,7 +1577,8 @@ end_repeat_nmi:
          * frame to point back to repeat_nmi.
          */
         pushq   $-1                             /* ORIG_RAX: no syscall to restart */
-        ALLOC_PT_GPREGS_ON_STACK
+        PUSH_AND_CLEAR_REGS
+        ENCODE_FRAME_POINTER
 
         /*
          * Use paranoid_entry to handle SWAPGS, but no need to use paranoid_exit
@@ -1655,8 +1602,7 @@ end_repeat_nmi:
 nmi_swapgs:
         SWAPGS_UNSAFE_STACK
 nmi_restore:
-        POP_EXTRA_REGS
-        POP_C_REGS
+        POP_REGS
 
         /*
          * Skip orig_ax and the "outermost" frame to point RSP at the "iret"
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index 98d5358e4041..fd65e016e413 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -85,15 +85,25 @@ ENTRY(entry_SYSENTER_compat)
         pushq   %rcx                    /* pt_regs->cx */
         pushq   $-ENOSYS                /* pt_regs->ax */
         pushq   $0                      /* pt_regs->r8  = 0 */
+        xorq    %r8, %r8                /* nospec   r8 */
         pushq   $0                      /* pt_regs->r9  = 0 */
+        xorq    %r9, %r9                /* nospec   r9 */
         pushq   $0                      /* pt_regs->r10 = 0 */
+        xorq    %r10, %r10              /* nospec   r10 */
         pushq   $0                      /* pt_regs->r11 = 0 */
+        xorq    %r11, %r11              /* nospec   r11 */
         pushq   %rbx                    /* pt_regs->rbx */
+        xorl    %ebx, %ebx              /* nospec   rbx */
         pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
+        xorl    %ebp, %ebp              /* nospec   rbp */
         pushq   $0                      /* pt_regs->r12 = 0 */
+        xorq    %r12, %r12              /* nospec   r12 */
         pushq   $0                      /* pt_regs->r13 = 0 */
+        xorq    %r13, %r13              /* nospec   r13 */
         pushq   $0                      /* pt_regs->r14 = 0 */
+        xorq    %r14, %r14              /* nospec   r14 */
         pushq   $0                      /* pt_regs->r15 = 0 */
+        xorq    %r15, %r15              /* nospec   r15 */
         cld
 
         /*
@@ -214,15 +224,25 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe)
         pushq   %rbp                    /* pt_regs->cx (stashed in bp) */
         pushq   $-ENOSYS                /* pt_regs->ax */
         pushq   $0                      /* pt_regs->r8  = 0 */
+        xorq    %r8, %r8                /* nospec   r8 */
         pushq   $0                      /* pt_regs->r9  = 0 */
+        xorq    %r9, %r9                /* nospec   r9 */
         pushq   $0                      /* pt_regs->r10 = 0 */
+        xorq    %r10, %r10              /* nospec   r10 */
         pushq   $0                      /* pt_regs->r11 = 0 */
+        xorq    %r11, %r11              /* nospec   r11 */
         pushq   %rbx                    /* pt_regs->rbx */
+        xorl    %ebx, %ebx              /* nospec   rbx */
         pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
+        xorl    %ebp, %ebp              /* nospec   rbp */
         pushq   $0                      /* pt_regs->r12 = 0 */
+        xorq    %r12, %r12              /* nospec   r12 */
         pushq   $0                      /* pt_regs->r13 = 0 */
+        xorq    %r13, %r13              /* nospec   r13 */
         pushq   $0                      /* pt_regs->r14 = 0 */
+        xorq    %r14, %r14              /* nospec   r14 */
         pushq   $0                      /* pt_regs->r15 = 0 */
+        xorq    %r15, %r15              /* nospec   r15 */
 
         /*
          * User mode is traced as though IRQs are on, and SYSENTER
@@ -338,15 +358,25 @@ ENTRY(entry_INT80_compat)
         pushq   %rcx                    /* pt_regs->cx */
         pushq   $-ENOSYS                /* pt_regs->ax */
         pushq   $0                      /* pt_regs->r8  = 0 */
+        xorq    %r8, %r8                /* nospec   r8 */
         pushq   $0                      /* pt_regs->r9  = 0 */
+        xorq    %r9, %r9                /* nospec   r9 */
         pushq   $0                      /* pt_regs->r10 = 0 */
+        xorq    %r10, %r10              /* nospec   r10 */
         pushq   $0                      /* pt_regs->r11 = 0 */
+        xorq    %r11, %r11              /* nospec   r11 */
         pushq   %rbx                    /* pt_regs->rbx */
+        xorl    %ebx, %ebx              /* nospec   rbx */
         pushq   %rbp                    /* pt_regs->rbp */
+        xorl    %ebp, %ebp              /* nospec   rbp */
         pushq   %r12                    /* pt_regs->r12 */
+        xorq    %r12, %r12              /* nospec   r12 */
         pushq   %r13                    /* pt_regs->r13 */
+        xorq    %r13, %r13              /* nospec   r13 */
         pushq   %r14                    /* pt_regs->r14 */
+        xorq    %r14, %r14              /* nospec   r14 */
         pushq   %r15                    /* pt_regs->r15 */
+        xorq    %r15, %r15              /* nospec   r15 */
         cld
 
         /*
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 731153a4681e..56457cb73448 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3559,7 +3559,7 @@ static int intel_snb_pebs_broken(int cpu)
                 break;
 
         case INTEL_FAM6_SANDYBRIDGE_X:
-                switch (cpu_data(cpu).x86_mask) {
+                switch (cpu_data(cpu).x86_stepping) {
                 case 6: rev = 0x618; break;
                 case 7: rev = 0x70c; break;
                 }
diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
index ae64d0b69729..cf372b90557e 100644
--- a/arch/x86/events/intel/lbr.c
+++ b/arch/x86/events/intel/lbr.c
@@ -1186,7 +1186,7 @@ void __init intel_pmu_lbr_init_atom(void)
          * on PMU interrupt
          */
         if (boot_cpu_data.x86_model == 28
-            && boot_cpu_data.x86_mask < 10) {
+            && boot_cpu_data.x86_stepping < 10) {
                 pr_cont("LBR disabled due to erratum");
                 return;
         }
diff --git a/arch/x86/events/intel/p6.c b/arch/x86/events/intel/p6.c
index a5604c352930..408879b0c0d4 100644
--- a/arch/x86/events/intel/p6.c
+++ b/arch/x86/events/intel/p6.c
@@ -234,7 +234,7 @@ static __initconst const struct x86_pmu p6_pmu = {
 
 static __init void p6_pmu_rdpmc_quirk(void)
 {
-        if (boot_cpu_data.x86_mask < 9) {
+        if (boot_cpu_data.x86_stepping < 9) {
                 /*
                  * PPro erratum 26; fixed in stepping 9 and above.
                  */
diff --git a/arch/x86/include/asm/acpi.h b/arch/x86/include/asm/acpi.h
index 44f5d79d5105..11881726ed37 100644
--- a/arch/x86/include/asm/acpi.h
+++ b/arch/x86/include/asm/acpi.h
@@ -94,7 +94,7 @@ static inline unsigned int acpi_processor_cstate_check(unsigned int max_cstate)
         if (boot_cpu_data.x86 == 0x0F &&
             boot_cpu_data.x86_vendor == X86_VENDOR_AMD &&
             boot_cpu_data.x86_model <= 0x05 &&
-            boot_cpu_data.x86_mask < 0x0A)
+            boot_cpu_data.x86_stepping < 0x0A)
                 return 1;
         else if (boot_cpu_has(X86_BUG_AMD_APIC_C1E))
                 return 1;
diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
index 30d406146016..e1259f043ae9 100644
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -40,7 +40,7 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 
         asm ("cmp %1,%2; sbb %0,%0;"
                         :"=r" (mask)
-                        :"r"(size),"r" (index)
+                        :"g"(size),"r" (index)
                         :"cc");
         return mask;
 }
diff --git a/arch/x86/include/asm/bug.h b/arch/x86/include/asm/bug.h
index 34d99af43994..6804d6642767 100644
--- a/arch/x86/include/asm/bug.h
+++ b/arch/x86/include/asm/bug.h
@@ -5,23 +5,20 @@
 #include <linux/stringify.h>
 
 /*
- * Since some emulators terminate on UD2, we cannot use it for WARN.
- * Since various instruction decoders disagree on the length of UD1,
- * we cannot use it either. So use UD0 for WARN.
+ * Despite that some emulators terminate on UD2, we use it for WARN().
  *
- * (binutils knows about "ud1" but {en,de}codes it as 2 bytes, whereas
- *  our kernel decoder thinks it takes a ModRM byte, which seems consistent
- *  with various things like the Intel SDM instruction encoding rules)
+ * Since various instruction decoders/specs disagree on the encoding of
+ * UD0/UD1.
  */
 
-#define ASM_UD0         ".byte 0x0f, 0xff"
+#define ASM_UD0         ".byte 0x0f, 0xff" /* + ModRM (for Intel) */
 #define ASM_UD1         ".byte 0x0f, 0xb9" /* + ModRM */
 #define ASM_UD2         ".byte 0x0f, 0x0b"
 
 #define INSN_UD0        0xff0f
 #define INSN_UD2        0x0b0f
 
-#define LEN_UD0         2
+#define LEN_UD2         2
 
 #ifdef CONFIG_GENERIC_BUG
 
@@ -77,7 +74,11 @@ do {								\
         unreachable();                                          \
 } while (0)
 
-#define __WARN_FLAGS(flags)     _BUG_FLAGS(ASM_UD0, BUGFLAG_WARNING|(flags))
+#define __WARN_FLAGS(flags)                                     \
+do {                                                            \
+        _BUG_FLAGS(ASM_UD2, BUGFLAG_WARNING|(flags));           \
+        annotate_reachable();                                   \
+} while (0)
 
 #include <asm-generic/bug.h>
 
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 70eddb3922ff..736771c9822e 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -148,45 +148,46 @@ extern void clear_cpu_cap(struct cpuinfo_x86 *c, unsigned int bit);
  */
 static __always_inline __pure bool _static_cpu_has(u16 bit)
 {
-                asm_volatile_goto("1: jmp 6f\n"
-                         "2:\n"
-                         ".skip -(((5f-4f) - (2b-1b)) > 0) * "
-                                 "((5f-4f) - (2b-1b)),0x90\n"
-                         "3:\n"
-                         ".section .altinstructions,\"a\"\n"
-                         " .long 1b - .\n"              /* src offset */
-                         " .long 4f - .\n"              /* repl offset */
-                         " .word %P1\n"                 /* always replace */
-                         " .byte 3b - 1b\n"             /* src len */
-                         " .byte 5f - 4f\n"             /* repl len */
-                         " .byte 3b - 2b\n"             /* pad len */
-                         ".previous\n"
-                         ".section .altinstr_replacement,\"ax\"\n"
-                         "4: jmp %l[t_no]\n"
-                         "5:\n"
-                         ".previous\n"
-                         ".section .altinstructions,\"a\"\n"
-                         " .long 1b - .\n"              /* src offset */
-                         " .long 0\n"                   /* no replacement */
-                         " .word %P0\n"                 /* feature bit */
-                         " .byte 3b - 1b\n"             /* src len */
-                         " .byte 0\n"                   /* repl len */
-                         " .byte 0\n"                   /* pad len */
-                         ".previous\n"
-                         ".section .altinstr_aux,\"ax\"\n"
-                         "6:\n"
-                         " testb %[bitnum],%[cap_byte]\n"
-                         " jnz %l[t_yes]\n"
-                         " jmp %l[t_no]\n"
-                         ".previous\n"
-                         : : "i" (bit), "i" (X86_FEATURE_ALWAYS),
-                             [bitnum] "i" (1 << (bit & 7)),
-                             [cap_byte] "m" (((const char *)boot_cpu_data.x86_capability)[bit >> 3])
-                         : : t_yes, t_no);
-        t_yes:
-                return true;
-        t_no:
-                return false;
+        asm_volatile_goto("1: jmp 6f\n"
+                 "2:\n"
+                 ".skip -(((5f-4f) - (2b-1b)) > 0) * "
+                         "((5f-4f) - (2b-1b)),0x90\n"
+                 "3:\n"
+                 ".section .altinstructions,\"a\"\n"
+                 " .long 1b - .\n"              /* src offset */
+                 " .long 4f - .\n"              /* repl offset */
+                 " .word %P[always]\n"          /* always replace */
+                 " .byte 3b - 1b\n"             /* src len */
+                 " .byte 5f - 4f\n"             /* repl len */
+                 " .byte 3b - 2b\n"             /* pad len */
+                 ".previous\n"
+                 ".section .altinstr_replacement,\"ax\"\n"
+                 "4: jmp %l[t_no]\n"
+                 "5:\n"
+                 ".previous\n"
+                 ".section .altinstructions,\"a\"\n"
+                 " .long 1b - .\n"              /* src offset */
+                 " .long 0\n"                   /* no replacement */
+                 " .word %P[feature]\n"         /* feature bit */
+                 " .byte 3b - 1b\n"             /* src len */
+                 " .byte 0\n"                   /* repl len */
+                 " .byte 0\n"                   /* pad len */
+                 ".previous\n"
+                 ".section .altinstr_aux,\"ax\"\n"
+                 "6:\n"
+                 " testb %[bitnum],%[cap_byte]\n"
+                 " jnz %l[t_yes]\n"
+                 " jmp %l[t_no]\n"
+                 ".previous\n"
+                 : : [feature]  "i" (bit),
+                     [always]   "i" (X86_FEATURE_ALWAYS),
+                     [bitnum]   "i" (1 << (bit & 7)),
+                     [cap_byte] "m" (((const char *)boot_cpu_data.x86_capability)[bit >> 3])
+                 : : t_yes, t_no);
+t_yes:
+        return true;
+t_no:
+        return false;
 }
 
 #define static_cpu_has(bit)                                     \
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index 4d57894635f2..81a1be326571 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -6,6 +6,7 @@
 #include <asm/alternative.h>
 #include <asm/alternative-asm.h>
 #include <asm/cpufeatures.h>
+#include <asm/msr-index.h>
 
 #ifdef __ASSEMBLY__
 
@@ -164,11 +165,53 @@ static inline void vmexit_fill_RSB(void)
 
 static inline void indirect_branch_prediction_barrier(void)
 {
-        alternative_input("",
-                          "call __ibp_barrier",
-                          X86_FEATURE_USE_IBPB,
-                          ASM_NO_INPUT_CLOBBER("eax", "ecx", "edx", "memory"));
+        asm volatile(ALTERNATIVE("",
+                                 "movl %[msr], %%ecx\n\t"
+                                 "movl %[val], %%eax\n\t"
+                                 "movl $0, %%edx\n\t"
+                                 "wrmsr",
+                                 X86_FEATURE_USE_IBPB)
+                     : : [msr] "i" (MSR_IA32_PRED_CMD),
+                         [val] "i" (PRED_CMD_IBPB)
+                     : "eax", "ecx", "edx", "memory");
 }
 
 #endif /* __ASSEMBLY__ */
+
+/*
+ * Below is used in the eBPF JIT compiler and emits the byte sequence
+ * for the following assembly:
+ *
+ * With retpolines configured:
+ *
+ *    callq do_rop
+ *  spec_trap:
+ *    pause
+ *    lfence
+ *    jmp spec_trap
+ *  do_rop:
+ *    mov %rax,(%rsp)
+ *    retq
+ *
+ * Without retpolines configured:
+ *
+ *    jmp *%rax
+ */
+#ifdef CONFIG_RETPOLINE
+# define RETPOLINE_RAX_BPF_JIT_SIZE     17
+# define RETPOLINE_RAX_BPF_JIT()                                \
+        EMIT1_off32(0xE8, 7);    /* callq do_rop */             \
+        /* spec_trap: */                                        \
+        EMIT2(0xF3, 0x90);       /* pause */                    \
+        EMIT3(0x0F, 0xAE, 0xE8); /* lfence */                   \
+        EMIT2(0xEB, 0xF9);       /* jmp spec_trap */            \
+        /* do_rop: */                                           \
+        EMIT4(0x48, 0x89, 0x04, 0x24); /* mov %rax,(%rsp) */    \
+        EMIT1(0xC3);             /* retq */
+#else
+# define RETPOLINE_RAX_BPF_JIT_SIZE     2
+# define RETPOLINE_RAX_BPF_JIT()                                \
+        EMIT2(0xFF, 0xE0);       /* jmp *%rax */
+#endif
+
 #endif /* _ASM_X86_NOSPEC_BRANCH_H_ */
diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
index 4baa6bceb232..d652a3808065 100644
--- a/arch/x86/include/asm/page_64.h
+++ b/arch/x86/include/asm/page_64.h
@@ -52,10 +52,6 @@ static inline void clear_page(void *page)
 
 void copy_page(void *to, void *from);
 
-#ifdef CONFIG_X86_MCE
-#define arch_unmap_kpfn arch_unmap_kpfn
-#endif
-
 #endif  /* !__ASSEMBLY__ */
 
 #ifdef CONFIG_X86_VSYSCALL_EMULATION
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index 892df375b615..554841fab717 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -297,9 +297,9 @@ static inline void __flush_tlb_global(void)
 {
         PVOP_VCALL0(pv_mmu_ops.flush_tlb_kernel);
 }
-static inline void __flush_tlb_single(unsigned long addr)
+static inline void __flush_tlb_one_user(unsigned long addr)
 {
-        PVOP_VCALL1(pv_mmu_ops.flush_tlb_single, addr);
+        PVOP_VCALL1(pv_mmu_ops.flush_tlb_one_user, addr);
 }
 
 static inline void flush_tlb_others(const struct cpumask *cpumask,
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
index 6ec54d01972d..f624f1f10316 100644
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -217,7 +217,7 @@ struct pv_mmu_ops {
         /* TLB operations */
         void (*flush_tlb_user)(void);
         void (*flush_tlb_kernel)(void);
-        void (*flush_tlb_single)(unsigned long addr);
+        void (*flush_tlb_one_user)(unsigned long addr);
         void (*flush_tlb_others)(const struct cpumask *cpus,
                                  const struct flush_tlb_info *info);
 
diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
index e67c0620aec2..e55466760ff8 100644
--- a/arch/x86/include/asm/pgtable_32.h
+++ b/arch/x86/include/asm/pgtable_32.h
@@ -61,7 +61,7 @@ void paging_init(void);
 #define kpte_clear_flush(ptep, vaddr)           \
 do {                                            \
         pte_clear(&init_mm, (vaddr), (ptep));   \
-        __flush_tlb_one((vaddr));               \
+        __flush_tlb_one_kernel((vaddr));                \
 } while (0)
 
 #endif /* !__ASSEMBLY__ */
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 793bae7e7ce3..1bd9ed87606f 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -91,7 +91,7 @@ struct cpuinfo_x86 {
         __u8                    x86;            /* CPU family */
         __u8                    x86_vendor;     /* CPU vendor */
         __u8                    x86_model;
-        __u8                    x86_mask;
+        __u8                    x86_stepping;
 #ifdef CONFIG_X86_64
         /* Number of 4K pages in DTLB/ITLB combined(in pages): */
         int                     x86_tlbsize;
@@ -109,7 +109,7 @@ struct cpuinfo_x86 {
         char                    x86_vendor_id[16];
         char                    x86_model_id[64];
         /* in KB - valid for CPUS which support this call: */
-        int                     x86_cache_size;
+        unsigned int            x86_cache_size;
         int                     x86_cache_alignment;    /* In bytes */
         /* Cache QoS architectural values: */
         int                     x86_cache_max_rmid;     /* max index */
@@ -977,7 +977,4 @@ bool xen_set_default_idle(void);
 
 void stop_this_cpu(void *dummy);
 void df_debug(struct pt_regs *regs, long error_code);
-
-void __ibp_barrier(void);
-
 #endif /* _ASM_X86_PROCESSOR_H */
diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
index 461f53d27708..a4189762b266 100644
--- a/arch/x86/include/asm/smp.h
+++ b/arch/x86/include/asm/smp.h
@@ -129,6 +129,7 @@ static inline void arch_send_call_function_ipi_mask(const struct cpumask *mask)
 void cpu_disable_common(void);
 void native_smp_prepare_boot_cpu(void);
 void native_smp_prepare_cpus(unsigned int max_cpus);
+void calculate_max_logical_packages(void);
 void native_smp_cpus_done(unsigned int max_cpus);
 void common_cpu_up(unsigned int cpunum, struct task_struct *tidle);
 int native_cpu_up(unsigned int cpunum, struct task_struct *tidle);
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index 2b8f18ca5874..84137c22fdfa 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -140,7 +140,7 @@ static inline unsigned long build_cr3_noflush(pgd_t *pgd, u16 asid)
 #else
 #define __flush_tlb() __native_flush_tlb()
 #define __flush_tlb_global() __native_flush_tlb_global()
-#define __flush_tlb_single(addr) __native_flush_tlb_single(addr)
+#define __flush_tlb_one_user(addr) __native_flush_tlb_one_user(addr)
 #endif
 
 static inline bool tlb_defer_switch_to_init_mm(void)
@@ -400,7 +400,7 @@ static inline void __native_flush_tlb_global(void)
 /*
  * flush one page in the user mapping
  */
-static inline void __native_flush_tlb_single(unsigned long addr)
+static inline void __native_flush_tlb_one_user(unsigned long addr)
 {
         u32 loaded_mm_asid = this_cpu_read(cpu_tlbstate.loaded_mm_asid);
 
@@ -437,18 +437,31 @@ static inline void __flush_tlb_all(void)
 /*
  * flush one page in the kernel mapping
  */
-static inline void __flush_tlb_one(unsigned long addr)
+static inline void __flush_tlb_one_kernel(unsigned long addr)
 {
         count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ONE);
-        __flush_tlb_single(addr);
+
+        /*
+         * If PTI is off, then __flush_tlb_one_user() is just INVLPG or its
+         * paravirt equivalent.  Even with PCID, this is sufficient: we only
+         * use PCID if we also use global PTEs for the kernel mapping, and
+         * INVLPG flushes global translations across all address spaces.
+         *
+         * If PTI is on, then the kernel is mapped with non-global PTEs, and
+         * __flush_tlb_one_user() will flush the given address for the current
+         * kernel address space and for its usermode counterpart, but it does
+         * not flush it for other address spaces.
+         */
+        __flush_tlb_one_user(addr);
 
         if (!static_cpu_has(X86_FEATURE_PTI))
                 return;
 
         /*
-         * __flush_tlb_single() will have cleared the TLB entry for this ASID,
-         * but since kernel space is replicated across all, we must also
-         * invalidate all others.
+         * See above.  We need to propagate the flush to all other address
+         * spaces.  In principle, we only need to propagate it to kernelmode
+         * address spaces, but the extra bookkeeping we would need is not
+         * worth it.
          */
         invalidate_other_asid();
 }
diff --git a/arch/x86/include/uapi/asm/hyperv.h b/arch/x86/include/uapi/asm/hyperv.h
index 197c2e6c7376..099414345865 100644
--- a/arch/x86/include/uapi/asm/hyperv.h
+++ b/arch/x86/include/uapi/asm/hyperv.h
@@ -241,24 +241,24 @@
 #define HV_X64_MSR_REENLIGHTENMENT_CONTROL      0x40000106
 
 struct hv_reenlightenment_control {
-        u64 vector:8;
-        u64 reserved1:8;
-        u64 enabled:1;
-        u64 reserved2:15;
-        u64 target_vp:32;
+        __u64 vector:8;
+        __u64 reserved1:8;
+        __u64 enabled:1;
+        __u64 reserved2:15;
+        __u64 target_vp:32;
 };
 
 #define HV_X64_MSR_TSC_EMULATION_CONTROL        0x40000107
 #define HV_X64_MSR_TSC_EMULATION_STATUS         0x40000108
 
 struct hv_tsc_emulation_control {
-        u64 enabled:1;
-        u64 reserved:63;
+        __u64 enabled:1;
+        __u64 reserved:63;
 };
 
 struct hv_tsc_emulation_status {
-        u64 inprogress:1;
-        u64 reserved:63;
+        __u64 inprogress:1;
+        __u64 reserved:63;
 };
 
 #define HV_X64_MSR_HYPERCALL_ENABLE             0x00000001
diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
index 6db28f17ff28..c88e0b127810 100644
--- a/arch/x86/kernel/amd_nb.c
+++ b/arch/x86/kernel/amd_nb.c
@@ -235,7 +235,7 @@ int amd_cache_northbridges(void)
         if (boot_cpu_data.x86 == 0x10 &&
             boot_cpu_data.x86_model >= 0x8 &&
             (boot_cpu_data.x86_model > 0x9 ||
-             boot_cpu_data.x86_mask >= 0x1))
+             boot_cpu_data.x86_stepping >= 0x1))
                 amd_northbridges.flags |= AMD_NB_L3_INDEX_DISABLE;
 
         if (boot_cpu_data.x86 == 0x15)
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 25ddf02598d2..b203af0855b5 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -546,7 +546,7 @@ static DEFINE_PER_CPU(struct clock_event_device, lapic_events);
 
 static u32 hsx_deadline_rev(void)
 {
-        switch (boot_cpu_data.x86_mask) {
+        switch (boot_cpu_data.x86_stepping) {
         case 0x02: return 0x3a; /* EP */
         case 0x04: return 0x0f; /* EX */
         }
@@ -556,7 +556,7 @@ static u32 hsx_deadline_rev(void)
 
 static u32 bdx_deadline_rev(void)
 {
-        switch (boot_cpu_data.x86_mask) {
+        switch (boot_cpu_data.x86_stepping) {
         case 0x02: return 0x00000011;
         case 0x03: return 0x0700000e;
         case 0x04: return 0x0f00000c;
@@ -568,7 +568,7 @@ static u32 bdx_deadline_rev(void)
 
 static u32 skx_deadline_rev(void)
 {
-        switch (boot_cpu_data.x86_mask) {
+        switch (boot_cpu_data.x86_stepping) {
         case 0x03: return 0x01000136;
         case 0x04: return 0x02000014;
         }
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
index 3cc471beb50b..bb6f7a2148d7 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -134,21 +134,40 @@ static void apic_update_vector(struct irq_data *irqd, unsigned int newvec,
 {
         struct apic_chip_data *apicd = apic_chip_data(irqd);
         struct irq_desc *desc = irq_data_to_desc(irqd);
+        bool managed = irqd_affinity_is_managed(irqd);
 
         lockdep_assert_held(&vector_lock);
 
         trace_vector_update(irqd->irq, newvec, newcpu, apicd->vector,
                             apicd->cpu);
 
-        /* Setup the vector move, if required  */
-        if (apicd->vector && cpu_online(apicd->cpu)) {
+        /*
+         * If there is no vector associated or if the associated vector is
+         * the shutdown vector, which is associated to make PCI/MSI
+         * shutdown mode work, then there is nothing to release. Clear out
+         * prev_vector for this and the offlined target case.
+         */
+        apicd->prev_vector = 0;
+        if (!apicd->vector || apicd->vector == MANAGED_IRQ_SHUTDOWN_VECTOR)
+                goto setnew;
+        /*
+         * If the target CPU of the previous vector is online, then mark
+         * the vector as move in progress and store it for cleanup when the
+         * first interrupt on the new vector arrives. If the target CPU is
+         * offline then the regular release mechanism via the cleanup
+         * vector is not possible and the vector can be immediately freed
+         * in the underlying matrix allocator.
+         */
+        if (cpu_online(apicd->cpu)) {
                 apicd->move_in_progress = true;
                 apicd->prev_vector = apicd->vector;
                 apicd->prev_cpu = apicd->cpu;
         } else {
-                apicd->prev_vector = 0;
+                irq_matrix_free(vector_matrix, apicd->cpu, apicd->vector,
+                                managed);
         }
 
+setnew:
         apicd->vector = newvec;
         apicd->cpu = newcpu;
         BUG_ON(!IS_ERR_OR_NULL(per_cpu(vector_irq, newcpu)[newvec]));
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 46b675aaf20b..f11910b44638 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -1176,16 +1176,25 @@ static void __init decode_gam_rng_tbl(unsigned long ptr)
 
         uv_gre_table = gre;
         for (; gre->type != UV_GAM_RANGE_TYPE_UNUSED; gre++) {
+                unsigned long size = ((unsigned long)(gre->limit - lgre)
+                                        << UV_GAM_RANGE_SHFT);
+                int order = 0;
+                char suffix[] = " KMGTPE";
+
+                while (size > 9999 && order < sizeof(suffix)) {
+                        size /= 1024;
+                        order++;
+                }
+
                 if (!index) {
                         pr_info("UV: GAM Range Table...\n");
                         pr_info("UV:  # %20s %14s %5s %4s %5s %3s %2s\n", "Range", "", "Size", "Type", "NASID", "SID", "PN");
                 }
-                pr_info("UV: %2d: 0x%014lx-0x%014lx %5luG %3d   %04x  %02x %02x\n",
+                pr_info("UV: %2d: 0x%014lx-0x%014lx %5lu%c %3d   %04x  %02x %02x\n",
                         index++,
                         (unsigned long)lgre << UV_GAM_RANGE_SHFT,
                         (unsigned long)gre->limit << UV_GAM_RANGE_SHFT,
-                        ((unsigned long)(gre->limit - lgre)) >>
-                                (30 - UV_GAM_RANGE_SHFT), /* 64M -> 1G */
+                        size, suffix[order],
                         gre->type, gre->nasid, gre->sockid, gre->pnode);
 
                 lgre = gre->limit;
diff --git a/arch/x86/kernel/asm-offsets_32.c b/arch/x86/kernel/asm-offsets_32.c
index fa1261eefa16..f91ba53e06c8 100644
--- a/arch/x86/kernel/asm-offsets_32.c
+++ b/arch/x86/kernel/asm-offsets_32.c
@@ -18,7 +18,7 @@ void foo(void)
         OFFSET(CPUINFO_x86, cpuinfo_x86, x86);
         OFFSET(CPUINFO_x86_vendor, cpuinfo_x86, x86_vendor);
         OFFSET(CPUINFO_x86_model, cpuinfo_x86, x86_model);
-        OFFSET(CPUINFO_x86_mask, cpuinfo_x86, x86_mask);
+        OFFSET(CPUINFO_x86_stepping, cpuinfo_x86, x86_stepping);
         OFFSET(CPUINFO_cpuid_level, cpuinfo_x86, cpuid_level);
         OFFSET(CPUINFO_x86_capability, cpuinfo_x86, x86_capability);
         OFFSET(CPUINFO_x86_vendor_id, cpuinfo_x86, x86_vendor_id);
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 5bddbdcbc4a3..f0e6456ca7d3 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -119,7 +119,7 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
                 return;
         }
 
-        if (c->x86_model == 6 && c->x86_mask == 1) {
+        if (c->x86_model == 6 && c->x86_stepping == 1) {
                 const int K6_BUG_LOOP = 1000000;
                 int n;
                 void (*f_vide)(void);
@@ -149,7 +149,7 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
 
         /* K6 with old style WHCR */
         if (c->x86_model < 8 ||
-           (c->x86_model == 8 && c->x86_mask < 8)) {
+           (c->x86_model == 8 && c->x86_stepping < 8)) {
                 /* We can only write allocate on the low 508Mb */
                 if (mbytes > 508)
                         mbytes = 508;
@@ -168,7 +168,7 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
                 return;
         }
 
-        if ((c->x86_model == 8 && c->x86_mask > 7) ||
+        if ((c->x86_model == 8 && c->x86_stepping > 7) ||
              c->x86_model == 9 || c->x86_model == 13) {
                 /* The more serious chips .. */
 
@@ -221,7 +221,7 @@ static void init_amd_k7(struct cpuinfo_x86 *c)
          * are more robust with CLK_CTL set to 200xxxxx instead of 600xxxxx
          * As per AMD technical note 27212 0.2
          */
-        if ((c->x86_model == 8 && c->x86_mask >= 1) || (c->x86_model > 8)) {
+        if ((c->x86_model == 8 && c->x86_stepping >= 1) || (c->x86_model > 8)) {
                 rdmsr(MSR_K7_CLK_CTL, l, h);
                 if ((l & 0xfff00000) != 0x20000000) {
                         pr_info("CPU: CLK_CTL MSR was %x. Reprogramming to %x\n",
@@ -241,12 +241,12 @@ static void init_amd_k7(struct cpuinfo_x86 *c)
          * but they are not certified as MP capable.
          */
         /* Athlon 660/661 is valid. */
-        if ((c->x86_model == 6) && ((c->x86_mask == 0) ||
-            (c->x86_mask == 1)))
+        if ((c->x86_model == 6) && ((c->x86_stepping == 0) ||
+            (c->x86_stepping == 1)))
                 return;
 
         /* Duron 670 is valid */
-        if ((c->x86_model == 7) && (c->x86_mask == 0))
+        if ((c->x86_model == 7) && (c->x86_stepping == 0))
                 return;
 
         /*
@@ -256,8 +256,8 @@ static void init_amd_k7(struct cpuinfo_x86 *c)
          * See http://www.heise.de/newsticker/data/jow-18.10.01-000 for
          * more.
          */
-        if (((c->x86_model == 6) && (c->x86_mask >= 2)) ||
-            ((c->x86_model == 7) && (c->x86_mask >= 1)) ||
+        if (((c->x86_model == 6) && (c->x86_stepping >= 2)) ||
+            ((c->x86_model == 7) && (c->x86_stepping >= 1)) ||
              (c->x86_model > 7))
                 if (cpu_has(c, X86_FEATURE_MP))
                         return;
@@ -628,7 +628,7 @@ static void early_init_amd(struct cpuinfo_x86 *c)
         /*  Set MTRR capability flag if appropriate */
         if (c->x86 == 5)
                 if (c->x86_model == 13 || c->x86_model == 9 ||
-                    (c->x86_model == 8 && c->x86_mask >= 8))
+                    (c->x86_model == 8 && c->x86_stepping >= 8))
                         set_cpu_cap(c, X86_FEATURE_K6_MTRR);
 #endif
 #if defined(CONFIG_X86_LOCAL_APIC) && defined(CONFIG_PCI)
@@ -795,7 +795,7 @@ static void init_amd_zn(struct cpuinfo_x86 *c)
          * Fix erratum 1076: CPB feature bit not being set in CPUID. It affects
          * all up to and including B1.
          */
-        if (c->x86_model <= 1 && c->x86_mask <= 1)
+        if (c->x86_model <= 1 && c->x86_stepping <= 1)
                 set_cpu_cap(c, X86_FEATURE_CPB);
 }
 
@@ -906,11 +906,11 @@ static unsigned int amd_size_cache(struct cpuinfo_x86 *c, unsigned int size)
         /* AMD errata T13 (order #21922) */
         if ((c->x86 == 6)) {
                 /* Duron Rev A0 */
-                if (c->x86_model == 3 && c->x86_mask == 0)
+                if (c->x86_model == 3 && c->x86_stepping == 0)
                         size = 64;
                 /* Tbird rev A1/A2 */
                 if (c->x86_model == 4 &&
-                        (c->x86_mask == 0 || c->x86_mask == 1))
+                        (c->x86_stepping == 0 || c->x86_stepping == 1))
                         size = 256;
         }
         return size;
@@ -1047,7 +1047,7 @@ static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum)
         }
 
         /* OSVW unavailable or ID unknown, match family-model-stepping range */
-        ms = (cpu->x86_model << 4) | cpu->x86_mask;
+        ms = (cpu->x86_model << 4) | cpu->x86_stepping;
         while ((range = *erratum++))
                 if ((cpu->x86 == AMD_MODEL_RANGE_FAMILY(range)) &&
                     (ms >= AMD_MODEL_RANGE_START(range)) &&
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 71949bf2de5a..d71c8b54b696 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -162,8 +162,7 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
         if (cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
                 return SPECTRE_V2_CMD_NONE;
         else {
-                ret = cmdline_find_option(boot_command_line, "spectre_v2", arg,
-                                          sizeof(arg));
+                ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, sizeof(arg));
                 if (ret < 0)
                         return SPECTRE_V2_CMD_AUTO;
 
@@ -175,8 +174,7 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
                 }
 
                 if (i >= ARRAY_SIZE(mitigation_options)) {
-                        pr_err("unknown option (%s). Switching to AUTO select\n",
-                               mitigation_options[i].option);
+                        pr_err("unknown option (%s). Switching to AUTO select\n", arg);
                         return SPECTRE_V2_CMD_AUTO;
                 }
         }
@@ -185,8 +183,7 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
              cmd == SPECTRE_V2_CMD_RETPOLINE_AMD ||
              cmd == SPECTRE_V2_CMD_RETPOLINE_GENERIC) &&
             !IS_ENABLED(CONFIG_RETPOLINE)) {
-                pr_err("%s selected but not compiled in. Switching to AUTO select\n",
-                       mitigation_options[i].option);
+                pr_err("%s selected but not compiled in. Switching to AUTO select\n", mitigation_options[i].option);
                 return SPECTRE_V2_CMD_AUTO;
         }
 
@@ -256,14 +253,14 @@ static void __init spectre_v2_select_mitigation(void)
                         goto retpoline_auto;
                 break;
         }
-        pr_err("kernel not compiled with retpoline; no mitigation available!");
+        pr_err("Spectre mitigation: kernel not compiled with retpoline; no mitigation available!");
         return;
 
 retpoline_auto:
         if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) {
         retpoline_amd:
                 if (!boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) {
-                        pr_err("LFENCE not serializing. Switching to generic retpoline\n");
+                        pr_err("Spectre mitigation: LFENCE not serializing, switching to generic retpoline\n");
                         goto retpoline_generic;
                 }
                 mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_AMD :
@@ -281,7 +278,7 @@ retpoline_auto:
         pr_info("%s\n", spectre_v2_strings[mode]);
 
         /*
-         * If neither SMEP or KPTI are available, there is a risk of
+         * If neither SMEP nor PTI are available, there is a risk of
          * hitting userspace addresses in the RSB after a context switch
          * from a shallow call stack to a deeper one. To prevent this fill
          * the entire RSB, even when using IBRS.
@@ -295,21 +292,20 @@ retpoline_auto:
         if ((!boot_cpu_has(X86_FEATURE_PTI) &&
              !boot_cpu_has(X86_FEATURE_SMEP)) || is_skylake_era()) {
                 setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
-                pr_info("Filling RSB on context switch\n");
+                pr_info("Spectre v2 mitigation: Filling RSB on context switch\n");
         }
 
         /* Initialize Indirect Branch Prediction Barrier if supported */
         if (boot_cpu_has(X86_FEATURE_IBPB)) {
                 setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
-                pr_info("Enabling Indirect Branch Prediction Barrier\n");
+                pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n");
         }
 }
 
 #undef pr_fmt
 
 #ifdef CONFIG_SYSFS
-ssize_t cpu_show_meltdown(struct device *dev,
-                          struct device_attribute *attr, char *buf)
+ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf)
 {
         if (!boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN))
                 return sprintf(buf, "Not affected\n");
@@ -318,16 +314,14 @@ ssize_t cpu_show_meltdown(struct device *dev,
         return sprintf(buf, "Vulnerable\n");
 }
 
-ssize_t cpu_show_spectre_v1(struct device *dev,
-                            struct device_attribute *attr, char *buf)
+ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, char *buf)
 {
         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V1))
                 return sprintf(buf, "Not affected\n");
         return sprintf(buf, "Mitigation: __user pointer sanitization\n");
 }
 
-ssize_t cpu_show_spectre_v2(struct device *dev,
-                            struct device_attribute *attr, char *buf)
+ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, char *buf)
 {
         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
                 return sprintf(buf, "Not affected\n");
@@ -337,9 +331,3 @@ ssize_t cpu_show_spectre_v2(struct device *dev,
                        spectre_v2_module_string());
 }
 #endif
-
-void __ibp_barrier(void)
-{
-        __wrmsr(MSR_IA32_PRED_CMD, PRED_CMD_IBPB, 0);
-}
-EXPORT_SYMBOL_GPL(__ibp_barrier);
diff --git a/arch/x86/kernel/cpu/centaur.c b/arch/x86/kernel/cpu/centaur.c
index c578cd29c2d2..e5ec0f11c0de 100644
--- a/arch/x86/kernel/cpu/centaur.c
+++ b/arch/x86/kernel/cpu/centaur.c
@@ -140,7 +140,7 @@ static void init_centaur(struct cpuinfo_x86 *c)
                         clear_cpu_cap(c, X86_FEATURE_TSC);
                         break;
                 case 8:
-                        switch (c->x86_mask) {
+                        switch (c->x86_stepping) {
                         default:
                         name = "2";
                                 break;
@@ -215,7 +215,7 @@ centaur_size_cache(struct cpuinfo_x86 *c, unsigned int size)
          *  - Note, it seems this may only be in engineering samples.
          */
         if ((c->x86 == 6) && (c->x86_model == 9) &&
-                                (c->x86_mask == 1) && (size == 65))
+                                (c->x86_stepping == 1) && (size == 65))
                 size -= 1;
         return size;
 }
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index d63f4b5706e4..824aee0117bb 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -731,7 +731,7 @@ void cpu_detect(struct cpuinfo_x86 *c)
                 cpuid(0x00000001, &tfms, &misc, &junk, &cap0);
                 c->x86          = x86_family(tfms);
                 c->x86_model    = x86_model(tfms);
-                c->x86_mask     = x86_stepping(tfms);
+                c->x86_stepping = x86_stepping(tfms);
 
                 if (cap0 & (1<<19)) {
                         c->x86_clflush_size = ((misc >> 8) & 0xff) * 8;
@@ -1184,9 +1184,9 @@ static void identify_cpu(struct cpuinfo_x86 *c)
         int i;
 
         c->loops_per_jiffy = loops_per_jiffy;
-        c->x86_cache_size = -1;
+        c->x86_cache_size = 0;
         c->x86_vendor = X86_VENDOR_UNKNOWN;
-        c->x86_model = c->x86_mask = 0; /* So far unknown... */
+        c->x86_model = c->x86_stepping = 0;     /* So far unknown... */
         c->x86_vendor_id[0] = '\0'; /* Unset */
         c->x86_model_id[0] = '\0';  /* Unset */
         c->x86_max_cores = 1;
@@ -1378,8 +1378,8 @@ void print_cpu_info(struct cpuinfo_x86 *c)
 
         pr_cont(" (family: 0x%x, model: 0x%x", c->x86, c->x86_model);
 
-        if (c->x86_mask || c->cpuid_level >= 0)
-                pr_cont(", stepping: 0x%x)\n", c->x86_mask);
+        if (c->x86_stepping || c->cpuid_level >= 0)
+                pr_cont(", stepping: 0x%x)\n", c->x86_stepping);
         else
                 pr_cont(")\n");
 }
diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
index 6b4bb335641f..8949b7ae6d92 100644
--- a/arch/x86/kernel/cpu/cyrix.c
+++ b/arch/x86/kernel/cpu/cyrix.c
@@ -215,7 +215,7 @@ static void init_cyrix(struct cpuinfo_x86 *c)
 
         /* common case step number/rev -- exceptions handled below */
         c->x86_model = (dir1 >> 4) + 1;
-        c->x86_mask = dir1 & 0xf;
+        c->x86_stepping = dir1 & 0xf;
 
         /* Now cook; the original recipe is by Channing Corn, from Cyrix.
          * We do the same thing for each generation: we work out
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 319bf989fad1..d19e903214b4 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -116,14 +116,13 @@ struct sku_microcode {
         u32 microcode;
 };
 static const struct sku_microcode spectre_bad_microcodes[] = {
-        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0B,   0x84 },
-        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0A,   0x84 },
-        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x09,   0x84 },
-        { INTEL_FAM6_KABYLAKE_MOBILE,   0x0A,   0x84 },
-        { INTEL_FAM6_KABYLAKE_MOBILE,   0x09,   0x84 },
+        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0B,   0x80 },
+        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0A,   0x80 },
+        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x09,   0x80 },
+        { INTEL_FAM6_KABYLAKE_MOBILE,   0x0A,   0x80 },
+        { INTEL_FAM6_KABYLAKE_MOBILE,   0x09,   0x80 },
         { INTEL_FAM6_SKYLAKE_X,         0x03,   0x0100013e },
         { INTEL_FAM6_SKYLAKE_X,         0x04,   0x0200003c },
-        { INTEL_FAM6_SKYLAKE_MOBILE,    0x03,   0xc2 },
         { INTEL_FAM6_SKYLAKE_DESKTOP,   0x03,   0xc2 },
         { INTEL_FAM6_BROADWELL_CORE,    0x04,   0x28 },
         { INTEL_FAM6_BROADWELL_GT3E,    0x01,   0x1b },
@@ -136,8 +135,6 @@ static const struct sku_microcode spectre_bad_microcodes[] = {
         { INTEL_FAM6_HASWELL_X,         0x02,   0x3b },
         { INTEL_FAM6_HASWELL_X,         0x04,   0x10 },
         { INTEL_FAM6_IVYBRIDGE_X,       0x04,   0x42a },
-        /* Updated in the 20180108 release; blacklist until we know otherwise */
-        { INTEL_FAM6_ATOM_GEMINI_LAKE,  0x01,   0x22 },
         /* Observed in the wild */
         { INTEL_FAM6_SANDYBRIDGE_X,     0x06,   0x61b },
         { INTEL_FAM6_SANDYBRIDGE_X,     0x07,   0x712 },
@@ -149,7 +146,7 @@ static bool bad_spectre_microcode(struct cpuinfo_x86 *c)
 
         for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) {
                 if (c->x86_model == spectre_bad_microcodes[i].model &&
-                    c->x86_mask == spectre_bad_microcodes[i].stepping)
+                    c->x86_stepping == spectre_bad_microcodes[i].stepping)
                         return (c->microcode <= spectre_bad_microcodes[i].microcode);
         }
         return false;
@@ -196,7 +193,7 @@ static void early_init_intel(struct cpuinfo_x86 *c)
          * need the microcode to have already been loaded... so if it is
          * not, recommend a BIOS update and disable large pages.
          */
-        if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_mask <= 2 &&
+        if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_stepping <= 2 &&
             c->microcode < 0x20e) {
                 pr_warn("Atom PSE erratum detected, BIOS microcode update recommended\n");
                 clear_cpu_cap(c, X86_FEATURE_PSE);
@@ -212,7 +209,7 @@ static void early_init_intel(struct cpuinfo_x86 *c)
 
         /* CPUID workaround for 0F33/0F34 CPU */
         if (c->x86 == 0xF && c->x86_model == 0x3
-            && (c->x86_mask == 0x3 || c->x86_mask == 0x4))
+            && (c->x86_stepping == 0x3 || c->x86_stepping == 0x4))
                 c->x86_phys_bits = 36;
 
         /*
@@ -310,7 +307,7 @@ int ppro_with_ram_bug(void)
         if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
             boot_cpu_data.x86 == 6 &&
             boot_cpu_data.x86_model == 1 &&
-            boot_cpu_data.x86_mask < 8) {
+            boot_cpu_data.x86_stepping < 8) {
                 pr_info("Pentium Pro with Errata#50 detected. Taking evasive action.\n");
                 return 1;
         }
@@ -327,7 +324,7 @@ static void intel_smp_check(struct cpuinfo_x86 *c)
          * Mask B, Pentium, but not Pentium MMX
          */
         if (c->x86 == 5 &&
-            c->x86_mask >= 1 && c->x86_mask <= 4 &&
+            c->x86_stepping >= 1 && c->x86_stepping <= 4 &&
             c->x86_model <= 3) {
                 /*
                  * Remember we have B step Pentia with bugs
@@ -370,7 +367,7 @@ static void intel_workarounds(struct cpuinfo_x86 *c)
          * SEP CPUID bug: Pentium Pro reports SEP but doesn't have it until
          * model 3 mask 3
          */
-        if ((c->x86<<8 | c->x86_model<<4 | c->x86_mask) < 0x633)
+        if ((c->x86<<8 | c->x86_model<<4 | c->x86_stepping) < 0x633)
                 clear_cpu_cap(c, X86_FEATURE_SEP);
 
         /*
@@ -388,7 +385,7 @@ static void intel_workarounds(struct cpuinfo_x86 *c)
          * P4 Xeon erratum 037 workaround.
          * Hardware prefetcher may cause stale data to be loaded into the cache.
          */
-        if ((c->x86 == 15) && (c->x86_model == 1) && (c->x86_mask == 1)) {
+        if ((c->x86 == 15) && (c->x86_model == 1) && (c->x86_stepping == 1)) {
                 if (msr_set_bit(MSR_IA32_MISC_ENABLE,
                                 MSR_IA32_MISC_ENABLE_PREFETCH_DISABLE_BIT) > 0) {
                         pr_info("CPU: C0 stepping P4 Xeon detected.\n");
@@ -403,7 +400,7 @@ static void intel_workarounds(struct cpuinfo_x86 *c)
          * Specification Update").
          */
         if (boot_cpu_has(X86_FEATURE_APIC) && (c->x86<<8 | c->x86_model<<4) == 0x520 &&
-            (c->x86_mask < 0x6 || c->x86_mask == 0xb))
+            (c->x86_stepping < 0x6 || c->x86_stepping == 0xb))
                 set_cpu_bug(c, X86_BUG_11AP);
 
 
@@ -650,7 +647,7 @@ static void init_intel(struct cpuinfo_x86 *c)
                 case 6:
                         if (l2 == 128)
                                 p = "Celeron (Mendocino)";
-                        else if (c->x86_mask == 0 || c->x86_mask == 5)
+                        else if (c->x86_stepping == 0 || c->x86_stepping == 5)
                                 p = "Celeron-A";
                         break;
 
diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c
index 410629f10ad3..589b948e6e01 100644
--- a/arch/x86/kernel/cpu/intel_rdt.c
+++ b/arch/x86/kernel/cpu/intel_rdt.c
@@ -819,7 +819,7 @@ static __init void rdt_quirks(void)
                         cache_alloc_hsw_probe();
                 break;
         case INTEL_FAM6_SKYLAKE_X:
-                if (boot_cpu_data.x86_mask <= 4)
+                if (boot_cpu_data.x86_stepping <= 4)
                         set_rdt_options("!cmt,!mbmtotal,!mbmlocal,!l3cat");
         }
 }
diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
index bdab7d2f51af..fca759d272a1 100644
--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
@@ -1804,6 +1804,7 @@ static int rdtgroup_mkdir_ctrl_mon(struct kernfs_node *parent_kn,
                 goto out_common_fail;
         }
         closid = ret;
+        ret = 0;
 
         rdtgrp->closid = closid;
         list_add(&rdtgrp->rdtgroup_list, &rdt_all_groups);
diff --git a/arch/x86/kernel/cpu/mcheck/mce-internal.h b/arch/x86/kernel/cpu/mcheck/mce-internal.h
index aa0d5df9dc60..e956eb267061 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-internal.h
+++ b/arch/x86/kernel/cpu/mcheck/mce-internal.h
@@ -115,4 +115,19 @@ static inline void mce_unregister_injector_chain(struct notifier_block *nb)	{ }
 
 extern struct mca_config mca_cfg;
 
+#ifndef CONFIG_X86_64
+/*
+ * On 32-bit systems it would be difficult to safely unmap a poison page
+ * from the kernel 1:1 map because there are no non-canonical addresses that
+ * we can use to refer to the address without risking a speculative access.
+ * However, this isn't much of an issue because:
+ * 1) Few unmappable pages are in the 1:1 map. Most are in HIGHMEM which
+ *    are only mapped into the kernel as needed
+ * 2) Few people would run a 32-bit kernel on a machine that supports
+ *    recoverable errors because they have too much memory to boot 32-bit.
+ */
+static inline void mce_unmap_kpfn(unsigned long pfn) {}
+#define mce_unmap_kpfn mce_unmap_kpfn
+#endif
+
 #endif /* __X86_MCE_INTERNAL_H__ */
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 3a8e88a611eb..8ff94d1e2dce 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -105,6 +105,10 @@ static struct irq_work mce_irq_work;
 
 static void (*quirk_no_way_out)(int bank, struct mce *m, struct pt_regs *regs);
 
+#ifndef mce_unmap_kpfn
+static void mce_unmap_kpfn(unsigned long pfn);
+#endif
+
 /*
  * CPU/chipset specific EDAC code can register a notifier call here to print
  * MCE errors in a human-readable form.
@@ -234,7 +238,7 @@ static void __print_mce(struct mce *m)
                         m->cs, m->ip);
 
                 if (m->cs == __KERNEL_CS)
-                        pr_cont("{%pS}", (void *)m->ip);
+                        pr_cont("{%pS}", (void *)(unsigned long)m->ip);
                 pr_cont("\n");
         }
 
@@ -590,7 +594,8 @@ static int srao_decode_notifier(struct notifier_block *nb, unsigned long val,
 
         if (mce_usable_address(mce) && (mce->severity == MCE_AO_SEVERITY)) {
                 pfn = mce->addr >> PAGE_SHIFT;
-                memory_failure(pfn, 0);
+                if (!memory_failure(pfn, 0))
+                        mce_unmap_kpfn(pfn);
         }
 
         return NOTIFY_OK;
@@ -1057,12 +1062,13 @@ static int do_memory_failure(struct mce *m)
         ret = memory_failure(m->addr >> PAGE_SHIFT, flags);
         if (ret)
                 pr_err("Memory error not recovered");
+        else
+                mce_unmap_kpfn(m->addr >> PAGE_SHIFT);
         return ret;
 }
 
-#if defined(arch_unmap_kpfn) && defined(CONFIG_MEMORY_FAILURE)
-
-void arch_unmap_kpfn(unsigned long pfn)
+#ifndef mce_unmap_kpfn
+static void mce_unmap_kpfn(unsigned long pfn)
 {
         unsigned long decoy_addr;
 
@@ -1073,7 +1079,7 @@ void arch_unmap_kpfn(unsigned long pfn)
          * We would like to just call:
          *      set_memory_np((unsigned long)pfn_to_kaddr(pfn), 1);
          * but doing that would radically increase the odds of a
-         * speculative access to the posion page because we'd have
+         * speculative access to the poison page because we'd have
          * the virtual address of the kernel 1:1 mapping sitting
          * around in registers.
          * Instead we get tricky.  We create a non-canonical address
@@ -1098,7 +1104,6 @@ void arch_unmap_kpfn(unsigned long pfn)
 
         if (set_memory_np(decoy_addr, 1))
                 pr_warn("Could not invalidate pfn=0x%lx from 1:1 map\n", pfn);
-
 }
 #endif
 
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index f7c55b0e753a..a15db2b4e0d6 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -921,7 +921,7 @@ static bool is_blacklisted(unsigned int cpu)
          */
         if (c->x86 == 6 &&
             c->x86_model == INTEL_FAM6_BROADWELL_X &&
-            c->x86_mask == 0x01 &&
+            c->x86_stepping == 0x01 &&
             llc_size_per_core > 2621440 &&
             c->microcode < 0x0b000021) {
                 pr_err_once("Erratum BDF90: late loading with revision < 0x0b000021 (0x%x) disabled.\n", c->microcode);
@@ -944,7 +944,7 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device,
                 return UCODE_NFOUND;
 
         sprintf(name, "intel-ucode/%02x-%02x-%02x",
-                c->x86, c->x86_model, c->x86_mask);
+                c->x86, c->x86_model, c->x86_stepping);
 
         if (request_firmware_direct(&firmware, name, device)) {
                 pr_debug("data file %s load failed\n", name);
@@ -982,7 +982,7 @@ static struct microcode_ops microcode_intel_ops = {
 
 static int __init calc_llc_size_per_core(struct cpuinfo_x86 *c)
 {
-        u64 llc_size = c->x86_cache_size * 1024;
+        u64 llc_size = c->x86_cache_size * 1024ULL;
 
         do_div(llc_size, c->x86_max_cores);
 
diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
index fdc55215d44d..e12ee86906c6 100644
--- a/arch/x86/kernel/cpu/mtrr/generic.c
+++ b/arch/x86/kernel/cpu/mtrr/generic.c
@@ -859,7 +859,7 @@ int generic_validate_add_page(unsigned long base, unsigned long size,
          */
         if (is_cpu(INTEL) && boot_cpu_data.x86 == 6 &&
             boot_cpu_data.x86_model == 1 &&
-            boot_cpu_data.x86_mask <= 7) {
+            boot_cpu_data.x86_stepping <= 7) {
                 if (base & ((1 << (22 - PAGE_SHIFT)) - 1)) {
                         pr_warn("mtrr: base(0x%lx000) is not 4 MiB aligned\n", base);
                         return -EINVAL;
diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
index 40d5a8a75212..7468de429087 100644
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -711,8 +711,8 @@ void __init mtrr_bp_init(void)
                         if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
                             boot_cpu_data.x86 == 0xF &&
                             boot_cpu_data.x86_model == 0x3 &&
-                            (boot_cpu_data.x86_mask == 0x3 ||
-                             boot_cpu_data.x86_mask == 0x4))
+                            (boot_cpu_data.x86_stepping == 0x3 ||
+                             boot_cpu_data.x86_stepping == 0x4))
                                 phys_addr = 36;
 
                         size_or_mask = SIZE_OR_MASK_BITS(phys_addr);
diff --git a/arch/x86/kernel/cpu/proc.c b/arch/x86/kernel/cpu/proc.c
index e7ecedafa1c8..2c8522a39ed5 100644
--- a/arch/x86/kernel/cpu/proc.c
+++ b/arch/x86/kernel/cpu/proc.c
@@ -72,8 +72,8 @@ static int show_cpuinfo(struct seq_file *m, void *v)
                    c->x86_model,
                    c->x86_model_id[0] ? c->x86_model_id : "unknown");
 
-        if (c->x86_mask || c->cpuid_level >= 0)
-                seq_printf(m, "stepping\t: %d\n", c->x86_mask);
+        if (c->x86_stepping || c->cpuid_level >= 0)
+                seq_printf(m, "stepping\t: %d\n", c->x86_stepping);
         else
                 seq_puts(m, "stepping\t: unknown\n");
         if (c->microcode)
@@ -91,8 +91,8 @@ static int show_cpuinfo(struct seq_file *m, void *v)
         }
 
         /* Cache size */
-        if (c->x86_cache_size >= 0)
-                seq_printf(m, "cache size\t: %d KB\n", c->x86_cache_size);
+        if (c->x86_cache_size)
+                seq_printf(m, "cache size\t: %u KB\n", c->x86_cache_size);
 
         show_cpuinfo_core(m, c, cpu);
         show_cpuinfo_misc(m, c);
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index c29020907886..b59e4fb40fd9 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -37,7 +37,7 @@
 #define X86             new_cpu_data+CPUINFO_x86
 #define X86_VENDOR      new_cpu_data+CPUINFO_x86_vendor
 #define X86_MODEL       new_cpu_data+CPUINFO_x86_model
-#define X86_MASK        new_cpu_data+CPUINFO_x86_mask
+#define X86_STEPPING    new_cpu_data+CPUINFO_x86_stepping
 #define X86_HARD_MATH   new_cpu_data+CPUINFO_hard_math
 #define X86_CPUID       new_cpu_data+CPUINFO_cpuid_level
 #define X86_CAPABILITY  new_cpu_data+CPUINFO_x86_capability
@@ -332,7 +332,7 @@ ENTRY(startup_32_smp)
         shrb $4,%al
         movb %al,X86_MODEL
         andb $0x0f,%cl          # mask mask revision
-        movb %cl,X86_MASK
+        movb %cl,X86_STEPPING
         movl %edx,X86_CAPABILITY
 
 .Lis486:
diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
index 1f790cf9d38f..3b7427aa7d85 100644
--- a/arch/x86/kernel/machine_kexec_64.c
+++ b/arch/x86/kernel/machine_kexec_64.c
@@ -542,6 +542,7 @@ int arch_kexec_apply_relocations_add(const Elf64_Ehdr *ehdr,
                                 goto overflow;
                         break;
                 case R_X86_64_PC32:
+                case R_X86_64_PLT32:
                         value -= (u64)address;
                         *(u32 *)location = value;
                         break;
diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
index da0c160e5589..f58336af095c 100644
--- a/arch/x86/kernel/module.c
+++ b/arch/x86/kernel/module.c
@@ -191,6 +191,7 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
                                 goto overflow;
                         break;
                 case R_X86_64_PC32:
+                case R_X86_64_PLT32:
                         if (*(u32 *)loc != 0)
                                 goto invalid_relocation;
                         val -= (u64)loc;
diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
index 27d0a1712663..f1c5eb99d445 100644
--- a/arch/x86/kernel/mpparse.c
+++ b/arch/x86/kernel/mpparse.c
@@ -410,7 +410,7 @@ static inline void __init construct_default_ISA_mptable(int mpc_default_type)
         processor.apicver = mpc_default_type > 4 ? 0x10 : 0x01;
         processor.cpuflag = CPU_ENABLED;
         processor.cpufeature = (boot_cpu_data.x86 << 8) |
-            (boot_cpu_data.x86_model << 4) | boot_cpu_data.x86_mask;
+            (boot_cpu_data.x86_model << 4) | boot_cpu_data.x86_stepping;
         processor.featureflag = boot_cpu_data.x86_capability[CPUID_1_EDX];
         processor.reserved[0] = 0;
         processor.reserved[1] = 0;
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index 041096bdef86..99dc79e76bdc 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -200,9 +200,9 @@ static void native_flush_tlb_global(void)
         __native_flush_tlb_global();
 }
 
-static void native_flush_tlb_single(unsigned long addr)
+static void native_flush_tlb_one_user(unsigned long addr)
 {
-        __native_flush_tlb_single(addr);
+        __native_flush_tlb_one_user(addr);
 }
 
 struct static_key paravirt_steal_enabled;
@@ -401,7 +401,7 @@ struct pv_mmu_ops pv_mmu_ops __ro_after_init = {
 
         .flush_tlb_user = native_flush_tlb,
         .flush_tlb_kernel = native_flush_tlb_global,
-        .flush_tlb_single = native_flush_tlb_single,
+        .flush_tlb_one_user = native_flush_tlb_one_user,
         .flush_tlb_others = native_flush_tlb_others,
 
         .pgd_alloc = __paravirt_pgd_alloc,
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 6f27facbaa9b..ff99e2b6fc54 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1281,11 +1281,10 @@ void __init native_smp_prepare_boot_cpu(void)
         cpu_set_state_online(me);
 }
 
-void __init native_smp_cpus_done(unsigned int max_cpus)
+void __init calculate_max_logical_packages(void)
 {
         int ncpus;
 
-        pr_debug("Boot done\n");
         /*
          * Today neither Intel nor AMD support heterogenous systems so
          * extrapolate the boot cpu's data to all packages.
@@ -1293,6 +1292,13 @@ void __init native_smp_cpus_done(unsigned int max_cpus)
         ncpus = cpu_data(0).booted_cores * topology_max_smt_threads();
         __max_logical_packages = DIV_ROUND_UP(nr_cpu_ids, ncpus);
         pr_info("Max logical packages: %u\n", __max_logical_packages);
+}
+
+void __init native_smp_cpus_done(unsigned int max_cpus)
+{
+        pr_debug("Boot done\n");
+
+        calculate_max_logical_packages();
 
         if (x86_has_numa_in_package)
                 set_sched_topology(x86_numa_in_package_topology);
@@ -1430,8 +1436,8 @@ static void remove_siblinginfo(int cpu)
         cpumask_clear(cpu_llc_shared_mask(cpu));
         cpumask_clear(topology_sibling_cpumask(cpu));
         cpumask_clear(topology_core_cpumask(cpu));
-        c->phys_proc_id = 0;
         c->cpu_core_id = 0;
+        c->booted_cores = 0;
         cpumask_clear_cpu(cpu, cpu_sibling_setup_mask);
         recompute_smt_state();
 }
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 446c9ef8cfc3..3d9b2308e7fa 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -181,7 +181,7 @@ int fixup_bug(struct pt_regs *regs, int trapnr)
                 break;
 
         case BUG_TRAP_TYPE_WARN:
-                regs->ip += LEN_UD0;
+                regs->ip += LEN_UD2;
                 return 1;
         }
 
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 8eca1d04aeb8..46ff304140c7 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -5080,7 +5080,7 @@ void kvm_mmu_uninit_vm(struct kvm *kvm)
 typedef bool (*slot_level_handler) (struct kvm *kvm, struct kvm_rmap_head *rmap_head);
 
 /* The caller should hold mmu-lock before calling this function. */
-static bool
+static __always_inline bool
 slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot,
                         slot_level_handler fn, int start_level, int end_level,
                         gfn_t start_gfn, gfn_t end_gfn, bool lock_flush_tlb)
@@ -5110,7 +5110,7 @@ slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot,
         return flush;
 }
 
-static bool
+static __always_inline bool
 slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                   slot_level_handler fn, int start_level, int end_level,
                   bool lock_flush_tlb)
@@ -5121,7 +5121,7 @@ slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                         lock_flush_tlb);
 }
 
-static bool
+static __always_inline bool
 slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                       slot_level_handler fn, bool lock_flush_tlb)
 {
@@ -5129,7 +5129,7 @@ slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                                  PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
 }
 
-static bool
+static __always_inline bool
 slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                         slot_level_handler fn, bool lock_flush_tlb)
 {
@@ -5137,7 +5137,7 @@ slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                                  PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
 }
 
-static bool
+static __always_inline bool
 slot_handle_leaf(struct kvm *kvm, struct kvm_memory_slot *memslot,
                  slot_level_handler fn, bool lock_flush_tlb)
 {
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index f427723dc7db..3dec126aa302 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -10136,7 +10136,10 @@ static void nested_get_vmcs12_pages(struct kvm_vcpu *vcpu,
                         (unsigned long)(vmcs12->posted_intr_desc_addr &
                         (PAGE_SIZE - 1)));
         }
-        if (!nested_vmx_prepare_msr_bitmap(vcpu, vmcs12))
+        if (nested_vmx_prepare_msr_bitmap(vcpu, vmcs12))
+                vmcs_set_bits(CPU_BASED_VM_EXEC_CONTROL,
+                              CPU_BASED_USE_MSR_BITMAPS);
+        else
                 vmcs_clear_bits(CPU_BASED_VM_EXEC_CONTROL,
                                 CPU_BASED_USE_MSR_BITMAPS);
 }
@@ -10224,8 +10227,8 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,
          *    updated to reflect this when L1 (or its L2s) actually write to
          *    the MSR.
          */
-        bool pred_cmd = msr_write_intercepted_l01(vcpu, MSR_IA32_PRED_CMD);
-        bool spec_ctrl = msr_write_intercepted_l01(vcpu, MSR_IA32_SPEC_CTRL);
+        bool pred_cmd = !msr_write_intercepted_l01(vcpu, MSR_IA32_PRED_CMD);
+        bool spec_ctrl = !msr_write_intercepted_l01(vcpu, MSR_IA32_SPEC_CTRL);
 
         /* Nothing to do if the MSR bitmap is not in use.  */
         if (!cpu_has_vmx_msr_bitmap() ||
diff --git a/arch/x86/lib/cpu.c b/arch/x86/lib/cpu.c
index d6f848d1211d..2dd1fe13a37b 100644
--- a/arch/x86/lib/cpu.c
+++ b/arch/x86/lib/cpu.c
@@ -18,7 +18,7 @@ unsigned int x86_model(unsigned int sig)
 {
         unsigned int fam, model;
 
-         fam = x86_family(sig);
+        fam = x86_family(sig);
 
         model = (sig >> 4) & 0xf;
 
diff --git a/arch/x86/lib/error-inject.c b/arch/x86/lib/error-inject.c
index 7b881d03d0dd..3cdf06128d13 100644
--- a/arch/x86/lib/error-inject.c
+++ b/arch/x86/lib/error-inject.c
@@ -7,6 +7,7 @@ asmlinkage void just_return_func(void);
 
 asm(
         ".type just_return_func, @function\n"
+        ".globl just_return_func\n"
         "just_return_func:\n"
         "       ret\n"
         ".size just_return_func, .-just_return_func\n"
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 1ab42c852069..8b72923f1d35 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -256,7 +256,7 @@ static void __set_pte_vaddr(pud_t *pud, unsigned long vaddr, pte_t new_pte)
          * It's enough to flush this one mapping.
          * (PGE mappings get flushed as well)
          */
-        __flush_tlb_one(vaddr);
+        __flush_tlb_one_kernel(vaddr);
 }
 
 void set_pte_vaddr_p4d(p4d_t *p4d_page, unsigned long vaddr, pte_t new_pte)
@@ -1193,8 +1193,8 @@ void __init mem_init(void)
         register_page_bootmem_info();
 
         /* Register memory areas for /proc/kcore */
-        kclist_add(&kcore_vsyscall, (void *)VSYSCALL_ADDR,
-                         PAGE_SIZE, KCORE_OTHER);
+        if (get_gate_vma(&init_mm))
+                kclist_add(&kcore_vsyscall, (void *)VSYSCALL_ADDR, PAGE_SIZE, KCORE_USER);
 
         mem_init_print_info(NULL);
 }
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index c45b6ec5357b..e2db83bebc3b 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -820,5 +820,5 @@ void __init __early_set_fixmap(enum fixed_addresses idx,
                 set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
         else
                 pte_clear(&init_mm, addr, pte);
-        __flush_tlb_one(addr);
+        __flush_tlb_one_kernel(addr);
 }
diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c
index 58477ec3d66d..7c8686709636 100644
--- a/arch/x86/mm/kmmio.c
+++ b/arch/x86/mm/kmmio.c
@@ -168,7 +168,7 @@ static int clear_page_presence(struct kmmio_fault_page *f, bool clear)
                 return -1;
         }
 
-        __flush_tlb_one(f->addr);
+        __flush_tlb_one_kernel(f->addr);
         return 0;
 }
 
diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
index c3c5274410a9..9bb7f0ab9fe6 100644
--- a/arch/x86/mm/pgtable_32.c
+++ b/arch/x86/mm/pgtable_32.c
@@ -63,7 +63,7 @@ void set_pte_vaddr(unsigned long vaddr, pte_t pteval)
          * It's enough to flush this one mapping.
          * (PGE mappings get flushed as well)
          */
-        __flush_tlb_one(vaddr);
+        __flush_tlb_one_kernel(vaddr);
 }
 
 unsigned long __FIXADDR_TOP = 0xfffff000;
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 8dcc0607f805..7f1a51399674 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -498,7 +498,7 @@ static void flush_tlb_func_common(const struct flush_tlb_info *f,
          *    flush that changes context.tlb_gen from 2 to 3.  If they get
          *    processed on this CPU in reverse order, we'll see
          *     local_tlb_gen == 1, mm_tlb_gen == 3, and end != TLB_FLUSH_ALL.
-         *    If we were to use __flush_tlb_single() and set local_tlb_gen to
+         *    If we were to use __flush_tlb_one_user() and set local_tlb_gen to
          *    3, we'd be break the invariant: we'd update local_tlb_gen above
          *    1 without the full flush that's needed for tlb_gen 2.
          *
@@ -519,7 +519,7 @@ static void flush_tlb_func_common(const struct flush_tlb_info *f,
 
                 addr = f->start;
                 while (addr < f->end) {
-                        __flush_tlb_single(addr);
+                        __flush_tlb_one_user(addr);
                         addr += PAGE_SIZE;
                 }
                 if (local)
@@ -666,7 +666,7 @@ static void do_kernel_range_flush(void *info)
 
         /* flush range by one by one 'invlpg' */
         for (addr = f->start; addr < f->end; addr += PAGE_SIZE)
-                __flush_tlb_one(addr);
+                __flush_tlb_one_kernel(addr);
 }
 
 void flush_tlb_kernel_range(unsigned long start, unsigned long end)
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 4923d92f918d..45e4eb5bcbb2 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -13,6 +13,7 @@
 #include <linux/if_vlan.h>
 #include <asm/cacheflush.h>
 #include <asm/set_memory.h>
+#include <asm/nospec-branch.h>
 #include <linux/bpf.h>
 
 /*
@@ -290,7 +291,7 @@ static void emit_bpf_tail_call(u8 **pprog)
         EMIT2(0x89, 0xD2);                        /* mov edx, edx */
         EMIT3(0x39, 0x56,                         /* cmp dword ptr [rsi + 16], edx */
               offsetof(struct bpf_array, map.max_entries));
-#define OFFSET1 43 /* number of bytes to jump */
+#define OFFSET1 (41 + RETPOLINE_RAX_BPF_JIT_SIZE) /* number of bytes to jump */
         EMIT2(X86_JBE, OFFSET1);                  /* jbe out */
         label1 = cnt;
 
@@ -299,7 +300,7 @@ static void emit_bpf_tail_call(u8 **pprog)
          */
         EMIT2_off32(0x8B, 0x85, 36);              /* mov eax, dword ptr [rbp + 36] */
         EMIT3(0x83, 0xF8, MAX_TAIL_CALL_CNT);     /* cmp eax, MAX_TAIL_CALL_CNT */
-#define OFFSET2 32
+#define OFFSET2 (30 + RETPOLINE_RAX_BPF_JIT_SIZE)
         EMIT2(X86_JA, OFFSET2);                   /* ja out */
         label2 = cnt;
         EMIT3(0x83, 0xC0, 0x01);                  /* add eax, 1 */
@@ -313,7 +314,7 @@ static void emit_bpf_tail_call(u8 **pprog)
          *   goto out;
          */
         EMIT3(0x48, 0x85, 0xC0);                  /* test rax,rax */
-#define OFFSET3 10
+#define OFFSET3 (8 + RETPOLINE_RAX_BPF_JIT_SIZE)
         EMIT2(X86_JE, OFFSET3);                   /* je out */
         label3 = cnt;
 
@@ -326,7 +327,7 @@ static void emit_bpf_tail_call(u8 **pprog)
          * rdi == ctx (1st arg)
          * rax == prog->bpf_func + prologue_size
          */
-        EMIT2(0xFF, 0xE0);                        /* jmp rax */
+        RETPOLINE_RAX_BPF_JIT();
 
         /* out: */
         BUILD_BUG_ON(cnt - label1 != OFFSET1);
diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
index 174c59774cc9..a7a7677265b6 100644
--- a/arch/x86/oprofile/nmi_int.c
+++ b/arch/x86/oprofile/nmi_int.c
@@ -460,7 +460,7 @@ static int nmi_setup(void)
                 goto fail;
 
         for_each_possible_cpu(cpu) {
-                if (!cpu)
+                if (!IS_ENABLED(CONFIG_SMP) || !cpu)
                         continue;
 
                 memcpy(per_cpu(cpu_msrs, cpu).counters,
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index c2e9285d1bf1..db77e087adaf 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -299,7 +299,7 @@ static void bau_process_message(struct msg_desc *mdp, struct bau_control *bcp,
                 local_flush_tlb();
                 stat->d_alltlb++;
         } else {
-                __flush_tlb_single(msg->address);
+                __flush_tlb_one_user(msg->address);
                 stat->d_onetlb++;
         }
         stat->d_requestee++;
diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
index 5d73c443e778..220e97841e49 100644
--- a/arch/x86/tools/relocs.c
+++ b/arch/x86/tools/relocs.c
@@ -770,9 +770,12 @@ static int do_reloc64(struct section *sec, Elf_Rel *rel, ElfW(Sym) *sym,
                 break;
 
         case R_X86_64_PC32:
+        case R_X86_64_PLT32:
                 /*
                  * PC relative relocations don't need to be adjusted unless
                  * referencing a percpu symbol.
+                 *
+                 * NB: R_X86_64_PLT32 can be treated as R_X86_64_PC32.
                  */
                 if (is_percpu_sym(sym, symname))
                         add_reloc(&relocs32neg, offset);
diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
index d85076223a69..aae88fec9941 100644
--- a/arch/x86/xen/mmu_pv.c
+++ b/arch/x86/xen/mmu_pv.c
@@ -1300,12 +1300,12 @@ static void xen_flush_tlb(void)
         preempt_enable();
 }
 
-static void xen_flush_tlb_single(unsigned long addr)
+static void xen_flush_tlb_one_user(unsigned long addr)
 {
         struct mmuext_op *op;
         struct multicall_space mcs;
 
-        trace_xen_mmu_flush_tlb_single(addr);
+        trace_xen_mmu_flush_tlb_one_user(addr);
 
         preempt_disable();
 
@@ -2370,7 +2370,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
 
         .flush_tlb_user = xen_flush_tlb,
         .flush_tlb_kernel = xen_flush_tlb,
-        .flush_tlb_single = xen_flush_tlb_single,
+        .flush_tlb_one_user = xen_flush_tlb_one_user,
         .flush_tlb_others = xen_flush_tlb_others,
 
         .pgd_alloc = xen_pgd_alloc,
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index 77c959cf81e7..7a43b2ae19f1 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -122,6 +122,8 @@ void __init xen_smp_cpus_done(unsigned int max_cpus)
 
         if (xen_hvm_domain())
                 native_smp_cpus_done(max_cpus);
+        else
+                calculate_max_logical_packages();
 
         if (xen_have_vcpu_info_placement)
                 return;
diff --git a/arch/xtensa/kernel/pci-dma.c b/arch/xtensa/kernel/pci-dma.c
index 623720a11143..732631ce250f 100644
--- a/arch/xtensa/kernel/pci-dma.c
+++ b/arch/xtensa/kernel/pci-dma.c
@@ -16,6 +16,7 @@
  */
 
 #include <linux/dma-contiguous.h>
+#include <linux/dma-direct.h>
 #include <linux/gfp.h>
 #include <linux/highmem.h>
 #include <linux/mm.h>
@@ -123,7 +124,7 @@ static void *xtensa_dma_alloc(struct device *dev, size_t size,
                               unsigned long attrs)
 {
         unsigned long ret;
-        unsigned long uncached = 0;
+        unsigned long uncached;
         unsigned long count = PAGE_ALIGN(size) >> PAGE_SHIFT;
         struct page *page = NULL;
 
@@ -144,15 +145,27 @@ static void *xtensa_dma_alloc(struct device *dev, size_t size,
         if (!page)
                 return NULL;
 
-        ret = (unsigned long)page_address(page);
+        *handle = phys_to_dma(dev, page_to_phys(page));
 
-        /* We currently don't support coherent memory outside KSEG */
+#ifdef CONFIG_MMU
+        if (PageHighMem(page)) {
+                void *p;
 
+                p = dma_common_contiguous_remap(page, size, VM_MAP,
+                                                pgprot_noncached(PAGE_KERNEL),
+                                                __builtin_return_address(0));
+                if (!p) {
+                        if (!dma_release_from_contiguous(dev, page, count))
+                                __free_pages(page, get_order(size));
+                }
+                return p;
+        }
+#endif
+        ret = (unsigned long)page_address(page);
         BUG_ON(ret < XCHAL_KSEG_CACHED_VADDR ||
                ret > XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE - 1);
 
         uncached = ret + XCHAL_KSEG_BYPASS_VADDR - XCHAL_KSEG_CACHED_VADDR;
-        *handle = virt_to_bus((void *)ret);
         __invalidate_dcache_range(ret, size);
 
         return (void *)uncached;
@@ -161,13 +174,20 @@ static void *xtensa_dma_alloc(struct device *dev, size_t size,
 static void xtensa_dma_free(struct device *dev, size_t size, void *vaddr,
                             dma_addr_t dma_handle, unsigned long attrs)
 {
-        unsigned long addr = (unsigned long)vaddr +
-                XCHAL_KSEG_CACHED_VADDR - XCHAL_KSEG_BYPASS_VADDR;
-        struct page *page = virt_to_page(addr);
         unsigned long count = PAGE_ALIGN(size) >> PAGE_SHIFT;
-
-        BUG_ON(addr < XCHAL_KSEG_CACHED_VADDR ||
-               addr > XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE - 1);
+        unsigned long addr = (unsigned long)vaddr;
+        struct page *page;
+
+        if (addr >= XCHAL_KSEG_BYPASS_VADDR &&
+            addr - XCHAL_KSEG_BYPASS_VADDR < XCHAL_KSEG_SIZE) {
+                addr += XCHAL_KSEG_CACHED_VADDR - XCHAL_KSEG_BYPASS_VADDR;
+                page = virt_to_page(addr);
+        } else {
+#ifdef CONFIG_MMU
+                dma_common_free_remap(vaddr, size, VM_MAP);
+#endif
+                page = pfn_to_page(PHYS_PFN(dma_to_phys(dev, dma_handle)));
+        }
 
         if (!dma_release_from_contiguous(dev, page, count))
                 __free_pages(page, get_order(size));
diff --git a/arch/xtensa/mm/init.c b/arch/xtensa/mm/init.c
index d776ec0d7b22..34aead7dcb48 100644
--- a/arch/xtensa/mm/init.c
+++ b/arch/xtensa/mm/init.c
@@ -79,19 +79,75 @@ void __init zones_init(void)
         free_area_init_node(0, zones_size, ARCH_PFN_OFFSET, NULL);
 }
 
+#ifdef CONFIG_HIGHMEM
+static void __init free_area_high(unsigned long pfn, unsigned long end)
+{
+        for (; pfn < end; pfn++)
+                free_highmem_page(pfn_to_page(pfn));
+}
+
+static void __init free_highpages(void)
+{
+        unsigned long max_low = max_low_pfn;
+        struct memblock_region *mem, *res;
+
+        reset_all_zones_managed_pages();
+        /* set highmem page free */
+        for_each_memblock(memory, mem) {
+                unsigned long start = memblock_region_memory_base_pfn(mem);
+                unsigned long end = memblock_region_memory_end_pfn(mem);
+
+                /* Ignore complete lowmem entries */
+                if (end <= max_low)
+                        continue;
+
+                if (memblock_is_nomap(mem))
+                        continue;
+
+                /* Truncate partial highmem entries */
+                if (start < max_low)
+                        start = max_low;
+
+                /* Find and exclude any reserved regions */
+                for_each_memblock(reserved, res) {
+                        unsigned long res_start, res_end;
+
+                        res_start = memblock_region_reserved_base_pfn(res);
+                        res_end = memblock_region_reserved_end_pfn(res);
+
+                        if (res_end < start)
+                                continue;
+                        if (res_start < start)
+                                res_start = start;
+                        if (res_start > end)
+                                res_start = end;
+                        if (res_end > end)
+                                res_end = end;
+                        if (res_start != start)
+                                free_area_high(start, res_start);
+                        start = res_end;
+                        if (start == end)
+                                break;
+                }
+
+                /* And now free anything which remains */
+                if (start < end)
+                        free_area_high(start, end);
+        }
+}
+#else
+static void __init free_highpages(void)
+{
+}
+#endif
+
 /*
  * Initialize memory pages.
  */
 
 void __init mem_init(void)
 {
-#ifdef CONFIG_HIGHMEM
-        unsigned long tmp;
-
-        reset_all_zones_managed_pages();
-        for (tmp = max_low_pfn; tmp < max_pfn; tmp++)
-                free_highmem_page(pfn_to_page(tmp));
-#endif
+        free_highpages();
 
         max_mapnr = max_pfn - ARCH_PFN_OFFSET;
         high_memory = (void *)__va(max_low_pfn << PAGE_SHIFT);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index df93102e2149..357492712b0e 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -3164,6 +3164,7 @@ static bool __blk_mq_poll(struct blk_mq_hw_ctx *hctx, struct request *rq)
                 cpu_relax();
         }
 
+        __set_current_state(TASK_RUNNING);
         return false;
 }
 
diff --git a/block/sed-opal.c b/block/sed-opal.c
index 9ed51d0c6b1d..e4929eec547f 100644
--- a/block/sed-opal.c
+++ b/block/sed-opal.c
@@ -490,7 +490,7 @@ static int opal_discovery0_end(struct opal_dev *dev)
 
         if (!found_com_id) {
                 pr_debug("Could not find OPAL comid for device. Returning early\n");
-                return -EOPNOTSUPP;;
+                return -EOPNOTSUPP;
         }
 
         dev->comid = comid;
diff --git a/certs/blacklist_nohashes.c b/certs/blacklist_nohashes.c
index 73fd99098ad7..753b703ef0ef 100644
--- a/certs/blacklist_nohashes.c
+++ b/certs/blacklist_nohashes.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 #include "blacklist.h"
 
-const char __initdata *const blacklist_hashes[] = {
+const char __initconst *const blacklist_hashes[] = {
         NULL
 };
diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
index 1f4e25f10049..598906b1e28d 100644
--- a/crypto/asymmetric_keys/pkcs7_trust.c
+++ b/crypto/asymmetric_keys/pkcs7_trust.c
@@ -106,6 +106,7 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
                 pr_devel("sinfo %u: Direct signer is key %x\n",
                          sinfo->index, key_serial(key));
                 x509 = NULL;
+                sig = sinfo->sig;
                 goto matched;
         }
         if (PTR_ERR(key) != -ENOKEY)
diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
index 39e6de0c2761..97c77f66b20d 100644
--- a/crypto/asymmetric_keys/pkcs7_verify.c
+++ b/crypto/asymmetric_keys/pkcs7_verify.c
@@ -270,7 +270,7 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
                                 sinfo->index);
                         return 0;
                 }
-                ret = public_key_verify_signature(p->pub, p->sig);
+                ret = public_key_verify_signature(p->pub, x509->sig);
                 if (ret < 0)
                         return ret;
                 x509->signer = p;
@@ -366,8 +366,7 @@ static int pkcs7_verify_one(struct pkcs7_message *pkcs7,
  *
  *  (*) -EBADMSG if some part of the message was invalid, or:
  *
- *  (*) 0 if no signature chains were found to be blacklisted or to contain
- *      unsupported crypto, or:
+ *  (*) 0 if a signature chain passed verification, or:
  *
  *  (*) -EKEYREJECTED if a blacklisted key was encountered, or:
  *
@@ -423,8 +422,11 @@ int pkcs7_verify(struct pkcs7_message *pkcs7,
 
         for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
                 ret = pkcs7_verify_one(pkcs7, sinfo);
-                if (sinfo->blacklisted && actual_ret == -ENOPKG)
-                        actual_ret = -EKEYREJECTED;
+                if (sinfo->blacklisted) {
+                        if (actual_ret == -ENOPKG)
+                                actual_ret = -EKEYREJECTED;
+                        continue;
+                }
                 if (ret < 0) {
                         if (ret == -ENOPKG) {
                                 sinfo->unsupported_crypto = true;
diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
index de996586762a..e929fe1e4106 100644
--- a/crypto/asymmetric_keys/public_key.c
+++ b/crypto/asymmetric_keys/public_key.c
@@ -79,9 +79,11 @@ int public_key_verify_signature(const struct public_key *pkey,
 
         BUG_ON(!pkey);
         BUG_ON(!sig);
-        BUG_ON(!sig->digest);
         BUG_ON(!sig->s);
 
+        if (!sig->digest)
+                return -ENOPKG;
+
         alg_name = sig->pkey_algo;
         if (strcmp(sig->pkey_algo, "rsa") == 0) {
                 /* The data wangled by the RSA algorithm is typically padded
diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c
index 86fb68508952..7c93c7728454 100644
--- a/crypto/asymmetric_keys/restrict.c
+++ b/crypto/asymmetric_keys/restrict.c
@@ -67,8 +67,9 @@ __setup("ca_keys=", ca_keys_setup);
  *
  * Returns 0 if the new certificate was accepted, -ENOKEY if we couldn't find a
  * matching parent certificate in the trusted list, -EKEYREJECTED if the
- * signature check fails or the key is blacklisted and some other error if
- * there is a matching certificate but the signature check cannot be performed.
+ * signature check fails or the key is blacklisted, -ENOPKG if the signature
+ * uses unsupported crypto, or some other error if there is a matching
+ * certificate but the signature check cannot be performed.
  */
 int restrict_link_by_signature(struct key *dest_keyring,
                                const struct key_type *type,
@@ -88,6 +89,8 @@ int restrict_link_by_signature(struct key *dest_keyring,
                 return -EOPNOTSUPP;
 
         sig = payload->data[asym_auth];
+        if (!sig)
+                return -ENOPKG;
         if (!sig->auth_ids[0] && !sig->auth_ids[1])
                 return -ENOKEY;
 
@@ -139,6 +142,8 @@ static int key_or_keyring_common(struct key *dest_keyring,
                 return -EOPNOTSUPP;
 
         sig = payload->data[asym_auth];
+        if (!sig)
+                return -ENOPKG;
         if (!sig->auth_ids[0] && !sig->auth_ids[1])
                 return -ENOKEY;
 
@@ -222,9 +227,9 @@ static int key_or_keyring_common(struct key *dest_keyring,
  *
  * Returns 0 if the new certificate was accepted, -ENOKEY if we
  * couldn't find a matching parent certificate in the trusted list,
- * -EKEYREJECTED if the signature check fails, and some other error if
- * there is a matching certificate but the signature check cannot be
- * performed.
+ * -EKEYREJECTED if the signature check fails, -ENOPKG if the signature uses
+ * unsupported crypto, or some other error if there is a matching certificate
+ * but the signature check cannot be performed.
  */
 int restrict_link_by_key_or_keyring(struct key *dest_keyring,
                                     const struct key_type *type,
@@ -249,9 +254,9 @@ int restrict_link_by_key_or_keyring(struct key *dest_keyring,
  *
  * Returns 0 if the new certificate was accepted, -ENOKEY if we
  * couldn't find a matching parent certificate in the trusted list,
- * -EKEYREJECTED if the signature check fails, and some other error if
- * there is a matching certificate but the signature check cannot be
- * performed.
+ * -EKEYREJECTED if the signature check fails, -ENOPKG if the signature uses
+ * unsupported crypto, or some other error if there is a matching certificate
+ * but the signature check cannot be performed.
  */
 int restrict_link_by_key_or_keyring_chain(struct key *dest_keyring,
                                           const struct key_type *type,
diff --git a/crypto/sha3_generic.c b/crypto/sha3_generic.c
index a965b9d80559..ded148783303 100644
--- a/crypto/sha3_generic.c
+++ b/crypto/sha3_generic.c
@@ -20,6 +20,20 @@
 #include <crypto/sha3.h>
 #include <asm/unaligned.h>
 
+/*
+ * On some 32-bit architectures (mn10300 and h8300), GCC ends up using
+ * over 1 KB of stack if we inline the round calculation into the loop
+ * in keccakf(). On the other hand, on 64-bit architectures with plenty
+ * of [64-bit wide] general purpose registers, not inlining it severely
+ * hurts performance. So let's use 64-bitness as a heuristic to decide
+ * whether to inline or not.
+ */
+#ifdef CONFIG_64BIT
+#define SHA3_INLINE     inline
+#else
+#define SHA3_INLINE     noinline
+#endif
+
 #define KECCAK_ROUNDS 24
 
 static const u64 keccakf_rndc[24] = {
@@ -35,111 +49,115 @@ static const u64 keccakf_rndc[24] = {
 
 /* update the state with given number of rounds */
 
-static void __attribute__((__optimize__("O3"))) keccakf(u64 st[25])
+static SHA3_INLINE void keccakf_round(u64 st[25])
 {
         u64 t[5], tt, bc[5];
-        int round;
 
-        for (round = 0; round < KECCAK_ROUNDS; round++) {
+        /* Theta */
+        bc[0] = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];
+        bc[1] = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];
+        bc[2] = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];
+        bc[3] = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];
+        bc[4] = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];
+
+        t[0] = bc[4] ^ rol64(bc[1], 1);
+        t[1] = bc[0] ^ rol64(bc[2], 1);
+        t[2] = bc[1] ^ rol64(bc[3], 1);
+        t[3] = bc[2] ^ rol64(bc[4], 1);
+        t[4] = bc[3] ^ rol64(bc[0], 1);
+
+        st[0] ^= t[0];
+
+        /* Rho Pi */
+        tt = st[1];
+        st[ 1] = rol64(st[ 6] ^ t[1], 44);
+        st[ 6] = rol64(st[ 9] ^ t[4], 20);
+        st[ 9] = rol64(st[22] ^ t[2], 61);
+        st[22] = rol64(st[14] ^ t[4], 39);
+        st[14] = rol64(st[20] ^ t[0], 18);
+        st[20] = rol64(st[ 2] ^ t[2], 62);
+        st[ 2] = rol64(st[12] ^ t[2], 43);
+        st[12] = rol64(st[13] ^ t[3], 25);
+        st[13] = rol64(st[19] ^ t[4],  8);
+        st[19] = rol64(st[23] ^ t[3], 56);
+        st[23] = rol64(st[15] ^ t[0], 41);
+        st[15] = rol64(st[ 4] ^ t[4], 27);
+        st[ 4] = rol64(st[24] ^ t[4], 14);
+        st[24] = rol64(st[21] ^ t[1],  2);
+        st[21] = rol64(st[ 8] ^ t[3], 55);
+        st[ 8] = rol64(st[16] ^ t[1], 45);
+        st[16] = rol64(st[ 5] ^ t[0], 36);
+        st[ 5] = rol64(st[ 3] ^ t[3], 28);
+        st[ 3] = rol64(st[18] ^ t[3], 21);
+        st[18] = rol64(st[17] ^ t[2], 15);
+        st[17] = rol64(st[11] ^ t[1], 10);
+        st[11] = rol64(st[ 7] ^ t[2],  6);
+        st[ 7] = rol64(st[10] ^ t[0],  3);
+        st[10] = rol64(    tt ^ t[1],  1);
+
+        /* Chi */
+        bc[ 0] = ~st[ 1] & st[ 2];
+        bc[ 1] = ~st[ 2] & st[ 3];
+        bc[ 2] = ~st[ 3] & st[ 4];
+        bc[ 3] = ~st[ 4] & st[ 0];
+        bc[ 4] = ~st[ 0] & st[ 1];
+        st[ 0] ^= bc[ 0];
+        st[ 1] ^= bc[ 1];
+        st[ 2] ^= bc[ 2];
+        st[ 3] ^= bc[ 3];
+        st[ 4] ^= bc[ 4];
+
+        bc[ 0] = ~st[ 6] & st[ 7];
+        bc[ 1] = ~st[ 7] & st[ 8];
+        bc[ 2] = ~st[ 8] & st[ 9];
+        bc[ 3] = ~st[ 9] & st[ 5];
+        bc[ 4] = ~st[ 5] & st[ 6];
+        st[ 5] ^= bc[ 0];
+        st[ 6] ^= bc[ 1];
+        st[ 7] ^= bc[ 2];
+        st[ 8] ^= bc[ 3];
+        st[ 9] ^= bc[ 4];
+
+        bc[ 0] = ~st[11] & st[12];
+        bc[ 1] = ~st[12] & st[13];
+        bc[ 2] = ~st[13] & st[14];
+        bc[ 3] = ~st[14] & st[10];
+        bc[ 4] = ~st[10] & st[11];
+        st[10] ^= bc[ 0];
+        st[11] ^= bc[ 1];
+        st[12] ^= bc[ 2];
+        st[13] ^= bc[ 3];
+        st[14] ^= bc[ 4];
+
+        bc[ 0] = ~st[16] & st[17];
+        bc[ 1] = ~st[17] & st[18];
+        bc[ 2] = ~st[18] & st[19];
+        bc[ 3] = ~st[19] & st[15];
+        bc[ 4] = ~st[15] & st[16];
+        st[15] ^= bc[ 0];
+        st[16] ^= bc[ 1];
+        st[17] ^= bc[ 2];
+        st[18] ^= bc[ 3];
+        st[19] ^= bc[ 4];
+
+        bc[ 0] = ~st[21] & st[22];
+        bc[ 1] = ~st[22] & st[23];
+        bc[ 2] = ~st[23] & st[24];
+        bc[ 3] = ~st[24] & st[20];
+        bc[ 4] = ~st[20] & st[21];
+        st[20] ^= bc[ 0];
+        st[21] ^= bc[ 1];
+        st[22] ^= bc[ 2];
+        st[23] ^= bc[ 3];
+        st[24] ^= bc[ 4];
+}
 
-                /* Theta */
-                bc[0] = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];
-                bc[1] = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];
-                bc[2] = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];
-                bc[3] = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];
-                bc[4] = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];
-
-                t[0] = bc[4] ^ rol64(bc[1], 1);
-                t[1] = bc[0] ^ rol64(bc[2], 1);
-                t[2] = bc[1] ^ rol64(bc[3], 1);
-                t[3] = bc[2] ^ rol64(bc[4], 1);
-                t[4] = bc[3] ^ rol64(bc[0], 1);
-
-                st[0] ^= t[0];
-
-                /* Rho Pi */
-                tt = st[1];
-                st[ 1] = rol64(st[ 6] ^ t[1], 44);
-                st[ 6] = rol64(st[ 9] ^ t[4], 20);
-                st[ 9] = rol64(st[22] ^ t[2], 61);
-                st[22] = rol64(st[14] ^ t[4], 39);
-                st[14] = rol64(st[20] ^ t[0], 18);
-                st[20] = rol64(st[ 2] ^ t[2], 62);
-                st[ 2] = rol64(st[12] ^ t[2], 43);
-                st[12] = rol64(st[13] ^ t[3], 25);
-                st[13] = rol64(st[19] ^ t[4],  8);
-                st[19] = rol64(st[23] ^ t[3], 56);
-                st[23] = rol64(st[15] ^ t[0], 41);
-                st[15] = rol64(st[ 4] ^ t[4], 27);
-                st[ 4] = rol64(st[24] ^ t[4], 14);
-                st[24] = rol64(st[21] ^ t[1],  2);
-                st[21] = rol64(st[ 8] ^ t[3], 55);
-                st[ 8] = rol64(st[16] ^ t[1], 45);
-                st[16] = rol64(st[ 5] ^ t[0], 36);
-                st[ 5] = rol64(st[ 3] ^ t[3], 28);
-                st[ 3] = rol64(st[18] ^ t[3], 21);
-                st[18] = rol64(st[17] ^ t[2], 15);
-                st[17] = rol64(st[11] ^ t[1], 10);
-                st[11] = rol64(st[ 7] ^ t[2],  6);
-                st[ 7] = rol64(st[10] ^ t[0],  3);
-                st[10] = rol64(    tt ^ t[1],  1);
-
-                /* Chi */
-                bc[ 0] = ~st[ 1] & st[ 2];
-                bc[ 1] = ~st[ 2] & st[ 3];
-                bc[ 2] = ~st[ 3] & st[ 4];
-                bc[ 3] = ~st[ 4] & st[ 0];
-                bc[ 4] = ~st[ 0] & st[ 1];
-                st[ 0] ^= bc[ 0];
-                st[ 1] ^= bc[ 1];
-                st[ 2] ^= bc[ 2];
-                st[ 3] ^= bc[ 3];
-                st[ 4] ^= bc[ 4];
-
-                bc[ 0] = ~st[ 6] & st[ 7];
-                bc[ 1] = ~st[ 7] & st[ 8];
-                bc[ 2] = ~st[ 8] & st[ 9];
-                bc[ 3] = ~st[ 9] & st[ 5];
-                bc[ 4] = ~st[ 5] & st[ 6];
-                st[ 5] ^= bc[ 0];
-                st[ 6] ^= bc[ 1];
-                st[ 7] ^= bc[ 2];
-                st[ 8] ^= bc[ 3];
-                st[ 9] ^= bc[ 4];
-
-                bc[ 0] = ~st[11] & st[12];
-                bc[ 1] = ~st[12] & st[13];
-                bc[ 2] = ~st[13] & st[14];
-                bc[ 3] = ~st[14] & st[10];
-                bc[ 4] = ~st[10] & st[11];
-                st[10] ^= bc[ 0];
-                st[11] ^= bc[ 1];
-                st[12] ^= bc[ 2];
-                st[13] ^= bc[ 3];
-                st[14] ^= bc[ 4];
-
-                bc[ 0] = ~st[16] & st[17];
-                bc[ 1] = ~st[17] & st[18];
-                bc[ 2] = ~st[18] & st[19];
-                bc[ 3] = ~st[19] & st[15];
-                bc[ 4] = ~st[15] & st[16];
-                st[15] ^= bc[ 0];
-                st[16] ^= bc[ 1];
-                st[17] ^= bc[ 2];
-                st[18] ^= bc[ 3];
-                st[19] ^= bc[ 4];
-
-                bc[ 0] = ~st[21] & st[22];
-                bc[ 1] = ~st[22] & st[23];
-                bc[ 2] = ~st[23] & st[24];
-                bc[ 3] = ~st[24] & st[20];
-                bc[ 4] = ~st[20] & st[21];
-                st[20] ^= bc[ 0];
-                st[21] ^= bc[ 1];
-                st[22] ^= bc[ 2];
-                st[23] ^= bc[ 3];
-                st[24] ^= bc[ 4];
+static void __optimize("O3") keccakf(u64 st[25])
+{
+        int round;
 
+        for (round = 0; round < KECCAK_ROUNDS; round++) {
+                keccakf_round(st);
                 /* Iota */
                 st[0] ^= keccakf_rndc[round];
         }
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 676c9788e1c8..0dad0bd9327b 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -660,13 +660,15 @@ struct acpi_device *acpi_companion_match(const struct device *dev)
  * acpi_of_match_device - Match device object using the "compatible" property.
  * @adev: ACPI device object to match.
  * @of_match_table: List of device IDs to match against.
+ * @of_id: OF ID if matched
  *
  * If @dev has an ACPI companion which has ACPI_DT_NAMESPACE_HID in its list of
  * identifiers and a _DSD object with the "compatible" property, use that
  * property to match against the given list of identifiers.
  */
 static bool acpi_of_match_device(struct acpi_device *adev,
-                                 const struct of_device_id *of_match_table)
+                                 const struct of_device_id *of_match_table,
+                                 const struct of_device_id **of_id)
 {
         const union acpi_object *of_compatible, *obj;
         int i, nval;
@@ -690,8 +692,11 @@ static bool acpi_of_match_device(struct acpi_device *adev,
                 const struct of_device_id *id;
 
                 for (id = of_match_table; id->compatible[0]; id++)
-                        if (!strcasecmp(obj->string.pointer, id->compatible))
+                        if (!strcasecmp(obj->string.pointer, id->compatible)) {
+                                if (of_id)
+                                        *of_id = id;
                                 return true;
+                        }
         }
 
         return false;
@@ -762,10 +767,11 @@ static bool __acpi_match_device_cls(const struct acpi_device_id *id,
         return true;
 }
 
-static const struct acpi_device_id *__acpi_match_device(
-        struct acpi_device *device,
-        const struct acpi_device_id *ids,
-        const struct of_device_id *of_ids)
+static bool __acpi_match_device(struct acpi_device *device,
+                                const struct acpi_device_id *acpi_ids,
+                                const struct of_device_id *of_ids,
+                                const struct acpi_device_id **acpi_id,
+                                const struct of_device_id **of_id)
 {
         const struct acpi_device_id *id;
         struct acpi_hardware_id *hwid;
@@ -775,30 +781,32 @@ static const struct acpi_device_id *__acpi_match_device(
          * driver for it.
          */
         if (!device || !device->status.present)
-                return NULL;
+                return false;
 
         list_for_each_entry(hwid, &device->pnp.ids, list) {
                 /* First, check the ACPI/PNP IDs provided by the caller. */
-                for (id = ids; id->id[0] || id->cls; id++) {
-                        if (id->id[0] && !strcmp((char *) id->id, hwid->id))
-                                return id;
-                        else if (id->cls && __acpi_match_device_cls(id, hwid))
-                                return id;
+                if (acpi_ids) {
+                        for (id = acpi_ids; id->id[0] || id->cls; id++) {
+                                if (id->id[0] && !strcmp((char *)id->id, hwid->id))
+                                        goto out_acpi_match;
+                                if (id->cls && __acpi_match_device_cls(id, hwid))
+                                        goto out_acpi_match;
+                        }
                 }
 
                 /*
                  * Next, check ACPI_DT_NAMESPACE_HID and try to match the
                  * "compatible" property if found.
-                 *
-                 * The id returned by the below is not valid, but the only
-                 * caller passing non-NULL of_ids here is only interested in
-                 * whether or not the return value is NULL.
                  */
-                if (!strcmp(ACPI_DT_NAMESPACE_HID, hwid->id)
-                    && acpi_of_match_device(device, of_ids))
-                        return id;
+                if (!strcmp(ACPI_DT_NAMESPACE_HID, hwid->id))
+                        return acpi_of_match_device(device, of_ids, of_id);
         }
-        return NULL;
+        return false;
+
+out_acpi_match:
+        if (acpi_id)
+                *acpi_id = id;
+        return true;
 }
 
 /**
@@ -815,32 +823,29 @@ static const struct acpi_device_id *__acpi_match_device(
 const struct acpi_device_id *acpi_match_device(const struct acpi_device_id *ids,
                                                const struct device *dev)
 {
-        return __acpi_match_device(acpi_companion_match(dev), ids, NULL);
+        const struct acpi_device_id *id = NULL;
+
+        __acpi_match_device(acpi_companion_match(dev), ids, NULL, &id, NULL);
+        return id;
 }
 EXPORT_SYMBOL_GPL(acpi_match_device);
 
-void *acpi_get_match_data(const struct device *dev)
+const void *acpi_device_get_match_data(const struct device *dev)
 {
         const struct acpi_device_id *match;
 
-        if (!dev->driver)
-                return NULL;
-
-        if (!dev->driver->acpi_match_table)
-                return NULL;
-
         match = acpi_match_device(dev->driver->acpi_match_table, dev);
         if (!match)
                 return NULL;
 
-        return (void *)match->driver_data;
+        return (const void *)match->driver_data;
 }
-EXPORT_SYMBOL_GPL(acpi_get_match_data);
+EXPORT_SYMBOL_GPL(acpi_device_get_match_data);
 
 int acpi_match_device_ids(struct acpi_device *device,
                           const struct acpi_device_id *ids)
 {
-        return __acpi_match_device(device, ids, NULL) ? 0 : -ENOENT;
+        return __acpi_match_device(device, ids, NULL, NULL, NULL) ? 0 : -ENOENT;
 }
 EXPORT_SYMBOL(acpi_match_device_ids);
 
@@ -849,10 +854,12 @@ bool acpi_driver_match_device(struct device *dev,
 {
         if (!drv->acpi_match_table)
                 return acpi_of_match_device(ACPI_COMPANION(dev),
-                                            drv->of_match_table);
+                                            drv->of_match_table,
+                                            NULL);
 
-        return !!__acpi_match_device(acpi_companion_match(dev),
-                                     drv->acpi_match_table, drv->of_match_table);
+        return __acpi_match_device(acpi_companion_match(dev),
+                                   drv->acpi_match_table, drv->of_match_table,
+                                   NULL, NULL);
 }
 EXPORT_SYMBOL_GPL(acpi_driver_match_device);
 
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index d9f38c645e4a..30a572956557 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1927,6 +1927,9 @@ static int acpi_ec_suspend_noirq(struct device *dev)
             ec->reference_count >= 1)
                 acpi_set_gpe(NULL, ec->gpe, ACPI_GPE_DISABLE);
 
+        if (acpi_sleep_no_ec_events())
+                acpi_ec_enter_noirq(ec);
+
         return 0;
 }
 
@@ -1934,6 +1937,9 @@ static int acpi_ec_resume_noirq(struct device *dev)
 {
         struct acpi_ec *ec = acpi_driver_data(to_acpi_device(dev));
 
+        if (acpi_sleep_no_ec_events())
+                acpi_ec_leave_noirq(ec);
+
         if (ec_no_wakeup && test_bit(EC_FLAGS_STARTED, &ec->flags) &&
             ec->reference_count >= 1)
                 acpi_set_gpe(NULL, ec->gpe, ACPI_GPE_ENABLE);
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 466d1503aba0..5815356ea6ad 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -1271,11 +1271,11 @@ static int acpi_fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,
         return 0;
 }
 
-static void *
+static const void *
 acpi_fwnode_device_get_match_data(const struct fwnode_handle *fwnode,
                                   const struct device *dev)
 {
-        return acpi_get_match_data(dev);
+        return acpi_device_get_match_data(dev);
 }
 
 #define DECLARE_ACPI_FWNODE_OPS(ops) \
diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
index 89e97d21a89c..9d52743080a4 100644
--- a/drivers/acpi/spcr.c
+++ b/drivers/acpi/spcr.c
@@ -115,6 +115,7 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console)
                         table->serial_port.access_width))) {
                 default:
                         pr_err("Unexpected SPCR Access Width.  Defaulting to byte size\n");
+                        /* fall through */
                 case 8:
                         iotype = "mmio";
                         break;
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 15e3d3c2260d..764b63a5aade 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1991,8 +1991,14 @@ static void binder_send_failed_reply(struct binder_transaction *t,
                                         &target_thread->reply_error.work);
                                 wake_up_interruptible(&target_thread->wait);
                         } else {
-                                WARN(1, "Unexpected reply error: %u\n",
-                                                target_thread->reply_error.cmd);
+                                /*
+                                 * Cannot get here for normal operation, but
+                                 * we can if multiple synchronous transactions
+                                 * are sent without blocking for responses.
+                                 * Just ignore the 2nd error in this case.
+                                 */
+                                pr_warn("Unexpected reply error: %u\n",
+                                        target_thread->reply_error.cmd);
                         }
                         binder_inner_proc_unlock(target_thread->proc);
                         binder_thread_dec_tmpref(target_thread);
@@ -2193,7 +2199,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
         int debug_id = buffer->debug_id;
 
         binder_debug(BINDER_DEBUG_TRANSACTION,
-                     "%d buffer release %d, size %zd-%zd, failed at %p\n",
+                     "%d buffer release %d, size %zd-%zd, failed at %pK\n",
                      proc->pid, buffer->debug_id,
                      buffer->data_size, buffer->offsets_size, failed_at);
 
@@ -3705,7 +3711,7 @@ static int binder_thread_write(struct binder_proc *proc,
                                 }
                         }
                         binder_debug(BINDER_DEBUG_DEAD_BINDER,
-                                     "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
+                                     "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
                                      proc->pid, thread->pid, (u64)cookie,
                                      death);
                         if (death == NULL) {
@@ -4376,6 +4382,15 @@ static int binder_thread_release(struct binder_proc *proc,
 
         binder_inner_proc_unlock(thread->proc);
 
+        /*
+         * This is needed to avoid races between wake_up_poll() above and
+         * and ep_remove_waitqueue() called for other reasons (eg the epoll file
+         * descriptor being closed); ep_remove_waitqueue() holds an RCU read
+         * lock, so we can be sure it's done after calling synchronize_rcu().
+         */
+        if (thread->looper & BINDER_LOOPER_STATE_POLL)
+                synchronize_rcu();
+
         if (send_reply)
                 binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
         binder_release_work(proc, &thread->todo);
@@ -4391,6 +4406,8 @@ static __poll_t binder_poll(struct file *filp,
         bool wait_for_proc_work;
 
         thread = binder_get_thread(proc);
+        if (!thread)
+                return POLLERR;
 
         binder_inner_proc_lock(thread->proc);
         thread->looper |= BINDER_LOOPER_STATE_POLL;
@@ -5034,7 +5051,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m,
         spin_lock(&t->lock);
         to_proc = t->to_proc;
         seq_printf(m,
-                   "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d",
+                   "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d",
                    prefix, t->debug_id, t,
                    t->from ? t->from->proc->pid : 0,
                    t->from ? t->from->pid : 0,
@@ -5058,7 +5075,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m,
         }
         if (buffer->target_node)
                 seq_printf(m, " node %d", buffer->target_node->debug_id);
-        seq_printf(m, " size %zd:%zd data %p\n",
+        seq_printf(m, " size %zd:%zd data %pK\n",
                    buffer->data_size, buffer->offsets_size,
                    buffer->data);
 }
diff --git a/drivers/base/core.c b/drivers/base/core.c
index b2261f92f2f1..5847364f25d9 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -310,6 +310,9 @@ static void __device_link_del(struct device_link *link)
         dev_info(link->consumer, "Dropping the link to %s\n",
                  dev_name(link->supplier));
 
+        if (link->flags & DL_FLAG_PM_RUNTIME)
+                pm_runtime_drop_link(link->consumer);
+
         list_del(&link->s_node);
         list_del(&link->c_node);
         device_link_free(link);
diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c
index a8ac86e4d79e..6637fc319269 100644
--- a/drivers/base/power/wakeirq.c
+++ b/drivers/base/power/wakeirq.c
@@ -321,7 +321,8 @@ void dev_pm_arm_wake_irq(struct wake_irq *wirq)
                 return;
 
         if (device_may_wakeup(wirq->dev)) {
-                if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED)
+                if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED &&
+                    !pm_runtime_status_suspended(wirq->dev))
                         enable_irq(wirq->irq);
 
                 enable_irq_wake(wirq->irq);
@@ -343,7 +344,8 @@ void dev_pm_disarm_wake_irq(struct wake_irq *wirq)
         if (device_may_wakeup(wirq->dev)) {
                 disable_irq_wake(wirq->irq);
 
-                if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED)
+                if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED &&
+                    !pm_runtime_status_suspended(wirq->dev))
                         disable_irq_nosync(wirq->irq);
         }
 }
diff --git a/drivers/base/property.c b/drivers/base/property.c
index 302236281d83..8f205f6461ed 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -1410,9 +1410,8 @@ int fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,
 }
 EXPORT_SYMBOL(fwnode_graph_parse_endpoint);
 
-void *device_get_match_data(struct device *dev)
+const void *device_get_match_data(struct device *dev)
 {
-        return fwnode_call_ptr_op(dev_fwnode(dev), device_get_match_data,
-                                  dev);
+        return fwnode_call_ptr_op(dev_fwnode(dev), device_get_match_data, dev);
 }
 EXPORT_SYMBOL_GPL(device_get_match_data);
diff --git a/drivers/char/hw_random/via-rng.c b/drivers/char/hw_random/via-rng.c
index d1f5bb534e0e..6e9df558325b 100644
--- a/drivers/char/hw_random/via-rng.c
+++ b/drivers/char/hw_random/via-rng.c
@@ -162,7 +162,7 @@ static int via_rng_init(struct hwrng *rng)
         /* Enable secondary noise source on CPUs where it is present. */
 
         /* Nehemiah stepping 8 and higher */
-        if ((c->x86_model == 9) && (c->x86_mask > 7))
+        if ((c->x86_model == 9) && (c->x86_stepping > 7))
                 lo |= VIA_NOISESRC2;
 
         /* Esther */
diff --git a/drivers/clocksource/mips-gic-timer.c b/drivers/clocksource/mips-gic-timer.c
index a04808a21d4e..65e18c86d9b9 100644
--- a/drivers/clocksource/mips-gic-timer.c
+++ b/drivers/clocksource/mips-gic-timer.c
@@ -205,12 +205,12 @@ static int __init gic_clocksource_of_init(struct device_node *node)
         } else if (of_property_read_u32(node, "clock-frequency",
                                         &gic_frequency)) {
                 pr_err("GIC frequency not specified.\n");
-                return -EINVAL;;
+                return -EINVAL;
         }
         gic_timer_irq = irq_of_parse_and_map(node, 0);
         if (!gic_timer_irq) {
                 pr_err("GIC timer IRQ not specified.\n");
-                return -EINVAL;;
+                return -EINVAL;
         }
 
         ret = __gic_clocksource_init();
diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
index 2a3fe83ec337..3b56ea3f52af 100644
--- a/drivers/clocksource/timer-sun5i.c
+++ b/drivers/clocksource/timer-sun5i.c
@@ -334,7 +334,7 @@ static int __init sun5i_timer_init(struct device_node *node)
         timer_base = of_io_request_and_map(node, 0, of_node_full_name(node));
         if (IS_ERR(timer_base)) {
                 pr_err("Can't map registers\n");
-                return PTR_ERR(timer_base);;
+                return PTR_ERR(timer_base);
         }
 
         irq = irq_of_parse_and_map(node, 0);
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index 3a2ca0f79daf..d0c34df0529c 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -629,7 +629,7 @@ static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c)
         if (c->x86_vendor == X86_VENDOR_INTEL) {
                 if ((c->x86 == 15) &&
                     (c->x86_model == 6) &&
-                    (c->x86_mask == 8)) {
+                    (c->x86_stepping == 8)) {
                         pr_info("Intel(R) Xeon(R) 7100 Errata AL30, processors may lock up on frequency changes: disabling acpi-cpufreq\n");
                         return -ENODEV;
                     }
diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
index 942632a27b50..f730b6528c18 100644
--- a/drivers/cpufreq/longhaul.c
+++ b/drivers/cpufreq/longhaul.c
@@ -775,7 +775,7 @@ static int longhaul_cpu_init(struct cpufreq_policy *policy)
                 break;
 
         case 7:
-                switch (c->x86_mask) {
+                switch (c->x86_stepping) {
                 case 0:
                         longhaul_version = TYPE_LONGHAUL_V1;
                         cpu_model = CPU_SAMUEL2;
@@ -787,7 +787,7 @@ static int longhaul_cpu_init(struct cpufreq_policy *policy)
                         break;
                 case 1 ... 15:
                         longhaul_version = TYPE_LONGHAUL_V2;
-                        if (c->x86_mask < 8) {
+                        if (c->x86_stepping < 8) {
                                 cpu_model = CPU_SAMUEL2;
                                 cpuname = "C3 'Samuel 2' [C5B]";
                         } else {
@@ -814,7 +814,7 @@ static int longhaul_cpu_init(struct cpufreq_policy *policy)
                 numscales = 32;
                 memcpy(mults, nehemiah_mults, sizeof(nehemiah_mults));
                 memcpy(eblcr, nehemiah_eblcr, sizeof(nehemiah_eblcr));
-                switch (c->x86_mask) {
+                switch (c->x86_stepping) {
                 case 0 ... 1:
                         cpu_model = CPU_NEHEMIAH;
                         cpuname = "C3 'Nehemiah A' [C5XLOE]";
diff --git a/drivers/cpufreq/p4-clockmod.c b/drivers/cpufreq/p4-clockmod.c
index fd77812313f3..a25741b1281b 100644
--- a/drivers/cpufreq/p4-clockmod.c
+++ b/drivers/cpufreq/p4-clockmod.c
@@ -168,7 +168,7 @@ static int cpufreq_p4_cpu_init(struct cpufreq_policy *policy)
 #endif
 
         /* Errata workaround */
-        cpuid = (c->x86 << 8) | (c->x86_model << 4) | c->x86_mask;
+        cpuid = (c->x86 << 8) | (c->x86_model << 4) | c->x86_stepping;
         switch (cpuid) {
         case 0x0f07:
         case 0x0f0a:
diff --git a/drivers/cpufreq/powernow-k7.c b/drivers/cpufreq/powernow-k7.c
index 80ac313e6c59..302e9ce793a0 100644
--- a/drivers/cpufreq/powernow-k7.c
+++ b/drivers/cpufreq/powernow-k7.c
@@ -131,7 +131,7 @@ static int check_powernow(void)
                 return 0;
         }
 
-        if ((c->x86_model == 6) && (c->x86_mask == 0)) {
+        if ((c->x86_model == 6) && (c->x86_stepping == 0)) {
                 pr_info("K7 660[A0] core detected, enabling errata workarounds\n");
                 have_a0 = 1;
         }
diff --git a/drivers/cpufreq/speedstep-centrino.c b/drivers/cpufreq/speedstep-centrino.c
index 41bc5397f4bb..4fa5adf16c70 100644
--- a/drivers/cpufreq/speedstep-centrino.c
+++ b/drivers/cpufreq/speedstep-centrino.c
@@ -37,7 +37,7 @@ struct cpu_id
 {
         __u8    x86;            /* CPU family */
         __u8    x86_model;      /* model */
-        __u8    x86_mask;       /* stepping */
+        __u8    x86_stepping;   /* stepping */
 };
 
 enum {
@@ -277,7 +277,7 @@ static int centrino_verify_cpu_id(const struct cpuinfo_x86 *c,
 {
         if ((c->x86 == x->x86) &&
             (c->x86_model == x->x86_model) &&
-            (c->x86_mask == x->x86_mask))
+            (c->x86_stepping == x->x86_stepping))
                 return 1;
         return 0;
 }
diff --git a/drivers/cpufreq/speedstep-lib.c b/drivers/cpufreq/speedstep-lib.c
index 8085ec9000d1..e3a9962ee410 100644
--- a/drivers/cpufreq/speedstep-lib.c
+++ b/drivers/cpufreq/speedstep-lib.c
@@ -272,9 +272,9 @@ unsigned int speedstep_detect_processor(void)
                 ebx = cpuid_ebx(0x00000001);
                 ebx &= 0x000000FF;
 
-                pr_debug("ebx value is %x, x86_mask is %x\n", ebx, c->x86_mask);
+                pr_debug("ebx value is %x, x86_stepping is %x\n", ebx, c->x86_stepping);
 
-                switch (c->x86_mask) {
+                switch (c->x86_stepping) {
                 case 4:
                         /*
                          * B-stepping [M-P4-M]
@@ -361,7 +361,7 @@ unsigned int speedstep_detect_processor(void)
                                 msr_lo, msr_hi);
                 if ((msr_hi & (1<<18)) &&
                     (relaxed_check ? 1 : (msr_hi & (3<<24)))) {
-                        if (c->x86_mask == 0x01) {
+                        if (c->x86_stepping == 0x01) {
                                 pr_debug("early PIII version\n");
                                 return SPEEDSTEP_CPU_PIII_C_EARLY;
                         } else
diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
index 75d280cb2dc0..e843cf410373 100644
--- a/drivers/crypto/caam/ctrl.c
+++ b/drivers/crypto/caam/ctrl.c
@@ -228,12 +228,16 @@ static int instantiate_rng(struct device *ctrldev, int state_handle_mask,
                  * without any error (HW optimizations for later
                  * CAAM eras), then try again.
                  */
+                if (ret)
+                        break;
+
                 rdsta_val = rd_reg32(&ctrl->r4tst[0].rdsta) & RDSTA_IFMASK;
                 if ((status && status != JRSTA_SSRC_JUMP_HALT_CC) ||
-                    !(rdsta_val & (1 << sh_idx)))
+                    !(rdsta_val & (1 << sh_idx))) {
                         ret = -EAGAIN;
-                if (ret)
                         break;
+                }
+
                 dev_info(ctrldev, "Instantiated RNG4 SH%d\n", sh_idx);
                 /* Clear the contents before recreating the descriptor */
                 memset(desc, 0x00, CAAM_CMD_SZ * 7);
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index 4b6642a25df5..1c6cbda56afe 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -512,7 +512,7 @@ static int __init padlock_init(void)
 
         printk(KERN_NOTICE PFX "Using VIA PadLock ACE for AES algorithm.\n");
 
-        if (c->x86 == 6 && c->x86_model == 15 && c->x86_mask == 2) {
+        if (c->x86 == 6 && c->x86_model == 15 && c->x86_stepping == 2) {
                 ecb_fetch_blocks = MAX_ECB_FETCH_BLOCKS;
                 cbc_fetch_blocks = MAX_CBC_FETCH_BLOCKS;
                 printk(KERN_NOTICE PFX "VIA Nano stepping 2 detected: enabling workaround.\n");
diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
index 188f44b7eb27..5d64c08b7f47 100644
--- a/drivers/crypto/s5p-sss.c
+++ b/drivers/crypto/s5p-sss.c
@@ -1922,15 +1922,21 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode)
         uint32_t aes_control;
         unsigned long flags;
         int err;
+        u8 *iv;
 
         aes_control = SSS_AES_KEY_CHANGE_MODE;
         if (mode & FLAGS_AES_DECRYPT)
                 aes_control |= SSS_AES_MODE_DECRYPT;
 
-        if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC)
+        if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) {
                 aes_control |= SSS_AES_CHAIN_MODE_CBC;
-        else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR)
+                iv = req->info;
+        } else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) {
                 aes_control |= SSS_AES_CHAIN_MODE_CTR;
+                iv = req->info;
+        } else {
+                iv = NULL; /* AES_ECB */
+        }
 
         if (dev->ctx->keylen == AES_KEYSIZE_192)
                 aes_control |= SSS_AES_KEY_SIZE_192;
@@ -1961,7 +1967,7 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode)
                 goto outdata_error;
 
         SSS_AES_WRITE(dev, AES_CONTROL, aes_control);
-        s5p_set_aes(dev, dev->ctx->aes_key, req->info, dev->ctx->keylen);
+        s5p_set_aes(dev, dev->ctx->aes_key, iv, dev->ctx->keylen);
 
         s5p_set_dma_indata(dev,  dev->sg_src);
         s5p_set_dma_outdata(dev, dev->sg_dst);
diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-prng.c b/drivers/crypto/sunxi-ss/sun4i-ss-prng.c
index 0d01d1624252..63d636424161 100644
--- a/drivers/crypto/sunxi-ss/sun4i-ss-prng.c
+++ b/drivers/crypto/sunxi-ss/sun4i-ss-prng.c
@@ -28,7 +28,7 @@ int sun4i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src,
         algt = container_of(alg, struct sun4i_ss_alg_template, alg.rng);
         ss = algt->ss;
 
-        spin_lock(&ss->slock);
+        spin_lock_bh(&ss->slock);
 
         writel(mode, ss->base + SS_CTL);
 
@@ -51,6 +51,6 @@ int sun4i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src,
         }
 
         writel(0, ss->base + SS_CTL);
-        spin_unlock(&ss->slock);
-        return dlen;
+        spin_unlock_bh(&ss->slock);
+        return 0;
 }
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 9c80e0cb1664..6882fa2f8bad 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1138,6 +1138,10 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src,
         struct talitos_private *priv = dev_get_drvdata(dev);
         bool is_sec1 = has_ftr_sec1(priv);
 
+        if (!src) {
+                to_talitos_ptr(ptr, 0, 0, is_sec1);
+                return 1;
+        }
         if (sg_count == 1) {
                 to_talitos_ptr(ptr, sg_dma_address(src) + offset, len, is_sec1);
                 return sg_count;
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 8b16ec595fa7..329cb96f886f 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -3147,7 +3147,7 @@ static struct amd64_family_type *per_family_init(struct amd64_pvt *pvt)
         struct amd64_family_type *fam_type = NULL;
 
         pvt->ext_model  = boot_cpu_data.x86_model >> 4;
-        pvt->stepping   = boot_cpu_data.x86_mask;
+        pvt->stepping   = boot_cpu_data.x86_stepping;
         pvt->model      = boot_cpu_data.x86_model;
         pvt->fam        = boot_cpu_data.x86;
 
diff --git a/drivers/extcon/extcon-axp288.c b/drivers/extcon/extcon-axp288.c
index 0a44d43802fe..3ec4c715e240 100644
--- a/drivers/extcon/extcon-axp288.c
+++ b/drivers/extcon/extcon-axp288.c
@@ -1,7 +1,6 @@
 /*
  * extcon-axp288.c - X-Power AXP288 PMIC extcon cable detection driver
  *
- * Copyright (C) 2016-2017 Hans de Goede <hdegoede@redhat.com>
  * Copyright (C) 2015 Intel Corporation
  * Author: Ramakrishna Pallala <ramakrishna.pallala@intel.com>
  *
@@ -98,15 +97,13 @@ struct axp288_extcon_info {
         struct device *dev;
         struct regmap *regmap;
         struct regmap_irq_chip_data *regmap_irqc;
-        struct delayed_work det_work;
         int irq[EXTCON_IRQ_END];
         struct extcon_dev *edev;
         unsigned int previous_cable;
-        bool first_detect_done;
 };
 
 /* Power up/down reason string array */
-static char *axp288_pwr_up_down_info[] = {
+static const char * const axp288_pwr_up_down_info[] = {
         "Last wake caused by user pressing the power button",
         "Last wake caused by a charger insertion",
         "Last wake caused by a battery insertion",
@@ -124,7 +121,7 @@ static char *axp288_pwr_up_down_info[] = {
  */
 static void axp288_extcon_log_rsi(struct axp288_extcon_info *info)
 {
-        char **rsi;
+        const char * const *rsi;
         unsigned int val, i, clear_mask = 0;
         int ret;
 
@@ -140,25 +137,6 @@ static void axp288_extcon_log_rsi(struct axp288_extcon_info *info)
         regmap_write(info->regmap, AXP288_PS_BOOT_REASON_REG, clear_mask);
 }
 
-static void axp288_chrg_detect_complete(struct axp288_extcon_info *info)
-{
-        /*
-         * We depend on other drivers to do things like mux the data lines,
-         * enable/disable vbus based on the id-pin, etc. Sometimes the BIOS has
-         * not set these things up correctly resulting in the initial charger
-         * cable type detection giving a wrong result and we end up not charging
-         * or charging at only 0.5A.
-         *
-         * So we schedule a second cable type detection after 2 seconds to
-         * give the other drivers time to load and do their thing.
-         */
-        if (!info->first_detect_done) {
-                queue_delayed_work(system_wq, &info->det_work,
-                                   msecs_to_jiffies(2000));
-                info->first_detect_done = true;
-        }
-}
-
 static int axp288_handle_chrg_det_event(struct axp288_extcon_info *info)
 {
         int ret, stat, cfg, pwr_stat;
@@ -223,8 +201,6 @@ no_vbus:
                 info->previous_cable = cable;
         }
 
-        axp288_chrg_detect_complete(info);
-
         return 0;
 
 dev_det_ret:
@@ -246,11 +222,8 @@ static irqreturn_t axp288_extcon_isr(int irq, void *data)
         return IRQ_HANDLED;
 }
 
-static void axp288_extcon_det_work(struct work_struct *work)
+static void axp288_extcon_enable(struct axp288_extcon_info *info)
 {
-        struct axp288_extcon_info *info =
-                container_of(work, struct axp288_extcon_info, det_work.work);
-
         regmap_update_bits(info->regmap, AXP288_BC_GLOBAL_REG,
                                                 BC_GLOBAL_RUN, 0);
         /* Enable the charger detection logic */
@@ -272,7 +245,6 @@ static int axp288_extcon_probe(struct platform_device *pdev)
         info->regmap = axp20x->regmap;
         info->regmap_irqc = axp20x->regmap_irqc;
         info->previous_cable = EXTCON_NONE;
-        INIT_DELAYED_WORK(&info->det_work, axp288_extcon_det_work);
 
         platform_set_drvdata(pdev, info);
 
@@ -318,7 +290,7 @@ static int axp288_extcon_probe(struct platform_device *pdev)
         }
 
         /* Start charger cable type detection */
-        queue_delayed_work(system_wq, &info->det_work, 0);
+        axp288_extcon_enable(info);
 
         return 0;
 }
diff --git a/drivers/extcon/extcon-intel-int3496.c b/drivers/extcon/extcon-intel-int3496.c
index c8691b5a9cb0..191e99f06a9a 100644
--- a/drivers/extcon/extcon-intel-int3496.c
+++ b/drivers/extcon/extcon-intel-int3496.c
@@ -153,8 +153,9 @@ static int int3496_probe(struct platform_device *pdev)
                 return ret;
         }
 
-        /* queue initial processing of id-pin */
+        /* process id-pin so that we start with the right status */
         queue_delayed_work(system_wq, &data->work, 0);
+        flush_delayed_work(&data->work);
 
         platform_set_drvdata(pdev, data);
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index e2c3c5ec42d1..c53095b3b0fb 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -568,6 +568,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
         /* HG _PR3 doesn't seem to work on this A+A weston board */
         { 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
+        { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0, 0, 0, 0, 0 },
 };
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
index 8ca3783f2deb..74d2efaec52f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -736,9 +736,11 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force)
         enum drm_connector_status ret = connector_status_disconnected;
         int r;
 
-        r = pm_runtime_get_sync(connector->dev->dev);
-        if (r < 0)
-                return connector_status_disconnected;
+        if (!drm_kms_helper_is_poll_worker()) {
+                r = pm_runtime_get_sync(connector->dev->dev);
+                if (r < 0)
+                        return connector_status_disconnected;
+        }
 
         if (encoder) {
                 struct amdgpu_encoder *amdgpu_encoder = to_amdgpu_encoder(encoder);
@@ -757,8 +759,12 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force)
         /* check acpi lid status ??? */
 
         amdgpu_connector_update_scratch_regs(connector, ret);
-        pm_runtime_mark_last_busy(connector->dev->dev);
-        pm_runtime_put_autosuspend(connector->dev->dev);
+
+        if (!drm_kms_helper_is_poll_worker()) {
+                pm_runtime_mark_last_busy(connector->dev->dev);
+                pm_runtime_put_autosuspend(connector->dev->dev);
+        }
+
         return ret;
 }
 
@@ -868,9 +874,11 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force)
         enum drm_connector_status ret = connector_status_disconnected;
         int r;
 
-        r = pm_runtime_get_sync(connector->dev->dev);
-        if (r < 0)
-                return connector_status_disconnected;
+        if (!drm_kms_helper_is_poll_worker()) {
+                r = pm_runtime_get_sync(connector->dev->dev);
+                if (r < 0)
+                        return connector_status_disconnected;
+        }
 
         encoder = amdgpu_connector_best_single_encoder(connector);
         if (!encoder)
@@ -924,8 +932,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force)
         amdgpu_connector_update_scratch_regs(connector, ret);
 
 out:
-        pm_runtime_mark_last_busy(connector->dev->dev);
-        pm_runtime_put_autosuspend(connector->dev->dev);
+        if (!drm_kms_helper_is_poll_worker()) {
+                pm_runtime_mark_last_busy(connector->dev->dev);
+                pm_runtime_put_autosuspend(connector->dev->dev);
+        }
 
         return ret;
 }
@@ -988,9 +998,11 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force)
         enum drm_connector_status ret = connector_status_disconnected;
         bool dret = false, broken_edid = false;
 
-        r = pm_runtime_get_sync(connector->dev->dev);
-        if (r < 0)
-                return connector_status_disconnected;
+        if (!drm_kms_helper_is_poll_worker()) {
+                r = pm_runtime_get_sync(connector->dev->dev);
+                if (r < 0)
+                        return connector_status_disconnected;
+        }
 
         if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
                 ret = connector->status;
@@ -1115,8 +1127,10 @@ out:
         amdgpu_connector_update_scratch_regs(connector, ret);
 
 exit:
-        pm_runtime_mark_last_busy(connector->dev->dev);
-        pm_runtime_put_autosuspend(connector->dev->dev);
+        if (!drm_kms_helper_is_poll_worker()) {
+                pm_runtime_mark_last_busy(connector->dev->dev);
+                pm_runtime_put_autosuspend(connector->dev->dev);
+        }
 
         return ret;
 }
@@ -1359,9 +1373,11 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force)
         struct drm_encoder *encoder = amdgpu_connector_best_single_encoder(connector);
         int r;
 
-        r = pm_runtime_get_sync(connector->dev->dev);
-        if (r < 0)
-                return connector_status_disconnected;
+        if (!drm_kms_helper_is_poll_worker()) {
+                r = pm_runtime_get_sync(connector->dev->dev);
+                if (r < 0)
+                        return connector_status_disconnected;
+        }
 
         if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
                 ret = connector->status;
@@ -1429,8 +1445,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force)
 
         amdgpu_connector_update_scratch_regs(connector, ret);
 out:
-        pm_runtime_mark_last_busy(connector->dev->dev);
-        pm_runtime_put_autosuspend(connector->dev->dev);
+        if (!drm_kms_helper_is_poll_worker()) {
+                pm_runtime_mark_last_busy(connector->dev->dev);
+                pm_runtime_put_autosuspend(connector->dev->dev);
+        }
 
         return ret;
 }
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index 61e8c3e02d16..33d91e4474ea 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -718,7 +718,7 @@ static enum link_training_result perform_channel_equalization_sequence(
         uint32_t retries_ch_eq;
         enum dc_lane_count lane_count = lt_settings->link_settings.lane_count;
         union lane_align_status_updated dpcd_lane_status_updated = {{0}};
-        union lane_status dpcd_lane_status[LANE_COUNT_DP_MAX] = {{{0}}};;
+        union lane_status dpcd_lane_status[LANE_COUNT_DP_MAX] = {{{0}}};
 
         hw_tr_pattern = get_supported_tp(link);
 
diff --git a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
index 4c3223a4d62b..adb6e7b9280c 100644
--- a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
+++ b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
@@ -162,7 +162,7 @@ static int pp_hw_init(void *handle)
                 if(hwmgr->smumgr_funcs->start_smu(pp_handle->hwmgr)) {
                         pr_err("smc start failed\n");
                         hwmgr->smumgr_funcs->smu_fini(pp_handle->hwmgr);
-                        return -EINVAL;;
+                        return -EINVAL;
                 }
                 if (ret == PP_DPM_DISABLED)
                         goto exit;
diff --git a/drivers/gpu/drm/cirrus/cirrus_mode.c b/drivers/gpu/drm/cirrus/cirrus_mode.c
index cd23b1b28259..c91b9b054e3f 100644
--- a/drivers/gpu/drm/cirrus/cirrus_mode.c
+++ b/drivers/gpu/drm/cirrus/cirrus_mode.c
@@ -294,22 +294,7 @@ static void cirrus_crtc_prepare(struct drm_crtc *crtc)
 {
 }
 
-/*
- * This is called after a mode is programmed. It should reverse anything done
- * by the prepare function
- */
-static void cirrus_crtc_commit(struct drm_crtc *crtc)
-{
-}
-
-/*
- * The core can pass us a set of gamma values to program. We actually only
- * use this for 8-bit mode so can't perform smooth fades on deeper modes,
- * but it's a requirement that we provide the function
- */
-static int cirrus_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
-                                 u16 *blue, uint32_t size,
-                                 struct drm_modeset_acquire_ctx *ctx)
+static void cirrus_crtc_load_lut(struct drm_crtc *crtc)
 {
         struct drm_device *dev = crtc->dev;
         struct cirrus_device *cdev = dev->dev_private;
@@ -317,7 +302,7 @@ static int cirrus_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
         int i;
 
         if (!crtc->enabled)
-                return 0;
+                return;
 
         r = crtc->gamma_store;
         g = r + crtc->gamma_size;
@@ -330,6 +315,27 @@ static int cirrus_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
                 WREG8(PALETTE_DATA, *g++ >> 8);
                 WREG8(PALETTE_DATA, *b++ >> 8);
         }
+}
+
+/*
+ * This is called after a mode is programmed. It should reverse anything done
+ * by the prepare function
+ */
+static void cirrus_crtc_commit(struct drm_crtc *crtc)
+{
+        cirrus_crtc_load_lut(crtc);
+}
+
+/*
+ * The core can pass us a set of gamma values to program. We actually only
+ * use this for 8-bit mode so can't perform smooth fades on deeper modes,
+ * but it's a requirement that we provide the function
+ */
+static int cirrus_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
+                                 u16 *blue, uint32_t size,
+                                 struct drm_modeset_acquire_ctx *ctx)
+{
+        cirrus_crtc_load_lut(crtc);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index ab4032167094..ae3cbfe9e01c 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1878,6 +1878,8 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state,
                 new_crtc_state->event->base.completion = &commit->flip_done;
                 new_crtc_state->event->base.completion_release = release_crtc_commit;
                 drm_crtc_commit_get(commit);
+
+                commit->abort_completion = true;
         }
 
         for_each_oldnew_connector_in_state(state, conn, old_conn_state, new_conn_state, i) {
@@ -3421,8 +3423,21 @@ EXPORT_SYMBOL(drm_atomic_helper_crtc_duplicate_state);
 void __drm_atomic_helper_crtc_destroy_state(struct drm_crtc_state *state)
 {
         if (state->commit) {
+                /*
+                 * In the event that a non-blocking commit returns
+                 * -ERESTARTSYS before the commit_tail work is queued, we will
+                 * have an extra reference to the commit object. Release it, if
+                 * the event has not been consumed by the worker.
+                 *
+                 * state->event may be freed, so we can't directly look at
+                 * state->event->base.completion.
+                 */
+                if (state->event && state->commit->abort_completion)
+                        drm_crtc_commit_put(state->commit);
+
                 kfree(state->commit->event);
                 state->commit->event = NULL;
+
                 drm_crtc_commit_put(state->commit);
         }
 
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index ddd537914575..4f751a9d71a3 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -113,6 +113,9 @@ static const struct edid_quirk {
         /* AEO model 0 reports 8 bpc, but is a 6 bpc panel */
         { "AEO", 0, EDID_QUIRK_FORCE_6BPC },
 
+        /* CPT panel of Asus UX303LA reports 8 bpc, but is a 6 bpc panel */
+        { "CPT", 0x17df, EDID_QUIRK_FORCE_6BPC },
+
         /* Belinea 10 15 55 */
         { "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 },
         { "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 },
@@ -162,6 +165,24 @@ static const struct edid_quirk {
 
         /* HTC Vive VR Headset */
         { "HVR", 0xaa01, EDID_QUIRK_NON_DESKTOP },
+
+        /* Oculus Rift DK1, DK2, and CV1 VR Headsets */
+        { "OVR", 0x0001, EDID_QUIRK_NON_DESKTOP },
+        { "OVR", 0x0003, EDID_QUIRK_NON_DESKTOP },
+        { "OVR", 0x0004, EDID_QUIRK_NON_DESKTOP },
+
+        /* Windows Mixed Reality Headsets */
+        { "ACR", 0x7fce, EDID_QUIRK_NON_DESKTOP },
+        { "HPN", 0x3515, EDID_QUIRK_NON_DESKTOP },
+        { "LEN", 0x0408, EDID_QUIRK_NON_DESKTOP },
+        { "LEN", 0xb800, EDID_QUIRK_NON_DESKTOP },
+        { "FUJ", 0x1970, EDID_QUIRK_NON_DESKTOP },
+        { "DEL", 0x7fce, EDID_QUIRK_NON_DESKTOP },
+        { "SEC", 0x144a, EDID_QUIRK_NON_DESKTOP },
+        { "AUS", 0xc102, EDID_QUIRK_NON_DESKTOP },
+
+        /* Sony PlayStation VR Headset */
+        { "SNY", 0x0704, EDID_QUIRK_NON_DESKTOP },
 };
 
 /*
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 186c4e90cc1c..89eef1bb4ddc 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -836,9 +836,24 @@ struct drm_mm_node *drm_mm_scan_color_evict(struct drm_mm_scan *scan)
         if (!mm->color_adjust)
                 return NULL;
 
-        hole = list_first_entry(&mm->hole_stack, typeof(*hole), hole_stack);
-        hole_start = __drm_mm_hole_node_start(hole);
-        hole_end = hole_start + hole->hole_size;
+        /*
+         * The hole found during scanning should ideally be the first element
+         * in the hole_stack list, but due to side-effects in the driver it
+         * may not be.
+         */
+        list_for_each_entry(hole, &mm->hole_stack, hole_stack) {
+                hole_start = __drm_mm_hole_node_start(hole);
+                hole_end = hole_start + hole->hole_size;
+
+                if (hole_start <= scan->hit_start &&
+                    hole_end >= scan->hit_end)
+                        break;
+        }
+
+        /* We should only be called after we found the hole previously */
+        DRM_MM_BUG_ON(&hole->hole_stack == &mm->hole_stack);
+        if (unlikely(&hole->hole_stack == &mm->hole_stack))
+                return NULL;
 
         DRM_MM_BUG_ON(hole_start > scan->hit_start);
         DRM_MM_BUG_ON(hole_end < scan->hit_end);
diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
index 555fbe54d6e2..00b8445ba819 100644
--- a/drivers/gpu/drm/drm_probe_helper.c
+++ b/drivers/gpu/drm/drm_probe_helper.c
@@ -654,6 +654,26 @@ out:
 }
 
 /**
+ * drm_kms_helper_is_poll_worker - is %current task an output poll worker?
+ *
+ * Determine if %current task is an output poll worker.  This can be used
+ * to select distinct code paths for output polling versus other contexts.
+ *
+ * One use case is to avoid a deadlock between the output poll worker and
+ * the autosuspend worker wherein the latter waits for polling to finish
+ * upon calling drm_kms_helper_poll_disable(), while the former waits for
+ * runtime suspend to finish upon calling pm_runtime_get_sync() in a
+ * connector ->detect hook.
+ */
+bool drm_kms_helper_is_poll_worker(void)
+{
+        struct work_struct *work = current_work();
+
+        return work && work->func == output_poll_execute;
+}
+EXPORT_SYMBOL(drm_kms_helper_is_poll_worker);
+
+/**
  * drm_kms_helper_poll_disable - disable output polling
  * @dev: drm_device
  *
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 2b8bf2dd6387..f68ef1b3a28c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -286,7 +286,6 @@ static int g2d_init_cmdlist(struct g2d_data *g2d)
 
         node = kcalloc(G2D_CMDLIST_NUM, sizeof(*node), GFP_KERNEL);
         if (!node) {
-                dev_err(dev, "failed to allocate memory\n");
                 ret = -ENOMEM;
                 goto err;
         }
@@ -926,7 +925,7 @@ static void g2d_finish_event(struct g2d_data *g2d, u32 cmdlist_no)
         struct drm_device *drm_dev = g2d->subdrv.drm_dev;
         struct g2d_runqueue_node *runqueue_node = g2d->runqueue_node;
         struct drm_exynos_pending_g2d_event *e;
-        struct timeval now;
+        struct timespec64 now;
 
         if (list_empty(&runqueue_node->event_list))
                 return;
@@ -934,9 +933,9 @@ static void g2d_finish_event(struct g2d_data *g2d, u32 cmdlist_no)
         e = list_first_entry(&runqueue_node->event_list,
                              struct drm_exynos_pending_g2d_event, base.link);
 
-        do_gettimeofday(&now);
+        ktime_get_ts64(&now);
         e->event.tv_sec = now.tv_sec;
-        e->event.tv_usec = now.tv_usec;
+        e->event.tv_usec = now.tv_nsec / NSEC_PER_USEC;
         e->event.cmdlist_no = cmdlist_no;
 
         drm_send_event(drm_dev, &e->base);
@@ -1358,10 +1357,9 @@ int exynos_g2d_exec_ioctl(struct drm_device *drm_dev, void *data,
                 return -EFAULT;
 
         runqueue_node = kmem_cache_alloc(g2d->runqueue_slab, GFP_KERNEL);
-        if (!runqueue_node) {
-                dev_err(dev, "failed to allocate memory\n");
+        if (!runqueue_node)
                 return -ENOMEM;
-        }
+
         run_cmdlist = &runqueue_node->run_cmdlist;
         event_list = &runqueue_node->event_list;
         INIT_LIST_HEAD(run_cmdlist);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_rotator.h b/drivers/gpu/drm/exynos/exynos_drm_rotator.h
deleted file mode 100644
index 71a0b4c0c1e8..000000000000
--- a/drivers/gpu/drm/exynos/exynos_drm_rotator.h
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright (c) 2012 Samsung Electronics Co., Ltd.
- *
- * Authors:
- *      YoungJun Cho <yj44.cho@samsung.com>
- *      Eunchul Kim <chulspro.kim@samsung.com>
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- */
-
-#ifndef _EXYNOS_DRM_ROTATOR_H_
-#define _EXYNOS_DRM_ROTATOR_H_
-
-/* TODO */
-
-#endif
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index a4b75a46f946..abd84cbcf1c2 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -1068,10 +1068,13 @@ static void hdmi_audio_config(struct hdmi_context *hdata)
         /* Configuration I2S input ports. Configure I2S_PIN_SEL_0~4 */
         hdmi_reg_writeb(hdata, HDMI_I2S_PIN_SEL_0, HDMI_I2S_SEL_SCLK(5)
                         | HDMI_I2S_SEL_LRCK(6));
-        hdmi_reg_writeb(hdata, HDMI_I2S_PIN_SEL_1, HDMI_I2S_SEL_SDATA1(1)
-                        | HDMI_I2S_SEL_SDATA2(4));
+
+        hdmi_reg_writeb(hdata, HDMI_I2S_PIN_SEL_1, HDMI_I2S_SEL_SDATA1(3)
+                        | HDMI_I2S_SEL_SDATA0(4));
+
         hdmi_reg_writeb(hdata, HDMI_I2S_PIN_SEL_2, HDMI_I2S_SEL_SDATA3(1)
                         | HDMI_I2S_SEL_SDATA2(2));
+
         hdmi_reg_writeb(hdata, HDMI_I2S_PIN_SEL_3, HDMI_I2S_SEL_DSD(0));
 
         /* I2S_CON_1 & 2 */
diff --git a/drivers/gpu/drm/exynos/regs-fimc.h b/drivers/gpu/drm/exynos/regs-fimc.h
index 30496134a3d0..d7cbe53c4c01 100644
--- a/drivers/gpu/drm/exynos/regs-fimc.h
+++ b/drivers/gpu/drm/exynos/regs-fimc.h
@@ -569,7 +569,7 @@
 #define EXYNOS_CIIMGEFF_FIN_EMBOSSING           (4 << 26)
 #define EXYNOS_CIIMGEFF_FIN_SILHOUETTE          (5 << 26)
 #define EXYNOS_CIIMGEFF_FIN_MASK                        (7 << 26)
-#define EXYNOS_CIIMGEFF_PAT_CBCR_MASK           ((0xff < 13) | (0xff < 0))
+#define EXYNOS_CIIMGEFF_PAT_CBCR_MASK           ((0xff << 13) | (0xff << 0))
 
 /* Real input DMA size register */
 #define EXYNOS_CIREAL_ISIZE_AUTOLOAD_ENABLE     (1 << 31)
diff --git a/drivers/gpu/drm/exynos/regs-hdmi.h b/drivers/gpu/drm/exynos/regs-hdmi.h
index 04be0f7e8193..4420c203ac85 100644
--- a/drivers/gpu/drm/exynos/regs-hdmi.h
+++ b/drivers/gpu/drm/exynos/regs-hdmi.h
@@ -464,7 +464,7 @@
 
 /* I2S_PIN_SEL_1 */
 #define HDMI_I2S_SEL_SDATA1(x)          (((x) & 0x7) << 4)
-#define HDMI_I2S_SEL_SDATA2(x)          ((x) & 0x7)
+#define HDMI_I2S_SEL_SDATA0(x)          ((x) & 0x7)
 
 /* I2S_PIN_SEL_2 */
 #define HDMI_I2S_SEL_SDATA3(x)          (((x) & 0x7) << 4)
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index 909499b73d03..021f722e2481 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -733,6 +733,25 @@ static ssize_t intel_vgpu_rw(struct mdev_device *mdev, char *buf,
         return ret == 0 ? count : ret;
 }
 
+static bool gtt_entry(struct mdev_device *mdev, loff_t *ppos)
+{
+        struct intel_vgpu *vgpu = mdev_get_drvdata(mdev);
+        unsigned int index = VFIO_PCI_OFFSET_TO_INDEX(*ppos);
+        struct intel_gvt *gvt = vgpu->gvt;
+        int offset;
+
+        /* Only allow MMIO GGTT entry access */
+        if (index != PCI_BASE_ADDRESS_0)
+                return false;
+
+        offset = (u64)(*ppos & VFIO_PCI_OFFSET_MASK) -
+                intel_vgpu_get_bar_gpa(vgpu, PCI_BASE_ADDRESS_0);
+
+        return (offset >= gvt->device_info.gtt_start_offset &&
+                offset < gvt->device_info.gtt_start_offset + gvt_ggtt_sz(gvt)) ?
+                        true : false;
+}
+
 static ssize_t intel_vgpu_read(struct mdev_device *mdev, char __user *buf,
                         size_t count, loff_t *ppos)
 {
@@ -742,7 +761,21 @@ static ssize_t intel_vgpu_read(struct mdev_device *mdev, char __user *buf,
         while (count) {
                 size_t filled;
 
-                if (count >= 4 && !(*ppos % 4)) {
+                /* Only support GGTT entry 8 bytes read */
+                if (count >= 8 && !(*ppos % 8) &&
+                        gtt_entry(mdev, ppos)) {
+                        u64 val;
+
+                        ret = intel_vgpu_rw(mdev, (char *)&val, sizeof(val),
+                                        ppos, false);
+                        if (ret <= 0)
+                                goto read_err;
+
+                        if (copy_to_user(buf, &val, sizeof(val)))
+                                goto read_err;
+
+                        filled = 8;
+                } else if (count >= 4 && !(*ppos % 4)) {
                         u32 val;
 
                         ret = intel_vgpu_rw(mdev, (char *)&val, sizeof(val),
@@ -802,7 +835,21 @@ static ssize_t intel_vgpu_write(struct mdev_device *mdev,
         while (count) {
                 size_t filled;
 
-                if (count >= 4 && !(*ppos % 4)) {
+                /* Only support GGTT entry 8 bytes write */
+                if (count >= 8 && !(*ppos % 8) &&
+                        gtt_entry(mdev, ppos)) {
+                        u64 val;
+
+                        if (copy_from_user(&val, buf, sizeof(val)))
+                                goto write_err;
+
+                        ret = intel_vgpu_rw(mdev, (char *)&val, sizeof(val),
+                                        ppos, true);
+                        if (ret <= 0)
+                                goto write_err;
+
+                        filled = 8;
+                } else if (count >= 4 && !(*ppos % 4)) {
                         u32 val;
 
                         if (copy_from_user(&val, buf, sizeof(val)))
diff --git a/drivers/gpu/drm/i915/gvt/mmio_context.c b/drivers/gpu/drm/i915/gvt/mmio_context.c
index 73ad6e90e49d..256f1bb522b7 100644
--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
+++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
@@ -118,6 +118,7 @@ static struct engine_mmio gen9_engine_mmio_list[] __cacheline_aligned = {
         {RCS, HALF_SLICE_CHICKEN3, 0xffff, true}, /* 0xe184 */
         {RCS, GEN9_HALF_SLICE_CHICKEN5, 0xffff, true}, /* 0xe188 */
         {RCS, GEN9_HALF_SLICE_CHICKEN7, 0xffff, true}, /* 0xe194 */
+        {RCS, GEN8_ROW_CHICKEN, 0xffff, true}, /* 0xe4f0 */
         {RCS, TRVATTL3PTRDW(0), 0, false}, /* 0x4de0 */
         {RCS, TRVATTL3PTRDW(1), 0, false}, /* 0x4de4 */
         {RCS, TRNULLDETCT, 0, false}, /* 0x4de8 */
diff --git a/drivers/gpu/drm/i915/gvt/trace.h b/drivers/gpu/drm/i915/gvt/trace.h
index 7a2511538f34..736bd2bc5127 100644
--- a/drivers/gpu/drm/i915/gvt/trace.h
+++ b/drivers/gpu/drm/i915/gvt/trace.h
@@ -333,7 +333,7 @@ TRACE_EVENT(render_mmio,
         TP_PROTO(int old_id, int new_id, char *action, unsigned int reg,
                  unsigned int old_val, unsigned int new_val),
 
-        TP_ARGS(old_id, new_id, action, reg, new_val, old_val),
+        TP_ARGS(old_id, new_id, action, reg, old_val, new_val),
 
         TP_STRUCT__entry(
                 __field(int, old_id)
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 173d0095e3b2..2f5209de0391 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1433,19 +1433,7 @@ void i915_driver_unload(struct drm_device *dev)
 
         intel_modeset_cleanup(dev);
 
-        /*
-         * free the memory space allocated for the child device
-         * config parsed from VBT
-         */
-        if (dev_priv->vbt.child_dev && dev_priv->vbt.child_dev_num) {
-                kfree(dev_priv->vbt.child_dev);
-                dev_priv->vbt.child_dev = NULL;
-                dev_priv->vbt.child_dev_num = 0;
-        }
-        kfree(dev_priv->vbt.sdvo_lvds_vbt_mode);
-        dev_priv->vbt.sdvo_lvds_vbt_mode = NULL;
-        kfree(dev_priv->vbt.lfp_lvds_vbt_mode);
-        dev_priv->vbt.lfp_lvds_vbt_mode = NULL;
+        intel_bios_cleanup(dev_priv);
 
         vga_switcheroo_unregister_client(pdev);
         vga_client_register(pdev, NULL, NULL, NULL);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index a42deebedb0f..d307429a5ae0 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1349,6 +1349,7 @@ struct intel_vbt_data {
                 u32 size;
                 u8 *data;
                 const u8 *sequence[MIPI_SEQ_MAX];
+                u8 *deassert_seq; /* Used by fixup_mipi_sequences() */
         } dsi;
 
         int crt_ddc_pin;
@@ -3657,6 +3658,7 @@ extern void intel_i2c_reset(struct drm_i915_private *dev_priv);
 
 /* intel_bios.c */
 void intel_bios_init(struct drm_i915_private *dev_priv);
+void intel_bios_cleanup(struct drm_i915_private *dev_priv);
 bool intel_bios_is_valid_vbt(const void *buf, size_t size);
 bool intel_bios_is_tv_present(struct drm_i915_private *dev_priv);
 bool intel_bios_is_lvds_present(struct drm_i915_private *dev_priv, u8 *i2c_pin);
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 648e7536ff51..0c963fcf31ff 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -803,7 +803,7 @@ int i915_gem_context_setparam_ioctl(struct drm_device *dev, void *data,
 
         case I915_CONTEXT_PARAM_PRIORITY:
                 {
-                        int priority = args->value;
+                        s64 priority = args->value;
 
                         if (args->size)
                                 ret = -EINVAL;
diff --git a/drivers/gpu/drm/i915/i915_oa_cflgt3.c b/drivers/gpu/drm/i915/i915_oa_cflgt3.c
index 42ff06fe54a3..792facdb6702 100644
--- a/drivers/gpu/drm/i915/i915_oa_cflgt3.c
+++ b/drivers/gpu/drm/i915/i915_oa_cflgt3.c
@@ -84,9 +84,9 @@ show_test_oa_id(struct device *kdev, struct device_attribute *attr, char *buf)
 void
 i915_perf_load_test_config_cflgt3(struct drm_i915_private *dev_priv)
 {
-        strncpy(dev_priv->perf.oa.test_config.uuid,
+        strlcpy(dev_priv->perf.oa.test_config.uuid,
                 "577e8e2c-3fa0-4875-8743-3538d585e3b0",
-                UUID_STRING_LEN);
+                sizeof(dev_priv->perf.oa.test_config.uuid));
         dev_priv->perf.oa.test_config.id = 1;
 
         dev_priv->perf.oa.test_config.mux_regs = mux_config_test_oa;
diff --git a/drivers/gpu/drm/i915/i915_oa_cnl.c b/drivers/gpu/drm/i915/i915_oa_cnl.c
index ff0ac3627cc4..ba9140c87cc0 100644
--- a/drivers/gpu/drm/i915/i915_oa_cnl.c
+++ b/drivers/gpu/drm/i915/i915_oa_cnl.c
@@ -96,9 +96,9 @@ show_test_oa_id(struct device *kdev, struct device_attribute *attr, char *buf)
 void
 i915_perf_load_test_config_cnl(struct drm_i915_private *dev_priv)
 {
-        strncpy(dev_priv->perf.oa.test_config.uuid,
+        strlcpy(dev_priv->perf.oa.test_config.uuid,
                 "db41edd4-d8e7-4730-ad11-b9a2d6833503",
-                UUID_STRING_LEN);
+                sizeof(dev_priv->perf.oa.test_config.uuid));
         dev_priv->perf.oa.test_config.id = 1;
 
         dev_priv->perf.oa.test_config.mux_regs = mux_config_test_oa;
diff --git a/drivers/gpu/drm/i915/i915_pmu.c b/drivers/gpu/drm/i915/i915_pmu.c
index 55a8a1e29424..0e9b98c32b62 100644
--- a/drivers/gpu/drm/i915/i915_pmu.c
+++ b/drivers/gpu/drm/i915/i915_pmu.c
@@ -285,26 +285,41 @@ static u64 count_interrupts(struct drm_i915_private *i915)
         return sum;
 }
 
-static void i915_pmu_event_destroy(struct perf_event *event)
+static void engine_event_destroy(struct perf_event *event)
 {
-        WARN_ON(event->parent);
+        struct drm_i915_private *i915 =
+                container_of(event->pmu, typeof(*i915), pmu.base);
+        struct intel_engine_cs *engine;
+
+        engine = intel_engine_lookup_user(i915,
+                                          engine_event_class(event),
+                                          engine_event_instance(event));
+        if (WARN_ON_ONCE(!engine))
+                return;
+
+        if (engine_event_sample(event) == I915_SAMPLE_BUSY &&
+            intel_engine_supports_stats(engine))
+                intel_disable_engine_stats(engine);
 }
 
-static int engine_event_init(struct perf_event *event)
+static void i915_pmu_event_destroy(struct perf_event *event)
 {
-        struct drm_i915_private *i915 =
-                container_of(event->pmu, typeof(*i915), pmu.base);
+        WARN_ON(event->parent);
 
-        if (!intel_engine_lookup_user(i915, engine_event_class(event),
-                                      engine_event_instance(event)))
-                return -ENODEV;
+        if (is_engine_event(event))
+                engine_event_destroy(event);
+}
 
-        switch (engine_event_sample(event)) {
+static int
+engine_event_status(struct intel_engine_cs *engine,
+                    enum drm_i915_pmu_engine_sample sample)
+{
+        switch (sample) {
         case I915_SAMPLE_BUSY:
         case I915_SAMPLE_WAIT:
                 break;
         case I915_SAMPLE_SEMA:
-                if (INTEL_GEN(i915) < 6)
+                if (INTEL_GEN(engine->i915) < 6)
                         return -ENODEV;
                 break;
         default:
@@ -314,6 +329,30 @@ static int engine_event_init(struct perf_event *event)
         return 0;
 }
 
+static int engine_event_init(struct perf_event *event)
+{
+        struct drm_i915_private *i915 =
+                container_of(event->pmu, typeof(*i915), pmu.base);
+        struct intel_engine_cs *engine;
+        u8 sample;
+        int ret;
+
+        engine = intel_engine_lookup_user(i915, engine_event_class(event),
+                                          engine_event_instance(event));
+        if (!engine)
+                return -ENODEV;
+
+        sample = engine_event_sample(event);
+        ret = engine_event_status(engine, sample);
+        if (ret)
+                return ret;
+
+        if (sample == I915_SAMPLE_BUSY && intel_engine_supports_stats(engine))
+                ret = intel_enable_engine_stats(engine);
+
+        return ret;
+}
+
 static int i915_pmu_event_init(struct perf_event *event)
 {
         struct drm_i915_private *i915 =
@@ -370,7 +409,94 @@ static int i915_pmu_event_init(struct perf_event *event)
         return 0;
 }
 
-static u64 __i915_pmu_event_read(struct perf_event *event)
+static u64 __get_rc6(struct drm_i915_private *i915)
+{
+        u64 val;
+
+        val = intel_rc6_residency_ns(i915,
+                                     IS_VALLEYVIEW(i915) ?
+                                     VLV_GT_RENDER_RC6 :
+                                     GEN6_GT_GFX_RC6);
+
+        if (HAS_RC6p(i915))
+                val += intel_rc6_residency_ns(i915, GEN6_GT_GFX_RC6p);
+
+        if (HAS_RC6pp(i915))
+                val += intel_rc6_residency_ns(i915, GEN6_GT_GFX_RC6pp);
+
+        return val;
+}
+
+static u64 get_rc6(struct drm_i915_private *i915, bool locked)
+{
+#if IS_ENABLED(CONFIG_PM)
+        unsigned long flags;
+        u64 val;
+
+        if (intel_runtime_pm_get_if_in_use(i915)) {
+                val = __get_rc6(i915);
+                intel_runtime_pm_put(i915);
+
+                /*
+                 * If we are coming back from being runtime suspended we must
+                 * be careful not to report a larger value than returned
+                 * previously.
+                 */
+
+                if (!locked)
+                        spin_lock_irqsave(&i915->pmu.lock, flags);
+
+                if (val >= i915->pmu.sample[__I915_SAMPLE_RC6_ESTIMATED].cur) {
+                        i915->pmu.sample[__I915_SAMPLE_RC6_ESTIMATED].cur = 0;
+                        i915->pmu.sample[__I915_SAMPLE_RC6].cur = val;
+                } else {
+                        val = i915->pmu.sample[__I915_SAMPLE_RC6_ESTIMATED].cur;
+                }
+
+                if (!locked)
+                        spin_unlock_irqrestore(&i915->pmu.lock, flags);
+        } else {
+                struct pci_dev *pdev = i915->drm.pdev;
+                struct device *kdev = &pdev->dev;
+                unsigned long flags2;
+
+                /*
+                 * We are runtime suspended.
+                 *
+                 * Report the delta from when the device was suspended to now,
+                 * on top of the last known real value, as the approximated RC6
+                 * counter value.
+                 */
+                if (!locked)
+                        spin_lock_irqsave(&i915->pmu.lock, flags);
+
+                spin_lock_irqsave(&kdev->power.lock, flags2);
+
+                if (!i915->pmu.sample[__I915_SAMPLE_RC6_ESTIMATED].cur)
+                        i915->pmu.suspended_jiffies_last =
+                                                kdev->power.suspended_jiffies;
+
+                val = kdev->power.suspended_jiffies -
+                      i915->pmu.suspended_jiffies_last;
+                val += jiffies - kdev->power.accounting_timestamp;
+
+                spin_unlock_irqrestore(&kdev->power.lock, flags2);
+
+                val = jiffies_to_nsecs(val);
+                val += i915->pmu.sample[__I915_SAMPLE_RC6].cur;
+                i915->pmu.sample[__I915_SAMPLE_RC6_ESTIMATED].cur = val;
+
+                if (!locked)
+                        spin_unlock_irqrestore(&i915->pmu.lock, flags);
+        }
+
+        return val;
+#else
+        return __get_rc6(i915);
+#endif
+}
+
+static u64 __i915_pmu_event_read(struct perf_event *event, bool locked)
 {
         struct drm_i915_private *i915 =
                 container_of(event->pmu, typeof(*i915), pmu.base);
@@ -387,7 +513,7 @@ static u64 __i915_pmu_event_read(struct perf_event *event)
                 if (WARN_ON_ONCE(!engine)) {
                         /* Do nothing */
                 } else if (sample == I915_SAMPLE_BUSY &&
-                           engine->pmu.busy_stats) {
+                           intel_engine_supports_stats(engine)) {
                         val = ktime_to_ns(intel_engine_get_busy_time(engine));
                 } else {
                         val = engine->pmu.sample[sample].cur;
@@ -408,18 +534,7 @@ static u64 __i915_pmu_event_read(struct perf_event *event)
                         val = count_interrupts(i915);
                         break;
                 case I915_PMU_RC6_RESIDENCY:
-                        intel_runtime_pm_get(i915);
-                        val = intel_rc6_residency_ns(i915,
-                                                     IS_VALLEYVIEW(i915) ?
-                                                     VLV_GT_RENDER_RC6 :
-                                                     GEN6_GT_GFX_RC6);
-                        if (HAS_RC6p(i915))
-                                val += intel_rc6_residency_ns(i915,
-                                                              GEN6_GT_GFX_RC6p);
-                        if (HAS_RC6pp(i915))
-                                val += intel_rc6_residency_ns(i915,
-                                                              GEN6_GT_GFX_RC6pp);
-                        intel_runtime_pm_put(i915);
+                        val = get_rc6(i915, locked);
                         break;
                 }
         }
@@ -434,7 +549,7 @@ static void i915_pmu_event_read(struct perf_event *event)
 
 again:
         prev = local64_read(&hwc->prev_count);
-        new = __i915_pmu_event_read(event);
+        new = __i915_pmu_event_read(event, false);
 
         if (local64_cmpxchg(&hwc->prev_count, prev, new) != prev)
                 goto again;
@@ -442,12 +557,6 @@ again:
         local64_add(new - prev, &event->count);
 }
 
-static bool engine_needs_busy_stats(struct intel_engine_cs *engine)
-{
-        return intel_engine_supports_stats(engine) &&
-               (engine->pmu.enable & BIT(I915_SAMPLE_BUSY));
-}
-
 static void i915_pmu_enable(struct perf_event *event)
 {
         struct drm_i915_private *i915 =
@@ -487,21 +596,7 @@ static void i915_pmu_enable(struct perf_event *event)
 
                 GEM_BUG_ON(sample >= I915_PMU_SAMPLE_BITS);
                 GEM_BUG_ON(engine->pmu.enable_count[sample] == ~0);
-                if (engine->pmu.enable_count[sample]++ == 0) {
-                        /*
-                         * Enable engine busy stats tracking if needed or
-                         * alternatively cancel the scheduled disable.
-                         *
-                         * If the delayed disable was pending, cancel it and
-                         * in this case do not enable since it already is.
-                         */
-                        if (engine_needs_busy_stats(engine) &&
-                            !engine->pmu.busy_stats) {
-                                engine->pmu.busy_stats = true;
-                                if (!cancel_delayed_work(&engine->pmu.disable_busy_stats))
-                                        intel_enable_engine_stats(engine);
-                        }
-                }
+                engine->pmu.enable_count[sample]++;
         }
 
         /*
@@ -509,19 +604,11 @@ static void i915_pmu_enable(struct perf_event *event)
          * for all listeners. Even when the event was already enabled and has
          * an existing non-zero value.
          */
-        local64_set(&event->hw.prev_count, __i915_pmu_event_read(event));
+        local64_set(&event->hw.prev_count, __i915_pmu_event_read(event, true));
 
         spin_unlock_irqrestore(&i915->pmu.lock, flags);
 }
 
-static void __disable_busy_stats(struct work_struct *work)
-{
-        struct intel_engine_cs *engine =
-               container_of(work, typeof(*engine), pmu.disable_busy_stats.work);
-
-        intel_disable_engine_stats(engine);
-}
-
 static void i915_pmu_disable(struct perf_event *event)
 {
         struct drm_i915_private *i915 =
@@ -545,26 +632,8 @@ static void i915_pmu_disable(struct perf_event *event)
                  * Decrement the reference count and clear the enabled
                  * bitmask when the last listener on an event goes away.
                  */
-                if (--engine->pmu.enable_count[sample] == 0) {
+                if (--engine->pmu.enable_count[sample] == 0)
                         engine->pmu.enable &= ~BIT(sample);
-                        if (!engine_needs_busy_stats(engine) &&
-                            engine->pmu.busy_stats) {
-                                engine->pmu.busy_stats = false;
-                                /*
-                                 * We request a delayed disable to handle the
-                                 * rapid on/off cycles on events, which can
-                                 * happen when tools like perf stat start, in a
-                                 * nicer way.
-                                 *
-                                 * In addition, this also helps with busy stats
-                                 * accuracy with background CPU offline/online
-                                 * migration events.
-                                 */
-                                queue_delayed_work(system_wq,
-                                                   &engine->pmu.disable_busy_stats,
-                                                   round_jiffies_up_relative(HZ));
-                        }
-                }
         }
 
         GEM_BUG_ON(bit >= I915_PMU_MASK_BITS);
@@ -797,8 +866,6 @@ static void i915_pmu_unregister_cpuhp_state(struct drm_i915_private *i915)
 
 void i915_pmu_register(struct drm_i915_private *i915)
 {
-        struct intel_engine_cs *engine;
-        enum intel_engine_id id;
         int ret;
 
         if (INTEL_GEN(i915) <= 2) {
@@ -820,10 +887,6 @@ void i915_pmu_register(struct drm_i915_private *i915)
         hrtimer_init(&i915->pmu.timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
         i915->pmu.timer.function = i915_sample;
 
-        for_each_engine(engine, i915, id)
-                INIT_DELAYED_WORK(&engine->pmu.disable_busy_stats,
-                                  __disable_busy_stats);
-
         ret = perf_pmu_register(&i915->pmu.base, "i915", -1);
         if (ret)
                 goto err;
@@ -843,9 +906,6 @@ err:
 
 void i915_pmu_unregister(struct drm_i915_private *i915)
 {
-        struct intel_engine_cs *engine;
-        enum intel_engine_id id;
-
         if (!i915->pmu.base.event_init)
                 return;
 
@@ -853,11 +913,6 @@ void i915_pmu_unregister(struct drm_i915_private *i915)
 
         hrtimer_cancel(&i915->pmu.timer);
 
-        for_each_engine(engine, i915, id) {
-                GEM_BUG_ON(engine->pmu.busy_stats);
-                flush_delayed_work(&engine->pmu.disable_busy_stats);
-        }
-
         i915_pmu_unregister_cpuhp_state(i915);
 
         perf_pmu_unregister(&i915->pmu.base);
diff --git a/drivers/gpu/drm/i915/i915_pmu.h b/drivers/gpu/drm/i915/i915_pmu.h
index 40c154d13565..bb62df15afa4 100644
--- a/drivers/gpu/drm/i915/i915_pmu.h
+++ b/drivers/gpu/drm/i915/i915_pmu.h
@@ -27,6 +27,8 @@
 enum {
         __I915_SAMPLE_FREQ_ACT = 0,
         __I915_SAMPLE_FREQ_REQ,
+        __I915_SAMPLE_RC6,
+        __I915_SAMPLE_RC6_ESTIMATED,
         __I915_NUM_PMU_SAMPLERS
 };
 
@@ -94,6 +96,10 @@ struct i915_pmu {
          * struct intel_engine_cs.
          */
         struct i915_pmu_sample sample[__I915_NUM_PMU_SAMPLERS];
+        /**
+         * @suspended_jiffies_last: Cached suspend time from PM core.
+         */
+        unsigned long suspended_jiffies_last;
 };
 
 #ifdef CONFIG_PERF_EVENTS
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index f7f771749e48..b49a2df44430 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -947,6 +947,86 @@ static int goto_next_sequence_v3(const u8 *data, int index, int total)
         return 0;
 }
 
+/*
+ * Get len of pre-fixed deassert fragment from a v1 init OTP sequence,
+ * skip all delay + gpio operands and stop at the first DSI packet op.
+ */
+static int get_init_otp_deassert_fragment_len(struct drm_i915_private *dev_priv)
+{
+        const u8 *data = dev_priv->vbt.dsi.sequence[MIPI_SEQ_INIT_OTP];
+        int index, len;
+
+        if (WARN_ON(!data || dev_priv->vbt.dsi.seq_version != 1))
+                return 0;
+
+        /* index = 1 to skip sequence byte */
+        for (index = 1; data[index] != MIPI_SEQ_ELEM_END; index += len) {
+                switch (data[index]) {
+                case MIPI_SEQ_ELEM_SEND_PKT:
+                        return index == 1 ? 0 : index;
+                case MIPI_SEQ_ELEM_DELAY:
+                        len = 5; /* 1 byte for operand + uint32 */
+                        break;
+                case MIPI_SEQ_ELEM_GPIO:
+                        len = 3; /* 1 byte for op, 1 for gpio_nr, 1 for value */
+                        break;
+                default:
+                        return 0;
+                }
+        }
+
+        return 0;
+}
+
+/*
+ * Some v1 VBT MIPI sequences do the deassert in the init OTP sequence.
+ * The deassert must be done before calling intel_dsi_device_ready, so for
+ * these devices we split the init OTP sequence into a deassert sequence and
+ * the actual init OTP part.
+ */
+static void fixup_mipi_sequences(struct drm_i915_private *dev_priv)
+{
+        u8 *init_otp;
+        int len;
+
+        /* Limit this to VLV for now. */
+        if (!IS_VALLEYVIEW(dev_priv))
+                return;
+
+        /* Limit this to v1 vid-mode sequences */
+        if (dev_priv->vbt.dsi.config->is_cmd_mode ||
+            dev_priv->vbt.dsi.seq_version != 1)
+                return;
+
+        /* Only do this if there are otp and assert seqs and no deassert seq */
+        if (!dev_priv->vbt.dsi.sequence[MIPI_SEQ_INIT_OTP] ||
+            !dev_priv->vbt.dsi.sequence[MIPI_SEQ_ASSERT_RESET] ||
+            dev_priv->vbt.dsi.sequence[MIPI_SEQ_DEASSERT_RESET])
+                return;
+
+        /* The deassert-sequence ends at the first DSI packet */
+        len = get_init_otp_deassert_fragment_len(dev_priv);
+        if (!len)
+                return;
+
+        DRM_DEBUG_KMS("Using init OTP fragment to deassert reset\n");
+
+        /* Copy the fragment, update seq byte and terminate it */
+        init_otp = (u8 *)dev_priv->vbt.dsi.sequence[MIPI_SEQ_INIT_OTP];
+        dev_priv->vbt.dsi.deassert_seq = kmemdup(init_otp, len + 1, GFP_KERNEL);
+        if (!dev_priv->vbt.dsi.deassert_seq)
+                return;
+        dev_priv->vbt.dsi.deassert_seq[0] = MIPI_SEQ_DEASSERT_RESET;
+        dev_priv->vbt.dsi.deassert_seq[len] = MIPI_SEQ_ELEM_END;
+        /* Use the copy for deassert */
+        dev_priv->vbt.dsi.sequence[MIPI_SEQ_DEASSERT_RESET] =
+                dev_priv->vbt.dsi.deassert_seq;
+        /* Replace the last byte of the fragment with init OTP seq byte */
+        init_otp[len - 1] = MIPI_SEQ_INIT_OTP;
+        /* And make MIPI_MIPI_SEQ_INIT_OTP point to it */
+        dev_priv->vbt.dsi.sequence[MIPI_SEQ_INIT_OTP] = init_otp + len - 1;
+}
+
 static void
 parse_mipi_sequence(struct drm_i915_private *dev_priv,
                     const struct bdb_header *bdb)
@@ -1016,6 +1096,8 @@ parse_mipi_sequence(struct drm_i915_private *dev_priv,
         dev_priv->vbt.dsi.size = seq_size;
         dev_priv->vbt.dsi.seq_version = sequence->version;
 
+        fixup_mipi_sequences(dev_priv);
+
         DRM_DEBUG_DRIVER("MIPI related VBT parsing complete\n");
         return;
 
@@ -1589,6 +1671,29 @@ out:
 }
 
 /**
+ * intel_bios_cleanup - Free any resources allocated by intel_bios_init()
+ * @dev_priv: i915 device instance
+ */
+void intel_bios_cleanup(struct drm_i915_private *dev_priv)
+{
+        kfree(dev_priv->vbt.child_dev);
+        dev_priv->vbt.child_dev = NULL;
+        dev_priv->vbt.child_dev_num = 0;
+        kfree(dev_priv->vbt.sdvo_lvds_vbt_mode);
+        dev_priv->vbt.sdvo_lvds_vbt_mode = NULL;
+        kfree(dev_priv->vbt.lfp_lvds_vbt_mode);
+        dev_priv->vbt.lfp_lvds_vbt_mode = NULL;
+        kfree(dev_priv->vbt.dsi.data);
+        dev_priv->vbt.dsi.data = NULL;
+        kfree(dev_priv->vbt.dsi.pps);
+        dev_priv->vbt.dsi.pps = NULL;
+        kfree(dev_priv->vbt.dsi.config);
+        dev_priv->vbt.dsi.config = NULL;
+        kfree(dev_priv->vbt.dsi.deassert_seq);
+        dev_priv->vbt.dsi.deassert_seq = NULL;
+}
+
+/**
  * intel_bios_is_tv_present - is integrated TV present in VBT
  * @dev_priv:   i915 device instance
  *
diff --git a/drivers/gpu/drm/i915/intel_breadcrumbs.c b/drivers/gpu/drm/i915/intel_breadcrumbs.c
index bd40fea16b4f..f54ddda9fdad 100644
--- a/drivers/gpu/drm/i915/intel_breadcrumbs.c
+++ b/drivers/gpu/drm/i915/intel_breadcrumbs.c
@@ -594,29 +594,16 @@ void intel_engine_remove_wait(struct intel_engine_cs *engine,
         spin_unlock_irq(&b->rb_lock);
 }
 
-static bool signal_valid(const struct drm_i915_gem_request *request)
-{
-        return intel_wait_check_request(&request->signaling.wait, request);
-}
-
 static bool signal_complete(const struct drm_i915_gem_request *request)
 {
         if (!request)
                 return false;
 
-        /* If another process served as the bottom-half it may have already
-         * signalled that this wait is already completed.
-         */
-        if (intel_wait_complete(&request->signaling.wait))
-                return signal_valid(request);
-
-        /* Carefully check if the request is complete, giving time for the
+        /*
+         * Carefully check if the request is complete, giving time for the
          * seqno to be visible or if the GPU hung.
          */
-        if (__i915_request_irq_complete(request))
-                return true;
-
-        return false;
+        return __i915_request_irq_complete(request);
 }
 
 static struct drm_i915_gem_request *to_signaler(struct rb_node *rb)
@@ -659,9 +646,13 @@ static int intel_breadcrumbs_signaler(void *arg)
                         request = i915_gem_request_get_rcu(request);
                 rcu_read_unlock();
                 if (signal_complete(request)) {
-                        local_bh_disable();
-                        dma_fence_signal(&request->fence);
-                        local_bh_enable(); /* kick start the tasklets */
+                        if (!test_bit(DMA_FENCE_FLAG_SIGNALED_BIT,
+                                      &request->fence.flags)) {
+                                local_bh_disable();
+                                dma_fence_signal(&request->fence);
+                                GEM_BUG_ON(!i915_gem_request_completed(request));
+                                local_bh_enable(); /* kick start the tasklets */
+                        }
 
                         spin_lock_irq(&b->rb_lock);
 
diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c
index 5dc118f26b51..1704c8897afd 100644
--- a/drivers/gpu/drm/i915/intel_cdclk.c
+++ b/drivers/gpu/drm/i915/intel_cdclk.c
@@ -1952,6 +1952,14 @@ int intel_crtc_compute_min_cdclk(const struct intel_crtc_state *crtc_state)
         if (crtc_state->has_audio && INTEL_GEN(dev_priv) >= 9)
                 min_cdclk = max(2 * 96000, min_cdclk);
 
+        /*
+         * On Valleyview some DSI panels lose (v|h)sync when the clock is lower
+         * than 320000KHz.
+         */
+        if (intel_crtc_has_type(crtc_state, INTEL_OUTPUT_DSI) &&
+            IS_VALLEYVIEW(dev_priv))
+                min_cdclk = max(320000, min_cdclk);
+
         if (min_cdclk > dev_priv->max_cdclk_freq) {
                 DRM_DEBUG_KMS("required cdclk (%d kHz) exceeds max (%d kHz)\n",
                               min_cdclk, dev_priv->max_cdclk_freq);
diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index d790bdc227ff..fa960cfd2764 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -1458,7 +1458,9 @@ static bool ring_is_idle(struct intel_engine_cs *engine)
         struct drm_i915_private *dev_priv = engine->i915;
         bool idle = true;
 
-        intel_runtime_pm_get(dev_priv);
+        /* If the whole device is asleep, the engine must be idle */
+        if (!intel_runtime_pm_get_if_in_use(dev_priv))
+                return true;
 
         /* First check that no commands are left in the ring */
         if ((I915_READ_HEAD(engine) & HEAD_ADDR) !=
@@ -1943,16 +1945,22 @@ intel_engine_lookup_user(struct drm_i915_private *i915, u8 class, u8 instance)
  */
 int intel_enable_engine_stats(struct intel_engine_cs *engine)
 {
+        struct intel_engine_execlists *execlists = &engine->execlists;
         unsigned long flags;
+        int err = 0;
 
         if (!intel_engine_supports_stats(engine))
                 return -ENODEV;
 
+        tasklet_disable(&execlists->tasklet);
         spin_lock_irqsave(&engine->stats.lock, flags);
-        if (engine->stats.enabled == ~0)
-                goto busy;
+
+        if (unlikely(engine->stats.enabled == ~0)) {
+                err = -EBUSY;
+                goto unlock;
+        }
+
         if (engine->stats.enabled++ == 0) {
-                struct intel_engine_execlists *execlists = &engine->execlists;
                 const struct execlist_port *port = execlists->port;
                 unsigned int num_ports = execlists_num_ports(execlists);
 
@@ -1967,14 +1975,12 @@ int intel_enable_engine_stats(struct intel_engine_cs *engine)
                 if (engine->stats.active)
                         engine->stats.start = engine->stats.enabled_at;
         }
-        spin_unlock_irqrestore(&engine->stats.lock, flags);
-
-        return 0;
 
-busy:
+unlock:
         spin_unlock_irqrestore(&engine->stats.lock, flags);
+        tasklet_enable(&execlists->tasklet);
 
-        return -EBUSY;
+        return err;
 }
 
 static ktime_t __intel_engine_get_busy_time(struct intel_engine_cs *engine)
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index c5ff203e42d6..a0e7a6c2a57c 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -366,20 +366,6 @@ struct intel_engine_cs {
                  */
 #define I915_ENGINE_SAMPLE_MAX (I915_SAMPLE_SEMA + 1)
                 struct i915_pmu_sample sample[I915_ENGINE_SAMPLE_MAX];
-                /**
-                 * @busy_stats: Has enablement of engine stats tracking been
-                 *              requested.
-                 */
-                bool busy_stats;
-                /**
-                 * @disable_busy_stats: Work item for busy stats disabling.
-                 *
-                 * Same as with @enable_busy_stats action, with the difference
-                 * that we delay it in case there are rapid enable-disable
-                 * actions, which can happen during tool startup (like perf
-                 * stat).
-                 */
-                struct delayed_work disable_busy_stats;
         } pmu;
 
         /*
diff --git a/drivers/gpu/drm/meson/meson_crtc.c b/drivers/gpu/drm/meson/meson_crtc.c
index 5155f0179b61..05520202c967 100644
--- a/drivers/gpu/drm/meson/meson_crtc.c
+++ b/drivers/gpu/drm/meson/meson_crtc.c
@@ -36,6 +36,7 @@
 #include "meson_venc.h"
 #include "meson_vpp.h"
 #include "meson_viu.h"
+#include "meson_canvas.h"
 #include "meson_registers.h"
 
 /* CRTC definition */
@@ -192,6 +193,11 @@ void meson_crtc_irq(struct meson_drm *priv)
                 } else
                         meson_vpp_disable_interlace_vscaler_osd1(priv);
 
+                meson_canvas_setup(priv, MESON_CANVAS_ID_OSD1,
+                           priv->viu.osd1_addr, priv->viu.osd1_stride,
+                           priv->viu.osd1_height, MESON_CANVAS_WRAP_NONE,
+                           MESON_CANVAS_BLKMODE_LINEAR);
+
                 /* Enable OSD1 */
                 writel_bits_relaxed(VPP_OSD1_POSTBLEND, VPP_OSD1_POSTBLEND,
                                     priv->io_base + _REG(VPP_MISC));
diff --git a/drivers/gpu/drm/meson/meson_drv.h b/drivers/gpu/drm/meson/meson_drv.h
index 5e8b392b9d1f..8450d6ac8c9b 100644
--- a/drivers/gpu/drm/meson/meson_drv.h
+++ b/drivers/gpu/drm/meson/meson_drv.h
@@ -43,6 +43,9 @@ struct meson_drm {
                 bool osd1_commit;
                 uint32_t osd1_ctrl_stat;
                 uint32_t osd1_blk0_cfg[5];
+                uint32_t osd1_addr;
+                uint32_t osd1_stride;
+                uint32_t osd1_height;
         } viu;
 
         struct {
diff --git a/drivers/gpu/drm/meson/meson_plane.c b/drivers/gpu/drm/meson/meson_plane.c
index d0a6ac8390f3..27bd3503e1e4 100644
--- a/drivers/gpu/drm/meson/meson_plane.c
+++ b/drivers/gpu/drm/meson/meson_plane.c
@@ -164,10 +164,9 @@ static void meson_plane_atomic_update(struct drm_plane *plane,
         /* Update Canvas with buffer address */
         gem = drm_fb_cma_get_gem_obj(fb, 0);
 
-        meson_canvas_setup(priv, MESON_CANVAS_ID_OSD1,
-                           gem->paddr, fb->pitches[0],
-                           fb->height, MESON_CANVAS_WRAP_NONE,
-                           MESON_CANVAS_BLKMODE_LINEAR);
+        priv->viu.osd1_addr = gem->paddr;
+        priv->viu.osd1_stride = fb->pitches[0];
+        priv->viu.osd1_height = fb->height;
 
         spin_unlock_irqrestore(&priv->drm->event_lock, flags);
 }
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
index 3e9bba4d6624..6d8e3a9a6fc0 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
@@ -680,7 +680,7 @@ struct msm_kms *mdp5_kms_init(struct drm_device *dev)
         } else {
                 dev_info(&pdev->dev,
                          "no iommu, fallback to phys contig buffers for scanout\n");
-                aspace = NULL;;
+                aspace = NULL;
         }
 
         pm_runtime_put_sync(&pdev->dev);
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 69d6e61a01ec..6ed9cb053dfa 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -570,9 +570,15 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
                 nv_connector->edid = NULL;
         }
 
-        ret = pm_runtime_get_sync(connector->dev->dev);
-        if (ret < 0 && ret != -EACCES)
-                return conn_status;
+        /* Outputs are only polled while runtime active, so acquiring a
+         * runtime PM ref here is unnecessary (and would deadlock upon
+         * runtime suspend because it waits for polling to finish).
+         */
+        if (!drm_kms_helper_is_poll_worker()) {
+                ret = pm_runtime_get_sync(connector->dev->dev);
+                if (ret < 0 && ret != -EACCES)
+                        return conn_status;
+        }
 
         nv_encoder = nouveau_connector_ddc_detect(connector);
         if (nv_encoder && (i2c = nv_encoder->i2c) != NULL) {
@@ -647,8 +653,10 @@ detect_analog:
 
  out:
 
-        pm_runtime_mark_last_busy(connector->dev->dev);
-        pm_runtime_put_autosuspend(connector->dev->dev);
+        if (!drm_kms_helper_is_poll_worker()) {
+                pm_runtime_mark_last_busy(connector->dev->dev);
+                pm_runtime_put_autosuspend(connector->dev->dev);
+        }
 
         return conn_status;
 }
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
index bf62303571b3..3695cde669f8 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
@@ -301,7 +301,7 @@ nvkm_therm_attr_set(struct nvkm_therm *therm,
 void
 nvkm_therm_clkgate_enable(struct nvkm_therm *therm)
 {
-        if (!therm->func->clkgate_enable || !therm->clkgating_enabled)
+        if (!therm || !therm->func->clkgate_enable || !therm->clkgating_enabled)
                 return;
 
         nvkm_debug(&therm->subdev,
@@ -312,7 +312,7 @@ nvkm_therm_clkgate_enable(struct nvkm_therm *therm)
 void
 nvkm_therm_clkgate_fini(struct nvkm_therm *therm, bool suspend)
 {
-        if (!therm->func->clkgate_fini || !therm->clkgating_enabled)
+        if (!therm || !therm->func->clkgate_fini || !therm->clkgating_enabled)
                 return;
 
         nvkm_debug(&therm->subdev,
@@ -395,7 +395,7 @@ void
 nvkm_therm_clkgate_init(struct nvkm_therm *therm,
                         const struct nvkm_therm_clkgate_pack *p)
 {
-        if (!therm->func->clkgate_init || !therm->clkgating_enabled)
+        if (!therm || !therm->func->clkgate_init || !therm->clkgating_enabled)
                 return;
 
         therm->func->clkgate_init(therm, p);
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 5012f5e47a1e..2e2ca3c6b47d 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -899,9 +899,11 @@ radeon_lvds_detect(struct drm_connector *connector, bool force)
         enum drm_connector_status ret = connector_status_disconnected;
         int r;
 
-        r = pm_runtime_get_sync(connector->dev->dev);
-        if (r < 0)
-                return connector_status_disconnected;
+        if (!drm_kms_helper_is_poll_worker()) {
+                r = pm_runtime_get_sync(connector->dev->dev);
+                if (r < 0)
+                        return connector_status_disconnected;
+        }
 
         if (encoder) {
                 struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
@@ -924,8 +926,12 @@ radeon_lvds_detect(struct drm_connector *connector, bool force)
         /* check acpi lid status ??? */
 
         radeon_connector_update_scratch_regs(connector, ret);
-        pm_runtime_mark_last_busy(connector->dev->dev);
-        pm_runtime_put_autosuspend(connector->dev->dev);
+
+        if (!drm_kms_helper_is_poll_worker()) {
+                pm_runtime_mark_last_busy(connector->dev->dev);
+                pm_runtime_put_autosuspend(connector->dev->dev);
+        }
+
         return ret;
 }
 
@@ -1039,9 +1045,11 @@ radeon_vga_detect(struct drm_connector *connector, bool force)
         enum drm_connector_status ret = connector_status_disconnected;
         int r;
 
-        r = pm_runtime_get_sync(connector->dev->dev);
-        if (r < 0)
-                return connector_status_disconnected;
+        if (!drm_kms_helper_is_poll_worker()) {
+                r = pm_runtime_get_sync(connector->dev->dev);
+                if (r < 0)
+                        return connector_status_disconnected;
+        }
 
         encoder = radeon_best_single_encoder(connector);
         if (!encoder)
@@ -1108,8 +1116,10 @@ radeon_vga_detect(struct drm_connector *connector, bool force)
         radeon_connector_update_scratch_regs(connector, ret);
 
 out:
-        pm_runtime_mark_last_busy(connector->dev->dev);
-        pm_runtime_put_autosuspend(connector->dev->dev);
+        if (!drm_kms_helper_is_poll_worker()) {
+                pm_runtime_mark_last_busy(connector->dev->dev);
+                pm_runtime_put_autosuspend(connector->dev->dev);
+        }
 
         return ret;
 }
@@ -1173,9 +1183,11 @@ radeon_tv_detect(struct drm_connector *connector, bool force)
         if (!radeon_connector->dac_load_detect)
                 return ret;
 
-        r = pm_runtime_get_sync(connector->dev->dev);
-        if (r < 0)
-                return connector_status_disconnected;
+        if (!drm_kms_helper_is_poll_worker()) {
+                r = pm_runtime_get_sync(connector->dev->dev);
+                if (r < 0)
+                        return connector_status_disconnected;
+        }
 
         encoder = radeon_best_single_encoder(connector);
         if (!encoder)
@@ -1187,8 +1199,12 @@ radeon_tv_detect(struct drm_connector *connector, bool force)
         if (ret == connector_status_connected)
                 ret = radeon_connector_analog_encoder_conflict_solve(connector, encoder, ret, false);
         radeon_connector_update_scratch_regs(connector, ret);
-        pm_runtime_mark_last_busy(connector->dev->dev);
-        pm_runtime_put_autosuspend(connector->dev->dev);
+
+        if (!drm_kms_helper_is_poll_worker()) {
+                pm_runtime_mark_last_busy(connector->dev->dev);
+                pm_runtime_put_autosuspend(connector->dev->dev);
+        }
+
         return ret;
 }
 
@@ -1251,9 +1267,11 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
         enum drm_connector_status ret = connector_status_disconnected;
         bool dret = false, broken_edid = false;
 
-        r = pm_runtime_get_sync(connector->dev->dev);
-        if (r < 0)
-                return connector_status_disconnected;
+        if (!drm_kms_helper_is_poll_worker()) {
+                r = pm_runtime_get_sync(connector->dev->dev);
+                if (r < 0)
+                        return connector_status_disconnected;
+        }
 
         if (radeon_connector->detected_hpd_without_ddc) {
                 force = true;
@@ -1436,8 +1454,10 @@ out:
         }
 
 exit:
-        pm_runtime_mark_last_busy(connector->dev->dev);
-        pm_runtime_put_autosuspend(connector->dev->dev);
+        if (!drm_kms_helper_is_poll_worker()) {
+                pm_runtime_mark_last_busy(connector->dev->dev);
+                pm_runtime_put_autosuspend(connector->dev->dev);
+        }
 
         return ret;
 }
@@ -1688,9 +1708,11 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
         if (radeon_dig_connector->is_mst)
                 return connector_status_disconnected;
 
-        r = pm_runtime_get_sync(connector->dev->dev);
-        if (r < 0)
-                return connector_status_disconnected;
+        if (!drm_kms_helper_is_poll_worker()) {
+                r = pm_runtime_get_sync(connector->dev->dev);
+                if (r < 0)
+                        return connector_status_disconnected;
+        }
 
         if (!force && radeon_check_hpd_status_unchanged(connector)) {
                 ret = connector->status;
@@ -1777,8 +1799,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
         }
 
 out:
-        pm_runtime_mark_last_busy(connector->dev->dev);
-        pm_runtime_put_autosuspend(connector->dev->dev);
+        if (!drm_kms_helper_is_poll_worker()) {
+                pm_runtime_mark_last_busy(connector->dev->dev);
+                pm_runtime_put_autosuspend(connector->dev->dev);
+        }
 
         return ret;
 }
diff --git a/drivers/gpu/drm/scheduler/gpu_scheduler.c b/drivers/gpu/drm/scheduler/gpu_scheduler.c
index 2c18996d59c5..0d95888ccc3e 100644
--- a/drivers/gpu/drm/scheduler/gpu_scheduler.c
+++ b/drivers/gpu/drm/scheduler/gpu_scheduler.c
@@ -461,7 +461,7 @@ void drm_sched_hw_job_reset(struct drm_gpu_scheduler *sched, struct drm_sched_jo
 {
         struct drm_sched_job *s_job;
         struct drm_sched_entity *entity, *tmp;
-        int i;;
+        int i;
 
         spin_lock(&sched->job_list_lock);
         list_for_each_entry_reverse(s_job, &sched->ring_mirror_list, node) {
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index 658fa2d3e40c..48685cddbad1 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -1089,7 +1089,7 @@ static void ipu_irq_handler(struct irq_desc *desc)
 {
         struct ipu_soc *ipu = irq_desc_get_handler_data(desc);
         struct irq_chip *chip = irq_desc_get_chip(desc);
-        const int int_reg[] = { 0, 1, 2, 3, 10, 11, 12, 13, 14};
+        static const int int_reg[] = { 0, 1, 2, 3, 10, 11, 12, 13, 14};
 
         chained_irq_enter(chip, desc);
 
@@ -1102,7 +1102,7 @@ static void ipu_err_irq_handler(struct irq_desc *desc)
 {
         struct ipu_soc *ipu = irq_desc_get_handler_data(desc);
         struct irq_chip *chip = irq_desc_get_chip(desc);
-        const int int_reg[] = { 4, 5, 8, 9};
+        static const int int_reg[] = { 4, 5, 8, 9};
 
         chained_irq_enter(chip, desc);
 
diff --git a/drivers/gpu/ipu-v3/ipu-cpmem.c b/drivers/gpu/ipu-v3/ipu-cpmem.c
index bb9c087e6c0d..9f2d9ec42add 100644
--- a/drivers/gpu/ipu-v3/ipu-cpmem.c
+++ b/drivers/gpu/ipu-v3/ipu-cpmem.c
@@ -788,12 +788,14 @@ int ipu_cpmem_set_image(struct ipuv3_channel *ch, struct ipu_image *image)
         case V4L2_PIX_FMT_SGBRG8:
         case V4L2_PIX_FMT_SGRBG8:
         case V4L2_PIX_FMT_SRGGB8:
+        case V4L2_PIX_FMT_GREY:
                 offset = image->rect.left + image->rect.top * pix->bytesperline;
                 break;
         case V4L2_PIX_FMT_SBGGR16:
         case V4L2_PIX_FMT_SGBRG16:
         case V4L2_PIX_FMT_SGRBG16:
         case V4L2_PIX_FMT_SRGGB16:
+        case V4L2_PIX_FMT_Y16:
                 offset = image->rect.left * 2 +
                          image->rect.top * pix->bytesperline;
                 break;
diff --git a/drivers/gpu/ipu-v3/ipu-csi.c b/drivers/gpu/ipu-v3/ipu-csi.c
index 24e12b87a0cb..caa05b0702e1 100644
--- a/drivers/gpu/ipu-v3/ipu-csi.c
+++ b/drivers/gpu/ipu-v3/ipu-csi.c
@@ -288,6 +288,7 @@ static int mbus_code_to_bus_cfg(struct ipu_csi_bus_config *cfg, u32 mbus_code)
         case MEDIA_BUS_FMT_SGBRG10_1X10:
         case MEDIA_BUS_FMT_SGRBG10_1X10:
         case MEDIA_BUS_FMT_SRGGB10_1X10:
+        case MEDIA_BUS_FMT_Y10_1X10:
                 cfg->data_fmt = CSI_SENS_CONF_DATA_FMT_BAYER;
                 cfg->mipi_dt = MIPI_DT_RAW10;
                 cfg->data_width = IPU_CSI_DATA_WIDTH_10;
@@ -296,6 +297,7 @@ static int mbus_code_to_bus_cfg(struct ipu_csi_bus_config *cfg, u32 mbus_code)
         case MEDIA_BUS_FMT_SGBRG12_1X12:
         case MEDIA_BUS_FMT_SGRBG12_1X12:
         case MEDIA_BUS_FMT_SRGGB12_1X12:
+        case MEDIA_BUS_FMT_Y12_1X12:
                 cfg->data_fmt = CSI_SENS_CONF_DATA_FMT_BAYER;
                 cfg->mipi_dt = MIPI_DT_RAW12;
                 cfg->data_width = IPU_CSI_DATA_WIDTH_12;
diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c
index f1cec3d70498..0f70e8847540 100644
--- a/drivers/gpu/ipu-v3/ipu-pre.c
+++ b/drivers/gpu/ipu-v3/ipu-pre.c
@@ -129,11 +129,14 @@ ipu_pre_lookup_by_phandle(struct device *dev, const char *name, int index)
                 if (pre_node == pre->dev->of_node) {
                         mutex_unlock(&ipu_pre_list_mutex);
                         device_link_add(dev, pre->dev, DL_FLAG_AUTOREMOVE);
+                        of_node_put(pre_node);
                         return pre;
                 }
         }
         mutex_unlock(&ipu_pre_list_mutex);
 
+        of_node_put(pre_node);
+
         return NULL;
 }
 
diff --git a/drivers/gpu/ipu-v3/ipu-prg.c b/drivers/gpu/ipu-v3/ipu-prg.c
index 067365c733c6..97b99500153d 100644
--- a/drivers/gpu/ipu-v3/ipu-prg.c
+++ b/drivers/gpu/ipu-v3/ipu-prg.c
@@ -102,11 +102,14 @@ ipu_prg_lookup_by_phandle(struct device *dev, const char *name, int ipu_id)
                         mutex_unlock(&ipu_prg_list_mutex);
                         device_link_add(dev, prg->dev, DL_FLAG_AUTOREMOVE);
                         prg->id = ipu_id;
+                        of_node_put(prg_node);
                         return prg;
                 }
         }
         mutex_unlock(&ipu_prg_list_mutex);
 
+        of_node_put(prg_node);
+
         return NULL;
 }
 
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 43ddcdfbd0da..9454ac134ce2 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -645,6 +645,9 @@
 #define USB_DEVICE_ID_LD_MICROCASSYTIME         0x1033
 #define USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE  0x1035
 #define USB_DEVICE_ID_LD_MICROCASSYPH           0x1038
+#define USB_DEVICE_ID_LD_POWERANALYSERCASSY     0x1040
+#define USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY       0x1042
+#define USB_DEVICE_ID_LD_MACHINETESTCASSY       0x1043
 #define USB_DEVICE_ID_LD_JWM            0x1080
 #define USB_DEVICE_ID_LD_DMMP           0x1081
 #define USB_DEVICE_ID_LD_UMIP           0x1090
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 5f6035a5ce36..e92b77fa574a 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -809,6 +809,9 @@ static const struct hid_device_id hid_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTIME) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYPH) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POWERANALYSERCASSY) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MACHINETESTCASSY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_JWM) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_DMMP) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_UMIP) },
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 4bdbf77f7197..72c338eb5fae 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -269,13 +269,13 @@ static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
         for (i = 0; i < ARRAY_SIZE(tjmax_model_table); i++) {
                 const struct tjmax_model *tm = &tjmax_model_table[i];
                 if (c->x86_model == tm->model &&
-                    (tm->mask == ANY || c->x86_mask == tm->mask))
+                    (tm->mask == ANY || c->x86_stepping == tm->mask))
                         return tm->tjmax;
         }
 
         /* Early chips have no MSR for TjMax */
 
-        if (c->x86_model == 0xf && c->x86_mask < 4)
+        if (c->x86_model == 0xf && c->x86_stepping < 4)
                 usemsr_ee = 0;
 
         if (c->x86_model > 0xe && usemsr_ee) {
@@ -426,7 +426,7 @@ static int chk_ucode_version(unsigned int cpu)
          * Readings might stop update when processor visited too deep sleep,
          * fixed for stepping D0 (6EC).
          */
-        if (c->x86_model == 0xe && c->x86_mask < 0xc && c->microcode < 0x39) {
+        if (c->x86_model == 0xe && c->x86_stepping < 0xc && c->microcode < 0x39) {
                 pr_err("Errata AE18 not fixed, update BIOS or microcode of the CPU!\n");
                 return -ENODEV;
         }
diff --git a/drivers/hwmon/hwmon-vid.c b/drivers/hwmon/hwmon-vid.c
index ef91b8a67549..84e91286fc4f 100644
--- a/drivers/hwmon/hwmon-vid.c
+++ b/drivers/hwmon/hwmon-vid.c
@@ -293,7 +293,7 @@ u8 vid_which_vrm(void)
         if (c->x86 < 6)         /* Any CPU with family lower than 6 */
                 return 0;       /* doesn't have VID */
 
-        vrm_ret = find_vrm(c->x86, c->x86_model, c->x86_mask, c->x86_vendor);
+        vrm_ret = find_vrm(c->x86, c->x86_model, c->x86_stepping, c->x86_vendor);
         if (vrm_ret == 134)
                 vrm_ret = get_via_model_d_vrm();
         if (vrm_ret == 0)
diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
index 06b4e1c78bd8..051a72eecb24 100644
--- a/drivers/hwmon/k10temp.c
+++ b/drivers/hwmon/k10temp.c
@@ -129,7 +129,10 @@ static ssize_t temp1_input_show(struct device *dev,
 
         data->read_tempreg(data->pdev, &regval);
         temp = (regval >> 21) * 125;
-        temp -= data->temp_offset;
+        if (temp > data->temp_offset)
+                temp -= data->temp_offset;
+        else
+                temp = 0;
 
         return sprintf(buf, "%u\n", temp);
 }
@@ -227,7 +230,7 @@ static bool has_erratum_319(struct pci_dev *pdev)
          * and AM3 formats, but that's the best we can do.
          */
         return boot_cpu_data.x86_model < 4 ||
-               (boot_cpu_data.x86_model == 4 && boot_cpu_data.x86_mask <= 2);
+               (boot_cpu_data.x86_model == 4 && boot_cpu_data.x86_stepping <= 2);
 }
 
 static int k10temp_probe(struct pci_dev *pdev,
diff --git a/drivers/hwmon/k8temp.c b/drivers/hwmon/k8temp.c
index 5a632bcf869b..e59f9113fb93 100644
--- a/drivers/hwmon/k8temp.c
+++ b/drivers/hwmon/k8temp.c
@@ -187,7 +187,7 @@ static int k8temp_probe(struct pci_dev *pdev,
                 return -ENOMEM;
 
         model = boot_cpu_data.x86_model;
-        stepping = boot_cpu_data.x86_mask;
+        stepping = boot_cpu_data.x86_stepping;
 
         /* feature available since SH-C0, exclude older revisions */
         if ((model == 4 && stepping == 0) ||
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index a9805c7cb305..e2954fb86d65 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -123,8 +123,10 @@ config I2C_I801
             Wildcat Point (PCH)
             Wildcat Point-LP (PCH)
             BayTrail (SOC)
+            Braswell (SOC)
             Sunrise Point-H (PCH)
             Sunrise Point-LP (PCH)
+            Kaby Lake-H (PCH)
             DNV (SOC)
             Broxton (SOC)
             Lewisburg (PCH)
diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
index cd07a69e2e93..44deae78913e 100644
--- a/drivers/i2c/busses/i2c-bcm2835.c
+++ b/drivers/i2c/busses/i2c-bcm2835.c
@@ -50,6 +50,9 @@
 #define BCM2835_I2C_S_CLKT      BIT(9)
 #define BCM2835_I2C_S_LEN       BIT(10) /* Fake bit for SW error reporting */
 
+#define BCM2835_I2C_FEDL_SHIFT  16
+#define BCM2835_I2C_REDL_SHIFT  0
+
 #define BCM2835_I2C_CDIV_MIN    0x0002
 #define BCM2835_I2C_CDIV_MAX    0xFFFE
 
@@ -81,7 +84,7 @@ static inline u32 bcm2835_i2c_readl(struct bcm2835_i2c_dev *i2c_dev, u32 reg)
 
 static int bcm2835_i2c_set_divider(struct bcm2835_i2c_dev *i2c_dev)
 {
-        u32 divider;
+        u32 divider, redl, fedl;
 
         divider = DIV_ROUND_UP(clk_get_rate(i2c_dev->clk),
                                i2c_dev->bus_clk_rate);
@@ -100,6 +103,22 @@ static int bcm2835_i2c_set_divider(struct bcm2835_i2c_dev *i2c_dev)
 
         bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_DIV, divider);
 
+        /*
+         * Number of core clocks to wait after falling edge before
+         * outputting the next data bit.  Note that both FEDL and REDL
+         * can't be greater than CDIV/2.
+         */
+        fedl = max(divider / 16, 1u);
+
+        /*
+         * Number of core clocks to wait after rising edge before
+         * sampling the next incoming data bit.
+         */
+        redl = max(divider / 4, 1u);
+
+        bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_DEL,
+                           (fedl << BCM2835_I2C_FEDL_SHIFT) |
+                           (redl << BCM2835_I2C_REDL_SHIFT));
         return 0;
 }
 
diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
index ae691884d071..05732531829f 100644
--- a/drivers/i2c/busses/i2c-designware-master.c
+++ b/drivers/i2c/busses/i2c-designware-master.c
@@ -209,7 +209,7 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
         i2c_dw_disable_int(dev);
 
         /* Enable the adapter */
-        __i2c_dw_enable(dev, true);
+        __i2c_dw_enable_and_wait(dev, true);
 
         /* Clear and enable interrupts */
         dw_readl(dev, DW_IC_CLR_INTR);
@@ -644,7 +644,7 @@ static int i2c_dw_init_recovery_info(struct dw_i2c_dev *dev)
         gpio = devm_gpiod_get(dev->dev, "scl", GPIOD_OUT_HIGH);
         if (IS_ERR(gpio)) {
                 r = PTR_ERR(gpio);
-                if (r == -ENOENT)
+                if (r == -ENOENT || r == -ENOSYS)
                         return 0;
                 return r;
         }
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 8eac00efadc1..692b34125866 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -58,6 +58,7 @@
  * Wildcat Point (PCH)          0x8ca2  32      hard    yes     yes     yes
  * Wildcat Point-LP (PCH)       0x9ca2  32      hard    yes     yes     yes
  * BayTrail (SOC)               0x0f12  32      hard    yes     yes     yes
+ * Braswell (SOC)               0x2292  32      hard    yes     yes     yes
  * Sunrise Point-H (PCH)        0xa123  32      hard    yes     yes     yes
  * Sunrise Point-LP (PCH)       0x9d23  32      hard    yes     yes     yes
  * DNV (SOC)                    0x19df  32      hard    yes     yes     yes
diff --git a/drivers/i2c/busses/i2c-sirf.c b/drivers/i2c/busses/i2c-sirf.c
index 2fd8b6d00391..87197ece0f90 100644
--- a/drivers/i2c/busses/i2c-sirf.c
+++ b/drivers/i2c/busses/i2c-sirf.c
@@ -341,7 +341,7 @@ static int i2c_sirfsoc_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, adap);
         init_completion(&siic->done);
 
-        /* Controller Initalisation */
+        /* Controller initialisation */
 
         writel(SIRFSOC_I2C_RESET, siic->base + SIRFSOC_I2C_CTRL);
         while (readl(siic->base + SIRFSOC_I2C_CTRL) & SIRFSOC_I2C_RESET)
@@ -369,7 +369,7 @@ static int i2c_sirfsoc_probe(struct platform_device *pdev)
          * but they start to affect the speed when clock is set to faster
          * frequencies.
          * Through the actual tests, use the different user_div value(which
-         * in the divider formular 'Fio / (Fi2c * user_div)') to adapt
+         * in the divider formula 'Fio / (Fi2c * user_div)') to adapt
          * the different ranges of i2c bus clock frequency, to make the SCL
          * more accurate.
          */
diff --git a/drivers/iio/adc/aspeed_adc.c b/drivers/iio/adc/aspeed_adc.c
index 327a49ba1991..9515ca165dfd 100644
--- a/drivers/iio/adc/aspeed_adc.c
+++ b/drivers/iio/adc/aspeed_adc.c
@@ -243,7 +243,7 @@ static int aspeed_adc_probe(struct platform_device *pdev)
                                          ASPEED_ADC_INIT_POLLING_TIME,
                                          ASPEED_ADC_INIT_TIMEOUT);
                 if (ret)
-                        goto scaler_error;
+                        goto poll_timeout_error;
         }
 
         /* Start all channels in normal mode. */
@@ -274,9 +274,10 @@ iio_register_error:
         writel(ASPEED_OPERATION_MODE_POWER_DOWN,
                 data->base + ASPEED_REG_ENGINE_CONTROL);
         clk_disable_unprepare(data->clk_scaler->clk);
-reset_error:
-        reset_control_assert(data->rst);
 clk_enable_error:
+poll_timeout_error:
+        reset_control_assert(data->rst);
+reset_error:
         clk_hw_unregister_divider(data->clk_scaler);
 scaler_error:
         clk_hw_unregister_divider(data->clk_prescaler);
diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
index 7f5def465340..9a2583caedaa 100644
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -722,8 +722,6 @@ static int stm32h7_adc_enable(struct stm32_adc *adc)
         int ret;
         u32 val;
 
-        /* Clear ADRDY by writing one, then enable ADC */
-        stm32_adc_set_bits(adc, STM32H7_ADC_ISR, STM32H7_ADRDY);
         stm32_adc_set_bits(adc, STM32H7_ADC_CR, STM32H7_ADEN);
 
         /* Poll for ADRDY to be set (after adc startup time) */
@@ -731,8 +729,11 @@ static int stm32h7_adc_enable(struct stm32_adc *adc)
                                            val & STM32H7_ADRDY,
                                            100, STM32_ADC_TIMEOUT_US);
         if (ret) {
-                stm32_adc_clr_bits(adc, STM32H7_ADC_CR, STM32H7_ADEN);
+                stm32_adc_set_bits(adc, STM32H7_ADC_CR, STM32H7_ADDIS);
                 dev_err(&indio_dev->dev, "Failed to enable ADC\n");
+        } else {
+                /* Clear ADRDY by writing one */
+                stm32_adc_set_bits(adc, STM32H7_ADC_ISR, STM32H7_ADRDY);
         }
 
         return ret;
diff --git a/drivers/iio/imu/adis_trigger.c b/drivers/iio/imu/adis_trigger.c
index 0dd5a381be64..457372f36791 100644
--- a/drivers/iio/imu/adis_trigger.c
+++ b/drivers/iio/imu/adis_trigger.c
@@ -46,6 +46,10 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
         if (adis->trig == NULL)
                 return -ENOMEM;
 
+        adis->trig->dev.parent = &adis->spi->dev;
+        adis->trig->ops = &adis_trigger_ops;
+        iio_trigger_set_drvdata(adis->trig, adis);
+
         ret = request_irq(adis->spi->irq,
                           &iio_trigger_generic_data_rdy_poll,
                           IRQF_TRIGGER_RISING,
@@ -54,9 +58,6 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
         if (ret)
                 goto error_free_trig;
 
-        adis->trig->dev.parent = &adis->spi->dev;
-        adis->trig->ops = &adis_trigger_ops;
-        iio_trigger_set_drvdata(adis->trig, adis);
         ret = iio_trigger_register(adis->trig);
 
         indio_dev->trig = iio_trigger_get(adis->trig);
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 79abf70a126d..cd5bfe39591b 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -175,7 +175,7 @@ __poll_t iio_buffer_poll(struct file *filp,
         struct iio_dev *indio_dev = filp->private_data;
         struct iio_buffer *rb = indio_dev->buffer;
 
-        if (!indio_dev->info)
+        if (!indio_dev->info || rb == NULL)
                 return 0;
 
         poll_wait(filp, &rb->pollq, wait);
diff --git a/drivers/iio/proximity/Kconfig b/drivers/iio/proximity/Kconfig
index fcb1c4ba5e41..f726f9427602 100644
--- a/drivers/iio/proximity/Kconfig
+++ b/drivers/iio/proximity/Kconfig
@@ -68,6 +68,8 @@ config SX9500
 
 config SRF08
         tristate "Devantech SRF02/SRF08/SRF10 ultrasonic ranger sensor"
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         depends on I2C
         help
           Say Y here to build a driver for Devantech SRF02/SRF08/SRF10
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index c4560d84dfae..25bb178f6074 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -305,16 +305,21 @@ void nldev_exit(void);
 static inline struct ib_qp *_ib_create_qp(struct ib_device *dev,
                                           struct ib_pd *pd,
                                           struct ib_qp_init_attr *attr,
-                                          struct ib_udata *udata)
+                                          struct ib_udata *udata,
+                                          struct ib_uobject *uobj)
 {
         struct ib_qp *qp;
 
+        if (!dev->create_qp)
+                return ERR_PTR(-EOPNOTSUPP);
+
         qp = dev->create_qp(pd, attr, udata);
         if (IS_ERR(qp))
                 return qp;
 
         qp->device = dev;
         qp->pd = pd;
+        qp->uobject = uobj;
         /*
          * We don't track XRC QPs for now, because they don't have PD
          * and more importantly they are created internaly by driver,
diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
index 85b5ee4defa4..d8eead5d106d 100644
--- a/drivers/infiniband/core/rdma_core.c
+++ b/drivers/infiniband/core/rdma_core.c
@@ -141,7 +141,12 @@ static struct ib_uobject *alloc_uobj(struct ib_ucontext *context,
          */
         uobj->context = context;
         uobj->type = type;
-        atomic_set(&uobj->usecnt, 0);
+        /*
+         * Allocated objects start out as write locked to deny any other
+         * syscalls from accessing them until they are committed. See
+         * rdma_alloc_commit_uobject
+         */
+        atomic_set(&uobj->usecnt, -1);
         kref_init(&uobj->ref);
 
         return uobj;
@@ -196,7 +201,15 @@ static struct ib_uobject *lookup_get_idr_uobject(const struct uverbs_obj_type *t
                 goto free;
         }
 
-        uverbs_uobject_get(uobj);
+        /*
+         * The idr_find is guaranteed to return a pointer to something that
+         * isn't freed yet, or NULL, as the free after idr_remove goes through
+         * kfree_rcu(). However the object may still have been released and
+         * kfree() could be called at any time.
+         */
+        if (!kref_get_unless_zero(&uobj->ref))
+                uobj = ERR_PTR(-ENOENT);
+
 free:
         rcu_read_unlock();
         return uobj;
@@ -399,13 +412,13 @@ static int __must_check remove_commit_fd_uobject(struct ib_uobject *uobj,
         return ret;
 }
 
-static void lockdep_check(struct ib_uobject *uobj, bool exclusive)
+static void assert_uverbs_usecnt(struct ib_uobject *uobj, bool exclusive)
 {
 #ifdef CONFIG_LOCKDEP
         if (exclusive)
-                WARN_ON(atomic_read(&uobj->usecnt) > 0);
+                WARN_ON(atomic_read(&uobj->usecnt) != -1);
         else
-                WARN_ON(atomic_read(&uobj->usecnt) == -1);
+                WARN_ON(atomic_read(&uobj->usecnt) <= 0);
 #endif
 }
 
@@ -444,7 +457,7 @@ int __must_check rdma_remove_commit_uobject(struct ib_uobject *uobj)
                 WARN(true, "ib_uverbs: Cleanup is running while removing an uobject\n");
                 return 0;
         }
-        lockdep_check(uobj, true);
+        assert_uverbs_usecnt(uobj, true);
         ret = _rdma_remove_commit_uobject(uobj, RDMA_REMOVE_DESTROY);
 
         up_read(&ucontext->cleanup_rwsem);
@@ -474,16 +487,17 @@ int rdma_explicit_destroy(struct ib_uobject *uobject)
                 WARN(true, "ib_uverbs: Cleanup is running while removing an uobject\n");
                 return 0;
         }
-        lockdep_check(uobject, true);
+        assert_uverbs_usecnt(uobject, true);
         ret = uobject->type->type_class->remove_commit(uobject,
                                                        RDMA_REMOVE_DESTROY);
         if (ret)
-                return ret;
+                goto out;
 
         uobject->type = &null_obj_type;
 
+out:
         up_read(&ucontext->cleanup_rwsem);
-        return 0;
+        return ret;
 }
 
 static void alloc_commit_idr_uobject(struct ib_uobject *uobj)
@@ -527,6 +541,10 @@ int rdma_alloc_commit_uobject(struct ib_uobject *uobj)
                 return ret;
         }
 
+        /* matches atomic_set(-1) in alloc_uobj */
+        assert_uverbs_usecnt(uobj, true);
+        atomic_set(&uobj->usecnt, 0);
+
         uobj->type->type_class->alloc_commit(uobj);
         up_read(&uobj->context->cleanup_rwsem);
 
@@ -561,7 +579,7 @@ static void lookup_put_fd_uobject(struct ib_uobject *uobj, bool exclusive)
 
 void rdma_lookup_put_uobject(struct ib_uobject *uobj, bool exclusive)
 {
-        lockdep_check(uobj, exclusive);
+        assert_uverbs_usecnt(uobj, exclusive);
         uobj->type->type_class->lookup_put(uobj, exclusive);
         /*
          * In order to unlock an object, either decrease its usecnt for
diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/restrack.c
index 857637bf46da..3dbc4e4cca41 100644
--- a/drivers/infiniband/core/restrack.c
+++ b/drivers/infiniband/core/restrack.c
@@ -7,7 +7,6 @@
 #include <rdma/restrack.h>
 #include <linux/mutex.h>
 #include <linux/sched/task.h>
-#include <linux/uaccess.h>
 #include <linux/pid_namespace.h>
 
 void rdma_restrack_init(struct rdma_restrack_root *res)
@@ -63,7 +62,6 @@ static struct ib_device *res_to_dev(struct rdma_restrack_entry *res)
 {
         enum rdma_restrack_type type = res->type;
         struct ib_device *dev;
-        struct ib_xrcd *xrcd;
         struct ib_pd *pd;
         struct ib_cq *cq;
         struct ib_qp *qp;
@@ -81,10 +79,6 @@ static struct ib_device *res_to_dev(struct rdma_restrack_entry *res)
                 qp = container_of(res, struct ib_qp, res);
                 dev = qp->device;
                 break;
-        case RDMA_RESTRACK_XRCD:
-                xrcd = container_of(res, struct ib_xrcd, res);
-                dev = xrcd->device;
-                break;
         default:
                 WARN_ONCE(true, "Wrong resource tracking type %u\n", type);
                 return NULL;
@@ -93,6 +87,21 @@ static struct ib_device *res_to_dev(struct rdma_restrack_entry *res)
         return dev;
 }
 
+static bool res_is_user(struct rdma_restrack_entry *res)
+{
+        switch (res->type) {
+        case RDMA_RESTRACK_PD:
+                return container_of(res, struct ib_pd, res)->uobject;
+        case RDMA_RESTRACK_CQ:
+                return container_of(res, struct ib_cq, res)->uobject;
+        case RDMA_RESTRACK_QP:
+                return container_of(res, struct ib_qp, res)->uobject;
+        default:
+                WARN_ONCE(true, "Wrong resource tracking type %u\n", res->type);
+                return false;
+        }
+}
+
 void rdma_restrack_add(struct rdma_restrack_entry *res)
 {
         struct ib_device *dev = res_to_dev(res);
@@ -100,7 +109,7 @@ void rdma_restrack_add(struct rdma_restrack_entry *res)
         if (!dev)
                 return;
 
-        if (!uaccess_kernel()) {
+        if (res_is_user(res)) {
                 get_task_struct(current);
                 res->task = current;
                 res->kern_name = NULL;
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 256934d1f64f..a148de35df8d 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -562,9 +562,10 @@ ssize_t ib_uverbs_open_xrcd(struct ib_uverbs_file *file,
         if (f.file)
                 fdput(f);
 
+        mutex_unlock(&file->device->xrcd_tree_mutex);
+
         uobj_alloc_commit(&obj->uobject);
 
-        mutex_unlock(&file->device->xrcd_tree_mutex);
         return in_len;
 
 err_copy:
@@ -603,10 +604,8 @@ ssize_t ib_uverbs_close_xrcd(struct ib_uverbs_file *file,
 
         uobj  = uobj_get_write(uobj_get_type(xrcd), cmd.xrcd_handle,
                                file->ucontext);
-        if (IS_ERR(uobj)) {
-                mutex_unlock(&file->device->xrcd_tree_mutex);
+        if (IS_ERR(uobj))
                 return PTR_ERR(uobj);
-        }
 
         ret = uobj_remove_commit(uobj);
         return ret ?: in_len;
@@ -979,6 +978,9 @@ static struct ib_ucq_object *create_cq(struct ib_uverbs_file *file,
         struct ib_uverbs_ex_create_cq_resp resp;
         struct ib_cq_init_attr attr = {};
 
+        if (!ib_dev->create_cq)
+                return ERR_PTR(-EOPNOTSUPP);
+
         if (cmd->comp_vector >= file->device->num_comp_vectors)
                 return ERR_PTR(-EINVAL);
 
@@ -1030,14 +1032,14 @@ static struct ib_ucq_object *create_cq(struct ib_uverbs_file *file,
         resp.response_length = offsetof(typeof(resp), response_length) +
                 sizeof(resp.response_length);
 
+        cq->res.type = RDMA_RESTRACK_CQ;
+        rdma_restrack_add(&cq->res);
+
         ret = cb(file, obj, &resp, ucore, context);
         if (ret)
                 goto err_cb;
 
         uobj_alloc_commit(&obj->uobject);
-        cq->res.type = RDMA_RESTRACK_CQ;
-        rdma_restrack_add(&cq->res);
-
         return obj;
 
 err_cb:
@@ -1518,7 +1520,8 @@ static int create_qp(struct ib_uverbs_file *file,
         if (cmd->qp_type == IB_QPT_XRC_TGT)
                 qp = ib_create_qp(pd, &attr);
         else
-                qp = _ib_create_qp(device, pd, &attr, uhw);
+                qp = _ib_create_qp(device, pd, &attr, uhw,
+                                   &obj->uevent.uobject);
 
         if (IS_ERR(qp)) {
                 ret = PTR_ERR(qp);
@@ -1550,8 +1553,10 @@ static int create_qp(struct ib_uverbs_file *file,
                         atomic_inc(&attr.srq->usecnt);
                 if (ind_tbl)
                         atomic_inc(&ind_tbl->usecnt);
+        } else {
+                /* It is done in _ib_create_qp for other QP types */
+                qp->uobject = &obj->uevent.uobject;
         }
-        qp->uobject = &obj->uevent.uobject;
 
         obj->uevent.uobject.object = qp;
 
@@ -1971,8 +1976,15 @@ static int modify_qp(struct ib_uverbs_file *file,
                 goto release_qp;
         }
 
+        if ((cmd->base.attr_mask & IB_QP_AV) &&
+            !rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) {
+                ret = -EINVAL;
+                goto release_qp;
+        }
+
         if ((cmd->base.attr_mask & IB_QP_ALT_PATH) &&
-            !rdma_is_port_valid(qp->device, cmd->base.alt_port_num)) {
+            (!rdma_is_port_valid(qp->device, cmd->base.alt_port_num) ||
+            !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num))) {
                 ret = -EINVAL;
                 goto release_qp;
         }
@@ -2941,6 +2953,11 @@ int ib_uverbs_ex_create_wq(struct ib_uverbs_file *file,
                 wq_init_attr.create_flags = cmd.create_flags;
         obj->uevent.events_reported = 0;
         INIT_LIST_HEAD(&obj->uevent.event_list);
+
+        if (!pd->device->create_wq) {
+                err = -EOPNOTSUPP;
+                goto err_put_cq;
+        }
         wq = pd->device->create_wq(pd, &wq_init_attr, uhw);
         if (IS_ERR(wq)) {
                 err = PTR_ERR(wq);
@@ -3084,7 +3101,12 @@ int ib_uverbs_ex_modify_wq(struct ib_uverbs_file *file,
                 wq_attr.flags = cmd.flags;
                 wq_attr.flags_mask = cmd.flags_mask;
         }
+        if (!wq->device->modify_wq) {
+                ret = -EOPNOTSUPP;
+                goto out;
+        }
         ret = wq->device->modify_wq(wq, &wq_attr, cmd.attr_mask, uhw);
+out:
         uobj_put_obj_read(wq);
         return ret;
 }
@@ -3181,6 +3203,11 @@ int ib_uverbs_ex_create_rwq_ind_table(struct ib_uverbs_file *file,
 
         init_attr.log_ind_tbl_size = cmd.log_ind_tbl_size;
         init_attr.ind_tbl = wqs;
+
+        if (!ib_dev->create_rwq_ind_table) {
+                err = -EOPNOTSUPP;
+                goto err_uobj;
+        }
         rwq_ind_tbl = ib_dev->create_rwq_ind_table(ib_dev, &init_attr, uhw);
 
         if (IS_ERR(rwq_ind_tbl)) {
@@ -3770,6 +3797,9 @@ int ib_uverbs_ex_query_device(struct ib_uverbs_file *file,
         struct ib_device_attr attr = {0};
         int err;
 
+        if (!ib_dev->query_device)
+                return -EOPNOTSUPP;
+
         if (ucore->inlen < sizeof(cmd))
                 return -EINVAL;
 
diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c
index d96dc1d17be1..339b85145044 100644
--- a/drivers/infiniband/core/uverbs_ioctl.c
+++ b/drivers/infiniband/core/uverbs_ioctl.c
@@ -59,6 +59,9 @@ static int uverbs_process_attr(struct ib_device *ibdev,
                         return 0;
         }
 
+        if (test_bit(attr_id, attr_bundle_h->valid_bitmap))
+                return -EINVAL;
+
         spec = &attr_spec_bucket->attrs[attr_id];
         e = &elements[attr_id];
         e->uattr = uattr_ptr;
diff --git a/drivers/infiniband/core/uverbs_ioctl_merge.c b/drivers/infiniband/core/uverbs_ioctl_merge.c
index 062485f9300d..62e1eb1d2a28 100644
--- a/drivers/infiniband/core/uverbs_ioctl_merge.c
+++ b/drivers/infiniband/core/uverbs_ioctl_merge.c
@@ -114,6 +114,7 @@ static size_t get_elements_above_id(const void **iters,
         short min = SHRT_MAX;
         const void *elem;
         int i, j, last_stored = -1;
+        unsigned int equal_min = 0;
 
         for_each_element(elem, i, j, elements, num_elements, num_offset,
                          data_offset) {
@@ -136,6 +137,10 @@ static size_t get_elements_above_id(const void **iters,
                  */
                 iters[last_stored == i ? num_iters - 1 : num_iters++] = elem;
                 last_stored = i;
+                if (min == GET_ID(id))
+                        equal_min++;
+                else
+                        equal_min = 1;
                 min = GET_ID(id);
         }
 
@@ -146,15 +151,10 @@ static size_t get_elements_above_id(const void **iters,
          * Therefore, we need to clean the beginning of the array to make sure
          * all ids of final elements are equal to min.
          */
-        for (i = num_iters - 1; i >= 0 &&
-             GET_ID(*(u16 *)(iters[i] + id_offset)) == min; i--)
-                ;
-
-        num_iters -= i + 1;
-        memmove(iters, iters + i + 1, sizeof(*iters) * num_iters);
+        memmove(iters, iters + num_iters - equal_min, sizeof(*iters) * equal_min);
 
         *min_id = min;
-        return num_iters;
+        return equal_min;
 }
 
 #define find_max_element_entry_id(num_elements, elements, num_objects_fld, \
@@ -322,7 +322,7 @@ static struct uverbs_method_spec *build_method_with_attrs(const struct uverbs_me
                 hash = kzalloc(sizeof(*hash) +
                                ALIGN(sizeof(*hash->attrs) * (attr_max_bucket + 1),
                                      sizeof(long)) +
-                               BITS_TO_LONGS(attr_max_bucket) * sizeof(long),
+                               BITS_TO_LONGS(attr_max_bucket + 1) * sizeof(long),
                                GFP_KERNEL);
                 if (!hash) {
                         res = -ENOMEM;
@@ -509,7 +509,7 @@ static struct uverbs_object_spec *build_object_with_methods(const struct uverbs_
                          * first handler which != NULL. This also defines the
                          * set of flags used for this handler.
                          */
-                        for (i = num_object_defs - 1;
+                        for (i = num_method_defs - 1;
                              i >= 0 && !method_defs[i]->handler; i--)
                                 ;
                         hash->methods[min_id++] = method;
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 395a3b091229..b1ca223aa380 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -650,12 +650,21 @@ static int verify_command_mask(struct ib_device *ib_dev, __u32 command)
         return -1;
 }
 
+static bool verify_command_idx(u32 command, bool extended)
+{
+        if (extended)
+                return command < ARRAY_SIZE(uverbs_ex_cmd_table);
+
+        return command < ARRAY_SIZE(uverbs_cmd_table);
+}
+
 static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                              size_t count, loff_t *pos)
 {
         struct ib_uverbs_file *file = filp->private_data;
         struct ib_device *ib_dev;
         struct ib_uverbs_cmd_hdr hdr;
+        bool extended_command;
         __u32 command;
         __u32 flags;
         int srcu_key;
@@ -688,6 +697,15 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
         }
 
         command = hdr.command & IB_USER_VERBS_CMD_COMMAND_MASK;
+        flags = (hdr.command &
+                 IB_USER_VERBS_CMD_FLAGS_MASK) >> IB_USER_VERBS_CMD_FLAGS_SHIFT;
+
+        extended_command = flags & IB_USER_VERBS_CMD_FLAG_EXTENDED;
+        if (!verify_command_idx(command, extended_command)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         if (verify_command_mask(ib_dev, command)) {
                 ret = -EOPNOTSUPP;
                 goto out;
@@ -699,12 +717,8 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                 goto out;
         }
 
-        flags = (hdr.command &
-                 IB_USER_VERBS_CMD_FLAGS_MASK) >> IB_USER_VERBS_CMD_FLAGS_SHIFT;
-
         if (!flags) {
-                if (command >= ARRAY_SIZE(uverbs_cmd_table) ||
-                    !uverbs_cmd_table[command]) {
+                if (!uverbs_cmd_table[command]) {
                         ret = -EINVAL;
                         goto out;
                 }
@@ -725,8 +739,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                 struct ib_udata uhw;
                 size_t written_count = count;
 
-                if (command >= ARRAY_SIZE(uverbs_ex_cmd_table) ||
-                    !uverbs_ex_cmd_table[command]) {
+                if (!uverbs_ex_cmd_table[command]) {
                         ret = -ENOSYS;
                         goto out;
                 }
@@ -942,6 +955,7 @@ static const struct file_operations uverbs_fops = {
         .llseek  = no_llseek,
 #if IS_ENABLED(CONFIG_INFINIBAND_EXP_USER_ACCESS)
         .unlocked_ioctl = ib_uverbs_ioctl,
+        .compat_ioctl = ib_uverbs_ioctl,
 #endif
 };
 
@@ -954,6 +968,7 @@ static const struct file_operations uverbs_mmap_fops = {
         .llseek  = no_llseek,
 #if IS_ENABLED(CONFIG_INFINIBAND_EXP_USER_ACCESS)
         .unlocked_ioctl = ib_uverbs_ioctl,
+        .compat_ioctl = ib_uverbs_ioctl,
 #endif
 };
 
diff --git a/drivers/infiniband/core/uverbs_std_types.c b/drivers/infiniband/core/uverbs_std_types.c
index cab0ac3556eb..df1360e6774f 100644
--- a/drivers/infiniband/core/uverbs_std_types.c
+++ b/drivers/infiniband/core/uverbs_std_types.c
@@ -234,15 +234,18 @@ static void create_udata(struct uverbs_attr_bundle *ctx,
                 uverbs_attr_get(ctx, UVERBS_UHW_OUT);
 
         if (!IS_ERR(uhw_in)) {
-                udata->inbuf = uhw_in->ptr_attr.ptr;
                 udata->inlen = uhw_in->ptr_attr.len;
+                if (uverbs_attr_ptr_is_inline(uhw_in))
+                        udata->inbuf = &uhw_in->uattr->data;
+                else
+                        udata->inbuf = u64_to_user_ptr(uhw_in->ptr_attr.data);
         } else {
                 udata->inbuf = NULL;
                 udata->inlen = 0;
         }
 
         if (!IS_ERR(uhw_out)) {
-                udata->outbuf = uhw_out->ptr_attr.ptr;
+                udata->outbuf = u64_to_user_ptr(uhw_out->ptr_attr.data);
                 udata->outlen = uhw_out->ptr_attr.len;
         } else {
                 udata->outbuf = NULL;
@@ -323,7 +326,8 @@ static int uverbs_create_cq_handler(struct ib_device *ib_dev,
         cq->res.type = RDMA_RESTRACK_CQ;
         rdma_restrack_add(&cq->res);
 
-        ret = uverbs_copy_to(attrs, CREATE_CQ_RESP_CQE, &cq->cqe);
+        ret = uverbs_copy_to(attrs, CREATE_CQ_RESP_CQE, &cq->cqe,
+                             sizeof(cq->cqe));
         if (ret)
                 goto err_cq;
 
@@ -375,7 +379,7 @@ static int uverbs_destroy_cq_handler(struct ib_device *ib_dev,
         resp.comp_events_reported  = obj->comp_events_reported;
         resp.async_events_reported = obj->async_events_reported;
 
-        return uverbs_copy_to(attrs, DESTROY_CQ_RESP, &resp);
+        return uverbs_copy_to(attrs, DESTROY_CQ_RESP, &resp, sizeof(resp));
 }
 
 static DECLARE_UVERBS_METHOD(
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 16ebc6372c31..93025d2009b8 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -887,7 +887,7 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
         if (qp_init_attr->cap.max_rdma_ctxs)
                 rdma_rw_init_qp(device, qp_init_attr);
 
-        qp = _ib_create_qp(device, pd, qp_init_attr, NULL);
+        qp = _ib_create_qp(device, pd, qp_init_attr, NULL, NULL);
         if (IS_ERR(qp))
                 return qp;
 
@@ -898,7 +898,6 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
         }
 
         qp->real_qp    = qp;
-        qp->uobject    = NULL;
         qp->qp_type    = qp_init_attr->qp_type;
         qp->rwq_ind_tbl = qp_init_attr->rwq_ind_tbl;
 
diff --git a/drivers/infiniband/hw/bnxt_re/bnxt_re.h b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
index ca32057e886f..3eb7a8387116 100644
--- a/drivers/infiniband/hw/bnxt_re/bnxt_re.h
+++ b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
@@ -120,7 +120,6 @@ struct bnxt_re_dev {
 #define BNXT_RE_FLAG_HAVE_L2_REF                3
 #define BNXT_RE_FLAG_RCFW_CHANNEL_EN            4
 #define BNXT_RE_FLAG_QOS_WORK_REG               5
-#define BNXT_RE_FLAG_TASK_IN_PROG               6
 #define BNXT_RE_FLAG_ISSUE_ROCE_STATS          29
         struct net_device               *netdev;
         unsigned int                    version, major, minor;
@@ -158,6 +157,7 @@ struct bnxt_re_dev {
         atomic_t                        srq_count;
         atomic_t                        mr_count;
         atomic_t                        mw_count;
+        atomic_t                        sched_count;
         /* Max of 2 lossless traffic class supported per port */
         u16                             cosq[2];
 
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index ae9e9ff54826..643174d949a8 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -174,10 +174,8 @@ int bnxt_re_query_device(struct ib_device *ibdev,
         ib_attr->max_pd = dev_attr->max_pd;
         ib_attr->max_qp_rd_atom = dev_attr->max_qp_rd_atom;
         ib_attr->max_qp_init_rd_atom = dev_attr->max_qp_init_rd_atom;
-        if (dev_attr->is_atomic) {
-                ib_attr->atomic_cap = IB_ATOMIC_HCA;
-                ib_attr->masked_atomic_cap = IB_ATOMIC_HCA;
-        }
+        ib_attr->atomic_cap = IB_ATOMIC_NONE;
+        ib_attr->masked_atomic_cap = IB_ATOMIC_NONE;
 
         ib_attr->max_ee_rd_atom = 0;
         ib_attr->max_res_rd_atom = 0;
@@ -787,20 +785,51 @@ int bnxt_re_query_ah(struct ib_ah *ib_ah, struct rdma_ah_attr *ah_attr)
         return 0;
 }
 
+static unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp)
+        __acquires(&qp->scq->cq_lock) __acquires(&qp->rcq->cq_lock)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&qp->scq->cq_lock, flags);
+        if (qp->rcq != qp->scq)
+                spin_lock(&qp->rcq->cq_lock);
+        else
+                __acquire(&qp->rcq->cq_lock);
+
+        return flags;
+}
+
+static void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp,
+                               unsigned long flags)
+        __releases(&qp->scq->cq_lock) __releases(&qp->rcq->cq_lock)
+{
+        if (qp->rcq != qp->scq)
+                spin_unlock(&qp->rcq->cq_lock);
+        else
+                __release(&qp->rcq->cq_lock);
+        spin_unlock_irqrestore(&qp->scq->cq_lock, flags);
+}
+
 /* Queue Pairs */
 int bnxt_re_destroy_qp(struct ib_qp *ib_qp)
 {
         struct bnxt_re_qp *qp = container_of(ib_qp, struct bnxt_re_qp, ib_qp);
         struct bnxt_re_dev *rdev = qp->rdev;
         int rc;
+        unsigned int flags;
 
         bnxt_qplib_flush_cqn_wq(&qp->qplib_qp);
-        bnxt_qplib_del_flush_qp(&qp->qplib_qp);
         rc = bnxt_qplib_destroy_qp(&rdev->qplib_res, &qp->qplib_qp);
         if (rc) {
                 dev_err(rdev_to_dev(rdev), "Failed to destroy HW QP");
                 return rc;
         }
+
+        flags = bnxt_re_lock_cqs(qp);
+        bnxt_qplib_clean_qp(&qp->qplib_qp);
+        bnxt_re_unlock_cqs(qp, flags);
+        bnxt_qplib_free_qp_res(&rdev->qplib_res, &qp->qplib_qp);
+
         if (ib_qp->qp_type == IB_QPT_GSI && rdev->qp1_sqp) {
                 rc = bnxt_qplib_destroy_ah(&rdev->qplib_res,
                                            &rdev->sqp_ah->qplib_ah);
@@ -810,7 +839,7 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp)
                         return rc;
                 }
 
-                bnxt_qplib_del_flush_qp(&qp->qplib_qp);
+                bnxt_qplib_clean_qp(&qp->qplib_qp);
                 rc = bnxt_qplib_destroy_qp(&rdev->qplib_res,
                                            &rdev->qp1_sqp->qplib_qp);
                 if (rc) {
@@ -1069,6 +1098,7 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
                         goto fail;
                 }
                 qp->qplib_qp.scq = &cq->qplib_cq;
+                qp->scq = cq;
         }
 
         if (qp_init_attr->recv_cq) {
@@ -1080,6 +1110,7 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
                         goto fail;
                 }
                 qp->qplib_qp.rcq = &cq->qplib_cq;
+                qp->rcq = cq;
         }
 
         if (qp_init_attr->srq) {
@@ -1185,7 +1216,7 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
                 rc = bnxt_qplib_create_qp(&rdev->qplib_res, &qp->qplib_qp);
                 if (rc) {
                         dev_err(rdev_to_dev(rdev), "Failed to create HW QP");
-                        goto fail;
+                        goto free_umem;
                 }
         }
 
@@ -1213,6 +1244,13 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
         return &qp->ib_qp;
 qp_destroy:
         bnxt_qplib_destroy_qp(&rdev->qplib_res, &qp->qplib_qp);
+free_umem:
+        if (udata) {
+                if (qp->rumem)
+                        ib_umem_release(qp->rumem);
+                if (qp->sumem)
+                        ib_umem_release(qp->sumem);
+        }
 fail:
         kfree(qp);
         return ERR_PTR(rc);
@@ -1603,7 +1641,7 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
                         dev_dbg(rdev_to_dev(rdev),
                                 "Move QP = %p out of flush list\n",
                                 qp);
-                        bnxt_qplib_del_flush_qp(&qp->qplib_qp);
+                        bnxt_qplib_clean_qp(&qp->qplib_qp);
                 }
         }
         if (qp_attr_mask & IB_QP_EN_SQD_ASYNC_NOTIFY) {
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.h b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
index 423ebe012f95..b88a48d43a9d 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
@@ -89,6 +89,8 @@ struct bnxt_re_qp {
         /* QP1 */
         u32                     send_psn;
         struct ib_ud_header     qp1_hdr;
+        struct bnxt_re_cq       *scq;
+        struct bnxt_re_cq       *rcq;
 };
 
 struct bnxt_re_cq {
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index 508d00a5a106..33a448036c2e 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -656,7 +656,6 @@ static void bnxt_re_dev_remove(struct bnxt_re_dev *rdev)
         mutex_unlock(&bnxt_re_dev_lock);
 
         synchronize_rcu();
-        flush_workqueue(bnxt_re_wq);
 
         ib_dealloc_device(&rdev->ibdev);
         /* rdev is gone */
@@ -1441,7 +1440,7 @@ static void bnxt_re_task(struct work_struct *work)
                 break;
         }
         smp_mb__before_atomic();
-        clear_bit(BNXT_RE_FLAG_TASK_IN_PROG, &rdev->flags);
+        atomic_dec(&rdev->sched_count);
         kfree(re_work);
 }
 
@@ -1503,7 +1502,7 @@ static int bnxt_re_netdev_event(struct notifier_block *notifier,
                 /* netdev notifier will call NETDEV_UNREGISTER again later since
                  * we are still holding the reference to the netdev
                  */
-                if (test_bit(BNXT_RE_FLAG_TASK_IN_PROG, &rdev->flags))
+                if (atomic_read(&rdev->sched_count) > 0)
                         goto exit;
                 bnxt_re_ib_unreg(rdev, false);
                 bnxt_re_remove_one(rdev);
@@ -1523,7 +1522,7 @@ static int bnxt_re_netdev_event(struct notifier_block *notifier,
                         re_work->vlan_dev = (real_dev == netdev ?
                                              NULL : netdev);
                         INIT_WORK(&re_work->work, bnxt_re_task);
-                        set_bit(BNXT_RE_FLAG_TASK_IN_PROG, &rdev->flags);
+                        atomic_inc(&rdev->sched_count);
                         queue_work(bnxt_re_wq, &re_work->work);
                 }
         }
@@ -1578,6 +1577,11 @@ static void __exit bnxt_re_mod_exit(void)
         */
         list_for_each_entry_safe_reverse(rdev, next, &to_be_deleted, list) {
                 dev_info(rdev_to_dev(rdev), "Unregistering Device");
+                /*
+                 * Flush out any scheduled tasks before destroying the
+                 * resources
+                 */
+                flush_workqueue(bnxt_re_wq);
                 bnxt_re_dev_stop(rdev);
                 bnxt_re_ib_unreg(rdev, true);
                 bnxt_re_remove_one(rdev);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 1b0e94697fe3..3ea5b9624f6b 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -173,7 +173,7 @@ static void __bnxt_qplib_del_flush_qp(struct bnxt_qplib_qp *qp)
         }
 }
 
-void bnxt_qplib_del_flush_qp(struct bnxt_qplib_qp *qp)
+void bnxt_qplib_clean_qp(struct bnxt_qplib_qp *qp)
 {
         unsigned long flags;
 
@@ -1419,7 +1419,6 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res,
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_destroy_qp req;
         struct creq_destroy_qp_resp resp;
-        unsigned long flags;
         u16 cmd_flags = 0;
         int rc;
 
@@ -1437,19 +1436,12 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res,
                 return rc;
         }
 
-        /* Must walk the associated CQs to nullified the QP ptr */
-        spin_lock_irqsave(&qp->scq->hwq.lock, flags);
-
-        __clean_cq(qp->scq, (u64)(unsigned long)qp);
-
-        if (qp->rcq && qp->rcq != qp->scq) {
-                spin_lock(&qp->rcq->hwq.lock);
-                __clean_cq(qp->rcq, (u64)(unsigned long)qp);
-                spin_unlock(&qp->rcq->hwq.lock);
-        }
-
-        spin_unlock_irqrestore(&qp->scq->hwq.lock, flags);
+        return 0;
+}
 
+void bnxt_qplib_free_qp_res(struct bnxt_qplib_res *res,
+                            struct bnxt_qplib_qp *qp)
+{
         bnxt_qplib_free_qp_hdr_buf(res, qp);
         bnxt_qplib_free_hwq(res->pdev, &qp->sq.hwq);
         kfree(qp->sq.swq);
@@ -1462,7 +1454,6 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res,
         if (qp->orrq.max_elements)
                 bnxt_qplib_free_hwq(res->pdev, &qp->orrq);
 
-        return 0;
 }
 
 void *bnxt_qplib_get_qp1_sq_buf(struct bnxt_qplib_qp *qp,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
index 211b27a8f9e2..ca0a2ffa3509 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
@@ -478,6 +478,9 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp);
 int bnxt_qplib_modify_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp);
 int bnxt_qplib_query_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp);
 int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp);
+void bnxt_qplib_clean_qp(struct bnxt_qplib_qp *qp);
+void bnxt_qplib_free_qp_res(struct bnxt_qplib_res *res,
+                            struct bnxt_qplib_qp *qp);
 void *bnxt_qplib_get_qp1_sq_buf(struct bnxt_qplib_qp *qp,
                                 struct bnxt_qplib_sge *sge);
 void *bnxt_qplib_get_qp1_rq_buf(struct bnxt_qplib_qp *qp,
@@ -500,7 +503,6 @@ void bnxt_qplib_req_notify_cq(struct bnxt_qplib_cq *cq, u32 arm_type);
 void bnxt_qplib_free_nq(struct bnxt_qplib_nq *nq);
 int bnxt_qplib_alloc_nq(struct pci_dev *pdev, struct bnxt_qplib_nq *nq);
 void bnxt_qplib_add_flush_qp(struct bnxt_qplib_qp *qp);
-void bnxt_qplib_del_flush_qp(struct bnxt_qplib_qp *qp);
 void bnxt_qplib_acquire_cq_locks(struct bnxt_qplib_qp *qp,
                                  unsigned long *flags);
 void bnxt_qplib_release_cq_locks(struct bnxt_qplib_qp *qp,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
index c015c1861351..03057983341f 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
@@ -52,18 +52,6 @@ const struct bnxt_qplib_gid bnxt_qplib_gid_zero = {{ 0, 0, 0, 0, 0, 0, 0, 0,
 
 /* Device */
 
-static bool bnxt_qplib_is_atomic_cap(struct bnxt_qplib_rcfw *rcfw)
-{
-        int rc;
-        u16 pcie_ctl2;
-
-        rc = pcie_capability_read_word(rcfw->pdev, PCI_EXP_DEVCTL2,
-                                       &pcie_ctl2);
-        if (rc)
-                return false;
-        return !!(pcie_ctl2 & PCI_EXP_DEVCTL2_ATOMIC_REQ);
-}
-
 static void bnxt_qplib_query_version(struct bnxt_qplib_rcfw *rcfw,
                                      char *fw_ver)
 {
@@ -165,7 +153,7 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
                 attr->tqm_alloc_reqs[i * 4 + 3] = *(++tqm_alloc);
         }
 
-        attr->is_atomic = bnxt_qplib_is_atomic_cap(rcfw);
+        attr->is_atomic = 0;
 bail:
         bnxt_qplib_rcfw_free_sbuf(rcfw, sbuf);
         return rc;
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
index faa9478c14a6..f95b97646c25 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
@@ -114,6 +114,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev,
         union pvrdma_cmd_resp rsp;
         struct pvrdma_cmd_create_cq *cmd = &req.create_cq;
         struct pvrdma_cmd_create_cq_resp *resp = &rsp.create_cq_resp;
+        struct pvrdma_create_cq_resp cq_resp = {0};
         struct pvrdma_create_cq ucmd;
 
         BUILD_BUG_ON(sizeof(struct pvrdma_cqe) != 64);
@@ -197,6 +198,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev,
 
         cq->ibcq.cqe = resp->cqe;
         cq->cq_handle = resp->cq_handle;
+        cq_resp.cqn = resp->cq_handle;
         spin_lock_irqsave(&dev->cq_tbl_lock, flags);
         dev->cq_tbl[cq->cq_handle % dev->dsr->caps.max_cq] = cq;
         spin_unlock_irqrestore(&dev->cq_tbl_lock, flags);
@@ -205,7 +207,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev,
                 cq->uar = &(to_vucontext(context)->uar);
 
                 /* Copy udata back. */
-                if (ib_copy_to_udata(udata, &cq->cq_handle, sizeof(__u32))) {
+                if (ib_copy_to_udata(udata, &cq_resp, sizeof(cq_resp))) {
                         dev_warn(&dev->pdev->dev,
                                  "failed to copy back udata\n");
                         pvrdma_destroy_cq(&cq->ibcq);
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c
index 5acebb1ef631..af235967a9c2 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c
@@ -113,6 +113,7 @@ struct ib_srq *pvrdma_create_srq(struct ib_pd *pd,
         union pvrdma_cmd_resp rsp;
         struct pvrdma_cmd_create_srq *cmd = &req.create_srq;
         struct pvrdma_cmd_create_srq_resp *resp = &rsp.create_srq_resp;
+        struct pvrdma_create_srq_resp srq_resp = {0};
         struct pvrdma_create_srq ucmd;
         unsigned long flags;
         int ret;
@@ -204,12 +205,13 @@ struct ib_srq *pvrdma_create_srq(struct ib_pd *pd,
         }
 
         srq->srq_handle = resp->srqn;
+        srq_resp.srqn = resp->srqn;
         spin_lock_irqsave(&dev->srq_tbl_lock, flags);
         dev->srq_tbl[srq->srq_handle % dev->dsr->caps.max_srq] = srq;
         spin_unlock_irqrestore(&dev->srq_tbl_lock, flags);
 
         /* Copy udata back. */
-        if (ib_copy_to_udata(udata, &srq->srq_handle, sizeof(__u32))) {
+        if (ib_copy_to_udata(udata, &srq_resp, sizeof(srq_resp))) {
                 dev_warn(&dev->pdev->dev, "failed to copy back udata\n");
                 pvrdma_destroy_srq(&srq->ibsrq);
                 return ERR_PTR(-EINVAL);
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
index 16b96616ef7e..a51463cd2f37 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
@@ -447,6 +447,7 @@ struct ib_pd *pvrdma_alloc_pd(struct ib_device *ibdev,
         union pvrdma_cmd_resp rsp;
         struct pvrdma_cmd_create_pd *cmd = &req.create_pd;
         struct pvrdma_cmd_create_pd_resp *resp = &rsp.create_pd_resp;
+        struct pvrdma_alloc_pd_resp pd_resp = {0};
         int ret;
         void *ptr;
 
@@ -475,9 +476,10 @@ struct ib_pd *pvrdma_alloc_pd(struct ib_device *ibdev,
         pd->privileged = !context;
         pd->pd_handle = resp->pd_handle;
         pd->pdn = resp->pd_handle;
+        pd_resp.pdn = resp->pd_handle;
 
         if (context) {
-                if (ib_copy_to_udata(udata, &pd->pdn, sizeof(__u32))) {
+                if (ib_copy_to_udata(udata, &pd_resp, sizeof(pd_resp))) {
                         dev_warn(&dev->pdev->dev,
                                  "failed to copy back protection domain\n");
                         pvrdma_dealloc_pd(&pd->ibpd);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_fs.c b/drivers/infiniband/ulp/ipoib/ipoib_fs.c
index 11f74cbe6660..ea302b054601 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_fs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_fs.c
@@ -281,8 +281,6 @@ void ipoib_delete_debug_files(struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = ipoib_priv(dev);
 
-        WARN_ONCE(!priv->mcg_dentry, "null mcg debug file\n");
-        WARN_ONCE(!priv->path_dentry, "null path debug file\n");
         debugfs_remove(priv->mcg_dentry);
         debugfs_remove(priv->path_dentry);
         priv->mcg_dentry = priv->path_dentry = NULL;
diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index 35a408d0ae4f..99bc9bd64b9e 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -205,7 +205,7 @@ static void intel_flush_svm_range_dev (struct intel_svm *svm, struct intel_svm_d
                          * for example, an "address" value of 0x12345f000 will
                          * flush from 0x123440000 to 0x12347ffff (256KiB). */
                         unsigned long last = address + ((unsigned long)(pages - 1) << VTD_PAGE_SHIFT);
-                        unsigned long mask = __rounddown_pow_of_two(address ^ last);;
+                        unsigned long mask = __rounddown_pow_of_two(address ^ last);
 
                         desc.high = QI_DEV_EIOTLB_ADDR((address & ~mask) | (mask - 1)) | QI_DEV_EIOTLB_SIZE;
                 } else {
diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c
index 55cfb986225b..faf734ff4cf3 100644
--- a/drivers/irqchip/irq-bcm7038-l1.c
+++ b/drivers/irqchip/irq-bcm7038-l1.c
@@ -339,9 +339,6 @@ int __init bcm7038_l1_of_init(struct device_node *dn,
                 goto out_unmap;
         }
 
-        pr_info("registered BCM7038 L1 intc (mem: 0x%p, IRQs: %d)\n",
-                intc->cpus[0]->map_base, IRQS_PER_WORD * intc->n_words);
-
         return 0;
 
 out_unmap:
diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c
index 983640eba418..8968e5e93fcb 100644
--- a/drivers/irqchip/irq-bcm7120-l2.c
+++ b/drivers/irqchip/irq-bcm7120-l2.c
@@ -318,9 +318,6 @@ static int __init bcm7120_l2_intc_probe(struct device_node *dn,
                 }
         }
 
-        pr_info("registered %s intc (mem: 0x%p, parent IRQ(s): %d)\n",
-                        intc_name, data->map_base[0], data->num_parent_irqs);
-
         return 0;
 
 out_free_domain:
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index 691d20eb0bec..0e65f609352e 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -262,9 +262,6 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
                 ct->chip.irq_set_wake = irq_gc_set_wake;
         }
 
-        pr_info("registered L2 intc (mem: 0x%p, parent irq: %d)\n",
-                        base, parent_irq);
-
         return 0;
 
 out_free_domain:
diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
index 993a8426a453..1ff38aff9f29 100644
--- a/drivers/irqchip/irq-gic-v2m.c
+++ b/drivers/irqchip/irq-gic-v2m.c
@@ -94,7 +94,7 @@ static struct irq_chip gicv2m_msi_irq_chip = {
 
 static struct msi_domain_info gicv2m_msi_domain_info = {
         .flags  = (MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS |
-                   MSI_FLAG_PCI_MSIX),
+                   MSI_FLAG_PCI_MSIX | MSI_FLAG_MULTI_PCI_MSI),
         .chip   = &gicv2m_msi_irq_chip,
 };
 
@@ -155,18 +155,12 @@ static int gicv2m_irq_gic_domain_alloc(struct irq_domain *domain,
         return 0;
 }
 
-static void gicv2m_unalloc_msi(struct v2m_data *v2m, unsigned int hwirq)
+static void gicv2m_unalloc_msi(struct v2m_data *v2m, unsigned int hwirq,
+                               int nr_irqs)
 {
-        int pos;
-
-        pos = hwirq - v2m->spi_start;
-        if (pos < 0 || pos >= v2m->nr_spis) {
-                pr_err("Failed to teardown msi. Invalid hwirq %d\n", hwirq);
-                return;
-        }
-
         spin_lock(&v2m_lock);
-        __clear_bit(pos, v2m->bm);
+        bitmap_release_region(v2m->bm, hwirq - v2m->spi_start,
+                              get_count_order(nr_irqs));
         spin_unlock(&v2m_lock);
 }
 
@@ -174,13 +168,13 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
                                    unsigned int nr_irqs, void *args)
 {
         struct v2m_data *v2m = NULL, *tmp;
-        int hwirq, offset, err = 0;
+        int hwirq, offset, i, err = 0;
 
         spin_lock(&v2m_lock);
         list_for_each_entry(tmp, &v2m_nodes, entry) {
-                offset = find_first_zero_bit(tmp->bm, tmp->nr_spis);
-                if (offset < tmp->nr_spis) {
-                        __set_bit(offset, tmp->bm);
+                offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+                                                 get_count_order(nr_irqs));
+                if (offset >= 0) {
                         v2m = tmp;
                         break;
                 }
@@ -192,16 +186,21 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
 
         hwirq = v2m->spi_start + offset;
 
-        err = gicv2m_irq_gic_domain_alloc(domain, virq, hwirq);
-        if (err) {
-                gicv2m_unalloc_msi(v2m, hwirq);
-                return err;
-        }
+        for (i = 0; i < nr_irqs; i++) {
+                err = gicv2m_irq_gic_domain_alloc(domain, virq + i, hwirq + i);
+                if (err)
+                        goto fail;
 
-        irq_domain_set_hwirq_and_chip(domain, virq, hwirq,
-                                      &gicv2m_irq_chip, v2m);
+                irq_domain_set_hwirq_and_chip(domain, virq + i, hwirq + i,
+                                              &gicv2m_irq_chip, v2m);
+        }
 
         return 0;
+
+fail:
+        irq_domain_free_irqs_parent(domain, virq, nr_irqs);
+        gicv2m_unalloc_msi(v2m, hwirq, get_count_order(nr_irqs));
+        return err;
 }
 
 static void gicv2m_irq_domain_free(struct irq_domain *domain,
@@ -210,8 +209,7 @@ static void gicv2m_irq_domain_free(struct irq_domain *domain,
         struct irq_data *d = irq_domain_get_irq_data(domain, virq);
         struct v2m_data *v2m = irq_data_get_irq_chip_data(d);
 
-        BUG_ON(nr_irqs != 1);
-        gicv2m_unalloc_msi(v2m, d->hwirq);
+        gicv2m_unalloc_msi(v2m, d->hwirq, nr_irqs);
         irq_domain_free_irqs_parent(domain, virq, nr_irqs);
 }
 
diff --git a/drivers/irqchip/irq-gic-v3-its-fsl-mc-msi.c b/drivers/irqchip/irq-gic-v3-its-fsl-mc-msi.c
index 13a5d9a1de96..4eca5c763766 100644
--- a/drivers/irqchip/irq-gic-v3-its-fsl-mc-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-fsl-mc-msi.c
@@ -71,6 +71,8 @@ static int __init its_fsl_mc_msi_init(void)
 
         for (np = of_find_matching_node(NULL, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller"))
                         continue;
 
diff --git a/drivers/irqchip/irq-gic-v3-its-pci-msi.c b/drivers/irqchip/irq-gic-v3-its-pci-msi.c
index 14a8c0a7e095..25a98de5cfb2 100644
--- a/drivers/irqchip/irq-gic-v3-its-pci-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-pci-msi.c
@@ -132,6 +132,8 @@ static int __init its_pci_of_msi_init(void)
 
         for (np = of_find_matching_node(NULL, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller"))
                         continue;
 
diff --git a/drivers/irqchip/irq-gic-v3-its-platform-msi.c b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
index 833a90fe33ae..8881a053c173 100644
--- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
@@ -154,6 +154,8 @@ static void __init its_pmsi_of_init(void)
 
         for (np = of_find_matching_node(NULL, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller"))
                         continue;
 
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 06f025fd5726..1d3056f53747 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -3314,6 +3314,8 @@ static int __init its_of_probe(struct device_node *node)
 
         for (np = of_find_matching_node(node, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller")) {
                         pr_warn("%pOF: no msi-controller property, ITS ignored\n",
                                 np);
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index a57c0fbbd34a..d99cc07903ec 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -673,7 +673,7 @@ static void gic_send_sgi(u64 cluster_id, u16 tlist, unsigned int irq)
                MPIDR_TO_SGI_RS(cluster_id)              |
                tlist << ICC_SGI1R_TARGET_LIST_SHIFT);
 
-        pr_debug("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
+        pr_devel("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
         gic_write_sgi1r(val);
 }
 
@@ -688,7 +688,7 @@ static void gic_raise_softirq(const struct cpumask *mask, unsigned int irq)
          * Ensure that stores to Normal memory are visible to the
          * other CPUs before issuing the IPI.
          */
-        smp_wmb();
+        wmb();
 
         for_each_cpu(cpu, mask) {
                 u64 cluster_id = MPIDR_TO_SGI_CLUSTER_ID(cpu_logical_map(cpu));
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index ef92a4d2038e..d32268cc1174 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -424,8 +424,6 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
         spin_lock_irqsave(&gic_lock, flags);
         write_gic_map_pin(intr, GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin);
         write_gic_map_vp(intr, BIT(mips_cm_vp_id(cpu)));
-        gic_clear_pcpu_masks(intr);
-        set_bit(intr, per_cpu_ptr(pcpu_masks, cpu));
         irq_data_update_effective_affinity(data, cpumask_of(cpu));
         spin_unlock_irqrestore(&gic_lock, flags);
 
diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
index 62f541f968f6..07074820a167 100644
--- a/drivers/macintosh/macio_asic.c
+++ b/drivers/macintosh/macio_asic.c
@@ -375,6 +375,7 @@ static struct macio_dev * macio_add_one_device(struct macio_chip *chip,
         dev->ofdev.dev.of_node = np;
         dev->ofdev.archdata.dma_mask = 0xffffffffUL;
         dev->ofdev.dev.dma_mask = &dev->ofdev.archdata.dma_mask;
+        dev->ofdev.dev.coherent_dma_mask = dev->ofdev.archdata.dma_mask;
         dev->ofdev.dev.parent = parent;
         dev->ofdev.dev.bus = &macio_bus_type;
         dev->ofdev.dev.release = macio_release_dev;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index d6de00f367ef..68136806d365 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -903,7 +903,8 @@ static void dec_pending(struct dm_io *io, blk_status_t error)
                         queue_io(md, bio);
                 } else {
                         /* done with normal IO or empty flush */
-                        bio->bi_status = io_error;
+                        if (io_error)
+                                bio->bi_status = io_error;
                         bio_endio(bio);
                 }
         }
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index b2eae332e1a2..f978eddc7a21 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1108,7 +1108,7 @@ static void alloc_behind_master_bio(struct r1bio *r1_bio,
 
         bio_copy_data(behind_bio, bio);
 skip_copy:
-        r1_bio->behind_master_bio = behind_bio;;
+        r1_bio->behind_master_bio = behind_bio;
         set_bit(R1BIO_BehindIO, &r1_bio->state);
 
         return;
diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
index 8d12017b9893..4470630dd545 100644
--- a/drivers/message/fusion/mptctl.c
+++ b/drivers/message/fusion/mptctl.c
@@ -2687,6 +2687,8 @@ mptctl_hp_targetinfo(unsigned long arg)
                                 __FILE__, __LINE__, iocnum);
                 return -ENODEV;
         }
+        if (karg.hdr.id >= MPT_MAX_FC_DEVICES)
+                return -EINVAL;
         dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo called.\n",
             ioc->name));
 
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 3e5eabdae8d9..772d02922529 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -548,12 +548,6 @@ int mei_cldev_disable(struct mei_cl_device *cldev)
                 goto out;
         }
 
-        if (bus->dev_state == MEI_DEV_POWER_DOWN) {
-                dev_dbg(bus->dev, "Device is powering down, don't bother with disconnection\n");
-                err = 0;
-                goto out;
-        }
-
         err = mei_cl_disconnect(cl);
         if (err < 0)
                 dev_err(bus->dev, "Could not disconnect from the ME client\n");
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index be64969d986a..7e60c1817c31 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -945,6 +945,12 @@ int mei_cl_disconnect(struct mei_cl *cl)
                 return 0;
         }
 
+        if (dev->dev_state == MEI_DEV_POWER_DOWN) {
+                cl_dbg(dev, cl, "Device is powering down, don't bother with disconnection\n");
+                mei_cl_set_disconnected(cl);
+                return 0;
+        }
+
         rets = pm_runtime_get(dev->dev);
         if (rets < 0 && rets != -EINPROGRESS) {
                 pm_runtime_put_noidle(dev->dev);
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index 0ccccbaf530d..e4b10b2d1a08 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -132,6 +132,11 @@
 #define MEI_DEV_ID_KBP        0xA2BA  /* Kaby Point */
 #define MEI_DEV_ID_KBP_2      0xA2BB  /* Kaby Point 2 */
 
+#define MEI_DEV_ID_CNP_LP     0x9DE0  /* Cannon Point LP */
+#define MEI_DEV_ID_CNP_LP_4   0x9DE4  /* Cannon Point LP 4 (iTouch) */
+#define MEI_DEV_ID_CNP_H      0xA360  /* Cannon Point H */
+#define MEI_DEV_ID_CNP_H_4    0xA364  /* Cannon Point H 4 (iTouch) */
+
 /*
  * MEI HW Section
  */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 4a0ccda4d04b..ea4e152270a3 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -98,6 +98,11 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
         {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, MEI_ME_PCH8_CFG)},
 
+        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP_4, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
+
         /* required last entry */
         {0, }
 };
diff --git a/drivers/misc/ocxl/file.c b/drivers/misc/ocxl/file.c
index d9aa407db06a..337462e1569f 100644
--- a/drivers/misc/ocxl/file.c
+++ b/drivers/misc/ocxl/file.c
@@ -133,8 +133,10 @@ static long afu_ioctl(struct file *file, unsigned int cmd,
                 if (!rc) {
                         rc = copy_to_user((u64 __user *) args, &irq_offset,
                                         sizeof(irq_offset));
-                        if (rc)
+                        if (rc) {
                                 ocxl_afu_irq_free(ctx, irq_offset);
+                                return -EFAULT;
+                        }
                 }
                 break;
 
@@ -277,7 +279,7 @@ static ssize_t afu_read(struct file *file, char __user *buf, size_t count,
         struct ocxl_context *ctx = file->private_data;
         struct ocxl_kernel_event_header header;
         ssize_t rc;
-        size_t used = 0;
+        ssize_t used = 0;
         DEFINE_WAIT(event_wait);
 
         memset(&header, 0, sizeof(header));
@@ -329,7 +331,7 @@ static ssize_t afu_read(struct file *file, char __user *buf, size_t count,
 
         used += sizeof(header);
 
-        rc = (ssize_t) used;
+        rc = used;
         return rc;
 }
 
diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
index 229dc18f0581..768972af8b85 100644
--- a/drivers/mmc/host/bcm2835.c
+++ b/drivers/mmc/host/bcm2835.c
@@ -1265,7 +1265,8 @@ static int bcm2835_add_host(struct bcm2835_host *host)
         char pio_limit_string[20];
         int ret;
 
-        mmc->f_max = host->max_clk;
+        if (!mmc->f_max || mmc->f_max > host->max_clk)
+                mmc->f_max = host->max_clk;
         mmc->f_min = host->max_clk / SDCDIV_MAX_CDIV;
 
         mmc->max_busy_timeout = ~0 / (mmc->f_max / 1000);
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index 22438ebfe4e6..4f972b879fe6 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -717,22 +717,6 @@ static int meson_mmc_clk_phase_tuning(struct mmc_host *mmc, u32 opcode,
 static int meson_mmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
 {
         struct meson_host *host = mmc_priv(mmc);
-        int ret;
-
-        /*
-         * If this is the initial tuning, try to get a sane Rx starting
-         * phase before doing the actual tuning.
-         */
-        if (!mmc->doing_retune) {
-                ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
-
-                if (ret)
-                        return ret;
-        }
-
-        ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->tx_clk);
-        if (ret)
-                return ret;
 
         return meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
 }
@@ -763,9 +747,8 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                 if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
 
-                /* Reset phases */
+                /* Reset rx phase */
                 clk_set_phase(host->rx_clk, 0);
-                clk_set_phase(host->tx_clk, 270);
 
                 break;
 
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index e6b8c59f2c0d..736ac887303c 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -328,7 +328,7 @@ config MTD_NAND_MARVELL
         tristate "NAND controller support on Marvell boards"
         depends on PXA3xx || ARCH_MMP || PLAT_ORION || ARCH_MVEBU || \
                    COMPILE_TEST
-        depends on HAS_IOMEM
+        depends on HAS_IOMEM && HAS_DMA
         help
           This enables the NAND flash controller driver for Marvell boards,
           including:
diff --git a/drivers/mtd/nand/vf610_nfc.c b/drivers/mtd/nand/vf610_nfc.c
index 80d31a58e558..f367144f3c6f 100644
--- a/drivers/mtd/nand/vf610_nfc.c
+++ b/drivers/mtd/nand/vf610_nfc.c
@@ -752,10 +752,8 @@ static int vf610_nfc_probe(struct platform_device *pdev)
                 if (mtd->oobsize > 64)
                         mtd->oobsize = 64;
 
-                /*
-                 * mtd->ecclayout is not specified here because we're using the
-                 * default large page ECC layout defined in NAND core.
-                 */
+                /* Use default large page ECC layout defined in NAND core */
+                mtd_set_ooblayout(mtd, &nand_ooblayout_lp_ops);
                 if (chip->ecc.strength == 32) {
                         nfc->ecc_mode = ECC_60_BYTE;
                         chip->ecc.bytes = 60;
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
index 3e5833cf1fab..eb23f9ba1a9a 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
@@ -426,6 +426,8 @@ static int xgbe_pci_resume(struct pci_dev *pdev)
         struct net_device *netdev = pdata->netdev;
         int ret = 0;
 
+        XP_IOWRITE(pdata, XP_INT_EN, 0x1fffff);
+
         pdata->lpm_ctrl &= ~MDIO_CTRL1_LPOWER;
         XMDIO_WRITE(pdata, MDIO_MMD_PCS, MDIO_CTRL1, pdata->lpm_ctrl);
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
index 22889fc158f2..87c4308b52a7 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
@@ -226,6 +226,10 @@ static int aq_pci_probe(struct pci_dev *pdev,
                 goto err_ioremap;
 
         self->aq_hw = kzalloc(sizeof(*self->aq_hw), GFP_KERNEL);
+        if (!self->aq_hw) {
+                err = -ENOMEM;
+                goto err_ioremap;
+        }
         self->aq_hw->aq_nic_cfg = aq_nic_get_cfg(self);
 
         for (bar = 0; bar < 4; ++bar) {
@@ -235,19 +239,19 @@ static int aq_pci_probe(struct pci_dev *pdev,
                         mmio_pa = pci_resource_start(pdev, bar);
                         if (mmio_pa == 0U) {
                                 err = -EIO;
-                                goto err_ioremap;
+                                goto err_free_aq_hw;
                         }
 
                         reg_sz = pci_resource_len(pdev, bar);
                         if ((reg_sz <= 24 /*ATL_REGS_SIZE*/)) {
                                 err = -EIO;
-                                goto err_ioremap;
+                                goto err_free_aq_hw;
                         }
 
                         self->aq_hw->mmio = ioremap_nocache(mmio_pa, reg_sz);
                         if (!self->aq_hw->mmio) {
                                 err = -EIO;
-                                goto err_ioremap;
+                                goto err_free_aq_hw;
                         }
                         break;
                 }
@@ -255,7 +259,7 @@ static int aq_pci_probe(struct pci_dev *pdev,
 
         if (bar == 4) {
                 err = -EIO;
-                goto err_ioremap;
+                goto err_free_aq_hw;
         }
 
         numvecs = min((u8)AQ_CFG_VECS_DEF,
@@ -290,6 +294,8 @@ err_register:
         aq_pci_free_irq_vectors(self);
 err_hwinit:
         iounmap(self->aq_hw->mmio);
+err_free_aq_hw:
+        kfree(self->aq_hw);
 err_ioremap:
         free_netdev(ndev);
 err_pci_func:
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index a77ee2f8fb8d..c1841db1b500 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -820,7 +820,7 @@ static int tg3_ape_event_lock(struct tg3 *tp, u32 timeout_us)
 
                 tg3_ape_unlock(tp, TG3_APE_LOCK_MEM);
 
-                udelay(10);
+                usleep_range(10, 20);
                 timeout_us -= (timeout_us > 10) ? 10 : timeout_us;
         }
 
@@ -922,8 +922,8 @@ static int tg3_ape_send_event(struct tg3 *tp, u32 event)
         if (!(apedata & APE_FW_STATUS_READY))
                 return -EAGAIN;
 
-        /* Wait for up to 1 millisecond for APE to service previous event. */
-        err = tg3_ape_event_lock(tp, 1000);
+        /* Wait for up to 20 millisecond for APE to service previous event. */
+        err = tg3_ape_event_lock(tp, 20000);
         if (err)
                 return err;
 
@@ -946,6 +946,7 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
 
         switch (kind) {
         case RESET_KIND_INIT:
+                tg3_ape_write32(tp, TG3_APE_HOST_HEARTBEAT_COUNT, tp->ape_hb++);
                 tg3_ape_write32(tp, TG3_APE_HOST_SEG_SIG,
                                 APE_HOST_SEG_SIG_MAGIC);
                 tg3_ape_write32(tp, TG3_APE_HOST_SEG_LEN,
@@ -962,13 +963,6 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
                 event = APE_EVENT_STATUS_STATE_START;
                 break;
         case RESET_KIND_SHUTDOWN:
-                /* With the interface we are currently using,
-                 * APE does not track driver state.  Wiping
-                 * out the HOST SEGMENT SIGNATURE forces
-                 * the APE to assume OS absent status.
-                 */
-                tg3_ape_write32(tp, TG3_APE_HOST_SEG_SIG, 0x0);
-
                 if (device_may_wakeup(&tp->pdev->dev) &&
                     tg3_flag(tp, WOL_ENABLE)) {
                         tg3_ape_write32(tp, TG3_APE_HOST_WOL_SPEED,
@@ -990,6 +984,18 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
         tg3_ape_send_event(tp, event);
 }
 
+static void tg3_send_ape_heartbeat(struct tg3 *tp,
+                                   unsigned long interval)
+{
+        /* Check if hb interval has exceeded */
+        if (!tg3_flag(tp, ENABLE_APE) ||
+            time_before(jiffies, tp->ape_hb_jiffies + interval))
+                return;
+
+        tg3_ape_write32(tp, TG3_APE_HOST_HEARTBEAT_COUNT, tp->ape_hb++);
+        tp->ape_hb_jiffies = jiffies;
+}
+
 static void tg3_disable_ints(struct tg3 *tp)
 {
         int i;
@@ -7262,6 +7268,7 @@ static int tg3_poll_msix(struct napi_struct *napi, int budget)
                 }
         }
 
+        tg3_send_ape_heartbeat(tp, TG3_APE_HB_INTERVAL << 1);
         return work_done;
 
 tx_recovery:
@@ -7344,6 +7351,7 @@ static int tg3_poll(struct napi_struct *napi, int budget)
                 }
         }
 
+        tg3_send_ape_heartbeat(tp, TG3_APE_HB_INTERVAL << 1);
         return work_done;
 
 tx_recovery:
@@ -10732,7 +10740,7 @@ static int tg3_reset_hw(struct tg3 *tp, bool reset_phy)
         if (tg3_flag(tp, ENABLE_APE))
                 /* Write our heartbeat update interval to APE. */
                 tg3_ape_write32(tp, TG3_APE_HOST_HEARTBEAT_INT_MS,
-                                APE_HOST_HEARTBEAT_INT_DISABLE);
+                                APE_HOST_HEARTBEAT_INT_5SEC);
 
         tg3_write_sig_post_reset(tp, RESET_KIND_INIT);
 
@@ -11077,6 +11085,9 @@ static void tg3_timer(struct timer_list *t)
                 tp->asf_counter = tp->asf_multiplier;
         }
 
+        /* Update the APE heartbeat every 5 seconds.*/
+        tg3_send_ape_heartbeat(tp, TG3_APE_HB_INTERVAL);
+
         spin_unlock(&tp->lock);
 
 restart_timer:
@@ -16653,6 +16664,8 @@ static int tg3_get_invariants(struct tg3 *tp, const struct pci_device_id *ent)
                                        pci_state_reg);
 
                 tg3_ape_lock_init(tp);
+                tp->ape_hb_interval =
+                        msecs_to_jiffies(APE_HOST_HEARTBEAT_INT_5SEC);
         }
 
         /* Set up tp->grc_local_ctrl before calling
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index 47f51cc0566d..1d61aa3efda1 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -2508,6 +2508,7 @@
 #define TG3_APE_LOCK_PHY3               5
 #define TG3_APE_LOCK_GPIO               7
 
+#define TG3_APE_HB_INTERVAL             (tp->ape_hb_interval)
 #define TG3_EEPROM_SB_F1R2_MBA_OFF      0x10
 
 
@@ -3423,6 +3424,10 @@ struct tg3 {
         struct device                   *hwmon_dev;
         bool                            link_up;
         bool                            pcierr_recovery;
+
+        u32                             ape_hb;
+        unsigned long                   ape_hb_interval;
+        unsigned long                   ape_hb_jiffies;
 };
 
 /* Accessor macros for chip and asic attributes
diff --git a/drivers/net/ethernet/cavium/common/cavium_ptp.c b/drivers/net/ethernet/cavium/common/cavium_ptp.c
index c87c9c684a33..d59497a7bdce 100644
--- a/drivers/net/ethernet/cavium/common/cavium_ptp.c
+++ b/drivers/net/ethernet/cavium/common/cavium_ptp.c
@@ -75,6 +75,8 @@ EXPORT_SYMBOL(cavium_ptp_get);
 
 void cavium_ptp_put(struct cavium_ptp *ptp)
 {
+        if (!ptp)
+                return;
         pci_dev_put(ptp->pdev);
 }
 EXPORT_SYMBOL(cavium_ptp_put);
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index b68cde9f17d2..7d9c5ffbd041 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -67,11 +67,6 @@ module_param(cpi_alg, int, S_IRUGO);
 MODULE_PARM_DESC(cpi_alg,
                  "PFC algorithm (0=none, 1=VLAN, 2=VLAN16, 3=IP Diffserv)");
 
-struct nicvf_xdp_tx {
-        u64 dma_addr;
-        u8  qidx;
-};
-
 static inline u8 nicvf_netdev_qidx(struct nicvf *nic, u8 qidx)
 {
         if (nic->sqs_mode)
@@ -507,29 +502,14 @@ static int nicvf_init_resources(struct nicvf *nic)
         return 0;
 }
 
-static void nicvf_unmap_page(struct nicvf *nic, struct page *page, u64 dma_addr)
-{
-        /* Check if it's a recycled page, if not unmap the DMA mapping.
-         * Recycled page holds an extra reference.
-         */
-        if (page_ref_count(page) == 1) {
-                dma_addr &= PAGE_MASK;
-                dma_unmap_page_attrs(&nic->pdev->dev, dma_addr,
-                                     RCV_FRAG_LEN + XDP_HEADROOM,
-                                     DMA_FROM_DEVICE,
-                                     DMA_ATTR_SKIP_CPU_SYNC);
-        }
-}
-
 static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
                                 struct cqe_rx_t *cqe_rx, struct snd_queue *sq,
                                 struct rcv_queue *rq, struct sk_buff **skb)
 {
         struct xdp_buff xdp;
         struct page *page;
-        struct nicvf_xdp_tx *xdp_tx = NULL;
         u32 action;
-        u16 len, err, offset = 0;
+        u16 len, offset = 0;
         u64 dma_addr, cpu_addr;
         void *orig_data;
 
@@ -543,7 +523,7 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
         cpu_addr = (u64)phys_to_virt(cpu_addr);
         page = virt_to_page((void *)cpu_addr);
 
-        xdp.data_hard_start = page_address(page) + RCV_BUF_HEADROOM;
+        xdp.data_hard_start = page_address(page);
         xdp.data = (void *)cpu_addr;
         xdp_set_data_meta_invalid(&xdp);
         xdp.data_end = xdp.data + len;
@@ -563,7 +543,18 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
 
         switch (action) {
         case XDP_PASS:
-                nicvf_unmap_page(nic, page, dma_addr);
+                /* Check if it's a recycled page, if not
+                 * unmap the DMA mapping.
+                 *
+                 * Recycled page holds an extra reference.
+                 */
+                if (page_ref_count(page) == 1) {
+                        dma_addr &= PAGE_MASK;
+                        dma_unmap_page_attrs(&nic->pdev->dev, dma_addr,
+                                             RCV_FRAG_LEN + XDP_PACKET_HEADROOM,
+                                             DMA_FROM_DEVICE,
+                                             DMA_ATTR_SKIP_CPU_SYNC);
+                }
 
                 /* Build SKB and pass on packet to network stack */
                 *skb = build_skb(xdp.data,
@@ -576,20 +567,6 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
         case XDP_TX:
                 nicvf_xdp_sq_append_pkt(nic, sq, (u64)xdp.data, dma_addr, len);
                 return true;
-        case XDP_REDIRECT:
-                /* Save DMA address for use while transmitting */
-                xdp_tx = (struct nicvf_xdp_tx *)page_address(page);
-                xdp_tx->dma_addr = dma_addr;
-                xdp_tx->qidx = nicvf_netdev_qidx(nic, cqe_rx->rq_idx);
-
-                err = xdp_do_redirect(nic->pnicvf->netdev, &xdp, prog);
-                if (!err)
-                        return true;
-
-                /* Free the page on error */
-                nicvf_unmap_page(nic, page, dma_addr);
-                put_page(page);
-                break;
         default:
                 bpf_warn_invalid_xdp_action(action);
                 /* fall through */
@@ -597,7 +574,18 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
                 trace_xdp_exception(nic->netdev, prog, action);
                 /* fall through */
         case XDP_DROP:
-                nicvf_unmap_page(nic, page, dma_addr);
+                /* Check if it's a recycled page, if not
+                 * unmap the DMA mapping.
+                 *
+                 * Recycled page holds an extra reference.
+                 */
+                if (page_ref_count(page) == 1) {
+                        dma_addr &= PAGE_MASK;
+                        dma_unmap_page_attrs(&nic->pdev->dev, dma_addr,
+                                             RCV_FRAG_LEN + XDP_PACKET_HEADROOM,
+                                             DMA_FROM_DEVICE,
+                                             DMA_ATTR_SKIP_CPU_SYNC);
+                }
                 put_page(page);
                 return true;
         }
@@ -1864,50 +1852,6 @@ static int nicvf_xdp(struct net_device *netdev, struct netdev_bpf *xdp)
         }
 }
 
-static int nicvf_xdp_xmit(struct net_device *netdev, struct xdp_buff *xdp)
-{
-        struct nicvf *nic = netdev_priv(netdev);
-        struct nicvf *snic = nic;
-        struct nicvf_xdp_tx *xdp_tx;
-        struct snd_queue *sq;
-        struct page *page;
-        int err, qidx;
-
-        if (!netif_running(netdev) || !nic->xdp_prog)
-                return -EINVAL;
-
-        page = virt_to_page(xdp->data);
-        xdp_tx = (struct nicvf_xdp_tx *)page_address(page);
-        qidx = xdp_tx->qidx;
-
-        if (xdp_tx->qidx >= nic->xdp_tx_queues)
-                return -EINVAL;
-
-        /* Get secondary Qset's info */
-        if (xdp_tx->qidx >= MAX_SND_QUEUES_PER_QS) {
-                qidx = xdp_tx->qidx / MAX_SND_QUEUES_PER_QS;
-                snic = (struct nicvf *)nic->snicvf[qidx - 1];
-                if (!snic)
-                        return -EINVAL;
-                qidx = xdp_tx->qidx % MAX_SND_QUEUES_PER_QS;
-        }
-
-        sq = &snic->qs->sq[qidx];
-        err = nicvf_xdp_sq_append_pkt(snic, sq, (u64)xdp->data,
-                                      xdp_tx->dma_addr,
-                                      xdp->data_end - xdp->data);
-        if (err)
-                return -ENOMEM;
-
-        nicvf_xdp_sq_doorbell(snic, sq, qidx);
-        return 0;
-}
-
-static void nicvf_xdp_flush(struct net_device *dev)
-{
-        return;
-}
-
 static int nicvf_config_hwtstamp(struct net_device *netdev, struct ifreq *ifr)
 {
         struct hwtstamp_config config;
@@ -1986,8 +1930,6 @@ static const struct net_device_ops nicvf_netdev_ops = {
         .ndo_fix_features       = nicvf_fix_features,
         .ndo_set_features       = nicvf_set_features,
         .ndo_bpf                = nicvf_xdp,
-        .ndo_xdp_xmit           = nicvf_xdp_xmit,
-        .ndo_xdp_flush          = nicvf_xdp_flush,
         .ndo_do_ioctl           = nicvf_ioctl,
 };
 
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 3eae9ff9b53a..d42704d07484 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -204,7 +204,7 @@ static inline int nicvf_alloc_rcv_buffer(struct nicvf *nic, struct rbdr *rbdr,
 
         /* Reserve space for header modifications by BPF program */
         if (rbdr->is_xdp)
-                buf_len += XDP_HEADROOM;
+                buf_len += XDP_PACKET_HEADROOM;
 
         /* Check if it's recycled */
         if (pgcache)
@@ -224,9 +224,8 @@ ret:
                         nic->rb_page = NULL;
                         return -ENOMEM;
                 }
-
                 if (pgcache)
-                        pgcache->dma_addr = *rbuf + XDP_HEADROOM;
+                        pgcache->dma_addr = *rbuf + XDP_PACKET_HEADROOM;
                 nic->rb_page_offset += buf_len;
         }
 
@@ -1244,7 +1243,7 @@ int nicvf_xdp_sq_append_pkt(struct nicvf *nic, struct snd_queue *sq,
         int qentry;
 
         if (subdesc_cnt > sq->xdp_free_cnt)
-                return -1;
+                return 0;
 
         qentry = nicvf_get_sq_desc(sq, subdesc_cnt);
 
@@ -1255,7 +1254,7 @@ int nicvf_xdp_sq_append_pkt(struct nicvf *nic, struct snd_queue *sq,
 
         sq->xdp_desc_cnt += subdesc_cnt;
 
-        return 0;
+        return 1;
 }
 
 /* Calculate no of SQ subdescriptors needed to transmit all
@@ -1656,7 +1655,7 @@ static void nicvf_unmap_rcv_buffer(struct nicvf *nic, u64 dma_addr,
                 if (page_ref_count(page) != 1)
                         return;
 
-                len += XDP_HEADROOM;
+                len += XDP_PACKET_HEADROOM;
                 /* Receive buffers in XDP mode are mapped from page start */
                 dma_addr &= PAGE_MASK;
         }
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
index ce1eed7a6d63..5e9a03cf1b4d 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
@@ -11,7 +11,6 @@
 
 #include <linux/netdevice.h>
 #include <linux/iommu.h>
-#include <linux/bpf.h>
 #include <net/xdp.h>
 #include "q_struct.h"
 
@@ -94,9 +93,6 @@
 #define RCV_FRAG_LEN     (SKB_DATA_ALIGN(DMA_BUFFER_LEN + NET_SKB_PAD) + \
                          SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 
-#define RCV_BUF_HEADROOM        128 /* To store dma address for XDP redirect */
-#define XDP_HEADROOM            (XDP_PACKET_HEADROOM + RCV_BUF_HEADROOM)
-
 #define MAX_CQES_FOR_TX         ((SND_QUEUE_LEN / MIN_SQ_DESC_PER_PKT_XMIT) * \
                                  MAX_CQE_PER_PKT_XMIT)
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
index 557fd8bfd54e..00a1d2d13169 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
@@ -472,7 +472,7 @@ int cudbg_collect_cim_la(struct cudbg_init *pdbg_init,
 
         if (is_t6(padap->params.chip)) {
                 size = padap->params.cim_la_size / 10 + 1;
-                size *= 11 * sizeof(u32);
+                size *= 10 * sizeof(u32);
         } else {
                 size = padap->params.cim_la_size / 8;
                 size *= 8 * sizeof(u32);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c
index 30485f9a598f..143686c60234 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c
@@ -102,7 +102,7 @@ static u32 cxgb4_get_entity_length(struct adapter *adap, u32 entity)
         case CUDBG_CIM_LA:
                 if (is_t6(adap->params.chip)) {
                         len = adap->params.cim_la_size / 10 + 1;
-                        len *= 11 * sizeof(u32);
+                        len *= 10 * sizeof(u32);
                 } else {
                         len = adap->params.cim_la_size / 8;
                         len *= 8 * sizeof(u32);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 56bc626ef006..7b452e85de2a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4982,9 +4982,10 @@ static int cxgb4_iov_configure(struct pci_dev *pdev, int num_vfs)
 
         pcie_fw = readl(adap->regs + PCIE_FW_A);
         /* Check if cxgb4 is the MASTER and fw is initialized */
-        if (!(pcie_fw & PCIE_FW_INIT_F) ||
+        if (num_vfs &&
+            (!(pcie_fw & PCIE_FW_INIT_F) ||
             !(pcie_fw & PCIE_FW_MASTER_VLD_F) ||
-            PCIE_FW_MASTER_G(pcie_fw) != CXGB4_UNIFIED_PF) {
+            PCIE_FW_MASTER_G(pcie_fw) != CXGB4_UNIFIED_PF)) {
                 dev_warn(&pdev->dev,
                          "cxgb4 driver needs to be MASTER to support SRIOV\n");
                 return -EOPNOTSUPP;
@@ -5599,24 +5600,24 @@ static void remove_one(struct pci_dev *pdev)
 #if IS_ENABLED(CONFIG_IPV6)
                 t4_cleanup_clip_tbl(adapter);
 #endif
-                iounmap(adapter->regs);
                 if (!is_t4(adapter->params.chip))
                         iounmap(adapter->bar2);
-                pci_disable_pcie_error_reporting(pdev);
-                if ((adapter->flags & DEV_ENABLED)) {
-                        pci_disable_device(pdev);
-                        adapter->flags &= ~DEV_ENABLED;
-                }
-                pci_release_regions(pdev);
-                kfree(adapter->mbox_log);
-                synchronize_rcu();
-                kfree(adapter);
         }
 #ifdef CONFIG_PCI_IOV
         else {
                 cxgb4_iov_configure(adapter->pdev, 0);
         }
 #endif
+        iounmap(adapter->regs);
+        pci_disable_pcie_error_reporting(pdev);
+        if ((adapter->flags & DEV_ENABLED)) {
+                pci_disable_device(pdev);
+                adapter->flags &= ~DEV_ENABLED;
+        }
+        pci_release_regions(pdev);
+        kfree(adapter->mbox_log);
+        synchronize_rcu();
+        kfree(adapter);
 }
 
 /* "Shutdown" quiesces the device, stopping Ingress Packet and Interrupt
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 047609ef0515..920bccd6bc40 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -2637,7 +2637,6 @@ void t4_get_regs(struct adapter *adap, void *buf, size_t buf_size)
 }
 
 #define EEPROM_STAT_ADDR   0x7bfc
-#define VPD_SIZE           0x800
 #define VPD_BASE           0x400
 #define VPD_BASE_OLD       0
 #define VPD_LEN            1024
@@ -2704,15 +2703,6 @@ int t4_get_raw_vpd_params(struct adapter *adapter, struct vpd_params *p)
         if (!vpd)
                 return -ENOMEM;
 
-        /* We have two VPD data structures stored in the adapter VPD area.
-         * By default, Linux calculates the size of the VPD area by traversing
-         * the first VPD area at offset 0x0, so we need to tell the OS what
-         * our real VPD size is.
-         */
-        ret = pci_set_vpd_size(adapter->pdev, VPD_SIZE);
-        if (ret < 0)
-                goto out;
-
         /* Card information normally starts at VPD_BASE but early cards had
          * it at 0.
          */
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 3bdeb295514b..f5c87bd35fa1 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2934,29 +2934,17 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,
 {
         int size = lstatus & BD_LENGTH_MASK;
         struct page *page = rxb->page;
-        bool last = !!(lstatus & BD_LFLAG(RXBD_LAST));
-
-        /* Remove the FCS from the packet length */
-        if (last)
-                size -= ETH_FCS_LEN;
 
         if (likely(first)) {
                 skb_put(skb, size);
         } else {
                 /* the last fragments' length contains the full frame length */
-                if (last)
+                if (lstatus & BD_LFLAG(RXBD_LAST))
                         size -= skb->len;
 
-                /* Add the last fragment if it contains something other than
-                 * the FCS, otherwise drop it and trim off any part of the FCS
-                 * that was already received.
-                 */
-                if (size > 0)
-                        skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
-                                        rxb->page_offset + RXBUF_ALIGNMENT,
-                                        size, GFAR_RXB_TRUESIZE);
-                else if (size < 0)
-                        pskb_trim(skb, skb->len + size);
+                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
+                                rxb->page_offset + RXBUF_ALIGNMENT,
+                                size, GFAR_RXB_TRUESIZE);
         }
 
         /* try reuse page */
@@ -3069,6 +3057,9 @@ static void gfar_process_frame(struct net_device *ndev, struct sk_buff *skb)
         if (priv->padding)
                 skb_pull(skb, priv->padding);
 
+        /* Trim off the FCS */
+        pskb_trim(skb, skb->len - ETH_FCS_LEN);
+
         if (ndev->features & NETIF_F_RXCSUM)
                 gfar_rx_checksum(skb, fcb);
 
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 27447260215d..1b3cc8bb0705 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -791,6 +791,18 @@ static int ibmvnic_login(struct net_device *netdev)
         return 0;
 }
 
+static void release_login_buffer(struct ibmvnic_adapter *adapter)
+{
+        kfree(adapter->login_buf);
+        adapter->login_buf = NULL;
+}
+
+static void release_login_rsp_buffer(struct ibmvnic_adapter *adapter)
+{
+        kfree(adapter->login_rsp_buf);
+        adapter->login_rsp_buf = NULL;
+}
+
 static void release_resources(struct ibmvnic_adapter *adapter)
 {
         int i;
@@ -813,6 +825,10 @@ static void release_resources(struct ibmvnic_adapter *adapter)
                         }
                 }
         }
+        kfree(adapter->napi);
+        adapter->napi = NULL;
+
+        release_login_rsp_buffer(adapter);
 }
 
 static int set_link_state(struct ibmvnic_adapter *adapter, u8 link_state)
@@ -1057,6 +1073,35 @@ static int ibmvnic_open(struct net_device *netdev)
         return rc;
 }
 
+static void clean_rx_pools(struct ibmvnic_adapter *adapter)
+{
+        struct ibmvnic_rx_pool *rx_pool;
+        u64 rx_entries;
+        int rx_scrqs;
+        int i, j;
+
+        if (!adapter->rx_pool)
+                return;
+
+        rx_scrqs = be32_to_cpu(adapter->login_rsp_buf->num_rxadd_subcrqs);
+        rx_entries = adapter->req_rx_add_entries_per_subcrq;
+
+        /* Free any remaining skbs in the rx buffer pools */
+        for (i = 0; i < rx_scrqs; i++) {
+                rx_pool = &adapter->rx_pool[i];
+                if (!rx_pool)
+                        continue;
+
+                netdev_dbg(adapter->netdev, "Cleaning rx_pool[%d]\n", i);
+                for (j = 0; j < rx_entries; j++) {
+                        if (rx_pool->rx_buff[j].skb) {
+                                dev_kfree_skb_any(rx_pool->rx_buff[j].skb);
+                                rx_pool->rx_buff[j].skb = NULL;
+                        }
+                }
+        }
+}
+
 static void clean_tx_pools(struct ibmvnic_adapter *adapter)
 {
         struct ibmvnic_tx_pool *tx_pool;
@@ -1134,7 +1179,7 @@ static int __ibmvnic_close(struct net_device *netdev)
                         }
                 }
         }
-
+        clean_rx_pools(adapter);
         clean_tx_pools(adapter);
         adapter->state = VNIC_CLOSED;
         return rc;
@@ -1670,8 +1715,6 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                 return 0;
         }
 
-        netif_carrier_on(netdev);
-
         /* kick napi */
         for (i = 0; i < adapter->req_rx_queues; i++)
                 napi_schedule(&adapter->napi[i]);
@@ -1679,6 +1722,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
         if (adapter->reset_reason != VNIC_RESET_FAILOVER)
                 netdev_notify_peers(netdev);
 
+        netif_carrier_on(netdev);
+
         return 0;
 }
 
@@ -1853,6 +1898,12 @@ restart_poll:
                                    be16_to_cpu(next->rx_comp.rc));
                         /* free the entry */
                         next->rx_comp.first = 0;
+                        dev_kfree_skb_any(rx_buff->skb);
+                        remove_buff_from_pool(adapter, rx_buff);
+                        continue;
+                } else if (!rx_buff->skb) {
+                        /* free the entry */
+                        next->rx_comp.first = 0;
                         remove_buff_from_pool(adapter, rx_buff);
                         continue;
                 }
@@ -3013,6 +3064,7 @@ static void send_login(struct ibmvnic_adapter *adapter)
         struct vnic_login_client_data *vlcd;
         int i;
 
+        release_login_rsp_buffer(adapter);
         client_data_len = vnic_client_data_len(adapter);
 
         buffer_size =
@@ -3738,6 +3790,7 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq,
                 ibmvnic_remove(adapter->vdev);
                 return -EIO;
         }
+        release_login_buffer(adapter);
         complete(&adapter->init_done);
 
         return 0;
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index a1d7b88cf083..5a1668cdb461 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -7137,6 +7137,7 @@ static void mvpp2_set_rx_mode(struct net_device *dev)
         int id = port->id;
         bool allmulti = dev->flags & IFF_ALLMULTI;
 
+retry:
         mvpp2_prs_mac_promisc_set(priv, id, dev->flags & IFF_PROMISC);
         mvpp2_prs_mac_multi_set(priv, id, MVPP2_PE_MAC_MC_ALL, allmulti);
         mvpp2_prs_mac_multi_set(priv, id, MVPP2_PE_MAC_MC_IP6, allmulti);
@@ -7144,9 +7145,13 @@ static void mvpp2_set_rx_mode(struct net_device *dev)
         /* Remove all port->id's mcast enries */
         mvpp2_prs_mcast_del_all(priv, id);
 
-        if (allmulti && !netdev_mc_empty(dev)) {
-                netdev_for_each_mc_addr(ha, dev)
-                        mvpp2_prs_mac_da_accept(priv, id, ha->addr, true);
+        if (!allmulti) {
+                netdev_for_each_mc_addr(ha, dev) {
+                        if (mvpp2_prs_mac_da_accept(priv, id, ha->addr, true)) {
+                                allmulti = true;
+                                goto retry;
+                        }
+                }
         }
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.c
index 0be4575b58a2..fd509160c8f6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.c
@@ -96,10 +96,10 @@ static void print_lyr_2_4_hdrs(struct trace_seq *p,
                                           "%pI4");
                 } else if (ethertype.v == ETH_P_IPV6) {
                         static const struct in6_addr full_ones = {
-                                .in6_u.u6_addr32 = {htonl(0xffffffff),
-                                                    htonl(0xffffffff),
-                                                    htonl(0xffffffff),
-                                                    htonl(0xffffffff)},
+                                .in6_u.u6_addr32 = {__constant_htonl(0xffffffff),
+                                                    __constant_htonl(0xffffffff),
+                                                    __constant_htonl(0xffffffff),
+                                                    __constant_htonl(0xffffffff)},
                         };
                         DECLARE_MASK_VAL(struct in6_addr, src_ipv6);
                         DECLARE_MASK_VAL(struct in6_addr, dst_ipv6);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 47bab842c5ee..da94c8cba5ee 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -1768,13 +1768,16 @@ static void mlx5e_build_rq_param(struct mlx5e_priv *priv,
         param->wq.linear = 1;
 }
 
-static void mlx5e_build_drop_rq_param(struct mlx5e_rq_param *param)
+static void mlx5e_build_drop_rq_param(struct mlx5_core_dev *mdev,
+                                      struct mlx5e_rq_param *param)
 {
         void *rqc = param->rqc;
         void *wq = MLX5_ADDR_OF(rqc, rqc, wq);
 
         MLX5_SET(wq, wq, wq_type, MLX5_WQ_TYPE_LINKED_LIST);
         MLX5_SET(wq, wq, log_wq_stride,    ilog2(sizeof(struct mlx5e_rx_wqe)));
+
+        param->wq.buf_numa_node = dev_to_node(&mdev->pdev->dev);
 }
 
 static void mlx5e_build_sq_param_common(struct mlx5e_priv *priv,
@@ -2634,6 +2637,9 @@ static int mlx5e_alloc_drop_cq(struct mlx5_core_dev *mdev,
                                struct mlx5e_cq *cq,
                                struct mlx5e_cq_param *param)
 {
+        param->wq.buf_numa_node = dev_to_node(&mdev->pdev->dev);
+        param->wq.db_numa_node  = dev_to_node(&mdev->pdev->dev);
+
         return mlx5e_alloc_cq_common(mdev, param, cq);
 }
 
@@ -2645,7 +2651,7 @@ static int mlx5e_open_drop_rq(struct mlx5_core_dev *mdev,
         struct mlx5e_cq *cq = &drop_rq->cq;
         int err;
 
-        mlx5e_build_drop_rq_param(&rq_param);
+        mlx5e_build_drop_rq_param(mdev, &rq_param);
 
         err = mlx5e_alloc_drop_cq(mdev, cq, &cq_param);
         if (err)
@@ -2994,8 +3000,8 @@ static int mlx5e_setup_tc_block(struct net_device *dev,
 }
 #endif
 
-int mlx5e_setup_tc(struct net_device *dev, enum tc_setup_type type,
-                   void *type_data)
+static int mlx5e_setup_tc(struct net_device *dev, enum tc_setup_type type,
+                          void *type_data)
 {
         switch (type) {
 #ifdef CONFIG_MLX5_ESWITCH
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 0d4bb0688faa..e5c3ab46a24a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -36,6 +36,7 @@
 #include <linux/tcp.h>
 #include <linux/bpf_trace.h>
 #include <net/busy_poll.h>
+#include <net/ip6_checksum.h>
 #include "en.h"
 #include "en_tc.h"
 #include "eswitch.h"
@@ -546,20 +547,33 @@ bool mlx5e_post_rx_mpwqes(struct mlx5e_rq *rq)
         return true;
 }
 
+static void mlx5e_lro_update_tcp_hdr(struct mlx5_cqe64 *cqe, struct tcphdr *tcp)
+{
+        u8 l4_hdr_type = get_cqe_l4_hdr_type(cqe);
+        u8 tcp_ack     = (l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_NO_DATA) ||
+                         (l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_AND_DATA);
+
+        tcp->check                      = 0;
+        tcp->psh                        = get_cqe_lro_tcppsh(cqe);
+
+        if (tcp_ack) {
+                tcp->ack                = 1;
+                tcp->ack_seq            = cqe->lro_ack_seq_num;
+                tcp->window             = cqe->lro_tcp_win;
+        }
+}
+
 static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe,
                                  u32 cqe_bcnt)
 {
         struct ethhdr   *eth = (struct ethhdr *)(skb->data);
         struct tcphdr   *tcp;
         int network_depth = 0;
+        __wsum check;
         __be16 proto;
         u16 tot_len;
         void *ip_p;
 
-        u8 l4_hdr_type = get_cqe_l4_hdr_type(cqe);
-        u8 tcp_ack = (l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_NO_DATA) ||
-                (l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_AND_DATA);
-
         proto = __vlan_get_protocol(skb, eth->h_proto, &network_depth);
 
         tot_len = cqe_bcnt - network_depth;
@@ -576,23 +590,30 @@ static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe,
                 ipv4->check             = 0;
                 ipv4->check             = ip_fast_csum((unsigned char *)ipv4,
                                                        ipv4->ihl);
+
+                mlx5e_lro_update_tcp_hdr(cqe, tcp);
+                check = csum_partial(tcp, tcp->doff * 4,
+                                     csum_unfold((__force __sum16)cqe->check_sum));
+                /* Almost done, don't forget the pseudo header */
+                tcp->check = csum_tcpudp_magic(ipv4->saddr, ipv4->daddr,
+                                               tot_len - sizeof(struct iphdr),
+                                               IPPROTO_TCP, check);
         } else {
+                u16 payload_len = tot_len - sizeof(struct ipv6hdr);
                 struct ipv6hdr *ipv6 = ip_p;
 
                 tcp = ip_p + sizeof(struct ipv6hdr);
                 skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
 
                 ipv6->hop_limit         = cqe->lro_min_ttl;
-                ipv6->payload_len       = cpu_to_be16(tot_len -
-                                                      sizeof(struct ipv6hdr));
-        }
-
-        tcp->psh = get_cqe_lro_tcppsh(cqe);
-
-        if (tcp_ack) {
-                tcp->ack                = 1;
-                tcp->ack_seq            = cqe->lro_ack_seq_num;
-                tcp->window             = cqe->lro_tcp_win;
+                ipv6->payload_len       = cpu_to_be16(payload_len);
+
+                mlx5e_lro_update_tcp_hdr(cqe, tcp);
+                check = csum_partial(tcp, tcp->doff * 4,
+                                     csum_unfold((__force __sum16)cqe->check_sum));
+                /* Almost done, don't forget the pseudo header */
+                tcp->check = csum_ipv6_magic(&ipv6->saddr, &ipv6->daddr, payload_len,
+                                             IPPROTO_TCP, check);
         }
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
index 5a4608281f38..707976482c09 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
@@ -216,7 +216,8 @@ mlx5e_test_loopback_validate(struct sk_buff *skb,
         if (iph->protocol != IPPROTO_UDP)
                 goto out;
 
-        udph = udp_hdr(skb);
+        /* Don't assume skb_transport_header() was set */
+        udph = (struct udphdr *)((u8 *)iph + 4 * iph->ihl);
         if (udph->dest != htons(9))
                 goto out;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index fd98b0dc610f..fa86a1466718 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -2529,7 +2529,8 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                         if (tcf_vlan_action(a) == TCA_VLAN_ACT_POP) {
                                 attr->action |= MLX5_FLOW_CONTEXT_ACTION_VLAN_POP;
                         } else if (tcf_vlan_action(a) == TCA_VLAN_ACT_PUSH) {
-                                if (tcf_vlan_push_proto(a) != htons(ETH_P_8021Q))
+                                if (tcf_vlan_push_proto(a) != htons(ETH_P_8021Q) ||
+                                    tcf_vlan_push_prio(a))
                                         return -EOPNOTSUPP;
 
                                 attr->action |= MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index 569b42a01026..11b4f1089d1c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -176,7 +176,7 @@ static inline u16 mlx5e_calc_min_inline(enum mlx5_inline_modes mode,
         default:
                 hlen = mlx5e_skb_l2_header_offset(skb);
         }
-        return min_t(u16, hlen, skb->len);
+        return min_t(u16, hlen, skb_headlen(skb));
 }
 
 static inline void mlx5e_tx_skb_pull_inline(unsigned char **skb_data,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index 5ecf2cddc16d..c2b1d7d351fc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1529,6 +1529,10 @@ static void esw_enable_vport(struct mlx5_eswitch *esw, int vport_num,
 
         esw_debug(esw->dev, "Enabling VPORT(%d)\n", vport_num);
 
+        /* Create steering drop counters for ingress and egress ACLs */
+        if (vport_num && esw->mode == SRIOV_LEGACY)
+                esw_vport_create_drop_counters(vport);
+
         /* Restore old vport configuration */
         esw_apply_vport_conf(esw, vport);
 
@@ -1545,10 +1549,6 @@ static void esw_enable_vport(struct mlx5_eswitch *esw, int vport_num,
         if (!vport_num)
                 vport->info.trusted = true;
 
-        /* create steering drop counters for ingress and egress ACLs */
-        if (vport_num && esw->mode == SRIOV_LEGACY)
-                esw_vport_create_drop_counters(vport);
-
         esw_vport_change_handle_locked(vport);
 
         esw->enabled_vports++;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index c025c98700e4..31fc2cfac3b3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -1429,7 +1429,8 @@ static bool check_conflicting_actions(u32 action1, u32 action2)
 
         if (xored_actions & (MLX5_FLOW_CONTEXT_ACTION_DROP  |
                              MLX5_FLOW_CONTEXT_ACTION_ENCAP |
-                             MLX5_FLOW_CONTEXT_ACTION_DECAP))
+                             MLX5_FLOW_CONTEXT_ACTION_DECAP |
+                             MLX5_FLOW_CONTEXT_ACTION_MOD_HDR))
                 return true;
 
         return false;
@@ -1758,8 +1759,11 @@ search_again_locked:
 
         /* Collect all fgs which has a matching match_criteria */
         err = build_match_list(&match_head, ft, spec);
-        if (err)
+        if (err) {
+                if (take_write)
+                        up_write_ref_node(&ft->node);
                 return ERR_PTR(err);
+        }
 
         if (!take_write)
                 up_read_ref_node(&ft->node);
@@ -1768,8 +1772,11 @@ search_again_locked:
                                       dest_num, version);
         free_match_list(&match_head);
         if (!IS_ERR(rule) ||
-            (PTR_ERR(rule) != -ENOENT && PTR_ERR(rule) != -EAGAIN))
+            (PTR_ERR(rule) != -ENOENT && PTR_ERR(rule) != -EAGAIN)) {
+                if (take_write)
+                        up_write_ref_node(&ft->node);
                 return rule;
+        }
 
         if (!take_write) {
                 nested_down_write_ref_node(&ft->node, FS_LOCK_GRANDPARENT);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
index e159243e0fcf..857035583ccd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
@@ -34,6 +34,7 @@
 #include <linux/highmem.h>
 #include <rdma/mlx5-abi.h>
 #include "en.h"
+#include "clock.h"
 
 enum {
         MLX5_CYCLES_SHIFT       = 23
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 2ef641c91c26..ae391e4b7070 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -551,7 +551,7 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
                 MLX5_SET(cmd_hca_cap,
                          set_hca_cap,
                          cache_line_128byte,
-                         cache_line_size() == 128 ? 1 : 0);
+                         cache_line_size() >= 128 ? 1 : 0);
 
         if (MLX5_CAP_GEN_MAX(dev, dct))
                 MLX5_SET(cmd_hca_cap, set_hca_cap, dct, 1);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index f0b25baba09a..f7948e983637 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -788,6 +788,9 @@ static struct mlxsw_sp_vr *mlxsw_sp_vr_create(struct mlxsw_sp *mlxsw_sp,
                                               u32 tb_id,
                                               struct netlink_ext_ack *extack)
 {
+        struct mlxsw_sp_mr_table *mr4_table;
+        struct mlxsw_sp_fib *fib4;
+        struct mlxsw_sp_fib *fib6;
         struct mlxsw_sp_vr *vr;
         int err;
 
@@ -796,29 +799,30 @@ static struct mlxsw_sp_vr *mlxsw_sp_vr_create(struct mlxsw_sp *mlxsw_sp,
                 NL_SET_ERR_MSG(extack, "spectrum: Exceeded number of supported virtual routers");
                 return ERR_PTR(-EBUSY);
         }
-        vr->fib4 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV4);
-        if (IS_ERR(vr->fib4))
-                return ERR_CAST(vr->fib4);
-        vr->fib6 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV6);
-        if (IS_ERR(vr->fib6)) {
-                err = PTR_ERR(vr->fib6);
+        fib4 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV4);
+        if (IS_ERR(fib4))
+                return ERR_CAST(fib4);
+        fib6 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV6);
+        if (IS_ERR(fib6)) {
+                err = PTR_ERR(fib6);
                 goto err_fib6_create;
         }
-        vr->mr4_table = mlxsw_sp_mr_table_create(mlxsw_sp, vr->id,
-                                                 MLXSW_SP_L3_PROTO_IPV4);
-        if (IS_ERR(vr->mr4_table)) {
-                err = PTR_ERR(vr->mr4_table);
+        mr4_table = mlxsw_sp_mr_table_create(mlxsw_sp, vr->id,
+                                             MLXSW_SP_L3_PROTO_IPV4);
+        if (IS_ERR(mr4_table)) {
+                err = PTR_ERR(mr4_table);
                 goto err_mr_table_create;
         }
+        vr->fib4 = fib4;
+        vr->fib6 = fib6;
+        vr->mr4_table = mr4_table;
         vr->tb_id = tb_id;
         return vr;
 
 err_mr_table_create:
-        mlxsw_sp_fib_destroy(mlxsw_sp, vr->fib6);
-        vr->fib6 = NULL;
+        mlxsw_sp_fib_destroy(mlxsw_sp, fib6);
 err_fib6_create:
-        mlxsw_sp_fib_destroy(mlxsw_sp, vr->fib4);
-        vr->fib4 = NULL;
+        mlxsw_sp_fib_destroy(mlxsw_sp, fib4);
         return ERR_PTR(err);
 }
 
@@ -3790,6 +3794,9 @@ mlxsw_sp_fib4_entry_offload_unset(struct mlxsw_sp_fib_entry *fib_entry)
         struct mlxsw_sp_nexthop_group *nh_grp = fib_entry->nh_group;
         int i;
 
+        if (!list_is_singular(&nh_grp->fib_list))
+                return;
+
         for (i = 0; i < nh_grp->count; i++) {
                 struct mlxsw_sp_nexthop *nh = &nh_grp->nexthops[i];
 
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index 7e7704daf5f1..c4949183eef3 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -43,12 +43,6 @@
 
 /* Local Definitions and Declarations */
 
-struct rmnet_walk_data {
-        struct net_device *real_dev;
-        struct list_head *head;
-        struct rmnet_port *port;
-};
-
 static int rmnet_is_real_dev_registered(const struct net_device *real_dev)
 {
         return rcu_access_pointer(real_dev->rx_handler) == rmnet_rx_handler;
@@ -112,17 +106,14 @@ static int rmnet_register_real_device(struct net_device *real_dev)
 static void rmnet_unregister_bridge(struct net_device *dev,
                                     struct rmnet_port *port)
 {
-        struct net_device *rmnet_dev, *bridge_dev;
         struct rmnet_port *bridge_port;
+        struct net_device *bridge_dev;
 
         if (port->rmnet_mode != RMNET_EPMODE_BRIDGE)
                 return;
 
         /* bridge slave handling */
         if (!port->nr_rmnet_devs) {
-                rmnet_dev = netdev_master_upper_dev_get_rcu(dev);
-                netdev_upper_dev_unlink(dev, rmnet_dev);
-
                 bridge_dev = port->bridge_ep;
 
                 bridge_port = rmnet_get_port_rtnl(bridge_dev);
@@ -132,9 +123,6 @@ static void rmnet_unregister_bridge(struct net_device *dev,
                 bridge_dev = port->bridge_ep;
 
                 bridge_port = rmnet_get_port_rtnl(bridge_dev);
-                rmnet_dev = netdev_master_upper_dev_get_rcu(bridge_dev);
-                netdev_upper_dev_unlink(bridge_dev, rmnet_dev);
-
                 rmnet_unregister_real_device(bridge_dev, bridge_port);
         }
 }
@@ -173,10 +161,6 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev,
         if (err)
                 goto err1;
 
-        err = netdev_master_upper_dev_link(dev, real_dev, NULL, NULL, extack);
-        if (err)
-                goto err2;
-
         port->rmnet_mode = mode;
 
         hlist_add_head_rcu(&ep->hlnode, &port->muxed_ep[mux_id]);
@@ -193,8 +177,6 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev,
 
         return 0;
 
-err2:
-        rmnet_vnd_dellink(mux_id, port, ep);
 err1:
         rmnet_unregister_real_device(real_dev, port);
 err0:
@@ -204,14 +186,13 @@ err0:
 
 static void rmnet_dellink(struct net_device *dev, struct list_head *head)
 {
+        struct rmnet_priv *priv = netdev_priv(dev);
         struct net_device *real_dev;
         struct rmnet_endpoint *ep;
         struct rmnet_port *port;
         u8 mux_id;
 
-        rcu_read_lock();
-        real_dev = netdev_master_upper_dev_get_rcu(dev);
-        rcu_read_unlock();
+        real_dev = priv->real_dev;
 
         if (!real_dev || !rmnet_is_real_dev_registered(real_dev))
                 return;
@@ -219,7 +200,6 @@ static void rmnet_dellink(struct net_device *dev, struct list_head *head)
         port = rmnet_get_port_rtnl(real_dev);
 
         mux_id = rmnet_vnd_get_mux(dev);
-        netdev_upper_dev_unlink(dev, real_dev);
 
         ep = rmnet_get_endpoint(port, mux_id);
         if (ep) {
@@ -233,30 +213,13 @@ static void rmnet_dellink(struct net_device *dev, struct list_head *head)
         unregister_netdevice_queue(dev, head);
 }
 
-static int rmnet_dev_walk_unreg(struct net_device *rmnet_dev, void *data)
-{
-        struct rmnet_walk_data *d = data;
-        struct rmnet_endpoint *ep;
-        u8 mux_id;
-
-        mux_id = rmnet_vnd_get_mux(rmnet_dev);
-        ep = rmnet_get_endpoint(d->port, mux_id);
-        if (ep) {
-                hlist_del_init_rcu(&ep->hlnode);
-                rmnet_vnd_dellink(mux_id, d->port, ep);
-                kfree(ep);
-        }
-        netdev_upper_dev_unlink(rmnet_dev, d->real_dev);
-        unregister_netdevice_queue(rmnet_dev, d->head);
-
-        return 0;
-}
-
 static void rmnet_force_unassociate_device(struct net_device *dev)
 {
         struct net_device *real_dev = dev;
-        struct rmnet_walk_data d;
+        struct hlist_node *tmp_ep;
+        struct rmnet_endpoint *ep;
         struct rmnet_port *port;
+        unsigned long bkt_ep;
         LIST_HEAD(list);
 
         if (!rmnet_is_real_dev_registered(real_dev))
@@ -264,16 +227,19 @@ static void rmnet_force_unassociate_device(struct net_device *dev)
 
         ASSERT_RTNL();
 
-        d.real_dev = real_dev;
-        d.head = &list;
-
         port = rmnet_get_port_rtnl(dev);
-        d.port = port;
 
         rcu_read_lock();
         rmnet_unregister_bridge(dev, port);
 
-        netdev_walk_all_lower_dev_rcu(real_dev, rmnet_dev_walk_unreg, &d);
+        hash_for_each_safe(port->muxed_ep, bkt_ep, tmp_ep, ep, hlnode) {
+                unregister_netdevice_queue(ep->egress_dev, &list);
+                rmnet_vnd_dellink(ep->mux_id, port, ep);
+
+                hlist_del_init_rcu(&ep->hlnode);
+                kfree(ep);
+        }
+
         rcu_read_unlock();
         unregister_netdevice_many(&list);
 
@@ -422,11 +388,6 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
         if (err)
                 return -EBUSY;
 
-        err = netdev_master_upper_dev_link(slave_dev, rmnet_dev, NULL, NULL,
-                                           extack);
-        if (err)
-                return -EINVAL;
-
         slave_port = rmnet_get_port(slave_dev);
         slave_port->rmnet_mode = RMNET_EPMODE_BRIDGE;
         slave_port->bridge_ep = real_dev;
@@ -449,7 +410,6 @@ int rmnet_del_bridge(struct net_device *rmnet_dev,
         port->rmnet_mode = RMNET_EPMODE_VND;
         port->bridge_ep = NULL;
 
-        netdev_upper_dev_unlink(slave_dev, rmnet_dev);
         slave_port = rmnet_get_port(slave_dev);
         rmnet_unregister_real_device(slave_dev, slave_port);
 
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
index 6bc328fb88e1..b0dbca070c00 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
@@ -38,6 +38,11 @@ static u8 rmnet_map_do_flow_control(struct sk_buff *skb,
         }
 
         ep = rmnet_get_endpoint(port, mux_id);
+        if (!ep) {
+                kfree_skb(skb);
+                return RX_HANDLER_CONSUMED;
+        }
+
         vnd = ep->egress_dev;
 
         ip_family = cmd->flow_control.ip_family;
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
index 570a227acdd8..346d310914df 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
@@ -121,7 +121,7 @@ static void rmnet_get_stats64(struct net_device *dev,
         memset(&total_stats, 0, sizeof(struct rmnet_vnd_stats));
 
         for_each_possible_cpu(cpu) {
-                pcpu_ptr = this_cpu_ptr(priv->pcpu_stats);
+                pcpu_ptr = per_cpu_ptr(priv->pcpu_stats, cpu);
 
                 do {
                         start = u64_stats_fetch_begin_irq(&pcpu_ptr->syncp);
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index c87f57ca4437..a95fbd5510d9 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -2255,9 +2255,6 @@ static int ravb_wol_setup(struct net_device *ndev)
         /* Enable MagicPacket */
         ravb_modify(ndev, ECMR, ECMR_MPDE, ECMR_MPDE);
 
-        /* Increased clock usage so device won't be suspended */
-        clk_enable(priv->clk);
-
         return enable_irq_wake(priv->emac_irq);
 }
 
@@ -2276,9 +2273,6 @@ static int ravb_wol_restore(struct net_device *ndev)
         if (ret < 0)
                 return ret;
 
-        /* Restore clock usage count */
-        clk_disable(priv->clk);
-
         return disable_irq_wake(priv->emac_irq);
 }
 
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index a197e11f3a56..92dcf8717fc6 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -40,7 +40,6 @@
 #include <linux/slab.h>
 #include <linux/ethtool.h>
 #include <linux/if_vlan.h>
-#include <linux/clk.h>
 #include <linux/sh_eth.h>
 #include <linux/of_mdio.h>
 
@@ -2304,7 +2303,7 @@ static void sh_eth_get_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
         wol->supported = 0;
         wol->wolopts = 0;
 
-        if (mdp->cd->magic && mdp->clk) {
+        if (mdp->cd->magic) {
                 wol->supported = WAKE_MAGIC;
                 wol->wolopts = mdp->wol_enabled ? WAKE_MAGIC : 0;
         }
@@ -2314,7 +2313,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
 {
         struct sh_eth_private *mdp = netdev_priv(ndev);
 
-        if (!mdp->cd->magic || !mdp->clk || wol->wolopts & ~WAKE_MAGIC)
+        if (!mdp->cd->magic || wol->wolopts & ~WAKE_MAGIC)
                 return -EOPNOTSUPP;
 
         mdp->wol_enabled = !!(wol->wolopts & WAKE_MAGIC);
@@ -3153,11 +3152,6 @@ static int sh_eth_drv_probe(struct platform_device *pdev)
                 goto out_release;
         }
 
-        /* Get clock, if not found that's OK but Wake-On-Lan is unavailable */
-        mdp->clk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(mdp->clk))
-                mdp->clk = NULL;
-
         ndev->base_addr = res->start;
 
         spin_lock_init(&mdp->lock);
@@ -3278,7 +3272,7 @@ static int sh_eth_drv_probe(struct platform_device *pdev)
         if (ret)
                 goto out_napi_del;
 
-        if (mdp->cd->magic && mdp->clk)
+        if (mdp->cd->magic)
                 device_set_wakeup_capable(&pdev->dev, 1);
 
         /* print device information */
@@ -3331,9 +3325,6 @@ static int sh_eth_wol_setup(struct net_device *ndev)
         /* Enable MagicPacket */
         sh_eth_modify(ndev, ECMR, ECMR_MPDE, ECMR_MPDE);
 
-        /* Increased clock usage so device won't be suspended */
-        clk_enable(mdp->clk);
-
         return enable_irq_wake(ndev->irq);
 }
 
@@ -3359,9 +3350,6 @@ static int sh_eth_wol_restore(struct net_device *ndev)
         if (ret < 0)
                 return ret;
 
-        /* Restore clock usage count */
-        clk_disable(mdp->clk);
-
         return disable_irq_wake(ndev->irq);
 }
 
diff --git a/drivers/net/ethernet/smsc/Kconfig b/drivers/net/ethernet/smsc/Kconfig
index 63aca9f847e1..4c2f612e4414 100644
--- a/drivers/net/ethernet/smsc/Kconfig
+++ b/drivers/net/ethernet/smsc/Kconfig
@@ -20,7 +20,7 @@ if NET_VENDOR_SMSC
 
 config SMC9194
         tristate "SMC 9194 support"
-        depends on (ISA || MAC && BROKEN)
+        depends on ISA
         select CRC32
         ---help---
           This is support for the SMC9xxx based Ethernet cards. Choose this
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index a0f2be81d52e..8fc02d9db3d0 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1451,7 +1451,7 @@ destroy_macvlan_port:
         /* the macvlan port may be freed by macvlan_uninit when fail to register.
          * so we destroy the macvlan port only when it's valid.
          */
-        if (create && macvlan_port_get_rtnl(dev))
+        if (create && macvlan_port_get_rtnl(lowerdev))
                 macvlan_port_destroy(port->dev);
         return err;
 }
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index b13eed21c87d..d39ae77707ef 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1382,7 +1382,7 @@ int genphy_setup_forced(struct phy_device *phydev)
                 ctl |= BMCR_FULLDPLX;
 
         return phy_modify(phydev, MII_BMCR,
-                          BMCR_LOOPBACK | BMCR_ISOLATE | BMCR_PDOWN, ctl);
+                          ~(BMCR_LOOPBACK | BMCR_ISOLATE | BMCR_PDOWN), ctl);
 }
 EXPORT_SYMBOL(genphy_setup_forced);
 
diff --git a/drivers/net/thunderbolt.c b/drivers/net/thunderbolt.c
index ca5e375de27c..e0d6760f3219 100644
--- a/drivers/net/thunderbolt.c
+++ b/drivers/net/thunderbolt.c
@@ -166,6 +166,8 @@ struct tbnet_ring {
  * @connected_work: Worker that finalizes the ThunderboltIP connection
  *                  setup and enables DMA paths for high speed data
  *                  transfers
+ * @disconnect_work: Worker that handles tearing down the ThunderboltIP
+ *                   connection
  * @rx_hdr: Copy of the currently processed Rx frame. Used when a
  *          network packet consists of multiple Thunderbolt frames.
  *          In host byte order.
@@ -190,6 +192,7 @@ struct tbnet {
         int login_retries;
         struct delayed_work login_work;
         struct work_struct connected_work;
+        struct work_struct disconnect_work;
         struct thunderbolt_ip_frame_header rx_hdr;
         struct tbnet_ring rx_ring;
         atomic_t frame_id;
@@ -445,7 +448,7 @@ static int tbnet_handle_packet(const void *buf, size_t size, void *data)
         case TBIP_LOGOUT:
                 ret = tbnet_logout_response(net, route, sequence, command_id);
                 if (!ret)
-                        tbnet_tear_down(net, false);
+                        queue_work(system_long_wq, &net->disconnect_work);
                 break;
 
         default:
@@ -659,6 +662,13 @@ static void tbnet_login_work(struct work_struct *work)
         }
 }
 
+static void tbnet_disconnect_work(struct work_struct *work)
+{
+        struct tbnet *net = container_of(work, typeof(*net), disconnect_work);
+
+        tbnet_tear_down(net, false);
+}
+
 static bool tbnet_check_frame(struct tbnet *net, const struct tbnet_frame *tf,
                               const struct thunderbolt_ip_frame_header *hdr)
 {
@@ -881,6 +891,7 @@ static int tbnet_stop(struct net_device *dev)
 
         napi_disable(&net->napi);
 
+        cancel_work_sync(&net->disconnect_work);
         tbnet_tear_down(net, true);
 
         tb_ring_free(net->rx_ring.ring);
@@ -1195,6 +1206,7 @@ static int tbnet_probe(struct tb_service *svc, const struct tb_service_id *id)
         net = netdev_priv(dev);
         INIT_DELAYED_WORK(&net->login_work, tbnet_login_work);
         INIT_WORK(&net->connected_work, tbnet_connected_work);
+        INIT_WORK(&net->disconnect_work, tbnet_disconnect_work);
         mutex_init(&net->connection_lock);
         atomic_set(&net->command_id, 0);
         atomic_set(&net->frame_id, 0);
@@ -1270,10 +1282,7 @@ static int __maybe_unused tbnet_suspend(struct device *dev)
         stop_login(net);
         if (netif_running(net->dev)) {
                 netif_device_detach(net->dev);
-                tb_ring_stop(net->rx_ring.ring);
-                tb_ring_stop(net->tx_ring.ring);
-                tbnet_free_buffers(&net->rx_ring);
-                tbnet_free_buffers(&net->tx_ring);
+                tbnet_tear_down(net, true);
         }
 
         return 0;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 81e6cc951e7f..b52258c327d2 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1489,27 +1489,23 @@ static struct sk_buff *tun_napi_alloc_frags(struct tun_file *tfile,
         skb->truesize += skb->data_len;
 
         for (i = 1; i < it->nr_segs; i++) {
+                struct page_frag *pfrag = &current->task_frag;
                 size_t fragsz = it->iov[i].iov_len;
-                unsigned long offset;
-                struct page *page;
-                void *data;
 
                 if (fragsz == 0 || fragsz > PAGE_SIZE) {
                         err = -EINVAL;
                         goto free;
                 }
 
-                local_bh_disable();
-                data = napi_alloc_frag(fragsz);
-                local_bh_enable();
-                if (!data) {
+                if (!skb_page_frag_refill(fragsz, pfrag, GFP_KERNEL)) {
                         err = -ENOMEM;
                         goto free;
                 }
 
-                page = virt_to_head_page(data);
-                offset = data - page_address(page);
-                skb_fill_page_desc(skb, i - 1, page, offset, fragsz);
+                skb_fill_page_desc(skb, i - 1, pfrag->page,
+                                   pfrag->offset, fragsz);
+                page_ref_inc(pfrag->page);
+                pfrag->offset += fragsz;
         }
 
         return skb;
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index d0a113743195..7a6a1fe79309 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -954,10 +954,11 @@ static int smsc75xx_set_features(struct net_device *netdev,
         /* it's racing here! */
 
         ret = smsc75xx_write_reg(dev, RFE_CTL, pdata->rfe_ctl);
-        if (ret < 0)
+        if (ret < 0) {
                 netdev_warn(dev->net, "Error writing RFE_CTL\n");
-
-        return ret;
+                return ret;
+        }
+        return 0;
 }
 
 static int smsc75xx_wait_ready(struct usbnet *dev, int in_pm)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 626c27352ae2..9bb9e562b893 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -443,12 +443,8 @@ static bool __virtnet_xdp_xmit(struct virtnet_info *vi,
         sg_init_one(sq->sg, xdp->data, xdp->data_end - xdp->data);
 
         err = virtqueue_add_outbuf(sq->vq, sq->sg, 1, xdp->data, GFP_ATOMIC);
-        if (unlikely(err)) {
-                struct page *page = virt_to_head_page(xdp->data);
-
-                put_page(page);
-                return false;
-        }
+        if (unlikely(err))
+                return false; /* Caller handle free/refcnt */
 
         return true;
 }
@@ -456,8 +452,18 @@ static bool __virtnet_xdp_xmit(struct virtnet_info *vi,
 static int virtnet_xdp_xmit(struct net_device *dev, struct xdp_buff *xdp)
 {
         struct virtnet_info *vi = netdev_priv(dev);
-        bool sent = __virtnet_xdp_xmit(vi, xdp);
+        struct receive_queue *rq = vi->rq;
+        struct bpf_prog *xdp_prog;
+        bool sent;
 
+        /* Only allow ndo_xdp_xmit if XDP is loaded on dev, as this
+         * indicate XDP resources have been successfully allocated.
+         */
+        xdp_prog = rcu_dereference(rq->xdp_prog);
+        if (!xdp_prog)
+                return -ENXIO;
+
+        sent = __virtnet_xdp_xmit(vi, xdp);
         if (!sent)
                 return -ENOSPC;
         return 0;
@@ -546,8 +552,11 @@ static struct sk_buff *receive_small(struct net_device *dev,
         unsigned int buflen = SKB_DATA_ALIGN(GOOD_PACKET_LEN + headroom) +
                               SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
         struct page *page = virt_to_head_page(buf);
-        unsigned int delta = 0, err;
+        unsigned int delta = 0;
         struct page *xdp_page;
+        bool sent;
+        int err;
+
         len -= vi->hdr_len;
 
         rcu_read_lock();
@@ -558,7 +567,7 @@ static struct sk_buff *receive_small(struct net_device *dev,
                 void *orig_data;
                 u32 act;
 
-                if (unlikely(hdr->hdr.gso_type || hdr->hdr.flags))
+                if (unlikely(hdr->hdr.gso_type))
                         goto err_xdp;
 
                 if (unlikely(xdp_headroom < virtnet_get_headroom(vi))) {
@@ -596,16 +605,19 @@ static struct sk_buff *receive_small(struct net_device *dev,
                         delta = orig_data - xdp.data;
                         break;
                 case XDP_TX:
-                        if (unlikely(!__virtnet_xdp_xmit(vi, &xdp)))
+                        sent = __virtnet_xdp_xmit(vi, &xdp);
+                        if (unlikely(!sent)) {
                                 trace_xdp_exception(vi->dev, xdp_prog, act);
-                        else
-                                *xdp_xmit = true;
+                                goto err_xdp;
+                        }
+                        *xdp_xmit = true;
                         rcu_read_unlock();
                         goto xdp_xmit;
                 case XDP_REDIRECT:
                         err = xdp_do_redirect(dev, &xdp, xdp_prog);
-                        if (!err)
-                                *xdp_xmit = true;
+                        if (err)
+                                goto err_xdp;
+                        *xdp_xmit = true;
                         rcu_read_unlock();
                         goto xdp_xmit;
                 default:
@@ -677,7 +689,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
         struct bpf_prog *xdp_prog;
         unsigned int truesize;
         unsigned int headroom = mergeable_ctx_to_headroom(ctx);
-        int err;
+        bool sent;
 
         head_skb = NULL;
 
@@ -746,20 +758,18 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                         }
                         break;
                 case XDP_TX:
-                        if (unlikely(!__virtnet_xdp_xmit(vi, &xdp)))
+                        sent = __virtnet_xdp_xmit(vi, &xdp);
+                        if (unlikely(!sent)) {
                                 trace_xdp_exception(vi->dev, xdp_prog, act);
-                        else
-                                *xdp_xmit = true;
+                                if (unlikely(xdp_page != page))
+                                        put_page(xdp_page);
+                                goto err_xdp;
+                        }
+                        *xdp_xmit = true;
                         if (unlikely(xdp_page != page))
                                 goto err_xdp;
                         rcu_read_unlock();
                         goto xdp_xmit;
-                case XDP_REDIRECT:
-                        err = xdp_do_redirect(dev, &xdp, xdp_prog);
-                        if (!err)
-                                *xdp_xmit = true;
-                        rcu_read_unlock();
-                        goto xdp_xmit;
                 default:
                         bpf_warn_invalid_xdp_action(act);
                 case XDP_ABORTED:
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 1cf22e62e3dd..6e0af815f25e 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -3516,7 +3516,7 @@ static int __init init_mac80211_hwsim(void)
 
         spin_lock_init(&hwsim_radio_lock);
 
-        hwsim_wq = alloc_workqueue("hwsim_wq",WQ_MEM_RECLAIM,0);
+        hwsim_wq = alloc_workqueue("hwsim_wq", 0, 0);
         if (!hwsim_wq)
                 return -ENOMEM;
         rhashtable_init(&hwsim_radios_rht, &hwsim_rht_params);
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index f431c32774f3..0fe7ea35c221 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -120,8 +120,12 @@ int nvme_reset_ctrl_sync(struct nvme_ctrl *ctrl)
         int ret;
 
         ret = nvme_reset_ctrl(ctrl);
-        if (!ret)
+        if (!ret) {
                 flush_work(&ctrl->reset_work);
+                if (ctrl->state != NVME_CTRL_LIVE)
+                        ret = -ENETRESET;
+        }
+
         return ret;
 }
 EXPORT_SYMBOL_GPL(nvme_reset_ctrl_sync);
@@ -265,7 +269,7 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
         switch (new_state) {
         case NVME_CTRL_ADMIN_ONLY:
                 switch (old_state) {
-                case NVME_CTRL_RECONNECTING:
+                case NVME_CTRL_CONNECTING:
                         changed = true;
                         /* FALLTHRU */
                 default:
@@ -276,7 +280,7 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
                 switch (old_state) {
                 case NVME_CTRL_NEW:
                 case NVME_CTRL_RESETTING:
-                case NVME_CTRL_RECONNECTING:
+                case NVME_CTRL_CONNECTING:
                         changed = true;
                         /* FALLTHRU */
                 default:
@@ -294,9 +298,9 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
                         break;
                 }
                 break;
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 switch (old_state) {
-                case NVME_CTRL_LIVE:
+                case NVME_CTRL_NEW:
                 case NVME_CTRL_RESETTING:
                         changed = true;
                         /* FALLTHRU */
@@ -309,7 +313,7 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
                 case NVME_CTRL_LIVE:
                 case NVME_CTRL_ADMIN_ONLY:
                 case NVME_CTRL_RESETTING:
-                case NVME_CTRL_RECONNECTING:
+                case NVME_CTRL_CONNECTING:
                         changed = true;
                         /* FALLTHRU */
                 default:
@@ -518,9 +522,11 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
                 u64 slba = nvme_block_nr(ns, bio->bi_iter.bi_sector);
                 u32 nlb = bio->bi_iter.bi_size >> ns->lba_shift;
 
-                range[n].cattr = cpu_to_le32(0);
-                range[n].nlb = cpu_to_le32(nlb);
-                range[n].slba = cpu_to_le64(slba);
+                if (n < segments) {
+                        range[n].cattr = cpu_to_le32(0);
+                        range[n].nlb = cpu_to_le32(nlb);
+                        range[n].slba = cpu_to_le64(slba);
+                }
                 n++;
         }
 
@@ -794,13 +800,9 @@ static void nvme_keep_alive_end_io(struct request *rq, blk_status_t status)
 
 static int nvme_keep_alive(struct nvme_ctrl *ctrl)
 {
-        struct nvme_command c;
         struct request *rq;
 
-        memset(&c, 0, sizeof(c));
-        c.common.opcode = nvme_admin_keep_alive;
-
-        rq = nvme_alloc_request(ctrl->admin_q, &c, BLK_MQ_REQ_RESERVED,
+        rq = nvme_alloc_request(ctrl->admin_q, &ctrl->ka_cmd, BLK_MQ_REQ_RESERVED,
                         NVME_QID_ANY);
         if (IS_ERR(rq))
                 return PTR_ERR(rq);
@@ -832,6 +834,8 @@ void nvme_start_keep_alive(struct nvme_ctrl *ctrl)
                 return;
 
         INIT_DELAYED_WORK(&ctrl->ka_work, nvme_keep_alive_work);
+        memset(&ctrl->ka_cmd, 0, sizeof(ctrl->ka_cmd));
+        ctrl->ka_cmd.common.opcode = nvme_admin_keep_alive;
         schedule_delayed_work(&ctrl->ka_work, ctrl->kato * HZ);
 }
 EXPORT_SYMBOL_GPL(nvme_start_keep_alive);
@@ -1117,14 +1121,19 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
 
 static void nvme_update_formats(struct nvme_ctrl *ctrl)
 {
-        struct nvme_ns *ns;
+        struct nvme_ns *ns, *next;
+        LIST_HEAD(rm_list);
 
         mutex_lock(&ctrl->namespaces_mutex);
         list_for_each_entry(ns, &ctrl->namespaces, list) {
-                if (ns->disk && nvme_revalidate_disk(ns->disk))
-                        nvme_ns_remove(ns);
+                if (ns->disk && nvme_revalidate_disk(ns->disk)) {
+                        list_move_tail(&ns->list, &rm_list);
+                }
         }
         mutex_unlock(&ctrl->namespaces_mutex);
+
+        list_for_each_entry_safe(ns, next, &rm_list, list)
+                nvme_ns_remove(ns);
 }
 
 static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
@@ -2687,7 +2696,7 @@ static ssize_t nvme_sysfs_show_state(struct device *dev,
                 [NVME_CTRL_LIVE]        = "live",
                 [NVME_CTRL_ADMIN_ONLY]  = "only-admin",
                 [NVME_CTRL_RESETTING]   = "resetting",
-                [NVME_CTRL_RECONNECTING]= "reconnecting",
+                [NVME_CTRL_CONNECTING]  = "connecting",
                 [NVME_CTRL_DELETING]    = "deleting",
                 [NVME_CTRL_DEAD]        = "dead",
         };
diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h
index 25b19f722f5b..a3145d90c1d2 100644
--- a/drivers/nvme/host/fabrics.h
+++ b/drivers/nvme/host/fabrics.h
@@ -171,13 +171,14 @@ static inline blk_status_t nvmf_check_init_req(struct nvme_ctrl *ctrl,
             cmd->common.opcode != nvme_fabrics_command ||
             cmd->fabrics.fctype != nvme_fabrics_type_connect) {
                 /*
-                 * Reconnecting state means transport disruption, which can take
-                 * a long time and even might fail permanently, fail fast to
-                 * give upper layers a chance to failover.
+                 * Connecting state means transport disruption or initial
+                 * establishment, which can take a long time and even might
+                 * fail permanently, fail fast to give upper layers a chance
+                 * to failover.
                  * Deleting state means that the ctrl will never accept commands
                  * again, fail it permanently.
                  */
-                if (ctrl->state == NVME_CTRL_RECONNECTING ||
+                if (ctrl->state == NVME_CTRL_CONNECTING ||
                     ctrl->state == NVME_CTRL_DELETING) {
                         nvme_req(rq)->status = NVME_SC_ABORT_REQ;
                         return BLK_STS_IOERR;
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index b856d7c919d2..7f51f8414b97 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -55,9 +55,7 @@ struct nvme_fc_queue {
 
 enum nvme_fcop_flags {
         FCOP_FLAGS_TERMIO       = (1 << 0),
-        FCOP_FLAGS_RELEASED     = (1 << 1),
-        FCOP_FLAGS_COMPLETE     = (1 << 2),
-        FCOP_FLAGS_AEN          = (1 << 3),
+        FCOP_FLAGS_AEN          = (1 << 1),
 };
 
 struct nvmefc_ls_req_op {
@@ -532,7 +530,7 @@ nvme_fc_resume_controller(struct nvme_fc_ctrl *ctrl)
 {
         switch (ctrl->ctrl.state) {
         case NVME_CTRL_NEW:
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 /*
                  * As all reconnects were suppressed, schedule a
                  * connect.
@@ -777,7 +775,7 @@ nvme_fc_ctrl_connectivity_loss(struct nvme_fc_ctrl *ctrl)
                 }
                 break;
 
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 /*
                  * The association has already been terminated and the
                  * controller is attempting reconnects.  No need to do anything
@@ -1470,7 +1468,6 @@ nvme_fc_xmt_disconnect_assoc(struct nvme_fc_ctrl *ctrl)
 
 /* *********************** NVME Ctrl Routines **************************** */
 
-static void __nvme_fc_final_op_cleanup(struct request *rq);
 static void nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg);
 
 static int
@@ -1512,13 +1509,19 @@ nvme_fc_exit_request(struct blk_mq_tag_set *set, struct request *rq,
 static int
 __nvme_fc_abort_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_fcp_op *op)
 {
-        int state;
+        unsigned long flags;
+        int opstate;
+
+        spin_lock_irqsave(&ctrl->lock, flags);
+        opstate = atomic_xchg(&op->state, FCPOP_STATE_ABORTED);
+        if (opstate != FCPOP_STATE_ACTIVE)
+                atomic_set(&op->state, opstate);
+        else if (ctrl->flags & FCCTRL_TERMIO)
+                ctrl->iocnt++;
+        spin_unlock_irqrestore(&ctrl->lock, flags);
 
-        state = atomic_xchg(&op->state, FCPOP_STATE_ABORTED);
-        if (state != FCPOP_STATE_ACTIVE) {
-                atomic_set(&op->state, state);
+        if (opstate != FCPOP_STATE_ACTIVE)
                 return -ECANCELED;
-        }
 
         ctrl->lport->ops->fcp_abort(&ctrl->lport->localport,
                                         &ctrl->rport->remoteport,
@@ -1532,60 +1535,26 @@ static void
 nvme_fc_abort_aen_ops(struct nvme_fc_ctrl *ctrl)
 {
         struct nvme_fc_fcp_op *aen_op = ctrl->aen_ops;
-        unsigned long flags;
-        int i, ret;
-
-        for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++) {
-                if (atomic_read(&aen_op->state) != FCPOP_STATE_ACTIVE)
-                        continue;
-
-                spin_lock_irqsave(&ctrl->lock, flags);
-                if (ctrl->flags & FCCTRL_TERMIO) {
-                        ctrl->iocnt++;
-                        aen_op->flags |= FCOP_FLAGS_TERMIO;
-                }
-                spin_unlock_irqrestore(&ctrl->lock, flags);
-
-                ret = __nvme_fc_abort_op(ctrl, aen_op);
-                if (ret) {
-                        /*
-                         * if __nvme_fc_abort_op failed the io wasn't
-                         * active. Thus this call path is running in
-                         * parallel to the io complete. Treat as non-error.
-                         */
+        int i;
 
-                        /* back out the flags/counters */
-                        spin_lock_irqsave(&ctrl->lock, flags);
-                        if (ctrl->flags & FCCTRL_TERMIO)
-                                ctrl->iocnt--;
-                        aen_op->flags &= ~FCOP_FLAGS_TERMIO;
-                        spin_unlock_irqrestore(&ctrl->lock, flags);
-                        return;
-                }
-        }
+        for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++)
+                __nvme_fc_abort_op(ctrl, aen_op);
 }
 
-static inline int
+static inline void
 __nvme_fc_fcpop_chk_teardowns(struct nvme_fc_ctrl *ctrl,
-                struct nvme_fc_fcp_op *op)
+                struct nvme_fc_fcp_op *op, int opstate)
 {
         unsigned long flags;
-        bool complete_rq = false;
 
-        spin_lock_irqsave(&ctrl->lock, flags);
-        if (unlikely(op->flags & FCOP_FLAGS_TERMIO)) {
+        if (opstate == FCPOP_STATE_ABORTED) {
+                spin_lock_irqsave(&ctrl->lock, flags);
                 if (ctrl->flags & FCCTRL_TERMIO) {
                         if (!--ctrl->iocnt)
                                 wake_up(&ctrl->ioabort_wait);
                 }
+                spin_unlock_irqrestore(&ctrl->lock, flags);
         }
-        if (op->flags & FCOP_FLAGS_RELEASED)
-                complete_rq = true;
-        else
-                op->flags |= FCOP_FLAGS_COMPLETE;
-        spin_unlock_irqrestore(&ctrl->lock, flags);
-
-        return complete_rq;
 }
 
 static void
@@ -1601,6 +1570,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
         __le16 status = cpu_to_le16(NVME_SC_SUCCESS << 1);
         union nvme_result result;
         bool terminate_assoc = true;
+        int opstate;
 
         /*
          * WARNING:
@@ -1639,11 +1609,12 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
          * association to be terminated.
          */
 
+        opstate = atomic_xchg(&op->state, FCPOP_STATE_COMPLETE);
+
         fc_dma_sync_single_for_cpu(ctrl->lport->dev, op->fcp_req.rspdma,
                                 sizeof(op->rsp_iu), DMA_FROM_DEVICE);
 
-        if (atomic_read(&op->state) == FCPOP_STATE_ABORTED ||
-                        op->flags & FCOP_FLAGS_TERMIO)
+        if (opstate == FCPOP_STATE_ABORTED)
                 status = cpu_to_le16(NVME_SC_ABORT_REQ << 1);
         else if (freq->status)
                 status = cpu_to_le16(NVME_SC_INTERNAL << 1);
@@ -1708,7 +1679,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
 done:
         if (op->flags & FCOP_FLAGS_AEN) {
                 nvme_complete_async_event(&queue->ctrl->ctrl, status, &result);
-                __nvme_fc_fcpop_chk_teardowns(ctrl, op);
+                __nvme_fc_fcpop_chk_teardowns(ctrl, op, opstate);
                 atomic_set(&op->state, FCPOP_STATE_IDLE);
                 op->flags = FCOP_FLAGS_AEN;     /* clear other flags */
                 nvme_fc_ctrl_put(ctrl);
@@ -1722,13 +1693,11 @@ done:
         if (status &&
             (blk_queue_dying(rq->q) ||
              ctrl->ctrl.state == NVME_CTRL_NEW ||
-             ctrl->ctrl.state == NVME_CTRL_RECONNECTING))
+             ctrl->ctrl.state == NVME_CTRL_CONNECTING))
                 status |= cpu_to_le16(NVME_SC_DNR << 1);
 
-        if (__nvme_fc_fcpop_chk_teardowns(ctrl, op))
-                __nvme_fc_final_op_cleanup(rq);
-        else
-                nvme_end_request(rq, status, result);
+        __nvme_fc_fcpop_chk_teardowns(ctrl, op, opstate);
+        nvme_end_request(rq, status, result);
 
 check_error:
         if (terminate_assoc)
@@ -2415,46 +2384,16 @@ nvme_fc_submit_async_event(struct nvme_ctrl *arg)
 }
 
 static void
-__nvme_fc_final_op_cleanup(struct request *rq)
+nvme_fc_complete_rq(struct request *rq)
 {
         struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(rq);
         struct nvme_fc_ctrl *ctrl = op->ctrl;
 
         atomic_set(&op->state, FCPOP_STATE_IDLE);
-        op->flags &= ~(FCOP_FLAGS_TERMIO | FCOP_FLAGS_RELEASED |
-                        FCOP_FLAGS_COMPLETE);
 
         nvme_fc_unmap_data(ctrl, rq, op);
         nvme_complete_rq(rq);
         nvme_fc_ctrl_put(ctrl);
-
-}
-
-static void
-nvme_fc_complete_rq(struct request *rq)
-{
-        struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(rq);
-        struct nvme_fc_ctrl *ctrl = op->ctrl;
-        unsigned long flags;
-        bool completed = false;
-
-        /*
-         * the core layer, on controller resets after calling
-         * nvme_shutdown_ctrl(), calls complete_rq without our
-         * calling blk_mq_complete_request(), thus there may still
-         * be live i/o outstanding with the LLDD. Means transport has
-         * to track complete calls vs fcpio_done calls to know what
-         * path to take on completes and dones.
-         */
-        spin_lock_irqsave(&ctrl->lock, flags);
-        if (op->flags & FCOP_FLAGS_COMPLETE)
-                completed = true;
-        else
-                op->flags |= FCOP_FLAGS_RELEASED;
-        spin_unlock_irqrestore(&ctrl->lock, flags);
-
-        if (completed)
-                __nvme_fc_final_op_cleanup(rq);
 }
 
 /*
@@ -2476,35 +2415,11 @@ nvme_fc_terminate_exchange(struct request *req, void *data, bool reserved)
         struct nvme_ctrl *nctrl = data;
         struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
         struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(req);
-        unsigned long flags;
-        int status;
 
         if (!blk_mq_request_started(req))
                 return;
 
-        spin_lock_irqsave(&ctrl->lock, flags);
-        if (ctrl->flags & FCCTRL_TERMIO) {
-                ctrl->iocnt++;
-                op->flags |= FCOP_FLAGS_TERMIO;
-        }
-        spin_unlock_irqrestore(&ctrl->lock, flags);
-
-        status = __nvme_fc_abort_op(ctrl, op);
-        if (status) {
-                /*
-                 * if __nvme_fc_abort_op failed the io wasn't
-                 * active. Thus this call path is running in
-                 * parallel to the io complete. Treat as non-error.
-                 */
-
-                /* back out the flags/counters */
-                spin_lock_irqsave(&ctrl->lock, flags);
-                if (ctrl->flags & FCCTRL_TERMIO)
-                        ctrl->iocnt--;
-                op->flags &= ~FCOP_FLAGS_TERMIO;
-                spin_unlock_irqrestore(&ctrl->lock, flags);
-                return;
-        }
+        __nvme_fc_abort_op(ctrl, op);
 }
 
 
@@ -2943,7 +2858,7 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
         unsigned long recon_delay = ctrl->ctrl.opts->reconnect_delay * HZ;
         bool recon = true;
 
-        if (ctrl->ctrl.state != NVME_CTRL_RECONNECTING)
+        if (ctrl->ctrl.state != NVME_CTRL_CONNECTING)
                 return;
 
         if (portptr->port_state == FC_OBJSTATE_ONLINE)
@@ -2991,10 +2906,10 @@ nvme_fc_reset_ctrl_work(struct work_struct *work)
         /* will block will waiting for io to terminate */
         nvme_fc_delete_association(ctrl);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
                 dev_err(ctrl->ctrl.device,
                         "NVME-FC{%d}: error_recovery: Couldn't change state "
-                        "to RECONNECTING\n", ctrl->cnum);
+                        "to CONNECTING\n", ctrl->cnum);
                 return;
         }
 
@@ -3195,7 +3110,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
          * transport errors (frame drop, LS failure) inherently must kill
          * the association. The transport is coded so that any command used
          * to create the association (prior to a LIVE state transition
-         * while NEW or RECONNECTING) will fail if it completes in error or
+         * while NEW or CONNECTING) will fail if it completes in error or
          * times out.
          *
          * As such: as the connect request was mostly likely due to a
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 8e4550fa08f8..0521e4707d1c 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -123,7 +123,7 @@ enum nvme_ctrl_state {
         NVME_CTRL_LIVE,
         NVME_CTRL_ADMIN_ONLY,    /* Only admin queue live */
         NVME_CTRL_RESETTING,
-        NVME_CTRL_RECONNECTING,
+        NVME_CTRL_CONNECTING,
         NVME_CTRL_DELETING,
         NVME_CTRL_DEAD,
 };
@@ -183,6 +183,7 @@ struct nvme_ctrl {
         struct work_struct scan_work;
         struct work_struct async_event_work;
         struct delayed_work ka_work;
+        struct nvme_command ka_cmd;
         struct work_struct fw_act_work;
 
         /* Power saving configuration */
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 6fe7af00a1f4..73036d2fbbd5 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1141,7 +1141,7 @@ static bool nvme_should_reset(struct nvme_dev *dev, u32 csts)
         /* If there is a reset/reinit ongoing, we shouldn't reset again. */
         switch (dev->ctrl.state) {
         case NVME_CTRL_RESETTING:
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 return false;
         default:
                 break;
@@ -1215,13 +1215,17 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
          * cancellation error. All outstanding requests are completed on
          * shutdown, so we return BLK_EH_HANDLED.
          */
-        if (dev->ctrl.state == NVME_CTRL_RESETTING) {
+        switch (dev->ctrl.state) {
+        case NVME_CTRL_CONNECTING:
+        case NVME_CTRL_RESETTING:
                 dev_warn(dev->ctrl.device,
                          "I/O %d QID %d timeout, disable controller\n",
                          req->tag, nvmeq->qid);
                 nvme_dev_disable(dev, false);
                 nvme_req(req)->flags |= NVME_REQ_CANCELLED;
                 return BLK_EH_HANDLED;
+        default:
+                break;
         }
 
         /*
@@ -1364,18 +1368,14 @@ static int nvme_cmb_qdepth(struct nvme_dev *dev, int nr_io_queues,
 static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq,
                                 int qid, int depth)
 {
-        if (qid && dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS)) {
-                unsigned offset = (qid - 1) * roundup(SQ_SIZE(depth),
-                                                      dev->ctrl.page_size);
-                nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset;
-                nvmeq->sq_cmds_io = dev->cmb + offset;
-        } else {
-                nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
-                                        &nvmeq->sq_dma_addr, GFP_KERNEL);
-                if (!nvmeq->sq_cmds)
-                        return -ENOMEM;
-        }
+        /* CMB SQEs will be mapped before creation */
+        if (qid && dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS))
+                return 0;
 
+        nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
+                                            &nvmeq->sq_dma_addr, GFP_KERNEL);
+        if (!nvmeq->sq_cmds)
+                return -ENOMEM;
         return 0;
 }
 
@@ -1449,6 +1449,13 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
         struct nvme_dev *dev = nvmeq->dev;
         int result;
 
+        if (dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS)) {
+                unsigned offset = (qid - 1) * roundup(SQ_SIZE(nvmeq->q_depth),
+                                                      dev->ctrl.page_size);
+                nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset;
+                nvmeq->sq_cmds_io = dev->cmb + offset;
+        }
+
         nvmeq->cq_vector = qid - 1;
         result = adapter_alloc_cq(dev, qid, nvmeq);
         if (result < 0)
@@ -2288,12 +2295,12 @@ static void nvme_reset_work(struct work_struct *work)
                 nvme_dev_disable(dev, false);
 
         /*
-         * Introduce RECONNECTING state from nvme-fc/rdma transports to mark the
+         * Introduce CONNECTING state from nvme-fc/rdma transports to mark the
          * initializing procedure here.
          */
-        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_CONNECTING)) {
                 dev_warn(dev->ctrl.device,
-                        "failed to mark controller RECONNECTING\n");
+                        "failed to mark controller CONNECTING\n");
                 goto out;
         }
 
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 2bc059f7d73c..3a51ed50eff2 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -887,7 +887,7 @@ free_ctrl:
 static void nvme_rdma_reconnect_or_remove(struct nvme_rdma_ctrl *ctrl)
 {
         /* If we are resetting/deleting then do nothing */
-        if (ctrl->ctrl.state != NVME_CTRL_RECONNECTING) {
+        if (ctrl->ctrl.state != NVME_CTRL_CONNECTING) {
                 WARN_ON_ONCE(ctrl->ctrl.state == NVME_CTRL_NEW ||
                         ctrl->ctrl.state == NVME_CTRL_LIVE);
                 return;
@@ -973,7 +973,7 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
         blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
         nvme_start_queues(&ctrl->ctrl);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
                 /* state change failure should never happen */
                 WARN_ON_ONCE(1);
                 return;
@@ -1756,7 +1756,7 @@ static void nvme_rdma_reset_ctrl_work(struct work_struct *work)
         nvme_stop_ctrl(&ctrl->ctrl);
         nvme_rdma_shutdown_ctrl(ctrl, false);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
                 /* state change failure should never happen */
                 WARN_ON_ONCE(1);
                 return;
@@ -1784,11 +1784,8 @@ static void nvme_rdma_reset_ctrl_work(struct work_struct *work)
         return;
 
 out_fail:
-        dev_warn(ctrl->ctrl.device, "Removing after reset failure\n");
-        nvme_remove_namespaces(&ctrl->ctrl);
-        nvme_rdma_shutdown_ctrl(ctrl, true);
-        nvme_uninit_ctrl(&ctrl->ctrl);
-        nvme_put_ctrl(&ctrl->ctrl);
+        ++ctrl->ctrl.nr_reconnects;
+        nvme_rdma_reconnect_or_remove(ctrl);
 }
 
 static const struct nvme_ctrl_ops nvme_rdma_ctrl_ops = {
@@ -1942,6 +1939,9 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
         if (!ctrl->queues)
                 goto out_uninit_ctrl;
 
+        changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING);
+        WARN_ON_ONCE(!changed);
+
         ret = nvme_rdma_configure_admin_queue(ctrl, true);
         if (ret)
                 goto out_kfree_queues;
diff --git a/drivers/nvme/target/io-cmd.c b/drivers/nvme/target/io-cmd.c
index 0a4372a016f2..28bbdff4a88b 100644
--- a/drivers/nvme/target/io-cmd.c
+++ b/drivers/nvme/target/io-cmd.c
@@ -105,10 +105,13 @@ static void nvmet_execute_flush(struct nvmet_req *req)
 static u16 nvmet_discard_range(struct nvmet_ns *ns,
                 struct nvme_dsm_range *range, struct bio **bio)
 {
-        if (__blkdev_issue_discard(ns->bdev,
+        int ret;
+
+        ret = __blkdev_issue_discard(ns->bdev,
                         le64_to_cpu(range->slba) << (ns->blksize_shift - 9),
                         le32_to_cpu(range->nlb) << (ns->blksize_shift - 9),
-                        GFP_KERNEL, 0, bio))
+                        GFP_KERNEL, 0, bio);
+        if (ret && ret != -EOPNOTSUPP)
                 return NVME_SC_INTERNAL | NVME_SC_DNR;
         return 0;
 }
diff --git a/drivers/of/property.c b/drivers/of/property.c
index 36ed84e26d9c..f46828e3b082 100644
--- a/drivers/of/property.c
+++ b/drivers/of/property.c
@@ -977,11 +977,11 @@ static int of_fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,
         return 0;
 }
 
-static void *
+static const void *
 of_fwnode_device_get_match_data(const struct fwnode_handle *fwnode,
                                 const struct device *dev)
 {
-        return (void *)of_device_get_match_data(dev);
+        return of_device_get_match_data(dev);
 }
 
 const struct fwnode_operations of_fwnode_ops = {
diff --git a/drivers/opp/cpu.c b/drivers/opp/cpu.c
index 2d87bc1adf38..0c0910709435 100644
--- a/drivers/opp/cpu.c
+++ b/drivers/opp/cpu.c
@@ -55,7 +55,7 @@ int dev_pm_opp_init_cpufreq_table(struct device *dev,
         if (max_opps <= 0)
                 return max_opps ? max_opps : -ENODATA;
 
-        freq_table = kcalloc((max_opps + 1), sizeof(*freq_table), GFP_ATOMIC);
+        freq_table = kcalloc((max_opps + 1), sizeof(*freq_table), GFP_KERNEL);
         if (!freq_table)
                 return -ENOMEM;
 
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index fc734014206f..8b14bd326d4a 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3419,22 +3419,29 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PORT_RIDGE,
 
 static void quirk_chelsio_extend_vpd(struct pci_dev *dev)
 {
-        pci_set_vpd_size(dev, 8192);
-}
-
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x20, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x21, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x22, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x23, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x24, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x25, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x26, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x30, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x31, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x32, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x35, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x36, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x37, quirk_chelsio_extend_vpd);
+        int chip = (dev->device & 0xf000) >> 12;
+        int func = (dev->device & 0x0f00) >>  8;
+        int prod = (dev->device & 0x00ff) >>  0;
+
+        /*
+         * If this is a T3-based adapter, there's a 1KB VPD area at offset
+         * 0xc00 which contains the preferred VPD values.  If this is a T4 or
+         * later based adapter, the special VPD is at offset 0x400 for the
+         * Physical Functions (the SR-IOV Virtual Functions have no VPD
+         * Capabilities).  The PCI VPD Access core routines will normally
+         * compute the size of the VPD by parsing the VPD Data Structure at
+         * offset 0x000.  This will result in silent failures when attempting
+         * to accesses these other VPD areas which are beyond those computed
+         * limits.
+         */
+        if (chip == 0x0 && prod >= 0x20)
+                pci_set_vpd_size(dev, 8192);
+        else if (chip >= 0x4 && func < 0x8)
+                pci_set_vpd_size(dev, 2048);
+}
+
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, PCI_ANY_ID,
+                        quirk_chelsio_extend_vpd);
 
 #ifdef CONFIG_ACPI
 /*
diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
index 7bc5eee96b31..0c2ed11c0603 100644
--- a/drivers/perf/arm_pmu.c
+++ b/drivers/perf/arm_pmu.c
@@ -17,7 +17,6 @@
 #include <linux/export.h>
 #include <linux/kernel.h>
 #include <linux/perf/arm_pmu.h>
-#include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/sched/clock.h>
 #include <linux/spinlock.h>
@@ -26,6 +25,9 @@
 
 #include <asm/irq_regs.h>
 
+static DEFINE_PER_CPU(struct arm_pmu *, cpu_armpmu);
+static DEFINE_PER_CPU(int, cpu_irq);
+
 static int
 armpmu_map_cache_event(const unsigned (*cache_map)
                                       [PERF_COUNT_HW_CACHE_MAX]
@@ -320,17 +322,9 @@ validate_group(struct perf_event *event)
         return 0;
 }
 
-static struct arm_pmu_platdata *armpmu_get_platdata(struct arm_pmu *armpmu)
-{
-        struct platform_device *pdev = armpmu->plat_device;
-
-        return pdev ? dev_get_platdata(&pdev->dev) : NULL;
-}
-
 static irqreturn_t armpmu_dispatch_irq(int irq, void *dev)
 {
         struct arm_pmu *armpmu;
-        struct arm_pmu_platdata *plat;
         int ret;
         u64 start_clock, finish_clock;
 
@@ -341,14 +335,11 @@ static irqreturn_t armpmu_dispatch_irq(int irq, void *dev)
          * dereference.
          */
         armpmu = *(void **)dev;
-
-        plat = armpmu_get_platdata(armpmu);
+        if (WARN_ON_ONCE(!armpmu))
+                return IRQ_NONE;
 
         start_clock = sched_clock();
-        if (plat && plat->handle_irq)
-                ret = plat->handle_irq(irq, armpmu, armpmu->handle_irq);
-        else
-                ret = armpmu->handle_irq(irq, armpmu);
+        ret = armpmu->handle_irq(irq, armpmu);
         finish_clock = sched_clock();
 
         perf_sample_event_took(finish_clock - start_clock);
@@ -531,54 +522,41 @@ int perf_num_counters(void)
 }
 EXPORT_SYMBOL_GPL(perf_num_counters);
 
-void armpmu_free_irq(struct arm_pmu *armpmu, int cpu)
+static int armpmu_count_irq_users(const int irq)
 {
-        struct pmu_hw_events __percpu *hw_events = armpmu->hw_events;
-        int irq = per_cpu(hw_events->irq, cpu);
+        int cpu, count = 0;
 
-        if (!cpumask_test_and_clear_cpu(cpu, &armpmu->active_irqs))
-                return;
-
-        if (irq_is_percpu_devid(irq)) {
-                free_percpu_irq(irq, &hw_events->percpu_pmu);
-                cpumask_clear(&armpmu->active_irqs);
-                return;
+        for_each_possible_cpu(cpu) {
+                if (per_cpu(cpu_irq, cpu) == irq)
+                        count++;
         }
 
-        free_irq(irq, per_cpu_ptr(&hw_events->percpu_pmu, cpu));
+        return count;
 }
 
-void armpmu_free_irqs(struct arm_pmu *armpmu)
+void armpmu_free_irq(int irq, int cpu)
 {
-        int cpu;
+        if (per_cpu(cpu_irq, cpu) == 0)
+                return;
+        if (WARN_ON(irq != per_cpu(cpu_irq, cpu)))
+                return;
+
+        if (!irq_is_percpu_devid(irq))
+                free_irq(irq, per_cpu_ptr(&cpu_armpmu, cpu));
+        else if (armpmu_count_irq_users(irq) == 1)
+                free_percpu_irq(irq, &cpu_armpmu);
 
-        for_each_cpu(cpu, &armpmu->supported_cpus)
-                armpmu_free_irq(armpmu, cpu);
+        per_cpu(cpu_irq, cpu) = 0;
 }
 
-int armpmu_request_irq(struct arm_pmu *armpmu, int cpu)
+int armpmu_request_irq(int irq, int cpu)
 {
         int err = 0;
-        struct pmu_hw_events __percpu *hw_events = armpmu->hw_events;
         const irq_handler_t handler = armpmu_dispatch_irq;
-        int irq = per_cpu(hw_events->irq, cpu);
         if (!irq)
                 return 0;
 
-        if (irq_is_percpu_devid(irq) && cpumask_empty(&armpmu->active_irqs)) {
-                err = request_percpu_irq(irq, handler, "arm-pmu",
-                                         &hw_events->percpu_pmu);
-        } else if (irq_is_percpu_devid(irq)) {
-                int other_cpu = cpumask_first(&armpmu->active_irqs);
-                int other_irq = per_cpu(hw_events->irq, other_cpu);
-
-                if (irq != other_irq) {
-                        pr_warn("mismatched PPIs detected.\n");
-                        err = -EINVAL;
-                        goto err_out;
-                }
-        } else {
-                struct arm_pmu_platdata *platdata = armpmu_get_platdata(armpmu);
+        if (!irq_is_percpu_devid(irq)) {
                 unsigned long irq_flags;
 
                 err = irq_force_affinity(irq, cpumask_of(cpu));
@@ -589,22 +567,22 @@ int armpmu_request_irq(struct arm_pmu *armpmu, int cpu)
                         goto err_out;
                 }
 
-                if (platdata && platdata->irq_flags) {
-                        irq_flags = platdata->irq_flags;
-                } else {
-                        irq_flags = IRQF_PERCPU |
-                                    IRQF_NOBALANCING |
-                                    IRQF_NO_THREAD;
-                }
+                irq_flags = IRQF_PERCPU |
+                            IRQF_NOBALANCING |
+                            IRQF_NO_THREAD;
 
+                irq_set_status_flags(irq, IRQ_NOAUTOEN);
                 err = request_irq(irq, handler, irq_flags, "arm-pmu",
-                                  per_cpu_ptr(&hw_events->percpu_pmu, cpu));
+                                  per_cpu_ptr(&cpu_armpmu, cpu));
+        } else if (armpmu_count_irq_users(irq) == 0) {
+                err = request_percpu_irq(irq, handler, "arm-pmu",
+                                         &cpu_armpmu);
         }
 
         if (err)
                 goto err_out;
 
-        cpumask_set_cpu(cpu, &armpmu->active_irqs);
+        per_cpu(cpu_irq, cpu) = irq;
         return 0;
 
 err_out:
@@ -612,19 +590,6 @@ err_out:
         return err;
 }
 
-int armpmu_request_irqs(struct arm_pmu *armpmu)
-{
-        int cpu, err;
-
-        for_each_cpu(cpu, &armpmu->supported_cpus) {
-                err = armpmu_request_irq(armpmu, cpu);
-                if (err)
-                        break;
-        }
-
-        return err;
-}
-
 static int armpmu_get_cpu_irq(struct arm_pmu *pmu, int cpu)
 {
         struct pmu_hw_events __percpu *hw_events = pmu->hw_events;
@@ -647,12 +612,14 @@ static int arm_perf_starting_cpu(unsigned int cpu, struct hlist_node *node)
         if (pmu->reset)
                 pmu->reset(pmu);
 
+        per_cpu(cpu_armpmu, cpu) = pmu;
+
         irq = armpmu_get_cpu_irq(pmu, cpu);
         if (irq) {
-                if (irq_is_percpu_devid(irq)) {
+                if (irq_is_percpu_devid(irq))
                         enable_percpu_irq(irq, IRQ_TYPE_NONE);
-                        return 0;
-                }
+                else
+                        enable_irq(irq);
         }
 
         return 0;
@@ -667,8 +634,14 @@ static int arm_perf_teardown_cpu(unsigned int cpu, struct hlist_node *node)
                 return 0;
 
         irq = armpmu_get_cpu_irq(pmu, cpu);
-        if (irq && irq_is_percpu_devid(irq))
-                disable_percpu_irq(irq);
+        if (irq) {
+                if (irq_is_percpu_devid(irq))
+                        disable_percpu_irq(irq);
+                else
+                        disable_irq(irq);
+        }
+
+        per_cpu(cpu_armpmu, cpu) = NULL;
 
         return 0;
 }
@@ -800,18 +773,18 @@ static void cpu_pmu_destroy(struct arm_pmu *cpu_pmu)
                                             &cpu_pmu->node);
 }
 
-struct arm_pmu *armpmu_alloc(void)
+static struct arm_pmu *__armpmu_alloc(gfp_t flags)
 {
         struct arm_pmu *pmu;
         int cpu;
 
-        pmu = kzalloc(sizeof(*pmu), GFP_KERNEL);
+        pmu = kzalloc(sizeof(*pmu), flags);
         if (!pmu) {
                 pr_info("failed to allocate PMU device!\n");
                 goto out;
         }
 
-        pmu->hw_events = alloc_percpu(struct pmu_hw_events);
+        pmu->hw_events = alloc_percpu_gfp(struct pmu_hw_events, flags);
         if (!pmu->hw_events) {
                 pr_info("failed to allocate per-cpu PMU data.\n");
                 goto out_free_pmu;
@@ -857,6 +830,17 @@ out:
         return NULL;
 }
 
+struct arm_pmu *armpmu_alloc(void)
+{
+        return __armpmu_alloc(GFP_KERNEL);
+}
+
+struct arm_pmu *armpmu_alloc_atomic(void)
+{
+        return __armpmu_alloc(GFP_ATOMIC);
+}
+
+
 void armpmu_free(struct arm_pmu *pmu)
 {
         free_percpu(pmu->hw_events);
diff --git a/drivers/perf/arm_pmu_acpi.c b/drivers/perf/arm_pmu_acpi.c
index 705f1a390e31..0f197516d708 100644
--- a/drivers/perf/arm_pmu_acpi.c
+++ b/drivers/perf/arm_pmu_acpi.c
@@ -11,6 +11,8 @@
 #include <linux/acpi.h>
 #include <linux/cpumask.h>
 #include <linux/init.h>
+#include <linux/irq.h>
+#include <linux/irqdesc.h>
 #include <linux/percpu.h>
 #include <linux/perf/arm_pmu.h>
 
@@ -87,7 +89,13 @@ static int arm_pmu_acpi_parse_irqs(void)
                         pr_warn("No ACPI PMU IRQ for CPU%d\n", cpu);
                 }
 
+                /*
+                 * Log and request the IRQ so the core arm_pmu code can manage
+                 * it. We'll have to sanity-check IRQs later when we associate
+                 * them with their PMUs.
+                 */
                 per_cpu(pmu_irqs, cpu) = irq;
+                armpmu_request_irq(irq, cpu);
         }
 
         return 0;
@@ -127,7 +135,7 @@ static struct arm_pmu *arm_pmu_acpi_find_alloc_pmu(void)
                 return pmu;
         }
 
-        pmu = armpmu_alloc();
+        pmu = armpmu_alloc_atomic();
         if (!pmu) {
                 pr_warn("Unable to allocate PMU for CPU%d\n",
                         smp_processor_id());
@@ -140,6 +148,35 @@ static struct arm_pmu *arm_pmu_acpi_find_alloc_pmu(void)
 }
 
 /*
+ * Check whether the new IRQ is compatible with those already associated with
+ * the PMU (e.g. we don't have mismatched PPIs).
+ */
+static bool pmu_irq_matches(struct arm_pmu *pmu, int irq)
+{
+        struct pmu_hw_events __percpu *hw_events = pmu->hw_events;
+        int cpu;
+
+        if (!irq)
+                return true;
+
+        for_each_cpu(cpu, &pmu->supported_cpus) {
+                int other_irq = per_cpu(hw_events->irq, cpu);
+                if (!other_irq)
+                        continue;
+
+                if (irq == other_irq)
+                        continue;
+                if (!irq_is_percpu_devid(irq) && !irq_is_percpu_devid(other_irq))
+                        continue;
+
+                pr_warn("mismatched PPIs detected\n");
+                return false;
+        }
+
+        return true;
+}
+
+/*
  * This must run before the common arm_pmu hotplug logic, so that we can
  * associate a CPU and its interrupt before the common code tries to manage the
  * affinity and so on.
@@ -164,19 +201,14 @@ static int arm_pmu_acpi_cpu_starting(unsigned int cpu)
         if (!pmu)
                 return -ENOMEM;
 
-        cpumask_set_cpu(cpu, &pmu->supported_cpus);
-
         per_cpu(probed_pmus, cpu) = pmu;
 
-        /*
-         * Log and request the IRQ so the core arm_pmu code can manage it.  In
-         * some situations (e.g. mismatched PPIs), we may fail to request the
-         * IRQ. However, it may be too late for us to do anything about it.
-         * The common ARM PMU code will log a warning in this case.
-         */
-        hw_events = pmu->hw_events;
-        per_cpu(hw_events->irq, cpu) = irq;
-        armpmu_request_irq(pmu, cpu);
+        if (pmu_irq_matches(pmu, irq)) {
+                hw_events = pmu->hw_events;
+                per_cpu(hw_events->irq, cpu) = irq;
+        }
+
+        cpumask_set_cpu(cpu, &pmu->supported_cpus);
 
         /*
          * Ideally, we'd probe the PMU here when we find the first matching
@@ -247,11 +279,6 @@ static int arm_pmu_acpi_init(void)
         if (acpi_disabled)
                 return 0;
 
-        /*
-         * We can't request IRQs yet, since we don't know the cookie value
-         * until we know which CPUs share the same logical PMU. We'll handle
-         * that in arm_pmu_acpi_cpu_starting().
-         */
         ret = arm_pmu_acpi_parse_irqs();
         if (ret)
                 return ret;
diff --git a/drivers/perf/arm_pmu_platform.c b/drivers/perf/arm_pmu_platform.c
index 46501cc79fd7..7729eda5909d 100644
--- a/drivers/perf/arm_pmu_platform.c
+++ b/drivers/perf/arm_pmu_platform.c
@@ -127,13 +127,6 @@ static int pmu_parse_irqs(struct arm_pmu *pmu)
                         pdev->dev.of_node);
         }
 
-        /*
-         * Some platforms have all PMU IRQs OR'd into a single IRQ, with a
-         * special platdata function that attempts to demux them.
-         */
-        if (dev_get_platdata(&pdev->dev))
-                cpumask_setall(&pmu->supported_cpus);
-
         for (i = 0; i < num_irqs; i++) {
                 int cpu, irq;
 
@@ -164,6 +157,36 @@ static int pmu_parse_irqs(struct arm_pmu *pmu)
         return 0;
 }
 
+static int armpmu_request_irqs(struct arm_pmu *armpmu)
+{
+        struct pmu_hw_events __percpu *hw_events = armpmu->hw_events;
+        int cpu, err;
+
+        for_each_cpu(cpu, &armpmu->supported_cpus) {
+                int irq = per_cpu(hw_events->irq, cpu);
+                if (!irq)
+                        continue;
+
+                err = armpmu_request_irq(irq, cpu);
+                if (err)
+                        break;
+        }
+
+        return err;
+}
+
+static void armpmu_free_irqs(struct arm_pmu *armpmu)
+{
+        int cpu;
+        struct pmu_hw_events __percpu *hw_events = armpmu->hw_events;
+
+        for_each_cpu(cpu, &armpmu->supported_cpus) {
+                int irq = per_cpu(hw_events->irq, cpu);
+
+                armpmu_free_irq(irq, cpu);
+        }
+}
+
 int arm_pmu_device_probe(struct platform_device *pdev,
                          const struct of_device_id *of_table,
                          const struct pmu_probe_info *probe_table)
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index 2a68f59d2228..c52c6723374b 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -127,24 +127,6 @@ static const struct dmi_system_id dell_device_table[] __initconst = {
                 },
         },
         {
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_CHASSIS_TYPE, "30"), /*Tablet*/
-                },
-        },
-        {
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /*Convertible*/
-                },
-        },
-        {
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_CHASSIS_TYPE, "32"), /*Detachable*/
-                },
-        },
-        {
                 .ident = "Dell Computer Corporation",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
@@ -1279,7 +1261,7 @@ static int kbd_get_state(struct kbd_state *state)
         struct calling_interface_buffer buffer;
         int ret;
 
-        dell_fill_request(&buffer, 0, 0, 0, 0);
+        dell_fill_request(&buffer, 0x1, 0, 0, 0);
         ret = dell_send_request(&buffer,
                                 CLASS_KBD_BACKLIGHT, SELECT_KBD_BACKLIGHT);
         if (ret)
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 5b6f18b18801..535199c9e6bc 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -113,7 +113,7 @@ MODULE_PARM_DESC(no_bt_rfkill, "No rfkill for bluetooth.");
 /*
  * ACPI Helpers
  */
-#define IDEAPAD_EC_TIMEOUT (100) /* in ms */
+#define IDEAPAD_EC_TIMEOUT (200) /* in ms */
 
 static int read_method_int(acpi_handle handle, const char *method, int *val)
 {
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index daa68acbc900..c0c8945603cb 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -933,7 +933,7 @@ static int wmi_dev_probe(struct device *dev)
                         goto probe_failure;
                 }
 
-                buf = kmalloc(strlen(wdriver->driver.name) + 4, GFP_KERNEL);
+                buf = kmalloc(strlen(wdriver->driver.name) + 5, GFP_KERNEL);
                 if (!buf) {
                         ret = -ENOMEM;
                         goto probe_string_failure;
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index ba2e0856d22c..8f5c1d7f751a 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -1297,6 +1297,9 @@ static int virtio_ccw_cio_notify(struct ccw_device *cdev, int event)
                 vcdev->device_lost = true;
                 rc = NOTIFY_DONE;
                 break;
+        case CIO_OPER:
+                rc = NOTIFY_OK;
+                break;
         default:
                 rc = NOTIFY_DONE;
                 break;
@@ -1309,6 +1312,27 @@ static struct ccw_device_id virtio_ids[] = {
         {},
 };
 
+#ifdef CONFIG_PM_SLEEP
+static int virtio_ccw_freeze(struct ccw_device *cdev)
+{
+        struct virtio_ccw_device *vcdev = dev_get_drvdata(&cdev->dev);
+
+        return virtio_device_freeze(&vcdev->vdev);
+}
+
+static int virtio_ccw_restore(struct ccw_device *cdev)
+{
+        struct virtio_ccw_device *vcdev = dev_get_drvdata(&cdev->dev);
+        int ret;
+
+        ret = virtio_ccw_set_transport_rev(vcdev);
+        if (ret)
+                return ret;
+
+        return virtio_device_restore(&vcdev->vdev);
+}
+#endif
+
 static struct ccw_driver virtio_ccw_driver = {
         .driver = {
                 .owner = THIS_MODULE,
@@ -1321,6 +1345,11 @@ static struct ccw_driver virtio_ccw_driver = {
         .set_online = virtio_ccw_online,
         .notify = virtio_ccw_cio_notify,
         .int_class = IRQIO_VIR,
+#ifdef CONFIG_PM_SLEEP
+        .freeze = virtio_ccw_freeze,
+        .thaw = virtio_ccw_restore,
+        .restore = virtio_ccw_restore,
+#endif
 };
 
 static int __init pure_hex(char **cp, unsigned int *val, int min_digit,
diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
index fcfd28d2884c..de1b3fce936d 100644
--- a/drivers/scsi/Makefile
+++ b/drivers/scsi/Makefile
@@ -185,7 +185,6 @@ ncr53c8xx-flags-$(CONFIG_SCSI_ZALON) \
 CFLAGS_ncr53c8xx.o      := $(ncr53c8xx-flags-y) $(ncr53c8xx-flags-m)
 zalon7xx-objs   := zalon.o ncr53c8xx.o
 NCR_Q720_mod-objs       := NCR_Q720.o ncr53c8xx.o
-oktagon_esp_mod-objs    := oktagon_esp.o oktagon_io.o
 
 # Files generated that shall be removed upon make clean
 clean-files :=  53c700_d.h 53c700_u.h
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index b3b931ab77eb..2664ea0df35f 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1693,8 +1693,10 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
          *      Map in the registers from the adapter.
          */
         aac->base_size = AAC_MIN_FOOTPRINT_SIZE;
-        if ((*aac_drivers[index].init)(aac))
+        if ((*aac_drivers[index].init)(aac)) {
+                error = -ENODEV;
                 goto out_unmap;
+        }
 
         if (aac->sync_mode) {
                 if (aac_sync_mode)
diff --git a/drivers/scsi/aic7xxx/aiclib.c b/drivers/scsi/aic7xxx/aiclib.c
deleted file mode 100644
index 828ae3d9a510..000000000000
--- a/drivers/scsi/aic7xxx/aiclib.c
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Implementation of Utility functions for all SCSI device types.
- *
- * Copyright (c) 1997, 1998, 1999 Justin T. Gibbs.
- * Copyright (c) 1997, 1998 Kenneth D. Merry.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions, and the following disclaimer,
- *    without modification, immediately at the beginning of the file.
- * 2. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
- * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * $FreeBSD: src/sys/cam/scsi/scsi_all.c,v 1.38 2002/09/23 04:56:35 mjacob Exp $
- * $Id$
- */
-
-#include "aiclib.h"
-
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index 8e2f767147cb..5a645b8b9af1 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -1889,6 +1889,7 @@ void bnx2fc_process_scsi_cmd_compl(struct bnx2fc_cmd *io_req,
                 /* we will not receive ABTS response for this IO */
                 BNX2FC_IO_DBG(io_req, "Timer context finished processing "
                            "this scsi cmd\n");
+                return;
         }
 
         /* Cancel the timeout_work, as we received IO completion */
diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c
index be5ee2d37815..7dbbbb81a1e7 100644
--- a/drivers/scsi/csiostor/csio_lnode.c
+++ b/drivers/scsi/csiostor/csio_lnode.c
@@ -114,7 +114,7 @@ static enum csio_ln_ev fwevt_to_lnevt[] = {
 static struct csio_lnode *
 csio_ln_lookup_by_portid(struct csio_hw *hw, uint8_t portid)
 {
-        struct csio_lnode *ln = hw->rln;
+        struct csio_lnode *ln;
         struct list_head *tmp;
 
         /* Match siblings lnode with portid */
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index 022e421c2185..4b44325d1a82 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -876,6 +876,11 @@ static void alua_rtpg_work(struct work_struct *work)
 
 /**
  * alua_rtpg_queue() - cause RTPG to be submitted asynchronously
+ * @pg: ALUA port group associated with @sdev.
+ * @sdev: SCSI device for which to submit an RTPG.
+ * @qdata: Information about the callback to invoke after the RTPG.
+ * @force: Whether or not to submit an RTPG if a work item that will submit an
+ *         RTPG already has been scheduled.
  *
  * Returns true if and only if alua_rtpg_work() will be called asynchronously.
  * That function is responsible for calling @qdata->fn().
diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h
index 9a0696f68f37..b81a53c4a9a8 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.h
+++ b/drivers/scsi/ibmvscsi/ibmvfc.h
@@ -367,7 +367,7 @@ enum ibmvfc_fcp_rsp_info_codes {
 };
 
 struct ibmvfc_fcp_rsp_info {
-        __be16 reserved;
+        u8 reserved[3];
         u8 rsp_code;
         u8 reserved2[4];
 }__attribute__((packed, aligned (2)));
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 13d6e4ec3022..59a87ca328d3 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -2410,8 +2410,11 @@ _base_assign_reply_queues(struct MPT3SAS_ADAPTER *ioc)
                                 continue;
                         }
 
-                        for_each_cpu(cpu, mask)
+                        for_each_cpu_and(cpu, mask, cpu_online_mask) {
+                                if (cpu >= ioc->cpu_msix_table_sz)
+                                        break;
                                 ioc->cpu_msix_table[cpu] = reply_q->msix_index;
+                        }
                 }
                 return;
         }
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index 029e2e69b29f..f57a94b4f0d9 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -1724,7 +1724,6 @@ static ssize_t qedi_show_boot_eth_info(void *data, int type, char *buf)
 {
         struct qedi_ctx *qedi = data;
         struct nvm_iscsi_initiator *initiator;
-        char *str = buf;
         int rc = 1;
         u32 ipv6_en, dhcp_en, ip_len;
         struct nvm_iscsi_block *block;
@@ -1758,32 +1757,32 @@ static ssize_t qedi_show_boot_eth_info(void *data, int type, char *buf)
 
         switch (type) {
         case ISCSI_BOOT_ETH_IP_ADDR:
-                rc = snprintf(str, ip_len, fmt, ip);
+                rc = snprintf(buf, ip_len, fmt, ip);
                 break;
         case ISCSI_BOOT_ETH_SUBNET_MASK:
-                rc = snprintf(str, ip_len, fmt, sub);
+                rc = snprintf(buf, ip_len, fmt, sub);
                 break;
         case ISCSI_BOOT_ETH_GATEWAY:
-                rc = snprintf(str, ip_len, fmt, gw);
+                rc = snprintf(buf, ip_len, fmt, gw);
                 break;
         case ISCSI_BOOT_ETH_FLAGS:
-                rc = snprintf(str, 3, "%hhd\n",
+                rc = snprintf(buf, 3, "%hhd\n",
                               SYSFS_FLAG_FW_SEL_BOOT);
                 break;
         case ISCSI_BOOT_ETH_INDEX:
-                rc = snprintf(str, 3, "0\n");
+                rc = snprintf(buf, 3, "0\n");
                 break;
         case ISCSI_BOOT_ETH_MAC:
-                rc = sysfs_format_mac(str, qedi->mac, ETH_ALEN);
+                rc = sysfs_format_mac(buf, qedi->mac, ETH_ALEN);
                 break;
         case ISCSI_BOOT_ETH_VLAN:
-                rc = snprintf(str, 12, "%d\n",
+                rc = snprintf(buf, 12, "%d\n",
                               GET_FIELD2(initiator->generic_cont0,
                                          NVM_ISCSI_CFG_INITIATOR_VLAN));
                 break;
         case ISCSI_BOOT_ETH_ORIGIN:
                 if (dhcp_en)
-                        rc = snprintf(str, 3, "3\n");
+                        rc = snprintf(buf, 3, "3\n");
                 break;
         default:
                 rc = 0;
@@ -1819,7 +1818,6 @@ static ssize_t qedi_show_boot_ini_info(void *data, int type, char *buf)
 {
         struct qedi_ctx *qedi = data;
         struct nvm_iscsi_initiator *initiator;
-        char *str = buf;
         int rc;
         struct nvm_iscsi_block *block;
 
@@ -1831,8 +1829,8 @@ static ssize_t qedi_show_boot_ini_info(void *data, int type, char *buf)
 
         switch (type) {
         case ISCSI_BOOT_INI_INITIATOR_NAME:
-                rc = snprintf(str, NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, "%s\n",
-                              initiator->initiator_name.byte);
+                rc = sprintf(buf, "%.*s\n", NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN,
+                             initiator->initiator_name.byte);
                 break;
         default:
                 rc = 0;
@@ -1860,7 +1858,6 @@ static ssize_t
 qedi_show_boot_tgt_info(struct qedi_ctx *qedi, int type,
                         char *buf, enum qedi_nvm_tgts idx)
 {
-        char *str = buf;
         int rc = 1;
         u32 ctrl_flags, ipv6_en, chap_en, mchap_en, ip_len;
         struct nvm_iscsi_block *block;
@@ -1899,48 +1896,48 @@ qedi_show_boot_tgt_info(struct qedi_ctx *qedi, int type,
 
         switch (type) {
         case ISCSI_BOOT_TGT_NAME:
-                rc = snprintf(str, NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, "%s\n",
-                              block->target[idx].target_name.byte);
+                rc = sprintf(buf, "%.*s\n", NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN,
+                             block->target[idx].target_name.byte);
                 break;
         case ISCSI_BOOT_TGT_IP_ADDR:
                 if (ipv6_en)
-                        rc = snprintf(str, ip_len, "%pI6\n",
+                        rc = snprintf(buf, ip_len, "%pI6\n",
                                       block->target[idx].ipv6_addr.byte);
                 else
-                        rc = snprintf(str, ip_len, "%pI4\n",
+                        rc = snprintf(buf, ip_len, "%pI4\n",
                                       block->target[idx].ipv4_addr.byte);
                 break;
         case ISCSI_BOOT_TGT_PORT:
-                rc = snprintf(str, 12, "%d\n",
+                rc = snprintf(buf, 12, "%d\n",
                               GET_FIELD2(block->target[idx].generic_cont0,
                                          NVM_ISCSI_CFG_TARGET_TCP_PORT));
                 break;
         case ISCSI_BOOT_TGT_LUN:
-                rc = snprintf(str, 22, "%.*d\n",
+                rc = snprintf(buf, 22, "%.*d\n",
                               block->target[idx].lun.value[1],
                               block->target[idx].lun.value[0]);
                 break;
         case ISCSI_BOOT_TGT_CHAP_NAME:
-                rc = snprintf(str, NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, "%s\n",
-                              chap_name);
+                rc = sprintf(buf, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
+                             chap_name);
                 break;
         case ISCSI_BOOT_TGT_CHAP_SECRET:
-                rc = snprintf(str, NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN, "%s\n",
-                              chap_secret);
+                rc = sprintf(buf, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
+                             chap_secret);
                 break;
         case ISCSI_BOOT_TGT_REV_CHAP_NAME:
-                rc = snprintf(str, NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, "%s\n",
-                              mchap_name);
+                rc = sprintf(buf, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
+                             mchap_name);
                 break;
         case ISCSI_BOOT_TGT_REV_CHAP_SECRET:
-                rc = snprintf(str, NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN, "%s\n",
-                              mchap_secret);
+                rc = sprintf(buf, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
+                             mchap_secret);
                 break;
         case ISCSI_BOOT_TGT_FLAGS:
-                rc = snprintf(str, 3, "%hhd\n", SYSFS_FLAG_FW_SEL_BOOT);
+                rc = snprintf(buf, 3, "%hhd\n", SYSFS_FLAG_FW_SEL_BOOT);
                 break;
         case ISCSI_BOOT_TGT_NIC_ASSOC:
-                rc = snprintf(str, 3, "0\n");
+                rc = snprintf(buf, 3, "0\n");
                 break;
         default:
                 rc = 0;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index aececf664654..2dea1129d396 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -59,8 +59,6 @@ qla2x00_sp_timeout(struct timer_list *t)
         req->outstanding_cmds[sp->handle] = NULL;
         iocb = &sp->u.iocb_cmd;
         iocb->timeout(sp);
-        if (sp->type != SRB_ELS_DCMD)
-                sp->free(sp);
         spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
 }
 
@@ -102,7 +100,6 @@ qla2x00_async_iocb_timeout(void *data)
         srb_t *sp = data;
         fc_port_t *fcport = sp->fcport;
         struct srb_iocb *lio = &sp->u.iocb_cmd;
-        struct event_arg ea;
 
         if (fcport) {
                 ql_dbg(ql_dbg_disc, fcport->vha, 0x2071,
@@ -117,25 +114,13 @@ qla2x00_async_iocb_timeout(void *data)
 
         switch (sp->type) {
         case SRB_LOGIN_CMD:
-                if (!fcport)
-                        break;
                 /* Retry as needed. */
                 lio->u.logio.data[0] = MBS_COMMAND_ERROR;
                 lio->u.logio.data[1] = lio->u.logio.flags & SRB_LOGIN_RETRIED ?
                         QLA_LOGIO_LOGIN_RETRIED : 0;
-                memset(&ea, 0, sizeof(ea));
-                ea.event = FCME_PLOGI_DONE;
-                ea.fcport = sp->fcport;
-                ea.data[0] = lio->u.logio.data[0];
-                ea.data[1] = lio->u.logio.data[1];
-                ea.sp = sp;
-                qla24xx_handle_plogi_done_event(fcport->vha, &ea);
+                sp->done(sp, QLA_FUNCTION_TIMEOUT);
                 break;
         case SRB_LOGOUT_CMD:
-                if (!fcport)
-                        break;
-                qlt_logo_completion_handler(fcport, QLA_FUNCTION_TIMEOUT);
-                break;
         case SRB_CT_PTHRU_CMD:
         case SRB_MB_IOCB:
         case SRB_NACK_PLOGI:
@@ -235,12 +220,10 @@ static void
 qla2x00_async_logout_sp_done(void *ptr, int res)
 {
         srb_t *sp = ptr;
-        struct srb_iocb *lio = &sp->u.iocb_cmd;
 
         sp->fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
-        if (!test_bit(UNLOADING, &sp->vha->dpc_flags))
-                qla2x00_post_async_logout_done_work(sp->vha, sp->fcport,
-                    lio->u.logio.data);
+        sp->fcport->login_gen++;
+        qlt_logo_completion_handler(sp->fcport, res);
         sp->free(sp);
 }
 
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 1b62e943ec49..8d00d559bd26 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -3275,12 +3275,11 @@ qla24xx_abort_iocb(srb_t *sp, struct abort_entry_24xx *abt_iocb)
         memset(abt_iocb, 0, sizeof(struct abort_entry_24xx));
         abt_iocb->entry_type = ABORT_IOCB_TYPE;
         abt_iocb->entry_count = 1;
-        abt_iocb->handle =
-             cpu_to_le32(MAKE_HANDLE(aio->u.abt.req_que_no,
-                 aio->u.abt.cmd_hndl));
+        abt_iocb->handle = cpu_to_le32(MAKE_HANDLE(req->id, sp->handle));
         abt_iocb->nport_handle = cpu_to_le16(sp->fcport->loop_id);
         abt_iocb->handle_to_abort =
-            cpu_to_le32(MAKE_HANDLE(req->id, aio->u.abt.cmd_hndl));
+            cpu_to_le32(MAKE_HANDLE(aio->u.abt.req_que_no,
+                                    aio->u.abt.cmd_hndl));
         abt_iocb->port_id[0] = sp->fcport->d_id.b.al_pa;
         abt_iocb->port_id[1] = sp->fcport->d_id.b.area;
         abt_iocb->port_id[2] = sp->fcport->d_id.b.domain;
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 14109d86c3f6..89f93ebd819d 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -272,7 +272,8 @@ qla2x00_mbx_completion(scsi_qla_host_t *vha, uint16_t mb0)
         struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
 
         /* Read all mbox registers? */
-        mboxes = (1 << ha->mbx_count) - 1;
+        WARN_ON_ONCE(ha->mbx_count > 32);
+        mboxes = (1ULL << ha->mbx_count) - 1;
         if (!ha->mcp)
                 ql_dbg(ql_dbg_async, vha, 0x5001, "MBX pointer ERROR.\n");
         else
@@ -2880,7 +2881,8 @@ qla24xx_mbx_completion(scsi_qla_host_t *vha, uint16_t mb0)
         struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
 
         /* Read all mbox registers? */
-        mboxes = (1 << ha->mbx_count) - 1;
+        WARN_ON_ONCE(ha->mbx_count > 32);
+        mboxes = (1ULL << ha->mbx_count) - 1;
         if (!ha->mcp)
                 ql_dbg(ql_dbg_async, vha, 0x504e, "MBX pointer ERROR.\n");
         else
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 12ee6e02d146..afcb5567998a 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3625,6 +3625,8 @@ qla2x00_remove_one(struct pci_dev *pdev)
         }
         qla2x00_wait_for_hba_ready(base_vha);
 
+        qla2x00_wait_for_sess_deletion(base_vha);
+
         /*
          * if UNLOAD flag is already set, then continue unload,
          * where it was set first.
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index fc89af8fe256..896b2d8bd803 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -4871,8 +4871,6 @@ static int qlt_24xx_handle_els(struct scsi_qla_host *vha,
                                     sess);
                                 qlt_send_term_imm_notif(vha, iocb, 1);
                                 res = 0;
-                                spin_lock_irqsave(&tgt->ha->tgt.sess_lock,
-                                    flags);
                                 break;
                         }
 
diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
index fc233717355f..817f312023a9 100644
--- a/drivers/scsi/qla4xxx/ql4_def.h
+++ b/drivers/scsi/qla4xxx/ql4_def.h
@@ -168,6 +168,8 @@
 #define DEV_DB_NON_PERSISTENT   0
 #define DEV_DB_PERSISTENT       1
 
+#define QL4_ISP_REG_DISCONNECT 0xffffffffU
+
 #define COPY_ISID(dst_isid, src_isid) {                 \
         int i, j;                                       \
         for (i = 0, j = ISID_SIZE - 1; i < ISID_SIZE;)  \
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index 82e889bbe0ed..fc2c97d9a0d6 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -262,6 +262,24 @@ static struct iscsi_transport qla4xxx_iscsi_transport = {
 
 static struct scsi_transport_template *qla4xxx_scsi_transport;
 
+static int qla4xxx_isp_check_reg(struct scsi_qla_host *ha)
+{
+        u32 reg_val = 0;
+        int rval = QLA_SUCCESS;
+
+        if (is_qla8022(ha))
+                reg_val = readl(&ha->qla4_82xx_reg->host_status);
+        else if (is_qla8032(ha) || is_qla8042(ha))
+                reg_val = qla4_8xxx_rd_direct(ha, QLA8XXX_PEG_ALIVE_COUNTER);
+        else
+                reg_val = readw(&ha->reg->ctrl_status);
+
+        if (reg_val == QL4_ISP_REG_DISCONNECT)
+                rval = QLA_ERROR;
+
+        return rval;
+}
+
 static int qla4xxx_send_ping(struct Scsi_Host *shost, uint32_t iface_num,
                              uint32_t iface_type, uint32_t payload_size,
                              uint32_t pid, struct sockaddr *dst_addr)
@@ -9186,10 +9204,17 @@ static int qla4xxx_eh_abort(struct scsi_cmnd *cmd)
         struct srb *srb = NULL;
         int ret = SUCCESS;
         int wait = 0;
+        int rval;
 
         ql4_printk(KERN_INFO, ha, "scsi%ld:%d:%llu: Abort command issued cmd=%p, cdb=0x%x\n",
                    ha->host_no, id, lun, cmd, cmd->cmnd[0]);
 
+        rval = qla4xxx_isp_check_reg(ha);
+        if (rval != QLA_SUCCESS) {
+                ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, exiting.\n");
+                return FAILED;
+        }
+
         spin_lock_irqsave(&ha->hardware_lock, flags);
         srb = (struct srb *) CMD_SP(cmd);
         if (!srb) {
@@ -9241,6 +9266,7 @@ static int qla4xxx_eh_device_reset(struct scsi_cmnd *cmd)
         struct scsi_qla_host *ha = to_qla_host(cmd->device->host);
         struct ddb_entry *ddb_entry = cmd->device->hostdata;
         int ret = FAILED, stat;
+        int rval;
 
         if (!ddb_entry)
                 return ret;
@@ -9260,6 +9286,12 @@ static int qla4xxx_eh_device_reset(struct scsi_cmnd *cmd)
                       cmd, jiffies, cmd->request->timeout / HZ,
                       ha->dpc_flags, cmd->result, cmd->allowed));
 
+        rval = qla4xxx_isp_check_reg(ha);
+        if (rval != QLA_SUCCESS) {
+                ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, exiting.\n");
+                return FAILED;
+        }
+
         /* FIXME: wait for hba to go online */
         stat = qla4xxx_reset_lun(ha, ddb_entry, cmd->device->lun);
         if (stat != QLA_SUCCESS) {
@@ -9303,6 +9335,7 @@ static int qla4xxx_eh_target_reset(struct scsi_cmnd *cmd)
         struct scsi_qla_host *ha = to_qla_host(cmd->device->host);
         struct ddb_entry *ddb_entry = cmd->device->hostdata;
         int stat, ret;
+        int rval;
 
         if (!ddb_entry)
                 return FAILED;
@@ -9320,6 +9353,12 @@ static int qla4xxx_eh_target_reset(struct scsi_cmnd *cmd)
                       ha->host_no, cmd, jiffies, cmd->request->timeout / HZ,
                       ha->dpc_flags, cmd->result, cmd->allowed));
 
+        rval = qla4xxx_isp_check_reg(ha);
+        if (rval != QLA_SUCCESS) {
+                ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, exiting.\n");
+                return FAILED;
+        }
+
         stat = qla4xxx_reset_target(ha, ddb_entry);
         if (stat != QLA_SUCCESS) {
                 starget_printk(KERN_INFO, scsi_target(cmd->device),
@@ -9374,9 +9413,16 @@ static int qla4xxx_eh_host_reset(struct scsi_cmnd *cmd)
 {
         int return_status = FAILED;
         struct scsi_qla_host *ha;
+        int rval;
 
         ha = to_qla_host(cmd->device->host);
 
+        rval = qla4xxx_isp_check_reg(ha);
+        if (rval != QLA_SUCCESS) {
+                ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, exiting.\n");
+                return FAILED;
+        }
+
         if ((is_qla8032(ha) || is_qla8042(ha)) && ql4xdontresethba)
                 qla4_83xx_set_idc_dontreset(ha);
 
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 40fc7a590e81..6be5ab32c94f 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1657,7 +1657,7 @@ static struct scsi_host_template scsi_driver = {
         .eh_timed_out =         storvsc_eh_timed_out,
         .slave_alloc =          storvsc_device_alloc,
         .slave_configure =      storvsc_device_configure,
-        .cmd_per_lun =          255,
+        .cmd_per_lun =          2048,
         .this_id =              -1,
         .use_clustering =       ENABLE_CLUSTERING,
         /* Make sure we dont get a sg segment crosses a page boundary */
diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c
index ca360daa6a25..378af306fda1 100644
--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
+++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
@@ -536,7 +536,7 @@ sym_getsync(struct sym_hcb *np, u_char dt, u_char sfac, u_char *divp, u_char *fa
          *  Look for the greatest clock divisor that allows an 
          *  input speed faster than the period.
          */
-        while (div-- > 0)
+        while (--div > 0)
                 if (kpc >= (div_10M[div] << 2)) break;
 
         /*
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index a355d989b414..c7da2c185990 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -4352,6 +4352,8 @@ static int ufshcd_slave_alloc(struct scsi_device *sdev)
         /* REPORT SUPPORTED OPERATION CODES is not supported */
         sdev->no_report_opcodes = 1;
 
+        /* WRITE_SAME command is not supported */
+        sdev->no_write_same = 1;
 
         ufshcd_set_queue_depth(sdev);
 
diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c
index 53f7275d6cbd..cfb42f5eccb2 100644
--- a/drivers/soc/imx/gpc.c
+++ b/drivers/soc/imx/gpc.c
@@ -348,7 +348,7 @@ static int imx_gpc_old_dt_init(struct device *dev, struct regmap *regmap,
                 if (i == 1) {
                         domain->supply = devm_regulator_get(dev, "pu");
                         if (IS_ERR(domain->supply))
-                                return PTR_ERR(domain->supply);;
+                                return PTR_ERR(domain->supply);
 
                         ret = imx_pgc_get_clocks(dev, domain);
                         if (ret)
diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index bbdc53b686dd..6dbba5aff191 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -702,30 +702,32 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
         size_t pgstart, pgend;
         int ret = -EINVAL;
 
+        mutex_lock(&ashmem_mutex);
+
         if (unlikely(!asma->file))
-                return -EINVAL;
+                goto out_unlock;
 
-        if (unlikely(copy_from_user(&pin, p, sizeof(pin))))
-                return -EFAULT;
+        if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) {
+                ret = -EFAULT;
+                goto out_unlock;
+        }
 
         /* per custom, you can pass zero for len to mean "everything onward" */
         if (!pin.len)
                 pin.len = PAGE_ALIGN(asma->size) - pin.offset;
 
         if (unlikely((pin.offset | pin.len) & ~PAGE_MASK))
-                return -EINVAL;
+                goto out_unlock;
 
         if (unlikely(((__u32)-1) - pin.offset < pin.len))
-                return -EINVAL;
+                goto out_unlock;
 
         if (unlikely(PAGE_ALIGN(asma->size) < pin.offset + pin.len))
-                return -EINVAL;
+                goto out_unlock;
 
         pgstart = pin.offset / PAGE_SIZE;
         pgend = pgstart + (pin.len / PAGE_SIZE) - 1;
 
-        mutex_lock(&ashmem_mutex);
-
         switch (cmd) {
         case ASHMEM_PIN:
                 ret = ashmem_pin(asma, pgstart, pgend);
@@ -738,6 +740,7 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
                 break;
         }
 
+out_unlock:
         mutex_unlock(&ashmem_mutex);
 
         return ret;
diff --git a/drivers/staging/android/ion/ion_cma_heap.c b/drivers/staging/android/ion/ion_cma_heap.c
index 94e06925c712..49718c96bf9e 100644
--- a/drivers/staging/android/ion/ion_cma_heap.c
+++ b/drivers/staging/android/ion/ion_cma_heap.c
@@ -12,6 +12,7 @@
 #include <linux/err.h>
 #include <linux/cma.h>
 #include <linux/scatterlist.h>
+#include <linux/highmem.h>
 
 #include "ion.h"
 
@@ -42,6 +43,22 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer,
         if (!pages)
                 return -ENOMEM;
 
+        if (PageHighMem(pages)) {
+                unsigned long nr_clear_pages = nr_pages;
+                struct page *page = pages;
+
+                while (nr_clear_pages > 0) {
+                        void *vaddr = kmap_atomic(page);
+
+                        memset(vaddr, 0, PAGE_SIZE);
+                        kunmap_atomic(vaddr);
+                        page++;
+                        nr_clear_pages--;
+                }
+        } else {
+                memset(page_address(pages), 0, size);
+        }
+
         table = kmalloc(sizeof(*table), GFP_KERNEL);
         if (!table)
                 goto err;
diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
index 079a8410d664..df0499fc4802 100644
--- a/drivers/staging/iio/adc/ad7192.c
+++ b/drivers/staging/iio/adc/ad7192.c
@@ -141,6 +141,8 @@
 #define AD7192_GPOCON_P1DAT     BIT(1) /* P1 state */
 #define AD7192_GPOCON_P0DAT     BIT(0) /* P0 state */
 
+#define AD7192_EXT_FREQ_MHZ_MIN 2457600
+#define AD7192_EXT_FREQ_MHZ_MAX 5120000
 #define AD7192_INT_FREQ_MHZ     4915200
 
 /* NOTE:
@@ -218,6 +220,12 @@ static int ad7192_calibrate_all(struct ad7192_state *st)
                                 ARRAY_SIZE(ad7192_calib_arr));
 }
 
+static inline bool ad7192_valid_external_frequency(u32 freq)
+{
+        return (freq >= AD7192_EXT_FREQ_MHZ_MIN &&
+                freq <= AD7192_EXT_FREQ_MHZ_MAX);
+}
+
 static int ad7192_setup(struct ad7192_state *st,
                         const struct ad7192_platform_data *pdata)
 {
@@ -243,17 +251,20 @@ static int ad7192_setup(struct ad7192_state *st,
                          id);
 
         switch (pdata->clock_source_sel) {
-        case AD7192_CLK_EXT_MCLK1_2:
-        case AD7192_CLK_EXT_MCLK2:
-                st->mclk = AD7192_INT_FREQ_MHZ;
-                break;
         case AD7192_CLK_INT:
         case AD7192_CLK_INT_CO:
-                if (pdata->ext_clk_hz)
-                        st->mclk = pdata->ext_clk_hz;
-                else
-                        st->mclk = AD7192_INT_FREQ_MHZ;
+                st->mclk = AD7192_INT_FREQ_MHZ;
                 break;
+        case AD7192_CLK_EXT_MCLK1_2:
+        case AD7192_CLK_EXT_MCLK2:
+                if (ad7192_valid_external_frequency(pdata->ext_clk_hz)) {
+                        st->mclk = pdata->ext_clk_hz;
+                        break;
+                }
+                dev_err(&st->sd.spi->dev, "Invalid frequency setting %u\n",
+                        pdata->ext_clk_hz);
+                ret = -EINVAL;
+                goto out;
         default:
                 ret = -EINVAL;
                 goto out;
diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
index 2b28fb9c0048..3bcf49466361 100644
--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
@@ -648,8 +648,6 @@ static int ad5933_register_ring_funcs_and_init(struct iio_dev *indio_dev)
         /* Ring buffer functions - here trigger setup related */
         indio_dev->setup_ops = &ad5933_ring_setup_ops;
 
-        indio_dev->modes |= INDIO_BUFFER_HARDWARE;
-
         return 0;
 }
 
@@ -762,7 +760,7 @@ static int ad5933_probe(struct i2c_client *client,
         indio_dev->dev.parent = &client->dev;
         indio_dev->info = &ad5933_info;
         indio_dev->name = id->name;
-        indio_dev->modes = INDIO_DIRECT_MODE;
+        indio_dev->modes = (INDIO_BUFFER_SOFTWARE | INDIO_DIRECT_MODE);
         indio_dev->channels = ad5933_channels;
         indio_dev->num_channels = ARRAY_SIZE(ad5933_channels);
 
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index f699abab1787..148f3ee70286 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -19,6 +19,12 @@ config USB_EHCI_BIG_ENDIAN_MMIO
 config USB_EHCI_BIG_ENDIAN_DESC
         bool
 
+config USB_UHCI_BIG_ENDIAN_MMIO
+        bool
+
+config USB_UHCI_BIG_ENDIAN_DESC
+        bool
+
 menuconfig USB_SUPPORT
         bool "USB support"
         depends on HAS_IOMEM
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 06b3b54a0e68..7b366a6c0b49 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -174,6 +174,7 @@ static int acm_wb_alloc(struct acm *acm)
                 wb = &acm->wb[wbn];
                 if (!wb->use) {
                         wb->use = 1;
+                        wb->len = 0;
                         return wbn;
                 }
                 wbn = (wbn + 1) % ACM_NW;
@@ -805,16 +806,18 @@ static int acm_tty_write(struct tty_struct *tty,
 static void acm_tty_flush_chars(struct tty_struct *tty)
 {
         struct acm *acm = tty->driver_data;
-        struct acm_wb *cur = acm->putbuffer;
+        struct acm_wb *cur;
         int err;
         unsigned long flags;
 
+        spin_lock_irqsave(&acm->write_lock, flags);
+
+        cur = acm->putbuffer;
         if (!cur) /* nothing to do */
-                return;
+                goto out;
 
         acm->putbuffer = NULL;
         err = usb_autopm_get_interface_async(acm->control);
-        spin_lock_irqsave(&acm->write_lock, flags);
         if (err < 0) {
                 cur->use = 0;
                 acm->putbuffer = cur;
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 4024926c1d68..f4a548471f0f 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -226,6 +226,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
                         USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
 
+        /* Corsair K70 RGB */
+        { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
+
         /* Corsair Strafe RGB */
         { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
 
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index e4c3ce0de5de..5bcad1d869b5 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -1917,7 +1917,9 @@ static void dwc2_hsotg_program_zlp(struct dwc2_hsotg *hsotg,
                 /* Not specific buffer needed for ep0 ZLP */
                 dma_addr_t dma = hs_ep->desc_list_dma;
 
-                dwc2_gadget_set_ep0_desc_chain(hsotg, hs_ep);
+                if (!index)
+                        dwc2_gadget_set_ep0_desc_chain(hsotg, hs_ep);
+
                 dwc2_gadget_config_nonisoc_xfer_ddma(hs_ep, dma, 0);
         } else {
                 dwc2_writel(DXEPTSIZ_MC(1) | DXEPTSIZ_PKTCNT(1) |
@@ -2974,9 +2976,13 @@ static void dwc2_hsotg_epint(struct dwc2_hsotg *hsotg, unsigned int idx,
         if (ints & DXEPINT_STSPHSERCVD) {
                 dev_dbg(hsotg->dev, "%s: StsPhseRcvd\n", __func__);
 
-                /* Move to STATUS IN for DDMA */
-                if (using_desc_dma(hsotg))
-                        dwc2_hsotg_ep0_zlp(hsotg, true);
+                /* Safety check EP0 state when STSPHSERCVD asserted */
+                if (hsotg->ep0_state == DWC2_EP0_DATA_OUT) {
+                        /* Move to STATUS IN for DDMA */
+                        if (using_desc_dma(hsotg))
+                                dwc2_hsotg_ep0_zlp(hsotg, true);
+                }
+
         }
 
         if (ints & DXEPINT_BACK2BACKSETUP)
@@ -3375,12 +3381,6 @@ void dwc2_hsotg_core_init_disconnected(struct dwc2_hsotg *hsotg,
         dwc2_writel(dwc2_hsotg_ep0_mps(hsotg->eps_out[0]->ep.maxpacket) |
                DXEPCTL_USBACTEP, hsotg->regs + DIEPCTL0);
 
-        dwc2_hsotg_enqueue_setup(hsotg);
-
-        dev_dbg(hsotg->dev, "EP0: DIEPCTL0=0x%08x, DOEPCTL0=0x%08x\n",
-                dwc2_readl(hsotg->regs + DIEPCTL0),
-                dwc2_readl(hsotg->regs + DOEPCTL0));
-
         /* clear global NAKs */
         val = DCTL_CGOUTNAK | DCTL_CGNPINNAK;
         if (!is_usb_reset)
@@ -3391,6 +3391,12 @@ void dwc2_hsotg_core_init_disconnected(struct dwc2_hsotg *hsotg,
         mdelay(3);
 
         hsotg->lx_state = DWC2_L0;
+
+        dwc2_hsotg_enqueue_setup(hsotg);
+
+        dev_dbg(hsotg->dev, "EP0: DIEPCTL0=0x%08x, DOEPCTL0=0x%08x\n",
+                dwc2_readl(hsotg->regs + DIEPCTL0),
+                dwc2_readl(hsotg->regs + DOEPCTL0));
 }
 
 static void dwc2_hsotg_core_disconnect(struct dwc2_hsotg *hsotg)
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index ade2ab00d37a..f1d838a4acd6 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -100,6 +100,8 @@ static void dwc3_set_prtcap(struct dwc3 *dwc, u32 mode)
         reg &= ~(DWC3_GCTL_PRTCAPDIR(DWC3_GCTL_PRTCAP_OTG));
         reg |= DWC3_GCTL_PRTCAPDIR(mode);
         dwc3_writel(dwc->regs, DWC3_GCTL, reg);
+
+        dwc->current_dr_role = mode;
 }
 
 static void __dwc3_set_mode(struct work_struct *work)
@@ -133,8 +135,6 @@ static void __dwc3_set_mode(struct work_struct *work)
 
         dwc3_set_prtcap(dwc, dwc->desired_dr_role);
 
-        dwc->current_dr_role = dwc->desired_dr_role;
-
         spin_unlock_irqrestore(&dwc->lock, flags);
 
         switch (dwc->desired_dr_role) {
@@ -219,7 +219,7 @@ static int dwc3_core_soft_reset(struct dwc3 *dwc)
          * XHCI driver will reset the host block. If dwc3 was configured for
          * host-only mode, then we can return early.
          */
-        if (dwc->dr_mode == USB_DR_MODE_HOST)
+        if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST)
                 return 0;
 
         reg = dwc3_readl(dwc->regs, DWC3_DCTL);
@@ -234,6 +234,9 @@ static int dwc3_core_soft_reset(struct dwc3 *dwc)
                 udelay(1);
         } while (--retries);
 
+        phy_exit(dwc->usb3_generic_phy);
+        phy_exit(dwc->usb2_generic_phy);
+
         return -ETIMEDOUT;
 }
 
@@ -483,6 +486,22 @@ static void dwc3_cache_hwparams(struct dwc3 *dwc)
         parms->hwparams8 = dwc3_readl(dwc->regs, DWC3_GHWPARAMS8);
 }
 
+static int dwc3_core_ulpi_init(struct dwc3 *dwc)
+{
+        int intf;
+        int ret = 0;
+
+        intf = DWC3_GHWPARAMS3_HSPHY_IFC(dwc->hwparams.hwparams3);
+
+        if (intf == DWC3_GHWPARAMS3_HSPHY_IFC_ULPI ||
+            (intf == DWC3_GHWPARAMS3_HSPHY_IFC_UTMI_ULPI &&
+             dwc->hsphy_interface &&
+             !strncmp(dwc->hsphy_interface, "ulpi", 4)))
+                ret = dwc3_ulpi_init(dwc);
+
+        return ret;
+}
+
 /**
  * dwc3_phy_setup - Configure USB PHY Interface of DWC3 Core
  * @dwc: Pointer to our controller context structure
@@ -494,7 +513,6 @@ static void dwc3_cache_hwparams(struct dwc3 *dwc)
 static int dwc3_phy_setup(struct dwc3 *dwc)
 {
         u32 reg;
-        int ret;
 
         reg = dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0));
 
@@ -565,9 +583,6 @@ static int dwc3_phy_setup(struct dwc3 *dwc)
                 }
                 /* FALLTHROUGH */
         case DWC3_GHWPARAMS3_HSPHY_IFC_ULPI:
-                ret = dwc3_ulpi_init(dwc);
-                if (ret)
-                        return ret;
                 /* FALLTHROUGH */
         default:
                 break;
@@ -724,6 +739,7 @@ static void dwc3_core_setup_global_control(struct dwc3 *dwc)
 }
 
 static int dwc3_core_get_phy(struct dwc3 *dwc);
+static int dwc3_core_ulpi_init(struct dwc3 *dwc);
 
 /**
  * dwc3_core_init - Low-level initialization of DWC3 Core
@@ -755,17 +771,27 @@ static int dwc3_core_init(struct dwc3 *dwc)
                         dwc->maximum_speed = USB_SPEED_HIGH;
         }
 
-        ret = dwc3_core_get_phy(dwc);
+        ret = dwc3_phy_setup(dwc);
         if (ret)
                 goto err0;
 
-        ret = dwc3_core_soft_reset(dwc);
-        if (ret)
-                goto err0;
+        if (!dwc->ulpi_ready) {
+                ret = dwc3_core_ulpi_init(dwc);
+                if (ret)
+                        goto err0;
+                dwc->ulpi_ready = true;
+        }
 
-        ret = dwc3_phy_setup(dwc);
+        if (!dwc->phys_ready) {
+                ret = dwc3_core_get_phy(dwc);
+                if (ret)
+                        goto err0a;
+                dwc->phys_ready = true;
+        }
+
+        ret = dwc3_core_soft_reset(dwc);
         if (ret)
-                goto err0;
+                goto err0a;
 
         dwc3_core_setup_global_control(dwc);
         dwc3_core_num_eps(dwc);
@@ -838,6 +864,9 @@ err1:
         phy_exit(dwc->usb2_generic_phy);
         phy_exit(dwc->usb3_generic_phy);
 
+err0a:
+        dwc3_ulpi_exit(dwc);
+
 err0:
         return ret;
 }
@@ -916,7 +945,6 @@ static int dwc3_core_init_mode(struct dwc3 *dwc)
 
         switch (dwc->dr_mode) {
         case USB_DR_MODE_PERIPHERAL:
-                dwc->current_dr_role = DWC3_GCTL_PRTCAP_DEVICE;
                 dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_DEVICE);
 
                 if (dwc->usb2_phy)
@@ -932,7 +960,6 @@ static int dwc3_core_init_mode(struct dwc3 *dwc)
                 }
                 break;
         case USB_DR_MODE_HOST:
-                dwc->current_dr_role = DWC3_GCTL_PRTCAP_HOST;
                 dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_HOST);
 
                 if (dwc->usb2_phy)
@@ -1234,7 +1261,6 @@ err4:
 
 err3:
         dwc3_free_event_buffers(dwc);
-        dwc3_ulpi_exit(dwc);
 
 err2:
         pm_runtime_allow(&pdev->dev);
@@ -1284,7 +1310,7 @@ static int dwc3_remove(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_PM
-static int dwc3_suspend_common(struct dwc3 *dwc)
+static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
 {
         unsigned long   flags;
 
@@ -1296,6 +1322,10 @@ static int dwc3_suspend_common(struct dwc3 *dwc)
                 dwc3_core_exit(dwc);
                 break;
         case DWC3_GCTL_PRTCAP_HOST:
+                /* do nothing during host runtime_suspend */
+                if (!PMSG_IS_AUTO(msg))
+                        dwc3_core_exit(dwc);
+                break;
         default:
                 /* do nothing */
                 break;
@@ -1304,7 +1334,7 @@ static int dwc3_suspend_common(struct dwc3 *dwc)
         return 0;
 }
 
-static int dwc3_resume_common(struct dwc3 *dwc)
+static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg)
 {
         unsigned long   flags;
         int             ret;
@@ -1320,6 +1350,13 @@ static int dwc3_resume_common(struct dwc3 *dwc)
                 spin_unlock_irqrestore(&dwc->lock, flags);
                 break;
         case DWC3_GCTL_PRTCAP_HOST:
+                /* nothing to do on host runtime_resume */
+                if (!PMSG_IS_AUTO(msg)) {
+                        ret = dwc3_core_init(dwc);
+                        if (ret)
+                                return ret;
+                }
+                break;
         default:
                 /* do nothing */
                 break;
@@ -1331,12 +1368,11 @@ static int dwc3_resume_common(struct dwc3 *dwc)
 static int dwc3_runtime_checks(struct dwc3 *dwc)
 {
         switch (dwc->current_dr_role) {
-        case USB_DR_MODE_PERIPHERAL:
-        case USB_DR_MODE_OTG:
+        case DWC3_GCTL_PRTCAP_DEVICE:
                 if (dwc->connected)
                         return -EBUSY;
                 break;
-        case USB_DR_MODE_HOST:
+        case DWC3_GCTL_PRTCAP_HOST:
         default:
                 /* do nothing */
                 break;
@@ -1353,7 +1389,7 @@ static int dwc3_runtime_suspend(struct device *dev)
         if (dwc3_runtime_checks(dwc))
                 return -EBUSY;
 
-        ret = dwc3_suspend_common(dwc);
+        ret = dwc3_suspend_common(dwc, PMSG_AUTO_SUSPEND);
         if (ret)
                 return ret;
 
@@ -1369,7 +1405,7 @@ static int dwc3_runtime_resume(struct device *dev)
 
         device_init_wakeup(dev, false);
 
-        ret = dwc3_resume_common(dwc);
+        ret = dwc3_resume_common(dwc, PMSG_AUTO_RESUME);
         if (ret)
                 return ret;
 
@@ -1416,7 +1452,7 @@ static int dwc3_suspend(struct device *dev)
         struct dwc3     *dwc = dev_get_drvdata(dev);
         int             ret;
 
-        ret = dwc3_suspend_common(dwc);
+        ret = dwc3_suspend_common(dwc, PMSG_SUSPEND);
         if (ret)
                 return ret;
 
@@ -1432,7 +1468,7 @@ static int dwc3_resume(struct device *dev)
 
         pinctrl_pm_select_default_state(dev);
 
-        ret = dwc3_resume_common(dwc);
+        ret = dwc3_resume_common(dwc, PMSG_RESUME);
         if (ret)
                 return ret;
 
diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 03c7aaaac926..860d2bc184d1 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -158,13 +158,15 @@
 #define DWC3_GDBGFIFOSPACE_TYPE(n)      (((n) << 5) & 0x1e0)
 #define DWC3_GDBGFIFOSPACE_SPACE_AVAILABLE(n) (((n) >> 16) & 0xffff)
 
-#define DWC3_TXFIFOQ            1
-#define DWC3_RXFIFOQ            3
-#define DWC3_TXREQQ             5
-#define DWC3_RXREQQ             7
-#define DWC3_RXINFOQ            9
-#define DWC3_DESCFETCHQ         13
-#define DWC3_EVENTQ             15
+#define DWC3_TXFIFOQ            0
+#define DWC3_RXFIFOQ            1
+#define DWC3_TXREQQ             2
+#define DWC3_RXREQQ             3
+#define DWC3_RXINFOQ            4
+#define DWC3_PSTATQ             5
+#define DWC3_DESCFETCHQ         6
+#define DWC3_EVENTQ             7
+#define DWC3_AUXEVENTQ          8
 
 /* Global RX Threshold Configuration Register */
 #define DWC3_GRXTHRCFG_MAXRXBURSTSIZE(n) (((n) & 0x1f) << 19)
@@ -795,7 +797,9 @@ struct dwc3_scratchpad_array {
  * @usb3_phy: pointer to USB3 PHY
  * @usb2_generic_phy: pointer to USB2 PHY
  * @usb3_generic_phy: pointer to USB3 PHY
+ * @phys_ready: flag to indicate that PHYs are ready
  * @ulpi: pointer to ulpi interface
+ * @ulpi_ready: flag to indicate that ULPI is initialized
  * @u2sel: parameter from Set SEL request.
  * @u2pel: parameter from Set SEL request.
  * @u1sel: parameter from Set SEL request.
@@ -893,7 +897,10 @@ struct dwc3 {
         struct phy              *usb2_generic_phy;
         struct phy              *usb3_generic_phy;
 
+        bool                    phys_ready;
+
         struct ulpi             *ulpi;
+        bool                    ulpi_ready;
 
         void __iomem            *regs;
         size_t                  regs_size;
diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index 7ae0eefc7cc7..e54c3622eb28 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -143,6 +143,7 @@ static int dwc3_of_simple_remove(struct platform_device *pdev)
                 clk_disable_unprepare(simple->clks[i]);
                 clk_put(simple->clks[i]);
         }
+        simple->num_clocks = 0;
 
         reset_control_assert(simple->resets);
         reset_control_put(simple->resets);
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index a4719e853b85..ed8b86517675 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -582,9 +582,25 @@ static int dwc3_omap_resume(struct device *dev)
         return 0;
 }
 
+static void dwc3_omap_complete(struct device *dev)
+{
+        struct dwc3_omap        *omap = dev_get_drvdata(dev);
+
+        if (extcon_get_state(omap->edev, EXTCON_USB))
+                dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_VALID);
+        else
+                dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_OFF);
+
+        if (extcon_get_state(omap->edev, EXTCON_USB_HOST))
+                dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_GROUND);
+        else
+                dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_FLOAT);
+}
+
 static const struct dev_pm_ops dwc3_omap_dev_pm_ops = {
 
         SET_SYSTEM_SLEEP_PM_OPS(dwc3_omap_suspend, dwc3_omap_resume)
+        .complete = dwc3_omap_complete,
 };
 
 #define DEV_PM_OPS      (&dwc3_omap_dev_pm_ops)
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 9c2e4a17918e..18be31d5743a 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -854,7 +854,12 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
                 trb++;
                 trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
                 trace_dwc3_complete_trb(ep0, trb);
-                ep0->trb_enqueue = 0;
+
+                if (r->direction)
+                        dwc->eps[1]->trb_enqueue = 0;
+                else
+                        dwc->eps[0]->trb_enqueue = 0;
+
                 dwc->ep0_bounced = false;
         }
 
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 616ef49ccb49..2bda4eb1e9ac 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2745,6 +2745,8 @@ static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc)
                 break;
         }
 
+        dwc->eps[1]->endpoint.maxpacket = dwc->gadget.ep0->maxpacket;
+
         /* Enable USB2 LPM Capability */
 
         if ((dwc->revision > DWC3_REVISION_194A) &&
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 8f2cf3baa19c..c2592d883f67 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1855,44 +1855,20 @@ static int ffs_func_eps_enable(struct ffs_function *func)
 
         spin_lock_irqsave(&func->ffs->eps_lock, flags);
         while(count--) {
-                struct usb_endpoint_descriptor *ds;
-                struct usb_ss_ep_comp_descriptor *comp_desc = NULL;
-                int needs_comp_desc = false;
-                int desc_idx;
-
-                if (ffs->gadget->speed == USB_SPEED_SUPER) {
-                        desc_idx = 2;
-                        needs_comp_desc = true;
-                } else if (ffs->gadget->speed == USB_SPEED_HIGH)
-                        desc_idx = 1;
-                else
-                        desc_idx = 0;
-
-                /* fall-back to lower speed if desc missing for current speed */
-                do {
-                        ds = ep->descs[desc_idx];
-                } while (!ds && --desc_idx >= 0);
-
-                if (!ds) {
-                        ret = -EINVAL;
-                        break;
-                }
-
                 ep->ep->driver_data = ep;
-                ep->ep->desc = ds;
 
-                if (needs_comp_desc) {
-                        comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
-                                        USB_DT_ENDPOINT_SIZE);
-                        ep->ep->maxburst = comp_desc->bMaxBurst + 1;
-                        ep->ep->comp_desc = comp_desc;
+                ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
+                if (ret) {
+                        pr_err("%s: config_ep_by_speed(%s) returned %d\n",
+                                        __func__, ep->ep->name, ret);
+                        break;
                 }
 
                 ret = usb_ep_enable(ep->ep);
                 if (likely(!ret)) {
                         epfile->ep = ep;
-                        epfile->in = usb_endpoint_dir_in(ds);
-                        epfile->isoc = usb_endpoint_xfer_isoc(ds);
+                        epfile->in = usb_endpoint_dir_in(ep->ep->desc);
+                        epfile->isoc = usb_endpoint_xfer_isoc(ep->ep->desc);
                 } else {
                         break;
                 }
@@ -2979,10 +2955,8 @@ static int _ffs_func_bind(struct usb_configuration *c,
         struct ffs_data *ffs = func->ffs;
 
         const int full = !!func->ffs->fs_descs_count;
-        const int high = gadget_is_dualspeed(func->gadget) &&
-                func->ffs->hs_descs_count;
-        const int super = gadget_is_superspeed(func->gadget) &&
-                func->ffs->ss_descs_count;
+        const int high = !!func->ffs->hs_descs_count;
+        const int super = !!func->ffs->ss_descs_count;
 
         int fs_len, hs_len, ss_len, ret, i;
         struct ffs_ep *eps_ptr;
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 11fe788b4308..d2dc1f00180b 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -524,6 +524,8 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
                 dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
                 return ret;
         }
+        iad_desc.bFirstInterface = ret;
+
         std_ac_if_desc.bInterfaceNumber = ret;
         uac2->ac_intf = ret;
         uac2->ac_alt = 0;
diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
index 1e9567091d86..0875d38476ee 100644
--- a/drivers/usb/gadget/udc/Kconfig
+++ b/drivers/usb/gadget/udc/Kconfig
@@ -274,7 +274,6 @@ config USB_SNP_UDC_PLAT
         tristate "Synopsys USB 2.0 Device controller"
         depends on USB_GADGET && OF && HAS_DMA
         depends on EXTCON || EXTCON=n
-        select USB_GADGET_DUALSPEED
         select USB_SNP_CORE
         default ARCH_BCM_IPROC
         help
diff --git a/drivers/usb/gadget/udc/bdc/bdc_pci.c b/drivers/usb/gadget/udc/bdc/bdc_pci.c
index 1e940f054cb8..6dbc489513cd 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_pci.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_pci.c
@@ -77,6 +77,7 @@ static int bdc_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
         if (ret) {
                 dev_err(&pci->dev,
                         "couldn't add resources to bdc device\n");
+                platform_device_put(bdc);
                 return ret;
         }
 
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 859d5b11ba4c..1f8b19d9cf97 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -180,8 +180,8 @@ EXPORT_SYMBOL_GPL(usb_ep_alloc_request);
 void usb_ep_free_request(struct usb_ep *ep,
                                        struct usb_request *req)
 {
-        ep->ops->free_request(ep, req);
         trace_usb_ep_free_request(ep, req, 0);
+        ep->ops->free_request(ep, req);
 }
 EXPORT_SYMBOL_GPL(usb_ep_free_request);
 
diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c
index e5b4ee96c4bf..56b517a38865 100644
--- a/drivers/usb/gadget/udc/fsl_udc_core.c
+++ b/drivers/usb/gadget/udc/fsl_udc_core.c
@@ -1305,7 +1305,7 @@ static void udc_reset_ep_queue(struct fsl_udc *udc, u8 pipe)
 {
         struct fsl_ep *ep = get_ep_by_pipe(udc, pipe);
 
-        if (ep->name)
+        if (ep->ep.name)
                 nuke(ep, -ESHUTDOWN);
 }
 
@@ -1693,7 +1693,7 @@ static void dtd_complete_irq(struct fsl_udc *udc)
                 curr_ep = get_ep_by_pipe(udc, i);
 
                 /* If the ep is configured */
-                if (curr_ep->name == NULL) {
+                if (!curr_ep->ep.name) {
                         WARNING("Invalid EP?");
                         continue;
                 }
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 6e87af248367..409cde4e6a51 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -2410,7 +2410,7 @@ static int renesas_usb3_remove(struct platform_device *pdev)
         __renesas_usb3_ep_free_request(usb3->ep0_req);
         if (usb3->phy)
                 phy_put(usb3->phy);
-        pm_runtime_disable(usb3_to_dev(usb3));
+        pm_runtime_disable(&pdev->dev);
 
         return 0;
 }
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 6150bed7cfa8..4fcfb3084b36 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -633,14 +633,6 @@ config USB_UHCI_ASPEED
        bool
        default y if ARCH_ASPEED
 
-config USB_UHCI_BIG_ENDIAN_MMIO
-        bool
-        default y if SPARC_LEON
-
-config USB_UHCI_BIG_ENDIAN_DESC
-        bool
-        default y if SPARC_LEON
-
 config USB_FHCI_HCD
         tristate "Freescale QE USB Host Controller support"
         depends on OF_GPIO && QE_GPIO && QUICC_ENGINE
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index facafdf8fb95..d7641cbdee43 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -774,12 +774,12 @@ static struct urb *request_single_step_set_feature_urb(
         atomic_inc(&urb->use_count);
         atomic_inc(&urb->dev->urbnum);
         urb->setup_dma = dma_map_single(
-                        hcd->self.controller,
+                        hcd->self.sysdev,
                         urb->setup_packet,
                         sizeof(struct usb_ctrlrequest),
                         DMA_TO_DEVICE);
         urb->transfer_dma = dma_map_single(
-                        hcd->self.controller,
+                        hcd->self.sysdev,
                         urb->transfer_buffer,
                         urb->transfer_buffer_length,
                         DMA_FROM_DEVICE);
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 88158324dcae..327630405695 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -1188,10 +1188,10 @@ static int submit_single_step_set_feature(
          * 15 secs after the setup
          */
         if (is_setup) {
-                /* SETUP pid */
+                /* SETUP pid, and interrupt after SETUP completion */
                 qtd_fill(ehci, qtd, urb->setup_dma,
                                 sizeof(struct usb_ctrlrequest),
-                                token | (2 /* "setup" */ << 8), 8);
+                                QTD_IOC | token | (2 /* "setup" */ << 8), 8);
 
                 submit_async(ehci, urb, &qtd_list, GFP_ATOMIC);
                 return 0; /*Return now; we shall come back after 15 seconds*/
@@ -1228,12 +1228,8 @@ static int submit_single_step_set_feature(
         qtd_prev->hw_next = QTD_NEXT(ehci, qtd->qtd_dma);
         list_add_tail(&qtd->qtd_list, head);
 
-        /* dont fill any data in such packets */
-        qtd_fill(ehci, qtd, 0, 0, token, 0);
-
-        /* by default, enable interrupt on urb completion */
-        if (likely(!(urb->transfer_flags & URB_NO_INTERRUPT)))
-                qtd->hw_token |= cpu_to_hc32(ehci, QTD_IOC);
+        /* Interrupt after STATUS completion */
+        qtd_fill(ehci, qtd, 0, 0, token | QTD_IOC, 0);
 
         submit_async(ehci, urb, &qtd_list, GFP_KERNEL);
 
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index ee9676349333..84f88fa411cd 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -74,6 +74,7 @@ static const char	hcd_name [] = "ohci_hcd";
 
 #define STATECHANGE_DELAY       msecs_to_jiffies(300)
 #define IO_WATCHDOG_DELAY       msecs_to_jiffies(275)
+#define IO_WATCHDOG_OFF         0xffffff00
 
 #include "ohci.h"
 #include "pci-quirks.h"
@@ -231,7 +232,7 @@ static int ohci_urb_enqueue (
                 }
 
                 /* Start up the I/O watchdog timer, if it's not running */
-                if (!timer_pending(&ohci->io_watchdog) &&
+                if (ohci->prev_frame_no == IO_WATCHDOG_OFF &&
                                 list_empty(&ohci->eds_in_use) &&
                                 !(ohci->flags & OHCI_QUIRK_QEMU)) {
                         ohci->prev_frame_no = ohci_frame_no(ohci);
@@ -501,6 +502,7 @@ static int ohci_init (struct ohci_hcd *ohci)
                 return 0;
 
         timer_setup(&ohci->io_watchdog, io_watchdog_func, 0);
+        ohci->prev_frame_no = IO_WATCHDOG_OFF;
 
         ohci->hcca = dma_alloc_coherent (hcd->self.controller,
                         sizeof(*ohci->hcca), &ohci->hcca_dma, GFP_KERNEL);
@@ -730,7 +732,7 @@ static void io_watchdog_func(struct timer_list *t)
         u32             head;
         struct ed       *ed;
         struct td       *td, *td_start, *td_next;
-        unsigned        frame_no;
+        unsigned        frame_no, prev_frame_no = IO_WATCHDOG_OFF;
         unsigned long   flags;
 
         spin_lock_irqsave(&ohci->lock, flags);
@@ -835,7 +837,7 @@ static void io_watchdog_func(struct timer_list *t)
                         }
                 }
                 if (!list_empty(&ohci->eds_in_use)) {
-                        ohci->prev_frame_no = frame_no;
+                        prev_frame_no = frame_no;
                         ohci->prev_wdh_cnt = ohci->wdh_cnt;
                         ohci->prev_donehead = ohci_readl(ohci,
                                         &ohci->regs->donehead);
@@ -845,6 +847,7 @@ static void io_watchdog_func(struct timer_list *t)
         }
 
  done:
+        ohci->prev_frame_no = prev_frame_no;
         spin_unlock_irqrestore(&ohci->lock, flags);
 }
 
@@ -973,6 +976,7 @@ static void ohci_stop (struct usb_hcd *hcd)
         if (quirk_nec(ohci))
                 flush_work(&ohci->nec_work);
         del_timer_sync(&ohci->io_watchdog);
+        ohci->prev_frame_no = IO_WATCHDOG_OFF;
 
         ohci_writel (ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);
         ohci_usb_reset(ohci);
diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
index fb7aaa3b9d06..634f3c7bf774 100644
--- a/drivers/usb/host/ohci-hub.c
+++ b/drivers/usb/host/ohci-hub.c
@@ -311,8 +311,10 @@ static int ohci_bus_suspend (struct usb_hcd *hcd)
                 rc = ohci_rh_suspend (ohci, 0);
         spin_unlock_irq (&ohci->lock);
 
-        if (rc == 0)
+        if (rc == 0) {
                 del_timer_sync(&ohci->io_watchdog);
+                ohci->prev_frame_no = IO_WATCHDOG_OFF;
+        }
         return rc;
 }
 
diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index b2ec8c399363..4ccb85a67bb3 100644
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -1019,6 +1019,8 @@ skip_ed:
                  * have modified this list.  normally it's just prepending
                  * entries (which we'd ignore), but paranoia won't hurt.
                  */
+                *last = ed->ed_next;
+                ed->ed_next = NULL;
                 modified = 0;
 
                 /* unlink urbs as requested, but rescan the list after
@@ -1077,21 +1079,22 @@ rescan_this:
                         goto rescan_this;
 
                 /*
-                 * If no TDs are queued, take ED off the ed_rm_list.
+                 * If no TDs are queued, ED is now idle.
                  * Otherwise, if the HC is running, reschedule.
-                 * If not, leave it on the list for further dequeues.
+                 * If the HC isn't running, add ED back to the
+                 * start of the list for later processing.
                  */
                 if (list_empty(&ed->td_list)) {
-                        *last = ed->ed_next;
-                        ed->ed_next = NULL;
                         ed->state = ED_IDLE;
                         list_del(&ed->in_use_list);
                 } else if (ohci->rh_state == OHCI_RH_RUNNING) {
-                        *last = ed->ed_next;
-                        ed->ed_next = NULL;
                         ed_schedule(ohci, ed);
                 } else {
-                        last = &ed->ed_next;
+                        ed->ed_next = ohci->ed_rm_list;
+                        ohci->ed_rm_list = ed;
+                        /* Don't loop on the same ED */
+                        if (last == &ohci->ed_rm_list)
+                                last = &ed->ed_next;
                 }
 
                 if (modified)
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 161536717025..67ad4bb6919a 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -66,6 +66,23 @@
 #define AX_INDXC                0x30
 #define AX_DATAC                0x34
 
+#define PT_ADDR_INDX            0xE8
+#define PT_READ_INDX            0xE4
+#define PT_SIG_1_ADDR           0xA520
+#define PT_SIG_2_ADDR           0xA521
+#define PT_SIG_3_ADDR           0xA522
+#define PT_SIG_4_ADDR           0xA523
+#define PT_SIG_1_DATA           0x78
+#define PT_SIG_2_DATA           0x56
+#define PT_SIG_3_DATA           0x34
+#define PT_SIG_4_DATA           0x12
+#define PT4_P1_REG              0xB521
+#define PT4_P2_REG              0xB522
+#define PT2_P1_REG              0xD520
+#define PT2_P2_REG              0xD521
+#define PT1_P1_REG              0xD522
+#define PT1_P2_REG              0xD523
+
 #define NB_PCIE_INDX_ADDR       0xe0
 #define NB_PCIE_INDX_DATA       0xe4
 #define PCIE_P_CNTL             0x10040
@@ -513,6 +530,98 @@ void usb_amd_dev_put(void)
 EXPORT_SYMBOL_GPL(usb_amd_dev_put);
 
 /*
+ * Check if port is disabled in BIOS on AMD Promontory host.
+ * BIOS Disabled ports may wake on connect/disconnect and need
+ * driver workaround to keep them disabled.
+ * Returns true if port is marked disabled.
+ */
+bool usb_amd_pt_check_port(struct device *device, int port)
+{
+        unsigned char value, port_shift;
+        struct pci_dev *pdev;
+        u16 reg;
+
+        pdev = to_pci_dev(device);
+        pci_write_config_word(pdev, PT_ADDR_INDX, PT_SIG_1_ADDR);
+
+        pci_read_config_byte(pdev, PT_READ_INDX, &value);
+        if (value != PT_SIG_1_DATA)
+                return false;
+
+        pci_write_config_word(pdev, PT_ADDR_INDX, PT_SIG_2_ADDR);
+
+        pci_read_config_byte(pdev, PT_READ_INDX, &value);
+        if (value != PT_SIG_2_DATA)
+                return false;
+
+        pci_write_config_word(pdev, PT_ADDR_INDX, PT_SIG_3_ADDR);
+
+        pci_read_config_byte(pdev, PT_READ_INDX, &value);
+        if (value != PT_SIG_3_DATA)
+                return false;
+
+        pci_write_config_word(pdev, PT_ADDR_INDX, PT_SIG_4_ADDR);
+
+        pci_read_config_byte(pdev, PT_READ_INDX, &value);
+        if (value != PT_SIG_4_DATA)
+                return false;
+
+        /* Check disabled port setting, if bit is set port is enabled */
+        switch (pdev->device) {
+        case 0x43b9:
+        case 0x43ba:
+        /*
+         * device is AMD_PROMONTORYA_4(0x43b9) or PROMONTORYA_3(0x43ba)
+         * PT4_P1_REG bits[7..1] represents USB2.0 ports 6 to 0
+         * PT4_P2_REG bits[6..0] represents ports 13 to 7
+         */
+                if (port > 6) {
+                        reg = PT4_P2_REG;
+                        port_shift = port - 7;
+                } else {
+                        reg = PT4_P1_REG;
+                        port_shift = port + 1;
+                }
+                break;
+        case 0x43bb:
+        /*
+         * device is AMD_PROMONTORYA_2(0x43bb)
+         * PT2_P1_REG bits[7..5] represents USB2.0 ports 2 to 0
+         * PT2_P2_REG bits[5..0] represents ports 9 to 3
+         */
+                if (port > 2) {
+                        reg = PT2_P2_REG;
+                        port_shift = port - 3;
+                } else {
+                        reg = PT2_P1_REG;
+                        port_shift = port + 5;
+                }
+                break;
+        case 0x43bc:
+        /*
+         * device is AMD_PROMONTORYA_1(0x43bc)
+         * PT1_P1_REG[7..4] represents USB2.0 ports 3 to 0
+         * PT1_P2_REG[5..0] represents ports 9 to 4
+         */
+                if (port > 3) {
+                        reg = PT1_P2_REG;
+                        port_shift = port - 4;
+                } else {
+                        reg = PT1_P1_REG;
+                        port_shift = port + 4;
+                }
+                break;
+        default:
+                return false;
+        }
+        pci_write_config_word(pdev, PT_ADDR_INDX, reg);
+        pci_read_config_byte(pdev, PT_READ_INDX, &value);
+
+        return !(value & BIT(port_shift));
+}
+EXPORT_SYMBOL_GPL(usb_amd_pt_check_port);
+
+/*
  * Make sure the controller is completely inactive, unable to
  * generate interrupts or do DMA.
  */
diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h
index b68dcb5dd0fd..4ca0d9b7e463 100644
--- a/drivers/usb/host/pci-quirks.h
+++ b/drivers/usb/host/pci-quirks.h
@@ -17,6 +17,7 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev);
 void usb_disable_xhci_ports(struct pci_dev *xhci_pdev);
 void sb800_prefetch(struct device *dev, int on);
 bool usb_xhci_needs_pci_reset(struct pci_dev *pdev);
+bool usb_amd_pt_check_port(struct device *device, int port);
 #else
 struct pci_dev;
 static inline void usb_amd_quirk_pll_disable(void) {}
@@ -25,6 +26,10 @@ static inline void usb_asmedia_modifyflowcontrol(struct pci_dev *pdev) {}
 static inline void usb_amd_dev_put(void) {}
 static inline void usb_disable_xhci_ports(struct pci_dev *xhci_pdev) {}
 static inline void sb800_prefetch(struct device *dev, int on) {}
+static inline bool usb_amd_pt_check_port(struct device *device, int port)
+{
+        return false;
+}
 #endif  /* CONFIG_USB_PCI */
 
 #endif  /*  __LINUX_USB_PCI_QUIRKS_H  */
diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
index e26e685d8a57..5851052d4668 100644
--- a/drivers/usb/host/xhci-debugfs.c
+++ b/drivers/usb/host/xhci-debugfs.c
@@ -211,7 +211,7 @@ static void xhci_ring_dump_segment(struct seq_file *s,
 static int xhci_ring_trb_show(struct seq_file *s, void *unused)
 {
         int                     i;
-        struct xhci_ring        *ring = s->private;
+        struct xhci_ring        *ring = *(struct xhci_ring **)s->private;
         struct xhci_segment     *seg = ring->first_seg;
 
         for (i = 0; i < ring->num_segs; i++) {
@@ -387,7 +387,7 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci,
 
         snprintf(epriv->name, sizeof(epriv->name), "ep%02d", ep_index);
         epriv->root = xhci_debugfs_create_ring_dir(xhci,
-                                                   &dev->eps[ep_index].new_ring,
+                                                   &dev->eps[ep_index].ring,
                                                    epriv->name,
                                                    spriv->root);
         spriv->eps[ep_index] = epriv;
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 46d5e08f05f1..72ebbc908e19 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1224,17 +1224,17 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                                 temp = readl(port_array[wIndex]);
                                 break;
                         }
-
-                        /* Software should not attempt to set
-                         * port link state above '3' (U3) and the port
-                         * must be enabled.
-                         */
-                        if ((temp & PORT_PE) == 0 ||
-                                (link_state > USB_SS_PORT_LS_U3)) {
-                                xhci_warn(xhci, "Cannot set link state.\n");
+                        /* Port must be enabled */
+                        if (!(temp & PORT_PE)) {
+                                retval = -ENODEV;
+                                break;
+                        }
+                        /* Can't set port link state above '3' (U3) */
+                        if (link_state > USB_SS_PORT_LS_U3) {
+                                xhci_warn(xhci, "Cannot set port %d link state %d\n",
+                                         wIndex, link_state);
                                 goto error;
                         }
-
                         if (link_state == USB_SS_PORT_LS_U3) {
                                 slot_id = xhci_find_slot_id_by_port(hcd, xhci,
                                                 wIndex + 1);
@@ -1522,6 +1522,13 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                                 t2 |= PORT_WKOC_E | PORT_WKCONN_E;
                                 t2 &= ~PORT_WKDISC_E;
                         }
+
+                        if ((xhci->quirks & XHCI_U2_DISABLE_WAKE) &&
+                            (hcd->speed < HCD_USB3)) {
+                                if (usb_amd_pt_check_port(hcd->self.controller,
+                                                          port_index))
+                                        t2 &= ~PORT_WAKE_BITS;
+                        }
                 } else
                         t2 &= ~PORT_WAKE_BITS;
 
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 6c79037876db..5262fa571a5d 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -42,6 +42,10 @@
 #define PCI_DEVICE_ID_INTEL_APL_XHCI                    0x5aa8
 #define PCI_DEVICE_ID_INTEL_DNV_XHCI                    0x19d0
 
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_4                 0x43b9
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_3                 0x43ba
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_2                 0x43bb
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_1                 0x43bc
 #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI                0x1142
 
 static const char hcd_name[] = "xhci_hcd";
@@ -125,6 +129,13 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_AMD)
                 xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 
+        if ((pdev->vendor == PCI_VENDOR_ID_AMD) &&
+                ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) ||
+                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_3) ||
+                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2) ||
+                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_1)))
+                xhci->quirks |= XHCI_U2_DISABLE_WAKE;
+
         if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
                 xhci->quirks |= XHCI_LPM_SUPPORT;
                 xhci->quirks |= XHCI_INTEL_HOST;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 1eeb3396300f..25d4b748a56f 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -646,8 +646,6 @@ static void xhci_stop(struct usb_hcd *hcd)
                 return;
         }
 
-        xhci_debugfs_exit(xhci);
-
         xhci_dbc_exit(xhci);
 
         spin_lock_irq(&xhci->lock);
@@ -680,6 +678,7 @@ static void xhci_stop(struct usb_hcd *hcd)
 
         xhci_dbg_trace(xhci, trace_xhci_dbg_init, "cleaning up memory");
         xhci_mem_cleanup(xhci);
+        xhci_debugfs_exit(xhci);
         xhci_dbg_trace(xhci, trace_xhci_dbg_init,
                         "xhci_stop completed - status = %x",
                         readl(&xhci->op_regs->status));
@@ -1014,6 +1013,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 
                 xhci_dbg(xhci, "cleaning up memory\n");
                 xhci_mem_cleanup(xhci);
+                xhci_debugfs_exit(xhci);
                 xhci_dbg(xhci, "xhci_stop completed - status = %x\n",
                             readl(&xhci->op_regs->status));
 
@@ -3544,12 +3544,10 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
                 virt_dev->eps[i].ep_state &= ~EP_STOP_CMD_PENDING;
                 del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
         }
-
+        xhci_debugfs_remove_slot(xhci, udev->slot_id);
         ret = xhci_disable_slot(xhci, udev->slot_id);
-        if (ret) {
-                xhci_debugfs_remove_slot(xhci, udev->slot_id);
+        if (ret)
                 xhci_free_virt_device(xhci, udev->slot_id);
-        }
 }
 
 int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 96099a245c69..e4d7d3d06a75 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1822,7 +1822,7 @@ struct xhci_hcd {
 /* For controller with a broken Port Disable implementation */
 #define XHCI_BROKEN_PORT_PED    (1 << 25)
 #define XHCI_LIMIT_ENDPOINT_INTERVAL_7  (1 << 26)
-/* Reserved. It was XHCI_U2_DISABLE_WAKE */
+#define XHCI_U2_DISABLE_WAKE    (1 << 27)
 #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28)
 #define XHCI_HW_LPM_DISABLE     (1 << 29)
 
diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
index 63b9e85dc0e9..236a60f53099 100644
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -42,6 +42,9 @@
 #define USB_DEVICE_ID_LD_MICROCASSYTIME         0x1033  /* USB Product ID of Micro-CASSY Time (reserved) */
 #define USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE  0x1035  /* USB Product ID of Micro-CASSY Temperature */
 #define USB_DEVICE_ID_LD_MICROCASSYPH           0x1038  /* USB Product ID of Micro-CASSY pH */
+#define USB_DEVICE_ID_LD_POWERANALYSERCASSY     0x1040  /* USB Product ID of Power Analyser CASSY */
+#define USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY       0x1042  /* USB Product ID of Converter Controller CASSY */
+#define USB_DEVICE_ID_LD_MACHINETESTCASSY       0x1043  /* USB Product ID of Machine Test CASSY */
 #define USB_DEVICE_ID_LD_JWM            0x1080  /* USB Product ID of Joule and Wattmeter */
 #define USB_DEVICE_ID_LD_DMMP           0x1081  /* USB Product ID of Digital Multimeter P (reserved) */
 #define USB_DEVICE_ID_LD_UMIP           0x1090  /* USB Product ID of UMI P */
@@ -84,6 +87,9 @@ static const struct usb_device_id ld_usb_table[] = {
         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTIME) },
         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE) },
         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYPH) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POWERANALYSERCASSY) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MACHINETESTCASSY) },
         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_JWM) },
         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_DMMP) },
         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_UMIP) },
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 968bf1e8b0fe..eef4ad578b31 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2708,7 +2708,8 @@ static int musb_resume(struct device *dev)
         if ((devctl & mask) != (musb->context.devctl & mask))
                 musb->port1_status = 0;
 
-        musb_start(musb);
+        musb_enable_interrupts(musb);
+        musb_platform_enable(musb);
 
         spin_lock_irqsave(&musb->lock, flags);
         error = musb_run_resume_work(musb);
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 394b4ac86161..45ed32c2cba9 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -391,13 +391,7 @@ static void musb_advance_schedule(struct musb *musb, struct urb *urb,
                 }
         }
 
-        /*
-         * The pipe must be broken if current urb->status is set, so don't
-         * start next urb.
-         * TODO: to minimize the risk of regression, only check urb->status
-         * for RX, until we have a test case to understand the behavior of TX.
-         */
-        if ((!status || !is_in) && qh && qh->is_ready) {
+        if (qh != NULL && qh->is_ready) {
                 musb_dbg(musb, "... next ep%d %cX urb %p",
                     hw_ep->epnum, is_in ? 'R' : 'T', next_urb(qh));
                 musb_start_urb(musb, is_in, qh);
diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
index da031c45395a..fbec863350f6 100644
--- a/drivers/usb/phy/phy-mxs-usb.c
+++ b/drivers/usb/phy/phy-mxs-usb.c
@@ -602,6 +602,9 @@ static enum usb_charger_type mxs_phy_charger_detect(struct usb_phy *phy)
         void __iomem *base = phy->io_priv;
         enum usb_charger_type chgr_type = UNKNOWN_TYPE;
 
+        if (!regmap)
+                return UNKNOWN_TYPE;
+
         if (mxs_charger_data_contact_detect(mxs_phy))
                 return chgr_type;
 
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index 5925d111bd47..39fa2fc1b8b7 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -982,6 +982,10 @@ static int usbhsf_dma_prepare_pop_with_usb_dmac(struct usbhs_pkt *pkt,
         if ((uintptr_t)pkt->buf & (USBHS_USB_DMAC_XFER_SIZE - 1))
                 goto usbhsf_pio_prepare_pop;
 
+        /* return at this time if the pipe is running */
+        if (usbhs_pipe_is_running(pipe))
+                return 0;
+
         usbhs_pipe_config_change_bfre(pipe, 1);
 
         ret = usbhsf_fifo_select(pipe, fifo, 0);
@@ -1172,6 +1176,7 @@ static int usbhsf_dma_pop_done_with_usb_dmac(struct usbhs_pkt *pkt,
         usbhsf_fifo_clear(pipe, fifo);
         pkt->actual = usbhs_dma_calc_received_size(pkt, chan, rcv_len);
 
+        usbhs_pipe_running(pipe, 0);
         usbhsf_dma_stop(pipe, fifo);
         usbhsf_dma_unmap(pkt);
         usbhsf_fifo_unselect(pipe, pipe->fifo);
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 5db8ed517e0e..2d8d9150da0c 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -241,6 +241,7 @@ static void option_instat_callback(struct urb *urb);
 #define QUECTEL_PRODUCT_EC21                    0x0121
 #define QUECTEL_PRODUCT_EC25                    0x0125
 #define QUECTEL_PRODUCT_BG96                    0x0296
+#define QUECTEL_PRODUCT_EP06                    0x0306
 
 #define CMOTECH_VENDOR_ID                       0x16d8
 #define CMOTECH_PRODUCT_6001                    0x6001
@@ -689,6 +690,10 @@ static const struct option_blacklist_info yuga_clm920_nc5_blacklist = {
         .reserved = BIT(1) | BIT(4),
 };
 
+static const struct option_blacklist_info quectel_ep06_blacklist = {
+        .reserved = BIT(4) | BIT(5),
+};
+
 static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -1203,6 +1208,8 @@ static const struct usb_device_id option_ids[] = {
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06),
+          .driver_info = (kernel_ulong_t)&quectel_ep06_blacklist },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
index 49e552472c3f..dd8ef36ab10e 100644
--- a/drivers/usb/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -73,6 +73,7 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
                         goto err;
 
                 sdev->ud.tcp_socket = socket;
+                sdev->ud.sockfd = sockfd;
 
                 spin_unlock_irq(&sdev->ud.lock);
 
@@ -172,6 +173,7 @@ static void stub_shutdown_connection(struct usbip_device *ud)
         if (ud->tcp_socket) {
                 sockfd_put(ud->tcp_socket);
                 ud->tcp_socket = NULL;
+                ud->sockfd = -1;
         }
 
         /* 3. free used data */
@@ -266,6 +268,7 @@ static struct stub_device *stub_device_alloc(struct usb_device *udev)
         sdev->ud.status         = SDEV_ST_AVAILABLE;
         spin_lock_init(&sdev->ud.lock);
         sdev->ud.tcp_socket     = NULL;
+        sdev->ud.sockfd         = -1;
 
         INIT_LIST_HEAD(&sdev->priv_init);
         INIT_LIST_HEAD(&sdev->priv_tx);
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index c3e1008aa491..20e3d4609583 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -984,6 +984,7 @@ static void vhci_shutdown_connection(struct usbip_device *ud)
         if (vdev->ud.tcp_socket) {
                 sockfd_put(vdev->ud.tcp_socket);
                 vdev->ud.tcp_socket = NULL;
+                vdev->ud.sockfd = -1;
         }
         pr_info("release socket\n");
 
@@ -1030,6 +1031,7 @@ static void vhci_device_reset(struct usbip_device *ud)
         if (ud->tcp_socket) {
                 sockfd_put(ud->tcp_socket);
                 ud->tcp_socket = NULL;
+                ud->sockfd = -1;
         }
         ud->status = VDEV_ST_NULL;
 
diff --git a/drivers/video/fbdev/geode/video_gx.c b/drivers/video/fbdev/geode/video_gx.c
index 6082f653c68a..67773e8bbb95 100644
--- a/drivers/video/fbdev/geode/video_gx.c
+++ b/drivers/video/fbdev/geode/video_gx.c
@@ -127,7 +127,7 @@ void gx_set_dclk_frequency(struct fb_info *info)
         int timeout = 1000;
 
         /* Rev. 1 Geode GXs use a 14 MHz reference clock instead of 48 MHz. */
-        if (cpu_data(0).x86_mask == 1) {
+        if (cpu_data(0).x86_stepping == 1) {
                 pll_table = gx_pll_table_14MHz;
                 pll_table_len = ARRAY_SIZE(gx_pll_table_14MHz);
         } else {
diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
index 753d9cb437d0..aedbee3b2838 100644
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@ -60,6 +60,7 @@ struct sock_mapping {
         bool active_socket;
         struct list_head list;
         struct socket *sock;
+        atomic_t refcount;
         union {
                 struct {
                         int irq;
@@ -93,6 +94,32 @@ struct sock_mapping {
         };
 };
 
+static inline struct sock_mapping *pvcalls_enter_sock(struct socket *sock)
+{
+        struct sock_mapping *map;
+
+        if (!pvcalls_front_dev ||
+                dev_get_drvdata(&pvcalls_front_dev->dev) == NULL)
+                return ERR_PTR(-ENOTCONN);
+
+        map = (struct sock_mapping *)sock->sk->sk_send_head;
+        if (map == NULL)
+                return ERR_PTR(-ENOTSOCK);
+
+        pvcalls_enter();
+        atomic_inc(&map->refcount);
+        return map;
+}
+
+static inline void pvcalls_exit_sock(struct socket *sock)
+{
+        struct sock_mapping *map;
+
+        map = (struct sock_mapping *)sock->sk->sk_send_head;
+        atomic_dec(&map->refcount);
+        pvcalls_exit();
+}
+
 static inline int get_request(struct pvcalls_bedata *bedata, int *req_id)
 {
         *req_id = bedata->ring.req_prod_pvt & (RING_SIZE(&bedata->ring) - 1);
@@ -369,31 +396,23 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
         if (addr->sa_family != AF_INET || sock->type != SOCK_STREAM)
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
 
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *)sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         spin_lock(&bedata->socket_lock);
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         ret = create_active(map, &evtchn);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
 
@@ -423,7 +442,7 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
         smp_rmb();
         ret = bedata->rsp[req_id].ret;
         bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -488,23 +507,15 @@ int pvcalls_front_sendmsg(struct socket *sock, struct msghdr *msg,
         if (flags & (MSG_CONFIRM|MSG_DONTROUTE|MSG_EOR|MSG_OOB))
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         mutex_lock(&map->active.out_mutex);
         if ((flags & MSG_DONTWAIT) && !pvcalls_front_write_todo(map)) {
                 mutex_unlock(&map->active.out_mutex);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EAGAIN;
         }
         if (len > INT_MAX)
@@ -526,7 +537,7 @@ again:
                 tot_sent = sent;
 
         mutex_unlock(&map->active.out_mutex);
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return tot_sent;
 }
 
@@ -591,19 +602,11 @@ int pvcalls_front_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
         if (flags & (MSG_CMSG_CLOEXEC|MSG_ERRQUEUE|MSG_OOB|MSG_TRUNC))
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         mutex_lock(&map->active.in_mutex);
         if (len > XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER))
                 len = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
@@ -623,7 +626,7 @@ int pvcalls_front_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                 ret = 0;
 
         mutex_unlock(&map->active.in_mutex);
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -637,24 +640,16 @@ int pvcalls_front_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
         if (addr->sa_family != AF_INET || sock->type != SOCK_STREAM)
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (map == NULL) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         spin_lock(&bedata->socket_lock);
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         req = RING_GET_REQUEST(&bedata->ring, req_id);
@@ -684,7 +679,7 @@ int pvcalls_front_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
         bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
 
         map->passive.status = PVCALLS_STATUS_BIND;
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return 0;
 }
 
@@ -695,21 +690,13 @@ int pvcalls_front_listen(struct socket *sock, int backlog)
         struct xen_pvcalls_request *req;
         int notify, req_id, ret;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         if (map->passive.status != PVCALLS_STATUS_BIND) {
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EOPNOTSUPP;
         }
 
@@ -717,7 +704,7 @@ int pvcalls_front_listen(struct socket *sock, int backlog)
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         req = RING_GET_REQUEST(&bedata->ring, req_id);
@@ -741,7 +728,7 @@ int pvcalls_front_listen(struct socket *sock, int backlog)
         bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
 
         map->passive.status = PVCALLS_STATUS_LISTEN;
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -753,21 +740,13 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
         struct xen_pvcalls_request *req;
         int notify, req_id, ret, evtchn, nonblock;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         if (map->passive.status != PVCALLS_STATUS_LISTEN) {
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EINVAL;
         }
 
@@ -785,13 +764,13 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                         goto received;
                 }
                 if (nonblock) {
-                        pvcalls_exit();
+                        pvcalls_exit_sock(sock);
                         return -EAGAIN;
                 }
                 if (wait_event_interruptible(map->passive.inflight_accept_req,
                         !test_and_set_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                                           (void *)&map->passive.flags))) {
-                        pvcalls_exit();
+                        pvcalls_exit_sock(sock);
                         return -EINTR;
                 }
         }
@@ -802,7 +781,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         map2 = kzalloc(sizeof(*map2), GFP_ATOMIC);
@@ -810,7 +789,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -ENOMEM;
         }
         ret = create_active(map2, &evtchn);
@@ -819,7 +798,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         list_add_tail(&map2->list, &bedata->socket_mappings);
@@ -841,13 +820,13 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
         /* We could check if we have received a response before returning. */
         if (nonblock) {
                 WRITE_ONCE(map->passive.inflight_req_id, req_id);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EAGAIN;
         }
 
         if (wait_event_interruptible(bedata->inflight_req,
                 READ_ONCE(bedata->rsp[req_id].req_id) == req_id)) {
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EINTR;
         }
         /* read req_id, then the content */
@@ -862,7 +841,7 @@ received:
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 pvcalls_front_free_map(bedata, map2);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -ENOMEM;
         }
         newsock->sk->sk_send_head = (void *)map2;
@@ -874,7 +853,7 @@ received:
         clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, (void *)&map->passive.flags);
         wake_up(&map->passive.inflight_accept_req);
 
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -965,23 +944,16 @@ __poll_t pvcalls_front_poll(struct file *file, struct socket *sock,
         struct sock_mapping *map;
         __poll_t ret;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
                 return EPOLLNVAL;
-        }
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return EPOLLNVAL;
-        }
         if (map->active_socket)
                 ret = pvcalls_front_poll_active(file, bedata, map, wait);
         else
                 ret = pvcalls_front_poll_passive(file, bedata, map, wait);
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -995,25 +967,20 @@ int pvcalls_front_release(struct socket *sock)
         if (sock->sk == NULL)
                 return 0;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -EIO;
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map)) {
+                if (PTR_ERR(map) == -ENOTCONN)
+                        return -EIO;
+                else
+                        return 0;
         }
-
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (map == NULL) {
-                pvcalls_exit();
-                return 0;
-        }
-
         spin_lock(&bedata->socket_lock);
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         sock->sk->sk_send_head = NULL;
@@ -1043,14 +1010,20 @@ int pvcalls_front_release(struct socket *sock)
                 /*
                  * We need to make sure that sendmsg/recvmsg on this socket have
                  * not started before we've cleared sk_send_head here. The
-                 * easiest (though not optimal) way to guarantee this is to see
-                 * that no pvcall (other than us) is in progress.
+                 * easiest way to guarantee this is to see that no pvcalls
+                 * (other than us) is in progress on this socket.
                  */
-                while (atomic_read(&pvcalls_refcount) > 1)
+                while (atomic_read(&map->refcount) > 1)
                         cpu_relax();
 
                 pvcalls_front_free_map(bedata, map);
         } else {
+                wake_up(&bedata->inflight_req);
+                wake_up(&map->passive.inflight_accept_req);
+
+                while (atomic_read(&map->refcount) > 1)
+                        cpu_relax();
+
                 spin_lock(&bedata->socket_lock);
                 list_del(&map->list);
                 spin_unlock(&bedata->socket_lock);
diff --git a/drivers/xen/tmem.c b/drivers/xen/tmem.c
index bf13d1ec51f3..04e7b3b29bac 100644
--- a/drivers/xen/tmem.c
+++ b/drivers/xen/tmem.c
@@ -284,6 +284,10 @@ static int tmem_frontswap_store(unsigned type, pgoff_t offset,
         int pool = tmem_frontswap_poolid;
         int ret;
 
+        /* THP isn't supported */
+        if (PageTransHuge(page))
+                return -1;
+
         if (pool < 0)
                 return -1;
         if (ind64 != ind)
diff --git a/drivers/xen/xenbus/xenbus.h b/drivers/xen/xenbus/xenbus.h
index 149c5e7efc89..092981171df1 100644
--- a/drivers/xen/xenbus/xenbus.h
+++ b/drivers/xen/xenbus/xenbus.h
@@ -76,6 +76,7 @@ struct xb_req_data {
         struct list_head list;
         wait_queue_head_t wq;
         struct xsd_sockmsg msg;
+        uint32_t caller_req_id;
         enum xsd_sockmsg_type type;
         char *body;
         const struct kvec *vec;
diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c
index 5b081a01779d..d239fc3c5e3d 100644
--- a/drivers/xen/xenbus/xenbus_comms.c
+++ b/drivers/xen/xenbus/xenbus_comms.c
@@ -309,6 +309,7 @@ static int process_msg(void)
                         goto out;
 
                 if (req->state == xb_req_state_wait_reply) {
+                        req->msg.req_id = req->caller_req_id;
                         req->msg.type = state.msg.type;
                         req->msg.len = state.msg.len;
                         req->body = state.body;
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index 3e59590c7254..3f3b29398ab8 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -227,6 +227,8 @@ static void xs_send(struct xb_req_data *req, struct xsd_sockmsg *msg)
         req->state = xb_req_state_queued;
         init_waitqueue_head(&req->wq);
 
+        /* Save the caller req_id and restore it later in the reply */
+        req->caller_req_id = req->msg.req_id;
         req->msg.req_id = xs_request_enter(req);
 
         mutex_lock(&xb_write_mutex);
@@ -310,6 +312,7 @@ static void *xs_talkv(struct xenbus_transaction t,
         req->num_vecs = num_vecs;
         req->cb = xs_wake_up;
 
+        msg.req_id = 0;
         msg.tx_id = t.id;
         msg.type = type;
         msg.len = 0;
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index e4054e533f6d..f94b2d8c744a 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1264,7 +1264,16 @@ again:
         while (node) {
                 ref = rb_entry(node, struct prelim_ref, rbnode);
                 node = rb_next(&ref->rbnode);
-                WARN_ON(ref->count < 0);
+                /*
+                 * ref->count < 0 can happen here if there are delayed
+                 * refs with a node->action of BTRFS_DROP_DELAYED_REF.
+                 * prelim_ref_insert() relies on this when merging
+                 * identical refs to keep the overall count correct.
+                 * prelim_ref_insert() will merge only those refs
+                 * which compare identically.  Any refs having
+                 * e.g. different offsets would not be merged,
+                 * and would retain their original ref->count < 0.
+                 */
                 if (roots && ref->count && ref->root_id && ref->parent == 0) {
                         if (sc && sc->root_objectid &&
                             ref->root_id != sc->root_objectid) {
diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
index a1a40cf382e3..7ab5e0128f0c 100644
--- a/fs/btrfs/delayed-ref.c
+++ b/fs/btrfs/delayed-ref.c
@@ -821,7 +821,8 @@ int btrfs_add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
         spin_unlock(&delayed_refs->lock);
 
         if (qrecord_inserted)
-                return btrfs_qgroup_trace_extent_post(fs_info, record);
+                btrfs_qgroup_trace_extent_post(fs_info, record);
+
         return 0;
 
 free_head_ref:
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 05751a677da4..c1618ab9fecf 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2147,6 +2147,10 @@ int btrfs_discard_extent(struct btrfs_fs_info *fs_info, u64 bytenr,
                         u64 bytes;
                         struct request_queue *req_q;
 
+                        if (!stripe->dev->bdev) {
+                                ASSERT(btrfs_test_opt(fs_info, DEGRADED));
+                                continue;
+                        }
                         req_q = bdev_get_queue(stripe->dev->bdev);
                         if (!blk_queue_discard(req_q))
                                 continue;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 53ca025655fc..a79299a89b7d 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1335,8 +1335,11 @@ next_slot:
                 leaf = path->nodes[0];
                 if (path->slots[0] >= btrfs_header_nritems(leaf)) {
                         ret = btrfs_next_leaf(root, path);
-                        if (ret < 0)
+                        if (ret < 0) {
+                                if (cow_start != (u64)-1)
+                                        cur_offset = cow_start;
                                 goto error;
+                        }
                         if (ret > 0)
                                 break;
                         leaf = path->nodes[0];
@@ -3385,6 +3388,11 @@ int btrfs_orphan_add(struct btrfs_trans_handle *trans,
                 ret = btrfs_orphan_reserve_metadata(trans, inode);
                 ASSERT(!ret);
                 if (ret) {
+                        /*
+                         * dec doesn't need spin_lock as ->orphan_block_rsv
+                         * would be released only if ->orphan_inodes is
+                         * zero.
+                         */
                         atomic_dec(&root->orphan_inodes);
                         clear_bit(BTRFS_INODE_ORPHAN_META_RESERVED,
                                   &inode->runtime_flags);
@@ -3399,12 +3407,17 @@ int btrfs_orphan_add(struct btrfs_trans_handle *trans,
         if (insert >= 1) {
                 ret = btrfs_insert_orphan_item(trans, root, btrfs_ino(inode));
                 if (ret) {
-                        atomic_dec(&root->orphan_inodes);
                         if (reserve) {
                                 clear_bit(BTRFS_INODE_ORPHAN_META_RESERVED,
                                           &inode->runtime_flags);
                                 btrfs_orphan_release_metadata(inode);
                         }
+                        /*
+                         * btrfs_orphan_commit_root may race with us and set
+                         * ->orphan_block_rsv to zero, in order to avoid that,
+                         * decrease ->orphan_inodes after everything is done.
+                         */
+                        atomic_dec(&root->orphan_inodes);
                         if (ret != -EEXIST) {
                                 clear_bit(BTRFS_INODE_HAS_ORPHAN_ITEM,
                                           &inode->runtime_flags);
@@ -3436,28 +3449,26 @@ static int btrfs_orphan_del(struct btrfs_trans_handle *trans,
 {
         struct btrfs_root *root = inode->root;
         int delete_item = 0;
-        int release_rsv = 0;
         int ret = 0;
 
-        spin_lock(&root->orphan_lock);
         if (test_and_clear_bit(BTRFS_INODE_HAS_ORPHAN_ITEM,
                                &inode->runtime_flags))
                 delete_item = 1;
 
+        if (delete_item && trans)
+                ret = btrfs_del_orphan_item(trans, root, btrfs_ino(inode));
+
         if (test_and_clear_bit(BTRFS_INODE_ORPHAN_META_RESERVED,
                                &inode->runtime_flags))
-                release_rsv = 1;
-        spin_unlock(&root->orphan_lock);
+                btrfs_orphan_release_metadata(inode);
 
-        if (delete_item) {
+        /*
+         * btrfs_orphan_commit_root may race with us and set ->orphan_block_rsv
+         * to zero, in order to avoid that, decrease ->orphan_inodes after
+         * everything is done.
+         */
+        if (delete_item)
                 atomic_dec(&root->orphan_inodes);
-                if (trans)
-                        ret = btrfs_del_orphan_item(trans, root,
-                                                    btrfs_ino(inode));
-        }
-
-        if (release_rsv)
-                btrfs_orphan_release_metadata(inode);
 
         return ret;
 }
@@ -5281,7 +5292,7 @@ void btrfs_evict_inode(struct inode *inode)
         trace_btrfs_inode_evict(inode);
 
         if (!root) {
-                kmem_cache_free(btrfs_inode_cachep, BTRFS_I(inode));
+                clear_inode(inode);
                 return;
         }
 
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 9e61dd624f7b..aa259d6986e1 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1442,8 +1442,13 @@ int btrfs_qgroup_trace_extent_post(struct btrfs_fs_info *fs_info,
         int ret;
 
         ret = btrfs_find_all_roots(NULL, fs_info, bytenr, 0, &old_root, false);
-        if (ret < 0)
-                return ret;
+        if (ret < 0) {
+                fs_info->qgroup_flags |= BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT;
+                btrfs_warn(fs_info,
+"error accounting new delayed refs extent (err code: %d), quota inconsistent",
+                        ret);
+                return 0;
+        }
 
         /*
          * Here we don't need to get the lock of
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index afadaadab18e..4fd19b4d6675 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -29,6 +29,7 @@
 #include "hash.h"
 #include "compression.h"
 #include "qgroup.h"
+#include "inode-map.h"
 
 /* magic values for the inode_only field in btrfs_log_inode:
  *
@@ -2472,6 +2473,9 @@ static noinline int walk_down_log_tree(struct btrfs_trans_handle *trans,
                                         clean_tree_block(fs_info, next);
                                         btrfs_wait_tree_block_writeback(next);
                                         btrfs_tree_unlock(next);
+                                } else {
+                                        if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags))
+                                                clear_extent_buffer_dirty(next);
                                 }
 
                                 WARN_ON(root_owner !=
@@ -2552,6 +2556,9 @@ static noinline int walk_up_log_tree(struct btrfs_trans_handle *trans,
                                         clean_tree_block(fs_info, next);
                                         btrfs_wait_tree_block_writeback(next);
                                         btrfs_tree_unlock(next);
+                                } else {
+                                        if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags))
+                                                clear_extent_buffer_dirty(next);
                                 }
 
                                 WARN_ON(root_owner != BTRFS_TREE_LOG_OBJECTID);
@@ -2630,6 +2637,9 @@ static int walk_log_tree(struct btrfs_trans_handle *trans,
                                 clean_tree_block(fs_info, next);
                                 btrfs_wait_tree_block_writeback(next);
                                 btrfs_tree_unlock(next);
+                        } else {
+                                if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags))
+                                        clear_extent_buffer_dirty(next);
                         }
 
                         WARN_ON(log->root_key.objectid !=
@@ -3018,13 +3028,14 @@ static void free_log_tree(struct btrfs_trans_handle *trans,
 
         while (1) {
                 ret = find_first_extent_bit(&log->dirty_log_pages,
-                                0, &start, &end, EXTENT_DIRTY | EXTENT_NEW,
+                                0, &start, &end,
+                                EXTENT_DIRTY | EXTENT_NEW | EXTENT_NEED_WAIT,
                                 NULL);
                 if (ret)
                         break;
 
                 clear_extent_bits(&log->dirty_log_pages, start, end,
-                                  EXTENT_DIRTY | EXTENT_NEW);
+                                  EXTENT_DIRTY | EXTENT_NEW | EXTENT_NEED_WAIT);
         }
 
         /*
@@ -5677,6 +5688,23 @@ again:
                                                       path);
                 }
 
+                if (!ret && wc.stage == LOG_WALK_REPLAY_ALL) {
+                        struct btrfs_root *root = wc.replay_dest;
+
+                        btrfs_release_path(path);
+
+                        /*
+                         * We have just replayed everything, and the highest
+                         * objectid of fs roots probably has changed in case
+                         * some inode_item's got replayed.
+                         *
+                         * root->objectid_mutex is not acquired as log replay
+                         * could only happen during mount.
+                         */
+                        ret = btrfs_find_highest_objectid(root,
+                                                  &root->highest_objectid);
+                }
+
                 key.offset = found_key.offset - 1;
                 wc.replay_dest->log_root = NULL;
                 free_extent_buffer(log->node);
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index b5036bd69e6a..2ceb924ca0d6 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -645,6 +645,7 @@ static void btrfs_free_stale_devices(const char *path,
                                 btrfs_sysfs_remove_fsid(fs_devs);
                                 list_del(&fs_devs->list);
                                 free_fs_devices(fs_devs);
+                                break;
                         } else {
                                 fs_devs->num_devices--;
                                 list_del(&dev->dev_list);
diff --git a/fs/efivarfs/file.c b/fs/efivarfs/file.c
index 5f22e74bbade..8e568428c88b 100644
--- a/fs/efivarfs/file.c
+++ b/fs/efivarfs/file.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/efi.h>
+#include <linux/delay.h>
 #include <linux/fs.h>
 #include <linux/slab.h>
 #include <linux/mount.h>
@@ -74,6 +75,11 @@ static ssize_t efivarfs_file_read(struct file *file, char __user *userbuf,
         ssize_t size = 0;
         int err;
 
+        while (!__ratelimit(&file->f_cred->user->ratelimit)) {
+                if (!msleep_interruptible(50))
+                        return -EINTR;
+        }
+
         err = efivar_entry_size(var, &datasize);
 
         /*
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 86863792f36a..86d6a4435c87 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -716,7 +716,7 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
         __be64 *ptr;
         sector_t lblock;
         sector_t lend;
-        int ret;
+        int ret = 0;
         int eob;
         unsigned int len;
         struct buffer_head *bh;
@@ -728,12 +728,14 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
                 goto out;
         }
 
-        if ((flags & IOMAP_REPORT) && gfs2_is_stuffed(ip)) {
-                gfs2_stuffed_iomap(inode, iomap);
-                if (pos >= iomap->length)
-                        return -ENOENT;
-                ret = 0;
-                goto out;
+        if (gfs2_is_stuffed(ip)) {
+                if (flags & IOMAP_REPORT) {
+                        gfs2_stuffed_iomap(inode, iomap);
+                        if (pos >= iomap->length)
+                                ret = -ENOENT;
+                        goto out;
+                }
+                BUG_ON(!(flags & IOMAP_WRITE));
         }
 
         lblock = pos >> inode->i_blkbits;
@@ -744,7 +746,7 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
         iomap->type = IOMAP_HOLE;
         iomap->length = (u64)(lend - lblock) << inode->i_blkbits;
         iomap->flags = IOMAP_F_MERGED;
-        bmap_lock(ip, 0);
+        bmap_lock(ip, flags & IOMAP_WRITE);
 
         /*
          * Directory data blocks have a struct gfs2_meta_header header, so the
@@ -787,27 +789,28 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
                 iomap->flags |= IOMAP_F_BOUNDARY;
         iomap->length = (u64)len << inode->i_blkbits;
 
-        ret = 0;
-
 out_release:
         release_metapath(&mp);
-        bmap_unlock(ip, 0);
+        bmap_unlock(ip, flags & IOMAP_WRITE);
 out:
         trace_gfs2_iomap_end(ip, iomap, ret);
         return ret;
 
 do_alloc:
-        if (!(flags & IOMAP_WRITE)) {
-                if (pos >= i_size_read(inode)) {
+        if (flags & IOMAP_WRITE) {
+                ret = gfs2_iomap_alloc(inode, iomap, flags, &mp);
+        } else if (flags & IOMAP_REPORT) {
+                loff_t size = i_size_read(inode);
+                if (pos >= size)
                         ret = -ENOENT;
-                        goto out_release;
-                }
-                ret = 0;
-                iomap->length = hole_size(inode, lblock, &mp);
-                goto out_release;
+                else if (height <= ip->i_height)
+                        iomap->length = hole_size(inode, lblock, &mp);
+                else
+                        iomap->length = size - pos;
+        } else {
+                if (height <= ip->i_height)
+                        iomap->length = hole_size(inode, lblock, &mp);
         }
-
-        ret = gfs2_iomap_alloc(inode, iomap, flags, &mp);
         goto out_release;
 }
 
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index 2435af56b87e..a50d7813e3ea 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -572,7 +572,7 @@ out:
 }
 
 static bool
-validate_bitmap_values(unsigned long mask)
+validate_bitmap_values(unsigned int mask)
 {
         return (mask & ~RCA4_TYPE_MASK_ALL) == 0;
 }
@@ -596,17 +596,15 @@ __be32 nfs4_callback_recallany(void *argp, void *resp,
                 goto out;
 
         status = cpu_to_be32(NFS4_OK);
-        if (test_bit(RCA4_TYPE_MASK_RDATA_DLG, (const unsigned long *)
-                     &args->craa_type_mask))
+        if (args->craa_type_mask & BIT(RCA4_TYPE_MASK_RDATA_DLG))
                 flags = FMODE_READ;
-        if (test_bit(RCA4_TYPE_MASK_WDATA_DLG, (const unsigned long *)
-                     &args->craa_type_mask))
+        if (args->craa_type_mask & BIT(RCA4_TYPE_MASK_WDATA_DLG))
                 flags |= FMODE_WRITE;
-        if (test_bit(RCA4_TYPE_MASK_FILE_LAYOUT, (const unsigned long *)
-                     &args->craa_type_mask))
-                pnfs_recall_all_layouts(cps->clp);
         if (flags)
                 nfs_expire_unused_delegation_types(cps->clp, flags);
+
+        if (args->craa_type_mask & BIT(RCA4_TYPE_MASK_FILE_LAYOUT))
+                pnfs_recall_all_layouts(cps->clp);
 out:
         dprintk("%s: exit with status = %d\n", __func__, ntohl(status));
         return status;
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 49f848fd1f04..7327930ad970 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -873,7 +873,7 @@ static void nfs3_nlm_release_call(void *data)
         }
 }
 
-const struct nlmclnt_operations nlmclnt_fl_close_lock_ops = {
+static const struct nlmclnt_operations nlmclnt_fl_close_lock_ops = {
         .nlmclnt_alloc_call = nfs3_nlm_alloc_call,
         .nlmclnt_unlock_prepare = nfs3_nlm_unlock_prepare,
         .nlmclnt_release_call = nfs3_nlm_release_call,
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 04612c24d394..979631411a0e 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -868,8 +868,10 @@ static int nfs4_set_client(struct nfs_server *server,
         if (IS_ERR(clp))
                 return PTR_ERR(clp);
 
-        if (server->nfs_client == clp)
+        if (server->nfs_client == clp) {
+                nfs_put_client(clp);
                 return -ELOOP;
+        }
 
         /*
          * Query for the lease time on clientid setup or renewal
@@ -1244,11 +1246,11 @@ int nfs4_update_server(struct nfs_server *server, const char *hostname,
                                 clp->cl_proto, clnt->cl_timeout,
                                 clp->cl_minorversion, net);
         clear_bit(NFS_MIG_TSM_POSSIBLE, &server->mig_status);
-        nfs_put_client(clp);
         if (error != 0) {
                 nfs_server_insert_lists(server);
                 return error;
         }
+        nfs_put_client(clp);
 
         if (server->nfs_client->cl_hostname == NULL)
                 server->nfs_client->cl_hostname = kstrdup(hostname, GFP_KERNEL);
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index e8a93bc8285d..d1e82761de81 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -510,6 +510,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
                         /* we have to zero-fill user buffer even if no read */
                         if (copy_to_user(buffer, buf, tsz))
                                 return -EFAULT;
+                } else if (m->type == KCORE_USER) {
+                        /* User page is handled prior to normal kernel page: */
+                        if (copy_to_user(buffer, (char *)start, tsz))
+                                return -EFAULT;
                 } else {
                         if (kern_addr_valid(start)) {
                                 /*
diff --git a/fs/signalfd.c b/fs/signalfd.c
index 9990957264e3..76bf9cc62074 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -118,13 +118,22 @@ static int signalfd_copyinfo(struct signalfd_siginfo __user *uinfo,
                 err |= __put_user(kinfo->si_trapno, &uinfo->ssi_trapno);
 #endif
 #ifdef BUS_MCEERR_AO
-                /* 
+                /*
+                 * Other callers might not initialize the si_lsb field,
+                 * so check explicitly for the right codes here.
+                 */
+                if (kinfo->si_signo == SIGBUS &&
+                     kinfo->si_code == BUS_MCEERR_AO)
+                        err |= __put_user((short) kinfo->si_addr_lsb,
+                                          &uinfo->ssi_addr_lsb);
+#endif
+#ifdef BUS_MCEERR_AR
+                /*
                  * Other callers might not initialize the si_lsb field,
                  * so check explicitly for the right codes here.
                  */
                 if (kinfo->si_signo == SIGBUS &&
-                    (kinfo->si_code == BUS_MCEERR_AR ||
-                     kinfo->si_code == BUS_MCEERR_AO))
+                    kinfo->si_code == BUS_MCEERR_AR)
                         err |= __put_user((short) kinfo->si_addr_lsb,
                                           &uinfo->ssi_addr_lsb);
 #endif
diff --git a/include/asm-generic/bitops/lock.h b/include/asm-generic/bitops/lock.h
index bc397573c43a..67ab280ad134 100644
--- a/include/asm-generic/bitops/lock.h
+++ b/include/asm-generic/bitops/lock.h
@@ -7,7 +7,8 @@
  * @nr: Bit to set
  * @addr: Address to count from
  *
- * This operation is atomic and provides acquire barrier semantics.
+ * This operation is atomic and provides acquire barrier semantics if
+ * the returned value is 0.
  * It can be used to implement bit locks.
  */
 #define test_and_set_bit_lock(nr, addr) test_and_set_bit(nr, addr)
diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h
index 963b755d19b0..a7613e1b0c87 100644
--- a/include/asm-generic/bug.h
+++ b/include/asm-generic/bug.h
@@ -52,6 +52,7 @@ struct bug_entry {
 #ifndef HAVE_ARCH_BUG
 #define BUG() do { \
         printk("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \
+        barrier_before_unreachable(); \
         panic("BUG!"); \
 } while (0)
 #endif
diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h
index 1c27526c499e..cf13842a6dbd 100644
--- a/include/drm/drm_atomic.h
+++ b/include/drm/drm_atomic.h
@@ -134,6 +134,15 @@ struct drm_crtc_commit {
          * &drm_pending_vblank_event pointer to clean up private events.
          */
         struct drm_pending_vblank_event *event;
+
+        /**
+         * @abort_completion:
+         *
+         * A flag that's set after drm_atomic_helper_setup_commit takes a second
+         * reference for the completion of $drm_crtc_state.event. It's used by
+         * the free code to remove the second reference if commit fails.
+         */
+        bool abort_completion;
 };
 
 struct __drm_planes_state {
diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
index 76e237bd989b..6914633037a5 100644
--- a/include/drm/drm_crtc_helper.h
+++ b/include/drm/drm_crtc_helper.h
@@ -77,5 +77,6 @@ void drm_kms_helper_hotplug_event(struct drm_device *dev);
 
 void drm_kms_helper_poll_disable(struct drm_device *dev);
 void drm_kms_helper_poll_enable(struct drm_device *dev);
+bool drm_kms_helper_is_poll_worker(void);
 
 #endif
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 64e10746f282..968173ec2726 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -587,7 +587,7 @@ extern int acpi_nvs_for_each_region(int (*func)(__u64, __u64, void *),
 const struct acpi_device_id *acpi_match_device(const struct acpi_device_id *ids,
                                                const struct device *dev);
 
-void *acpi_get_match_data(const struct device *dev);
+const void *acpi_device_get_match_data(const struct device *dev);
 extern bool acpi_driver_match_device(struct device *dev,
                                      const struct device_driver *drv);
 int acpi_device_uevent_modalias(struct device *, struct kobj_uevent_env *);
@@ -766,7 +766,7 @@ static inline const struct acpi_device_id *acpi_match_device(
         return NULL;
 }
 
-static inline void *acpi_get_match_data(const struct device *dev)
+static inline const void *acpi_device_get_match_data(const struct device *dev)
 {
         return NULL;
 }
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 4f3df807cf8f..ed63f3b69c12 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -49,7 +49,7 @@ struct blk_stat_callback;
 #define BLKDEV_MIN_RQ   4
 #define BLKDEV_MAX_RQ   128     /* Default maximum */
 
-/* Must be consisitent with blk_mq_poll_stats_bkt() */
+/* Must be consistent with blk_mq_poll_stats_bkt() */
 #define BLK_MQ_POLL_STATS_BKTS 16
 
 /*
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 631354acfa72..901c1ccb3374 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -167,8 +167,6 @@
 
 #if GCC_VERSION >= 40100
 # define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
-
-#define __nostackprotector      __attribute__((__optimize__("no-stack-protector")))
 #endif
 
 #if GCC_VERSION >= 40300
@@ -196,6 +194,11 @@
 #endif /* __CHECKER__ */
 #endif /* GCC_VERSION >= 40300 */
 
+#if GCC_VERSION >= 40400
+#define __optimize(level)       __attribute__((__optimize__(level)))
+#define __nostackprotector      __optimize("no-stack-protector")
+#endif /* GCC_VERSION >= 40400 */
+
 #if GCC_VERSION >= 40500
 
 #ifndef __CHECKER__
@@ -205,6 +208,15 @@
 #endif
 
 /*
+ * calling noreturn functions, __builtin_unreachable() and __builtin_trap()
+ * confuse the stack allocation in gcc, leading to overly large stack
+ * frames, see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82365
+ *
+ * Adding an empty inline assembly before it works around the problem
+ */
+#define barrier_before_unreachable() asm volatile("")
+
+/*
  * Mark a position in code as unreachable.  This can be used to
  * suppress control flow warnings after asm blocks that transfer
  * control elsewhere.
@@ -214,7 +226,11 @@
  * unreleased.  Really, we need to have autoconf for the kernel.
  */
 #define unreachable() \
-        do { annotate_unreachable(); __builtin_unreachable(); } while (0)
+        do {                                    \
+                annotate_unreachable();         \
+                barrier_before_unreachable();   \
+                __builtin_unreachable();        \
+        } while (0)
 
 /* Mark a function definition as prohibited from being cloned. */
 #define __noclone       __attribute__((__noclone__, __optimize__("no-tracer")))
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index c2cc57a2f508..ab4711c63601 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -86,6 +86,11 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
 # define barrier_data(ptr) barrier()
 #endif
 
+/* workaround for GCC PR82365 if needed */
+#ifndef barrier_before_unreachable
+# define barrier_before_unreachable() do { } while (0)
+#endif
+
 /* Unreachable code */
 #ifdef CONFIG_STACK_VALIDATION
 /*
@@ -277,6 +282,10 @@ unsigned long read_word_at_a_time(const void *addr)
 
 #endif /* __ASSEMBLY__ */
 
+#ifndef __optimize
+# define __optimize(level)
+#endif
+
 /* Compile time object size, -1 for unknown */
 #ifndef __compiletime_object_size
 # define __compiletime_object_size(obj) -1
diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
index 871f9e21810c..0b3fc229086c 100644
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -225,7 +225,7 @@ static inline void cpuidle_coupled_parallel_barrier(struct cpuidle_device *dev,
 }
 #endif
 
-#ifdef CONFIG_ARCH_HAS_CPU_RELAX
+#if defined(CONFIG_CPU_IDLE) && defined(CONFIG_ARCH_HAS_CPU_RELAX)
 void cpuidle_poll_state_init(struct cpuidle_driver *drv);
 #else
 static inline void cpuidle_poll_state_init(struct cpuidle_driver *drv) {}
diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
index d4a2a7dcd72d..bf53d893ad02 100644
--- a/include/linux/cpumask.h
+++ b/include/linux/cpumask.h
@@ -170,6 +170,8 @@ static inline unsigned int cpumask_local_spread(unsigned int i, int node)
         for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask)
 #define for_each_cpu_not(cpu, mask)             \
         for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask)
+#define for_each_cpu_wrap(cpu, mask, start)     \
+        for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)(start))
 #define for_each_cpu_and(cpu, mask, and)        \
         for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)and)
 #else
diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
index 34fe8463d10e..eb9eab4ecd6d 100644
--- a/include/linux/dma-mapping.h
+++ b/include/linux/dma-mapping.h
@@ -578,7 +578,7 @@ static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
 
 /*
  * This is a hack for the legacy x86 forbid_dac and iommu_sac_force. Please
- * don't use this is new code.
+ * don't use this in new code.
  */
 #ifndef arch_dma_supported
 #define arch_dma_supported(dev, mask)   (1)
diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h
index 4fa1a489efe4..4fe8f289b3f6 100644
--- a/include/linux/fwnode.h
+++ b/include/linux/fwnode.h
@@ -73,8 +73,8 @@ struct fwnode_operations {
         struct fwnode_handle *(*get)(struct fwnode_handle *fwnode);
         void (*put)(struct fwnode_handle *fwnode);
         bool (*device_is_available)(const struct fwnode_handle *fwnode);
-        void *(*device_get_match_data)(const struct fwnode_handle *fwnode,
-                                       const struct device *dev);
+        const void *(*device_get_match_data)(const struct fwnode_handle *fwnode,
+                                             const struct device *dev);
         bool (*property_present)(const struct fwnode_handle *fwnode,
                                  const char *propname);
         int (*property_read_int_array)(const struct fwnode_handle *fwnode,
diff --git a/include/linux/kconfig.h b/include/linux/kconfig.h
index fec5076eda91..dcde9471897d 100644
--- a/include/linux/kconfig.h
+++ b/include/linux/kconfig.h
@@ -4,6 +4,12 @@
 
 #include <generated/autoconf.h>
 
+#ifdef CONFIG_CPU_BIG_ENDIAN
+#define __BIG_ENDIAN 4321
+#else
+#define __LITTLE_ENDIAN 1234
+#endif
+
 #define __ARG_PLACEHOLDER_1 0,
 #define __take_second_arg(__ignored, val, ...) val
 
@@ -64,4 +70,7 @@
  */
 #define IS_ENABLED(option) __or(IS_BUILTIN(option), IS_MODULE(option))
 
+/* Make sure we always have all types and struct attributes defined. */
+#include <linux/compiler_types.h>
+
 #endif /* __LINUX_KCONFIG_H */
diff --git a/include/linux/kcore.h b/include/linux/kcore.h
index 7ff25a808fef..80db19d3a505 100644
--- a/include/linux/kcore.h
+++ b/include/linux/kcore.h
@@ -10,6 +10,7 @@ enum kcore_type {
         KCORE_VMALLOC,
         KCORE_RAM,
         KCORE_VMEMMAP,
+        KCORE_USER,
         KCORE_OTHER,
 };
 
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 882046863581..c46016bb25eb 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -523,9 +523,11 @@ static inline void __mod_memcg_state(struct mem_cgroup *memcg,
 static inline void mod_memcg_state(struct mem_cgroup *memcg,
                                    int idx, int val)
 {
-        preempt_disable();
+        unsigned long flags;
+
+        local_irq_save(flags);
         __mod_memcg_state(memcg, idx, val);
-        preempt_enable();
+        local_irq_restore(flags);
 }
 
 /**
@@ -606,9 +608,11 @@ static inline void __mod_lruvec_state(struct lruvec *lruvec,
 static inline void mod_lruvec_state(struct lruvec *lruvec,
                                     enum node_stat_item idx, int val)
 {
-        preempt_disable();
+        unsigned long flags;
+
+        local_irq_save(flags);
         __mod_lruvec_state(lruvec, idx, val);
-        preempt_enable();
+        local_irq_restore(flags);
 }
 
 static inline void __mod_lruvec_page_state(struct page *page,
@@ -630,9 +634,11 @@ static inline void __mod_lruvec_page_state(struct page *page,
 static inline void mod_lruvec_page_state(struct page *page,
                                          enum node_stat_item idx, int val)
 {
-        preempt_disable();
+        unsigned long flags;
+
+        local_irq_save(flags);
         __mod_lruvec_page_state(page, idx, val);
-        preempt_enable();
+        local_irq_restore(flags);
 }
 
 unsigned long mem_cgroup_soft_limit_reclaim(pg_data_t *pgdat, int order,
@@ -659,9 +665,11 @@ static inline void __count_memcg_events(struct mem_cgroup *memcg,
 static inline void count_memcg_events(struct mem_cgroup *memcg,
                                       int idx, unsigned long count)
 {
-        preempt_disable();
+        unsigned long flags;
+
+        local_irq_save(flags);
         __count_memcg_events(memcg, idx, count);
-        preempt_enable();
+        local_irq_restore(flags);
 }
 
 /* idx can be of type enum memcg_event_item or vm_event_item */
diff --git a/include/linux/mm_inline.h b/include/linux/mm_inline.h
index c30b32e3c862..10191c28fc04 100644
--- a/include/linux/mm_inline.h
+++ b/include/linux/mm_inline.h
@@ -127,10 +127,4 @@ static __always_inline enum lru_list page_lru(struct page *page)
 
 #define lru_to_page(head) (list_entry((head)->prev, struct page, lru))
 
-#ifdef arch_unmap_kpfn
-extern void arch_unmap_kpfn(unsigned long pfn);
-#else
-static __always_inline void arch_unmap_kpfn(unsigned long pfn) { }
-#endif
-
 #endif
diff --git a/include/linux/mutex.h b/include/linux/mutex.h
index f25c13423bd4..cb3bbed4e633 100644
--- a/include/linux/mutex.h
+++ b/include/linux/mutex.h
@@ -66,6 +66,11 @@ struct mutex {
 #endif
 };
 
+/*
+ * Internal helper function; C doesn't allow us to hide it :/
+ *
+ * DO NOT USE (outside of mutex code).
+ */
 static inline struct task_struct *__mutex_owner(struct mutex *lock)
 {
         return (struct task_struct *)(atomic_long_read(&lock->owner) & ~0x07);
diff --git a/include/linux/nospec.h b/include/linux/nospec.h
index b99bced39ac2..fbc98e2c8228 100644
--- a/include/linux/nospec.h
+++ b/include/linux/nospec.h
@@ -20,20 +20,6 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
                                                     unsigned long size)
 {
         /*
-         * Warn developers about inappropriate array_index_nospec() usage.
-         *
-         * Even if the CPU speculates past the WARN_ONCE branch, the
-         * sign bit of @index is taken into account when generating the
-         * mask.
-         *
-         * This warning is compiled out when the compiler can infer that
-         * @index and @size are less than LONG_MAX.
-         */
-        if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX,
-                        "array_index_nospec() limited to range of [0, LONG_MAX]\n"))
-                return 0;
-
-        /*
          * Always calculate and emit the mask even if the compiler
          * thinks the mask is not needed. The compiler does not take
          * into account the value of @index under speculation.
@@ -44,6 +30,26 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 #endif
 
 /*
+ * Warn developers about inappropriate array_index_nospec() usage.
+ *
+ * Even if the CPU speculates past the WARN_ONCE branch, the
+ * sign bit of @index is taken into account when generating the
+ * mask.
+ *
+ * This warning is compiled out when the compiler can infer that
+ * @index and @size are less than LONG_MAX.
+ */
+#define array_index_mask_nospec_check(index, size)                              \
+({                                                                              \
+        if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX,                      \
+            "array_index_nospec() limited to range of [0, LONG_MAX]\n"))        \
+                _mask = 0;                                                      \
+        else                                                                    \
+                _mask = array_index_mask_nospec(index, size);                   \
+        _mask;                                                                  \
+})
+
+/*
  * array_index_nospec - sanitize an array index after a bounds check
  *
  * For a code sequence like:
@@ -61,7 +67,7 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 ({                                                                      \
         typeof(index) _i = (index);                                     \
         typeof(size) _s = (size);                                       \
-        unsigned long _mask = array_index_mask_nospec(_i, _s);          \
+        unsigned long _mask = array_index_mask_nospec_check(_i, _s);    \
                                                                         \
         BUILD_BUG_ON(sizeof(_i) > sizeof(long));                        \
         BUILD_BUG_ON(sizeof(_s) > sizeof(long));                        \
diff --git a/include/linux/perf/arm_pmu.h b/include/linux/perf/arm_pmu.h
index af0f44effd44..40036a57d072 100644
--- a/include/linux/perf/arm_pmu.h
+++ b/include/linux/perf/arm_pmu.h
@@ -14,26 +14,10 @@
 
 #include <linux/interrupt.h>
 #include <linux/perf_event.h>
+#include <linux/platform_device.h>
 #include <linux/sysfs.h>
 #include <asm/cputype.h>
 
-/*
- * struct arm_pmu_platdata - ARM PMU platform data
- *
- * @handle_irq: an optional handler which will be called from the
- *      interrupt and passed the address of the low level handler,
- *      and can be used to implement any platform specific handling
- *      before or after calling it.
- *
- * @irq_flags: if non-zero, these flags will be passed to request_irq
- *             when requesting interrupts for this PMU device.
- */
-struct arm_pmu_platdata {
-        irqreturn_t (*handle_irq)(int irq, void *dev,
-                                  irq_handler_t pmu_handler);
-        unsigned long irq_flags;
-};
-
 #ifdef CONFIG_ARM_PMU
 
 /*
@@ -92,7 +76,6 @@ enum armpmu_attr_groups {
 
 struct arm_pmu {
         struct pmu      pmu;
-        cpumask_t       active_irqs;
         cpumask_t       supported_cpus;
         char            *name;
         irqreturn_t     (*handle_irq)(int irq_num, void *dev);
@@ -174,12 +157,11 @@ static inline int arm_pmu_acpi_probe(armpmu_init_fn init_fn) { return 0; }
 
 /* Internal functions only for core arm_pmu code */
 struct arm_pmu *armpmu_alloc(void);
+struct arm_pmu *armpmu_alloc_atomic(void);
 void armpmu_free(struct arm_pmu *pmu);
 int armpmu_register(struct arm_pmu *pmu);
-int armpmu_request_irqs(struct arm_pmu *armpmu);
-void armpmu_free_irqs(struct arm_pmu *armpmu);
-int armpmu_request_irq(struct arm_pmu *armpmu, int cpu);
-void armpmu_free_irq(struct arm_pmu *armpmu, int cpu);
+int armpmu_request_irq(int irq, int cpu);
+void armpmu_free_irq(int irq, int cpu);
 
 #define ARMV8_PMU_PDEV_NAME "armv8-pmu"
 
diff --git a/include/linux/property.h b/include/linux/property.h
index 769d372c1edf..2eea4b310fc2 100644
--- a/include/linux/property.h
+++ b/include/linux/property.h
@@ -283,7 +283,7 @@ bool device_dma_supported(struct device *dev);
 
 enum dev_dma_attr device_get_dma_attr(struct device *dev);
 
-void *device_get_match_data(struct device *dev);
+const void *device_get_match_data(struct device *dev);
 
 int device_get_phy_mode(struct device *dev);
 
diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
index b884b7794187..e6335227b844 100644
--- a/include/linux/ptr_ring.h
+++ b/include/linux/ptr_ring.h
@@ -469,7 +469,7 @@ static inline int ptr_ring_consume_batched_bh(struct ptr_ring *r,
  */
 static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp)
 {
-        if (size * sizeof(void *) > KMALLOC_MAX_SIZE)
+        if (size > KMALLOC_MAX_SIZE / sizeof(void *))
                 return NULL;
         return kvmalloc_array(size, sizeof(void *), gfp | __GFP_ZERO);
 }
diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h
index 1149533aa2fa..9806184bb3d5 100644
--- a/include/linux/sched/mm.h
+++ b/include/linux/sched/mm.h
@@ -36,7 +36,18 @@ static inline void mmgrab(struct mm_struct *mm)
         atomic_inc(&mm->mm_count);
 }
 
-extern void mmdrop(struct mm_struct *mm);
+extern void __mmdrop(struct mm_struct *mm);
+
+static inline void mmdrop(struct mm_struct *mm)
+{
+        /*
+         * The implicit full barrier implied by atomic_dec_and_test() is
+         * required by the membarrier system call before returning to
+         * user-space, after storing to rq->curr.
+         */
+        if (unlikely(atomic_dec_and_test(&mm->mm_count)))
+                __mmdrop(mm);
+}
 
 /**
  * mmget() - Pin the address space associated with a &struct mm_struct.
diff --git a/include/linux/sched/user.h b/include/linux/sched/user.h
index 0dcf4e480ef7..96fe289c4c6e 100644
--- a/include/linux/sched/user.h
+++ b/include/linux/sched/user.h
@@ -4,6 +4,7 @@
 
 #include <linux/uidgid.h>
 #include <linux/atomic.h>
+#include <linux/ratelimit.h>
 
 struct key;
 
@@ -41,6 +42,9 @@ struct user_struct {
     defined(CONFIG_NET)
         atomic_long_t locked_vm;
 #endif
+
+        /* Miscellaneous per-user rate limit */
+        struct ratelimit_state ratelimit;
 };
 
 extern int uids_sysfs_init(void);
diff --git a/include/linux/semaphore.h b/include/linux/semaphore.h
index dc368b8ce215..11c86fbfeb98 100644
--- a/include/linux/semaphore.h
+++ b/include/linux/semaphore.h
@@ -4,7 +4,7 @@
  *
  * Distributed under the terms of the GNU GPL, version 2
  *
- * Please see kernel/semaphore.c for documentation of these functions
+ * Please see kernel/locking/semaphore.c for documentation of these functions
  */
 #ifndef __LINUX_SEMAPHORE_H
 #define __LINUX_SEMAPHORE_H
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 5ebc0f869720..c1e66bdcf583 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3646,7 +3646,7 @@ static inline bool __skb_checksum_validate_needed(struct sk_buff *skb,
         return true;
 }
 
-/* For small packets <= CHECKSUM_BREAK peform checksum complete directly
+/* For small packets <= CHECKSUM_BREAK perform checksum complete directly
  * in checksum_init.
  */
 #define CHECKSUM_BREAK 76
diff --git a/include/linux/swap.h b/include/linux/swap.h
index 7b6a59f722a3..a1a3f4ed94ce 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -337,8 +337,6 @@ extern void deactivate_file_page(struct page *page);
 extern void mark_page_lazyfree(struct page *page);
 extern void swap_setup(void);
 
-extern void add_page_to_unevictable_list(struct page *page);
-
 extern void lru_cache_add_active_or_unevictable(struct page *page,
                                                 struct vm_area_struct *vma);
 
diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
index 4a54ef96aff5..bc0cda180c8b 100644
--- a/include/linux/workqueue.h
+++ b/include/linux/workqueue.h
@@ -465,6 +465,7 @@ extern bool cancel_delayed_work_sync(struct delayed_work *dwork);
 
 extern void workqueue_set_max_active(struct workqueue_struct *wq,
                                      int max_active);
+extern struct work_struct *current_work(void);
 extern bool current_is_workqueue_rescuer(void);
 extern bool workqueue_congested(int cpu, struct workqueue_struct *wq);
 extern unsigned int work_busy(struct work_struct *work);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 906e90223066..c96511fa9198 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -4149,7 +4149,7 @@ void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *sta, u8 tid);
  * The TX headroom reserved by mac80211 for its own tx_status functions.
  * This is enough for the radiotap header.
  */
-#define IEEE80211_TX_STATUS_HEADROOM    14
+#define IEEE80211_TX_STATUS_HEADROOM    ALIGN(14, 4)
 
 /**
  * ieee80211_sta_set_buffered - inform mac80211 about driver-buffered frames
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index ebc5a2ed8631..f83cacce3308 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -78,7 +78,7 @@ struct regulatory_request {
         int wiphy_idx;
         enum nl80211_reg_initiator initiator;
         enum nl80211_user_reg_hint_type user_reg_hint_type;
-        char alpha2[2];
+        char alpha2[3];
         enum nl80211_dfs_regions dfs_region;
         bool intersect;
         bool processed;
diff --git a/include/net/udplite.h b/include/net/udplite.h
index 81bdbf97319b..9185e45b997f 100644
--- a/include/net/udplite.h
+++ b/include/net/udplite.h
@@ -64,6 +64,7 @@ static inline int udplite_checksum_init(struct sk_buff *skb, struct udphdr *uh)
                 UDP_SKB_CB(skb)->cscov = cscov;
                 if (skb->ip_summed == CHECKSUM_COMPLETE)
                         skb->ip_summed = CHECKSUM_NONE;
+                skb->csum_valid = 0;
         }
 
         return 0;
diff --git a/include/rdma/restrack.h b/include/rdma/restrack.h
index c2d81167c858..2cdf8dcf4bdc 100644
--- a/include/rdma/restrack.h
+++ b/include/rdma/restrack.h
@@ -29,10 +29,6 @@ enum rdma_restrack_type {
          */
         RDMA_RESTRACK_QP,
         /**
-         * @RDMA_RESTRACK_XRCD: XRC domain (XRCD)
-         */
-        RDMA_RESTRACK_XRCD,
-        /**
          * @RDMA_RESTRACK_MAX: Last entry, used for array dclarations
          */
         RDMA_RESTRACK_MAX
diff --git a/include/rdma/uverbs_ioctl.h b/include/rdma/uverbs_ioctl.h
index 6da44079aa58..38287d9d23a1 100644
--- a/include/rdma/uverbs_ioctl.h
+++ b/include/rdma/uverbs_ioctl.h
@@ -276,10 +276,7 @@ struct uverbs_object_tree_def {
  */
 
 struct uverbs_ptr_attr {
-        union {
-                u64             data;
-                void    __user *ptr;
-        };
+        u64             data;
         u16             len;
         /* Combination of bits from enum UVERBS_ATTR_F_XXXX */
         u16             flags;
@@ -351,38 +348,60 @@ static inline const struct uverbs_attr *uverbs_attr_get(const struct uverbs_attr
 }
 
 static inline int uverbs_copy_to(const struct uverbs_attr_bundle *attrs_bundle,
-                                 size_t idx, const void *from)
+                                 size_t idx, const void *from, size_t size)
 {
         const struct uverbs_attr *attr = uverbs_attr_get(attrs_bundle, idx);
         u16 flags;
+        size_t min_size;
 
         if (IS_ERR(attr))
                 return PTR_ERR(attr);
 
+        min_size = min_t(size_t, attr->ptr_attr.len, size);
+        if (copy_to_user(u64_to_user_ptr(attr->ptr_attr.data), from, min_size))
+                return -EFAULT;
+
         flags = attr->ptr_attr.flags | UVERBS_ATTR_F_VALID_OUTPUT;
-        return (!copy_to_user(attr->ptr_attr.ptr, from, attr->ptr_attr.len) &&
-                !put_user(flags, &attr->uattr->flags)) ? 0 : -EFAULT;
+        if (put_user(flags, &attr->uattr->flags))
+                return -EFAULT;
+
+        return 0;
 }
 
-static inline int _uverbs_copy_from(void *to, size_t to_size,
+static inline bool uverbs_attr_ptr_is_inline(const struct uverbs_attr *attr)
+{
+        return attr->ptr_attr.len <= sizeof(attr->ptr_attr.data);
+}
+
+static inline int _uverbs_copy_from(void *to,
                                     const struct uverbs_attr_bundle *attrs_bundle,
-                                    size_t idx)
+                                    size_t idx,
+                                    size_t size)
 {
         const struct uverbs_attr *attr = uverbs_attr_get(attrs_bundle, idx);
 
         if (IS_ERR(attr))
                 return PTR_ERR(attr);
 
-        if (to_size <= sizeof(((struct ib_uverbs_attr *)0)->data))
+        /*
+         * Validation ensures attr->ptr_attr.len >= size. If the caller is
+         * using UVERBS_ATTR_SPEC_F_MIN_SZ then it must call copy_from with
+         * the right size.
+         */
+        if (unlikely(size < attr->ptr_attr.len))
+                return -EINVAL;
+
+        if (uverbs_attr_ptr_is_inline(attr))
                 memcpy(to, &attr->ptr_attr.data, attr->ptr_attr.len);
-        else if (copy_from_user(to, attr->ptr_attr.ptr, attr->ptr_attr.len))
+        else if (copy_from_user(to, u64_to_user_ptr(attr->ptr_attr.data),
+                                attr->ptr_attr.len))
                 return -EFAULT;
 
         return 0;
 }
 
 #define uverbs_copy_from(to, attrs_bundle, idx)                               \
-        _uverbs_copy_from(to, sizeof(*(to)), attrs_bundle, idx)
+        _uverbs_copy_from(to, attrs_bundle, idx, sizeof(*to))
 
 /* =================================================
  *       Definitions -> Specs infrastructure
diff --git a/include/sound/ac97/regs.h b/include/sound/ac97/regs.h
index 4bb86d379bd5..9a4fa0c3264a 100644
--- a/include/sound/ac97/regs.h
+++ b/include/sound/ac97/regs.h
@@ -31,7 +31,7 @@
 #define AC97_HEADPHONE          0x04    /* Headphone Volume (optional) */
 #define AC97_MASTER_MONO        0x06    /* Master Volume Mono (optional) */
 #define AC97_MASTER_TONE        0x08    /* Master Tone (Bass & Treble) (optional) */
-#define AC97_PC_BEEP            0x0a    /* PC Beep Volume (optinal) */
+#define AC97_PC_BEEP            0x0a    /* PC Beep Volume (optional) */
 #define AC97_PHONE              0x0c    /* Phone Volume (optional) */
 #define AC97_MIC                0x0e    /* MIC Volume */
 #define AC97_LINE               0x10    /* Line In Volume */
diff --git a/include/trace/events/xen.h b/include/trace/events/xen.h
index b8adf05c534e..7dd8f34c37df 100644
--- a/include/trace/events/xen.h
+++ b/include/trace/events/xen.h
@@ -368,7 +368,7 @@ TRACE_EVENT(xen_mmu_flush_tlb,
             TP_printk("%s", "")
         );
 
-TRACE_EVENT(xen_mmu_flush_tlb_single,
+TRACE_EVENT(xen_mmu_flush_tlb_one_user,
             TP_PROTO(unsigned long addr),
             TP_ARGS(addr),
             TP_STRUCT__entry(
diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h
index f8cb5760ea4f..8bbbcb5cd94b 100644
--- a/include/uapi/linux/if_ether.h
+++ b/include/uapi/linux/if_ether.h
@@ -23,7 +23,6 @@
 #define _UAPI_LINUX_IF_ETHER_H
 
 #include <linux/types.h>
-#include <linux/libc-compat.h>
 
 /*
  *      IEEE 802.3 Ethernet magic constants.  The frame sizes omit the preamble
@@ -151,6 +150,11 @@
  *      This is an Ethernet frame header.
  */
 
+/* allow libcs like musl to deactivate this, glibc does not implement this. */
+#ifndef __UAPI_DEF_ETHHDR
+#define __UAPI_DEF_ETHHDR               1
+#endif
+
 #if __UAPI_DEF_ETHHDR
 struct ethhdr {
         unsigned char   h_dest[ETH_ALEN];       /* destination eth addr */
diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
index fc29efaa918c..8254c937c9f4 100644
--- a/include/uapi/linux/libc-compat.h
+++ b/include/uapi/linux/libc-compat.h
@@ -264,10 +264,4 @@
 
 #endif /* __GLIBC__ */
 
-/* Definitions for if_ether.h */
-/* allow libcs like musl to deactivate this, glibc does not implement this. */
-#ifndef __UAPI_DEF_ETHHDR
-#define __UAPI_DEF_ETHHDR               1
-#endif
-
 #endif /* _UAPI_LIBC_COMPAT_H */
diff --git a/include/uapi/linux/ptrace.h b/include/uapi/linux/ptrace.h
index e46d82b91166..d5a1b8a492b9 100644
--- a/include/uapi/linux/ptrace.h
+++ b/include/uapi/linux/ptrace.h
@@ -69,8 +69,8 @@ struct ptrace_peeksiginfo_args {
 #define PTRACE_SECCOMP_GET_METADATA     0x420d
 
 struct seccomp_metadata {
-        unsigned long filter_off;       /* Input: which filter */
-        unsigned int flags;             /* Output: filter's flags */
+        __u64 filter_off;       /* Input: which filter */
+        __u64 flags;            /* Output: filter's flags */
 };
 
 /* Read signals from a shared (process wide) queue */
diff --git a/include/uapi/rdma/rdma_user_ioctl.h b/include/uapi/rdma/rdma_user_ioctl.h
index 03557b5f9aa6..46de0885e800 100644
--- a/include/uapi/rdma/rdma_user_ioctl.h
+++ b/include/uapi/rdma/rdma_user_ioctl.h
@@ -65,7 +65,7 @@ struct ib_uverbs_attr {
         __u16 len;              /* only for pointers */
         __u16 flags;            /* combination of UVERBS_ATTR_F_XXXX */
         __u16 reserved;
-        __u64 data;             /* ptr to command, inline data or idr/fd */
+        __aligned_u64 data;     /* ptr to command, inline data or idr/fd */
 };
 
 struct ib_uverbs_ioctl_hdr {
@@ -73,7 +73,7 @@ struct ib_uverbs_ioctl_hdr {
         __u16 object_id;
         __u16 method_id;
         __u16 num_attrs;
-        __u64 reserved;
+        __aligned_u64 reserved;
         struct ib_uverbs_attr  attrs[0];
 };
 
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index b1f66480135b..14750e7c5ee4 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -26,8 +26,10 @@ static void bpf_array_free_percpu(struct bpf_array *array)
 {
         int i;
 
-        for (i = 0; i < array->map.max_entries; i++)
+        for (i = 0; i < array->map.max_entries; i++) {
                 free_percpu(array->pptrs[i]);
+                cond_resched();
+        }
 }
 
 static int bpf_array_alloc_percpu(struct bpf_array *array)
@@ -43,6 +45,7 @@ static int bpf_array_alloc_percpu(struct bpf_array *array)
                         return -ENOMEM;
                 }
                 array->pptrs[i] = ptr;
+                cond_resched();
         }
 
         return 0;
@@ -73,11 +76,11 @@ static int array_map_alloc_check(union bpf_attr *attr)
 static struct bpf_map *array_map_alloc(union bpf_attr *attr)
 {
         bool percpu = attr->map_type == BPF_MAP_TYPE_PERCPU_ARRAY;
-        int numa_node = bpf_map_attr_numa_node(attr);
+        int ret, numa_node = bpf_map_attr_numa_node(attr);
         u32 elem_size, index_mask, max_entries;
         bool unpriv = !capable(CAP_SYS_ADMIN);
+        u64 cost, array_size, mask64;
         struct bpf_array *array;
-        u64 array_size, mask64;
 
         elem_size = round_up(attr->value_size, 8);
 
@@ -109,8 +112,19 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr)
                 array_size += (u64) max_entries * elem_size;
 
         /* make sure there is no u32 overflow later in round_up() */
-        if (array_size >= U32_MAX - PAGE_SIZE)
+        cost = array_size;
+        if (cost >= U32_MAX - PAGE_SIZE)
                 return ERR_PTR(-ENOMEM);
+        if (percpu) {
+                cost += (u64)attr->max_entries * elem_size * num_possible_cpus();
+                if (cost >= U32_MAX - PAGE_SIZE)
+                        return ERR_PTR(-ENOMEM);
+        }
+        cost = round_up(cost, PAGE_SIZE) >> PAGE_SHIFT;
+
+        ret = bpf_map_precharge_memlock(cost);
+        if (ret < 0)
+                return ERR_PTR(ret);
 
         /* allocate all map elements and zero-initialize them */
         array = bpf_map_area_alloc(array_size, numa_node);
@@ -121,20 +135,13 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr)
 
         /* copy mandatory map attributes */
         bpf_map_init_from_attr(&array->map, attr);
+        array->map.pages = cost;
         array->elem_size = elem_size;
 
-        if (!percpu)
-                goto out;
-
-        array_size += (u64) attr->max_entries * elem_size * num_possible_cpus();
-
-        if (array_size >= U32_MAX - PAGE_SIZE ||
-            bpf_array_alloc_percpu(array)) {
+        if (percpu && bpf_array_alloc_percpu(array)) {
                 bpf_map_area_free(array);
                 return ERR_PTR(-ENOMEM);
         }
-out:
-        array->map.pages = round_up(array_size, PAGE_SIZE) >> PAGE_SHIFT;
 
         return &array->map;
 }
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 29ca9208dcfa..d315b393abdd 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1590,7 +1590,7 @@ int bpf_prog_array_copy_to_user(struct bpf_prog_array __rcu *progs,
          * so always copy 'cnt' prog_ids to the user.
          * In a rare race the user will see zero prog_ids
          */
-        ids = kcalloc(cnt, sizeof(u32), GFP_USER);
+        ids = kcalloc(cnt, sizeof(u32), GFP_USER | __GFP_NOWARN);
         if (!ids)
                 return -ENOMEM;
         rcu_read_lock();
diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
index fbfdada6caee..a4bb0b34375a 100644
--- a/kernel/bpf/cpumap.c
+++ b/kernel/bpf/cpumap.c
@@ -334,7 +334,7 @@ static int cpu_map_kthread_run(void *data)
 static struct bpf_cpu_map_entry *__cpu_map_entry_alloc(u32 qsize, u32 cpu,
                                                        int map_id)
 {
-        gfp_t gfp = GFP_ATOMIC|__GFP_NOWARN;
+        gfp_t gfp = GFP_KERNEL | __GFP_NOWARN;
         struct bpf_cpu_map_entry *rcpu;
         int numa, err;
 
diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
index 7b469d10d0e9..b4b5b81e7251 100644
--- a/kernel/bpf/lpm_trie.c
+++ b/kernel/bpf/lpm_trie.c
@@ -555,7 +555,10 @@ static void trie_free(struct bpf_map *map)
         struct lpm_trie_node __rcu **slot;
         struct lpm_trie_node *node;
 
-        raw_spin_lock(&trie->lock);
+        /* Wait for outstanding programs to complete
+         * update/lookup/delete/get_next_key and free the trie.
+         */
+        synchronize_rcu();
 
         /* Always start at the root and walk down to a node that has no
          * children. Then free that node, nullify its reference in the parent
@@ -566,10 +569,9 @@ static void trie_free(struct bpf_map *map)
                 slot = &trie->root;
 
                 for (;;) {
-                        node = rcu_dereference_protected(*slot,
-                                        lockdep_is_held(&trie->lock));
+                        node = rcu_dereference_protected(*slot, 1);
                         if (!node)
-                                goto unlock;
+                                goto out;
 
                         if (rcu_access_pointer(node->child[0])) {
                                 slot = &node->child[0];
@@ -587,8 +589,8 @@ static void trie_free(struct bpf_map *map)
                 }
         }
 
-unlock:
-        raw_spin_unlock(&trie->lock);
+out:
+        kfree(trie);
 }
 
 static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key)
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index 48c33417d13c..a927e89dad6e 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -521,8 +521,8 @@ static struct smap_psock *smap_init_psock(struct sock *sock,
 static struct bpf_map *sock_map_alloc(union bpf_attr *attr)
 {
         struct bpf_stab *stab;
-        int err = -EINVAL;
         u64 cost;
+        int err;
 
         if (!capable(CAP_NET_ADMIN))
                 return ERR_PTR(-EPERM);
@@ -547,6 +547,7 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr)
 
         /* make sure page count doesn't overflow */
         cost = (u64) stab->map.max_entries * sizeof(struct sock *);
+        err = -EINVAL;
         if (cost >= U32_MAX - PAGE_SIZE)
                 goto free_stab;
 
diff --git a/kernel/fork.c b/kernel/fork.c
index be8aa5b98666..e5d9d405ae4e 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -592,7 +592,7 @@ static void check_mm(struct mm_struct *mm)
  * is dropped: either by a lazy thread or by
  * mmput. Free the page directory and the mm.
  */
-static void __mmdrop(struct mm_struct *mm)
+void __mmdrop(struct mm_struct *mm)
 {
         BUG_ON(mm == &init_mm);
         mm_free_pgd(mm);
@@ -603,18 +603,7 @@ static void __mmdrop(struct mm_struct *mm)
         put_user_ns(mm->user_ns);
         free_mm(mm);
 }
-
-void mmdrop(struct mm_struct *mm)
-{
-        /*
-         * The implicit full barrier implied by atomic_dec_and_test() is
-         * required by the membarrier system call before returning to
-         * user-space, after storing to rq->curr.
-         */
-        if (unlikely(atomic_dec_and_test(&mm->mm_count)))
-                __mmdrop(mm);
-}
-EXPORT_SYMBOL_GPL(mmdrop);
+EXPORT_SYMBOL_GPL(__mmdrop);
 
 static void mmdrop_async_fn(struct work_struct *work)
 {
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index e6a9c36470ee..82b8b18ee1eb 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1726,25 +1726,14 @@ static int irq_domain_debug_show(struct seq_file *m, void *p)
         irq_domain_debug_show_one(m, d, 0);
         return 0;
 }
-
-static int irq_domain_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, irq_domain_debug_show, inode->i_private);
-}
-
-static const struct file_operations dfs_domain_ops = {
-        .open           = irq_domain_debug_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-};
+DEFINE_SHOW_ATTRIBUTE(irq_domain_debug);
 
 static void debugfs_add_domain_dir(struct irq_domain *d)
 {
         if (!d->name || !domain_dir || d->debugfs_file)
                 return;
         d->debugfs_file = debugfs_create_file(d->name, 0444, domain_dir, d,
-                                              &dfs_domain_ops);
+                                              &irq_domain_debug_fops);
 }
 
 static void debugfs_remove_domain_dir(struct irq_domain *d)
@@ -1760,7 +1749,8 @@ void __init irq_domain_debugfs_init(struct dentry *root)
         if (!domain_dir)
                 return;
 
-        debugfs_create_file("default", 0444, domain_dir, NULL, &dfs_domain_ops);
+        debugfs_create_file("default", 0444, domain_dir, NULL,
+                            &irq_domain_debug_fops);
         mutex_lock(&irq_domain_mutex);
         list_for_each_entry(d, &irq_domain_list, link)
                 debugfs_add_domain_dir(d);
diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c
index 5187dfe809ac..4c5770407031 100644
--- a/kernel/irq/matrix.c
+++ b/kernel/irq/matrix.c
@@ -16,6 +16,7 @@ struct cpumap {
         unsigned int            available;
         unsigned int            allocated;
         unsigned int            managed;
+        bool                    initialized;
         bool                    online;
         unsigned long           alloc_map[IRQ_MATRIX_SIZE];
         unsigned long           managed_map[IRQ_MATRIX_SIZE];
@@ -81,9 +82,11 @@ void irq_matrix_online(struct irq_matrix *m)
 
         BUG_ON(cm->online);
 
-        bitmap_zero(cm->alloc_map, m->matrix_bits);
-        cm->available = m->alloc_size - (cm->managed + m->systembits_inalloc);
-        cm->allocated = 0;
+        if (!cm->initialized) {
+                cm->available = m->alloc_size;
+                cm->available -= cm->managed + m->systembits_inalloc;
+                cm->initialized = true;
+        }
         m->global_available += cm->available;
         cm->online = true;
         m->online_maps++;
@@ -370,14 +373,16 @@ void irq_matrix_free(struct irq_matrix *m, unsigned int cpu,
         if (WARN_ON_ONCE(bit < m->alloc_start || bit >= m->alloc_end))
                 return;
 
-        if (cm->online) {
-                clear_bit(bit, cm->alloc_map);
-                cm->allocated--;
+        clear_bit(bit, cm->alloc_map);
+        cm->allocated--;
+
+        if (cm->online)
                 m->total_allocated--;
-                if (!managed) {
-                        cm->available++;
+
+        if (!managed) {
+                cm->available++;
+                if (cm->online)
                         m->global_available++;
-                }
         }
         trace_irq_matrix_free(bit, cpu, m, cm);
 }
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index da2ccf142358..102160ff5c66 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -978,67 +978,90 @@ static int prepare_kprobe(struct kprobe *p)
 }
 
 /* Caller must lock kprobe_mutex */
-static void arm_kprobe_ftrace(struct kprobe *p)
+static int arm_kprobe_ftrace(struct kprobe *p)
 {
-        int ret;
+        int ret = 0;
 
         ret = ftrace_set_filter_ip(&kprobe_ftrace_ops,
                                    (unsigned long)p->addr, 0, 0);
-        WARN(ret < 0, "Failed to arm kprobe-ftrace at %p (%d)\n", p->addr, ret);
-        kprobe_ftrace_enabled++;
-        if (kprobe_ftrace_enabled == 1) {
+        if (ret) {
+                pr_debug("Failed to arm kprobe-ftrace at %p (%d)\n", p->addr, ret);
+                return ret;
+        }
+
+        if (kprobe_ftrace_enabled == 0) {
                 ret = register_ftrace_function(&kprobe_ftrace_ops);
-                WARN(ret < 0, "Failed to init kprobe-ftrace (%d)\n", ret);
+                if (ret) {
+                        pr_debug("Failed to init kprobe-ftrace (%d)\n", ret);
+                        goto err_ftrace;
+                }
         }
+
+        kprobe_ftrace_enabled++;
+        return ret;
+
+err_ftrace:
+        /*
+         * Note: Since kprobe_ftrace_ops has IPMODIFY set, and ftrace requires a
+         * non-empty filter_hash for IPMODIFY ops, we're safe from an accidental
+         * empty filter_hash which would undesirably trace all functions.
+         */
+        ftrace_set_filter_ip(&kprobe_ftrace_ops, (unsigned long)p->addr, 1, 0);
+        return ret;
 }
 
 /* Caller must lock kprobe_mutex */
-static void disarm_kprobe_ftrace(struct kprobe *p)
+static int disarm_kprobe_ftrace(struct kprobe *p)
 {
-        int ret;
+        int ret = 0;
 
-        kprobe_ftrace_enabled--;
-        if (kprobe_ftrace_enabled == 0) {
+        if (kprobe_ftrace_enabled == 1) {
                 ret = unregister_ftrace_function(&kprobe_ftrace_ops);
-                WARN(ret < 0, "Failed to init kprobe-ftrace (%d)\n", ret);
+                if (WARN(ret < 0, "Failed to unregister kprobe-ftrace (%d)\n", ret))
+                        return ret;
         }
+
+        kprobe_ftrace_enabled--;
+
         ret = ftrace_set_filter_ip(&kprobe_ftrace_ops,
                            (unsigned long)p->addr, 1, 0);
         WARN(ret < 0, "Failed to disarm kprobe-ftrace at %p (%d)\n", p->addr, ret);
+        return ret;
 }
 #else   /* !CONFIG_KPROBES_ON_FTRACE */
 #define prepare_kprobe(p)       arch_prepare_kprobe(p)
-#define arm_kprobe_ftrace(p)    do {} while (0)
-#define disarm_kprobe_ftrace(p) do {} while (0)
+#define arm_kprobe_ftrace(p)    (-ENODEV)
+#define disarm_kprobe_ftrace(p) (-ENODEV)
 #endif
 
 /* Arm a kprobe with text_mutex */
-static void arm_kprobe(struct kprobe *kp)
+static int arm_kprobe(struct kprobe *kp)
 {
-        if (unlikely(kprobe_ftrace(kp))) {
-                arm_kprobe_ftrace(kp);
-                return;
-        }
+        if (unlikely(kprobe_ftrace(kp)))
+                return arm_kprobe_ftrace(kp);
+
         cpus_read_lock();
         mutex_lock(&text_mutex);
         __arm_kprobe(kp);
         mutex_unlock(&text_mutex);
         cpus_read_unlock();
+
+        return 0;
 }
 
 /* Disarm a kprobe with text_mutex */
-static void disarm_kprobe(struct kprobe *kp, bool reopt)
+static int disarm_kprobe(struct kprobe *kp, bool reopt)
 {
-        if (unlikely(kprobe_ftrace(kp))) {
-                disarm_kprobe_ftrace(kp);
-                return;
-        }
+        if (unlikely(kprobe_ftrace(kp)))
+                return disarm_kprobe_ftrace(kp);
 
         cpus_read_lock();
         mutex_lock(&text_mutex);
         __disarm_kprobe(kp, reopt);
         mutex_unlock(&text_mutex);
         cpus_read_unlock();
+
+        return 0;
 }
 
 /*
@@ -1362,9 +1385,15 @@ out:
 
         if (ret == 0 && kprobe_disabled(ap) && !kprobe_disabled(p)) {
                 ap->flags &= ~KPROBE_FLAG_DISABLED;
-                if (!kprobes_all_disarmed)
+                if (!kprobes_all_disarmed) {
                         /* Arm the breakpoint again. */
-                        arm_kprobe(ap);
+                        ret = arm_kprobe(ap);
+                        if (ret) {
+                                ap->flags |= KPROBE_FLAG_DISABLED;
+                                list_del_rcu(&p->list);
+                                synchronize_sched();
+                        }
+                }
         }
         return ret;
 }
@@ -1573,8 +1602,14 @@ int register_kprobe(struct kprobe *p)
         hlist_add_head_rcu(&p->hlist,
                        &kprobe_table[hash_ptr(p->addr, KPROBE_HASH_BITS)]);
 
-        if (!kprobes_all_disarmed && !kprobe_disabled(p))
-                arm_kprobe(p);
+        if (!kprobes_all_disarmed && !kprobe_disabled(p)) {
+                ret = arm_kprobe(p);
+                if (ret) {
+                        hlist_del_rcu(&p->hlist);
+                        synchronize_sched();
+                        goto out;
+                }
+        }
 
         /* Try to optimize kprobe */
         try_to_optimize_kprobe(p);
@@ -1608,11 +1643,12 @@ static int aggr_kprobe_disabled(struct kprobe *ap)
 static struct kprobe *__disable_kprobe(struct kprobe *p)
 {
         struct kprobe *orig_p;
+        int ret;
 
         /* Get an original kprobe for return */
         orig_p = __get_valid_kprobe(p);
         if (unlikely(orig_p == NULL))
-                return NULL;
+                return ERR_PTR(-EINVAL);
 
         if (!kprobe_disabled(p)) {
                 /* Disable probe if it is a child probe */
@@ -1626,8 +1662,13 @@ static struct kprobe *__disable_kprobe(struct kprobe *p)
                          * should have already been disarmed, so
                          * skip unneed disarming process.
                          */
-                        if (!kprobes_all_disarmed)
-                                disarm_kprobe(orig_p, true);
+                        if (!kprobes_all_disarmed) {
+                                ret = disarm_kprobe(orig_p, true);
+                                if (ret) {
+                                        p->flags &= ~KPROBE_FLAG_DISABLED;
+                                        return ERR_PTR(ret);
+                                }
+                        }
                         orig_p->flags |= KPROBE_FLAG_DISABLED;
                 }
         }
@@ -1644,8 +1685,8 @@ static int __unregister_kprobe_top(struct kprobe *p)
 
         /* Disable kprobe. This will disarm it if needed. */
         ap = __disable_kprobe(p);
-        if (ap == NULL)
-                return -EINVAL;
+        if (IS_ERR(ap))
+                return PTR_ERR(ap);
 
         if (ap == p)
                 /*
@@ -2078,12 +2119,14 @@ static void kill_kprobe(struct kprobe *p)
 int disable_kprobe(struct kprobe *kp)
 {
         int ret = 0;
+        struct kprobe *p;
 
         mutex_lock(&kprobe_mutex);
 
         /* Disable this kprobe */
-        if (__disable_kprobe(kp) == NULL)
-                ret = -EINVAL;
+        p = __disable_kprobe(kp);
+        if (IS_ERR(p))
+                ret = PTR_ERR(p);
 
         mutex_unlock(&kprobe_mutex);
         return ret;
@@ -2116,7 +2159,9 @@ int enable_kprobe(struct kprobe *kp)
 
         if (!kprobes_all_disarmed && kprobe_disabled(p)) {
                 p->flags &= ~KPROBE_FLAG_DISABLED;
-                arm_kprobe(p);
+                ret = arm_kprobe(p);
+                if (ret)
+                        p->flags |= KPROBE_FLAG_DISABLED;
         }
 out:
         mutex_unlock(&kprobe_mutex);
@@ -2407,11 +2452,12 @@ static const struct file_operations debugfs_kprobe_blacklist_ops = {
         .release        = seq_release,
 };
 
-static void arm_all_kprobes(void)
+static int arm_all_kprobes(void)
 {
         struct hlist_head *head;
         struct kprobe *p;
-        unsigned int i;
+        unsigned int i, total = 0, errors = 0;
+        int err, ret = 0;
 
         mutex_lock(&kprobe_mutex);
 
@@ -2428,46 +2474,74 @@ static void arm_all_kprobes(void)
         /* Arming kprobes doesn't optimize kprobe itself */
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
-                hlist_for_each_entry_rcu(p, head, hlist)
-                        if (!kprobe_disabled(p))
-                                arm_kprobe(p);
+                /* Arm all kprobes on a best-effort basis */
+                hlist_for_each_entry_rcu(p, head, hlist) {
+                        if (!kprobe_disabled(p)) {
+                                err = arm_kprobe(p);
+                                if (err)  {
+                                        errors++;
+                                        ret = err;
+                                }
+                                total++;
+                        }
+                }
         }
 
-        printk(KERN_INFO "Kprobes globally enabled\n");
+        if (errors)
+                pr_warn("Kprobes globally enabled, but failed to arm %d out of %d probes\n",
+                        errors, total);
+        else
+                pr_info("Kprobes globally enabled\n");
 
 already_enabled:
         mutex_unlock(&kprobe_mutex);
-        return;
+        return ret;
 }
 
-static void disarm_all_kprobes(void)
+static int disarm_all_kprobes(void)
 {
         struct hlist_head *head;
         struct kprobe *p;
-        unsigned int i;
+        unsigned int i, total = 0, errors = 0;
+        int err, ret = 0;
 
         mutex_lock(&kprobe_mutex);
 
         /* If kprobes are already disarmed, just return */
         if (kprobes_all_disarmed) {
                 mutex_unlock(&kprobe_mutex);
-                return;
+                return 0;
         }
 
         kprobes_all_disarmed = true;
-        printk(KERN_INFO "Kprobes globally disabled\n");
 
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
+                /* Disarm all kprobes on a best-effort basis */
                 hlist_for_each_entry_rcu(p, head, hlist) {
-                        if (!arch_trampoline_kprobe(p) && !kprobe_disabled(p))
-                                disarm_kprobe(p, false);
+                        if (!arch_trampoline_kprobe(p) && !kprobe_disabled(p)) {
+                                err = disarm_kprobe(p, false);
+                                if (err) {
+                                        errors++;
+                                        ret = err;
+                                }
+                                total++;
+                        }
                 }
         }
+
+        if (errors)
+                pr_warn("Kprobes globally disabled, but failed to disarm %d out of %d probes\n",
+                        errors, total);
+        else
+                pr_info("Kprobes globally disabled\n");
+
         mutex_unlock(&kprobe_mutex);
 
         /* Wait for disarming all kprobes by optimizer */
         wait_for_kprobe_optimizer();
+
+        return ret;
 }
 
 /*
@@ -2494,6 +2568,7 @@ static ssize_t write_enabled_file_bool(struct file *file,
 {
         char buf[32];
         size_t buf_size;
+        int ret = 0;
 
         buf_size = min(count, (sizeof(buf)-1));
         if (copy_from_user(buf, user_buf, buf_size))
@@ -2504,17 +2579,20 @@ static ssize_t write_enabled_file_bool(struct file *file,
         case 'y':
         case 'Y':
         case '1':
-                arm_all_kprobes();
+                ret = arm_all_kprobes();
                 break;
         case 'n':
         case 'N':
         case '0':
-                disarm_all_kprobes();
+                ret = disarm_all_kprobes();
                 break;
         default:
                 return -EINVAL;
         }
 
+        if (ret)
+                return ret;
+
         return count;
 }
 
diff --git a/kernel/locking/qspinlock.c b/kernel/locking/qspinlock.c
index 38ece035039e..d880296245c5 100644
--- a/kernel/locking/qspinlock.c
+++ b/kernel/locking/qspinlock.c
@@ -379,6 +379,14 @@ queue:
         tail = encode_tail(smp_processor_id(), idx);
 
         node += idx;
+
+        /*
+         * Ensure that we increment the head node->count before initialising
+         * the actual node. If the compiler is kind enough to reorder these
+         * stores, then an IRQ could overwrite our assignments.
+         */
+        barrier();
+
         node->locked = 0;
         node->next = NULL;
         pv_init_node(node);
@@ -408,14 +416,15 @@ queue:
          */
         if (old & _Q_TAIL_MASK) {
                 prev = decode_tail(old);
+
                 /*
-                 * The above xchg_tail() is also a load of @lock which
-                 * generates, through decode_tail(), a pointer.  The address
-                 * dependency matches the RELEASE of xchg_tail() such that
-                 * the subsequent access to @prev happens after.
+                 * We must ensure that the stores to @node are observed before
+                 * the write to prev->next. The address dependency from
+                 * xchg_tail is not sufficient to ensure this because the read
+                 * component of xchg_tail is unordered with respect to the
+                 * initialisation of @node.
                  */
-
-                WRITE_ONCE(prev->next, node);
+                smp_store_release(&prev->next, node);
 
                 pv_wait_node(node, prev);
                 arch_mcs_spin_lock_contended(&node->locked);
diff --git a/kernel/relay.c b/kernel/relay.c
index c3029402f15c..c955b10c973c 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -163,7 +163,7 @@ static struct rchan_buf *relay_create_buf(struct rchan *chan)
 {
         struct rchan_buf *buf;
 
-        if (chan->n_subbufs > UINT_MAX / sizeof(size_t *))
+        if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t *))
                 return NULL;
 
         buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index bf724c1952ea..e7c535eee0a6 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2601,19 +2601,31 @@ static inline void finish_task(struct task_struct *prev)
 #endif
 }
 
-static inline void finish_lock_switch(struct rq *rq)
+static inline void
+prepare_lock_switch(struct rq *rq, struct task_struct *next, struct rq_flags *rf)
 {
+        /*
+         * Since the runqueue lock will be released by the next
+         * task (which is an invalid locking op but in the case
+         * of the scheduler it's an obvious special-case), so we
+         * do an early lockdep release here:
+         */
+        rq_unpin_lock(rq, rf);
+        spin_release(&rq->lock.dep_map, 1, _THIS_IP_);
 #ifdef CONFIG_DEBUG_SPINLOCK
         /* this is a valid case when another task releases the spinlock */
-        rq->lock.owner = current;
+        rq->lock.owner = next;
 #endif
+}
+
+static inline void finish_lock_switch(struct rq *rq)
+{
         /*
          * If we are tracking spinlock dependencies then we have to
          * fix up the runqueue lock - which gets 'carried over' from
          * prev into current:
          */
         spin_acquire(&rq->lock.dep_map, 0, 0, _THIS_IP_);
-
         raw_spin_unlock_irq(&rq->lock);
 }
 
@@ -2844,14 +2856,7 @@ context_switch(struct rq *rq, struct task_struct *prev,
 
         rq->clock_update_flags &= ~(RQCF_ACT_SKIP|RQCF_REQ_SKIP);
 
-        /*
-         * Since the runqueue lock will be released by the next
-         * task (which is an invalid locking op but in the case
-         * of the scheduler it's an obvious special-case), so we
-         * do an early lockdep release here:
-         */
-        rq_unpin_lock(rq, rf);
-        spin_release(&rq->lock.dep_map, 1, _THIS_IP_);
+        prepare_lock_switch(rq, next, rf);
 
         /* Here we just switch the register state and the stack. */
         switch_to(prev, next, prev);
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index dd062a1c8cf0..7936f548e071 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -19,8 +19,6 @@
 
 #include "sched.h"
 
-#define SUGOV_KTHREAD_PRIORITY  50
-
 struct sugov_tunables {
         struct gov_attr_set attr_set;
         unsigned int rate_limit_us;
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 9bb0e0c412ec..9df09782025c 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -1153,6 +1153,7 @@ static void update_curr_dl(struct rq *rq)
         struct sched_dl_entity *dl_se = &curr->dl;
         u64 delta_exec, scaled_delta_exec;
         int cpu = cpu_of(rq);
+        u64 now;
 
         if (!dl_task(curr) || !on_dl_rq(dl_se))
                 return;
@@ -1165,7 +1166,8 @@ static void update_curr_dl(struct rq *rq)
          * natural solution, but the full ramifications of this
          * approach need further study.
          */
-        delta_exec = rq_clock_task(rq) - curr->se.exec_start;
+        now = rq_clock_task(rq);
+        delta_exec = now - curr->se.exec_start;
         if (unlikely((s64)delta_exec <= 0)) {
                 if (unlikely(dl_se->dl_yielded))
                         goto throttle;
@@ -1178,7 +1180,7 @@ static void update_curr_dl(struct rq *rq)
         curr->se.sum_exec_runtime += delta_exec;
         account_group_exec_runtime(curr, delta_exec);
 
-        curr->se.exec_start = rq_clock_task(rq);
+        curr->se.exec_start = now;
         cgroup_account_cputime(curr, delta_exec);
 
         sched_rt_avg_update(rq, delta_exec);
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 663b2355a3aa..aad49451584e 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -950,12 +950,13 @@ static void update_curr_rt(struct rq *rq)
 {
         struct task_struct *curr = rq->curr;
         struct sched_rt_entity *rt_se = &curr->rt;
-        u64 now = rq_clock_task(rq);
         u64 delta_exec;
+        u64 now;
 
         if (curr->sched_class != &rt_sched_class)
                 return;
 
+        now = rq_clock_task(rq);
         delta_exec = now - curr->se.exec_start;
         if (unlikely((s64)delta_exec <= 0))
                 return;
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 940fa408a288..dc77548167ef 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1076,14 +1076,16 @@ long seccomp_get_metadata(struct task_struct *task,
 
         size = min_t(unsigned long, size, sizeof(kmd));
 
-        if (copy_from_user(&kmd, data, size))
+        if (size < sizeof(kmd.filter_off))
+                return -EINVAL;
+
+        if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
                 return -EFAULT;
 
         filter = get_nth_filter(task, kmd.filter_off);
         if (IS_ERR(filter))
                 return PTR_ERR(filter);
 
-        memset(&kmd, 0, sizeof(kmd));
         if (filter->log)
                 kmd.flags |= SECCOMP_FILTER_FLAG_LOG;
 
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index fc2838ac8b78..c0a9e310d715 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -872,6 +872,8 @@ int perf_event_query_prog_array(struct perf_event *event, void __user *info)
                 return -EINVAL;
         if (copy_from_user(&query, uquery, sizeof(query)))
                 return -EFAULT;
+        if (query.ids_len > BPF_TRACE_MAX_PROGS)
+                return -E2BIG;
 
         mutex_lock(&bpf_event_mutex);
         ret = bpf_prog_array_copy_info(event->tp_event->prog_array,
diff --git a/kernel/user.c b/kernel/user.c
index 9a20acce460d..36288d840675 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -101,6 +101,7 @@ struct user_struct root_user = {
         .sigpending     = ATOMIC_INIT(0),
         .locked_shm     = 0,
         .uid            = GLOBAL_ROOT_UID,
+        .ratelimit      = RATELIMIT_STATE_INIT(root_user.ratelimit, 0, 0),
 };
 
 /*
@@ -191,6 +192,8 @@ struct user_struct *alloc_uid(kuid_t uid)
 
                 new->uid = uid;
                 atomic_set(&new->__count, 1);
+                ratelimit_state_init(&new->ratelimit, HZ, 100);
+                ratelimit_set_flags(&new->ratelimit, RATELIMIT_MSG_ON_RELEASE);
 
                 /*
                  * Before adding this, check whether we raced
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 017044c26233..bb9a519cbf50 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -4180,6 +4180,22 @@ void workqueue_set_max_active(struct workqueue_struct *wq, int max_active)
 EXPORT_SYMBOL_GPL(workqueue_set_max_active);
 
 /**
+ * current_work - retrieve %current task's work struct
+ *
+ * Determine if %current task is a workqueue worker and what it's working on.
+ * Useful to find out the context that the %current task is running in.
+ *
+ * Return: work struct if %current task is a workqueue worker, %NULL otherwise.
+ */
+struct work_struct *current_work(void)
+{
+        struct worker *worker = current_wq_worker();
+
+        return worker ? worker->current_work : NULL;
+}
+EXPORT_SYMBOL(current_work);
+
+/**
  * current_is_workqueue_rescuer - is %current workqueue rescuer?
  *
  * Determine whether %current is a workqueue rescuer.  Can be used from
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 6088408ef26c..64155e310a9f 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1642,6 +1642,7 @@ config DMA_API_DEBUG
 
 menuconfig RUNTIME_TESTING_MENU
         bool "Runtime Testing"
+        def_bool y
 
 if RUNTIME_TESTING_MENU
 
diff --git a/lib/dma-direct.c b/lib/dma-direct.c
index 40b1f92f2214..c9e8e21cb334 100644
--- a/lib/dma-direct.c
+++ b/lib/dma-direct.c
@@ -84,6 +84,10 @@ again:
         return page_address(page);
 }
 
+/*
+ * NOTE: this function must never look at the dma_addr argument, because we want
+ * to be able to use it as a helper for iommu implementations as well.
+ */
 void dma_direct_free(struct device *dev, size_t size, void *cpu_addr,
                 dma_addr_t dma_addr, unsigned long attrs)
 {
@@ -152,5 +156,6 @@ const struct dma_map_ops dma_direct_ops = {
         .map_sg                 = dma_direct_map_sg,
         .dma_supported          = dma_direct_supported,
         .mapping_error          = dma_direct_mapping_error,
+        .is_phys                = 1,
 };
 EXPORT_SYMBOL(dma_direct_ops);
diff --git a/lib/idr.c b/lib/idr.c
index c98d77fcf393..99ec5bc89d25 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -431,7 +431,6 @@ int ida_get_new_above(struct ida *ida, int start, int *id)
                         bitmap = this_cpu_xchg(ida_bitmap, NULL);
                         if (!bitmap)
                                 return -EAGAIN;
-                        memset(bitmap, 0, sizeof(*bitmap));
                         bitmap->bitmap[0] = tmp >> RADIX_TREE_EXCEPTIONAL_SHIFT;
                         rcu_assign_pointer(*slot, bitmap);
                 }
@@ -464,7 +463,6 @@ int ida_get_new_above(struct ida *ida, int start, int *id)
                         bitmap = this_cpu_xchg(ida_bitmap, NULL);
                         if (!bitmap)
                                 return -EAGAIN;
-                        memset(bitmap, 0, sizeof(*bitmap));
                         __set_bit(bit, bitmap->bitmap);
                         radix_tree_iter_replace(root, &iter, slot, bitmap);
                 }
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 0a7ae3288a24..8e00138d593f 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -2125,7 +2125,7 @@ int ida_pre_get(struct ida *ida, gfp_t gfp)
                 preempt_enable();
 
         if (!this_cpu_read(ida_bitmap)) {
-                struct ida_bitmap *bitmap = kmalloc(sizeof(*bitmap), gfp);
+                struct ida_bitmap *bitmap = kzalloc(sizeof(*bitmap), gfp);
                 if (!bitmap)
                         return 0;
                 if (this_cpu_cmpxchg(ida_bitmap, NULL, bitmap))
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 77ee6ced11b1..d7a708f82559 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -1849,7 +1849,7 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
 {
         const int default_width = 2 * sizeof(void *);
 
-        if (!ptr && *fmt != 'K') {
+        if (!ptr && *fmt != 'K' && *fmt != 'x') {
                 /*
                  * Print (null) with the same width as a pointer so it makes
                  * tabular output look nice.
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 4b80ccee4535..8291b75f42c8 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1139,8 +1139,6 @@ int memory_failure(unsigned long pfn, int flags)
                 return 0;
         }
 
-        arch_unmap_kpfn(pfn);
-
         orig_head = hpage = compound_head(p);
         num_poisoned_pages_inc();
 
diff --git a/mm/memory.c b/mm/memory.c
index dd8de96f5547..5fcfc24904d1 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -80,7 +80,7 @@
 
 #include "internal.h"
 
-#ifdef LAST_CPUPID_NOT_IN_PAGE_FLAGS
+#if defined(LAST_CPUPID_NOT_IN_PAGE_FLAGS) && !defined(CONFIG_COMPILE_TEST)
 #warning Unfortunate NUMA and NUMA Balancing config, growing page-frame for last_cpupid.
 #endif
 
diff --git a/mm/mlock.c b/mm/mlock.c
index 79398200e423..74e5a6547c3d 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -64,6 +64,12 @@ void clear_page_mlock(struct page *page)
         mod_zone_page_state(page_zone(page), NR_MLOCK,
                             -hpage_nr_pages(page));
         count_vm_event(UNEVICTABLE_PGCLEARED);
+        /*
+         * The previous TestClearPageMlocked() corresponds to the smp_mb()
+         * in __pagevec_lru_add_fn().
+         *
+         * See __pagevec_lru_add_fn for more explanation.
+         */
         if (!isolate_lru_page(page)) {
                 putback_lru_page(page);
         } else {
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 81e18ceef579..cb416723538f 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -46,6 +46,7 @@
 #include <linux/stop_machine.h>
 #include <linux/sort.h>
 #include <linux/pfn.h>
+#include <xen/xen.h>
 #include <linux/backing-dev.h>
 #include <linux/fault-inject.h>
 #include <linux/page-isolation.h>
@@ -347,6 +348,9 @@ static inline bool update_defer_init(pg_data_t *pgdat,
         /* Always populate low zones for address-constrained allocations */
         if (zone_end < pgdat_end_pfn(pgdat))
                 return true;
+        /* Xen PV domains need page structures early */
+        if (xen_pv_domain())
+                return true;
         (*nr_initialised)++;
         if ((*nr_initialised > pgdat->static_init_pgcnt) &&
             (pfn & (PAGES_PER_SECTION - 1)) == 0) {
diff --git a/mm/swap.c b/mm/swap.c
index 567a7b96e41d..0f17330dd0e5 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -446,30 +446,6 @@ void lru_cache_add(struct page *page)
 }
 
 /**
- * add_page_to_unevictable_list - add a page to the unevictable list
- * @page:  the page to be added to the unevictable list
- *
- * Add page directly to its zone's unevictable list.  To avoid races with
- * tasks that might be making the page evictable, through eg. munlock,
- * munmap or exit, while it's not on the lru, we want to add the page
- * while it's locked or otherwise "invisible" to other tasks.  This is
- * difficult to do when using the pagevec cache, so bypass that.
- */
-void add_page_to_unevictable_list(struct page *page)
-{
-        struct pglist_data *pgdat = page_pgdat(page);
-        struct lruvec *lruvec;
-
-        spin_lock_irq(&pgdat->lru_lock);
-        lruvec = mem_cgroup_page_lruvec(page, pgdat);
-        ClearPageActive(page);
-        SetPageUnevictable(page);
-        SetPageLRU(page);
-        add_page_to_lru_list(page, lruvec, LRU_UNEVICTABLE);
-        spin_unlock_irq(&pgdat->lru_lock);
-}
-
-/**
  * lru_cache_add_active_or_unevictable
  * @page:  the page to be added to LRU
  * @vma:   vma in which page is mapped for determining reclaimability
@@ -484,13 +460,9 @@ void lru_cache_add_active_or_unevictable(struct page *page,
 {
         VM_BUG_ON_PAGE(PageLRU(page), page);
 
-        if (likely((vma->vm_flags & (VM_LOCKED | VM_SPECIAL)) != VM_LOCKED)) {
+        if (likely((vma->vm_flags & (VM_LOCKED | VM_SPECIAL)) != VM_LOCKED))
                 SetPageActive(page);
-                lru_cache_add(page);
-                return;
-        }
-
-        if (!TestSetPageMlocked(page)) {
+        else if (!TestSetPageMlocked(page)) {
                 /*
                  * We use the irq-unsafe __mod_zone_page_stat because this
                  * counter is not modified from interrupt context, and the pte
@@ -500,7 +472,7 @@ void lru_cache_add_active_or_unevictable(struct page *page,
                                     hpage_nr_pages(page));
                 count_vm_event(UNEVICTABLE_PGMLOCKED);
         }
-        add_page_to_unevictable_list(page);
+        lru_cache_add(page);
 }
 
 /*
@@ -886,15 +858,55 @@ void lru_add_page_tail(struct page *page, struct page *page_tail,
 static void __pagevec_lru_add_fn(struct page *page, struct lruvec *lruvec,
                                  void *arg)
 {
-        int file = page_is_file_cache(page);
-        int active = PageActive(page);
-        enum lru_list lru = page_lru(page);
+        enum lru_list lru;
+        int was_unevictable = TestClearPageUnevictable(page);
 
         VM_BUG_ON_PAGE(PageLRU(page), page);
 
         SetPageLRU(page);
+        /*
+         * Page becomes evictable in two ways:
+         * 1) Within LRU lock [munlock_vma_pages() and __munlock_pagevec()].
+         * 2) Before acquiring LRU lock to put the page to correct LRU and then
+         *   a) do PageLRU check with lock [check_move_unevictable_pages]
+         *   b) do PageLRU check before lock [clear_page_mlock]
+         *
+         * (1) & (2a) are ok as LRU lock will serialize them. For (2b), we need
+         * following strict ordering:
+         *
+         * #0: __pagevec_lru_add_fn             #1: clear_page_mlock
+         *
+         * SetPageLRU()                         TestClearPageMlocked()
+         * smp_mb() // explicit ordering        // above provides strict
+         *                                      // ordering
+         * PageMlocked()                        PageLRU()
+         *
+         *
+         * if '#1' does not observe setting of PG_lru by '#0' and fails
+         * isolation, the explicit barrier will make sure that page_evictable
+         * check will put the page in correct LRU. Without smp_mb(), SetPageLRU
+         * can be reordered after PageMlocked check and can make '#1' to fail
+         * the isolation of the page whose Mlocked bit is cleared (#0 is also
+         * looking at the same page) and the evictable page will be stranded
+         * in an unevictable LRU.
+         */
+        smp_mb();
+
+        if (page_evictable(page)) {
+                lru = page_lru(page);
+                update_page_reclaim_stat(lruvec, page_is_file_cache(page),
+                                         PageActive(page));
+                if (was_unevictable)
+                        count_vm_event(UNEVICTABLE_PGRESCUED);
+        } else {
+                lru = LRU_UNEVICTABLE;
+                ClearPageActive(page);
+                SetPageUnevictable(page);
+                if (!was_unevictable)
+                        count_vm_event(UNEVICTABLE_PGCULLED);
+        }
+
         add_page_to_lru_list(page, lruvec, lru);
-        update_page_reclaim_stat(lruvec, file, active);
         trace_mm_lru_insertion(page, lru);
 }
 
@@ -913,7 +925,7 @@ EXPORT_SYMBOL(__pagevec_lru_add);
  * @pvec:       Where the resulting entries are placed
  * @mapping:    The address_space to search
  * @start:      The starting entry index
- * @nr_pages:   The maximum number of pages
+ * @nr_entries: The maximum number of pages
  * @indices:    The cache indices corresponding to the entries in @pvec
  *
  * pagevec_lookup_entries() will search for and return a group of up
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 673942094328..ebff729cc956 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1943,11 +1943,15 @@ void *vmalloc_exec(unsigned long size)
 }
 
 #if defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA32)
-#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL
+#define GFP_VMALLOC32 (GFP_DMA32 | GFP_KERNEL)
 #elif defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA)
-#define GFP_VMALLOC32 GFP_DMA | GFP_KERNEL
+#define GFP_VMALLOC32 (GFP_DMA | GFP_KERNEL)
 #else
-#define GFP_VMALLOC32 GFP_KERNEL
+/*
+ * 64b systems should always have either DMA or DMA32 zones. For others
+ * GFP_DMA32 should do the right thing and use the normal zone.
+ */
+#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL
 #endif
 
 /**
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 444749669187..bee53495a829 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -769,64 +769,7 @@ int remove_mapping(struct address_space *mapping, struct page *page)
  */
 void putback_lru_page(struct page *page)
 {
-        bool is_unevictable;
-        int was_unevictable = PageUnevictable(page);
-
-        VM_BUG_ON_PAGE(PageLRU(page), page);
-
-redo:
-        ClearPageUnevictable(page);
-
-        if (page_evictable(page)) {
-                /*
-                 * For evictable pages, we can use the cache.
-                 * In event of a race, worst case is we end up with an
-                 * unevictable page on [in]active list.
-                 * We know how to handle that.
-                 */
-                is_unevictable = false;
-                lru_cache_add(page);
-        } else {
-                /*
-                 * Put unevictable pages directly on zone's unevictable
-                 * list.
-                 */
-                is_unevictable = true;
-                add_page_to_unevictable_list(page);
-                /*
-                 * When racing with an mlock or AS_UNEVICTABLE clearing
-                 * (page is unlocked) make sure that if the other thread
-                 * does not observe our setting of PG_lru and fails
-                 * isolation/check_move_unevictable_pages,
-                 * we see PG_mlocked/AS_UNEVICTABLE cleared below and move
-                 * the page back to the evictable list.
-                 *
-                 * The other side is TestClearPageMlocked() or shmem_lock().
-                 */
-                smp_mb();
-        }
-
-        /*
-         * page's status can change while we move it among lru. If an evictable
-         * page is on unevictable list, it never be freed. To avoid that,
-         * check after we added it to the list, again.
-         */
-        if (is_unevictable && page_evictable(page)) {
-                if (!isolate_lru_page(page)) {
-                        put_page(page);
-                        goto redo;
-                }
-                /* This means someone else dropped this page from LRU
-                 * So, it will be freed or putback to LRU again. There is
-                 * nothing to do here.
-                 */
-        }
-
-        if (was_unevictable && !is_unevictable)
-                count_vm_event(UNEVICTABLE_PGRESCUED);
-        else if (!was_unevictable && is_unevictable)
-                count_vm_event(UNEVICTABLE_PGCULLED);
-
+        lru_cache_add(page);
         put_page(page);         /* drop ref from isolate */
 }
 
diff --git a/mm/zpool.c b/mm/zpool.c
index f8cb83e7699b..01a771e304fa 100644
--- a/mm/zpool.c
+++ b/mm/zpool.c
@@ -360,7 +360,7 @@ u64 zpool_get_total_size(struct zpool *zpool)
 
 /**
  * zpool_evictable() - Test if zpool is potentially evictable
- * @pool        The zpool to test
+ * @zpool:      The zpool to test
  *
  * Zpool is only potentially evictable when it's created with struct
  * zpool_ops.evict and its driver implements struct zpool_driver.shrink.
diff --git a/mm/zswap.c b/mm/zswap.c
index c004aa4fd3f4..61a5c41972db 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -1007,6 +1007,12 @@ static int zswap_frontswap_store(unsigned type, pgoff_t offset,
         u8 *src, *dst;
         struct zswap_header zhdr = { .swpentry = swp_entry(type, offset) };
 
+        /* THP isn't supported */
+        if (PageTransHuge(page)) {
+                ret = -EINVAL;
+                goto reject;
+        }
+
         if (!zswap_enabled || !tree) {
                 ret = -ENODEV;
                 goto reject;
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index f3a4efcf1456..3aa5a93ad107 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -160,7 +160,8 @@ static void req_done(struct virtqueue *vq)
                 spin_unlock_irqrestore(&chan->lock, flags);
                 /* Wakeup if anyone waiting for VirtIO ring space. */
                 wake_up(chan->vc_wq);
-                p9_client_cb(chan->client, req, REQ_STATUS_RCVD);
+                if (len)
+                        p9_client_cb(chan->client, req, REQ_STATUS_RCVD);
         }
 }
 
diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
index 0254c35b2bf0..126a8ea73c96 100644
--- a/net/bridge/br_sysfs_if.c
+++ b/net/bridge/br_sysfs_if.c
@@ -255,6 +255,9 @@ static ssize_t brport_show(struct kobject *kobj,
         struct brport_attribute *brport_attr = to_brport_attr(attr);
         struct net_bridge_port *p = to_brport(kobj);
 
+        if (!brport_attr->show)
+                return -EINVAL;
+
         return brport_attr->show(p, buf);
 }
 
diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c
index 279527f8b1fe..ce7152a12bd8 100644
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -187,17 +187,17 @@ static int ebt_among_mt_check(const struct xt_mtchk_param *par)
         expected_length += ebt_mac_wormhash_size(wh_src);
 
         if (em->match_size != EBT_ALIGN(expected_length)) {
-                pr_info("wrong size: %d against expected %d, rounded to %zd\n",
-                        em->match_size, expected_length,
-                        EBT_ALIGN(expected_length));
+                pr_err_ratelimited("wrong size: %d against expected %d, rounded to %zd\n",
+                                   em->match_size, expected_length,
+                                   EBT_ALIGN(expected_length));
                 return -EINVAL;
         }
         if (wh_dst && (err = ebt_mac_wormhash_check_integrity(wh_dst))) {
-                pr_info("dst integrity fail: %x\n", -err);
+                pr_err_ratelimited("dst integrity fail: %x\n", -err);
                 return -EINVAL;
         }
         if (wh_src && (err = ebt_mac_wormhash_check_integrity(wh_src))) {
-                pr_info("src integrity fail: %x\n", -err);
+                pr_err_ratelimited("src integrity fail: %x\n", -err);
                 return -EINVAL;
         }
         return 0;
diff --git a/net/bridge/netfilter/ebt_limit.c b/net/bridge/netfilter/ebt_limit.c
index 61a9f1be1263..165b9d678cf1 100644
--- a/net/bridge/netfilter/ebt_limit.c
+++ b/net/bridge/netfilter/ebt_limit.c
@@ -72,8 +72,8 @@ static int ebt_limit_mt_check(const struct xt_mtchk_param *par)
         /* Check for overflow. */
         if (info->burst == 0 ||
             user2credits(info->avg * info->burst) < user2credits(info->avg)) {
-                pr_info("overflow, try lower: %u/%u\n",
-                        info->avg, info->burst);
+                pr_info_ratelimited("overflow, try lower: %u/%u\n",
+                                    info->avg, info->burst);
                 return -EINVAL;
         }
 
diff --git a/net/core/dev.c b/net/core/dev.c
index dda9d7b9a840..d4362befe7e2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2382,8 +2382,11 @@ EXPORT_SYMBOL(netdev_set_num_tc);
  */
 int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
 {
+        bool disabling;
         int rc;
 
+        disabling = txq < dev->real_num_tx_queues;
+
         if (txq < 1 || txq > dev->num_tx_queues)
                 return -EINVAL;
 
@@ -2399,15 +2402,19 @@ int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
                 if (dev->num_tc)
                         netif_setup_tc(dev, txq);
 
-                if (txq < dev->real_num_tx_queues) {
+                dev->real_num_tx_queues = txq;
+
+                if (disabling) {
+                        synchronize_net();
                         qdisc_reset_all_tx_gt(dev, txq);
 #ifdef CONFIG_XPS
                         netif_reset_xps_queues_gt(dev, txq);
 #endif
                 }
+        } else {
+                dev->real_num_tx_queues = txq;
         }
 
-        dev->real_num_tx_queues = txq;
         return 0;
 }
 EXPORT_SYMBOL(netif_set_real_num_tx_queues);
diff --git a/net/core/filter.c b/net/core/filter.c
index 08ab4c65a998..0c121adbdbaa 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3381,17 +3381,13 @@ BPF_CALL_2(bpf_sock_ops_cb_flags_set, struct bpf_sock_ops_kern *, bpf_sock,
         struct sock *sk = bpf_sock->sk;
         int val = argval & BPF_SOCK_OPS_ALL_CB_FLAGS;
 
-        if (!sk_fullsock(sk))
+        if (!IS_ENABLED(CONFIG_INET) || !sk_fullsock(sk))
                 return -EINVAL;
 
-#ifdef CONFIG_INET
         if (val)
                 tcp_sk(sk)->bpf_sock_ops_cb_flags = val;
 
         return argval & (~BPF_SOCK_OPS_ALL_CB_FLAGS);
-#else
-        return -EINVAL;
-#endif
 }
 
 static const struct bpf_func_proto bpf_sock_ops_cb_flags_set_proto = {
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 0a3f88f08727..98fd12721221 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -66,6 +66,7 @@ struct net_rate_estimator {
 static void est_fetch_counters(struct net_rate_estimator *e,
                                struct gnet_stats_basic_packed *b)
 {
+        memset(b, 0, sizeof(*b));
         if (e->stats_lock)
                 spin_lock(e->stats_lock);
 
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 91dd09f79808..791aff68af88 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1338,6 +1338,12 @@ static int dn_setsockopt(struct socket *sock, int level, int optname, char __use
         lock_sock(sk);
         err = __dn_setsockopt(sock, level, optname, optval, optlen, 0);
         release_sock(sk);
+#ifdef CONFIG_NETFILTER
+        /* we need to exclude all possible ENOPROTOOPTs except default case */
+        if (err == -ENOPROTOOPT && optname != DSO_LINKINFO &&
+            optname != DSO_STREAM && optname != DSO_SEQPACKET)
+                err = nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
+#endif
 
         return err;
 }
@@ -1445,15 +1451,6 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us
                 dn_nsp_send_disc(sk, 0x38, 0, sk->sk_allocation);
                 break;
 
-        default:
-#ifdef CONFIG_NETFILTER
-                return nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
-#endif
-        case DSO_LINKINFO:
-        case DSO_STREAM:
-        case DSO_SEQPACKET:
-                return -ENOPROTOOPT;
-
         case DSO_MAXWINDOW:
                 if (optlen != sizeof(unsigned long))
                         return -EINVAL;
@@ -1501,6 +1498,12 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us
                         return -EINVAL;
                 scp->info_loc = u.info;
                 break;
+
+        case DSO_LINKINFO:
+        case DSO_STREAM:
+        case DSO_SEQPACKET:
+        default:
+                return -ENOPROTOOPT;
         }
 
         return 0;
@@ -1514,6 +1517,20 @@ static int dn_getsockopt(struct socket *sock, int level, int optname, char __use
         lock_sock(sk);
         err = __dn_getsockopt(sock, level, optname, optval, optlen, 0);
         release_sock(sk);
+#ifdef CONFIG_NETFILTER
+        if (err == -ENOPROTOOPT && optname != DSO_STREAM &&
+            optname != DSO_SEQPACKET && optname != DSO_CONACCEPT &&
+            optname != DSO_CONREJECT) {
+                int len;
+
+                if (get_user(len, optlen))
+                        return -EFAULT;
+
+                err = nf_getsockopt(sk, PF_DECnet, optname, optval, &len);
+                if (err >= 0)
+                        err = put_user(len, optlen);
+        }
+#endif
 
         return err;
 }
@@ -1579,26 +1596,6 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
                 r_data = &link;
                 break;
 
-        default:
-#ifdef CONFIG_NETFILTER
-        {
-                int ret, len;
-
-                if (get_user(len, optlen))
-                        return -EFAULT;
-
-                ret = nf_getsockopt(sk, PF_DECnet, optname, optval, &len);
-                if (ret >= 0)
-                        ret = put_user(len, optlen);
-                return ret;
-        }
-#endif
-        case DSO_STREAM:
-        case DSO_SEQPACKET:
-        case DSO_CONACCEPT:
-        case DSO_CONREJECT:
-                return -ENOPROTOOPT;
-
         case DSO_MAXWINDOW:
                 if (r_len > sizeof(unsigned long))
                         r_len = sizeof(unsigned long);
@@ -1630,6 +1627,13 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
                         r_len = sizeof(unsigned char);
                 r_data = &scp->info_rem;
                 break;
+
+        case DSO_STREAM:
+        case DSO_SEQPACKET:
+        case DSO_CONACCEPT:
+        case DSO_CONREJECT:
+        default:
+                return -ENOPROTOOPT;
         }
 
         if (r_data) {
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index c586597da20d..7d36a950d961 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -646,6 +646,11 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi,
                                             fi->fib_nh, cfg, extack))
                                 return 1;
                 }
+#ifdef CONFIG_IP_ROUTE_CLASSID
+                if (cfg->fc_flow &&
+                    cfg->fc_flow != fi->fib_nh->nh_tclassid)
+                        return 1;
+#endif
                 if ((!cfg->fc_oif || cfg->fc_oif == fi->fib_nh->nh_oif) &&
                     (!cfg->fc_gw  || cfg->fc_gw == fi->fib_nh->nh_gw))
                         return 0;
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 008be04ac1cc..9c41a0cef1a5 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1567,10 +1567,7 @@ int ip_getsockopt(struct sock *sk, int level,
                 if (get_user(len, optlen))
                         return -EFAULT;
 
-                lock_sock(sk);
-                err = nf_getsockopt(sk, PF_INET, optname, optval,
-                                &len);
-                release_sock(sk);
+                err = nf_getsockopt(sk, PF_INET, optname, optval, &len);
                 if (err >= 0)
                         err = put_user(len, optlen);
                 return err;
@@ -1602,9 +1599,7 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
                 if (get_user(len, optlen))
                         return -EFAULT;
 
-                lock_sock(sk);
                 err = compat_nf_getsockopt(sk, PF_INET, optname, optval, &len);
-                release_sock(sk);
                 if (err >= 0)
                         err = put_user(len, optlen);
                 return err;
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 4ffe302f9b82..e3e420f3ba7b 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -252,6 +252,10 @@ unsigned int arpt_do_table(struct sk_buff *skb,
                         }
                         if (table_base + v
                             != arpt_next_entry(e)) {
+                                if (unlikely(stackidx >= private->stacksize)) {
+                                        verdict = NF_DROP;
+                                        break;
+                                }
                                 jumpstack[stackidx++] = e;
                         }
 
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 9a71f3149507..e38395a8dcf2 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -330,8 +330,13 @@ ipt_do_table(struct sk_buff *skb,
                                 continue;
                         }
                         if (table_base + v != ipt_next_entry(e) &&
-                            !(e->ip.flags & IPT_F_GOTO))
+                            !(e->ip.flags & IPT_F_GOTO)) {
+                                if (unlikely(stackidx >= private->stacksize)) {
+                                        verdict = NF_DROP;
+                                        break;
+                                }
                                 jumpstack[stackidx++] = e;
+                        }
 
                         e = get_entry(table_base, v);
                         continue;
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 3a84a60f6b39..4b02ab39ebc5 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -107,12 +107,6 @@ clusterip_config_entry_put(struct net *net, struct clusterip_config *c)
 
         local_bh_disable();
         if (refcount_dec_and_lock(&c->entries, &cn->lock)) {
-                list_del_rcu(&c->list);
-                spin_unlock(&cn->lock);
-                local_bh_enable();
-
-                unregister_netdevice_notifier(&c->notifier);
-
                 /* In case anyone still accesses the file, the open/close
                  * functions are also incrementing the refcount on their own,
                  * so it's safe to remove the entry even if it's in use. */
@@ -120,6 +114,12 @@ clusterip_config_entry_put(struct net *net, struct clusterip_config *c)
                 if (cn->procdir)
                         proc_remove(c->pde);
 #endif
+                list_del_rcu(&c->list);
+                spin_unlock(&cn->lock);
+                local_bh_enable();
+
+                unregister_netdevice_notifier(&c->notifier);
+
                 return;
         }
         local_bh_enable();
@@ -154,8 +154,12 @@ clusterip_config_find_get(struct net *net, __be32 clusterip, int entry)
 #endif
                 if (unlikely(!refcount_inc_not_zero(&c->refcount)))
                         c = NULL;
-                else if (entry)
-                        refcount_inc(&c->entries);
+                else if (entry) {
+                        if (unlikely(!refcount_inc_not_zero(&c->entries))) {
+                                clusterip_config_put(c);
+                                c = NULL;
+                        }
+                }
         }
         rcu_read_unlock_bh();
 
diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
index 270765236f5e..aaaf9a81fbc9 100644
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ b/net/ipv4/netfilter/ipt_ECN.c
@@ -98,17 +98,15 @@ static int ecn_tg_check(const struct xt_tgchk_param *par)
         const struct ipt_ECN_info *einfo = par->targinfo;
         const struct ipt_entry *e = par->entryinfo;
 
-        if (einfo->operation & IPT_ECN_OP_MASK) {
-                pr_info("unsupported ECN operation %x\n", einfo->operation);
+        if (einfo->operation & IPT_ECN_OP_MASK)
                 return -EINVAL;
-        }
-        if (einfo->ip_ect & ~IPT_ECN_IP_MASK) {
-                pr_info("new ECT codepoint %x out of mask\n", einfo->ip_ect);
+
+        if (einfo->ip_ect & ~IPT_ECN_IP_MASK)
                 return -EINVAL;
-        }
+
         if ((einfo->operation & (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR)) &&
             (e->ip.proto != IPPROTO_TCP || (e->ip.invflags & XT_INV_PROTO))) {
-                pr_info("cannot use TCP operations on a non-tcp rule\n");
+                pr_info_ratelimited("cannot use operation on non-tcp rule\n");
                 return -EINVAL;
         }
         return 0;
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index 8bd0d7b26632..e8bed3390e58 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -74,13 +74,13 @@ static int reject_tg_check(const struct xt_tgchk_param *par)
         const struct ipt_entry *e = par->entryinfo;
 
         if (rejinfo->with == IPT_ICMP_ECHOREPLY) {
-                pr_info("ECHOREPLY no longer supported.\n");
+                pr_info_ratelimited("ECHOREPLY no longer supported.\n");
                 return -EINVAL;
         } else if (rejinfo->with == IPT_TCP_RESET) {
                 /* Must specify that it's a TCP packet */
                 if (e->ip.proto != IPPROTO_TCP ||
                     (e->ip.invflags & XT_INV_PROTO)) {
-                        pr_info("TCP_RESET invalid for non-tcp\n");
+                        pr_info_ratelimited("TCP_RESET invalid for non-tcp\n");
                         return -EINVAL;
                 }
         }
diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
index 37fb9552e858..fd01f13c896a 100644
--- a/net/ipv4/netfilter/ipt_rpfilter.c
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -105,14 +105,14 @@ static int rpfilter_check(const struct xt_mtchk_param *par)
         const struct xt_rpfilter_info *info = par->matchinfo;
         unsigned int options = ~XT_RPFILTER_OPTION_MASK;
         if (info->flags & options) {
-                pr_info("unknown options encountered");
+                pr_info_ratelimited("unknown options\n");
                 return -EINVAL;
         }
 
         if (strcmp(par->table, "mangle") != 0 &&
             strcmp(par->table, "raw") != 0) {
-                pr_info("match only valid in the \'raw\' "
-                        "or \'mangle\' tables, not \'%s\'.\n", par->table);
+                pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n",
+                                    par->table);
                 return -EINVAL;
         }
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 49cc1c1df1ba..a4f44d815a61 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1826,6 +1826,8 @@ int fib_multipath_hash(const struct fib_info *fi, const struct flowi4 *fl4,
                                 return skb_get_hash_raw(skb) >> 1;
                         memset(&hash_keys, 0, sizeof(hash_keys));
                         skb_flow_dissect_flow_keys(skb, &keys, flag);
+
+                        hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
                         hash_keys.addrs.v4addrs.src = keys.addrs.v4addrs.src;
                         hash_keys.addrs.v4addrs.dst = keys.addrs.v4addrs.dst;
                         hash_keys.ports.src = keys.ports.src;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index e9f985e42405..6818042cd8a9 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1730,7 +1730,7 @@ u32 tcp_tso_autosize(const struct sock *sk, unsigned int mss_now,
          */
         segs = max_t(u32, bytes / mss_now, min_tso_segs);
 
-        return min_t(u32, segs, sk->sk_gso_max_segs);
+        return segs;
 }
 EXPORT_SYMBOL(tcp_tso_autosize);
 
@@ -1742,9 +1742,10 @@ static u32 tcp_tso_segs(struct sock *sk, unsigned int mss_now)
         const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops;
         u32 tso_segs = ca_ops->tso_segs_goal ? ca_ops->tso_segs_goal(sk) : 0;
 
-        return tso_segs ? :
-                tcp_tso_autosize(sk, mss_now,
-                                 sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
+        if (!tso_segs)
+                tso_segs = tcp_tso_autosize(sk, mss_now,
+                                sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
+        return min_t(u32, tso_segs, sk->sk_gso_max_segs);
 }
 
 /* Returns the portion of skb which can be sent right away */
@@ -2027,6 +2028,24 @@ static inline void tcp_mtu_check_reprobe(struct sock *sk)
         }
 }
 
+static bool tcp_can_coalesce_send_queue_head(struct sock *sk, int len)
+{
+        struct sk_buff *skb, *next;
+
+        skb = tcp_send_head(sk);
+        tcp_for_write_queue_from_safe(skb, next, sk) {
+                if (len <= skb->len)
+                        break;
+
+                if (unlikely(TCP_SKB_CB(skb)->eor))
+                        return false;
+
+                len -= skb->len;
+        }
+
+        return true;
+}
+
 /* Create a new MTU probe if we are ready.
  * MTU probe is regularly attempting to increase the path MTU by
  * deliberately sending larger packets.  This discovers routing
@@ -2099,6 +2118,9 @@ static int tcp_mtu_probe(struct sock *sk)
                         return 0;
         }
 
+        if (!tcp_can_coalesce_send_queue_head(sk, probe_size))
+                return -1;
+
         /* We're allowed to probe.  Build it now. */
         nskb = sk_stream_alloc_skb(sk, probe_size, GFP_ATOMIC, false);
         if (!nskb)
@@ -2134,6 +2156,10 @@ static int tcp_mtu_probe(struct sock *sk)
                         /* We've eaten all the data from this skb.
                          * Throw it away. */
                         TCP_SKB_CB(nskb)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags;
+                        /* If this is the last SKB we copy and eor is set
+                         * we need to propagate it to the new skb.
+                         */
+                        TCP_SKB_CB(nskb)->eor = TCP_SKB_CB(skb)->eor;
                         tcp_unlink_write_queue(skb, sk);
                         sk_wmem_free_skb(sk, skb);
                 } else {
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index bfaefe560b5c..e5ef7c38c934 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2024,6 +2024,11 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
                 err = udplite_checksum_init(skb, uh);
                 if (err)
                         return err;
+
+                if (UDP_SKB_CB(skb)->partial_cov) {
+                        skb->csum = inet_compute_pseudo(skb, proto);
+                        return 0;
+                }
         }
 
         /* Note, we are only interested in != 0 or == 0, thus the
diff --git a/net/ipv6/ip6_checksum.c b/net/ipv6/ip6_checksum.c
index ec43d18b5ff9..547515e8450a 100644
--- a/net/ipv6/ip6_checksum.c
+++ b/net/ipv6/ip6_checksum.c
@@ -73,6 +73,11 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto)
                 err = udplite_checksum_init(skb, uh);
                 if (err)
                         return err;
+
+                if (UDP_SKB_CB(skb)->partial_cov) {
+                        skb->csum = ip6_compute_pseudo(skb, proto);
+                        return 0;
+                }
         }
 
         /* To support RFC 6936 (allow zero checksum in UDP/IPV6 for tunnels)
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index d78d41fc4b1a..24535169663d 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -1367,10 +1367,7 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname,
                 if (get_user(len, optlen))
                         return -EFAULT;
 
-                lock_sock(sk);
-                err = nf_getsockopt(sk, PF_INET6, optname, optval,
-                                &len);
-                release_sock(sk);
+                err = nf_getsockopt(sk, PF_INET6, optname, optval, &len);
                 if (err >= 0)
                         err = put_user(len, optlen);
         }
@@ -1409,10 +1406,7 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname,
                 if (get_user(len, optlen))
                         return -EFAULT;
 
-                lock_sock(sk);
-                err = compat_nf_getsockopt(sk, PF_INET6,
-                                           optname, optval, &len);
-                release_sock(sk);
+                err = compat_nf_getsockopt(sk, PF_INET6, optname, optval, &len);
                 if (err >= 0)
                         err = put_user(len, optlen);
         }
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index af4c917e0836..62358b93bbac 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -352,6 +352,10 @@ ip6t_do_table(struct sk_buff *skb,
                         }
                         if (table_base + v != ip6t_next_entry(e) &&
                             !(e->ipv6.flags & IP6T_F_GOTO)) {
+                                if (unlikely(stackidx >= private->stacksize)) {
+                                        verdict = NF_DROP;
+                                        break;
+                                }
                                 jumpstack[stackidx++] = e;
                         }
 
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index fa51a205918d..38dea8ff680f 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -85,14 +85,14 @@ static int reject_tg6_check(const struct xt_tgchk_param *par)
         const struct ip6t_entry *e = par->entryinfo;
 
         if (rejinfo->with == IP6T_ICMP6_ECHOREPLY) {
-                pr_info("ECHOREPLY is not supported.\n");
+                pr_info_ratelimited("ECHOREPLY is not supported\n");
                 return -EINVAL;
         } else if (rejinfo->with == IP6T_TCP_RESET) {
                 /* Must specify that it's a TCP packet */
                 if (!(e->ipv6.flags & IP6T_F_PROTO) ||
                     e->ipv6.proto != IPPROTO_TCP ||
                     (e->ipv6.invflags & XT_INV_PROTO)) {
-                        pr_info("TCP_RESET illegal for non-tcp\n");
+                        pr_info_ratelimited("TCP_RESET illegal for non-tcp\n");
                         return -EINVAL;
                 }
         }
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index b12e61b7b16c..94deb69bbbda 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -103,14 +103,14 @@ static int rpfilter_check(const struct xt_mtchk_param *par)
         unsigned int options = ~XT_RPFILTER_OPTION_MASK;
 
         if (info->flags & options) {
-                pr_info("unknown options encountered");
+                pr_info_ratelimited("unknown options\n");
                 return -EINVAL;
         }
 
         if (strcmp(par->table, "mangle") != 0 &&
             strcmp(par->table, "raw") != 0) {
-                pr_info("match only valid in the \'raw\' "
-                        "or \'mangle\' tables, not \'%s\'.\n", par->table);
+                pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n",
+                                    par->table);
                 return -EINVAL;
         }
 
diff --git a/net/ipv6/netfilter/ip6t_srh.c b/net/ipv6/netfilter/ip6t_srh.c
index 9642164107ce..33719d5560c8 100644
--- a/net/ipv6/netfilter/ip6t_srh.c
+++ b/net/ipv6/netfilter/ip6t_srh.c
@@ -122,12 +122,14 @@ static int srh_mt6_check(const struct xt_mtchk_param *par)
         const struct ip6t_srh *srhinfo = par->matchinfo;
 
         if (srhinfo->mt_flags & ~IP6T_SRH_MASK) {
-                pr_err("unknown srh match flags  %X\n", srhinfo->mt_flags);
+                pr_info_ratelimited("unknown srh match flags  %X\n",
+                                    srhinfo->mt_flags);
                 return -EINVAL;
         }
 
         if (srhinfo->mt_invflags & ~IP6T_SRH_INV_MASK) {
-                pr_err("unknown srh invflags %X\n", srhinfo->mt_invflags);
+                pr_info_ratelimited("unknown srh invflags %X\n",
+                                    srhinfo->mt_invflags);
                 return -EINVAL;
         }
 
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 3873d3877135..3a1775a62973 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -182,7 +182,7 @@ static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
 #ifdef CONFIG_IPV6_SIT_6RD
         struct ip_tunnel *t = netdev_priv(dev);
 
-        if (t->dev == sitn->fb_tunnel_dev) {
+        if (dev == sitn->fb_tunnel_dev) {
                 ipv6_addr_set(&t->ip6rd.prefix, htonl(0x20020000), 0, 0, 0);
                 t->ip6rd.relay_prefix = 0;
                 t->ip6rd.prefixlen = 16;
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index a8b1616cec41..1f3188d03840 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -8,6 +8,7 @@
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2010, Intel Corporation
  * Copyright(c) 2015-2017 Intel Deutschland GmbH
+ * Copyright (C) 2018        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -304,9 +305,6 @@ void ___ieee80211_start_rx_ba_session(struct sta_info *sta,
                          * driver so reject the timeout update.
                          */
                         status = WLAN_STATUS_REQUEST_DECLINED;
-                        ieee80211_send_addba_resp(sta->sdata, sta->sta.addr,
-                                                  tid, dialog_token, status,
-                                                  1, buf_size, timeout);
                         goto end;
                 }
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 46028e12e216..f4195a0f0279 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2892,7 +2892,7 @@ cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
         }
         if (beacon->probe_resp_len) {
                 new_beacon->probe_resp_len = beacon->probe_resp_len;
-                beacon->probe_resp = pos;
+                new_beacon->probe_resp = pos;
                 memcpy(pos, beacon->probe_resp, beacon->probe_resp_len);
                 pos += beacon->probe_resp_len;
         }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 26900025de2f..ae9c33cd8ada 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1467,7 +1467,7 @@ struct ieee802_11_elems {
         const struct ieee80211_timeout_interval_ie *timeout_int;
         const u8 *opmode_notif;
         const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
-        const struct ieee80211_mesh_chansw_params_ie *mesh_chansw_params_ie;
+        struct ieee80211_mesh_chansw_params_ie *mesh_chansw_params_ie;
         const struct ieee80211_bss_max_idle_period_ie *max_idle_period_ie;
 
         /* length of them, respectively */
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 73ac607beb5d..6a381cbe1e33 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -1255,13 +1255,12 @@ int ieee80211_mesh_csa_beacon(struct ieee80211_sub_if_data *sdata,
 }
 
 static int mesh_fwd_csa_frame(struct ieee80211_sub_if_data *sdata,
-                               struct ieee80211_mgmt *mgmt, size_t len)
+                               struct ieee80211_mgmt *mgmt, size_t len,
+                               struct ieee802_11_elems *elems)
 {
         struct ieee80211_mgmt *mgmt_fwd;
         struct sk_buff *skb;
         struct ieee80211_local *local = sdata->local;
-        u8 *pos = mgmt->u.action.u.chan_switch.variable;
-        size_t offset_ttl;
 
         skb = dev_alloc_skb(local->tx_headroom + len);
         if (!skb)
@@ -1269,13 +1268,9 @@ static int mesh_fwd_csa_frame(struct ieee80211_sub_if_data *sdata,
         skb_reserve(skb, local->tx_headroom);
         mgmt_fwd = skb_put(skb, len);
 
-        /* offset_ttl is based on whether the secondary channel
-         * offset is available or not. Subtract 1 from the mesh TTL
-         * and disable the initiator flag before forwarding.
-         */
-        offset_ttl = (len < 42) ? 7 : 10;
-        *(pos + offset_ttl) -= 1;
-        *(pos + offset_ttl + 1) &= ~WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR;
+        elems->mesh_chansw_params_ie->mesh_ttl--;
+        elems->mesh_chansw_params_ie->mesh_flags &=
+                ~WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR;
 
         memcpy(mgmt_fwd, mgmt, len);
         eth_broadcast_addr(mgmt_fwd->da);
@@ -1323,7 +1318,7 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
 
         /* forward or re-broadcast the CSA frame */
         if (fwd_csa) {
-                if (mesh_fwd_csa_frame(sdata, mgmt, len) < 0)
+                if (mesh_fwd_csa_frame(sdata, mgmt, len, &elems) < 0)
                         mcsa_dbg(sdata, "Failed to forward the CSA frame");
         }
 }
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index ee0181778a42..029334835747 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -8,6 +8,7 @@
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2008, Intel Corporation
  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ * Copyright (C) 2018        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -27,7 +28,7 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
                                  u32 sta_flags, u8 *bssid,
                                  struct ieee80211_csa_ie *csa_ie)
 {
-        enum nl80211_band new_band;
+        enum nl80211_band new_band = current_band;
         int new_freq;
         u8 new_chan_no;
         struct ieee80211_channel *new_chan;
@@ -55,15 +56,13 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
                                 elems->ext_chansw_ie->new_operating_class,
                                 &new_band)) {
                         sdata_info(sdata,
-                                   "cannot understand ECSA IE operating class %d, disconnecting\n",
+                                   "cannot understand ECSA IE operating class, %d, ignoring\n",
                                    elems->ext_chansw_ie->new_operating_class);
-                        return -EINVAL;
                 }
                 new_chan_no = elems->ext_chansw_ie->new_ch_num;
                 csa_ie->count = elems->ext_chansw_ie->count;
                 csa_ie->mode = elems->ext_chansw_ie->mode;
         } else if (elems->ch_switch_ie) {
-                new_band = current_band;
                 new_chan_no = elems->ch_switch_ie->new_ch_num;
                 csa_ie->count = elems->ch_switch_ie->count;
                 csa_ie->mode = elems->ch_switch_ie->mode;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 0c5627f8a104..af0b608ee8ed 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -314,7 +314,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 
         if (ieee80211_hw_check(hw, USES_RSS)) {
                 sta->pcpu_rx_stats =
-                        alloc_percpu(struct ieee80211_sta_rx_stats);
+                        alloc_percpu_gfp(struct ieee80211_sta_rx_stats, gfp);
                 if (!sta->pcpu_rx_stats)
                         goto free;
         }
@@ -433,6 +433,7 @@ free_txq:
         if (sta->sta.txq[0])
                 kfree(to_txq_info(sta->sta.txq[0]));
 free:
+        free_percpu(sta->pcpu_rx_stats);
 #ifdef CONFIG_MAC80211_MESH
         kfree(sta->mesh);
 #endif
diff --git a/net/netfilter/nf_nat_proto_common.c b/net/netfilter/nf_nat_proto_common.c
index fbce552a796e..7d7466dbf663 100644
--- a/net/netfilter/nf_nat_proto_common.c
+++ b/net/netfilter/nf_nat_proto_common.c
@@ -41,7 +41,7 @@ void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto,
                                  const struct nf_conn *ct,
                                  u16 *rover)
 {
-        unsigned int range_size, min, i;
+        unsigned int range_size, min, max, i;
         __be16 *portptr;
         u_int16_t off;
 
@@ -71,7 +71,10 @@ void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto,
                 }
         } else {
                 min = ntohs(range->min_proto.all);
-                range_size = ntohs(range->max_proto.all) - min + 1;
+                max = ntohs(range->max_proto.all);
+                if (unlikely(max < min))
+                        swap(max, min);
+                range_size = max - min + 1;
         }
 
         if (range->flags & NF_NAT_RANGE_PROTO_RANDOM) {
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 2f685ee1f9c8..fa1655aff8d3 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -434,36 +434,35 @@ int xt_check_match(struct xt_mtchk_param *par,
                  * ebt_among is exempt from centralized matchsize checking
                  * because it uses a dynamic-size data set.
                  */
-                pr_err("%s_tables: %s.%u match: invalid size "
-                       "%u (kernel) != (user) %u\n",
-                       xt_prefix[par->family], par->match->name,
-                       par->match->revision,
-                       XT_ALIGN(par->match->matchsize), size);
+                pr_err_ratelimited("%s_tables: %s.%u match: invalid size %u (kernel) != (user) %u\n",
+                                   xt_prefix[par->family], par->match->name,
+                                   par->match->revision,
+                                   XT_ALIGN(par->match->matchsize), size);
                 return -EINVAL;
         }
         if (par->match->table != NULL &&
             strcmp(par->match->table, par->table) != 0) {
-                pr_err("%s_tables: %s match: only valid in %s table, not %s\n",
-                       xt_prefix[par->family], par->match->name,
-                       par->match->table, par->table);
+                pr_info_ratelimited("%s_tables: %s match: only valid in %s table, not %s\n",
+                                    xt_prefix[par->family], par->match->name,
+                                    par->match->table, par->table);
                 return -EINVAL;
         }
         if (par->match->hooks && (par->hook_mask & ~par->match->hooks) != 0) {
                 char used[64], allow[64];
 
-                pr_err("%s_tables: %s match: used from hooks %s, but only "
-                       "valid from %s\n",
-                       xt_prefix[par->family], par->match->name,
-                       textify_hooks(used, sizeof(used), par->hook_mask,
-                                     par->family),
-                       textify_hooks(allow, sizeof(allow), par->match->hooks,
-                                     par->family));
+                pr_info_ratelimited("%s_tables: %s match: used from hooks %s, but only valid from %s\n",
+                                    xt_prefix[par->family], par->match->name,
+                                    textify_hooks(used, sizeof(used),
+                                                  par->hook_mask, par->family),
+                                    textify_hooks(allow, sizeof(allow),
+                                                  par->match->hooks,
+                                                  par->family));
                 return -EINVAL;
         }
         if (par->match->proto && (par->match->proto != proto || inv_proto)) {
-                pr_err("%s_tables: %s match: only valid for protocol %u\n",
-                       xt_prefix[par->family], par->match->name,
-                       par->match->proto);
+                pr_info_ratelimited("%s_tables: %s match: only valid for protocol %u\n",
+                                    xt_prefix[par->family], par->match->name,
+                                    par->match->proto);
                 return -EINVAL;
         }
         if (par->match->checkentry != NULL) {
@@ -814,36 +813,35 @@ int xt_check_target(struct xt_tgchk_param *par,
         int ret;
 
         if (XT_ALIGN(par->target->targetsize) != size) {
-                pr_err("%s_tables: %s.%u target: invalid size "
-                       "%u (kernel) != (user) %u\n",
-                       xt_prefix[par->family], par->target->name,
-                       par->target->revision,
-                       XT_ALIGN(par->target->targetsize), size);
+                pr_err_ratelimited("%s_tables: %s.%u target: invalid size %u (kernel) != (user) %u\n",
+                                   xt_prefix[par->family], par->target->name,
+                                   par->target->revision,
+                                   XT_ALIGN(par->target->targetsize), size);
                 return -EINVAL;
         }
         if (par->target->table != NULL &&
             strcmp(par->target->table, par->table) != 0) {
-                pr_err("%s_tables: %s target: only valid in %s table, not %s\n",
-                       xt_prefix[par->family], par->target->name,
-                       par->target->table, par->table);
+                pr_info_ratelimited("%s_tables: %s target: only valid in %s table, not %s\n",
+                                    xt_prefix[par->family], par->target->name,
+                                    par->target->table, par->table);
                 return -EINVAL;
         }
         if (par->target->hooks && (par->hook_mask & ~par->target->hooks) != 0) {
                 char used[64], allow[64];
 
-                pr_err("%s_tables: %s target: used from hooks %s, but only "
-                       "usable from %s\n",
-                       xt_prefix[par->family], par->target->name,
-                       textify_hooks(used, sizeof(used), par->hook_mask,
-                                     par->family),
-                       textify_hooks(allow, sizeof(allow), par->target->hooks,
-                                     par->family));
+                pr_info_ratelimited("%s_tables: %s target: used from hooks %s, but only usable from %s\n",
+                                    xt_prefix[par->family], par->target->name,
+                                    textify_hooks(used, sizeof(used),
+                                                  par->hook_mask, par->family),
+                                    textify_hooks(allow, sizeof(allow),
+                                                  par->target->hooks,
+                                                  par->family));
                 return -EINVAL;
         }
         if (par->target->proto && (par->target->proto != proto || inv_proto)) {
-                pr_err("%s_tables: %s target: only valid for protocol %u\n",
-                       xt_prefix[par->family], par->target->name,
-                       par->target->proto);
+                pr_info_ratelimited("%s_tables: %s target: only valid for protocol %u\n",
+                                    xt_prefix[par->family], par->target->name,
+                                    par->target->proto);
                 return -EINVAL;
         }
         if (par->target->checkentry != NULL) {
@@ -1004,10 +1002,6 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
         if (sz < sizeof(*info))
                 return NULL;
 
-        /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
-        if ((size >> PAGE_SHIFT) + 2 > totalram_pages)
-                return NULL;
-
         /* __GFP_NORETRY is not fully supported by kvmalloc but it should
          * work reasonably well if sz is too large and bail out rather
          * than shoot all processes down before realizing there is nothing
diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c
index c502419d6306..f368ee6741db 100644
--- a/net/netfilter/xt_AUDIT.c
+++ b/net/netfilter/xt_AUDIT.c
@@ -120,8 +120,8 @@ static int audit_tg_check(const struct xt_tgchk_param *par)
         const struct xt_audit_info *info = par->targinfo;
 
         if (info->type > XT_AUDIT_TYPE_MAX) {
-                pr_info("Audit type out of range (valid range: 0..%hhu)\n",
-                        XT_AUDIT_TYPE_MAX);
+                pr_info_ratelimited("Audit type out of range (valid range: 0..%hhu)\n",
+                                    XT_AUDIT_TYPE_MAX);
                 return -ERANGE;
         }
 
diff --git a/net/netfilter/xt_CHECKSUM.c b/net/netfilter/xt_CHECKSUM.c
index 0f642ef8cd26..9f4151ec3e06 100644
--- a/net/netfilter/xt_CHECKSUM.c
+++ b/net/netfilter/xt_CHECKSUM.c
@@ -36,13 +36,13 @@ static int checksum_tg_check(const struct xt_tgchk_param *par)
         const struct xt_CHECKSUM_info *einfo = par->targinfo;
 
         if (einfo->operation & ~XT_CHECKSUM_OP_FILL) {
-                pr_info("unsupported CHECKSUM operation %x\n", einfo->operation);
+                pr_info_ratelimited("unsupported CHECKSUM operation %x\n",
+                                    einfo->operation);
                 return -EINVAL;
         }
-        if (!einfo->operation) {
-                pr_info("no CHECKSUM operation enabled\n");
+        if (!einfo->operation)
                 return -EINVAL;
-        }
+
         return 0;
 }
 
diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c
index da56c06a443c..f3f1caac949b 100644
--- a/net/netfilter/xt_CONNSECMARK.c
+++ b/net/netfilter/xt_CONNSECMARK.c
@@ -91,8 +91,8 @@ static int connsecmark_tg_check(const struct xt_tgchk_param *par)
 
         if (strcmp(par->table, "mangle") != 0 &&
             strcmp(par->table, "security") != 0) {
-                pr_info("target only valid in the \'mangle\' "
-                        "or \'security\' tables, not \'%s\'.\n", par->table);
+                pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n",
+                                    par->table);
                 return -EINVAL;
         }
 
@@ -102,14 +102,14 @@ static int connsecmark_tg_check(const struct xt_tgchk_param *par)
                 break;
 
         default:
-                pr_info("invalid mode: %hu\n", info->mode);
+                pr_info_ratelimited("invalid mode: %hu\n", info->mode);
                 return -EINVAL;
         }
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0)
-                pr_info("cannot load conntrack support for proto=%u\n",
-                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
         return ret;
 }
 
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 5a152e2acfd5..8790190c6feb 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -82,15 +82,14 @@ xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
 
         proto = xt_ct_find_proto(par);
         if (!proto) {
-                pr_info("You must specify a L4 protocol, and not use "
-                        "inversions on it.\n");
+                pr_info_ratelimited("You must specify a L4 protocol and not use inversions on it\n");
                 return -ENOENT;
         }
 
         helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
                                                     proto);
         if (helper == NULL) {
-                pr_info("No such helper \"%s\"\n", helper_name);
+                pr_info_ratelimited("No such helper \"%s\"\n", helper_name);
                 return -ENOENT;
         }
 
@@ -124,6 +123,7 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
         const struct nf_conntrack_l4proto *l4proto;
         struct ctnl_timeout *timeout;
         struct nf_conn_timeout *timeout_ext;
+        const char *errmsg = NULL;
         int ret = 0;
         u8 proto;
 
@@ -131,29 +131,29 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
         timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
         if (timeout_find_get == NULL) {
                 ret = -ENOENT;
-                pr_info("Timeout policy base is empty\n");
+                errmsg = "Timeout policy base is empty";
                 goto out;
         }
 
         proto = xt_ct_find_proto(par);
         if (!proto) {
                 ret = -EINVAL;
-                pr_info("You must specify a L4 protocol, and not use "
-                        "inversions on it.\n");
+                errmsg = "You must specify a L4 protocol and not use inversions on it";
                 goto out;
         }
 
         timeout = timeout_find_get(par->net, timeout_name);
         if (timeout == NULL) {
                 ret = -ENOENT;
-                pr_info("No such timeout policy \"%s\"\n", timeout_name);
+                pr_info_ratelimited("No such timeout policy \"%s\"\n",
+                                    timeout_name);
                 goto out;
         }
 
         if (timeout->l3num != par->family) {
                 ret = -EINVAL;
-                pr_info("Timeout policy `%s' can only be used by L3 protocol "
-                        "number %d\n", timeout_name, timeout->l3num);
+                pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
+                                    timeout_name, 3, timeout->l3num);
                 goto err_put_timeout;
         }
         /* Make sure the timeout policy matches any existing protocol tracker,
@@ -162,9 +162,8 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
         l4proto = __nf_ct_l4proto_find(par->family, proto);
         if (timeout->l4proto->l4proto != l4proto->l4proto) {
                 ret = -EINVAL;
-                pr_info("Timeout policy `%s' can only be used by L4 protocol "
-                        "number %d\n",
-                        timeout_name, timeout->l4proto->l4proto);
+                pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
+                                    timeout_name, 4, timeout->l4proto->l4proto);
                 goto err_put_timeout;
         }
         timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
@@ -180,6 +179,8 @@ err_put_timeout:
         __xt_ct_tg_timeout_put(timeout);
 out:
         rcu_read_unlock();
+        if (errmsg)
+                pr_info_ratelimited("%s\n", errmsg);
         return ret;
 #else
         return -EOPNOTSUPP;
diff --git a/net/netfilter/xt_DSCP.c b/net/netfilter/xt_DSCP.c
index 3f83d38c4e5b..098ed851b7a7 100644
--- a/net/netfilter/xt_DSCP.c
+++ b/net/netfilter/xt_DSCP.c
@@ -66,10 +66,8 @@ static int dscp_tg_check(const struct xt_tgchk_param *par)
 {
         const struct xt_DSCP_info *info = par->targinfo;
 
-        if (info->dscp > XT_DSCP_MAX) {
-                pr_info("dscp %x out of range\n", info->dscp);
+        if (info->dscp > XT_DSCP_MAX)
                 return -EDOM;
-        }
         return 0;
 }
 
diff --git a/net/netfilter/xt_HL.c b/net/netfilter/xt_HL.c
index 1535e87ed9bd..4653b071bed4 100644
--- a/net/netfilter/xt_HL.c
+++ b/net/netfilter/xt_HL.c
@@ -105,10 +105,8 @@ static int ttl_tg_check(const struct xt_tgchk_param *par)
 {
         const struct ipt_TTL_info *info = par->targinfo;
 
-        if (info->mode > IPT_TTL_MAXMODE) {
-                pr_info("TTL: invalid or unknown mode %u\n", info->mode);
+        if (info->mode > IPT_TTL_MAXMODE)
                 return -EINVAL;
-        }
         if (info->mode != IPT_TTL_SET && info->ttl == 0)
                 return -EINVAL;
         return 0;
@@ -118,15 +116,10 @@ static int hl_tg6_check(const struct xt_tgchk_param *par)
 {
         const struct ip6t_HL_info *info = par->targinfo;
 
-        if (info->mode > IP6T_HL_MAXMODE) {
-                pr_info("invalid or unknown mode %u\n", info->mode);
+        if (info->mode > IP6T_HL_MAXMODE)
                 return -EINVAL;
-        }
-        if (info->mode != IP6T_HL_SET && info->hop_limit == 0) {
-                pr_info("increment/decrement does not "
-                        "make sense with value 0\n");
+        if (info->mode != IP6T_HL_SET && info->hop_limit == 0)
                 return -EINVAL;
-        }
         return 0;
 }
 
diff --git a/net/netfilter/xt_HMARK.c b/net/netfilter/xt_HMARK.c
index 60e6dbe12460..9c75f419cd80 100644
--- a/net/netfilter/xt_HMARK.c
+++ b/net/netfilter/xt_HMARK.c
@@ -9,6 +9,8 @@
  * the Free Software Foundation.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/icmp.h>
@@ -312,29 +314,30 @@ hmark_tg_v4(struct sk_buff *skb, const struct xt_action_param *par)
 static int hmark_tg_check(const struct xt_tgchk_param *par)
 {
         const struct xt_hmark_info *info = par->targinfo;
+        const char *errmsg = "proto mask must be zero with L3 mode";
 
-        if (!info->hmodulus) {
-                pr_info("xt_HMARK: hash modulus can't be zero\n");
+        if (!info->hmodulus)
                 return -EINVAL;
-        }
+
         if (info->proto_mask &&
-            (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))) {
-                pr_info("xt_HMARK: proto mask must be zero with L3 mode\n");
-                return -EINVAL;
-        }
+            (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3)))
+                goto err;
+
         if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPI_MASK) &&
             (info->flags & (XT_HMARK_FLAG(XT_HMARK_SPORT_MASK) |
-                             XT_HMARK_FLAG(XT_HMARK_DPORT_MASK)))) {
-                pr_info("xt_HMARK: spi-mask and port-mask can't be combined\n");
+                             XT_HMARK_FLAG(XT_HMARK_DPORT_MASK))))
                 return -EINVAL;
-        }
+
         if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPI) &&
             (info->flags & (XT_HMARK_FLAG(XT_HMARK_SPORT) |
                              XT_HMARK_FLAG(XT_HMARK_DPORT)))) {
-                pr_info("xt_HMARK: spi-set and port-set can't be combined\n");
-                return -EINVAL;
+                errmsg = "spi-set and port-set can't be combined";
+                goto err;
         }
         return 0;
+err:
+        pr_info_ratelimited("%s\n", errmsg);
+        return -EINVAL;
 }
 
 static struct xt_target hmark_tg_reg[] __read_mostly = {
diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index 6c2482b709b1..1ac6600bfafd 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -146,11 +146,11 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)
         timer_setup(&info->timer->timer, idletimer_tg_expired, 0);
         info->timer->refcnt = 1;
 
+        INIT_WORK(&info->timer->work, idletimer_tg_work);
+
         mod_timer(&info->timer->timer,
                   msecs_to_jiffies(info->timeout * 1000) + jiffies);
 
-        INIT_WORK(&info->timer->work, idletimer_tg_work);
-
         return 0;
 
 out_free_attr:
@@ -191,7 +191,10 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par)
                 pr_debug("timeout value is zero\n");
                 return -EINVAL;
         }
-
+        if (info->timeout >= INT_MAX / 1000) {
+                pr_debug("timeout value is too big\n");
+                return -EINVAL;
+        }
         if (info->label[0] == '\0' ||
             strnlen(info->label,
                     MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) {
diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c
index 1dcad893df78..19846445504d 100644
--- a/net/netfilter/xt_LED.c
+++ b/net/netfilter/xt_LED.c
@@ -111,10 +111,8 @@ static int led_tg_check(const struct xt_tgchk_param *par)
         struct xt_led_info_internal *ledinternal;
         int err;
 
-        if (ledinfo->id[0] == '\0') {
-                pr_info("No 'id' parameter given.\n");
+        if (ledinfo->id[0] == '\0')
                 return -EINVAL;
-        }
 
         mutex_lock(&xt_led_mutex);
 
@@ -138,13 +136,14 @@ static int led_tg_check(const struct xt_tgchk_param *par)
 
         err = led_trigger_register(&ledinternal->netfilter_led_trigger);
         if (err) {
-                pr_err("Trigger name is already in use.\n");
+                pr_info_ratelimited("Trigger name is already in use.\n");
                 goto exit_alloc;
         }
 
-        /* See if we need to set up a timer */
-        if (ledinfo->delay > 0)
-                timer_setup(&ledinternal->timer, led_timeout_callback, 0);
+        /* Since the letinternal timer can be shared between multiple targets,
+         * always set it up, even if the current target does not need it
+         */
+        timer_setup(&ledinternal->timer, led_timeout_callback, 0);
 
         list_add_tail(&ledinternal->list, &xt_led_triggers);
 
@@ -181,8 +180,7 @@ static void led_tg_destroy(const struct xt_tgdtor_param *par)
 
         list_del(&ledinternal->list);
 
-        if (ledinfo->delay > 0)
-                del_timer_sync(&ledinternal->timer);
+        del_timer_sync(&ledinternal->timer);
 
         led_trigger_unregister(&ledinternal->netfilter_led_trigger);
 
diff --git a/net/netfilter/xt_NFQUEUE.c b/net/netfilter/xt_NFQUEUE.c
index a360b99a958a..a9aca80a32ae 100644
--- a/net/netfilter/xt_NFQUEUE.c
+++ b/net/netfilter/xt_NFQUEUE.c
@@ -8,6 +8,8 @@
  *
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/skbuff.h>
 
@@ -67,13 +69,13 @@ static int nfqueue_tg_check(const struct xt_tgchk_param *par)
         init_hashrandom(&jhash_initval);
 
         if (info->queues_total == 0) {
-                pr_err("NFQUEUE: number of total queues is 0\n");
+                pr_info_ratelimited("number of total queues is 0\n");
                 return -EINVAL;
         }
         maxid = info->queues_total - 1 + info->queuenum;
         if (maxid > 0xffff) {
-                pr_err("NFQUEUE: number of queues (%u) out of range (got %u)\n",
-                       info->queues_total, maxid);
+                pr_info_ratelimited("number of queues (%u) out of range (got %u)\n",
+                                    info->queues_total, maxid);
                 return -ERANGE;
         }
         if (par->target->revision == 2 && info->flags > 1)
diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
index 9faf5e050b79..4ad5fe27e08b 100644
--- a/net/netfilter/xt_SECMARK.c
+++ b/net/netfilter/xt_SECMARK.c
@@ -60,18 +60,20 @@ static int checkentry_lsm(struct xt_secmark_target_info *info)
                                        &info->secid);
         if (err) {
                 if (err == -EINVAL)
-                        pr_info("invalid security context \'%s\'\n", info->secctx);
+                        pr_info_ratelimited("invalid security context \'%s\'\n",
+                                            info->secctx);
                 return err;
         }
 
         if (!info->secid) {
-                pr_info("unable to map security context \'%s\'\n", info->secctx);
+                pr_info_ratelimited("unable to map security context \'%s\'\n",
+                                    info->secctx);
                 return -ENOENT;
         }
 
         err = security_secmark_relabel_packet(info->secid);
         if (err) {
-                pr_info("unable to obtain relabeling permission\n");
+                pr_info_ratelimited("unable to obtain relabeling permission\n");
                 return err;
         }
 
@@ -86,14 +88,14 @@ static int secmark_tg_check(const struct xt_tgchk_param *par)
 
         if (strcmp(par->table, "mangle") != 0 &&
             strcmp(par->table, "security") != 0) {
-                pr_info("target only valid in the \'mangle\' "
-                        "or \'security\' tables, not \'%s\'.\n", par->table);
+                pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n",
+                                    par->table);
                 return -EINVAL;
         }
 
         if (mode && mode != info->mode) {
-                pr_info("mode already set to %hu cannot mix with "
-                        "rules for mode %hu\n", mode, info->mode);
+                pr_info_ratelimited("mode already set to %hu cannot mix with rules for mode %hu\n",
+                                    mode, info->mode);
                 return -EINVAL;
         }
 
@@ -101,7 +103,7 @@ static int secmark_tg_check(const struct xt_tgchk_param *par)
         case SECMARK_MODE_SEL:
                 break;
         default:
-                pr_info("invalid mode: %hu\n", info->mode);
+                pr_info_ratelimited("invalid mode: %hu\n", info->mode);
                 return -EINVAL;
         }
 
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 99bb8e410f22..98efb202f8b4 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -273,8 +273,7 @@ static int tcpmss_tg4_check(const struct xt_tgchk_param *par)
             (par->hook_mask & ~((1 << NF_INET_FORWARD) |
                            (1 << NF_INET_LOCAL_OUT) |
                            (1 << NF_INET_POST_ROUTING))) != 0) {
-                pr_info("path-MTU clamping only supported in "
-                        "FORWARD, OUTPUT and POSTROUTING hooks\n");
+                pr_info_ratelimited("path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks\n");
                 return -EINVAL;
         }
         if (par->nft_compat)
@@ -283,7 +282,7 @@ static int tcpmss_tg4_check(const struct xt_tgchk_param *par)
         xt_ematch_foreach(ematch, e)
                 if (find_syn_match(ematch))
                         return 0;
-        pr_info("Only works on TCP SYN packets\n");
+        pr_info_ratelimited("Only works on TCP SYN packets\n");
         return -EINVAL;
 }
 
@@ -298,8 +297,7 @@ static int tcpmss_tg6_check(const struct xt_tgchk_param *par)
             (par->hook_mask & ~((1 << NF_INET_FORWARD) |
                            (1 << NF_INET_LOCAL_OUT) |
                            (1 << NF_INET_POST_ROUTING))) != 0) {
-                pr_info("path-MTU clamping only supported in "
-                        "FORWARD, OUTPUT and POSTROUTING hooks\n");
+                pr_info_ratelimited("path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks\n");
                 return -EINVAL;
         }
         if (par->nft_compat)
@@ -308,7 +306,7 @@ static int tcpmss_tg6_check(const struct xt_tgchk_param *par)
         xt_ematch_foreach(ematch, e)
                 if (find_syn_match(ematch))
                         return 0;
-        pr_info("Only works on TCP SYN packets\n");
+        pr_info_ratelimited("Only works on TCP SYN packets\n");
         return -EINVAL;
 }
 #endif
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index 17d7705e3bd4..8c89323c06af 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -540,8 +540,7 @@ static int tproxy_tg6_check(const struct xt_tgchk_param *par)
             !(i->invflags & IP6T_INV_PROTO))
                 return 0;
 
-        pr_info("Can be used only in combination with "
-                "either -p tcp or -p udp\n");
+        pr_info_ratelimited("Can be used only with -p tcp or -p udp\n");
         return -EINVAL;
 }
 #endif
@@ -559,8 +558,7 @@ static int tproxy_tg4_check(const struct xt_tgchk_param *par)
             && !(i->invflags & IPT_INV_PROTO))
                 return 0;
 
-        pr_info("Can be used only in combination with "
-                "either -p tcp or -p udp\n");
+        pr_info_ratelimited("Can be used only with -p tcp or -p udp\n");
         return -EINVAL;
 }
 
diff --git a/net/netfilter/xt_addrtype.c b/net/netfilter/xt_addrtype.c
index 911a7c0da504..89e281b3bfc2 100644
--- a/net/netfilter/xt_addrtype.c
+++ b/net/netfilter/xt_addrtype.c
@@ -164,48 +164,47 @@ addrtype_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
 
 static int addrtype_mt_checkentry_v1(const struct xt_mtchk_param *par)
 {
+        const char *errmsg = "both incoming and outgoing interface limitation cannot be selected";
         struct xt_addrtype_info_v1 *info = par->matchinfo;
 
         if (info->flags & XT_ADDRTYPE_LIMIT_IFACE_IN &&
-            info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT) {
-                pr_info("both incoming and outgoing "
-                        "interface limitation cannot be selected\n");
-                return -EINVAL;
-        }
+            info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT)
+                goto err;
 
         if (par->hook_mask & ((1 << NF_INET_PRE_ROUTING) |
             (1 << NF_INET_LOCAL_IN)) &&
             info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT) {
-                pr_info("output interface limitation "
-                        "not valid in PREROUTING and INPUT\n");
-                return -EINVAL;
+                errmsg = "output interface limitation not valid in PREROUTING and INPUT";
+                goto err;
         }
 
         if (par->hook_mask & ((1 << NF_INET_POST_ROUTING) |
             (1 << NF_INET_LOCAL_OUT)) &&
             info->flags & XT_ADDRTYPE_LIMIT_IFACE_IN) {
-                pr_info("input interface limitation "
-                        "not valid in POSTROUTING and OUTPUT\n");
-                return -EINVAL;
+                errmsg = "input interface limitation not valid in POSTROUTING and OUTPUT";
+                goto err;
         }
 
 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
         if (par->family == NFPROTO_IPV6) {
                 if ((info->source | info->dest) & XT_ADDRTYPE_BLACKHOLE) {
-                        pr_err("ipv6 BLACKHOLE matching not supported\n");
-                        return -EINVAL;
+                        errmsg = "ipv6 BLACKHOLE matching not supported";
+                        goto err;
                 }
                 if ((info->source | info->dest) >= XT_ADDRTYPE_PROHIBIT) {
-                        pr_err("ipv6 PROHIBIT (THROW, NAT ..) matching not supported\n");
-                        return -EINVAL;
+                        errmsg = "ipv6 PROHIBIT (THROW, NAT ..) matching not supported";
+                        goto err;
                 }
                 if ((info->source | info->dest) & XT_ADDRTYPE_BROADCAST) {
-                        pr_err("ipv6 does not support BROADCAST matching\n");
-                        return -EINVAL;
+                        errmsg = "ipv6 does not support BROADCAST matching";
+                        goto err;
                 }
         }
 #endif
         return 0;
+err:
+        pr_info_ratelimited("%s\n", errmsg);
+        return -EINVAL;
 }
 
 static struct xt_match addrtype_mt_reg[] __read_mostly = {
diff --git a/net/netfilter/xt_bpf.c b/net/netfilter/xt_bpf.c
index 06b090d8e901..a2cf8a6236d6 100644
--- a/net/netfilter/xt_bpf.c
+++ b/net/netfilter/xt_bpf.c
@@ -7,6 +7,8 @@
  * published by the Free Software Foundation.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/syscalls.h>
 #include <linux/skbuff.h>
@@ -34,7 +36,7 @@ static int __bpf_mt_check_bytecode(struct sock_filter *insns, __u16 len,
         program.filter = insns;
 
         if (bpf_prog_create(ret, &program)) {
-                pr_info("bpf: check failed: parse error\n");
+                pr_info_ratelimited("check failed: parse error\n");
                 return -EINVAL;
         }
 
diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
index 891f4e7e8ea7..7df2dece57d3 100644
--- a/net/netfilter/xt_cgroup.c
+++ b/net/netfilter/xt_cgroup.c
@@ -12,6 +12,8 @@
  * published by the Free Software Foundation.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/skbuff.h>
 #include <linux/module.h>
 #include <linux/netfilter/x_tables.h>
@@ -48,7 +50,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
         }
 
         if (info->has_path && info->has_classid) {
-                pr_info("xt_cgroup: both path and classid specified\n");
+                pr_info_ratelimited("path and classid specified\n");
                 return -EINVAL;
         }
 
@@ -56,8 +58,8 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
         if (info->has_path) {
                 cgrp = cgroup_get_from_path(info->path);
                 if (IS_ERR(cgrp)) {
-                        pr_info("xt_cgroup: invalid path, errno=%ld\n",
-                                PTR_ERR(cgrp));
+                        pr_info_ratelimited("invalid path, errno=%ld\n",
+                                            PTR_ERR(cgrp));
                         return -EINVAL;
                 }
                 info->priv = cgrp;
diff --git a/net/netfilter/xt_cluster.c b/net/netfilter/xt_cluster.c
index 57ef175dfbfa..0068688995c8 100644
--- a/net/netfilter/xt_cluster.c
+++ b/net/netfilter/xt_cluster.c
@@ -135,14 +135,12 @@ static int xt_cluster_mt_checkentry(const struct xt_mtchk_param *par)
         struct xt_cluster_match_info *info = par->matchinfo;
 
         if (info->total_nodes > XT_CLUSTER_NODES_MAX) {
-                pr_info("you have exceeded the maximum "
-                        "number of cluster nodes (%u > %u)\n",
-                        info->total_nodes, XT_CLUSTER_NODES_MAX);
+                pr_info_ratelimited("you have exceeded the maximum number of cluster nodes (%u > %u)\n",
+                                    info->total_nodes, XT_CLUSTER_NODES_MAX);
                 return -EINVAL;
         }
         if (info->node_mask >= (1ULL << info->total_nodes)) {
-                pr_info("this node mask cannot be "
-                        "higher than the total number of nodes\n");
+                pr_info_ratelimited("node mask cannot exceed total number of nodes\n");
                 return -EDOM;
         }
         return 0;
diff --git a/net/netfilter/xt_connbytes.c b/net/netfilter/xt_connbytes.c
index cad0b7b5eb35..93cb018c3055 100644
--- a/net/netfilter/xt_connbytes.c
+++ b/net/netfilter/xt_connbytes.c
@@ -112,8 +112,8 @@ static int connbytes_mt_check(const struct xt_mtchk_param *par)
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0)
-                pr_info("cannot load conntrack support for proto=%u\n",
-                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
 
         /*
          * This filter cannot function correctly unless connection tracking
diff --git a/net/netfilter/xt_connlabel.c b/net/netfilter/xt_connlabel.c
index 23372879e6e3..4fa4efd24353 100644
--- a/net/netfilter/xt_connlabel.c
+++ b/net/netfilter/xt_connlabel.c
@@ -57,14 +57,15 @@ static int connlabel_mt_check(const struct xt_mtchk_param *par)
         int ret;
 
         if (info->options & ~options) {
-                pr_err("Unknown options in mask %x\n", info->options);
+                pr_info_ratelimited("Unknown options in mask %x\n",
+                                    info->options);
                 return -EINVAL;
         }
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0) {
-                pr_info("cannot load conntrack support for proto=%u\n",
-                                                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
                 return ret;
         }
 
diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index ec377cc6a369..809639ce6f5a 100644
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -79,8 +79,8 @@ static int connmark_tg_check(const struct xt_tgchk_param *par)
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0)
-                pr_info("cannot load conntrack support for proto=%u\n",
-                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
         return ret;
 }
 
@@ -109,8 +109,8 @@ static int connmark_mt_check(const struct xt_mtchk_param *par)
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0)
-                pr_info("cannot load conntrack support for proto=%u\n",
-                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
         return ret;
 }
 
diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.c
index 39cf1d019240..df80fe7d391c 100644
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -272,8 +272,8 @@ static int conntrack_mt_check(const struct xt_mtchk_param *par)
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0)
-                pr_info("cannot load conntrack support for proto=%u\n",
-                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
         return ret;
 }
 
diff --git a/net/netfilter/xt_dscp.c b/net/netfilter/xt_dscp.c
index 236ac8008909..a4c2b862f820 100644
--- a/net/netfilter/xt_dscp.c
+++ b/net/netfilter/xt_dscp.c
@@ -46,10 +46,8 @@ static int dscp_mt_check(const struct xt_mtchk_param *par)
 {
         const struct xt_dscp_info *info = par->matchinfo;
 
-        if (info->dscp > XT_DSCP_MAX) {
-                pr_info("dscp %x out of range\n", info->dscp);
+        if (info->dscp > XT_DSCP_MAX)
                 return -EDOM;
-        }
 
         return 0;
 }
diff --git a/net/netfilter/xt_ecn.c b/net/netfilter/xt_ecn.c
index 3c831a8efebc..c7ad4afa5fb8 100644
--- a/net/netfilter/xt_ecn.c
+++ b/net/netfilter/xt_ecn.c
@@ -97,7 +97,7 @@ static int ecn_mt_check4(const struct xt_mtchk_param *par)
 
         if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
             (ip->proto != IPPROTO_TCP || ip->invflags & IPT_INV_PROTO)) {
-                pr_info("cannot match TCP bits in rule for non-tcp packets\n");
+                pr_info_ratelimited("cannot match TCP bits for non-tcp packets\n");
                 return -EINVAL;
         }
 
@@ -139,7 +139,7 @@ static int ecn_mt_check6(const struct xt_mtchk_param *par)
 
         if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
             (ip->proto != IPPROTO_TCP || ip->invflags & IP6T_INV_PROTO)) {
-                pr_info("cannot match TCP bits in rule for non-tcp packets\n");
+                pr_info_ratelimited("cannot match TCP bits for non-tcp packets\n");
                 return -EINVAL;
         }
 
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index ca6847403ca2..66f5aca62a08 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -523,7 +523,8 @@ static u64 user2rate(u64 user)
         if (user != 0) {
                 return div64_u64(XT_HASHLIMIT_SCALE_v2, user);
         } else {
-                pr_warn("invalid rate from userspace: %llu\n", user);
+                pr_info_ratelimited("invalid rate from userspace: %llu\n",
+                                    user);
                 return 0;
         }
 }
@@ -774,7 +775,7 @@ hashlimit_mt_common(const struct sk_buff *skb, struct xt_action_param *par,
                 if (!dh->rateinfo.prev_window &&
                     (dh->rateinfo.current_rate <= dh->rateinfo.burst)) {
                         spin_unlock(&dh->lock);
-                        rcu_read_unlock_bh();
+                        local_bh_enable();
                         return !(cfg->mode & XT_HASHLIMIT_INVERT);
                 } else {
                         goto overlimit;
@@ -865,33 +866,34 @@ static int hashlimit_mt_check_common(const struct xt_mtchk_param *par,
         }
 
         if (cfg->mode & ~XT_HASHLIMIT_ALL) {
-                pr_info("Unknown mode mask %X, kernel too old?\n",
-                                                cfg->mode);
+                pr_info_ratelimited("Unknown mode mask %X, kernel too old?\n",
+                                    cfg->mode);
                 return -EINVAL;
         }
 
         /* Check for overflow. */
         if (revision >= 3 && cfg->mode & XT_HASHLIMIT_RATE_MATCH) {
                 if (cfg->avg == 0 || cfg->avg > U32_MAX) {
-                        pr_info("hashlimit invalid rate\n");
+                        pr_info_ratelimited("invalid rate\n");
                         return -ERANGE;
                 }
 
                 if (cfg->interval == 0) {
-                        pr_info("hashlimit invalid interval\n");
+                        pr_info_ratelimited("invalid interval\n");
                         return -EINVAL;
                 }
         } else if (cfg->mode & XT_HASHLIMIT_BYTES) {
                 if (user2credits_byte(cfg->avg) == 0) {
-                        pr_info("overflow, rate too high: %llu\n", cfg->avg);
+                        pr_info_ratelimited("overflow, rate too high: %llu\n",
+                                            cfg->avg);
                         return -EINVAL;
                 }
         } else if (cfg->burst == 0 ||
-                    user2credits(cfg->avg * cfg->burst, revision) <
-                    user2credits(cfg->avg, revision)) {
-                        pr_info("overflow, try lower: %llu/%llu\n",
-                                cfg->avg, cfg->burst);
-                        return -ERANGE;
+                   user2credits(cfg->avg * cfg->burst, revision) <
+                   user2credits(cfg->avg, revision)) {
+                pr_info_ratelimited("overflow, try lower: %llu/%llu\n",
+                                    cfg->avg, cfg->burst);
+                return -ERANGE;
         }
 
         mutex_lock(&hashlimit_mutex);
diff --git a/net/netfilter/xt_helper.c b/net/netfilter/xt_helper.c
index 38a78151c0e9..fd077aeaaed9 100644
--- a/net/netfilter/xt_helper.c
+++ b/net/netfilter/xt_helper.c
@@ -61,8 +61,8 @@ static int helper_mt_check(const struct xt_mtchk_param *par)
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0) {
-                pr_info("cannot load conntrack support for proto=%u\n",
-                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
                 return ret;
         }
         info->name[sizeof(info->name) - 1] = '\0';
diff --git a/net/netfilter/xt_ipcomp.c b/net/netfilter/xt_ipcomp.c
index 7ca64a50db04..57f1df575701 100644
--- a/net/netfilter/xt_ipcomp.c
+++ b/net/netfilter/xt_ipcomp.c
@@ -72,7 +72,7 @@ static int comp_mt_check(const struct xt_mtchk_param *par)
 
         /* Must specify no unknown invflags */
         if (compinfo->invflags & ~XT_IPCOMP_INV_MASK) {
-                pr_err("unknown flags %X\n", compinfo->invflags);
+                pr_info_ratelimited("unknown flags %X\n", compinfo->invflags);
                 return -EINVAL;
         }
         return 0;
diff --git a/net/netfilter/xt_ipvs.c b/net/netfilter/xt_ipvs.c
index 42540d26c2b8..1d950a6100af 100644
--- a/net/netfilter/xt_ipvs.c
+++ b/net/netfilter/xt_ipvs.c
@@ -158,7 +158,8 @@ static int ipvs_mt_check(const struct xt_mtchk_param *par)
             && par->family != NFPROTO_IPV6
 #endif
                 ) {
-                pr_info("protocol family %u not supported\n", par->family);
+                pr_info_ratelimited("protocol family %u not supported\n",
+                                    par->family);
                 return -EINVAL;
         }
 
diff --git a/net/netfilter/xt_l2tp.c b/net/netfilter/xt_l2tp.c
index 8aee572771f2..c43482bf48e6 100644
--- a/net/netfilter/xt_l2tp.c
+++ b/net/netfilter/xt_l2tp.c
@@ -216,7 +216,7 @@ static int l2tp_mt_check(const struct xt_mtchk_param *par)
         /* Check for invalid flags */
         if (info->flags & ~(XT_L2TP_TID | XT_L2TP_SID | XT_L2TP_VERSION |
                             XT_L2TP_TYPE)) {
-                pr_info("unknown flags: %x\n", info->flags);
+                pr_info_ratelimited("unknown flags: %x\n", info->flags);
                 return -EINVAL;
         }
 
@@ -225,7 +225,8 @@ static int l2tp_mt_check(const struct xt_mtchk_param *par)
             (!(info->flags & XT_L2TP_SID)) &&
             ((!(info->flags & XT_L2TP_TYPE)) ||
              (info->type != XT_L2TP_TYPE_CONTROL))) {
-                pr_info("invalid flags combination: %x\n", info->flags);
+                pr_info_ratelimited("invalid flags combination: %x\n",
+                                    info->flags);
                 return -EINVAL;
         }
 
@@ -234,19 +235,22 @@ static int l2tp_mt_check(const struct xt_mtchk_param *par)
          */
         if (info->flags & XT_L2TP_VERSION) {
                 if ((info->version < 2) || (info->version > 3)) {
-                        pr_info("wrong L2TP version: %u\n", info->version);
+                        pr_info_ratelimited("wrong L2TP version: %u\n",
+                                            info->version);
                         return -EINVAL;
                 }
 
                 if (info->version == 2) {
                         if ((info->flags & XT_L2TP_TID) &&
                             (info->tid > 0xffff)) {
-                                pr_info("v2 tid > 0xffff: %u\n", info->tid);
+                                pr_info_ratelimited("v2 tid > 0xffff: %u\n",
+                                                    info->tid);
                                 return -EINVAL;
                         }
                         if ((info->flags & XT_L2TP_SID) &&
                             (info->sid > 0xffff)) {
-                                pr_info("v2 sid > 0xffff: %u\n", info->sid);
+                                pr_info_ratelimited("v2 sid > 0xffff: %u\n",
+                                                    info->sid);
                                 return -EINVAL;
                         }
                 }
@@ -268,13 +272,13 @@ static int l2tp_mt_check4(const struct xt_mtchk_param *par)
 
         if ((ip->proto != IPPROTO_UDP) &&
             (ip->proto != IPPROTO_L2TP)) {
-                pr_info("missing protocol rule (udp|l2tpip)\n");
+                pr_info_ratelimited("missing protocol rule (udp|l2tpip)\n");
                 return -EINVAL;
         }
 
         if ((ip->proto == IPPROTO_L2TP) &&
             (info->version == 2)) {
-                pr_info("v2 doesn't support IP mode\n");
+                pr_info_ratelimited("v2 doesn't support IP mode\n");
                 return -EINVAL;
         }
 
@@ -295,13 +299,13 @@ static int l2tp_mt_check6(const struct xt_mtchk_param *par)
 
         if ((ip->proto != IPPROTO_UDP) &&
             (ip->proto != IPPROTO_L2TP)) {
-                pr_info("missing protocol rule (udp|l2tpip)\n");
+                pr_info_ratelimited("missing protocol rule (udp|l2tpip)\n");
                 return -EINVAL;
         }
 
         if ((ip->proto == IPPROTO_L2TP) &&
             (info->version == 2)) {
-                pr_info("v2 doesn't support IP mode\n");
+                pr_info_ratelimited("v2 doesn't support IP mode\n");
                 return -EINVAL;
         }
 
diff --git a/net/netfilter/xt_limit.c b/net/netfilter/xt_limit.c
index 61403b77361c..55d18cd67635 100644
--- a/net/netfilter/xt_limit.c
+++ b/net/netfilter/xt_limit.c
@@ -106,8 +106,8 @@ static int limit_mt_check(const struct xt_mtchk_param *par)
         /* Check for overflow. */
         if (r->burst == 0
             || user2credits(r->avg * r->burst) < user2credits(r->avg)) {
-                pr_info("Overflow, try lower: %u/%u\n",
-                        r->avg, r->burst);
+                pr_info_ratelimited("Overflow, try lower: %u/%u\n",
+                                    r->avg, r->burst);
                 return -ERANGE;
         }
 
diff --git a/net/netfilter/xt_nat.c b/net/netfilter/xt_nat.c
index 0fd14d1eb09d..bdb689cdc829 100644
--- a/net/netfilter/xt_nat.c
+++ b/net/netfilter/xt_nat.c
@@ -8,6 +8,8 @@
  * published by the Free Software Foundation.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/netfilter.h>
@@ -19,8 +21,7 @@ static int xt_nat_checkentry_v0(const struct xt_tgchk_param *par)
         const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
         if (mr->rangesize != 1) {
-                pr_info("%s: multiple ranges no longer supported\n",
-                        par->target->name);
+                pr_info_ratelimited("multiple ranges no longer supported\n");
                 return -EINVAL;
         }
         return nf_ct_netns_get(par->net, par->family);
diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c
index 6f92d25590a8..c8674deed4eb 100644
--- a/net/netfilter/xt_nfacct.c
+++ b/net/netfilter/xt_nfacct.c
@@ -6,6 +6,8 @@
  * it under the terms of the GNU General Public License version 2 (or any
  * later at your option) as published by the Free Software Foundation.
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/skbuff.h>
 
@@ -39,8 +41,8 @@ nfacct_mt_checkentry(const struct xt_mtchk_param *par)
 
         nfacct = nfnl_acct_find_get(par->net, info->name);
         if (nfacct == NULL) {
-                pr_info("xt_nfacct: accounting object with name `%s' "
-                        "does not exists\n", info->name);
+                pr_info_ratelimited("accounting object `%s' does not exists\n",
+                                    info->name);
                 return -ENOENT;
         }
         info->nfacct = nfacct;
diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index bb33598e4530..9d6d67b953ac 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -107,9 +107,7 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
              info->invert & XT_PHYSDEV_OP_BRIDGED) &&
             par->hook_mask & ((1 << NF_INET_LOCAL_OUT) |
             (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) {
-                pr_info("using --physdev-out and --physdev-is-out are only "
-                        "supported in the FORWARD and POSTROUTING chains with "
-                        "bridged traffic.\n");
+                pr_info_ratelimited("--physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic\n");
                 if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
                         return -EINVAL;
         }
diff --git a/net/netfilter/xt_policy.c b/net/netfilter/xt_policy.c
index 5639fb03bdd9..13f8ccf946d6 100644
--- a/net/netfilter/xt_policy.c
+++ b/net/netfilter/xt_policy.c
@@ -132,26 +132,29 @@ policy_mt(const struct sk_buff *skb, struct xt_action_param *par)
 static int policy_mt_check(const struct xt_mtchk_param *par)
 {
         const struct xt_policy_info *info = par->matchinfo;
+        const char *errmsg = "neither incoming nor outgoing policy selected";
+
+        if (!(info->flags & (XT_POLICY_MATCH_IN|XT_POLICY_MATCH_OUT)))
+                goto err;
 
-        if (!(info->flags & (XT_POLICY_MATCH_IN|XT_POLICY_MATCH_OUT))) {
-                pr_info("neither incoming nor outgoing policy selected\n");
-                return -EINVAL;
-        }
         if (par->hook_mask & ((1 << NF_INET_PRE_ROUTING) |
             (1 << NF_INET_LOCAL_IN)) && info->flags & XT_POLICY_MATCH_OUT) {
-                pr_info("output policy not valid in PREROUTING and INPUT\n");
-                return -EINVAL;
+                errmsg = "output policy not valid in PREROUTING and INPUT";
+                goto err;
         }
         if (par->hook_mask & ((1 << NF_INET_POST_ROUTING) |
             (1 << NF_INET_LOCAL_OUT)) && info->flags & XT_POLICY_MATCH_IN) {
-                pr_info("input policy not valid in POSTROUTING and OUTPUT\n");
-                return -EINVAL;
+                errmsg = "input policy not valid in POSTROUTING and OUTPUT";
+                goto err;
         }
         if (info->len > XT_POLICY_MAX_ELEM) {
-                pr_info("too many policy elements\n");
-                return -EINVAL;
+                errmsg = "too many policy elements";
+                goto err;
         }
         return 0;
+err:
+        pr_info_ratelimited("%s\n", errmsg);
+        return -EINVAL;
 }
 
 static struct xt_match policy_mt_reg[] __read_mostly = {
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 245fa350a7a8..6d232d18faff 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -342,8 +342,8 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
         net_get_random_once(&hash_rnd, sizeof(hash_rnd));
 
         if (info->check_set & ~XT_RECENT_VALID_FLAGS) {
-                pr_info("Unsupported user space flags (%08x)\n",
-                        info->check_set);
+                pr_info_ratelimited("Unsupported userspace flags (%08x)\n",
+                                    info->check_set);
                 return -EINVAL;
         }
         if (hweight8(info->check_set &
@@ -357,8 +357,8 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
         if ((info->check_set & XT_RECENT_REAP) && !info->seconds)
                 return -EINVAL;
         if (info->hit_count >= XT_RECENT_MAX_NSTAMPS) {
-                pr_info("hitcount (%u) is larger than allowed maximum (%u)\n",
-                        info->hit_count, XT_RECENT_MAX_NSTAMPS - 1);
+                pr_info_ratelimited("hitcount (%u) is larger than allowed maximum (%u)\n",
+                                    info->hit_count, XT_RECENT_MAX_NSTAMPS - 1);
                 return -EINVAL;
         }
         if (info->name[0] == '\0' ||
@@ -587,7 +587,7 @@ recent_mt_proc_write(struct file *file, const char __user *input,
                 add = true;
                 break;
         default:
-                pr_info("Need \"+ip\", \"-ip\" or \"/\"\n");
+                pr_info_ratelimited("Need \"+ip\", \"-ip\" or \"/\"\n");
                 return -EINVAL;
         }
 
@@ -601,10 +601,8 @@ recent_mt_proc_write(struct file *file, const char __user *input,
                 succ   = in4_pton(c, size, (void *)&addr, '\n', NULL);
         }
 
-        if (!succ) {
-                pr_info("illegal address written to procfs\n");
+        if (!succ)
                 return -EINVAL;
-        }
 
         spin_lock_bh(&recent_lock);
         e = recent_entry_lookup(t, &addr, family, 0);
diff --git a/net/netfilter/xt_set.c b/net/netfilter/xt_set.c
index 16b6b11ee83f..6f4c5217d835 100644
--- a/net/netfilter/xt_set.c
+++ b/net/netfilter/xt_set.c
@@ -92,12 +92,12 @@ set_match_v0_checkentry(const struct xt_mtchk_param *par)
         index = ip_set_nfnl_get_byindex(par->net, info->match_set.index);
 
         if (index == IPSET_INVALID_ID) {
-                pr_warn("Cannot find set identified by id %u to match\n",
-                        info->match_set.index);
+                pr_info_ratelimited("Cannot find set identified by id %u to match\n",
+                                    info->match_set.index);
                 return -ENOENT;
         }
         if (info->match_set.u.flags[IPSET_DIM_MAX - 1] != 0) {
-                pr_warn("Protocol error: set match dimension is over the limit!\n");
+                pr_info_ratelimited("set match dimension is over the limit!\n");
                 ip_set_nfnl_put(par->net, info->match_set.index);
                 return -ERANGE;
         }
@@ -143,12 +143,12 @@ set_match_v1_checkentry(const struct xt_mtchk_param *par)
         index = ip_set_nfnl_get_byindex(par->net, info->match_set.index);
 
         if (index == IPSET_INVALID_ID) {
-                pr_warn("Cannot find set identified by id %u to match\n",
-                        info->match_set.index);
+                pr_info_ratelimited("Cannot find set identified by id %u to match\n",
+                                    info->match_set.index);
                 return -ENOENT;
         }
         if (info->match_set.dim > IPSET_DIM_MAX) {
-                pr_warn("Protocol error: set match dimension is over the limit!\n");
+                pr_info_ratelimited("set match dimension is over the limit!\n");
                 ip_set_nfnl_put(par->net, info->match_set.index);
                 return -ERANGE;
         }
@@ -241,8 +241,8 @@ set_target_v0_checkentry(const struct xt_tgchk_param *par)
         if (info->add_set.index != IPSET_INVALID_ID) {
                 index = ip_set_nfnl_get_byindex(par->net, info->add_set.index);
                 if (index == IPSET_INVALID_ID) {
-                        pr_warn("Cannot find add_set index %u as target\n",
-                                info->add_set.index);
+                        pr_info_ratelimited("Cannot find add_set index %u as target\n",
+                                            info->add_set.index);
                         return -ENOENT;
                 }
         }
@@ -250,8 +250,8 @@ set_target_v0_checkentry(const struct xt_tgchk_param *par)
         if (info->del_set.index != IPSET_INVALID_ID) {
                 index = ip_set_nfnl_get_byindex(par->net, info->del_set.index);
                 if (index == IPSET_INVALID_ID) {
-                        pr_warn("Cannot find del_set index %u as target\n",
-                                info->del_set.index);
+                        pr_info_ratelimited("Cannot find del_set index %u as target\n",
+                                            info->del_set.index);
                         if (info->add_set.index != IPSET_INVALID_ID)
                                 ip_set_nfnl_put(par->net, info->add_set.index);
                         return -ENOENT;
@@ -259,7 +259,7 @@ set_target_v0_checkentry(const struct xt_tgchk_param *par)
         }
         if (info->add_set.u.flags[IPSET_DIM_MAX - 1] != 0 ||
             info->del_set.u.flags[IPSET_DIM_MAX - 1] != 0) {
-                pr_warn("Protocol error: SET target dimension is over the limit!\n");
+                pr_info_ratelimited("SET target dimension over the limit!\n");
                 if (info->add_set.index != IPSET_INVALID_ID)
                         ip_set_nfnl_put(par->net, info->add_set.index);
                 if (info->del_set.index != IPSET_INVALID_ID)
@@ -316,8 +316,8 @@ set_target_v1_checkentry(const struct xt_tgchk_param *par)
         if (info->add_set.index != IPSET_INVALID_ID) {
                 index = ip_set_nfnl_get_byindex(par->net, info->add_set.index);
                 if (index == IPSET_INVALID_ID) {
-                        pr_warn("Cannot find add_set index %u as target\n",
-                                info->add_set.index);
+                        pr_info_ratelimited("Cannot find add_set index %u as target\n",
+                                            info->add_set.index);
                         return -ENOENT;
                 }
         }
@@ -325,8 +325,8 @@ set_target_v1_checkentry(const struct xt_tgchk_param *par)
         if (info->del_set.index != IPSET_INVALID_ID) {
                 index = ip_set_nfnl_get_byindex(par->net, info->del_set.index);
                 if (index == IPSET_INVALID_ID) {
-                        pr_warn("Cannot find del_set index %u as target\n",
-                                info->del_set.index);
+                        pr_info_ratelimited("Cannot find del_set index %u as target\n",
+                                            info->del_set.index);
                         if (info->add_set.index != IPSET_INVALID_ID)
                                 ip_set_nfnl_put(par->net, info->add_set.index);
                         return -ENOENT;
@@ -334,7 +334,7 @@ set_target_v1_checkentry(const struct xt_tgchk_param *par)
         }
         if (info->add_set.dim > IPSET_DIM_MAX ||
             info->del_set.dim > IPSET_DIM_MAX) {
-                pr_warn("Protocol error: SET target dimension is over the limit!\n");
+                pr_info_ratelimited("SET target dimension over the limit!\n");
                 if (info->add_set.index != IPSET_INVALID_ID)
                         ip_set_nfnl_put(par->net, info->add_set.index);
                 if (info->del_set.index != IPSET_INVALID_ID)
@@ -444,8 +444,8 @@ set_target_v3_checkentry(const struct xt_tgchk_param *par)
                 index = ip_set_nfnl_get_byindex(par->net,
                                                 info->add_set.index);
                 if (index == IPSET_INVALID_ID) {
-                        pr_warn("Cannot find add_set index %u as target\n",
-                                info->add_set.index);
+                        pr_info_ratelimited("Cannot find add_set index %u as target\n",
+                                            info->add_set.index);
                         return -ENOENT;
                 }
         }
@@ -454,8 +454,8 @@ set_target_v3_checkentry(const struct xt_tgchk_param *par)
                 index = ip_set_nfnl_get_byindex(par->net,
                                                 info->del_set.index);
                 if (index == IPSET_INVALID_ID) {
-                        pr_warn("Cannot find del_set index %u as target\n",
-                                info->del_set.index);
+                        pr_info_ratelimited("Cannot find del_set index %u as target\n",
+                                            info->del_set.index);
                         if (info->add_set.index != IPSET_INVALID_ID)
                                 ip_set_nfnl_put(par->net,
                                                 info->add_set.index);
@@ -465,7 +465,7 @@ set_target_v3_checkentry(const struct xt_tgchk_param *par)
 
         if (info->map_set.index != IPSET_INVALID_ID) {
                 if (strncmp(par->table, "mangle", 7)) {
-                        pr_warn("--map-set only usable from mangle table\n");
+                        pr_info_ratelimited("--map-set only usable from mangle table\n");
                         return -EINVAL;
                 }
                 if (((info->flags & IPSET_FLAG_MAP_SKBPRIO) |
@@ -473,14 +473,14 @@ set_target_v3_checkentry(const struct xt_tgchk_param *par)
                      !(par->hook_mask & (1 << NF_INET_FORWARD |
                                          1 << NF_INET_LOCAL_OUT |
                                          1 << NF_INET_POST_ROUTING))) {
-                        pr_warn("mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains\n");
+                        pr_info_ratelimited("mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains\n");
                         return -EINVAL;
                 }
                 index = ip_set_nfnl_get_byindex(par->net,
                                                 info->map_set.index);
                 if (index == IPSET_INVALID_ID) {
-                        pr_warn("Cannot find map_set index %u as target\n",
-                                info->map_set.index);
+                        pr_info_ratelimited("Cannot find map_set index %u as target\n",
+                                            info->map_set.index);
                         if (info->add_set.index != IPSET_INVALID_ID)
                                 ip_set_nfnl_put(par->net,
                                                 info->add_set.index);
@@ -494,7 +494,7 @@ set_target_v3_checkentry(const struct xt_tgchk_param *par)
         if (info->add_set.dim > IPSET_DIM_MAX ||
             info->del_set.dim > IPSET_DIM_MAX ||
             info->map_set.dim > IPSET_DIM_MAX) {
-                pr_warn("Protocol error: SET target dimension is over the limit!\n");
+                pr_info_ratelimited("SET target dimension over the limit!\n");
                 if (info->add_set.index != IPSET_INVALID_ID)
                         ip_set_nfnl_put(par->net, info->add_set.index);
                 if (info->del_set.index != IPSET_INVALID_ID)
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 575d2153e3b8..2ac7f674d19b 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -171,7 +171,8 @@ static int socket_mt_v1_check(const struct xt_mtchk_param *par)
                 return err;
 
         if (info->flags & ~XT_SOCKET_FLAGS_V1) {
-                pr_info("unknown flags 0x%x\n", info->flags & ~XT_SOCKET_FLAGS_V1);
+                pr_info_ratelimited("unknown flags 0x%x\n",
+                                    info->flags & ~XT_SOCKET_FLAGS_V1);
                 return -EINVAL;
         }
         return 0;
@@ -187,7 +188,8 @@ static int socket_mt_v2_check(const struct xt_mtchk_param *par)
                 return err;
 
         if (info->flags & ~XT_SOCKET_FLAGS_V2) {
-                pr_info("unknown flags 0x%x\n", info->flags & ~XT_SOCKET_FLAGS_V2);
+                pr_info_ratelimited("unknown flags 0x%x\n",
+                                    info->flags & ~XT_SOCKET_FLAGS_V2);
                 return -EINVAL;
         }
         return 0;
@@ -203,8 +205,8 @@ static int socket_mt_v3_check(const struct xt_mtchk_param *par)
         if (err)
                 return err;
         if (info->flags & ~XT_SOCKET_FLAGS_V3) {
-                pr_info("unknown flags 0x%x\n",
-                        info->flags & ~XT_SOCKET_FLAGS_V3);
+                pr_info_ratelimited("unknown flags 0x%x\n",
+                                    info->flags & ~XT_SOCKET_FLAGS_V3);
                 return -EINVAL;
         }
         return 0;
diff --git a/net/netfilter/xt_state.c b/net/netfilter/xt_state.c
index 5fbd79194d21..0b41c0befe3c 100644
--- a/net/netfilter/xt_state.c
+++ b/net/netfilter/xt_state.c
@@ -44,8 +44,8 @@ static int state_mt_check(const struct xt_mtchk_param *par)
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0)
-                pr_info("cannot load conntrack support for proto=%u\n",
-                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
         return ret;
 }
 
diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
index 1b01eec1fbda..0160f505e337 100644
--- a/net/netfilter/xt_time.c
+++ b/net/netfilter/xt_time.c
@@ -235,13 +235,13 @@ static int time_mt_check(const struct xt_mtchk_param *par)
 
         if (info->daytime_start > XT_TIME_MAX_DAYTIME ||
             info->daytime_stop > XT_TIME_MAX_DAYTIME) {
-                pr_info("invalid argument - start or "
-                        "stop time greater than 23:59:59\n");
+                pr_info_ratelimited("invalid argument - start or stop time greater than 23:59:59\n");
                 return -EDOM;
         }
 
         if (info->flags & ~XT_TIME_ALL_FLAGS) {
-                pr_info("unknown flags 0x%x\n", info->flags & ~XT_TIME_ALL_FLAGS);
+                pr_info_ratelimited("unknown flags 0x%x\n",
+                                    info->flags & ~XT_TIME_ALL_FLAGS);
                 return -EINVAL;
         }
 
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 2ad445c1d27c..07e8478068f0 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2308,7 +2308,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
         if (cb->start) {
                 ret = cb->start(cb);
                 if (ret)
-                        goto error_unlock;
+                        goto error_put;
         }
 
         nlk->cb_running = true;
@@ -2328,6 +2328,8 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
          */
         return -EINTR;
 
+error_put:
+        module_put(control->module);
 error_unlock:
         sock_put(sk);
         mutex_unlock(nlk->cb_mutex);
diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
index 367d8c027101..2ceefa183cee 100644
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -149,6 +149,10 @@ struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri,
 
         pr_debug("uri: %s, len: %zu\n", uri, uri_len);
 
+        /* sdreq->tlv_len is u8, takes uri_len, + 3 for header, + 1 for NULL */
+        if (WARN_ON_ONCE(uri_len > U8_MAX - 4))
+                return NULL;
+
         sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
         if (sdreq == NULL)
                 return NULL;
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index c0b83dc9d993..f018eafc2a0d 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -61,7 +61,8 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
 };
 
 static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = {
-        [NFC_SDP_ATTR_URI] = { .type = NLA_STRING },
+        [NFC_SDP_ATTR_URI] = { .type = NLA_STRING,
+                               .len = U8_MAX - 4 },
         [NFC_SDP_ATTR_SAP] = { .type = NLA_U8 },
 };
 
diff --git a/net/rds/connection.c b/net/rds/connection.c
index 94e190febfdd..2da3176bf792 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -224,7 +224,7 @@ static struct rds_connection *__rds_conn_create(struct net *net,
         if (rds_destroy_pending(conn))
                 ret = -ENETDOWN;
         else
-                ret = trans->conn_alloc(conn, gfp);
+                ret = trans->conn_alloc(conn, GFP_ATOMIC);
         if (ret) {
                 rcu_read_unlock();
                 kfree(conn->c_path);
diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
index 42410e910aff..cf73dc006c3b 100644
--- a/net/rxrpc/output.c
+++ b/net/rxrpc/output.c
@@ -445,7 +445,7 @@ send_fragmentable:
                                         (char *)&opt, sizeof(opt));
                 if (ret == 0) {
                         ret = kernel_sendmsg(conn->params.local->socket, &msg,
-                                             iov, 1, iov[0].iov_len);
+                                             iov, 2, len);
 
                         opt = IPV6_PMTUDISC_DO;
                         kernel_setsockopt(conn->params.local->socket,
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index cc21e8db25b0..9d45d8b56744 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -517,9 +517,10 @@ try_again:
                         ret = put_cmsg(msg, SOL_RXRPC, RXRPC_USER_CALL_ID,
                                        sizeof(unsigned int), &id32);
                 } else {
+                        unsigned long idl = call->user_call_ID;
+
                         ret = put_cmsg(msg, SOL_RXRPC, RXRPC_USER_CALL_ID,
-                                       sizeof(unsigned long),
-                                       &call->user_call_ID);
+                                       sizeof(unsigned long), &idl);
                 }
                 if (ret < 0)
                         goto error_unlock_call;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 2bc1bc23d42e..247b7cc20c13 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -376,17 +376,12 @@ struct tcf_net {
 static unsigned int tcf_net_id;
 
 static int tcf_block_insert(struct tcf_block *block, struct net *net,
-                            u32 block_index, struct netlink_ext_ack *extack)
+                            struct netlink_ext_ack *extack)
 {
         struct tcf_net *tn = net_generic(net, tcf_net_id);
-        int err;
 
-        err = idr_alloc_u32(&tn->idr, block, &block_index, block_index,
-                            GFP_KERNEL);
-        if (err)
-                return err;
-        block->index = block_index;
-        return 0;
+        return idr_alloc_u32(&tn->idr, block, &block->index, block->index,
+                             GFP_KERNEL);
 }
 
 static void tcf_block_remove(struct tcf_block *block, struct net *net)
@@ -397,6 +392,7 @@ static void tcf_block_remove(struct tcf_block *block, struct net *net)
 }
 
 static struct tcf_block *tcf_block_create(struct net *net, struct Qdisc *q,
+                                          u32 block_index,
                                           struct netlink_ext_ack *extack)
 {
         struct tcf_block *block;
@@ -419,10 +415,13 @@ static struct tcf_block *tcf_block_create(struct net *net, struct Qdisc *q,
                 err = -ENOMEM;
                 goto err_chain_create;
         }
-        block->net = qdisc_net(q);
         block->refcnt = 1;
         block->net = net;
-        block->q = q;
+        block->index = block_index;
+
+        /* Don't store q pointer for blocks which are shared */
+        if (!tcf_block_shared(block))
+                block->q = q;
         return block;
 
 err_chain_create:
@@ -518,13 +517,12 @@ int tcf_block_get_ext(struct tcf_block **p_block, struct Qdisc *q,
         }
 
         if (!block) {
-                block = tcf_block_create(net, q, extack);
+                block = tcf_block_create(net, q, ei->block_index, extack);
                 if (IS_ERR(block))
                         return PTR_ERR(block);
                 created = true;
-                if (ei->block_index) {
-                        err = tcf_block_insert(block, net,
-                                               ei->block_index, extack);
+                if (tcf_block_shared(block)) {
+                        err = tcf_block_insert(block, net, extack);
                         if (err)
                                 goto err_block_insert;
                 }
@@ -1399,13 +1397,18 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
                     nla_get_u32(tca[TCA_CHAIN]) != chain->index)
                         continue;
                 if (!tcf_chain_dump(chain, q, parent, skb, cb,
-                                    index_start, &index))
+                                    index_start, &index)) {
+                        err = -EMSGSIZE;
                         break;
+                }
         }
 
         cb->args[0] = index;
 
 out:
+        /* If we did no progress, the error (EMSGSIZE) is real */
+        if (skb->len == 0 && err)
+                return err;
         return skb->len;
 }
 
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 6c7601a530e3..ed8b6a24b9e9 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -96,7 +96,7 @@ struct tc_u_hnode {
 
 struct tc_u_common {
         struct tc_u_hnode __rcu *hlist;
-        struct tcf_block        *block;
+        void                    *ptr;
         int                     refcnt;
         struct idr              handle_idr;
         struct hlist_node       hnode;
@@ -330,9 +330,25 @@ static struct hlist_head *tc_u_common_hash;
 #define U32_HASH_SHIFT 10
 #define U32_HASH_SIZE (1 << U32_HASH_SHIFT)
 
+static void *tc_u_common_ptr(const struct tcf_proto *tp)
+{
+        struct tcf_block *block = tp->chain->block;
+
+        /* The block sharing is currently supported only
+         * for classless qdiscs. In that case we use block
+         * for tc_u_common identification. In case the
+         * block is not shared, block->q is a valid pointer
+         * and we can use that. That works for classful qdiscs.
+         */
+        if (tcf_block_shared(block))
+                return block;
+        else
+                return block->q;
+}
+
 static unsigned int tc_u_hash(const struct tcf_proto *tp)
 {
-        return hash_ptr(tp->chain->block, U32_HASH_SHIFT);
+        return hash_ptr(tc_u_common_ptr(tp), U32_HASH_SHIFT);
 }
 
 static struct tc_u_common *tc_u_common_find(const struct tcf_proto *tp)
@@ -342,7 +358,7 @@ static struct tc_u_common *tc_u_common_find(const struct tcf_proto *tp)
 
         h = tc_u_hash(tp);
         hlist_for_each_entry(tc, &tc_u_common_hash[h], hnode) {
-                if (tc->block == tp->chain->block)
+                if (tc->ptr == tc_u_common_ptr(tp))
                         return tc;
         }
         return NULL;
@@ -371,7 +387,7 @@ static int u32_init(struct tcf_proto *tp)
                         kfree(root_ht);
                         return -ENOBUFS;
                 }
-                tp_c->block = tp->chain->block;
+                tp_c->ptr = tc_u_common_ptr(tp);
                 INIT_HLIST_NODE(&tp_c->hnode);
                 idr_init(&tp_c->handle_idr);
 
diff --git a/net/sctp/debug.c b/net/sctp/debug.c
index 291c97b07058..8f6c2e8c0953 100644
--- a/net/sctp/debug.c
+++ b/net/sctp/debug.c
@@ -81,6 +81,12 @@ const char *sctp_cname(const union sctp_subtype cid)
         case SCTP_CID_RECONF:
                 return "RECONF";
 
+        case SCTP_CID_I_DATA:
+                return "I_DATA";
+
+        case SCTP_CID_I_FWD_TSN:
+                return "I_FWD_TSN";
+
         default:
                 break;
         }
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 141c9c466ec1..0247cc432e02 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -897,15 +897,12 @@ int sctp_hash_transport(struct sctp_transport *t)
         rhl_for_each_entry_rcu(transport, tmp, list, node)
                 if (transport->asoc->ep == t->asoc->ep) {
                         rcu_read_unlock();
-                        err = -EEXIST;
-                        goto out;
+                        return -EEXIST;
                 }
         rcu_read_unlock();
 
         err = rhltable_insert_key(&sctp_transport_hashtable, &arg,
                                   &t->node, sctp_hash_params);
-
-out:
         if (err)
                 pr_err_once("insert transport fail, errno %d\n", err);
 
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index cedf672487f9..f799043abec9 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -6,7 +6,7 @@
  *
  * This file is part of the SCTP kernel implementation
  *
- * These functions manipulate sctp tsn mapping array.
+ * This file contains sctp stream maniuplation primitives and helpers.
  *
  * This SCTP implementation is free software;
  * you can redistribute it and/or modify it under the terms of
diff --git a/net/sctp/stream_interleave.c b/net/sctp/stream_interleave.c
index 8c7cf8f08711..d3764c181299 100644
--- a/net/sctp/stream_interleave.c
+++ b/net/sctp/stream_interleave.c
@@ -3,7 +3,8 @@
  *
  * This file is part of the SCTP kernel implementation
  *
- * These functions manipulate sctp stream queue/scheduling.
+ * These functions implement sctp stream message interleaving, mostly
+ * including I-DATA and I-FORWARD-TSN chunks process.
  *
  * This SCTP implementation is free software;
  * you can redistribute it and/or modify it under the terms of
@@ -954,12 +955,8 @@ static void sctp_renege_events(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
         __u32 freed = 0;
         __u16 needed;
 
-        if (chunk) {
-                needed = ntohs(chunk->chunk_hdr->length);
-                needed -= sizeof(struct sctp_idata_chunk);
-        } else {
-                needed = SCTP_DEFAULT_MAXWINDOW;
-        }
+        needed = ntohs(chunk->chunk_hdr->length) -
+                 sizeof(struct sctp_idata_chunk);
 
         if (skb_queue_empty(&asoc->base.sk->sk_receive_queue)) {
                 freed = sctp_ulpq_renege_list(ulpq, &ulpq->lobby, needed);
@@ -971,9 +968,8 @@ static void sctp_renege_events(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
                                                        needed);
         }
 
-        if (chunk && freed >= needed)
-                if (sctp_ulpevent_idata(ulpq, chunk, gfp) <= 0)
-                        sctp_intl_start_pd(ulpq, gfp);
+        if (freed >= needed && sctp_ulpevent_idata(ulpq, chunk, gfp) <= 0)
+                sctp_intl_start_pd(ulpq, gfp);
 
         sk_mem_reclaim(asoc->base.sk);
 }
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index c8001471da6c..3e3dce3d4c63 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -813,7 +813,7 @@ err_out:
         return err;
 }
 
-int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         char *name;
@@ -835,20 +835,27 @@ int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
 
         name = nla_data(attrs[TIPC_NLA_BEARER_NAME]);
 
-        rtnl_lock();
         bearer = tipc_bearer_find(net, name);
-        if (!bearer) {
-                rtnl_unlock();
+        if (!bearer)
                 return -EINVAL;
-        }
 
         bearer_disable(net, bearer);
-        rtnl_unlock();
 
         return 0;
 }
 
-int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
+int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_bearer_disable(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
+
+int __tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         char *bearer;
@@ -890,15 +897,18 @@ int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
                         prio = nla_get_u32(props[TIPC_NLA_PROP_PRIO]);
         }
 
+        return tipc_enable_bearer(net, bearer, domain, prio, attrs);
+}
+
+int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
         rtnl_lock();
-        err = tipc_enable_bearer(net, bearer, domain, prio, attrs);
-        if (err) {
-                rtnl_unlock();
-                return err;
-        }
+        err = __tipc_nl_bearer_enable(skb, info);
         rtnl_unlock();
 
-        return 0;
+        return err;
 }
 
 int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info)
@@ -944,7 +954,7 @@ int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info)
         return 0;
 }
 
-int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         char *name;
@@ -965,22 +975,17 @@ int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
         name = nla_data(attrs[TIPC_NLA_BEARER_NAME]);
 
-        rtnl_lock();
         b = tipc_bearer_find(net, name);
-        if (!b) {
-                rtnl_unlock();
+        if (!b)
                 return -EINVAL;
-        }
 
         if (attrs[TIPC_NLA_BEARER_PROP]) {
                 struct nlattr *props[TIPC_NLA_PROP_MAX + 1];
 
                 err = tipc_nl_parse_link_prop(attrs[TIPC_NLA_BEARER_PROP],
                                               props);
-                if (err) {
-                        rtnl_unlock();
+                if (err)
                         return err;
-                }
 
                 if (props[TIPC_NLA_PROP_TOL])
                         b->tolerance = nla_get_u32(props[TIPC_NLA_PROP_TOL]);
@@ -989,11 +994,21 @@ int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
                 if (props[TIPC_NLA_PROP_WIN])
                         b->window = nla_get_u32(props[TIPC_NLA_PROP_WIN]);
         }
-        rtnl_unlock();
 
         return 0;
 }
 
+int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_bearer_set(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
+
 static int __tipc_nl_add_media(struct tipc_nl_msg *msg,
                                struct tipc_media *media, int nlflags)
 {
@@ -1115,7 +1130,7 @@ err_out:
         return err;
 }
 
-int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         char *name;
@@ -1133,22 +1148,17 @@ int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
         name = nla_data(attrs[TIPC_NLA_MEDIA_NAME]);
 
-        rtnl_lock();
         m = tipc_media_find(name);
-        if (!m) {
-                rtnl_unlock();
+        if (!m)
                 return -EINVAL;
-        }
 
         if (attrs[TIPC_NLA_MEDIA_PROP]) {
                 struct nlattr *props[TIPC_NLA_PROP_MAX + 1];
 
                 err = tipc_nl_parse_link_prop(attrs[TIPC_NLA_MEDIA_PROP],
                                               props);
-                if (err) {
-                        rtnl_unlock();
+                if (err)
                         return err;
-                }
 
                 if (props[TIPC_NLA_PROP_TOL])
                         m->tolerance = nla_get_u32(props[TIPC_NLA_PROP_TOL]);
@@ -1157,7 +1167,17 @@ int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
                 if (props[TIPC_NLA_PROP_WIN])
                         m->window = nla_get_u32(props[TIPC_NLA_PROP_WIN]);
         }
-        rtnl_unlock();
 
         return 0;
 }
+
+int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_media_set(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index 42d6eeeb646d..a53613d95bc9 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -188,15 +188,19 @@ extern struct tipc_media udp_media_info;
 #endif
 
 int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_bearer_get(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info);
 
 int tipc_nl_media_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_media_get(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info);
 
 int tipc_media_set_priority(const char *name, u32 new_value);
 int tipc_media_set_window(const char *name, u32 new_value);
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 719c5924b638..1a2fde0d6f61 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -200,7 +200,7 @@ out:
         return skb->len;
 }
 
-int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
 {
         struct net *net = sock_net(skb->sk);
         struct tipc_net *tn = net_generic(net, tipc_net_id);
@@ -241,10 +241,19 @@ int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
                 if (!tipc_addr_node_valid(addr))
                         return -EINVAL;
 
-                rtnl_lock();
                 tipc_net_start(net, addr);
-                rtnl_unlock();
         }
 
         return 0;
 }
+
+int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_net_set(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
diff --git a/net/tipc/net.h b/net/tipc/net.h
index c7c254902873..c0306aa2374b 100644
--- a/net/tipc/net.h
+++ b/net/tipc/net.h
@@ -47,5 +47,6 @@ void tipc_net_stop(struct net *net);
 
 int tipc_nl_net_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info);
 
 #endif
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index e48f0b2c01b9..4492cda45566 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -285,10 +285,6 @@ static int __tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
         if (!trans_buf)
                 return -ENOMEM;
 
-        err = (*cmd->transcode)(cmd, trans_buf, msg);
-        if (err)
-                goto trans_out;
-
         attrbuf = kmalloc((tipc_genl_family.maxattr + 1) *
                         sizeof(struct nlattr *), GFP_KERNEL);
         if (!attrbuf) {
@@ -296,27 +292,34 @@ static int __tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
                 goto trans_out;
         }
 
-        err = nla_parse(attrbuf, tipc_genl_family.maxattr,
-                        (const struct nlattr *)trans_buf->data,
-                        trans_buf->len, NULL, NULL);
-        if (err)
-                goto parse_out;
-
         doit_buf = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
         if (!doit_buf) {
                 err = -ENOMEM;
-                goto parse_out;
+                goto attrbuf_out;
         }
 
-        doit_buf->sk = msg->dst_sk;
-
         memset(&info, 0, sizeof(info));
         info.attrs = attrbuf;
 
+        rtnl_lock();
+        err = (*cmd->transcode)(cmd, trans_buf, msg);
+        if (err)
+                goto doit_out;
+
+        err = nla_parse(attrbuf, tipc_genl_family.maxattr,
+                        (const struct nlattr *)trans_buf->data,
+                        trans_buf->len, NULL, NULL);
+        if (err)
+                goto doit_out;
+
+        doit_buf->sk = msg->dst_sk;
+
         err = (*cmd->doit)(doit_buf, &info);
+doit_out:
+        rtnl_unlock();
 
         kfree_skb(doit_buf);
-parse_out:
+attrbuf_out:
         kfree(attrbuf);
 trans_out:
         kfree_skb(trans_buf);
@@ -722,13 +725,13 @@ static int tipc_nl_compat_link_set(struct tipc_nl_compat_cmd_doit *cmd,
 
         media = tipc_media_find(lc->name);
         if (media) {
-                cmd->doit = &tipc_nl_media_set;
+                cmd->doit = &__tipc_nl_media_set;
                 return tipc_nl_compat_media_set(skb, msg);
         }
 
         bearer = tipc_bearer_find(msg->net, lc->name);
         if (bearer) {
-                cmd->doit = &tipc_nl_bearer_set;
+                cmd->doit = &__tipc_nl_bearer_set;
                 return tipc_nl_compat_bearer_set(skb, msg);
         }
 
@@ -1089,12 +1092,12 @@ static int tipc_nl_compat_handle(struct tipc_nl_compat_msg *msg)
                 return tipc_nl_compat_dumpit(&dump, msg);
         case TIPC_CMD_ENABLE_BEARER:
                 msg->req_type = TIPC_TLV_BEARER_CONFIG;
-                doit.doit = tipc_nl_bearer_enable;
+                doit.doit = __tipc_nl_bearer_enable;
                 doit.transcode = tipc_nl_compat_bearer_enable;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_DISABLE_BEARER:
                 msg->req_type = TIPC_TLV_BEARER_NAME;
-                doit.doit = tipc_nl_bearer_disable;
+                doit.doit = __tipc_nl_bearer_disable;
                 doit.transcode = tipc_nl_compat_bearer_disable;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_SHOW_LINK_STATS:
@@ -1148,12 +1151,12 @@ static int tipc_nl_compat_handle(struct tipc_nl_compat_msg *msg)
                 return tipc_nl_compat_dumpit(&dump, msg);
         case TIPC_CMD_SET_NODE_ADDR:
                 msg->req_type = TIPC_TLV_NET_ADDR;
-                doit.doit = tipc_nl_net_set;
+                doit.doit = __tipc_nl_net_set;
                 doit.transcode = tipc_nl_compat_net_set;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_SET_NETID:
                 msg->req_type = TIPC_TLV_UNSIGNED;
-                doit.doit = tipc_nl_net_set;
+                doit.doit = __tipc_nl_net_set;
                 doit.transcode = tipc_nl_compat_net_set;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_GET_NETID:
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index b0d5fcea47e7..e9b4b53ab53e 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -308,8 +308,11 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
                         goto out;
                 }
                 lock_sock(sk);
-                memcpy(crypto_info_aes_gcm_128->iv, ctx->iv,
+                memcpy(crypto_info_aes_gcm_128->iv,
+                       ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
                        TLS_CIPHER_AES_GCM_128_IV_SIZE);
+                memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->rec_seq,
+                       TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
                 release_sock(sk);
                 if (copy_to_user(optval,
                                  crypto_info_aes_gcm_128,
@@ -375,7 +378,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
         rc = copy_from_user(crypto_info, optval, sizeof(*crypto_info));
         if (rc) {
                 rc = -EFAULT;
-                goto out;
+                goto err_crypto_info;
         }
 
         /* check version */
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index d545e1d0dea2..2d465bdeccbc 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1825,7 +1825,7 @@ out:
 }
 
 /* We use paged skbs for stream sockets, and limit occupancy to 32768
- * bytes, and a minimun of a full page.
+ * bytes, and a minimum of a full page.
  */
 #define UNIX_SKB_FRAGS_SZ (PAGE_SIZE << get_order(32768))
 
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index 51aa55618ef7..b12da6ef3c12 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -170,9 +170,28 @@ int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
                 enum nl80211_bss_scan_width scan_width;
                 struct ieee80211_supported_band *sband =
                                 rdev->wiphy.bands[setup->chandef.chan->band];
-                scan_width = cfg80211_chandef_to_scan_width(&setup->chandef);
-                setup->basic_rates = ieee80211_mandatory_rates(sband,
-                                                               scan_width);
+
+                if (setup->chandef.chan->band == NL80211_BAND_2GHZ) {
+                        int i;
+
+                        /*
+                         * Older versions selected the mandatory rates for
+                         * 2.4 GHz as well, but were broken in that only
+                         * 1 Mbps was regarded as a mandatory rate. Keep
+                         * using just 1 Mbps as the default basic rate for
+                         * mesh to be interoperable with older versions.
+                         */
+                        for (i = 0; i < sband->n_bitrates; i++) {
+                                if (sband->bitrates[i].bitrate == 10) {
+                                        setup->basic_rates = BIT(i);
+                                        break;
+                                }
+                        }
+                } else {
+                        scan_width = cfg80211_chandef_to_scan_width(&setup->chandef);
+                        setup->basic_rates = ieee80211_mandatory_rates(sband,
+                                                                       scan_width);
+                }
         }
 
         err = cfg80211_chandef_dfs_required(&rdev->wiphy,
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index fdb3646274a5..701cfd7acc1b 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -1032,6 +1032,8 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
         wdev->current_bss = NULL;
         wdev->ssid_len = 0;
         wdev->conn_owner_nlportid = 0;
+        kzfree(wdev->connect_keys);
+        wdev->connect_keys = NULL;
 
         nl80211_send_disconnected(rdev, dev, reason, ie, ie_len, from_ap);
 
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 6f9e4ce568cd..9bb0a7f2863e 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -18,6 +18,7 @@
 #include <linux/cred.h>
 #include <linux/key-type.h>
 #include <linux/digsig.h>
+#include <linux/vmalloc.h>
 #include <crypto/public_key.h>
 #include <keys/system_keyring.h>
 
diff --git a/security/keys/big_key.c b/security/keys/big_key.c
index 929e14978c42..fa728f662a6f 100644
--- a/security/keys/big_key.c
+++ b/security/keys/big_key.c
@@ -22,6 +22,13 @@
 #include <keys/big_key-type.h>
 #include <crypto/aead.h>
 
+struct big_key_buf {
+        unsigned int            nr_pages;
+        void                    *virt;
+        struct scatterlist      *sg;
+        struct page             *pages[];
+};
+
 /*
  * Layout of key payload words.
  */
@@ -91,10 +98,9 @@ static DEFINE_MUTEX(big_key_aead_lock);
 /*
  * Encrypt/decrypt big_key data
  */
-static int big_key_crypt(enum big_key_op op, u8 *data, size_t datalen, u8 *key)
+static int big_key_crypt(enum big_key_op op, struct big_key_buf *buf, size_t datalen, u8 *key)
 {
         int ret;
-        struct scatterlist sgio;
         struct aead_request *aead_req;
         /* We always use a zero nonce. The reason we can get away with this is
          * because we're using a different randomly generated key for every
@@ -109,8 +115,7 @@ static int big_key_crypt(enum big_key_op op, u8 *data, size_t datalen, u8 *key)
                 return -ENOMEM;
 
         memset(zero_nonce, 0, sizeof(zero_nonce));
-        sg_init_one(&sgio, data, datalen + (op == BIG_KEY_ENC ? ENC_AUTHTAG_SIZE : 0));
-        aead_request_set_crypt(aead_req, &sgio, &sgio, datalen, zero_nonce);
+        aead_request_set_crypt(aead_req, buf->sg, buf->sg, datalen, zero_nonce);
         aead_request_set_callback(aead_req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);
         aead_request_set_ad(aead_req, 0);
 
@@ -130,21 +135,81 @@ error:
 }
 
 /*
+ * Free up the buffer.
+ */
+static void big_key_free_buffer(struct big_key_buf *buf)
+{
+        unsigned int i;
+
+        if (buf->virt) {
+                memset(buf->virt, 0, buf->nr_pages * PAGE_SIZE);
+                vunmap(buf->virt);
+        }
+
+        for (i = 0; i < buf->nr_pages; i++)
+                if (buf->pages[i])
+                        __free_page(buf->pages[i]);
+
+        kfree(buf);
+}
+
+/*
+ * Allocate a buffer consisting of a set of pages with a virtual mapping
+ * applied over them.
+ */
+static void *big_key_alloc_buffer(size_t len)
+{
+        struct big_key_buf *buf;
+        unsigned int npg = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+        unsigned int i, l;
+
+        buf = kzalloc(sizeof(struct big_key_buf) +
+                      sizeof(struct page) * npg +
+                      sizeof(struct scatterlist) * npg,
+                      GFP_KERNEL);
+        if (!buf)
+                return NULL;
+
+        buf->nr_pages = npg;
+        buf->sg = (void *)(buf->pages + npg);
+        sg_init_table(buf->sg, npg);
+
+        for (i = 0; i < buf->nr_pages; i++) {
+                buf->pages[i] = alloc_page(GFP_KERNEL);
+                if (!buf->pages[i])
+                        goto nomem;
+
+                l = min_t(size_t, len, PAGE_SIZE);
+                sg_set_page(&buf->sg[i], buf->pages[i], l, 0);
+                len -= l;
+        }
+
+        buf->virt = vmap(buf->pages, buf->nr_pages, VM_MAP, PAGE_KERNEL);
+        if (!buf->virt)
+                goto nomem;
+
+        return buf;
+
+nomem:
+        big_key_free_buffer(buf);
+        return NULL;
+}
+
+/*
  * Preparse a big key
  */
 int big_key_preparse(struct key_preparsed_payload *prep)
 {
+        struct big_key_buf *buf;
         struct path *path = (struct path *)&prep->payload.data[big_key_path];
         struct file *file;
         u8 *enckey;
-        u8 *data = NULL;
         ssize_t written;
-        size_t datalen = prep->datalen;
+        size_t datalen = prep->datalen, enclen = datalen + ENC_AUTHTAG_SIZE;
         int ret;
 
-        ret = -EINVAL;
         if (datalen <= 0 || datalen > 1024 * 1024 || !prep->data)
-                goto error;
+                return -EINVAL;
 
         /* Set an arbitrary quota */
         prep->quotalen = 16;
@@ -157,13 +222,12 @@ int big_key_preparse(struct key_preparsed_payload *prep)
                  *
                  * File content is stored encrypted with randomly generated key.
                  */
-                size_t enclen = datalen + ENC_AUTHTAG_SIZE;
                 loff_t pos = 0;
 
-                data = kmalloc(enclen, GFP_KERNEL);
-                if (!data)
+                buf = big_key_alloc_buffer(enclen);
+                if (!buf)
                         return -ENOMEM;
-                memcpy(data, prep->data, datalen);
+                memcpy(buf->virt, prep->data, datalen);
 
                 /* generate random key */
                 enckey = kmalloc(ENC_KEY_SIZE, GFP_KERNEL);
@@ -176,7 +240,7 @@ int big_key_preparse(struct key_preparsed_payload *prep)
                         goto err_enckey;
 
                 /* encrypt aligned data */
-                ret = big_key_crypt(BIG_KEY_ENC, data, datalen, enckey);
+                ret = big_key_crypt(BIG_KEY_ENC, buf, datalen, enckey);
                 if (ret)
                         goto err_enckey;
 
@@ -187,7 +251,7 @@ int big_key_preparse(struct key_preparsed_payload *prep)
                         goto err_enckey;
                 }
 
-                written = kernel_write(file, data, enclen, &pos);
+                written = kernel_write(file, buf->virt, enclen, &pos);
                 if (written != enclen) {
                         ret = written;
                         if (written >= 0)
@@ -202,7 +266,7 @@ int big_key_preparse(struct key_preparsed_payload *prep)
                 *path = file->f_path;
                 path_get(path);
                 fput(file);
-                kzfree(data);
+                big_key_free_buffer(buf);
         } else {
                 /* Just store the data in a buffer */
                 void *data = kmalloc(datalen, GFP_KERNEL);
@@ -220,7 +284,7 @@ err_fput:
 err_enckey:
         kzfree(enckey);
 error:
-        kzfree(data);
+        big_key_free_buffer(buf);
         return ret;
 }
 
@@ -298,15 +362,15 @@ long big_key_read(const struct key *key, char __user *buffer, size_t buflen)
                 return datalen;
 
         if (datalen > BIG_KEY_FILE_THRESHOLD) {
+                struct big_key_buf *buf;
                 struct path *path = (struct path *)&key->payload.data[big_key_path];
                 struct file *file;
-                u8 *data;
                 u8 *enckey = (u8 *)key->payload.data[big_key_data];
                 size_t enclen = datalen + ENC_AUTHTAG_SIZE;
                 loff_t pos = 0;
 
-                data = kmalloc(enclen, GFP_KERNEL);
-                if (!data)
+                buf = big_key_alloc_buffer(enclen);
+                if (!buf)
                         return -ENOMEM;
 
                 file = dentry_open(path, O_RDONLY, current_cred());
@@ -316,26 +380,26 @@ long big_key_read(const struct key *key, char __user *buffer, size_t buflen)
                 }
 
                 /* read file to kernel and decrypt */
-                ret = kernel_read(file, data, enclen, &pos);
+                ret = kernel_read(file, buf->virt, enclen, &pos);
                 if (ret >= 0 && ret != enclen) {
                         ret = -EIO;
                         goto err_fput;
                 }
 
-                ret = big_key_crypt(BIG_KEY_DEC, data, enclen, enckey);
+                ret = big_key_crypt(BIG_KEY_DEC, buf, enclen, enckey);
                 if (ret)
                         goto err_fput;
 
                 ret = datalen;
 
                 /* copy decrypted data to user */
-                if (copy_to_user(buffer, data, datalen) != 0)
+                if (copy_to_user(buffer, buf->virt, datalen) != 0)
                         ret = -EFAULT;
 
 err_fput:
                 fput(file);
 error:
-                kzfree(data);
+                big_key_free_buffer(buf);
         } else {
                 ret = datalen;
                 if (copy_to_user(buffer, key->payload.data[big_key_data],
diff --git a/sound/ac97/Kconfig b/sound/ac97/Kconfig
index f8a64e15e5bf..baa5f8ef89d2 100644
--- a/sound/ac97/Kconfig
+++ b/sound/ac97/Kconfig
@@ -5,7 +5,6 @@
 
 config AC97_BUS_NEW
         tristate
-        select AC97
         help
           This is the new AC97 bus type, successor of AC97_BUS. The ported
           drivers which benefit from the AC97 automatic probing should "select"
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 60db32785f62..04d4db44fae5 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1003,7 +1003,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
 {
         struct snd_seq_client *client = file->private_data;
         int written = 0, len;
-        int err = -EINVAL;
+        int err;
         struct snd_seq_event event;
 
         if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT))
@@ -1018,11 +1018,15 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
 
         /* allocate the pool now if the pool is not allocated yet */ 
         if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
-                if (snd_seq_pool_init(client->pool) < 0)
+                mutex_lock(&client->ioctl_mutex);
+                err = snd_seq_pool_init(client->pool);
+                mutex_unlock(&client->ioctl_mutex);
+                if (err < 0)
                         return -ENOMEM;
         }
 
         /* only process whole events */
+        err = -EINVAL;
         while (count >= sizeof(struct snd_seq_event)) {
                 /* Read in the event header from the user */
                 len = sizeof(event);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 23475888192b..ce28f7ce64e6 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3465,6 +3465,19 @@ static void alc269_fixup_pincfg_no_hp_to_lineout(struct hda_codec *codec,
                 spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
 }
 
+static void alc269_fixup_pincfg_U7x7_headset_mic(struct hda_codec *codec,
+                                                 const struct hda_fixup *fix,
+                                                 int action)
+{
+        unsigned int cfg_headphone = snd_hda_codec_get_pincfg(codec, 0x21);
+        unsigned int cfg_headset_mic = snd_hda_codec_get_pincfg(codec, 0x19);
+
+        if (cfg_headphone && cfg_headset_mic == 0x411111f0)
+                snd_hda_codec_set_pincfg(codec, 0x19,
+                        (cfg_headphone & ~AC_DEFCFG_DEVICE) |
+                        (AC_JACK_MIC_IN << AC_DEFCFG_DEVICE_SHIFT));
+}
+
 static void alc269_fixup_hweq(struct hda_codec *codec,
                                const struct hda_fixup *fix, int action)
 {
@@ -4972,6 +4985,28 @@ static void alc_fixup_tpt440_dock(struct hda_codec *codec,
         }
 }
 
+static void alc_fixup_tpt470_dock(struct hda_codec *codec,
+                                  const struct hda_fixup *fix, int action)
+{
+        static const struct hda_pintbl pincfgs[] = {
+                { 0x17, 0x21211010 }, /* dock headphone */
+                { 0x19, 0x21a11010 }, /* dock mic */
+                { }
+        };
+        struct alc_spec *spec = codec->spec;
+
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
+                /* Enable DOCK device */
+                snd_hda_codec_write(codec, 0x17, 0,
+                            AC_VERB_SET_CONFIG_DEFAULT_BYTES_3, 0);
+                /* Enable DOCK device */
+                snd_hda_codec_write(codec, 0x19, 0,
+                            AC_VERB_SET_CONFIG_DEFAULT_BYTES_3, 0);
+                snd_hda_apply_pincfgs(codec, pincfgs);
+        }
+}
+
 static void alc_shutup_dell_xps13(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
@@ -5351,6 +5386,7 @@ enum {
         ALC269_FIXUP_LIFEBOOK_EXTMIC,
         ALC269_FIXUP_LIFEBOOK_HP_PIN,
         ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT,
+        ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC,
         ALC269_FIXUP_AMIC,
         ALC269_FIXUP_DMIC,
         ALC269VB_FIXUP_AMIC,
@@ -5446,6 +5482,7 @@ enum {
         ALC700_FIXUP_INTEL_REFERENCE,
         ALC274_FIXUP_DELL_BIND_DACS,
         ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
+        ALC298_FIXUP_TPT470_DOCK,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -5556,6 +5593,10 @@ static const struct hda_fixup alc269_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
         },
+        [ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc269_fixup_pincfg_U7x7_headset_mic,
+        },
         [ALC269_FIXUP_AMIC] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
@@ -6271,6 +6312,12 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC274_FIXUP_DELL_BIND_DACS
         },
+        [ALC298_FIXUP_TPT470_DOCK] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_tpt470_dock,
+                .chained = true,
+                .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6321,6 +6368,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
         SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
         SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+        SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+        SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
         SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
@@ -6422,6 +6471,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT),
         SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
         SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
+        SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),
         SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
         SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
         SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
@@ -6450,8 +6500,16 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x2218, "Thinkpad X1 Carbon 2nd", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x222d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x222e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2231, "Thinkpad T560", ALC292_FIXUP_TPT460),
         SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460),
+        SND_PCI_QUIRK(0x17aa, 0x2245, "Thinkpad T470", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x2246, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x2247, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x224b, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
@@ -6472,7 +6530,12 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x5050, "Thinkpad T560p", ALC292_FIXUP_TPT460),
         SND_PCI_QUIRK(0x17aa, 0x5051, "Thinkpad L460", ALC292_FIXUP_TPT460),
         SND_PCI_QUIRK(0x17aa, 0x5053, "Thinkpad T460", ALC292_FIXUP_TPT460),
+        SND_PCI_QUIRK(0x17aa, 0x505d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x505f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x5062, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x17aa, 0x511e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
         SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
         SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
@@ -6735,6 +6798,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x14, 0x90170110},
                 {0x21, 0x02211020}),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60130},
+                {0x14, 0x90170110},
+                {0x14, 0x01011020},
+                {0x21, 0x0221101f}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC256_STANDARD_PINS),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC,
                 {0x14, 0x90170110},
@@ -6803,6 +6871,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x12, 0x90a60120},
                 {0x14, 0x90170110},
                 {0x21, 0x0321101f}),
+        SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0xb7a60130},
+                {0x14, 0x90170110},
+                {0x21, 0x04211020}),
         SND_HDA_PIN_QUIRK(0x10ec0290, 0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1,
                 ALC290_STANDARD_PINS,
                 {0x15, 0x04211040},
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 9afb8ab524c7..06b22624ab7a 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -347,17 +347,20 @@ static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request,
                             int validx, int *value_ret)
 {
         struct snd_usb_audio *chip = cval->head.mixer->chip;
-        unsigned char buf[4 + 3 * sizeof(__u32)]; /* enough space for one range */
+        /* enough space for one range */
+        unsigned char buf[sizeof(__u16) + 3 * sizeof(__u32)];
         unsigned char *val;
-        int idx = 0, ret, size;
+        int idx = 0, ret, val_size, size;
         __u8 bRequest;
 
+        val_size = uac2_ctl_value_size(cval->val_type);
+
         if (request == UAC_GET_CUR) {
                 bRequest = UAC2_CS_CUR;
-                size = uac2_ctl_value_size(cval->val_type);
+                size = val_size;
         } else {
                 bRequest = UAC2_CS_RANGE;
-                size = sizeof(buf);
+                size = sizeof(__u16) + 3 * val_size;
         }
 
         memset(buf, 0, sizeof(buf));
@@ -390,16 +393,17 @@ error:
                 val = buf + sizeof(__u16);
                 break;
         case UAC_GET_MAX:
-                val = buf + sizeof(__u16) * 2;
+                val = buf + sizeof(__u16) + val_size;
                 break;
         case UAC_GET_RES:
-                val = buf + sizeof(__u16) * 3;
+                val = buf + sizeof(__u16) + val_size * 2;
                 break;
         default:
                 return -EINVAL;
         }
 
-        *value_ret = convert_signed_value(cval, snd_usb_combine_bytes(val, sizeof(__u16)));
+        *value_ret = convert_signed_value(cval,
+                                          snd_usb_combine_bytes(val, val_size));
 
         return 0;
 }
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index b9c9a19f9588..3cbfae6604f9 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -357,6 +357,15 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
 
                 alts = &iface->altsetting[1];
                 goto add_sync_ep;
+        case USB_ID(0x1397, 0x0002):
+                ep = 0x81;
+                iface = usb_ifnum_to_if(dev, 1);
+
+                if (!iface || iface->num_altsetting == 0)
+                        return -EINVAL;
+
+                alts = &iface->altsetting[1];
+                goto add_sync_ep;
 
         }
         if (attr == USB_ENDPOINT_SYNC_ASYNC &&
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index a66ef5777887..ea8f3de92fa4 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1363,8 +1363,11 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
                         return SNDRV_PCM_FMTBIT_DSD_U32_BE;
                 break;
 
-        /* Amanero Combo384 USB interface with native DSD support */
-        case USB_ID(0x16d0, 0x071a):
+        /* Amanero Combo384 USB based DACs with native DSD support */
+        case USB_ID(0x16d0, 0x071a):  /* Amanero - Combo384 */
+        case USB_ID(0x2ab6, 0x0004):  /* T+A DAC8DSD-V2.0, MP1000E-V2.0, MP2000R-V2.0, MP2500R-V2.0, MP3100HV-V2.0 */
+        case USB_ID(0x2ab6, 0x0005):  /* T+A USB HD Audio 1 */
+        case USB_ID(0x2ab6, 0x0006):  /* T+A USB HD Audio 2 */
                 if (fp->altsetting == 2) {
                         switch (le16_to_cpu(chip->dev->descriptor.bcdDevice)) {
                         case 0x199:
diff --git a/tools/arch/powerpc/include/uapi/asm/kvm.h b/tools/arch/powerpc/include/uapi/asm/kvm.h
index 637b7263cb86..833ed9a16adf 100644
--- a/tools/arch/powerpc/include/uapi/asm/kvm.h
+++ b/tools/arch/powerpc/include/uapi/asm/kvm.h
@@ -632,6 +632,8 @@ struct kvm_ppc_cpu_char {
 #define KVM_REG_PPC_TIDR        (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbc)
 #define KVM_REG_PPC_PSSCR       (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbd)
 
+#define KVM_REG_PPC_DEC_EXPIRY  (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbe)
+
 /* Transactional Memory checkpointed state:
  * This is all GPRs, all VSX regs and a subset of SPRs
  */
diff --git a/tools/arch/s390/include/uapi/asm/unistd.h b/tools/arch/s390/include/uapi/asm/unistd.h
deleted file mode 100644
index 725120939051..000000000000
--- a/tools/arch/s390/include/uapi/asm/unistd.h
+++ /dev/null
@@ -1,412 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/*
- *  S390 version
- *
- *  Derived from "include/asm-i386/unistd.h"
- */
-
-#ifndef _UAPI_ASM_S390_UNISTD_H_
-#define _UAPI_ASM_S390_UNISTD_H_
-
-/*
- * This file contains the system call numbers.
- */
-
-#define __NR_exit                 1
-#define __NR_fork                 2
-#define __NR_read                 3
-#define __NR_write                4
-#define __NR_open                 5
-#define __NR_close                6
-#define __NR_restart_syscall      7
-#define __NR_creat                8
-#define __NR_link                 9
-#define __NR_unlink              10
-#define __NR_execve              11
-#define __NR_chdir               12
-#define __NR_mknod               14
-#define __NR_chmod               15
-#define __NR_lseek               19
-#define __NR_getpid              20
-#define __NR_mount               21
-#define __NR_umount              22
-#define __NR_ptrace              26
-#define __NR_alarm               27
-#define __NR_pause               29
-#define __NR_utime               30
-#define __NR_access              33
-#define __NR_nice                34
-#define __NR_sync                36
-#define __NR_kill                37
-#define __NR_rename              38
-#define __NR_mkdir               39
-#define __NR_rmdir               40
-#define __NR_dup                 41
-#define __NR_pipe                42
-#define __NR_times               43
-#define __NR_brk                 45
-#define __NR_signal              48
-#define __NR_acct                51
-#define __NR_umount2             52
-#define __NR_ioctl               54
-#define __NR_fcntl               55
-#define __NR_setpgid             57
-#define __NR_umask               60
-#define __NR_chroot              61
-#define __NR_ustat               62
-#define __NR_dup2                63
-#define __NR_getppid             64
-#define __NR_getpgrp             65
-#define __NR_setsid              66
-#define __NR_sigaction           67
-#define __NR_sigsuspend          72
-#define __NR_sigpending          73
-#define __NR_sethostname         74
-#define __NR_setrlimit           75
-#define __NR_getrusage           77
-#define __NR_gettimeofday        78
-#define __NR_settimeofday        79
-#define __NR_symlink             83
-#define __NR_readlink            85
-#define __NR_uselib              86
-#define __NR_swapon              87
-#define __NR_reboot              88
-#define __NR_readdir             89
-#define __NR_mmap                90
-#define __NR_munmap              91
-#define __NR_truncate            92
-#define __NR_ftruncate           93
-#define __NR_fchmod              94
-#define __NR_getpriority         96
-#define __NR_setpriority         97
-#define __NR_statfs              99
-#define __NR_fstatfs            100
-#define __NR_socketcall         102
-#define __NR_syslog             103
-#define __NR_setitimer          104
-#define __NR_getitimer          105
-#define __NR_stat               106
-#define __NR_lstat              107
-#define __NR_fstat              108
-#define __NR_lookup_dcookie     110
-#define __NR_vhangup            111
-#define __NR_idle               112
-#define __NR_wait4              114
-#define __NR_swapoff            115
-#define __NR_sysinfo            116
-#define __NR_ipc                117
-#define __NR_fsync              118
-#define __NR_sigreturn          119
-#define __NR_clone              120
-#define __NR_setdomainname      121
-#define __NR_uname              122
-#define __NR_adjtimex           124
-#define __NR_mprotect           125
-#define __NR_sigprocmask        126
-#define __NR_create_module      127
-#define __NR_init_module        128
-#define __NR_delete_module      129
-#define __NR_get_kernel_syms    130
-#define __NR_quotactl           131
-#define __NR_getpgid            132
-#define __NR_fchdir             133
-#define __NR_bdflush            134
-#define __NR_sysfs              135
-#define __NR_personality        136
-#define __NR_afs_syscall        137 /* Syscall for Andrew File System */
-#define __NR_getdents           141
-#define __NR_flock              143
-#define __NR_msync              144
-#define __NR_readv              145
-#define __NR_writev             146
-#define __NR_getsid             147
-#define __NR_fdatasync          148
-#define __NR__sysctl            149
-#define __NR_mlock              150
-#define __NR_munlock            151
-#define __NR_mlockall           152
-#define __NR_munlockall         153
-#define __NR_sched_setparam             154
-#define __NR_sched_getparam             155
-#define __NR_sched_setscheduler         156
-#define __NR_sched_getscheduler         157
-#define __NR_sched_yield                158
-#define __NR_sched_get_priority_max     159
-#define __NR_sched_get_priority_min     160
-#define __NR_sched_rr_get_interval      161
-#define __NR_nanosleep          162
-#define __NR_mremap             163
-#define __NR_query_module       167
-#define __NR_poll               168
-#define __NR_nfsservctl         169
-#define __NR_prctl              172
-#define __NR_rt_sigreturn       173
-#define __NR_rt_sigaction       174
-#define __NR_rt_sigprocmask     175
-#define __NR_rt_sigpending      176
-#define __NR_rt_sigtimedwait    177
-#define __NR_rt_sigqueueinfo    178
-#define __NR_rt_sigsuspend      179
-#define __NR_pread64            180
-#define __NR_pwrite64           181
-#define __NR_getcwd             183
-#define __NR_capget             184
-#define __NR_capset             185
-#define __NR_sigaltstack        186
-#define __NR_sendfile           187
-#define __NR_getpmsg            188
-#define __NR_putpmsg            189
-#define __NR_vfork              190
-#define __NR_pivot_root         217
-#define __NR_mincore            218
-#define __NR_madvise            219
-#define __NR_getdents64         220
-#define __NR_readahead          222
-#define __NR_setxattr           224
-#define __NR_lsetxattr          225
-#define __NR_fsetxattr          226
-#define __NR_getxattr           227
-#define __NR_lgetxattr          228
-#define __NR_fgetxattr          229
-#define __NR_listxattr          230
-#define __NR_llistxattr         231
-#define __NR_flistxattr         232
-#define __NR_removexattr        233
-#define __NR_lremovexattr       234
-#define __NR_fremovexattr       235
-#define __NR_gettid             236
-#define __NR_tkill              237
-#define __NR_futex              238
-#define __NR_sched_setaffinity  239
-#define __NR_sched_getaffinity  240
-#define __NR_tgkill             241
-/* Number 242 is reserved for tux */
-#define __NR_io_setup           243
-#define __NR_io_destroy         244
-#define __NR_io_getevents       245
-#define __NR_io_submit          246
-#define __NR_io_cancel          247
-#define __NR_exit_group         248
-#define __NR_epoll_create       249
-#define __NR_epoll_ctl          250
-#define __NR_epoll_wait         251
-#define __NR_set_tid_address    252
-#define __NR_fadvise64          253
-#define __NR_timer_create       254
-#define __NR_timer_settime      255
-#define __NR_timer_gettime      256
-#define __NR_timer_getoverrun   257
-#define __NR_timer_delete       258
-#define __NR_clock_settime      259
-#define __NR_clock_gettime      260
-#define __NR_clock_getres       261
-#define __NR_clock_nanosleep    262
-/* Number 263 is reserved for vserver */
-#define __NR_statfs64           265
-#define __NR_fstatfs64          266
-#define __NR_remap_file_pages   267
-#define __NR_mbind              268
-#define __NR_get_mempolicy      269
-#define __NR_set_mempolicy      270
-#define __NR_mq_open            271
-#define __NR_mq_unlink          272
-#define __NR_mq_timedsend       273
-#define __NR_mq_timedreceive    274
-#define __NR_mq_notify          275
-#define __NR_mq_getsetattr      276
-#define __NR_kexec_load         277
-#define __NR_add_key            278
-#define __NR_request_key        279
-#define __NR_keyctl             280
-#define __NR_waitid             281
-#define __NR_ioprio_set         282
-#define __NR_ioprio_get         283
-#define __NR_inotify_init       284
-#define __NR_inotify_add_watch  285
-#define __NR_inotify_rm_watch   286
-#define __NR_migrate_pages      287
-#define __NR_openat             288
-#define __NR_mkdirat            289
-#define __NR_mknodat            290
-#define __NR_fchownat           291
-#define __NR_futimesat          292
-#define __NR_unlinkat           294
-#define __NR_renameat           295
-#define __NR_linkat             296
-#define __NR_symlinkat          297
-#define __NR_readlinkat         298
-#define __NR_fchmodat           299
-#define __NR_faccessat          300
-#define __NR_pselect6           301
-#define __NR_ppoll              302
-#define __NR_unshare            303
-#define __NR_set_robust_list    304
-#define __NR_get_robust_list    305
-#define __NR_splice             306
-#define __NR_sync_file_range    307
-#define __NR_tee                308
-#define __NR_vmsplice           309
-#define __NR_move_pages         310
-#define __NR_getcpu             311
-#define __NR_epoll_pwait        312
-#define __NR_utimes             313
-#define __NR_fallocate          314
-#define __NR_utimensat          315
-#define __NR_signalfd           316
-#define __NR_timerfd            317
-#define __NR_eventfd            318
-#define __NR_timerfd_create     319
-#define __NR_timerfd_settime    320
-#define __NR_timerfd_gettime    321
-#define __NR_signalfd4          322
-#define __NR_eventfd2           323
-#define __NR_inotify_init1      324
-#define __NR_pipe2              325
-#define __NR_dup3               326
-#define __NR_epoll_create1      327
-#define __NR_preadv             328
-#define __NR_pwritev            329
-#define __NR_rt_tgsigqueueinfo  330
-#define __NR_perf_event_open    331
-#define __NR_fanotify_init      332
-#define __NR_fanotify_mark      333
-#define __NR_prlimit64          334
-#define __NR_name_to_handle_at  335
-#define __NR_open_by_handle_at  336
-#define __NR_clock_adjtime      337
-#define __NR_syncfs             338
-#define __NR_setns              339
-#define __NR_process_vm_readv   340
-#define __NR_process_vm_writev  341
-#define __NR_s390_runtime_instr 342
-#define __NR_kcmp               343
-#define __NR_finit_module       344
-#define __NR_sched_setattr      345
-#define __NR_sched_getattr      346
-#define __NR_renameat2          347
-#define __NR_seccomp            348
-#define __NR_getrandom          349
-#define __NR_memfd_create       350
-#define __NR_bpf                351
-#define __NR_s390_pci_mmio_write        352
-#define __NR_s390_pci_mmio_read         353
-#define __NR_execveat           354
-#define __NR_userfaultfd        355
-#define __NR_membarrier         356
-#define __NR_recvmmsg           357
-#define __NR_sendmmsg           358
-#define __NR_socket             359
-#define __NR_socketpair         360
-#define __NR_bind               361
-#define __NR_connect            362
-#define __NR_listen             363
-#define __NR_accept4            364
-#define __NR_getsockopt         365
-#define __NR_setsockopt         366
-#define __NR_getsockname        367
-#define __NR_getpeername        368
-#define __NR_sendto             369
-#define __NR_sendmsg            370
-#define __NR_recvfrom           371
-#define __NR_recvmsg            372
-#define __NR_shutdown           373
-#define __NR_mlock2             374
-#define __NR_copy_file_range    375
-#define __NR_preadv2            376
-#define __NR_pwritev2           377
-#define __NR_s390_guarded_storage       378
-#define __NR_statx              379
-#define __NR_s390_sthyi         380
-#define NR_syscalls 381
-
-/* 
- * There are some system calls that are not present on 64 bit, some
- * have a different name although they do the same (e.g. __NR_chown32
- * is __NR_chown on 64 bit).
- */
-#ifndef __s390x__
-
-#define __NR_time                13
-#define __NR_lchown              16
-#define __NR_setuid              23
-#define __NR_getuid              24
-#define __NR_stime               25
-#define __NR_setgid              46
-#define __NR_getgid              47
-#define __NR_geteuid             49
-#define __NR_getegid             50
-#define __NR_setreuid            70
-#define __NR_setregid            71
-#define __NR_getrlimit           76
-#define __NR_getgroups           80
-#define __NR_setgroups           81
-#define __NR_fchown              95
-#define __NR_ioperm             101
-#define __NR_setfsuid           138
-#define __NR_setfsgid           139
-#define __NR__llseek            140
-#define __NR__newselect         142
-#define __NR_setresuid          164
-#define __NR_getresuid          165
-#define __NR_setresgid          170
-#define __NR_getresgid          171
-#define __NR_chown              182
-#define __NR_ugetrlimit         191     /* SuS compliant getrlimit */
-#define __NR_mmap2              192
-#define __NR_truncate64         193
-#define __NR_ftruncate64        194
-#define __NR_stat64             195
-#define __NR_lstat64            196
-#define __NR_fstat64            197
-#define __NR_lchown32           198
-#define __NR_getuid32           199
-#define __NR_getgid32           200
-#define __NR_geteuid32          201
-#define __NR_getegid32          202
-#define __NR_setreuid32         203
-#define __NR_setregid32         204
-#define __NR_getgroups32        205
-#define __NR_setgroups32        206
-#define __NR_fchown32           207
-#define __NR_setresuid32        208
-#define __NR_getresuid32        209
-#define __NR_setresgid32        210
-#define __NR_getresgid32        211
-#define __NR_chown32            212
-#define __NR_setuid32           213
-#define __NR_setgid32           214
-#define __NR_setfsuid32         215
-#define __NR_setfsgid32         216
-#define __NR_fcntl64            221
-#define __NR_sendfile64         223
-#define __NR_fadvise64_64       264
-#define __NR_fstatat64          293
-
-#else
-
-#define __NR_select             142
-#define __NR_getrlimit          191     /* SuS compliant getrlimit */
-#define __NR_lchown             198
-#define __NR_getuid             199
-#define __NR_getgid             200
-#define __NR_geteuid            201
-#define __NR_getegid            202
-#define __NR_setreuid           203
-#define __NR_setregid           204
-#define __NR_getgroups          205
-#define __NR_setgroups          206
-#define __NR_fchown             207
-#define __NR_setresuid          208
-#define __NR_getresuid          209
-#define __NR_setresgid          210
-#define __NR_getresgid          211
-#define __NR_chown              212
-#define __NR_setuid             213
-#define __NR_setgid             214
-#define __NR_setfsuid           215
-#define __NR_setfsgid           216
-#define __NR_newfstatat         293
-
-#endif
-
-#endif /* _UAPI_ASM_S390_UNISTD_H_ */
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 1d9199e1c2ad..0dfe4d3f74e2 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -210,6 +210,7 @@
 
 #define X86_FEATURE_MBA                 ( 7*32+18) /* Memory Bandwidth Allocation */
 #define X86_FEATURE_RSB_CTXSW           ( 7*32+19) /* "" Fill RSB on context switches */
+#define X86_FEATURE_SEV                 ( 7*32+20) /* AMD Secure Encrypted Virtualization */
 
 #define X86_FEATURE_USE_IBPB            ( 7*32+21) /* "" Indirect Branch Prediction Barrier enabled */
 
diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c
index 3a0396d87c42..185acfa229b5 100644
--- a/tools/bpf/bpftool/main.c
+++ b/tools/bpf/bpftool/main.c
@@ -244,7 +244,7 @@ static int do_batch(int argc, char **argv)
         }
 
         if (errno && errno != ENOENT) {
-                perror("reading batch file failed");
+                p_err("reading batch file failed: %s", strerror(errno));
                 err = -1;
         } else {
                 p_info("processed %d lines", lines);
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index e8e2baaf93c2..e549e329be82 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -774,6 +774,9 @@ static int do_dump(int argc, char **argv)
                               n < 0 ? strerror(errno) : "short write");
                         goto err_free;
                 }
+
+                if (json_output)
+                        jsonw_null(json_wtr);
         } else {
                 if (member_len == &info.jited_prog_len) {
                         const char *name = NULL;
diff --git a/tools/cgroup/Makefile b/tools/cgroup/Makefile
index 860fa151640a..ffca068e4a76 100644
--- a/tools/cgroup/Makefile
+++ b/tools/cgroup/Makefile
@@ -1,7 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 # Makefile for cgroup tools
 
-CC = $(CROSS_COMPILE)gcc
 CFLAGS = -Wall -Wextra
 
 all: cgroup_event_listener
diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile
index 805a2c0cf4cd..240eda014b37 100644
--- a/tools/gpio/Makefile
+++ b/tools/gpio/Makefile
@@ -12,8 +12,6 @@ endif
 # (this improves performance and avoids hard-to-debug behaviour);
 MAKEFLAGS += -r
 
-CC = $(CROSS_COMPILE)gcc
-LD = $(CROSS_COMPILE)ld
 CFLAGS += -O2 -Wall -g -D_GNU_SOURCE -I$(OUTPUT)include
 
 ALL_TARGETS := lsgpio gpio-hammer gpio-event-mon
diff --git a/tools/hv/Makefile b/tools/hv/Makefile
index 1139d71fa0cf..5db5e62cebda 100644
--- a/tools/hv/Makefile
+++ b/tools/hv/Makefile
@@ -1,7 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 # Makefile for Hyper-V tools
 
-CC = $(CROSS_COMPILE)gcc
 WARNINGS = -Wall -Wextra
 CFLAGS = $(WARNINGS) -g $(shell getconf LFS_CFLAGS)
 
diff --git a/tools/iio/Makefile b/tools/iio/Makefile
index a08e7a47d6a3..332ed2f6c2c2 100644
--- a/tools/iio/Makefile
+++ b/tools/iio/Makefile
@@ -12,8 +12,6 @@ endif
 # (this improves performance and avoids hard-to-debug behaviour);
 MAKEFLAGS += -r
 
-CC = $(CROSS_COMPILE)gcc
-LD = $(CROSS_COMPILE)ld
 CFLAGS += -O2 -Wall -g -D_GNU_SOURCE -I$(OUTPUT)include
 
 ALL_TARGETS := iio_event_monitor lsiio iio_generic_buffer
diff --git a/tools/include/uapi/drm/i915_drm.h b/tools/include/uapi/drm/i915_drm.h
index ac3c6503ca27..536ee4febd74 100644
--- a/tools/include/uapi/drm/i915_drm.h
+++ b/tools/include/uapi/drm/i915_drm.h
@@ -86,6 +86,62 @@ enum i915_mocs_table_index {
         I915_MOCS_CACHED,
 };
 
+/*
+ * Different engines serve different roles, and there may be more than one
+ * engine serving each role. enum drm_i915_gem_engine_class provides a
+ * classification of the role of the engine, which may be used when requesting
+ * operations to be performed on a certain subset of engines, or for providing
+ * information about that group.
+ */
+enum drm_i915_gem_engine_class {
+        I915_ENGINE_CLASS_RENDER        = 0,
+        I915_ENGINE_CLASS_COPY          = 1,
+        I915_ENGINE_CLASS_VIDEO         = 2,
+        I915_ENGINE_CLASS_VIDEO_ENHANCE = 3,
+
+        I915_ENGINE_CLASS_INVALID       = -1
+};
+
+/**
+ * DOC: perf_events exposed by i915 through /sys/bus/event_sources/drivers/i915
+ *
+ */
+
+enum drm_i915_pmu_engine_sample {
+        I915_SAMPLE_BUSY = 0,
+        I915_SAMPLE_WAIT = 1,
+        I915_SAMPLE_SEMA = 2
+};
+
+#define I915_PMU_SAMPLE_BITS (4)
+#define I915_PMU_SAMPLE_MASK (0xf)
+#define I915_PMU_SAMPLE_INSTANCE_BITS (8)
+#define I915_PMU_CLASS_SHIFT \
+        (I915_PMU_SAMPLE_BITS + I915_PMU_SAMPLE_INSTANCE_BITS)
+
+#define __I915_PMU_ENGINE(class, instance, sample) \
+        ((class) << I915_PMU_CLASS_SHIFT | \
+        (instance) << I915_PMU_SAMPLE_BITS | \
+        (sample))
+
+#define I915_PMU_ENGINE_BUSY(class, instance) \
+        __I915_PMU_ENGINE(class, instance, I915_SAMPLE_BUSY)
+
+#define I915_PMU_ENGINE_WAIT(class, instance) \
+        __I915_PMU_ENGINE(class, instance, I915_SAMPLE_WAIT)
+
+#define I915_PMU_ENGINE_SEMA(class, instance) \
+        __I915_PMU_ENGINE(class, instance, I915_SAMPLE_SEMA)
+
+#define __I915_PMU_OTHER(x) (__I915_PMU_ENGINE(0xff, 0xff, 0xf) + 1 + (x))
+
+#define I915_PMU_ACTUAL_FREQUENCY       __I915_PMU_OTHER(0)
+#define I915_PMU_REQUESTED_FREQUENCY    __I915_PMU_OTHER(1)
+#define I915_PMU_INTERRUPTS             __I915_PMU_OTHER(2)
+#define I915_PMU_RC6_RESIDENCY          __I915_PMU_OTHER(3)
+
+#define I915_PMU_LAST I915_PMU_RC6_RESIDENCY
+
 /* Each region is a minimum of 16k, and there are at most 255 of them.
  */
 #define I915_NR_TEX_REGIONS 255 /* table size 2k - maximum due to use
@@ -450,6 +506,27 @@ typedef struct drm_i915_irq_wait {
  */
 #define I915_PARAM_HAS_EXEC_FENCE_ARRAY  49
 
+/*
+ * Query whether every context (both per-file default and user created) is
+ * isolated (insofar as HW supports). If this parameter is not true, then
+ * freshly created contexts may inherit values from an existing context,
+ * rather than default HW values. If true, it also ensures (insofar as HW
+ * supports) that all state set by this context will not leak to any other
+ * context.
+ *
+ * As not every engine across every gen support contexts, the returned
+ * value reports the support of context isolation for individual engines by
+ * returning a bitmask of each engine class set to true if that class supports
+ * isolation.
+ */
+#define I915_PARAM_HAS_CONTEXT_ISOLATION 50
+
+/* Frequency of the command streamer timestamps given by the *_TIMESTAMP
+ * registers. This used to be fixed per platform but from CNL onwards, this
+ * might vary depending on the parts.
+ */
+#define I915_PARAM_CS_TIMESTAMP_FREQUENCY 51
+
 typedef struct drm_i915_getparam {
         __s32 param;
         /*
diff --git a/tools/include/uapi/linux/if_link.h b/tools/include/uapi/linux/if_link.h
index 8616131e2c61..6d9447700e18 100644
--- a/tools/include/uapi/linux/if_link.h
+++ b/tools/include/uapi/linux/if_link.h
@@ -163,6 +163,7 @@ enum {
         IFLA_IF_NETNSID,
         IFLA_CARRIER_UP_COUNT,
         IFLA_CARRIER_DOWN_COUNT,
+        IFLA_NEW_IFINDEX,
         __IFLA_MAX
 };
 
diff --git a/tools/include/uapi/linux/kvm.h b/tools/include/uapi/linux/kvm.h
index 8fb90a0819c3..0fb5ef939732 100644
--- a/tools/include/uapi/linux/kvm.h
+++ b/tools/include/uapi/linux/kvm.h
@@ -1362,6 +1362,96 @@ struct kvm_s390_ucas_mapping {
 /* Available with KVM_CAP_S390_CMMA_MIGRATION */
 #define KVM_S390_GET_CMMA_BITS      _IOWR(KVMIO, 0xb8, struct kvm_s390_cmma_log)
 #define KVM_S390_SET_CMMA_BITS      _IOW(KVMIO, 0xb9, struct kvm_s390_cmma_log)
+/* Memory Encryption Commands */
+#define KVM_MEMORY_ENCRYPT_OP      _IOWR(KVMIO, 0xba, unsigned long)
+
+struct kvm_enc_region {
+        __u64 addr;
+        __u64 size;
+};
+
+#define KVM_MEMORY_ENCRYPT_REG_REGION    _IOR(KVMIO, 0xbb, struct kvm_enc_region)
+#define KVM_MEMORY_ENCRYPT_UNREG_REGION  _IOR(KVMIO, 0xbc, struct kvm_enc_region)
+
+/* Secure Encrypted Virtualization command */
+enum sev_cmd_id {
+        /* Guest initialization commands */
+        KVM_SEV_INIT = 0,
+        KVM_SEV_ES_INIT,
+        /* Guest launch commands */
+        KVM_SEV_LAUNCH_START,
+        KVM_SEV_LAUNCH_UPDATE_DATA,
+        KVM_SEV_LAUNCH_UPDATE_VMSA,
+        KVM_SEV_LAUNCH_SECRET,
+        KVM_SEV_LAUNCH_MEASURE,
+        KVM_SEV_LAUNCH_FINISH,
+        /* Guest migration commands (outgoing) */
+        KVM_SEV_SEND_START,
+        KVM_SEV_SEND_UPDATE_DATA,
+        KVM_SEV_SEND_UPDATE_VMSA,
+        KVM_SEV_SEND_FINISH,
+        /* Guest migration commands (incoming) */
+        KVM_SEV_RECEIVE_START,
+        KVM_SEV_RECEIVE_UPDATE_DATA,
+        KVM_SEV_RECEIVE_UPDATE_VMSA,
+        KVM_SEV_RECEIVE_FINISH,
+        /* Guest status and debug commands */
+        KVM_SEV_GUEST_STATUS,
+        KVM_SEV_DBG_DECRYPT,
+        KVM_SEV_DBG_ENCRYPT,
+        /* Guest certificates commands */
+        KVM_SEV_CERT_EXPORT,
+
+        KVM_SEV_NR_MAX,
+};
+
+struct kvm_sev_cmd {
+        __u32 id;
+        __u64 data;
+        __u32 error;
+        __u32 sev_fd;
+};
+
+struct kvm_sev_launch_start {
+        __u32 handle;
+        __u32 policy;
+        __u64 dh_uaddr;
+        __u32 dh_len;
+        __u64 session_uaddr;
+        __u32 session_len;
+};
+
+struct kvm_sev_launch_update_data {
+        __u64 uaddr;
+        __u32 len;
+};
+
+
+struct kvm_sev_launch_secret {
+        __u64 hdr_uaddr;
+        __u32 hdr_len;
+        __u64 guest_uaddr;
+        __u32 guest_len;
+        __u64 trans_uaddr;
+        __u32 trans_len;
+};
+
+struct kvm_sev_launch_measure {
+        __u64 uaddr;
+        __u32 len;
+};
+
+struct kvm_sev_guest_status {
+        __u32 handle;
+        __u32 policy;
+        __u32 state;
+};
+
+struct kvm_sev_dbg {
+        __u64 src_uaddr;
+        __u64 dst_uaddr;
+        __u32 len;
+};
 
 #define KVM_DEV_ASSIGN_ENABLE_IOMMU     (1 << 0)
 #define KVM_DEV_ASSIGN_PCI_2_3          (1 << 1)
diff --git a/tools/laptop/freefall/Makefile b/tools/laptop/freefall/Makefile
index 5f758c489a20..b572d94255f6 100644
--- a/tools/laptop/freefall/Makefile
+++ b/tools/laptop/freefall/Makefile
@@ -2,7 +2,6 @@
 PREFIX ?= /usr
 SBINDIR ?= sbin
 INSTALL ?= install
-CC = $(CROSS_COMPILE)gcc
 
 TARGET = freefall
 
diff --git a/tools/leds/Makefile b/tools/leds/Makefile
index c379af003807..7b6bed13daaa 100644
--- a/tools/leds/Makefile
+++ b/tools/leds/Makefile
@@ -1,7 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 # Makefile for LEDs tools
 
-CC = $(CROSS_COMPILE)gcc
 CFLAGS = -Wall -Wextra -g -I../../include/uapi
 
 all: uledmon led_hw_brightness_mon
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 97073d649c1a..5bbbf285af74 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -1060,11 +1060,12 @@ bpf_program__reloc_text(struct bpf_program *prog, struct bpf_object *obj,
                 prog->insns = new_insn;
                 prog->main_prog_cnt = prog->insns_cnt;
                 prog->insns_cnt = new_cnt;
+                pr_debug("added %zd insn from %s to prog %s\n",
+                         text->insns_cnt, text->section_name,
+                         prog->section_name);
         }
         insn = &prog->insns[relo->insn_idx];
         insn->imm += prog->main_prog_cnt - relo->insn_idx;
-        pr_debug("added %zd insn from %s to prog %s\n",
-                 text->insns_cnt, text->section_name, prog->section_name);
         return 0;
 }
 
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index b00b1896547e..a8cb69a26576 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -852,8 +852,14 @@ static int add_switch_table(struct objtool_file *file, struct symbol *func,
  *    This is a fairly uncommon pattern which is new for GCC 6.  As of this
  *    writing, there are 11 occurrences of it in the allmodconfig kernel.
  *
+ *    As of GCC 7 there are quite a few more of these and the 'in between' code
+ *    is significant. Esp. with KASAN enabled some of the code between the mov
+ *    and jmpq uses .rodata itself, which can confuse things.
+ *
  *    TODO: Once we have DWARF CFI and smarter instruction decoding logic,
  *    ensure the same register is used in the mov and jump instructions.
+ *
+ *    NOTE: RETPOLINE made it harder still to decode dynamic jumps.
  */
 static struct rela *find_switch_table(struct objtool_file *file,
                                       struct symbol *func,
@@ -875,12 +881,25 @@ static struct rela *find_switch_table(struct objtool_file *file,
                                                 text_rela->addend + 4);
                 if (!rodata_rela)
                         return NULL;
+
                 file->ignore_unreachables = true;
                 return rodata_rela;
         }
 
         /* case 3 */
-        func_for_each_insn_continue_reverse(file, func, insn) {
+        /*
+         * Backward search using the @first_jump_src links, these help avoid
+         * much of the 'in between' code. Which avoids us getting confused by
+         * it.
+         */
+        for (insn = list_prev_entry(insn, list);
+
+             &insn->list != &file->insn_list &&
+             insn->sec == func->sec &&
+             insn->offset >= func->offset;
+
+             insn = insn->first_jump_src ?: list_prev_entry(insn, list)) {
+
                 if (insn->type == INSN_JUMP_DYNAMIC)
                         break;
 
@@ -910,14 +929,32 @@ static struct rela *find_switch_table(struct objtool_file *file,
         return NULL;
 }
 
+
 static int add_func_switch_tables(struct objtool_file *file,
                                   struct symbol *func)
 {
-        struct instruction *insn, *prev_jump = NULL;
+        struct instruction *insn, *last = NULL, *prev_jump = NULL;
         struct rela *rela, *prev_rela = NULL;
         int ret;
 
         func_for_each_insn(file, func, insn) {
+                if (!last)
+                        last = insn;
+
+                /*
+                 * Store back-pointers for unconditional forward jumps such
+                 * that find_switch_table() can back-track using those and
+                 * avoid some potentially confusing code.
+                 */
+                if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest &&
+                    insn->offset > last->offset &&
+                    insn->jump_dest->offset > insn->offset &&
+                    !insn->jump_dest->first_jump_src) {
+
+                        insn->jump_dest->first_jump_src = insn;
+                        last = insn->jump_dest;
+                }
+
                 if (insn->type != INSN_JUMP_DYNAMIC)
                         continue;
 
@@ -1899,13 +1936,19 @@ static bool ignore_unreachable_insn(struct instruction *insn)
                 if (is_kasan_insn(insn) || is_ubsan_insn(insn))
                         return true;
 
-                if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest) {
-                        insn = insn->jump_dest;
-                        continue;
+                if (insn->type == INSN_JUMP_UNCONDITIONAL) {
+                        if (insn->jump_dest &&
+                            insn->jump_dest->func == insn->func) {
+                                insn = insn->jump_dest;
+                                continue;
+                        }
+
+                        break;
                 }
 
                 if (insn->offset + insn->len >= insn->func->offset + insn->func->len)
                         break;
+
                 insn = list_next_entry(insn, list);
         }
 
diff --git a/tools/objtool/check.h b/tools/objtool/check.h
index dbadb304a410..23a1d065cae1 100644
--- a/tools/objtool/check.h
+++ b/tools/objtool/check.h
@@ -47,6 +47,7 @@ struct instruction {
         bool alt_group, visited, dead_end, ignore, hint, save, restore, ignore_alts;
         struct symbol *call_dest;
         struct instruction *jump_dest;
+        struct instruction *first_jump_src;
         struct list_head alts;
         struct symbol *func;
         struct stack_op stack_op;
diff --git a/tools/perf/Documentation/perf-data.txt b/tools/perf/Documentation/perf-data.txt
index f0796a47dfa3..90bb4aabe4f8 100644
--- a/tools/perf/Documentation/perf-data.txt
+++ b/tools/perf/Documentation/perf-data.txt
@@ -30,6 +30,10 @@ OPTIONS for 'convert'
 -i::
         Specify input perf data file path.
 
+-f::
+--force::
+        Don't complain, do it.
+
 -v::
 --verbose::
         Be more verbose (show counter open errors, etc).
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index 9b0351d3ce34..012328038594 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -146,12 +146,6 @@ define allow-override
     $(eval $(1) = $(2)))
 endef
 
-# Allow setting CC and AR and LD, or setting CROSS_COMPILE as a prefix.
-$(call allow-override,CC,$(CROSS_COMPILE)gcc)
-$(call allow-override,AR,$(CROSS_COMPILE)ar)
-$(call allow-override,LD,$(CROSS_COMPILE)ld)
-$(call allow-override,CXX,$(CROSS_COMPILE)g++)
-
 LD += $(EXTRA_LDFLAGS)
 
 HOSTCC  ?= gcc
diff --git a/tools/perf/arch/s390/Makefile b/tools/perf/arch/s390/Makefile
index 48228de415d0..dfa6e3103437 100644
--- a/tools/perf/arch/s390/Makefile
+++ b/tools/perf/arch/s390/Makefile
@@ -10,15 +10,19 @@ PERF_HAVE_ARCH_REGS_QUERY_REGISTER_OFFSET := 1
 
 out    := $(OUTPUT)arch/s390/include/generated/asm
 header := $(out)/syscalls_64.c
-sysdef := $(srctree)/tools/arch/s390/include/uapi/asm/unistd.h
-sysprf := $(srctree)/tools/perf/arch/s390/entry/syscalls/
+syskrn := $(srctree)/arch/s390/kernel/syscalls/syscall.tbl
+sysprf := $(srctree)/tools/perf/arch/s390/entry/syscalls
+sysdef := $(sysprf)/syscall.tbl
 systbl := $(sysprf)/mksyscalltbl
 
 # Create output directory if not already present
 _dummy := $(shell [ -d '$(out)' ] || mkdir -p '$(out)')
 
 $(header): $(sysdef) $(systbl)
-        $(Q)$(SHELL) '$(systbl)' '$(CC)' $(sysdef) > $@
+        @(test -d ../../kernel -a -d ../../tools -a -d ../perf && ( \
+        (diff -B $(sysdef) $(syskrn) >/dev/null) \
+        || echo "Warning: Kernel ABI header at '$(sysdef)' differs from latest version at '$(syskrn)'" >&2 )) || true
+        $(Q)$(SHELL) '$(systbl)' $(sysdef) > $@
 
 clean::
         $(call QUIET_CLEAN, s390) $(RM) $(header)
diff --git a/tools/perf/arch/s390/entry/syscalls/mksyscalltbl b/tools/perf/arch/s390/entry/syscalls/mksyscalltbl
index 7fa0d0abd419..72ecbb676370 100755
--- a/tools/perf/arch/s390/entry/syscalls/mksyscalltbl
+++ b/tools/perf/arch/s390/entry/syscalls/mksyscalltbl
@@ -3,25 +3,23 @@
 #
 # Generate system call table for perf
 #
-#
-# Copyright IBM Corp. 2017
+# Copyright IBM Corp. 2017, 2018
 # Author(s):  Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
 #
 
-gcc=$1
-input=$2
+SYSCALL_TBL=$1
 
-if ! test -r $input; then
+if ! test -r $SYSCALL_TBL; then
         echo "Could not read input file" >&2
         exit 1
 fi
 
 create_table()
 {
-        local max_nr
+        local max_nr nr abi sc discard
 
         echo 'static const char *syscalltbl_s390_64[] = {'
-        while read sc nr; do
+        while read nr abi sc discard; do
                 printf '\t[%d] = "%s",\n' $nr $sc
                 max_nr=$nr
         done
@@ -29,8 +27,6 @@ create_table()
         echo "#define SYSCALLTBL_S390_64_MAX_ID $max_nr"
 }
 
-
-$gcc -m64 -E -dM -x c  $input          \
-        |sed -ne 's/^#define __NR_//p' \
-        |sort -t' ' -k2 -nu            \
+grep -E "^[[:digit:]]+[[:space:]]+(common|64)" $SYSCALL_TBL     \
+        |sort -k1 -n                                    \
         |create_table
diff --git a/tools/perf/arch/s390/entry/syscalls/syscall.tbl b/tools/perf/arch/s390/entry/syscalls/syscall.tbl
new file mode 100644
index 000000000000..b38d48464368
--- /dev/null
+++ b/tools/perf/arch/s390/entry/syscalls/syscall.tbl
@@ -0,0 +1,390 @@
+# SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
+#
+# System call table for s390
+#
+# Format:
+#
+# <nr> <abi> <syscall> <entry-64bit> <compat-entry>
+#
+# where <abi> can be common, 64, or 32
+
+1    common     exit                    sys_exit                        sys_exit
+2    common     fork                    sys_fork                        sys_fork
+3    common     read                    sys_read                        compat_sys_s390_read
+4    common     write                   sys_write                       compat_sys_s390_write
+5    common     open                    sys_open                        compat_sys_open
+6    common     close                   sys_close                       sys_close
+7    common     restart_syscall         sys_restart_syscall             sys_restart_syscall
+8    common     creat                   sys_creat                       compat_sys_creat
+9    common     link                    sys_link                        compat_sys_link
+10   common     unlink                  sys_unlink                      compat_sys_unlink
+11   common     execve                  sys_execve                      compat_sys_execve
+12   common     chdir                   sys_chdir                       compat_sys_chdir
+13   32         time                    -                               compat_sys_time
+14   common     mknod                   sys_mknod                       compat_sys_mknod
+15   common     chmod                   sys_chmod                       compat_sys_chmod
+16   32         lchown                  -                               compat_sys_s390_lchown16
+19   common     lseek                   sys_lseek                       compat_sys_lseek
+20   common     getpid                  sys_getpid                      sys_getpid
+21   common     mount                   sys_mount                       compat_sys_mount
+22   common     umount                  sys_oldumount                   compat_sys_oldumount
+23   32         setuid                  -                               compat_sys_s390_setuid16
+24   32         getuid                  -                               compat_sys_s390_getuid16
+25   32         stime                   -                               compat_sys_stime
+26   common     ptrace                  sys_ptrace                      compat_sys_ptrace
+27   common     alarm                   sys_alarm                       sys_alarm
+29   common     pause                   sys_pause                       sys_pause
+30   common     utime                   sys_utime                       compat_sys_utime
+33   common     access                  sys_access                      compat_sys_access
+34   common     nice                    sys_nice                        sys_nice
+36   common     sync                    sys_sync                        sys_sync
+37   common     kill                    sys_kill                        sys_kill
+38   common     rename                  sys_rename                      compat_sys_rename
+39   common     mkdir                   sys_mkdir                       compat_sys_mkdir
+40   common     rmdir                   sys_rmdir                       compat_sys_rmdir
+41   common     dup                     sys_dup                         sys_dup
+42   common     pipe                    sys_pipe                        compat_sys_pipe
+43   common     times                   sys_times                       compat_sys_times
+45   common     brk                     sys_brk                         compat_sys_brk
+46   32         setgid                  -                               compat_sys_s390_setgid16
+47   32         getgid                  -                               compat_sys_s390_getgid16
+48   common     signal                  sys_signal                      compat_sys_signal
+49   32         geteuid                 -                               compat_sys_s390_geteuid16
+50   32         getegid                 -                               compat_sys_s390_getegid16
+51   common     acct                    sys_acct                        compat_sys_acct
+52   common     umount2                 sys_umount                      compat_sys_umount
+54   common     ioctl                   sys_ioctl                       compat_sys_ioctl
+55   common     fcntl                   sys_fcntl                       compat_sys_fcntl
+57   common     setpgid                 sys_setpgid                     sys_setpgid
+60   common     umask                   sys_umask                       sys_umask
+61   common     chroot                  sys_chroot                      compat_sys_chroot
+62   common     ustat                   sys_ustat                       compat_sys_ustat
+63   common     dup2                    sys_dup2                        sys_dup2
+64   common     getppid                 sys_getppid                     sys_getppid
+65   common     getpgrp                 sys_getpgrp                     sys_getpgrp
+66   common     setsid                  sys_setsid                      sys_setsid
+67   common     sigaction               sys_sigaction                   compat_sys_sigaction
+70   32         setreuid                -                               compat_sys_s390_setreuid16
+71   32         setregid                -                               compat_sys_s390_setregid16
+72   common     sigsuspend              sys_sigsuspend                  compat_sys_sigsuspend
+73   common     sigpending              sys_sigpending                  compat_sys_sigpending
+74   common     sethostname             sys_sethostname                 compat_sys_sethostname
+75   common     setrlimit               sys_setrlimit                   compat_sys_setrlimit
+76   32         getrlimit               -                               compat_sys_old_getrlimit
+77   common     getrusage               sys_getrusage                   compat_sys_getrusage
+78   common     gettimeofday            sys_gettimeofday                compat_sys_gettimeofday
+79   common     settimeofday            sys_settimeofday                compat_sys_settimeofday
+80   32         getgroups               -                               compat_sys_s390_getgroups16
+81   32         setgroups               -                               compat_sys_s390_setgroups16
+83   common     symlink                 sys_symlink                     compat_sys_symlink
+85   common     readlink                sys_readlink                    compat_sys_readlink
+86   common     uselib                  sys_uselib                      compat_sys_uselib
+87   common     swapon                  sys_swapon                      compat_sys_swapon
+88   common     reboot                  sys_reboot                      compat_sys_reboot
+89   common     readdir                 -                               compat_sys_old_readdir
+90   common     mmap                    sys_old_mmap                    compat_sys_s390_old_mmap
+91   common     munmap                  sys_munmap                      compat_sys_munmap
+92   common     truncate                sys_truncate                    compat_sys_truncate
+93   common     ftruncate               sys_ftruncate                   compat_sys_ftruncate
+94   common     fchmod                  sys_fchmod                      sys_fchmod
+95   32         fchown                  -                               compat_sys_s390_fchown16
+96   common     getpriority             sys_getpriority                 sys_getpriority
+97   common     setpriority             sys_setpriority                 sys_setpriority
+99   common     statfs                  sys_statfs                      compat_sys_statfs
+100  common     fstatfs                 sys_fstatfs                     compat_sys_fstatfs
+101  32         ioperm                  -                               -
+102  common     socketcall              sys_socketcall                  compat_sys_socketcall
+103  common     syslog                  sys_syslog                      compat_sys_syslog
+104  common     setitimer               sys_setitimer                   compat_sys_setitimer
+105  common     getitimer               sys_getitimer                   compat_sys_getitimer
+106  common     stat                    sys_newstat                     compat_sys_newstat
+107  common     lstat                   sys_newlstat                    compat_sys_newlstat
+108  common     fstat                   sys_newfstat                    compat_sys_newfstat
+110  common     lookup_dcookie          sys_lookup_dcookie              compat_sys_lookup_dcookie
+111  common     vhangup                 sys_vhangup                     sys_vhangup
+112  common     idle                    -                               -
+114  common     wait4                   sys_wait4                       compat_sys_wait4
+115  common     swapoff                 sys_swapoff                     compat_sys_swapoff
+116  common     sysinfo                 sys_sysinfo                     compat_sys_sysinfo
+117  common     ipc                     sys_s390_ipc                    compat_sys_s390_ipc
+118  common     fsync                   sys_fsync                       sys_fsync
+119  common     sigreturn               sys_sigreturn                   compat_sys_sigreturn
+120  common     clone                   sys_clone                       compat_sys_clone
+121  common     setdomainname           sys_setdomainname               compat_sys_setdomainname
+122  common     uname                   sys_newuname                    compat_sys_newuname
+124  common     adjtimex                sys_adjtimex                    compat_sys_adjtimex
+125  common     mprotect                sys_mprotect                    compat_sys_mprotect
+126  common     sigprocmask             sys_sigprocmask                 compat_sys_sigprocmask
+127  common     create_module           -                               -
+128  common     init_module             sys_init_module                 compat_sys_init_module
+129  common     delete_module           sys_delete_module               compat_sys_delete_module
+130  common     get_kernel_syms         -                               -
+131  common     quotactl                sys_quotactl                    compat_sys_quotactl
+132  common     getpgid                 sys_getpgid                     sys_getpgid
+133  common     fchdir                  sys_fchdir                      sys_fchdir
+134  common     bdflush                 sys_bdflush                     compat_sys_bdflush
+135  common     sysfs                   sys_sysfs                       compat_sys_sysfs
+136  common     personality             sys_s390_personality            sys_s390_personality
+137  common     afs_syscall             -                               -
+138  32         setfsuid                -                               compat_sys_s390_setfsuid16
+139  32         setfsgid                -                               compat_sys_s390_setfsgid16
+140  32         _llseek                 -                               compat_sys_llseek
+141  common     getdents                sys_getdents                    compat_sys_getdents
+142  32         _newselect              -                               compat_sys_select
+142  64         select                  sys_select                      -
+143  common     flock                   sys_flock                       sys_flock
+144  common     msync                   sys_msync                       compat_sys_msync
+145  common     readv                   sys_readv                       compat_sys_readv
+146  common     writev                  sys_writev                      compat_sys_writev
+147  common     getsid                  sys_getsid                      sys_getsid
+148  common     fdatasync               sys_fdatasync                   sys_fdatasync
+149  common     _sysctl                 sys_sysctl                      compat_sys_sysctl
+150  common     mlock                   sys_mlock                       compat_sys_mlock
+151  common     munlock                 sys_munlock                     compat_sys_munlock
+152  common     mlockall                sys_mlockall                    sys_mlockall
+153  common     munlockall              sys_munlockall                  sys_munlockall
+154  common     sched_setparam          sys_sched_setparam              compat_sys_sched_setparam
+155  common     sched_getparam          sys_sched_getparam              compat_sys_sched_getparam
+156  common     sched_setscheduler      sys_sched_setscheduler          compat_sys_sched_setscheduler
+157  common     sched_getscheduler      sys_sched_getscheduler          sys_sched_getscheduler
+158  common     sched_yield             sys_sched_yield                 sys_sched_yield
+159  common     sched_get_priority_max  sys_sched_get_priority_max      sys_sched_get_priority_max
+160  common     sched_get_priority_min  sys_sched_get_priority_min      sys_sched_get_priority_min
+161  common     sched_rr_get_interval   sys_sched_rr_get_interval       compat_sys_sched_rr_get_interval
+162  common     nanosleep               sys_nanosleep                   compat_sys_nanosleep
+163  common     mremap                  sys_mremap                      compat_sys_mremap
+164  32         setresuid               -                               compat_sys_s390_setresuid16
+165  32         getresuid               -                               compat_sys_s390_getresuid16
+167  common     query_module            -                               -
+168  common     poll                    sys_poll                        compat_sys_poll
+169  common     nfsservctl              -                               -
+170  32         setresgid               -                               compat_sys_s390_setresgid16
+171  32         getresgid               -                               compat_sys_s390_getresgid16
+172  common     prctl                   sys_prctl                       compat_sys_prctl
+173  common     rt_sigreturn            sys_rt_sigreturn                compat_sys_rt_sigreturn
+174  common     rt_sigaction            sys_rt_sigaction                compat_sys_rt_sigaction
+175  common     rt_sigprocmask          sys_rt_sigprocmask              compat_sys_rt_sigprocmask
+176  common     rt_sigpending           sys_rt_sigpending               compat_sys_rt_sigpending
+177  common     rt_sigtimedwait         sys_rt_sigtimedwait             compat_sys_rt_sigtimedwait
+178  common     rt_sigqueueinfo         sys_rt_sigqueueinfo             compat_sys_rt_sigqueueinfo
+179  common     rt_sigsuspend           sys_rt_sigsuspend               compat_sys_rt_sigsuspend
+180  common     pread64                 sys_pread64                     compat_sys_s390_pread64
+181  common     pwrite64                sys_pwrite64                    compat_sys_s390_pwrite64
+182  32         chown                   -                               compat_sys_s390_chown16
+183  common     getcwd                  sys_getcwd                      compat_sys_getcwd
+184  common     capget                  sys_capget                      compat_sys_capget
+185  common     capset                  sys_capset                      compat_sys_capset
+186  common     sigaltstack             sys_sigaltstack                 compat_sys_sigaltstack
+187  common     sendfile                sys_sendfile64                  compat_sys_sendfile
+188  common     getpmsg                 -                               -
+189  common     putpmsg                 -                               -
+190  common     vfork                   sys_vfork                       sys_vfork
+191  32         ugetrlimit              -                               compat_sys_getrlimit
+191  64         getrlimit               sys_getrlimit                   -
+192  32         mmap2                   -                               compat_sys_s390_mmap2
+193  32         truncate64              -                               compat_sys_s390_truncate64
+194  32         ftruncate64             -                               compat_sys_s390_ftruncate64
+195  32         stat64                  -                               compat_sys_s390_stat64
+196  32         lstat64                 -                               compat_sys_s390_lstat64
+197  32         fstat64                 -                               compat_sys_s390_fstat64
+198  32         lchown32                -                               compat_sys_lchown
+198  64         lchown                  sys_lchown                      -
+199  32         getuid32                -                               sys_getuid
+199  64         getuid                  sys_getuid                      -
+200  32         getgid32                -                               sys_getgid
+200  64         getgid                  sys_getgid                      -
+201  32         geteuid32               -                               sys_geteuid
+201  64         geteuid                 sys_geteuid                     -
+202  32         getegid32               -                               sys_getegid
+202  64         getegid                 sys_getegid                     -
+203  32         setreuid32              -                               sys_setreuid
+203  64         setreuid                sys_setreuid                    -
+204  32         setregid32              -                               sys_setregid
+204  64         setregid                sys_setregid                    -
+205  32         getgroups32             -                               compat_sys_getgroups
+205  64         getgroups               sys_getgroups                   -
+206  32         setgroups32             -                               compat_sys_setgroups
+206  64         setgroups               sys_setgroups                   -
+207  32         fchown32                -                               sys_fchown
+207  64         fchown                  sys_fchown                      -
+208  32         setresuid32             -                               sys_setresuid
+208  64         setresuid               sys_setresuid                   -
+209  32         getresuid32             -                               compat_sys_getresuid
+209  64         getresuid               sys_getresuid                   -
+210  32         setresgid32             -                               sys_setresgid
+210  64         setresgid               sys_setresgid                   -
+211  32         getresgid32             -                               compat_sys_getresgid
+211  64         getresgid               sys_getresgid                   -
+212  32         chown32                 -                               compat_sys_chown
+212  64         chown                   sys_chown                       -
+213  32         setuid32                -                               sys_setuid
+213  64         setuid                  sys_setuid                      -
+214  32         setgid32                -                               sys_setgid
+214  64         setgid                  sys_setgid                      -
+215  32         setfsuid32              -                               sys_setfsuid
+215  64         setfsuid                sys_setfsuid                    -
+216  32         setfsgid32              -                               sys_setfsgid
+216  64         setfsgid                sys_setfsgid                    -
+217  common     pivot_root              sys_pivot_root                  compat_sys_pivot_root
+218  common     mincore                 sys_mincore                     compat_sys_mincore
+219  common     madvise                 sys_madvise                     compat_sys_madvise
+220  common     getdents64              sys_getdents64                  compat_sys_getdents64
+221  32         fcntl64                 -                               compat_sys_fcntl64
+222  common     readahead               sys_readahead                   compat_sys_s390_readahead
+223  32         sendfile64              -                               compat_sys_sendfile64
+224  common     setxattr                sys_setxattr                    compat_sys_setxattr
+225  common     lsetxattr               sys_lsetxattr                   compat_sys_lsetxattr
+226  common     fsetxattr               sys_fsetxattr                   compat_sys_fsetxattr
+227  common     getxattr                sys_getxattr                    compat_sys_getxattr
+228  common     lgetxattr               sys_lgetxattr                   compat_sys_lgetxattr
+229  common     fgetxattr               sys_fgetxattr                   compat_sys_fgetxattr
+230  common     listxattr               sys_listxattr                   compat_sys_listxattr
+231  common     llistxattr              sys_llistxattr                  compat_sys_llistxattr
+232  common     flistxattr              sys_flistxattr                  compat_sys_flistxattr
+233  common     removexattr             sys_removexattr                 compat_sys_removexattr
+234  common     lremovexattr            sys_lremovexattr                compat_sys_lremovexattr
+235  common     fremovexattr            sys_fremovexattr                compat_sys_fremovexattr
+236  common     gettid                  sys_gettid                      sys_gettid
+237  common     tkill                   sys_tkill                       sys_tkill
+238  common     futex                   sys_futex                       compat_sys_futex
+239  common     sched_setaffinity       sys_sched_setaffinity           compat_sys_sched_setaffinity
+240  common     sched_getaffinity       sys_sched_getaffinity           compat_sys_sched_getaffinity
+241  common     tgkill                  sys_tgkill                      sys_tgkill
+243  common     io_setup                sys_io_setup                    compat_sys_io_setup
+244  common     io_destroy              sys_io_destroy                  compat_sys_io_destroy
+245  common     io_getevents            sys_io_getevents                compat_sys_io_getevents
+246  common     io_submit               sys_io_submit                   compat_sys_io_submit
+247  common     io_cancel               sys_io_cancel                   compat_sys_io_cancel
+248  common     exit_group              sys_exit_group                  sys_exit_group
+249  common     epoll_create            sys_epoll_create                sys_epoll_create
+250  common     epoll_ctl               sys_epoll_ctl                   compat_sys_epoll_ctl
+251  common     epoll_wait              sys_epoll_wait                  compat_sys_epoll_wait
+252  common     set_tid_address         sys_set_tid_address             compat_sys_set_tid_address
+253  common     fadvise64               sys_fadvise64_64                compat_sys_s390_fadvise64
+254  common     timer_create            sys_timer_create                compat_sys_timer_create
+255  common     timer_settime           sys_timer_settime               compat_sys_timer_settime
+256  common     timer_gettime           sys_timer_gettime               compat_sys_timer_gettime
+257  common     timer_getoverrun        sys_timer_getoverrun            sys_timer_getoverrun
+258  common     timer_delete            sys_timer_delete                sys_timer_delete
+259  common     clock_settime           sys_clock_settime               compat_sys_clock_settime
+260  common     clock_gettime           sys_clock_gettime               compat_sys_clock_gettime
+261  common     clock_getres            sys_clock_getres                compat_sys_clock_getres
+262  common     clock_nanosleep         sys_clock_nanosleep             compat_sys_clock_nanosleep
+264  32         fadvise64_64            -                               compat_sys_s390_fadvise64_64
+265  common     statfs64                sys_statfs64                    compat_sys_statfs64
+266  common     fstatfs64               sys_fstatfs64                   compat_sys_fstatfs64
+267  common     remap_file_pages        sys_remap_file_pages            compat_sys_remap_file_pages
+268  common     mbind                   sys_mbind                       compat_sys_mbind
+269  common     get_mempolicy           sys_get_mempolicy               compat_sys_get_mempolicy
+270  common     set_mempolicy           sys_set_mempolicy               compat_sys_set_mempolicy
+271  common     mq_open                 sys_mq_open                     compat_sys_mq_open
+272  common     mq_unlink               sys_mq_unlink                   compat_sys_mq_unlink
+273  common     mq_timedsend            sys_mq_timedsend                compat_sys_mq_timedsend
+274  common     mq_timedreceive         sys_mq_timedreceive             compat_sys_mq_timedreceive
+275  common     mq_notify               sys_mq_notify                   compat_sys_mq_notify
+276  common     mq_getsetattr           sys_mq_getsetattr               compat_sys_mq_getsetattr
+277  common     kexec_load              sys_kexec_load                  compat_sys_kexec_load
+278  common     add_key                 sys_add_key                     compat_sys_add_key
+279  common     request_key             sys_request_key                 compat_sys_request_key
+280  common     keyctl                  sys_keyctl                      compat_sys_keyctl
+281  common     waitid                  sys_waitid                      compat_sys_waitid
+282  common     ioprio_set              sys_ioprio_set                  sys_ioprio_set
+283  common     ioprio_get              sys_ioprio_get                  sys_ioprio_get
+284  common     inotify_init            sys_inotify_init                sys_inotify_init
+285  common     inotify_add_watch       sys_inotify_add_watch           compat_sys_inotify_add_watch
+286  common     inotify_rm_watch        sys_inotify_rm_watch            sys_inotify_rm_watch
+287  common     migrate_pages           sys_migrate_pages               compat_sys_migrate_pages
+288  common     openat                  sys_openat                      compat_sys_openat
+289  common     mkdirat                 sys_mkdirat                     compat_sys_mkdirat
+290  common     mknodat                 sys_mknodat                     compat_sys_mknodat
+291  common     fchownat                sys_fchownat                    compat_sys_fchownat
+292  common     futimesat               sys_futimesat                   compat_sys_futimesat
+293  32         fstatat64               -                               compat_sys_s390_fstatat64
+293  64         newfstatat              sys_newfstatat                  -
+294  common     unlinkat                sys_unlinkat                    compat_sys_unlinkat
+295  common     renameat                sys_renameat                    compat_sys_renameat
+296  common     linkat                  sys_linkat                      compat_sys_linkat
+297  common     symlinkat               sys_symlinkat                   compat_sys_symlinkat
+298  common     readlinkat              sys_readlinkat                  compat_sys_readlinkat
+299  common     fchmodat                sys_fchmodat                    compat_sys_fchmodat
+300  common     faccessat               sys_faccessat                   compat_sys_faccessat
+301  common     pselect6                sys_pselect6                    compat_sys_pselect6
+302  common     ppoll                   sys_ppoll                       compat_sys_ppoll
+303  common     unshare                 sys_unshare                     compat_sys_unshare
+304  common     set_robust_list         sys_set_robust_list             compat_sys_set_robust_list
+305  common     get_robust_list         sys_get_robust_list             compat_sys_get_robust_list
+306  common     splice                  sys_splice                      compat_sys_splice
+307  common     sync_file_range         sys_sync_file_range             compat_sys_s390_sync_file_range
+308  common     tee                     sys_tee                         compat_sys_tee
+309  common     vmsplice                sys_vmsplice                    compat_sys_vmsplice
+310  common     move_pages              sys_move_pages                  compat_sys_move_pages
+311  common     getcpu                  sys_getcpu                      compat_sys_getcpu
+312  common     epoll_pwait             sys_epoll_pwait                 compat_sys_epoll_pwait
+313  common     utimes                  sys_utimes                      compat_sys_utimes
+314  common     fallocate               sys_fallocate                   compat_sys_s390_fallocate
+315  common     utimensat               sys_utimensat                   compat_sys_utimensat
+316  common     signalfd                sys_signalfd                    compat_sys_signalfd
+317  common     timerfd                 -                               -
+318  common     eventfd                 sys_eventfd                     sys_eventfd
+319  common     timerfd_create          sys_timerfd_create              sys_timerfd_create
+320  common     timerfd_settime         sys_timerfd_settime             compat_sys_timerfd_settime
+321  common     timerfd_gettime         sys_timerfd_gettime             compat_sys_timerfd_gettime
+322  common     signalfd4               sys_signalfd4                   compat_sys_signalfd4
+323  common     eventfd2                sys_eventfd2                    sys_eventfd2
+324  common     inotify_init1           sys_inotify_init1               sys_inotify_init1
+325  common     pipe2                   sys_pipe2                       compat_sys_pipe2
+326  common     dup3                    sys_dup3                        sys_dup3
+327  common     epoll_create1           sys_epoll_create1               sys_epoll_create1
+328  common     preadv                  sys_preadv                      compat_sys_preadv
+329  common     pwritev                 sys_pwritev                     compat_sys_pwritev
+330  common     rt_tgsigqueueinfo       sys_rt_tgsigqueueinfo           compat_sys_rt_tgsigqueueinfo
+331  common     perf_event_open         sys_perf_event_open             compat_sys_perf_event_open
+332  common     fanotify_init           sys_fanotify_init               sys_fanotify_init
+333  common     fanotify_mark           sys_fanotify_mark               compat_sys_fanotify_mark
+334  common     prlimit64               sys_prlimit64                   compat_sys_prlimit64
+335  common     name_to_handle_at       sys_name_to_handle_at           compat_sys_name_to_handle_at
+336  common     open_by_handle_at       sys_open_by_handle_at           compat_sys_open_by_handle_at
+337  common     clock_adjtime           sys_clock_adjtime               compat_sys_clock_adjtime
+338  common     syncfs                  sys_syncfs                      sys_syncfs
+339  common     setns                   sys_setns                       sys_setns
+340  common     process_vm_readv        sys_process_vm_readv            compat_sys_process_vm_readv
+341  common     process_vm_writev       sys_process_vm_writev           compat_sys_process_vm_writev
+342  common     s390_runtime_instr      sys_s390_runtime_instr          sys_s390_runtime_instr
+343  common     kcmp                    sys_kcmp                        compat_sys_kcmp
+344  common     finit_module            sys_finit_module                compat_sys_finit_module
+345  common     sched_setattr           sys_sched_setattr               compat_sys_sched_setattr
+346  common     sched_getattr           sys_sched_getattr               compat_sys_sched_getattr
+347  common     renameat2               sys_renameat2                   compat_sys_renameat2
+348  common     seccomp                 sys_seccomp                     compat_sys_seccomp
+349  common     getrandom               sys_getrandom                   compat_sys_getrandom
+350  common     memfd_create            sys_memfd_create                compat_sys_memfd_create
+351  common     bpf                     sys_bpf                         compat_sys_bpf
+352  common     s390_pci_mmio_write     sys_s390_pci_mmio_write         compat_sys_s390_pci_mmio_write
+353  common     s390_pci_mmio_read      sys_s390_pci_mmio_read          compat_sys_s390_pci_mmio_read
+354  common     execveat                sys_execveat                    compat_sys_execveat
+355  common     userfaultfd             sys_userfaultfd                 sys_userfaultfd
+356  common     membarrier              sys_membarrier                  sys_membarrier
+357  common     recvmmsg                sys_recvmmsg                    compat_sys_recvmmsg
+358  common     sendmmsg                sys_sendmmsg                    compat_sys_sendmmsg
+359  common     socket                  sys_socket                      sys_socket
+360  common     socketpair              sys_socketpair                  compat_sys_socketpair
+361  common     bind                    sys_bind                        compat_sys_bind
+362  common     connect                 sys_connect                     compat_sys_connect
+363  common     listen                  sys_listen                      sys_listen
+364  common     accept4                 sys_accept4                     compat_sys_accept4
+365  common     getsockopt              sys_getsockopt                  compat_sys_getsockopt
+366  common     setsockopt              sys_setsockopt                  compat_sys_setsockopt
+367  common     getsockname             sys_getsockname                 compat_sys_getsockname
+368  common     getpeername             sys_getpeername                 compat_sys_getpeername
+369  common     sendto                  sys_sendto                      compat_sys_sendto
+370  common     sendmsg                 sys_sendmsg                     compat_sys_sendmsg
+371  common     recvfrom                sys_recvfrom                    compat_sys_recvfrom
+372  common     recvmsg                 sys_recvmsg                     compat_sys_recvmsg
+373  common     shutdown                sys_shutdown                    sys_shutdown
+374  common     mlock2                  sys_mlock2                      compat_sys_mlock2
+375  common     copy_file_range         sys_copy_file_range             compat_sys_copy_file_range
+376  common     preadv2                 sys_preadv2                     compat_sys_preadv2
+377  common     pwritev2                sys_pwritev2                    compat_sys_pwritev2
+378  common     s390_guarded_storage    sys_s390_guarded_storage        compat_sys_s390_guarded_storage
+379  common     statx                   sys_statx                       compat_sys_statx
+380  common     s390_sthyi              sys_s390_sthyi                  compat_sys_s390_sthyi
diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
index c0815a37fdb5..539c3d460158 100644
--- a/tools/perf/builtin-c2c.c
+++ b/tools/perf/builtin-c2c.c
@@ -2245,7 +2245,7 @@ static int perf_c2c__browse_cacheline(struct hist_entry *he)
         c2c_browser__update_nr_entries(browser);
 
         while (1) {
-                key = hist_browser__run(browser, "? - help");
+                key = hist_browser__run(browser, "? - help", true);
 
                 switch (key) {
                 case 's':
@@ -2314,7 +2314,7 @@ static int perf_c2c__hists_browse(struct hists *hists)
         c2c_browser__update_nr_entries(browser);
 
         while (1) {
-                key = hist_browser__run(browser, "? - help");
+                key = hist_browser__run(browser, "? - help", true);
 
                 switch (key) {
                 case 'q':
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 42a52dcc41cd..4ad5dc649716 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -530,7 +530,8 @@ static int report__browse_hists(struct report *rep)
         case 1:
                 ret = perf_evlist__tui_browse_hists(evlist, help, NULL,
                                                     rep->min_percent,
-                                                    &session->header.env);
+                                                    &session->header.env,
+                                                    true);
                 /*
                  * Usually "ret" is the last pressed key, and we only
                  * care if the key notifies us to switch data file.
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index c6ccda52117d..b7c823ba8374 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -283,8 +283,9 @@ static void perf_top__print_sym_table(struct perf_top *top)
 
         printf("%-*.*s\n", win_width, win_width, graph_dotted_line);
 
-        if (hists->stats.nr_lost_warned !=
-            hists->stats.nr_events[PERF_RECORD_LOST]) {
+        if (!top->record_opts.overwrite &&
+            (hists->stats.nr_lost_warned !=
+            hists->stats.nr_events[PERF_RECORD_LOST])) {
                 hists->stats.nr_lost_warned =
                               hists->stats.nr_events[PERF_RECORD_LOST];
                 color_fprintf(stdout, PERF_COLOR_RED,
@@ -611,7 +612,8 @@ static void *display_thread_tui(void *arg)
 
         perf_evlist__tui_browse_hists(top->evlist, help, &hbt,
                                       top->min_percent,
-                                      &top->session->header.env);
+                                      &top->session->header.env,
+                                      !top->record_opts.overwrite);
 
         done = 1;
         return NULL;
@@ -807,15 +809,23 @@ static void perf_event__process_sample(struct perf_tool *tool,
 
 static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
 {
+        struct record_opts *opts = &top->record_opts;
+        struct perf_evlist *evlist = top->evlist;
         struct perf_sample sample;
         struct perf_evsel *evsel;
+        struct perf_mmap *md;
         struct perf_session *session = top->session;
         union perf_event *event;
         struct machine *machine;
+        u64 end, start;
         int ret;
 
-        while ((event = perf_evlist__mmap_read(top->evlist, idx)) != NULL) {
-                ret = perf_evlist__parse_sample(top->evlist, event, &sample);
+        md = opts->overwrite ? &evlist->overwrite_mmap[idx] : &evlist->mmap[idx];
+        if (perf_mmap__read_init(md, opts->overwrite, &start, &end) < 0)
+                return;
+
+        while ((event = perf_mmap__read_event(md, opts->overwrite, &start, end)) != NULL) {
+                ret = perf_evlist__parse_sample(evlist, event, &sample);
                 if (ret) {
                         pr_err("Can't parse sample, err = %d\n", ret);
                         goto next_event;
@@ -869,16 +879,120 @@ static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
                 } else
                         ++session->evlist->stats.nr_unknown_events;
 next_event:
-                perf_evlist__mmap_consume(top->evlist, idx);
+                perf_mmap__consume(md, opts->overwrite);
         }
+
+        perf_mmap__read_done(md);
 }
 
 static void perf_top__mmap_read(struct perf_top *top)
 {
+        bool overwrite = top->record_opts.overwrite;
+        struct perf_evlist *evlist = top->evlist;
+        unsigned long long start, end;
         int i;
 
+        start = rdclock();
+        if (overwrite)
+                perf_evlist__toggle_bkw_mmap(evlist, BKW_MMAP_DATA_PENDING);
+
         for (i = 0; i < top->evlist->nr_mmaps; i++)
                 perf_top__mmap_read_idx(top, i);
+
+        if (overwrite) {
+                perf_evlist__toggle_bkw_mmap(evlist, BKW_MMAP_EMPTY);
+                perf_evlist__toggle_bkw_mmap(evlist, BKW_MMAP_RUNNING);
+        }
+        end = rdclock();
+
+        if ((end - start) > (unsigned long long)top->delay_secs * NSEC_PER_SEC)
+                ui__warning("Too slow to read ring buffer.\n"
+                            "Please try increasing the period (-c) or\n"
+                            "decreasing the freq (-F) or\n"
+                            "limiting the number of CPUs (-C)\n");
+}
+
+/*
+ * Check per-event overwrite term.
+ * perf top should support consistent term for all events.
+ * - All events don't have per-event term
+ *   E.g. "cpu/cpu-cycles/,cpu/instructions/"
+ *   Nothing change, return 0.
+ * - All events have same per-event term
+ *   E.g. "cpu/cpu-cycles,no-overwrite/,cpu/instructions,no-overwrite/
+ *   Using the per-event setting to replace the opts->overwrite if
+ *   they are different, then return 0.
+ * - Events have different per-event term
+ *   E.g. "cpu/cpu-cycles,overwrite/,cpu/instructions,no-overwrite/"
+ *   Return -1
+ * - Some of the event set per-event term, but some not.
+ *   E.g. "cpu/cpu-cycles/,cpu/instructions,no-overwrite/"
+ *   Return -1
+ */
+static int perf_top__overwrite_check(struct perf_top *top)
+{
+        struct record_opts *opts = &top->record_opts;
+        struct perf_evlist *evlist = top->evlist;
+        struct perf_evsel_config_term *term;
+        struct list_head *config_terms;
+        struct perf_evsel *evsel;
+        int set, overwrite = -1;
+
+        evlist__for_each_entry(evlist, evsel) {
+                set = -1;
+                config_terms = &evsel->config_terms;
+                list_for_each_entry(term, config_terms, list) {
+                        if (term->type == PERF_EVSEL__CONFIG_TERM_OVERWRITE)
+                                set = term->val.overwrite ? 1 : 0;
+                }
+
+                /* no term for current and previous event (likely) */
+                if ((overwrite < 0) && (set < 0))
+                        continue;
+
+                /* has term for both current and previous event, compare */
+                if ((overwrite >= 0) && (set >= 0) && (overwrite != set))
+                        return -1;
+
+                /* no term for current event but has term for previous one */
+                if ((overwrite >= 0) && (set < 0))
+                        return -1;
+
+                /* has term for current event */
+                if ((overwrite < 0) && (set >= 0)) {
+                        /* if it's first event, set overwrite */
+                        if (evsel == perf_evlist__first(evlist))
+                                overwrite = set;
+                        else
+                                return -1;
+                }
+        }
+
+        if ((overwrite >= 0) && (opts->overwrite != overwrite))
+                opts->overwrite = overwrite;
+
+        return 0;
+}
+
+static int perf_top_overwrite_fallback(struct perf_top *top,
+                                       struct perf_evsel *evsel)
+{
+        struct record_opts *opts = &top->record_opts;
+        struct perf_evlist *evlist = top->evlist;
+        struct perf_evsel *counter;
+
+        if (!opts->overwrite)
+                return 0;
+
+        /* only fall back when first event fails */
+        if (evsel != perf_evlist__first(evlist))
+                return 0;
+
+        evlist__for_each_entry(evlist, counter)
+                counter->attr.write_backward = false;
+        opts->overwrite = false;
+        ui__warning("fall back to non-overwrite mode\n");
+        return 1;
 }
 
 static int perf_top__start_counters(struct perf_top *top)
@@ -888,12 +1002,33 @@ static int perf_top__start_counters(struct perf_top *top)
         struct perf_evlist *evlist = top->evlist;
         struct record_opts *opts = &top->record_opts;
 
+        if (perf_top__overwrite_check(top)) {
+                ui__error("perf top only support consistent per-event "
+                          "overwrite setting for all events\n");
+                goto out_err;
+        }
+
         perf_evlist__config(evlist, opts, &callchain_param);
 
         evlist__for_each_entry(evlist, counter) {
 try_again:
                 if (perf_evsel__open(counter, top->evlist->cpus,
                                      top->evlist->threads) < 0) {
+
+                        /*
+                         * Specially handle overwrite fall back.
+                         * Because perf top is the only tool which has
+                         * overwrite mode by default, support
+                         * both overwrite and non-overwrite mode, and
+                         * require consistent mode for all events.
+                         *
+                         * May move it to generic code with more tools
+                         * have similar attribute.
+                         */
+                        if (perf_missing_features.write_backward &&
+                            perf_top_overwrite_fallback(top, counter))
+                                goto try_again;
+
                         if (perf_evsel__fallback(counter, errno, msg, sizeof(msg))) {
                                 if (verbose > 0)
                                         ui__warning("%s\n", msg);
@@ -1033,7 +1168,7 @@ static int __cmd_top(struct perf_top *top)
 
                 perf_top__mmap_read(top);
 
-                if (hits == top->samples)
+                if (opts->overwrite || (hits == top->samples))
                         ret = perf_evlist__poll(top->evlist, 100);
 
                 if (resize) {
@@ -1127,6 +1262,7 @@ int cmd_top(int argc, const char **argv)
                                 .uses_mmap   = true,
                         },
                         .proc_map_timeout    = 500,
+                        .overwrite      = 1,
                 },
                 .max_stack           = sysctl_perf_event_max_stack,
                 .sym_pcnt_filter     = 5,
diff --git a/tools/perf/check-headers.sh b/tools/perf/check-headers.sh
index 51abdb0a4047..790ec25919a0 100755
--- a/tools/perf/check-headers.sh
+++ b/tools/perf/check-headers.sh
@@ -33,7 +33,6 @@ arch/s390/include/uapi/asm/kvm.h
 arch/s390/include/uapi/asm/kvm_perf.h
 arch/s390/include/uapi/asm/ptrace.h
 arch/s390/include/uapi/asm/sie.h
-arch/s390/include/uapi/asm/unistd.h
 arch/arm/include/uapi/asm/kvm.h
 arch/arm64/include/uapi/asm/kvm.h
 arch/alpha/include/uapi/asm/errno.h
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/branch.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/branch.json
new file mode 100644
index 000000000000..3b6208763e50
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/branch.json
@@ -0,0 +1,27 @@
+[
+  {,
+    "EventCode": "0x7A",
+    "EventName": "BR_INDIRECT_SPEC",
+    "BriefDescription": "Branch speculatively executed - Indirect branch"
+  },
+  {,
+    "EventCode": "0xC9",
+    "EventName": "BR_COND",
+    "BriefDescription": "Conditional branch executed"
+  },
+  {,
+    "EventCode": "0xCA",
+    "EventName": "BR_INDIRECT_MISPRED",
+    "BriefDescription": "Indirect branch mispredicted"
+  },
+  {,
+    "EventCode": "0xCB",
+    "EventName": "BR_INDIRECT_MISPRED_ADDR",
+    "BriefDescription": "Indirect branch mispredicted because of address miscompare"
+  },
+  {,
+    "EventCode": "0xCC",
+    "EventName": "BR_COND_MISPRED",
+    "BriefDescription": "Conditional branch mispredicted"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/bus.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/bus.json
new file mode 100644
index 000000000000..480d9f7460ab
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/bus.json
@@ -0,0 +1,22 @@
+[
+  {,
+    "EventCode": "0x60",
+    "EventName": "BUS_ACCESS_LD",
+    "BriefDescription": "Bus access - Read"
+  },
+  {,
+    "EventCode": "0x61",
+    "EventName": "BUS_ACCESS_ST",
+    "BriefDescription": "Bus access - Write"
+  },
+  {,
+    "EventCode": "0xC0",
+    "EventName": "EXT_MEM_REQ",
+    "BriefDescription": "External memory request"
+  },
+  {,
+    "EventCode": "0xC1",
+    "EventName": "EXT_MEM_REQ_NC",
+    "BriefDescription": "Non-cacheable external memory request"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/cache.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/cache.json
new file mode 100644
index 000000000000..11baad6344b9
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/cache.json
@@ -0,0 +1,27 @@
+[
+  {,
+    "EventCode": "0xC2",
+    "EventName": "PREFETCH_LINEFILL",
+    "BriefDescription": "Linefill because of prefetch"
+  },
+  {,
+    "EventCode": "0xC3",
+    "EventName": "PREFETCH_LINEFILL_DROP",
+    "BriefDescription": "Instruction Cache Throttle occurred"
+  },
+  {,
+    "EventCode": "0xC4",
+    "EventName": "READ_ALLOC_ENTER",
+    "BriefDescription": "Entering read allocate mode"
+  },
+  {,
+    "EventCode": "0xC5",
+    "EventName": "READ_ALLOC",
+    "BriefDescription": "Read allocate mode"
+  },
+  {,
+    "EventCode": "0xC8",
+    "EventName": "EXT_SNOOP",
+    "BriefDescription": "SCU Snooped data from another CPU for this CPU"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/memory.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/memory.json
new file mode 100644
index 000000000000..480d9f7460ab
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/memory.json
@@ -0,0 +1,22 @@
+[
+  {,
+    "EventCode": "0x60",
+    "EventName": "BUS_ACCESS_LD",
+    "BriefDescription": "Bus access - Read"
+  },
+  {,
+    "EventCode": "0x61",
+    "EventName": "BUS_ACCESS_ST",
+    "BriefDescription": "Bus access - Write"
+  },
+  {,
+    "EventCode": "0xC0",
+    "EventName": "EXT_MEM_REQ",
+    "BriefDescription": "External memory request"
+  },
+  {,
+    "EventCode": "0xC1",
+    "EventName": "EXT_MEM_REQ_NC",
+    "BriefDescription": "Non-cacheable external memory request"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/other.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/other.json
new file mode 100644
index 000000000000..73a22402d003
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/other.json
@@ -0,0 +1,32 @@
+[
+  {,
+    "EventCode": "0x86",
+    "EventName": "EXC_IRQ",
+    "BriefDescription": "Exception taken, IRQ"
+  },
+  {,
+    "EventCode": "0x87",
+    "EventName": "EXC_FIQ",
+    "BriefDescription": "Exception taken, FIQ"
+  },
+  {,
+    "EventCode": "0xC6",
+    "EventName": "PRE_DECODE_ERR",
+    "BriefDescription": "Pre-decode error"
+  },
+  {,
+    "EventCode": "0xD0",
+    "EventName": "L1I_CACHE_ERR",
+    "BriefDescription": "L1 Instruction Cache (data or tag) memory error"
+  },
+  {,
+    "EventCode": "0xD1",
+    "EventName": "L1D_CACHE_ERR",
+    "BriefDescription": "L1 Data Cache (data, tag or dirty) memory error, correctable or non-correctable"
+  },
+  {,
+    "EventCode": "0xD2",
+    "EventName": "TLB_ERR",
+    "BriefDescription": "TLB memory error"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/pipeline.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/pipeline.json
new file mode 100644
index 000000000000..3149fb90555a
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/pipeline.json
@@ -0,0 +1,52 @@
+[
+  {,
+    "EventCode": "0xC7",
+    "EventName": "STALL_SB_FULL",
+    "BriefDescription": "Data Write operation that stalls the pipeline because the store buffer is full"
+  },
+  {,
+    "EventCode": "0xE0",
+    "EventName": "OTHER_IQ_DEP_STALL",
+    "BriefDescription": "Cycles that the DPU IQ is empty and that is not because of a recent micro-TLB miss, instruction cache miss or pre-decode error"
+  },
+  {,
+    "EventCode": "0xE1",
+    "EventName": "IC_DEP_STALL",
+    "BriefDescription": "Cycles the DPU IQ is empty and there is an instruction cache miss being processed"
+  },
+  {,
+    "EventCode": "0xE2",
+    "EventName": "IUTLB_DEP_STALL",
+    "BriefDescription": "Cycles the DPU IQ is empty and there is an instruction micro-TLB miss being processed"
+  },
+  {,
+    "EventCode": "0xE3",
+    "EventName": "DECODE_DEP_STALL",
+    "BriefDescription": "Cycles the DPU IQ is empty and there is a pre-decode error being processed"
+  },
+  {,
+    "EventCode": "0xE4",
+    "EventName": "OTHER_INTERLOCK_STALL",
+    "BriefDescription": "Cycles there is an interlock other than  Advanced SIMD/Floating-point instructions or load/store instruction"
+  },
+  {,
+    "EventCode": "0xE5",
+    "EventName": "AGU_DEP_STALL",
+    "BriefDescription": "Cycles there is an interlock for a load/store instruction waiting for data to calculate the address in the AGU"
+  },
+  {,
+    "EventCode": "0xE6",
+    "EventName": "SIMD_DEP_STALL",
+    "BriefDescription": "Cycles there is an interlock for an Advanced SIMD/Floating-point operation."
+  },
+  {,
+    "EventCode": "0xE7",
+    "EventName": "LD_DEP_STALL",
+    "BriefDescription": "Cycles there is a stall in the Wr stage because of a load miss"
+  },
+  {,
+    "EventCode": "0xE8",
+    "EventName": "ST_DEP_STALL",
+    "BriefDescription": "Cycles there is a stall in the Wr stage because of a store"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/mapfile.csv b/tools/perf/pmu-events/arch/arm64/mapfile.csv
index 219d6756134e..e61c9ca6cf9e 100644
--- a/tools/perf/pmu-events/arch/arm64/mapfile.csv
+++ b/tools/perf/pmu-events/arch/arm64/mapfile.csv
@@ -13,3 +13,4 @@
 #
 #Family-model,Version,Filename,EventType
 0x00000000420f5160,v1,cavium,core
+0x00000000410fd03[[:xdigit:]],v1,cortex-a53,core
diff --git a/tools/perf/tests/backward-ring-buffer.c b/tools/perf/tests/backward-ring-buffer.c
index 4035d43523c3..e0b1b414d466 100644
--- a/tools/perf/tests/backward-ring-buffer.c
+++ b/tools/perf/tests/backward-ring-buffer.c
@@ -31,10 +31,12 @@ static int count_samples(struct perf_evlist *evlist, int *sample_count,
         int i;
 
         for (i = 0; i < evlist->nr_mmaps; i++) {
+                struct perf_mmap *map = &evlist->overwrite_mmap[i];
                 union perf_event *event;
+                u64 start, end;
 
-                perf_mmap__read_catchup(&evlist->overwrite_mmap[i]);
-                while ((event = perf_mmap__read_backward(&evlist->overwrite_mmap[i])) != NULL) {
+                perf_mmap__read_init(map, true, &start, &end);
+                while ((event = perf_mmap__read_event(map, true, &start, end)) != NULL) {
                         const u32 type = event->header.type;
 
                         switch (type) {
@@ -49,6 +51,7 @@ static int count_samples(struct perf_evlist *evlist, int *sample_count,
                                 return TEST_FAIL;
                         }
                 }
+                perf_mmap__read_done(map);
         }
         return TEST_OK;
 }
diff --git a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
index 8b3da21a08f1..c446c894b297 100755
--- a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
+++ b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
@@ -22,10 +22,23 @@ trace_libc_inet_pton_backtrace() {
         expected[4]="rtt min.*"
         expected[5]="[0-9]+\.[0-9]+[[:space:]]+probe_libc:inet_pton:\([[:xdigit:]]+\)"
         expected[6]=".*inet_pton[[:space:]]\($libc\)$"
-        expected[7]="getaddrinfo[[:space:]]\($libc\)$"
-        expected[8]=".*\(.*/bin/ping.*\)$"
-
-        perf trace --no-syscalls -e probe_libc:inet_pton/max-stack=3/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do
+        case "$(uname -m)" in
+        s390x)
+                eventattr='call-graph=dwarf'
+                expected[7]="gaih_inet[[:space:]]\(inlined\)$"
+                expected[8]="__GI_getaddrinfo[[:space:]]\(inlined\)$"
+                expected[9]="main[[:space:]]\(.*/bin/ping.*\)$"
+                expected[10]="__libc_start_main[[:space:]]\($libc\)$"
+                expected[11]="_start[[:space:]]\(.*/bin/ping.*\)$"
+                ;;
+        *)
+                eventattr='max-stack=3'
+                expected[7]="getaddrinfo[[:space:]]\($libc\)$"
+                expected[8]=".*\(.*/bin/ping.*\)$"
+                ;;
+        esac
+
+        perf trace --no-syscalls -e probe_libc:inet_pton/$eventattr/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do
                 echo $line
                 echo "$line" | egrep -q "${expected[$idx]}"
                 if [ $? -ne 0 ] ; then
@@ -33,7 +46,7 @@ trace_libc_inet_pton_backtrace() {
                         exit 1
                 fi
                 let idx+=1
-                [ $idx -eq 9 ] && break
+                [ -z "${expected[$idx]}" ] && break
         done
 }
 
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index 68146f4620a5..6495ee55d9c3 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -608,7 +608,8 @@ static int hist_browser__title(struct hist_browser *browser, char *bf, size_t si
         return browser->title ? browser->title(browser, bf, size) : 0;
 }
 
-int hist_browser__run(struct hist_browser *browser, const char *help)
+int hist_browser__run(struct hist_browser *browser, const char *help,
+                      bool warn_lost_event)
 {
         int key;
         char title[160];
@@ -638,8 +639,9 @@ int hist_browser__run(struct hist_browser *browser, const char *help)
                         nr_entries = hist_browser__nr_entries(browser);
                         ui_browser__update_nr_entries(&browser->b, nr_entries);
 
-                        if (browser->hists->stats.nr_lost_warned !=
-                            browser->hists->stats.nr_events[PERF_RECORD_LOST]) {
+                        if (warn_lost_event &&
+                            (browser->hists->stats.nr_lost_warned !=
+                            browser->hists->stats.nr_events[PERF_RECORD_LOST])) {
                                 browser->hists->stats.nr_lost_warned =
                                         browser->hists->stats.nr_events[PERF_RECORD_LOST];
                                 ui_browser__warn_lost_events(&browser->b);
@@ -2763,7 +2765,8 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                                     bool left_exits,
                                     struct hist_browser_timer *hbt,
                                     float min_pcnt,
-                                    struct perf_env *env)
+                                    struct perf_env *env,
+                                    bool warn_lost_event)
 {
         struct hists *hists = evsel__hists(evsel);
         struct hist_browser *browser = perf_evsel_browser__new(evsel, hbt, env);
@@ -2844,7 +2847,8 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
 
                 nr_options = 0;
 
-                key = hist_browser__run(browser, helpline);
+                key = hist_browser__run(browser, helpline,
+                                        warn_lost_event);
 
                 if (browser->he_selection != NULL) {
                         thread = hist_browser__selected_thread(browser);
@@ -3184,7 +3188,8 @@ static void perf_evsel_menu__write(struct ui_browser *browser,
 
 static int perf_evsel_menu__run(struct perf_evsel_menu *menu,
                                 int nr_events, const char *help,
-                                struct hist_browser_timer *hbt)
+                                struct hist_browser_timer *hbt,
+                                bool warn_lost_event)
 {
         struct perf_evlist *evlist = menu->b.priv;
         struct perf_evsel *pos;
@@ -3203,7 +3208,9 @@ static int perf_evsel_menu__run(struct perf_evsel_menu *menu,
                 case K_TIMER:
                         hbt->timer(hbt->arg);
 
-                        if (!menu->lost_events_warned && menu->lost_events) {
+                        if (!menu->lost_events_warned &&
+                            menu->lost_events &&
+                            warn_lost_event) {
                                 ui_browser__warn_lost_events(&menu->b);
                                 menu->lost_events_warned = true;
                         }
@@ -3224,7 +3231,8 @@ browse_hists:
                         key = perf_evsel__hists_browse(pos, nr_events, help,
                                                        true, hbt,
                                                        menu->min_pcnt,
-                                                       menu->env);
+                                                       menu->env,
+                                                       warn_lost_event);
                         ui_browser__show_title(&menu->b, title);
                         switch (key) {
                         case K_TAB:
@@ -3282,7 +3290,8 @@ static int __perf_evlist__tui_browse_hists(struct perf_evlist *evlist,
                                            int nr_entries, const char *help,
                                            struct hist_browser_timer *hbt,
                                            float min_pcnt,
-                                           struct perf_env *env)
+                                           struct perf_env *env,
+                                           bool warn_lost_event)
 {
         struct perf_evsel *pos;
         struct perf_evsel_menu menu = {
@@ -3309,13 +3318,15 @@ static int __perf_evlist__tui_browse_hists(struct perf_evlist *evlist,
                         menu.b.width = line_len;
         }
 
-        return perf_evsel_menu__run(&menu, nr_entries, help, hbt);
+        return perf_evsel_menu__run(&menu, nr_entries, help,
+                                    hbt, warn_lost_event);
 }
 
 int perf_evlist__tui_browse_hists(struct perf_evlist *evlist, const char *help,
                                   struct hist_browser_timer *hbt,
                                   float min_pcnt,
-                                  struct perf_env *env)
+                                  struct perf_env *env,
+                                  bool warn_lost_event)
 {
         int nr_entries = evlist->nr_entries;
 
@@ -3325,7 +3336,7 @@ single_entry:
 
                 return perf_evsel__hists_browse(first, nr_entries, help,
                                                 false, hbt, min_pcnt,
-                                                env);
+                                                env, warn_lost_event);
         }
 
         if (symbol_conf.event_group) {
@@ -3342,5 +3353,6 @@ single_entry:
         }
 
         return __perf_evlist__tui_browse_hists(evlist, nr_entries, help,
-                                               hbt, min_pcnt, env);
+                                               hbt, min_pcnt, env,
+                                               warn_lost_event);
 }
diff --git a/tools/perf/ui/browsers/hists.h b/tools/perf/ui/browsers/hists.h
index ba431777f559..9428bee076f2 100644
--- a/tools/perf/ui/browsers/hists.h
+++ b/tools/perf/ui/browsers/hists.h
@@ -28,7 +28,8 @@ struct hist_browser {
 
 struct hist_browser *hist_browser__new(struct hists *hists);
 void hist_browser__delete(struct hist_browser *browser);
-int hist_browser__run(struct hist_browser *browser, const char *help);
+int hist_browser__run(struct hist_browser *browser, const char *help,
+                      bool warn_lost_event);
 void hist_browser__init(struct hist_browser *browser,
                         struct hists *hists);
 #endif /* _PERF_UI_BROWSER_HISTS_H_ */
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index ac35cd214feb..e5fc14e53c05 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -715,28 +715,11 @@ union perf_event *perf_evlist__mmap_read_forward(struct perf_evlist *evlist, int
         return perf_mmap__read_forward(md);
 }
 
-union perf_event *perf_evlist__mmap_read_backward(struct perf_evlist *evlist, int idx)
-{
-        struct perf_mmap *md = &evlist->mmap[idx];
-
-        /*
-         * No need to check messup for backward ring buffer:
-         * We can always read arbitrary long data from a backward
-         * ring buffer unless we forget to pause it before reading.
-         */
-        return perf_mmap__read_backward(md);
-}
-
 union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx)
 {
         return perf_evlist__mmap_read_forward(evlist, idx);
 }
 
-void perf_evlist__mmap_read_catchup(struct perf_evlist *evlist, int idx)
-{
-        perf_mmap__read_catchup(&evlist->mmap[idx]);
-}
-
 void perf_evlist__mmap_consume(struct perf_evlist *evlist, int idx)
 {
         perf_mmap__consume(&evlist->mmap[idx], false);
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index 75f8e0ad5d76..336b838e6957 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -133,10 +133,6 @@ union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx);
 
 union perf_event *perf_evlist__mmap_read_forward(struct perf_evlist *evlist,
                                                  int idx);
-union perf_event *perf_evlist__mmap_read_backward(struct perf_evlist *evlist,
-                                                  int idx);
-void perf_evlist__mmap_read_catchup(struct perf_evlist *evlist, int idx);
-
 void perf_evlist__mmap_consume(struct perf_evlist *evlist, int idx);
 
 int perf_evlist__open(struct perf_evlist *evlist);
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index ff359c9ece2e..ef351688b797 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -41,17 +41,7 @@
 
 #include "sane_ctype.h"
 
-static struct {
-        bool sample_id_all;
-        bool exclude_guest;
-        bool mmap2;
-        bool cloexec;
-        bool clockid;
-        bool clockid_wrong;
-        bool lbr_flags;
-        bool write_backward;
-        bool group_read;
-} perf_missing_features;
+struct perf_missing_features perf_missing_features;
 
 static clockid_t clockid;
 
diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
index 846e41644525..a7487c6d1866 100644
--- a/tools/perf/util/evsel.h
+++ b/tools/perf/util/evsel.h
@@ -149,6 +149,20 @@ union u64_swap {
         u32 val32[2];
 };
 
+struct perf_missing_features {
+        bool sample_id_all;
+        bool exclude_guest;
+        bool mmap2;
+        bool cloexec;
+        bool clockid;
+        bool clockid_wrong;
+        bool lbr_flags;
+        bool write_backward;
+        bool group_read;
+};
+
+extern struct perf_missing_features perf_missing_features;
+
 struct cpu_map;
 struct target;
 struct thread_map;
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index f6630cb95eff..02721b579746 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -430,7 +430,8 @@ int hist_entry__tui_annotate(struct hist_entry *he, struct perf_evsel *evsel,
 int perf_evlist__tui_browse_hists(struct perf_evlist *evlist, const char *help,
                                   struct hist_browser_timer *hbt,
                                   float min_pcnt,
-                                  struct perf_env *env);
+                                  struct perf_env *env,
+                                  bool warn_lost_event);
 int script_browse(const char *script_opt);
 #else
 static inline
@@ -438,7 +439,8 @@ int perf_evlist__tui_browse_hists(struct perf_evlist *evlist __maybe_unused,
                                   const char *help __maybe_unused,
                                   struct hist_browser_timer *hbt __maybe_unused,
                                   float min_pcnt __maybe_unused,
-                                  struct perf_env *env __maybe_unused)
+                                  struct perf_env *env __maybe_unused,
+                                  bool warn_lost_event __maybe_unused)
 {
         return 0;
 }
diff --git a/tools/perf/util/mmap.c b/tools/perf/util/mmap.c
index 05076e683938..91531a7c8fbf 100644
--- a/tools/perf/util/mmap.c
+++ b/tools/perf/util/mmap.c
@@ -22,29 +22,27 @@ size_t perf_mmap__mmap_len(struct perf_mmap *map)
 
 /* When check_messup is true, 'end' must points to a good entry */
 static union perf_event *perf_mmap__read(struct perf_mmap *map,
-                                         u64 start, u64 end, u64 *prev)
+                                         u64 *startp, u64 end)
 {
         unsigned char *data = map->base + page_size;
         union perf_event *event = NULL;
-        int diff = end - start;
+        int diff = end - *startp;
 
         if (diff >= (int)sizeof(event->header)) {
                 size_t size;
 
-                event = (union perf_event *)&data[start & map->mask];
+                event = (union perf_event *)&data[*startp & map->mask];
                 size = event->header.size;
 
-                if (size < sizeof(event->header) || diff < (int)size) {
-                        event = NULL;
-                        goto broken_event;
-                }
+                if (size < sizeof(event->header) || diff < (int)size)
+                        return NULL;
 
                 /*
                  * Event straddles the mmap boundary -- header should always
                  * be inside due to u64 alignment of output.
                  */
-                if ((start & map->mask) + size != ((start + size) & map->mask)) {
-                        unsigned int offset = start;
+                if ((*startp & map->mask) + size != ((*startp + size) & map->mask)) {
+                        unsigned int offset = *startp;
                         unsigned int len = min(sizeof(*event), size), cpy;
                         void *dst = map->event_copy;
 
@@ -59,20 +57,19 @@ static union perf_event *perf_mmap__read(struct perf_mmap *map,
                         event = (union perf_event *)map->event_copy;
                 }
 
-                start += size;
+                *startp += size;
         }
 
-broken_event:
-        if (prev)
-                *prev = start;
-
         return event;
 }
 
+/*
+ * legacy interface for mmap read.
+ * Don't use it. Use perf_mmap__read_event().
+ */
 union perf_event *perf_mmap__read_forward(struct perf_mmap *map)
 {
         u64 head;
-        u64 old = map->prev;
 
         /*
          * Check if event was unmapped due to a POLLHUP/POLLERR.
@@ -82,13 +79,26 @@ union perf_event *perf_mmap__read_forward(struct perf_mmap *map)
 
         head = perf_mmap__read_head(map);
 
-        return perf_mmap__read(map, old, head, &map->prev);
+        return perf_mmap__read(map, &map->prev, head);
 }
 
-union perf_event *perf_mmap__read_backward(struct perf_mmap *map)
+/*
+ * Read event from ring buffer one by one.
+ * Return one event for each call.
+ *
+ * Usage:
+ * perf_mmap__read_init()
+ * while(event = perf_mmap__read_event()) {
+ *      //process the event
+ *      perf_mmap__consume()
+ * }
+ * perf_mmap__read_done()
+ */
+union perf_event *perf_mmap__read_event(struct perf_mmap *map,
+                                        bool overwrite,
+                                        u64 *startp, u64 end)
 {
-        u64 head, end;
-        u64 start = map->prev;
+        union perf_event *event;
 
         /*
          * Check if event was unmapped due to a POLLHUP/POLLERR.
@@ -96,40 +106,19 @@ union perf_event *perf_mmap__read_backward(struct perf_mmap *map)
         if (!refcount_read(&map->refcnt))
                 return NULL;
 
-        head = perf_mmap__read_head(map);
-        if (!head)
+        if (startp == NULL)
                 return NULL;
 
-        /*
-         * 'head' pointer starts from 0. Kernel minus sizeof(record) form
-         * it each time when kernel writes to it, so in fact 'head' is
-         * negative. 'end' pointer is made manually by adding the size of
-         * the ring buffer to 'head' pointer, means the validate data can
-         * read is the whole ring buffer. If 'end' is positive, the ring
-         * buffer has not fully filled, so we must adjust 'end' to 0.
-         *
-         * However, since both 'head' and 'end' is unsigned, we can't
-         * simply compare 'end' against 0. Here we compare '-head' and
-         * the size of the ring buffer, where -head is the number of bytes
-         * kernel write to the ring buffer.
-         */
-        if (-head < (u64)(map->mask + 1))
-                end = 0;
-        else
-                end = head + map->mask + 1;
-
-        return perf_mmap__read(map, start, end, &map->prev);
-}
+        /* non-overwirte doesn't pause the ringbuffer */
+        if (!overwrite)
+                end = perf_mmap__read_head(map);
 
-void perf_mmap__read_catchup(struct perf_mmap *map)
-{
-        u64 head;
+        event = perf_mmap__read(map, startp, end);
 
-        if (!refcount_read(&map->refcnt))
-                return;
+        if (!overwrite)
+                map->prev = *startp;
 
-        head = perf_mmap__read_head(map);
-        map->prev = head;
+        return event;
 }
 
 static bool perf_mmap__empty(struct perf_mmap *map)
@@ -267,41 +256,60 @@ static int overwrite_rb_find_range(void *buf, int mask, u64 head, u64 *start, u6
         return -1;
 }
 
-int perf_mmap__push(struct perf_mmap *md, bool overwrite,
-                    void *to, int push(void *to, void *buf, size_t size))
+/*
+ * Report the start and end of the available data in ringbuffer
+ */
+int perf_mmap__read_init(struct perf_mmap *md, bool overwrite,
+                         u64 *startp, u64 *endp)
 {
         u64 head = perf_mmap__read_head(md);
         u64 old = md->prev;
-        u64 end = head, start = old;
         unsigned char *data = md->base + page_size;
         unsigned long size;
-        void *buf;
-        int rc = 0;
 
-        start = overwrite ? head : old;
-        end = overwrite ? old : head;
+        *startp = overwrite ? head : old;
+        *endp = overwrite ? old : head;
 
-        if (start == end)
-                return 0;
+        if (*startp == *endp)
+                return -EAGAIN;
 
-        size = end - start;
+        size = *endp - *startp;
         if (size > (unsigned long)(md->mask) + 1) {
                 if (!overwrite) {
                         WARN_ONCE(1, "failed to keep up with mmap data. (warn only once)\n");
 
                         md->prev = head;
                         perf_mmap__consume(md, overwrite);
-                        return 0;
+                        return -EAGAIN;
                 }
 
                 /*
                  * Backward ring buffer is full. We still have a chance to read
                  * most of data from it.
                  */
-                if (overwrite_rb_find_range(data, md->mask, head, &start, &end))
-                        return -1;
+                if (overwrite_rb_find_range(data, md->mask, head, startp, endp))
+                        return -EINVAL;
         }
 
+        return 0;
+}
+
+int perf_mmap__push(struct perf_mmap *md, bool overwrite,
+                    void *to, int push(void *to, void *buf, size_t size))
+{
+        u64 head = perf_mmap__read_head(md);
+        u64 end, start;
+        unsigned char *data = md->base + page_size;
+        unsigned long size;
+        void *buf;
+        int rc = 0;
+
+        rc = perf_mmap__read_init(md, overwrite, &start, &end);
+        if (rc < 0)
+                return (rc == -EAGAIN) ? 0 : -1;
+
+        size = end - start;
+
         if ((start & md->mask) + size != (end & md->mask)) {
                 buf = &data[start & md->mask];
                 size = md->mask + 1 - (start & md->mask);
@@ -327,3 +335,14 @@ int perf_mmap__push(struct perf_mmap *md, bool overwrite,
 out:
         return rc;
 }
+
+/*
+ * Mandatory for overwrite mode
+ * The direction of overwrite mode is backward.
+ * The last perf_mmap__read() will set tail to map->prev.
+ * Need to correct the map->prev to head which is the end of next read.
+ */
+void perf_mmap__read_done(struct perf_mmap *map)
+{
+        map->prev = perf_mmap__read_head(map);
+}
diff --git a/tools/perf/util/mmap.h b/tools/perf/util/mmap.h
index e43d7b55a55f..ec7d3a24e276 100644
--- a/tools/perf/util/mmap.h
+++ b/tools/perf/util/mmap.h
@@ -65,8 +65,6 @@ void perf_mmap__put(struct perf_mmap *map);
 
 void perf_mmap__consume(struct perf_mmap *map, bool overwrite);
 
-void perf_mmap__read_catchup(struct perf_mmap *md);
-
 static inline u64 perf_mmap__read_head(struct perf_mmap *mm)
 {
         struct perf_event_mmap_page *pc = mm->base;
@@ -87,11 +85,17 @@ static inline void perf_mmap__write_tail(struct perf_mmap *md, u64 tail)
 }
 
 union perf_event *perf_mmap__read_forward(struct perf_mmap *map);
-union perf_event *perf_mmap__read_backward(struct perf_mmap *map);
+
+union perf_event *perf_mmap__read_event(struct perf_mmap *map,
+                                        bool overwrite,
+                                        u64 *startp, u64 end);
 
 int perf_mmap__push(struct perf_mmap *md, bool backward,
                     void *to, int push(void *to, void *buf, size_t size));
 
 size_t perf_mmap__mmap_len(struct perf_mmap *map);
 
+int perf_mmap__read_init(struct perf_mmap *md, bool overwrite,
+                         u64 *startp, u64 *endp);
+void perf_mmap__read_done(struct perf_mmap *map);
 #endif /*__PERF_MMAP_H */
diff --git a/tools/perf/util/util.c b/tools/perf/util/util.c
index 443892dabedb..1019bbc5dbd8 100644
--- a/tools/perf/util/util.c
+++ b/tools/perf/util/util.c
@@ -340,35 +340,15 @@ size_t hex_width(u64 v)
         return n;
 }
 
-static int hex(char ch)
-{
-        if ((ch >= '0') && (ch <= '9'))
-                return ch - '0';
-        if ((ch >= 'a') && (ch <= 'f'))
-                return ch - 'a' + 10;
-        if ((ch >= 'A') && (ch <= 'F'))
-                return ch - 'A' + 10;
-        return -1;
-}
-
 /*
  * While we find nice hex chars, build a long_val.
  * Return number of chars processed.
  */
 int hex2u64(const char *ptr, u64 *long_val)
 {
-        const char *p = ptr;
-        *long_val = 0;
-
-        while (*p) {
-                const int hex_val = hex(*p);
+        char *p;
 
-                if (hex_val < 0)
-                        break;
-
-                *long_val = (*long_val << 4) | hex_val;
-                p++;
-        }
+        *long_val = strtoull(ptr, &p, 16);
 
         return p - ptr;
 }
diff --git a/tools/power/acpi/Makefile.config b/tools/power/acpi/Makefile.config
index a1883bbb0144..2cccbba64418 100644
--- a/tools/power/acpi/Makefile.config
+++ b/tools/power/acpi/Makefile.config
@@ -56,9 +56,6 @@ INSTALL_SCRIPT = ${INSTALL_PROGRAM}
 # to compile vs uClibc, that can be done here as well.
 CROSS = #/usr/i386-linux-uclibc/usr/bin/i386-uclibc-
 CROSS_COMPILE ?= $(CROSS)
-CC = $(CROSS_COMPILE)gcc
-LD = $(CROSS_COMPILE)gcc
-STRIP = $(CROSS_COMPILE)strip
 HOSTCC = gcc
 
 # check if compiler option is supported
diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include
index fcb3ed0be5f8..dd614463d4d6 100644
--- a/tools/scripts/Makefile.include
+++ b/tools/scripts/Makefile.include
@@ -42,6 +42,24 @@ EXTRA_WARNINGS += -Wformat
 
 CC_NO_CLANG := $(shell $(CC) -dM -E -x c /dev/null | grep -Fq "__clang__"; echo $$?)
 
+# Makefiles suck: This macro sets a default value of $(2) for the
+# variable named by $(1), unless the variable has been set by
+# environment or command line. This is necessary for CC and AR
+# because make sets default values, so the simpler ?= approach
+# won't work as expected.
+define allow-override
+  $(if $(or $(findstring environment,$(origin $(1))),\
+            $(findstring command line,$(origin $(1)))),,\
+    $(eval $(1) = $(2)))
+endef
+
+# Allow setting various cross-compile vars or setting CROSS_COMPILE as a prefix.
+$(call allow-override,CC,$(CROSS_COMPILE)gcc)
+$(call allow-override,AR,$(CROSS_COMPILE)ar)
+$(call allow-override,LD,$(CROSS_COMPILE)ld)
+$(call allow-override,CXX,$(CROSS_COMPILE)g++)
+$(call allow-override,STRIP,$(CROSS_COMPILE)strip)
+
 ifeq ($(CC_NO_CLANG), 1)
 EXTRA_WARNINGS += -Wstrict-aliasing=3
 endif
diff --git a/tools/spi/Makefile b/tools/spi/Makefile
index 90615e10c79a..815d15589177 100644
--- a/tools/spi/Makefile
+++ b/tools/spi/Makefile
@@ -11,8 +11,6 @@ endif
 # (this improves performance and avoids hard-to-debug behaviour);
 MAKEFLAGS += -r
 
-CC = $(CROSS_COMPILE)gcc
-LD = $(CROSS_COMPILE)ld
 CFLAGS += -O2 -Wall -g -D_GNU_SOURCE -I$(OUTPUT)include
 
 ALL_TARGETS := spidev_test spidev_fdx
diff --git a/tools/testing/selftests/bpf/.gitignore b/tools/testing/selftests/bpf/.gitignore
index cc15af2e54fe..9cf83f895d98 100644
--- a/tools/testing/selftests/bpf/.gitignore
+++ b/tools/testing/selftests/bpf/.gitignore
@@ -11,3 +11,4 @@ test_progs
 test_tcpbpf_user
 test_verifier_log
 feature
+test_libbpf_open
diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
index 436c4c72414f..9e03a4c356a4 100644
--- a/tools/testing/selftests/bpf/test_maps.c
+++ b/tools/testing/selftests/bpf/test_maps.c
@@ -126,6 +126,8 @@ static void test_hashmap_sizes(int task, void *data)
                         fd = bpf_create_map(BPF_MAP_TYPE_HASH, i, j,
                                             2, map_flags);
                         if (fd < 0) {
+                                if (errno == ENOMEM)
+                                        return;
                                 printf("Failed to create hashmap key=%d value=%d '%s'\n",
                                        i, j, strerror(errno));
                                 exit(1);
diff --git a/tools/testing/selftests/bpf/test_tcpbpf_kern.c b/tools/testing/selftests/bpf/test_tcpbpf_kern.c
index 57119ad57a3f..3e645ee41ed5 100644
--- a/tools/testing/selftests/bpf/test_tcpbpf_kern.c
+++ b/tools/testing/selftests/bpf/test_tcpbpf_kern.c
@@ -5,7 +5,6 @@
 #include <linux/if_ether.h>
 #include <linux/if_packet.h>
 #include <linux/ip.h>
-#include <linux/in6.h>
 #include <linux/types.h>
 #include <linux/socket.h>
 #include <linux/tcp.h>
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index c0f16e93f9bd..c73592fa3d41 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -2587,6 +2587,32 @@ static struct bpf_test tests[] = {
                 .result = ACCEPT,
         },
         {
+                "runtime/jit: pass negative index to tail_call",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_3, -1),
+                        BPF_LD_MAP_FD(BPF_REG_2, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_tail_call),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_prog = { 1 },
+                .result = ACCEPT,
+        },
+        {
+                "runtime/jit: pass > 32bit index to tail_call",
+                .insns = {
+                        BPF_LD_IMM64(BPF_REG_3, 0x100000000ULL),
+                        BPF_LD_MAP_FD(BPF_REG_2, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_tail_call),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_prog = { 2 },
+                .result = ACCEPT,
+        },
+        {
                 "stack pointer arithmetic",
                 .insns = {
                         BPF_MOV64_IMM(BPF_REG_1, 4),
diff --git a/tools/testing/selftests/memfd/Makefile b/tools/testing/selftests/memfd/Makefile
index a5276a91dfbf..0862e6f47a38 100644
--- a/tools/testing/selftests/memfd/Makefile
+++ b/tools/testing/selftests/memfd/Makefile
@@ -5,6 +5,7 @@ CFLAGS += -I../../../../include/
 CFLAGS += -I../../../../usr/include/
 
 TEST_PROGS := run_tests.sh
+TEST_FILES := run_fuse_test.sh
 TEST_GEN_FILES := memfd_test fuse_mnt fuse_test
 
 fuse_mnt.o: CFLAGS += $(shell pkg-config fuse --cflags)
diff --git a/tools/testing/selftests/powerpc/alignment/alignment_handler.c b/tools/testing/selftests/powerpc/alignment/alignment_handler.c
index 39fd362415cf..0f2698f9fd6d 100644
--- a/tools/testing/selftests/powerpc/alignment/alignment_handler.c
+++ b/tools/testing/selftests/powerpc/alignment/alignment_handler.c
@@ -57,7 +57,7 @@ volatile int gotsig;
 
 void sighandler(int sig, siginfo_t *info, void *ctx)
 {
-        struct ucontext *ucp = ctx;
+        ucontext_t *ucp = ctx;
 
         if (!testing) {
                 signal(sig, SIG_DFL);
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 0b457e8e0f0c..5df609950a66 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -141,6 +141,15 @@ struct seccomp_data {
 #define SECCOMP_FILTER_FLAG_LOG 2
 #endif
 
+#ifndef PTRACE_SECCOMP_GET_METADATA
+#define PTRACE_SECCOMP_GET_METADATA     0x420d
+
+struct seccomp_metadata {
+        __u64 filter_off;       /* Input: which filter */
+        __u64 flags;             /* Output: filter's flags */
+};
+#endif
+
 #ifndef seccomp
 int seccomp(unsigned int op, unsigned int flags, void *args)
 {
@@ -2845,6 +2854,58 @@ TEST(get_action_avail)
         EXPECT_EQ(errno, EOPNOTSUPP);
 }
 
+TEST(get_metadata)
+{
+        pid_t pid;
+        int pipefd[2];
+        char buf;
+        struct seccomp_metadata md;
+
+        ASSERT_EQ(0, pipe(pipefd));
+
+        pid = fork();
+        ASSERT_GE(pid, 0);
+        if (pid == 0) {
+                struct sock_filter filter[] = {
+                        BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
+                };
+                struct sock_fprog prog = {
+                        .len = (unsigned short)ARRAY_SIZE(filter),
+                        .filter = filter,
+                };
+
+                /* one with log, one without */
+                ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER,
+                                     SECCOMP_FILTER_FLAG_LOG, &prog));
+                ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog));
+
+                ASSERT_EQ(0, close(pipefd[0]));
+                ASSERT_EQ(1, write(pipefd[1], "1", 1));
+                ASSERT_EQ(0, close(pipefd[1]));
+
+                while (1)
+                        sleep(100);
+        }
+
+        ASSERT_EQ(0, close(pipefd[1]));
+        ASSERT_EQ(1, read(pipefd[0], &buf, 1));
+
+        ASSERT_EQ(0, ptrace(PTRACE_ATTACH, pid));
+        ASSERT_EQ(pid, waitpid(pid, NULL, 0));
+
+        md.filter_off = 0;
+        ASSERT_EQ(sizeof(md), ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md));
+        EXPECT_EQ(md.flags, SECCOMP_FILTER_FLAG_LOG);
+        EXPECT_EQ(md.filter_off, 0);
+
+        md.filter_off = 1;
+        ASSERT_EQ(sizeof(md), ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md));
+        EXPECT_EQ(md.flags, 0);
+        EXPECT_EQ(md.filter_off, 1);
+
+        ASSERT_EQ(0, kill(pid, SIGKILL));
+}
+
 /*
  * TODO:
  * - add microbenchmarks
diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index 10ca46df1449..d744991c0f4f 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -5,16 +5,26 @@ include ../lib.mk
 
 .PHONY: all all_32 all_64 warn_32bit_failure clean
 
-TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt ptrace_syscall test_mremap_vdso \
-                        check_initial_reg_state sigreturn ldt_gdt iopl mpx-mini-test ioperm \
+UNAME_M := $(shell uname -m)
+CAN_BUILD_I386 := $(shell ./check_cc.sh $(CC) trivial_32bit_program.c -m32)
+CAN_BUILD_X86_64 := $(shell ./check_cc.sh $(CC) trivial_64bit_program.c)
+
+TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \
+                        check_initial_reg_state sigreturn iopl mpx-mini-test ioperm \
                         protection_keys test_vdso test_vsyscall
 TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault test_syscall_vdso unwind_vdso \
                         test_FCMOV test_FCOMI test_FISTTP \
                         vdso_restorer
-TARGETS_C_64BIT_ONLY := fsgsbase sysret_rip 5lvl
+TARGETS_C_64BIT_ONLY := fsgsbase sysret_rip
+# Some selftests require 32bit support enabled also on 64bit systems
+TARGETS_C_32BIT_NEEDED := ldt_gdt ptrace_syscall
 
-TARGETS_C_32BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_32BIT_ONLY)
+TARGETS_C_32BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_32BIT_ONLY) $(TARGETS_C_32BIT_NEEDED)
 TARGETS_C_64BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_64BIT_ONLY)
+ifeq ($(CAN_BUILD_I386)$(CAN_BUILD_X86_64),11)
+TARGETS_C_64BIT_ALL += $(TARGETS_C_32BIT_NEEDED)
+endif
+
 BINARIES_32 := $(TARGETS_C_32BIT_ALL:%=%_32)
 BINARIES_64 := $(TARGETS_C_64BIT_ALL:%=%_64)
 
@@ -23,10 +33,6 @@ BINARIES_64 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_64))
 
 CFLAGS := -O2 -g -std=gnu99 -pthread -Wall -no-pie
 
-UNAME_M := $(shell uname -m)
-CAN_BUILD_I386 := $(shell ./check_cc.sh $(CC) trivial_32bit_program.c -m32)
-CAN_BUILD_X86_64 := $(shell ./check_cc.sh $(CC) trivial_64bit_program.c)
-
 define gen-target-rule-32
 $(1) $(1)_32: $(OUTPUT)/$(1)_32
 .PHONY: $(1) $(1)_32
@@ -40,12 +46,14 @@ endef
 ifeq ($(CAN_BUILD_I386),1)
 all: all_32
 TEST_PROGS += $(BINARIES_32)
+EXTRA_CFLAGS += -DCAN_BUILD_32
 $(foreach t,$(TARGETS_C_32BIT_ALL),$(eval $(call gen-target-rule-32,$(t))))
 endif
 
 ifeq ($(CAN_BUILD_X86_64),1)
 all: all_64
 TEST_PROGS += $(BINARIES_64)
+EXTRA_CFLAGS += -DCAN_BUILD_64
 $(foreach t,$(TARGETS_C_64BIT_ALL),$(eval $(call gen-target-rule-64,$(t))))
 endif
 
diff --git a/tools/testing/selftests/x86/mpx-mini-test.c b/tools/testing/selftests/x86/mpx-mini-test.c
index ec0f6b45ce8b..9c0325e1ea68 100644
--- a/tools/testing/selftests/x86/mpx-mini-test.c
+++ b/tools/testing/selftests/x86/mpx-mini-test.c
@@ -315,11 +315,39 @@ static inline void *__si_bounds_upper(siginfo_t *si)
         return si->si_upper;
 }
 #else
+
+/*
+ * This deals with old version of _sigfault in some distros:
+ *
+
+old _sigfault:
+        struct {
+            void *si_addr;
+        } _sigfault;
+
+new _sigfault:
+        struct {
+                void __user *_addr;
+                int _trapno;
+                short _addr_lsb;
+                union {
+                        struct {
+                                void __user *_lower;
+                                void __user *_upper;
+                        } _addr_bnd;
+                        __u32 _pkey;
+                };
+        } _sigfault;
+ *
+ */
+
 static inline void **__si_bounds_hack(siginfo_t *si)
 {
         void *sigfault = &si->_sifields._sigfault;
         void *end_sigfault = sigfault + sizeof(si->_sifields._sigfault);
-        void **__si_lower = end_sigfault;
+        int *trapno = (int*)end_sigfault;
+        /* skip _trapno and _addr_lsb */
+        void **__si_lower = (void**)(trapno + 2);
 
         return __si_lower;
 }
@@ -331,7 +359,7 @@ static inline void *__si_bounds_lower(siginfo_t *si)
 
 static inline void *__si_bounds_upper(siginfo_t *si)
 {
-        return (*__si_bounds_hack(si)) + sizeof(void *);
+        return *(__si_bounds_hack(si) + 1);
 }
 #endif
 
diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c
index bc1b0735bb50..f15aa5a76fe3 100644
--- a/tools/testing/selftests/x86/protection_keys.c
+++ b/tools/testing/selftests/x86/protection_keys.c
@@ -393,34 +393,6 @@ pid_t fork_lazy_child(void)
         return forkret;
 }
 
-void davecmp(void *_a, void *_b, int len)
-{
-        int i;
-        unsigned long *a = _a;
-        unsigned long *b = _b;
-
-        for (i = 0; i < len / sizeof(*a); i++) {
-                if (a[i] == b[i])
-                        continue;
-
-                dprintf3("[%3d]: a: %016lx b: %016lx\n", i, a[i], b[i]);
-        }
-}
-
-void dumpit(char *f)
-{
-        int fd = open(f, O_RDONLY);
-        char buf[100];
-        int nr_read;
-
-        dprintf2("maps fd: %d\n", fd);
-        do {
-                nr_read = read(fd, &buf[0], sizeof(buf));
-                write(1, buf, nr_read);
-        } while (nr_read > 0);
-        close(fd);
-}
-
 #define PKEY_DISABLE_ACCESS    0x1
 #define PKEY_DISABLE_WRITE     0x2
 
diff --git a/tools/testing/selftests/x86/single_step_syscall.c b/tools/testing/selftests/x86/single_step_syscall.c
index a48da95c18fd..ddfdd635de16 100644
--- a/tools/testing/selftests/x86/single_step_syscall.c
+++ b/tools/testing/selftests/x86/single_step_syscall.c
@@ -119,7 +119,9 @@ static void check_result(void)
 
 int main()
 {
+#ifdef CAN_BUILD_32
         int tmp;
+#endif
 
         sethandler(SIGTRAP, sigtrap, 0);
 
@@ -139,12 +141,13 @@ int main()
                       : : "c" (post_nop) : "r11");
         check_result();
 #endif
-
+#ifdef CAN_BUILD_32
         printf("[RUN]\tSet TF and check int80\n");
         set_eflags(get_eflags() | X86_EFLAGS_TF);
         asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)
                         : INT80_CLOBBERS);
         check_result();
+#endif
 
         /*
          * This test is particularly interesting if fast syscalls use
diff --git a/tools/testing/selftests/x86/test_mremap_vdso.c b/tools/testing/selftests/x86/test_mremap_vdso.c
index bf0d687c7db7..64f11c8d9b76 100644
--- a/tools/testing/selftests/x86/test_mremap_vdso.c
+++ b/tools/testing/selftests/x86/test_mremap_vdso.c
@@ -90,8 +90,12 @@ int main(int argc, char **argv, char **envp)
                         vdso_size += PAGE_SIZE;
                 }
 
+#ifdef __i386__
                 /* Glibc is likely to explode now - exit with raw syscall */
                 asm volatile ("int $0x80" : : "a" (__NR_exit), "b" (!!ret));
+#else /* __x86_64__ */
+                syscall(SYS_exit, ret);
+#endif
         } else {
                 int status;
 
diff --git a/tools/testing/selftests/x86/test_vdso.c b/tools/testing/selftests/x86/test_vdso.c
index 29973cde06d3..235259011704 100644
--- a/tools/testing/selftests/x86/test_vdso.c
+++ b/tools/testing/selftests/x86/test_vdso.c
@@ -26,20 +26,59 @@
 # endif
 #endif
 
+/* max length of lines in /proc/self/maps - anything longer is skipped here */
+#define MAPS_LINE_LEN 128
+
 int nerrs = 0;
 
+typedef long (*getcpu_t)(unsigned *, unsigned *, void *);
+
+getcpu_t vgetcpu;
+getcpu_t vdso_getcpu;
+
+static void *vsyscall_getcpu(void)
+{
 #ifdef __x86_64__
-# define VSYS(x) (x)
+        FILE *maps;
+        char line[MAPS_LINE_LEN];
+        bool found = false;
+
+        maps = fopen("/proc/self/maps", "r");
+        if (!maps) /* might still be present, but ignore it here, as we test vDSO not vsyscall */
+                return NULL;
+
+        while (fgets(line, MAPS_LINE_LEN, maps)) {
+                char r, x;
+                void *start, *end;
+                char name[MAPS_LINE_LEN];
+
+                /* sscanf() is safe here as strlen(name) >= strlen(line) */
+                if (sscanf(line, "%p-%p %c-%cp %*x %*x:%*x %*u %s",
+                           &start, &end, &r, &x, name) != 5)
+                        continue;
+
+                if (strcmp(name, "[vsyscall]"))
+                        continue;
+
+                /* assume entries are OK, as we test vDSO here not vsyscall */
+                found = true;
+                break;
+        }
+
+        fclose(maps);
+
+        if (!found) {
+                printf("Warning: failed to find vsyscall getcpu\n");
+                return NULL;
+        }
+        return (void *) (0xffffffffff600800);
 #else
-# define VSYS(x) 0
+        return NULL;
 #endif
+}
 
-typedef long (*getcpu_t)(unsigned *, unsigned *, void *);
-
-const getcpu_t vgetcpu = (getcpu_t)VSYS(0xffffffffff600800);
-getcpu_t vdso_getcpu;
 
-void fill_function_pointers()
+static void fill_function_pointers()
 {
         void *vdso = dlopen("linux-vdso.so.1",
                             RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);
@@ -54,6 +93,8 @@ void fill_function_pointers()
         vdso_getcpu = (getcpu_t)dlsym(vdso, "__vdso_getcpu");
         if (!vdso_getcpu)
                 printf("Warning: failed to find getcpu in vDSO\n");
+
+        vgetcpu = (getcpu_t) vsyscall_getcpu();
 }
 
 static long sys_getcpu(unsigned * cpu, unsigned * node,
diff --git a/tools/testing/selftests/x86/test_vsyscall.c b/tools/testing/selftests/x86/test_vsyscall.c
index 7a744fa7b786..be81621446f0 100644
--- a/tools/testing/selftests/x86/test_vsyscall.c
+++ b/tools/testing/selftests/x86/test_vsyscall.c
@@ -33,6 +33,9 @@
 # endif
 #endif
 
+/* max length of lines in /proc/self/maps - anything longer is skipped here */
+#define MAPS_LINE_LEN 128
+
 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
                        int flags)
 {
@@ -98,7 +101,7 @@ static int init_vsys(void)
 #ifdef __x86_64__
         int nerrs = 0;
         FILE *maps;
-        char line[128];
+        char line[MAPS_LINE_LEN];
         bool found = false;
 
         maps = fopen("/proc/self/maps", "r");
@@ -108,10 +111,12 @@ static int init_vsys(void)
                 return 0;
         }
 
-        while (fgets(line, sizeof(line), maps)) {
+        while (fgets(line, MAPS_LINE_LEN, maps)) {
                 char r, x;
                 void *start, *end;
-                char name[128];
+                char name[MAPS_LINE_LEN];
+
+                /* sscanf() is safe here as strlen(name) >= strlen(line) */
                 if (sscanf(line, "%p-%p %c-%cp %*x %*x:%*x %*u %s",
                            &start, &end, &r, &x, name) != 5)
                         continue;
diff --git a/tools/usb/Makefile b/tools/usb/Makefile
index 4e6506078494..01d758d73b6d 100644
--- a/tools/usb/Makefile
+++ b/tools/usb/Makefile
@@ -1,7 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 # Makefile for USB tools
 
-CC = $(CROSS_COMPILE)gcc
 PTHREAD_LIBS = -lpthread
 WARNINGS = -Wall -Wextra
 CFLAGS = $(WARNINGS) -g -I../include
diff --git a/tools/vm/Makefile b/tools/vm/Makefile
index be320b905ea7..20f6cf04377f 100644
--- a/tools/vm/Makefile
+++ b/tools/vm/Makefile
@@ -6,7 +6,6 @@ TARGETS=page-types slabinfo page_owner_sort
 LIB_DIR = ../lib/api
 LIBS = $(LIB_DIR)/libapi.a
 
-CC = $(CROSS_COMPILE)gcc
 CFLAGS = -Wall -Wextra -I../lib/
 LDFLAGS = $(LIBS)
 
diff --git a/tools/wmi/Makefile b/tools/wmi/Makefile
index e664f1167388..e0e87239126b 100644
--- a/tools/wmi/Makefile
+++ b/tools/wmi/Makefile
@@ -2,7 +2,6 @@ PREFIX ?= /usr
 SBINDIR ?= sbin
 INSTALL ?= install
 CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include
-CC = $(CROSS_COMPILE)gcc
 
 TARGET = dell-smbios-example