298 files changed, 3464 insertions, 2348 deletions

diff --git a/Documentation/networking/segmentation-offloads.txt b/Documentation/networking/segmentation-offloads.txt
index 2f09455a993a..d47480b61ac6 100644
--- a/Documentation/networking/segmentation-offloads.txt
+++ b/Documentation/networking/segmentation-offloads.txt
@@ -13,6 +13,7 @@ The following technologies are described:
  * Generic Segmentation Offload - GSO
  * Generic Receive Offload - GRO
  * Partial Generic Segmentation Offload - GSO_PARTIAL
+ * SCTP accelleration with GSO - GSO_BY_FRAGS
 
 TCP Segmentation Offload
 ========================
@@ -49,6 +50,10 @@ datagram into multiple IPv4 fragments.  Many of the requirements for UDP
 fragmentation offload are the same as TSO.  However the IPv4 ID for
 fragments should not increment as a single IPv4 datagram is fragmented.
 
+UFO is deprecated: modern kernels will no longer generate UFO skbs, but can
+still receive them from tuntap and similar devices. Offload of UDP-based
+tunnel protocols is still supported.
+
 IPIP, SIT, GRE, UDP Tunnel, and Remote Checksum Offloads
 ========================================================
 
@@ -83,10 +88,10 @@ SKB_GSO_UDP_TUNNEL_CSUM.  These two additional tunnel types reflect the
 fact that the outer header also requests to have a non-zero checksum
 included in the outer header.
 
-Finally there is SKB_GSO_REMCSUM which indicates that a given tunnel header
-has requested a remote checksum offload.  In this case the inner headers
-will be left with a partial checksum and only the outer header checksum
-will be computed.
+Finally there is SKB_GSO_TUNNEL_REMCSUM which indicates that a given tunnel
+header has requested a remote checksum offload.  In this case the inner
+headers will be left with a partial checksum and only the outer header
+checksum will be computed.
 
 Generic Segmentation Offload
 ============================
@@ -128,3 +133,28 @@ values for if the header was simply duplicated.  The one exception to this
 is the outer IPv4 ID field.  It is up to the device drivers to guarantee
 that the IPv4 ID field is incremented in the case that a given header does
 not have the DF bit set.
+
+SCTP accelleration with GSO
+===========================
+
+SCTP - despite the lack of hardware support - can still take advantage of
+GSO to pass one large packet through the network stack, rather than
+multiple small packets.
+
+This requires a different approach to other offloads, as SCTP packets
+cannot be just segmented to (P)MTU. Rather, the chunks must be contained in
+IP segments, padding respected. So unlike regular GSO, SCTP can't just
+generate a big skb, set gso_size to the fragmentation point and deliver it
+to IP layer.
+
+Instead, the SCTP protocol layer builds an skb with the segments correctly
+padded and stored as chained skbs, and skb_segment() splits based on those.
+To signal this, gso_size is set to the special value GSO_BY_FRAGS.
+
+Therefore, any code in the core networking stack must be aware of the
+possibility that gso_size will be GSO_BY_FRAGS and handle that case
+appropriately. (For size checks, the skb_gso_validate_*_len family of
+helpers do this automatically.)
+
+This also affects drivers with the NETIF_F_FRAGLIST & NETIF_F_GSO_SCTP bits
+set. Note also that NETIF_F_GSO_SCTP is included in NETIF_F_GSO_SOFTWARE.
diff --git a/MAINTAINERS b/MAINTAINERS
index 9a7f76eadae9..93a12af4f180 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -7909,7 +7909,6 @@ S:	Maintained
 F:      scripts/leaking_addresses.pl
 
 LED SUBSYSTEM
-M:      Richard Purdie <rpurdie@rpsys.net>
 M:      Jacek Anaszewski <jacek.anaszewski@gmail.com>
 M:      Pavel Machek <pavel@ucw.cz>
 L:      linux-leds@vger.kernel.org
diff --git a/Makefile b/Makefile
index 79ad2bfa24b6..d9cf3a40eda9 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 16
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc2
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
diff --git a/arch/arc/include/asm/bug.h b/arch/arc/include/asm/bug.h
index ea022d47896c..21ec82466d62 100644
--- a/arch/arc/include/asm/bug.h
+++ b/arch/arc/include/asm/bug.h
@@ -23,7 +23,8 @@ void die(const char *str, struct pt_regs *regs, unsigned long address);
 
 #define BUG()   do {                                                            \
         pr_warn("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \
-        dump_stack();                                                           \
+        barrier_before_unreachable();                                           \
+        __builtin_trap();                                                       \
 } while (0)
 
 #define HAVE_ARCH_BUG
diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
index be7bd19c87ec..eda8c5f629fc 100644
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@@ -20,7 +20,7 @@
 
 #define MPIDR_UP_BITMASK        (0x1 << 30)
 #define MPIDR_MT_BITMASK        (0x1 << 24)
-#define MPIDR_HWID_BITMASK      0xff00ffffff
+#define MPIDR_HWID_BITMASK      0xff00ffffffUL
 
 #define MPIDR_LEVEL_BITS_SHIFT  3
 #define MPIDR_LEVEL_BITS        (1 << MPIDR_LEVEL_BITS_SHIFT)
diff --git a/arch/arm64/include/asm/hugetlb.h b/arch/arm64/include/asm/hugetlb.h
index 1dca41bea16a..e73f68569624 100644
--- a/arch/arm64/include/asm/hugetlb.h
+++ b/arch/arm64/include/asm/hugetlb.h
@@ -22,7 +22,7 @@
 
 static inline pte_t huge_ptep_get(pte_t *ptep)
 {
-        return *ptep;
+        return READ_ONCE(*ptep);
 }
 
 
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index 9679067a1574..7faed6e48b46 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -185,42 +185,42 @@ static inline pmd_t kvm_s2pmd_mkexec(pmd_t pmd)
         return pmd;
 }
 
-static inline void kvm_set_s2pte_readonly(pte_t *pte)
+static inline void kvm_set_s2pte_readonly(pte_t *ptep)
 {
         pteval_t old_pteval, pteval;
 
-        pteval = READ_ONCE(pte_val(*pte));
+        pteval = READ_ONCE(pte_val(*ptep));
         do {
                 old_pteval = pteval;
                 pteval &= ~PTE_S2_RDWR;
                 pteval |= PTE_S2_RDONLY;
-                pteval = cmpxchg_relaxed(&pte_val(*pte), old_pteval, pteval);
+                pteval = cmpxchg_relaxed(&pte_val(*ptep), old_pteval, pteval);
         } while (pteval != old_pteval);
 }
 
-static inline bool kvm_s2pte_readonly(pte_t *pte)
+static inline bool kvm_s2pte_readonly(pte_t *ptep)
 {
-        return (pte_val(*pte) & PTE_S2_RDWR) == PTE_S2_RDONLY;
+        return (READ_ONCE(pte_val(*ptep)) & PTE_S2_RDWR) == PTE_S2_RDONLY;
 }
 
-static inline bool kvm_s2pte_exec(pte_t *pte)
+static inline bool kvm_s2pte_exec(pte_t *ptep)
 {
-        return !(pte_val(*pte) & PTE_S2_XN);
+        return !(READ_ONCE(pte_val(*ptep)) & PTE_S2_XN);
 }
 
-static inline void kvm_set_s2pmd_readonly(pmd_t *pmd)
+static inline void kvm_set_s2pmd_readonly(pmd_t *pmdp)
 {
-        kvm_set_s2pte_readonly((pte_t *)pmd);
+        kvm_set_s2pte_readonly((pte_t *)pmdp);
 }
 
-static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
+static inline bool kvm_s2pmd_readonly(pmd_t *pmdp)
 {
-        return kvm_s2pte_readonly((pte_t *)pmd);
+        return kvm_s2pte_readonly((pte_t *)pmdp);
 }
 
-static inline bool kvm_s2pmd_exec(pmd_t *pmd)
+static inline bool kvm_s2pmd_exec(pmd_t *pmdp)
 {
-        return !(pmd_val(*pmd) & PMD_S2_XN);
+        return !(READ_ONCE(pmd_val(*pmdp)) & PMD_S2_XN);
 }
 
 static inline bool kvm_page_empty(void *ptr)
diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
index 8d3331985d2e..39ec0b8a689e 100644
--- a/arch/arm64/include/asm/mmu_context.h
+++ b/arch/arm64/include/asm/mmu_context.h
@@ -141,13 +141,13 @@ static inline void cpu_install_idmap(void)
  * Atomically replaces the active TTBR1_EL1 PGD with a new VA-compatible PGD,
  * avoiding the possibility of conflicting TLB entries being allocated.
  */
-static inline void cpu_replace_ttbr1(pgd_t *pgd)
+static inline void cpu_replace_ttbr1(pgd_t *pgdp)
 {
         typedef void (ttbr_replace_func)(phys_addr_t);
         extern ttbr_replace_func idmap_cpu_replace_ttbr1;
         ttbr_replace_func *replace_phys;
 
-        phys_addr_t pgd_phys = virt_to_phys(pgd);
+        phys_addr_t pgd_phys = virt_to_phys(pgdp);
 
         replace_phys = (void *)__pa_symbol(idmap_cpu_replace_ttbr1);
 
diff --git a/arch/arm64/include/asm/pgalloc.h b/arch/arm64/include/asm/pgalloc.h
index e9d9f1b006ef..2e05bcd944c8 100644
--- a/arch/arm64/include/asm/pgalloc.h
+++ b/arch/arm64/include/asm/pgalloc.h
@@ -36,23 +36,23 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
         return (pmd_t *)__get_free_page(PGALLOC_GFP);
 }
 
-static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+static inline void pmd_free(struct mm_struct *mm, pmd_t *pmdp)
 {
-        BUG_ON((unsigned long)pmd & (PAGE_SIZE-1));
-        free_page((unsigned long)pmd);
+        BUG_ON((unsigned long)pmdp & (PAGE_SIZE-1));
+        free_page((unsigned long)pmdp);
 }
 
-static inline void __pud_populate(pud_t *pud, phys_addr_t pmd, pudval_t prot)
+static inline void __pud_populate(pud_t *pudp, phys_addr_t pmdp, pudval_t prot)
 {
-        set_pud(pud, __pud(__phys_to_pud_val(pmd) | prot));
+        set_pud(pudp, __pud(__phys_to_pud_val(pmdp) | prot));
 }
 
-static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
+static inline void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmdp)
 {
-        __pud_populate(pud, __pa(pmd), PMD_TYPE_TABLE);
+        __pud_populate(pudp, __pa(pmdp), PMD_TYPE_TABLE);
 }
 #else
-static inline void __pud_populate(pud_t *pud, phys_addr_t pmd, pudval_t prot)
+static inline void __pud_populate(pud_t *pudp, phys_addr_t pmdp, pudval_t prot)
 {
         BUILD_BUG();
 }
@@ -65,30 +65,30 @@ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
         return (pud_t *)__get_free_page(PGALLOC_GFP);
 }
 
-static inline void pud_free(struct mm_struct *mm, pud_t *pud)
+static inline void pud_free(struct mm_struct *mm, pud_t *pudp)
 {
-        BUG_ON((unsigned long)pud & (PAGE_SIZE-1));
-        free_page((unsigned long)pud);
+        BUG_ON((unsigned long)pudp & (PAGE_SIZE-1));
+        free_page((unsigned long)pudp);
 }
 
-static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pud, pgdval_t prot)
+static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pudp, pgdval_t prot)
 {
-        set_pgd(pgdp, __pgd(__phys_to_pgd_val(pud) | prot));
+        set_pgd(pgdp, __pgd(__phys_to_pgd_val(pudp) | prot));
 }
 
-static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
+static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgdp, pud_t *pudp)
 {
-        __pgd_populate(pgd, __pa(pud), PUD_TYPE_TABLE);
+        __pgd_populate(pgdp, __pa(pudp), PUD_TYPE_TABLE);
 }
 #else
-static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pud, pgdval_t prot)
+static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pudp, pgdval_t prot)
 {
         BUILD_BUG();
 }
 #endif  /* CONFIG_PGTABLE_LEVELS > 3 */
 
 extern pgd_t *pgd_alloc(struct mm_struct *mm);
-extern void pgd_free(struct mm_struct *mm, pgd_t *pgd);
+extern void pgd_free(struct mm_struct *mm, pgd_t *pgdp);
 
 static inline pte_t *
 pte_alloc_one_kernel(struct mm_struct *mm, unsigned long addr)
@@ -114,10 +114,10 @@ pte_alloc_one(struct mm_struct *mm, unsigned long addr)
 /*
  * Free a PTE table.
  */
-static inline void pte_free_kernel(struct mm_struct *mm, pte_t *pte)
+static inline void pte_free_kernel(struct mm_struct *mm, pte_t *ptep)
 {
-        if (pte)
-                free_page((unsigned long)pte);
+        if (ptep)
+                free_page((unsigned long)ptep);
 }
 
 static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
@@ -126,10 +126,10 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         __free_page(pte);
 }
 
-static inline void __pmd_populate(pmd_t *pmdp, phys_addr_t pte,
+static inline void __pmd_populate(pmd_t *pmdp, phys_addr_t ptep,
                                   pmdval_t prot)
 {
-        set_pmd(pmdp, __pmd(__phys_to_pmd_val(pte) | prot));
+        set_pmd(pmdp, __pmd(__phys_to_pmd_val(ptep) | prot));
 }
 
 /*
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 094374c82db0..7e2c27e63cd8 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -218,7 +218,7 @@ static inline pmd_t pmd_mkcont(pmd_t pmd)
 
 static inline void set_pte(pte_t *ptep, pte_t pte)
 {
-        *ptep = pte;
+        WRITE_ONCE(*ptep, pte);
 
         /*
          * Only if the new pte is valid and kernel, otherwise TLB maintenance
@@ -250,6 +250,8 @@ extern void __sync_icache_dcache(pte_t pteval, unsigned long addr);
 static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
                               pte_t *ptep, pte_t pte)
 {
+        pte_t old_pte;
+
         if (pte_present(pte) && pte_user_exec(pte) && !pte_special(pte))
                 __sync_icache_dcache(pte, addr);
 
@@ -258,14 +260,15 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
          * hardware updates of the pte (ptep_set_access_flags safely changes
          * valid ptes without going through an invalid entry).
          */
-        if (IS_ENABLED(CONFIG_DEBUG_VM) && pte_valid(*ptep) && pte_valid(pte) &&
+        old_pte = READ_ONCE(*ptep);
+        if (IS_ENABLED(CONFIG_DEBUG_VM) && pte_valid(old_pte) && pte_valid(pte) &&
            (mm == current->active_mm || atomic_read(&mm->mm_users) > 1)) {
                 VM_WARN_ONCE(!pte_young(pte),
                              "%s: racy access flag clearing: 0x%016llx -> 0x%016llx",
-                             __func__, pte_val(*ptep), pte_val(pte));
-                VM_WARN_ONCE(pte_write(*ptep) && !pte_dirty(pte),
+                             __func__, pte_val(old_pte), pte_val(pte));
+                VM_WARN_ONCE(pte_write(old_pte) && !pte_dirty(pte),
                              "%s: racy dirty state clearing: 0x%016llx -> 0x%016llx",
-                             __func__, pte_val(*ptep), pte_val(pte));
+                             __func__, pte_val(old_pte), pte_val(pte));
         }
 
         set_pte(ptep, pte);
@@ -431,7 +434,7 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
 
 static inline void set_pmd(pmd_t *pmdp, pmd_t pmd)
 {
-        *pmdp = pmd;
+        WRITE_ONCE(*pmdp, pmd);
         dsb(ishst);
         isb();
 }
@@ -482,7 +485,7 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd)
 
 static inline void set_pud(pud_t *pudp, pud_t pud)
 {
-        *pudp = pud;
+        WRITE_ONCE(*pudp, pud);
         dsb(ishst);
         isb();
 }
@@ -500,7 +503,7 @@ static inline phys_addr_t pud_page_paddr(pud_t pud)
 /* Find an entry in the second-level page table. */
 #define pmd_index(addr)         (((addr) >> PMD_SHIFT) & (PTRS_PER_PMD - 1))
 
-#define pmd_offset_phys(dir, addr)      (pud_page_paddr(*(dir)) + pmd_index(addr) * sizeof(pmd_t))
+#define pmd_offset_phys(dir, addr)      (pud_page_paddr(READ_ONCE(*(dir))) + pmd_index(addr) * sizeof(pmd_t))
 #define pmd_offset(dir, addr)           ((pmd_t *)__va(pmd_offset_phys((dir), (addr))))
 
 #define pmd_set_fixmap(addr)            ((pmd_t *)set_fixmap_offset(FIX_PMD, addr))
@@ -535,7 +538,7 @@ static inline phys_addr_t pud_page_paddr(pud_t pud)
 
 static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
 {
-        *pgdp = pgd;
+        WRITE_ONCE(*pgdp, pgd);
         dsb(ishst);
 }
 
@@ -552,7 +555,7 @@ static inline phys_addr_t pgd_page_paddr(pgd_t pgd)
 /* Find an entry in the frst-level page table. */
 #define pud_index(addr)         (((addr) >> PUD_SHIFT) & (PTRS_PER_PUD - 1))
 
-#define pud_offset_phys(dir, addr)      (pgd_page_paddr(*(dir)) + pud_index(addr) * sizeof(pud_t))
+#define pud_offset_phys(dir, addr)      (pgd_page_paddr(READ_ONCE(*(dir))) + pud_index(addr) * sizeof(pud_t))
 #define pud_offset(dir, addr)           ((pud_t *)__va(pud_offset_phys((dir), (addr))))
 
 #define pud_set_fixmap(addr)            ((pud_t *)set_fixmap_offset(FIX_PUD, addr))
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 07823595b7f0..52f15cd896e1 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -408,6 +408,15 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
         },
         {
                 .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
+                MIDR_ALL_VERSIONS(MIDR_QCOM_FALKOR),
+                .enable = qcom_enable_link_stack_sanitization,
+        },
+        {
+                .capability = ARM64_HARDEN_BP_POST_GUEST_EXIT,
+                MIDR_ALL_VERSIONS(MIDR_QCOM_FALKOR),
+        },
+        {
+                .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
                 MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
                 .enable = enable_smccc_arch_workaround_1,
         },
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index f85ac58d08a3..a8bf1c892b90 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -90,7 +90,7 @@ static int __init set_permissions(pte_t *ptep, pgtable_t token,
                                   unsigned long addr, void *data)
 {
         efi_memory_desc_t *md = data;
-        pte_t pte = *ptep;
+        pte_t pte = READ_ONCE(*ptep);
 
         if (md->attribute & EFI_MEMORY_RO)
                 pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index f20cf7e99249..1ec5f28c39fc 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -202,10 +202,10 @@ static int create_safe_exec_page(void *src_start, size_t length,
                                  gfp_t mask)
 {
         int rc = 0;
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
+        pgd_t *pgdp;
+        pud_t *pudp;
+        pmd_t *pmdp;
+        pte_t *ptep;
         unsigned long dst = (unsigned long)allocator(mask);
 
         if (!dst) {
@@ -216,38 +216,38 @@ static int create_safe_exec_page(void *src_start, size_t length,
         memcpy((void *)dst, src_start, length);
         flush_icache_range(dst, dst + length);
 
-        pgd = pgd_offset_raw(allocator(mask), dst_addr);
-        if (pgd_none(*pgd)) {
-                pud = allocator(mask);
-                if (!pud) {
+        pgdp = pgd_offset_raw(allocator(mask), dst_addr);
+        if (pgd_none(READ_ONCE(*pgdp))) {
+                pudp = allocator(mask);
+                if (!pudp) {
                         rc = -ENOMEM;
                         goto out;
                 }
-                pgd_populate(&init_mm, pgd, pud);
+                pgd_populate(&init_mm, pgdp, pudp);
         }
 
-        pud = pud_offset(pgd, dst_addr);
-        if (pud_none(*pud)) {
-                pmd = allocator(mask);
-                if (!pmd) {
+        pudp = pud_offset(pgdp, dst_addr);
+        if (pud_none(READ_ONCE(*pudp))) {
+                pmdp = allocator(mask);
+                if (!pmdp) {
                         rc = -ENOMEM;
                         goto out;
                 }
-                pud_populate(&init_mm, pud, pmd);
+                pud_populate(&init_mm, pudp, pmdp);
         }
 
-        pmd = pmd_offset(pud, dst_addr);
-        if (pmd_none(*pmd)) {
-                pte = allocator(mask);
-                if (!pte) {
+        pmdp = pmd_offset(pudp, dst_addr);
+        if (pmd_none(READ_ONCE(*pmdp))) {
+                ptep = allocator(mask);
+                if (!ptep) {
                         rc = -ENOMEM;
                         goto out;
                 }
-                pmd_populate_kernel(&init_mm, pmd, pte);
+                pmd_populate_kernel(&init_mm, pmdp, ptep);
         }
 
-        pte = pte_offset_kernel(pmd, dst_addr);
-        set_pte(pte, pfn_pte(virt_to_pfn(dst), PAGE_KERNEL_EXEC));
+        ptep = pte_offset_kernel(pmdp, dst_addr);
+        set_pte(ptep, pfn_pte(virt_to_pfn(dst), PAGE_KERNEL_EXEC));
 
         /*
          * Load our new page tables. A strict BBM approach requires that we
@@ -263,7 +263,7 @@ static int create_safe_exec_page(void *src_start, size_t length,
          */
         cpu_set_reserved_ttbr0();
         local_flush_tlb_all();
-        write_sysreg(phys_to_ttbr(virt_to_phys(pgd)), ttbr0_el1);
+        write_sysreg(phys_to_ttbr(virt_to_phys(pgdp)), ttbr0_el1);
         isb();
 
         *phys_dst_addr = virt_to_phys((void *)dst);
@@ -320,9 +320,9 @@ int swsusp_arch_suspend(void)
         return ret;
 }
 
-static void _copy_pte(pte_t *dst_pte, pte_t *src_pte, unsigned long addr)
+static void _copy_pte(pte_t *dst_ptep, pte_t *src_ptep, unsigned long addr)
 {
-        pte_t pte = *src_pte;
+        pte_t pte = READ_ONCE(*src_ptep);
 
         if (pte_valid(pte)) {
                 /*
@@ -330,7 +330,7 @@ static void _copy_pte(pte_t *dst_pte, pte_t *src_pte, unsigned long addr)
                  * read only (code, rodata). Clear the RDONLY bit from
                  * the temporary mappings we use during restore.
                  */
-                set_pte(dst_pte, pte_mkwrite(pte));
+                set_pte(dst_ptep, pte_mkwrite(pte));
         } else if (debug_pagealloc_enabled() && !pte_none(pte)) {
                 /*
                  * debug_pagealloc will removed the PTE_VALID bit if
@@ -343,112 +343,116 @@ static void _copy_pte(pte_t *dst_pte, pte_t *src_pte, unsigned long addr)
                  */
                 BUG_ON(!pfn_valid(pte_pfn(pte)));
 
-                set_pte(dst_pte, pte_mkpresent(pte_mkwrite(pte)));
+                set_pte(dst_ptep, pte_mkpresent(pte_mkwrite(pte)));
         }
 }
 
-static int copy_pte(pmd_t *dst_pmd, pmd_t *src_pmd, unsigned long start,
+static int copy_pte(pmd_t *dst_pmdp, pmd_t *src_pmdp, unsigned long start,
                     unsigned long end)
 {
-        pte_t *src_pte;
-        pte_t *dst_pte;
+        pte_t *src_ptep;
+        pte_t *dst_ptep;
         unsigned long addr = start;
 
-        dst_pte = (pte_t *)get_safe_page(GFP_ATOMIC);
-        if (!dst_pte)
+        dst_ptep = (pte_t *)get_safe_page(GFP_ATOMIC);
+        if (!dst_ptep)
                 return -ENOMEM;
-        pmd_populate_kernel(&init_mm, dst_pmd, dst_pte);
-        dst_pte = pte_offset_kernel(dst_pmd, start);
+        pmd_populate_kernel(&init_mm, dst_pmdp, dst_ptep);
+        dst_ptep = pte_offset_kernel(dst_pmdp, start);
 
-        src_pte = pte_offset_kernel(src_pmd, start);
+        src_ptep = pte_offset_kernel(src_pmdp, start);
         do {
-                _copy_pte(dst_pte, src_pte, addr);
-        } while (dst_pte++, src_pte++, addr += PAGE_SIZE, addr != end);
+                _copy_pte(dst_ptep, src_ptep, addr);
+        } while (dst_ptep++, src_ptep++, addr += PAGE_SIZE, addr != end);
 
         return 0;
 }
 
-static int copy_pmd(pud_t *dst_pud, pud_t *src_pud, unsigned long start,
+static int copy_pmd(pud_t *dst_pudp, pud_t *src_pudp, unsigned long start,
                     unsigned long end)
 {
-        pmd_t *src_pmd;
-        pmd_t *dst_pmd;
+        pmd_t *src_pmdp;
+        pmd_t *dst_pmdp;
         unsigned long next;
         unsigned long addr = start;
 
-        if (pud_none(*dst_pud)) {
-                dst_pmd = (pmd_t *)get_safe_page(GFP_ATOMIC);
-                if (!dst_pmd)
+        if (pud_none(READ_ONCE(*dst_pudp))) {
+                dst_pmdp = (pmd_t *)get_safe_page(GFP_ATOMIC);
+                if (!dst_pmdp)
                         return -ENOMEM;
-                pud_populate(&init_mm, dst_pud, dst_pmd);
+                pud_populate(&init_mm, dst_pudp, dst_pmdp);
         }
-        dst_pmd = pmd_offset(dst_pud, start);
+        dst_pmdp = pmd_offset(dst_pudp, start);
 
-        src_pmd = pmd_offset(src_pud, start);
+        src_pmdp = pmd_offset(src_pudp, start);
         do {
+                pmd_t pmd = READ_ONCE(*src_pmdp);
+
                 next = pmd_addr_end(addr, end);
-                if (pmd_none(*src_pmd))
+                if (pmd_none(pmd))
                         continue;
-                if (pmd_table(*src_pmd)) {
-                        if (copy_pte(dst_pmd, src_pmd, addr, next))
+                if (pmd_table(pmd)) {
+                        if (copy_pte(dst_pmdp, src_pmdp, addr, next))
                                 return -ENOMEM;
                 } else {
-                        set_pmd(dst_pmd,
-                                __pmd(pmd_val(*src_pmd) & ~PMD_SECT_RDONLY));
+                        set_pmd(dst_pmdp,
+                                __pmd(pmd_val(pmd) & ~PMD_SECT_RDONLY));
                 }
-        } while (dst_pmd++, src_pmd++, addr = next, addr != end);
+        } while (dst_pmdp++, src_pmdp++, addr = next, addr != end);
 
         return 0;
 }
 
-static int copy_pud(pgd_t *dst_pgd, pgd_t *src_pgd, unsigned long start,
+static int copy_pud(pgd_t *dst_pgdp, pgd_t *src_pgdp, unsigned long start,
                     unsigned long end)
 {
-        pud_t *dst_pud;
-        pud_t *src_pud;
+        pud_t *dst_pudp;
+        pud_t *src_pudp;
         unsigned long next;
         unsigned long addr = start;
 
-        if (pgd_none(*dst_pgd)) {
-                dst_pud = (pud_t *)get_safe_page(GFP_ATOMIC);
-                if (!dst_pud)
+        if (pgd_none(READ_ONCE(*dst_pgdp))) {
+                dst_pudp = (pud_t *)get_safe_page(GFP_ATOMIC);
+                if (!dst_pudp)
                         return -ENOMEM;
-                pgd_populate(&init_mm, dst_pgd, dst_pud);
+                pgd_populate(&init_mm, dst_pgdp, dst_pudp);
         }
-        dst_pud = pud_offset(dst_pgd, start);
+        dst_pudp = pud_offset(dst_pgdp, start);
 
-        src_pud = pud_offset(src_pgd, start);
+        src_pudp = pud_offset(src_pgdp, start);
         do {
+                pud_t pud = READ_ONCE(*src_pudp);
+
                 next = pud_addr_end(addr, end);
-                if (pud_none(*src_pud))
+                if (pud_none(pud))
                         continue;
-                if (pud_table(*(src_pud))) {
-                        if (copy_pmd(dst_pud, src_pud, addr, next))
+                if (pud_table(pud)) {
+                        if (copy_pmd(dst_pudp, src_pudp, addr, next))
                                 return -ENOMEM;
                 } else {
-                        set_pud(dst_pud,
-                                __pud(pud_val(*src_pud) & ~PMD_SECT_RDONLY));
+                        set_pud(dst_pudp,
+                                __pud(pud_val(pud) & ~PMD_SECT_RDONLY));
                 }
-        } while (dst_pud++, src_pud++, addr = next, addr != end);
+        } while (dst_pudp++, src_pudp++, addr = next, addr != end);
 
         return 0;
 }
 
-static int copy_page_tables(pgd_t *dst_pgd, unsigned long start,
+static int copy_page_tables(pgd_t *dst_pgdp, unsigned long start,
                             unsigned long end)
 {
         unsigned long next;
         unsigned long addr = start;
-        pgd_t *src_pgd = pgd_offset_k(start);
+        pgd_t *src_pgdp = pgd_offset_k(start);
 
-        dst_pgd = pgd_offset_raw(dst_pgd, start);
+        dst_pgdp = pgd_offset_raw(dst_pgdp, start);
         do {
                 next = pgd_addr_end(addr, end);
-                if (pgd_none(*src_pgd))
+                if (pgd_none(READ_ONCE(*src_pgdp)))
                         continue;
-                if (copy_pud(dst_pgd, src_pgd, addr, next))
+                if (copy_pud(dst_pgdp, src_pgdp, addr, next))
                         return -ENOMEM;
-        } while (dst_pgd++, src_pgd++, addr = next, addr != end);
+        } while (dst_pgdp++, src_pgdp++, addr = next, addr != end);
 
         return 0;
 }
diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index 116252a8d3a5..870f4b1587f9 100644
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -407,8 +407,10 @@ again:
                 u32 midr = read_cpuid_id();
 
                 /* Apply BTAC predictors mitigation to all Falkor chips */
-                if ((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR_V1)
+                if (((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR) ||
+                    ((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR_V1)) {
                         __qcom_hyp_sanitize_btac_predictors();
+                }
         }
 
         fp_enabled = __fpsimd_enabled();
diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
index 7b60d62ac593..65dfc8571bf8 100644
--- a/arch/arm64/mm/dump.c
+++ b/arch/arm64/mm/dump.c
@@ -286,48 +286,52 @@ static void note_page(struct pg_state *st, unsigned long addr, unsigned level,
 
 }
 
-static void walk_pte(struct pg_state *st, pmd_t *pmd, unsigned long start)
+static void walk_pte(struct pg_state *st, pmd_t *pmdp, unsigned long start)
 {
-        pte_t *pte = pte_offset_kernel(pmd, 0UL);
+        pte_t *ptep = pte_offset_kernel(pmdp, 0UL);
         unsigned long addr;
         unsigned i;
 
-        for (i = 0; i < PTRS_PER_PTE; i++, pte++) {
+        for (i = 0; i < PTRS_PER_PTE; i++, ptep++) {
                 addr = start + i * PAGE_SIZE;
-                note_page(st, addr, 4, pte_val(*pte));
+                note_page(st, addr, 4, READ_ONCE(pte_val(*ptep)));
         }
 }
 
-static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
+static void walk_pmd(struct pg_state *st, pud_t *pudp, unsigned long start)
 {
-        pmd_t *pmd = pmd_offset(pud, 0UL);
+        pmd_t *pmdp = pmd_offset(pudp, 0UL);
         unsigned long addr;
         unsigned i;
 
-        for (i = 0; i < PTRS_PER_PMD; i++, pmd++) {
+        for (i = 0; i < PTRS_PER_PMD; i++, pmdp++) {
+                pmd_t pmd = READ_ONCE(*pmdp);
+
                 addr = start + i * PMD_SIZE;
-                if (pmd_none(*pmd) || pmd_sect(*pmd)) {
-                        note_page(st, addr, 3, pmd_val(*pmd));
+                if (pmd_none(pmd) || pmd_sect(pmd)) {
+                        note_page(st, addr, 3, pmd_val(pmd));
                 } else {
-                        BUG_ON(pmd_bad(*pmd));
-                        walk_pte(st, pmd, addr);
+                        BUG_ON(pmd_bad(pmd));
+                        walk_pte(st, pmdp, addr);
                 }
         }
 }
 
-static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
+static void walk_pud(struct pg_state *st, pgd_t *pgdp, unsigned long start)
 {
-        pud_t *pud = pud_offset(pgd, 0UL);
+        pud_t *pudp = pud_offset(pgdp, 0UL);
         unsigned long addr;
         unsigned i;
 
-        for (i = 0; i < PTRS_PER_PUD; i++, pud++) {
+        for (i = 0; i < PTRS_PER_PUD; i++, pudp++) {
+                pud_t pud = READ_ONCE(*pudp);
+
                 addr = start + i * PUD_SIZE;
-                if (pud_none(*pud) || pud_sect(*pud)) {
-                        note_page(st, addr, 2, pud_val(*pud));
+                if (pud_none(pud) || pud_sect(pud)) {
+                        note_page(st, addr, 2, pud_val(pud));
                 } else {
-                        BUG_ON(pud_bad(*pud));
-                        walk_pmd(st, pud, addr);
+                        BUG_ON(pud_bad(pud));
+                        walk_pmd(st, pudp, addr);
                 }
         }
 }
@@ -335,17 +339,19 @@ static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
 static void walk_pgd(struct pg_state *st, struct mm_struct *mm,
                      unsigned long start)
 {
-        pgd_t *pgd = pgd_offset(mm, 0UL);
+        pgd_t *pgdp = pgd_offset(mm, 0UL);
         unsigned i;
         unsigned long addr;
 
-        for (i = 0; i < PTRS_PER_PGD; i++, pgd++) {
+        for (i = 0; i < PTRS_PER_PGD; i++, pgdp++) {
+                pgd_t pgd = READ_ONCE(*pgdp);
+
                 addr = start + i * PGDIR_SIZE;
-                if (pgd_none(*pgd)) {
-                        note_page(st, addr, 1, pgd_val(*pgd));
+                if (pgd_none(pgd)) {
+                        note_page(st, addr, 1, pgd_val(pgd));
                 } else {
-                        BUG_ON(pgd_bad(*pgd));
-                        walk_pud(st, pgd, addr);
+                        BUG_ON(pgd_bad(pgd));
+                        walk_pud(st, pgdp, addr);
                 }
         }
 }
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index f76bb2c3c943..bff11553eb05 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -130,7 +130,8 @@ static void mem_abort_decode(unsigned int esr)
 void show_pte(unsigned long addr)
 {
         struct mm_struct *mm;
-        pgd_t *pgd;
+        pgd_t *pgdp;
+        pgd_t pgd;
 
         if (addr < TASK_SIZE) {
                 /* TTBR0 */
@@ -149,33 +150,37 @@ void show_pte(unsigned long addr)
                 return;
         }
 
-        pr_alert("%s pgtable: %luk pages, %u-bit VAs, pgd = %p\n",
+        pr_alert("%s pgtable: %luk pages, %u-bit VAs, pgdp = %p\n",
                  mm == &init_mm ? "swapper" : "user", PAGE_SIZE / SZ_1K,
                  VA_BITS, mm->pgd);
-        pgd = pgd_offset(mm, addr);
-        pr_alert("[%016lx] *pgd=%016llx", addr, pgd_val(*pgd));
+        pgdp = pgd_offset(mm, addr);
+        pgd = READ_ONCE(*pgdp);
+        pr_alert("[%016lx] pgd=%016llx", addr, pgd_val(pgd));
 
         do {
-                pud_t *pud;
-                pmd_t *pmd;
-                pte_t *pte;
+                pud_t *pudp, pud;
+                pmd_t *pmdp, pmd;
+                pte_t *ptep, pte;
 
-                if (pgd_none(*pgd) || pgd_bad(*pgd))
+                if (pgd_none(pgd) || pgd_bad(pgd))
                         break;
 
-                pud = pud_offset(pgd, addr);
-                pr_cont(", *pud=%016llx", pud_val(*pud));
-                if (pud_none(*pud) || pud_bad(*pud))
+                pudp = pud_offset(pgdp, addr);
+                pud = READ_ONCE(*pudp);
+                pr_cont(", pud=%016llx", pud_val(pud));
+                if (pud_none(pud) || pud_bad(pud))
                         break;
 
-                pmd = pmd_offset(pud, addr);
-                pr_cont(", *pmd=%016llx", pmd_val(*pmd));
-                if (pmd_none(*pmd) || pmd_bad(*pmd))
+                pmdp = pmd_offset(pudp, addr);
+                pmd = READ_ONCE(*pmdp);
+                pr_cont(", pmd=%016llx", pmd_val(pmd));
+                if (pmd_none(pmd) || pmd_bad(pmd))
                         break;
 
-                pte = pte_offset_map(pmd, addr);
-                pr_cont(", *pte=%016llx", pte_val(*pte));
-                pte_unmap(pte);
+                ptep = pte_offset_map(pmdp, addr);
+                pte = READ_ONCE(*ptep);
+                pr_cont(", pte=%016llx", pte_val(pte));
+                pte_unmap(ptep);
         } while(0);
 
         pr_cont("\n");
@@ -196,8 +201,9 @@ int ptep_set_access_flags(struct vm_area_struct *vma,
                           pte_t entry, int dirty)
 {
         pteval_t old_pteval, pteval;
+        pte_t pte = READ_ONCE(*ptep);
 
-        if (pte_same(*ptep, entry))
+        if (pte_same(pte, entry))
                 return 0;
 
         /* only preserve the access flags and write permission */
@@ -210,7 +216,7 @@ int ptep_set_access_flags(struct vm_area_struct *vma,
          * (calculated as: a & b == ~(~a | ~b)).
          */
         pte_val(entry) ^= PTE_RDONLY;
-        pteval = READ_ONCE(pte_val(*ptep));
+        pteval = pte_val(pte);
         do {
                 old_pteval = pteval;
                 pteval ^= PTE_RDONLY;
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 6cb0fa92a651..ecc6818191df 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -54,14 +54,14 @@ static inline pgprot_t pte_pgprot(pte_t pte)
 static int find_num_contig(struct mm_struct *mm, unsigned long addr,
                            pte_t *ptep, size_t *pgsize)
 {
-        pgd_t *pgd = pgd_offset(mm, addr);
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp = pgd_offset(mm, addr);
+        pud_t *pudp;
+        pmd_t *pmdp;
 
         *pgsize = PAGE_SIZE;
-        pud = pud_offset(pgd, addr);
-        pmd = pmd_offset(pud, addr);
-        if ((pte_t *)pmd == ptep) {
+        pudp = pud_offset(pgdp, addr);
+        pmdp = pmd_offset(pudp, addr);
+        if ((pte_t *)pmdp == ptep) {
                 *pgsize = PMD_SIZE;
                 return CONT_PMDS;
         }
@@ -181,11 +181,8 @@ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
 
         clear_flush(mm, addr, ptep, pgsize, ncontig);
 
-        for (i = 0; i < ncontig; i++, ptep++, addr += pgsize, pfn += dpfn) {
-                pr_debug("%s: set pte %p to 0x%llx\n", __func__, ptep,
-                         pte_val(pfn_pte(pfn, hugeprot)));
+        for (i = 0; i < ncontig; i++, ptep++, addr += pgsize, pfn += dpfn)
                 set_pte_at(mm, addr, ptep, pfn_pte(pfn, hugeprot));
-        }
 }
 
 void set_huge_swap_pte_at(struct mm_struct *mm, unsigned long addr,
@@ -203,20 +200,20 @@ void set_huge_swap_pte_at(struct mm_struct *mm, unsigned long addr,
 pte_t *huge_pte_alloc(struct mm_struct *mm,
                       unsigned long addr, unsigned long sz)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pte_t *pte = NULL;
-
-        pr_debug("%s: addr:0x%lx sz:0x%lx\n", __func__, addr, sz);
-        pgd = pgd_offset(mm, addr);
-        pud = pud_alloc(mm, pgd, addr);
-        if (!pud)
+        pgd_t *pgdp;
+        pud_t *pudp;
+        pmd_t *pmdp;
+        pte_t *ptep = NULL;
+
+        pgdp = pgd_offset(mm, addr);
+        pudp = pud_alloc(mm, pgdp, addr);
+        if (!pudp)
                 return NULL;
 
         if (sz == PUD_SIZE) {
-                pte = (pte_t *)pud;
+                ptep = (pte_t *)pudp;
         } else if (sz == (PAGE_SIZE * CONT_PTES)) {
-                pmd_t *pmd = pmd_alloc(mm, pud, addr);
+                pmdp = pmd_alloc(mm, pudp, addr);
 
                 WARN_ON(addr & (sz - 1));
                 /*
@@ -226,60 +223,55 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
                  * will be no pte_unmap() to correspond with this
                  * pte_alloc_map().
                  */
-                pte = pte_alloc_map(mm, pmd, addr);
+                ptep = pte_alloc_map(mm, pmdp, addr);
         } else if (sz == PMD_SIZE) {
                 if (IS_ENABLED(CONFIG_ARCH_WANT_HUGE_PMD_SHARE) &&
-                    pud_none(*pud))
-                        pte = huge_pmd_share(mm, addr, pud);
+                    pud_none(READ_ONCE(*pudp)))
+                        ptep = huge_pmd_share(mm, addr, pudp);
                 else
-                        pte = (pte_t *)pmd_alloc(mm, pud, addr);
+                        ptep = (pte_t *)pmd_alloc(mm, pudp, addr);
         } else if (sz == (PMD_SIZE * CONT_PMDS)) {
-                pmd_t *pmd;
-
-                pmd = pmd_alloc(mm, pud, addr);
+                pmdp = pmd_alloc(mm, pudp, addr);
                 WARN_ON(addr & (sz - 1));
-                return (pte_t *)pmd;
+                return (pte_t *)pmdp;
         }
 
-        pr_debug("%s: addr:0x%lx sz:0x%lx ret pte=%p/0x%llx\n", __func__, addr,
-               sz, pte, pte_val(*pte));
-        return pte;
+        return ptep;
 }
 
 pte_t *huge_pte_offset(struct mm_struct *mm,
                        unsigned long addr, unsigned long sz)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp;
+        pud_t *pudp, pud;
+        pmd_t *pmdp, pmd;
 
-        pgd = pgd_offset(mm, addr);
-        pr_debug("%s: addr:0x%lx pgd:%p\n", __func__, addr, pgd);
-        if (!pgd_present(*pgd))
+        pgdp = pgd_offset(mm, addr);
+        if (!pgd_present(READ_ONCE(*pgdp)))
                 return NULL;
 
-        pud = pud_offset(pgd, addr);
-        if (sz != PUD_SIZE && pud_none(*pud))
+        pudp = pud_offset(pgdp, addr);
+        pud = READ_ONCE(*pudp);
+        if (sz != PUD_SIZE && pud_none(pud))
                 return NULL;
         /* hugepage or swap? */
-        if (pud_huge(*pud) || !pud_present(*pud))
-                return (pte_t *)pud;
+        if (pud_huge(pud) || !pud_present(pud))
+                return (pte_t *)pudp;
         /* table; check the next level */
 
         if (sz == CONT_PMD_SIZE)
                 addr &= CONT_PMD_MASK;
 
-        pmd = pmd_offset(pud, addr);
+        pmdp = pmd_offset(pudp, addr);
+        pmd = READ_ONCE(*pmdp);
         if (!(sz == PMD_SIZE || sz == CONT_PMD_SIZE) &&
-            pmd_none(*pmd))
+            pmd_none(pmd))
                 return NULL;
-        if (pmd_huge(*pmd) || !pmd_present(*pmd))
-                return (pte_t *)pmd;
+        if (pmd_huge(pmd) || !pmd_present(pmd))
+                return (pte_t *)pmdp;
 
-        if (sz == CONT_PTE_SIZE) {
-                pte_t *pte = pte_offset_kernel(pmd, (addr & CONT_PTE_MASK));
-                return pte;
-        }
+        if (sz == CONT_PTE_SIZE)
+                return pte_offset_kernel(pmdp, (addr & CONT_PTE_MASK));
 
         return NULL;
 }
@@ -367,7 +359,7 @@ void huge_ptep_set_wrprotect(struct mm_struct *mm,
         size_t pgsize;
         pte_t pte;
 
-        if (!pte_cont(*ptep)) {
+        if (!pte_cont(READ_ONCE(*ptep))) {
                 ptep_set_wrprotect(mm, addr, ptep);
                 return;
         }
@@ -391,7 +383,7 @@ void huge_ptep_clear_flush(struct vm_area_struct *vma,
         size_t pgsize;
         int ncontig;
 
-        if (!pte_cont(*ptep)) {
+        if (!pte_cont(READ_ONCE(*ptep))) {
                 ptep_clear_flush(vma, addr, ptep);
                 return;
         }
diff --git a/arch/arm64/mm/kasan_init.c b/arch/arm64/mm/kasan_init.c
index 6e02e6fb4c7b..dabfc1ecda3d 100644
--- a/arch/arm64/mm/kasan_init.c
+++ b/arch/arm64/mm/kasan_init.c
@@ -44,92 +44,92 @@ static phys_addr_t __init kasan_alloc_zeroed_page(int node)
         return __pa(p);
 }
 
-static pte_t *__init kasan_pte_offset(pmd_t *pmd, unsigned long addr, int node,
+static pte_t *__init kasan_pte_offset(pmd_t *pmdp, unsigned long addr, int node,
                                       bool early)
 {
-        if (pmd_none(*pmd)) {
+        if (pmd_none(READ_ONCE(*pmdp))) {
                 phys_addr_t pte_phys = early ? __pa_symbol(kasan_zero_pte)
                                              : kasan_alloc_zeroed_page(node);
-                __pmd_populate(pmd, pte_phys, PMD_TYPE_TABLE);
+                __pmd_populate(pmdp, pte_phys, PMD_TYPE_TABLE);
         }
 
-        return early ? pte_offset_kimg(pmd, addr)
-                     : pte_offset_kernel(pmd, addr);
+        return early ? pte_offset_kimg(pmdp, addr)
+                     : pte_offset_kernel(pmdp, addr);
 }
 
-static pmd_t *__init kasan_pmd_offset(pud_t *pud, unsigned long addr, int node,
+static pmd_t *__init kasan_pmd_offset(pud_t *pudp, unsigned long addr, int node,
                                       bool early)
 {
-        if (pud_none(*pud)) {
+        if (pud_none(READ_ONCE(*pudp))) {
                 phys_addr_t pmd_phys = early ? __pa_symbol(kasan_zero_pmd)
                                              : kasan_alloc_zeroed_page(node);
-                __pud_populate(pud, pmd_phys, PMD_TYPE_TABLE);
+                __pud_populate(pudp, pmd_phys, PMD_TYPE_TABLE);
         }
 
-        return early ? pmd_offset_kimg(pud, addr) : pmd_offset(pud, addr);
+        return early ? pmd_offset_kimg(pudp, addr) : pmd_offset(pudp, addr);
 }
 
-static pud_t *__init kasan_pud_offset(pgd_t *pgd, unsigned long addr, int node,
+static pud_t *__init kasan_pud_offset(pgd_t *pgdp, unsigned long addr, int node,
                                       bool early)
 {
-        if (pgd_none(*pgd)) {
+        if (pgd_none(READ_ONCE(*pgdp))) {
                 phys_addr_t pud_phys = early ? __pa_symbol(kasan_zero_pud)
                                              : kasan_alloc_zeroed_page(node);
-                __pgd_populate(pgd, pud_phys, PMD_TYPE_TABLE);
+                __pgd_populate(pgdp, pud_phys, PMD_TYPE_TABLE);
         }
 
-        return early ? pud_offset_kimg(pgd, addr) : pud_offset(pgd, addr);
+        return early ? pud_offset_kimg(pgdp, addr) : pud_offset(pgdp, addr);
 }
 
-static void __init kasan_pte_populate(pmd_t *pmd, unsigned long addr,
+static void __init kasan_pte_populate(pmd_t *pmdp, unsigned long addr,
                                       unsigned long end, int node, bool early)
 {
         unsigned long next;
-        pte_t *pte = kasan_pte_offset(pmd, addr, node, early);
+        pte_t *ptep = kasan_pte_offset(pmdp, addr, node, early);
 
         do {
                 phys_addr_t page_phys = early ? __pa_symbol(kasan_zero_page)
                                               : kasan_alloc_zeroed_page(node);
                 next = addr + PAGE_SIZE;
-                set_pte(pte, pfn_pte(__phys_to_pfn(page_phys), PAGE_KERNEL));
-        } while (pte++, addr = next, addr != end && pte_none(*pte));
+                set_pte(ptep, pfn_pte(__phys_to_pfn(page_phys), PAGE_KERNEL));
+        } while (ptep++, addr = next, addr != end && pte_none(READ_ONCE(*ptep)));
 }
 
-static void __init kasan_pmd_populate(pud_t *pud, unsigned long addr,
+static void __init kasan_pmd_populate(pud_t *pudp, unsigned long addr,
                                       unsigned long end, int node, bool early)
 {
         unsigned long next;
-        pmd_t *pmd = kasan_pmd_offset(pud, addr, node, early);
+        pmd_t *pmdp = kasan_pmd_offset(pudp, addr, node, early);
 
         do {
                 next = pmd_addr_end(addr, end);
-                kasan_pte_populate(pmd, addr, next, node, early);
-        } while (pmd++, addr = next, addr != end && pmd_none(*pmd));
+                kasan_pte_populate(pmdp, addr, next, node, early);
+        } while (pmdp++, addr = next, addr != end && pmd_none(READ_ONCE(*pmdp)));
 }
 
-static void __init kasan_pud_populate(pgd_t *pgd, unsigned long addr,
+static void __init kasan_pud_populate(pgd_t *pgdp, unsigned long addr,
                                       unsigned long end, int node, bool early)
 {
         unsigned long next;
-        pud_t *pud = kasan_pud_offset(pgd, addr, node, early);
+        pud_t *pudp = kasan_pud_offset(pgdp, addr, node, early);
 
         do {
                 next = pud_addr_end(addr, end);
-                kasan_pmd_populate(pud, addr, next, node, early);
-        } while (pud++, addr = next, addr != end && pud_none(*pud));
+                kasan_pmd_populate(pudp, addr, next, node, early);
+        } while (pudp++, addr = next, addr != end && pud_none(READ_ONCE(*pudp)));
 }
 
 static void __init kasan_pgd_populate(unsigned long addr, unsigned long end,
                                       int node, bool early)
 {
         unsigned long next;
-        pgd_t *pgd;
+        pgd_t *pgdp;
 
-        pgd = pgd_offset_k(addr);
+        pgdp = pgd_offset_k(addr);
         do {
                 next = pgd_addr_end(addr, end);
-                kasan_pud_populate(pgd, addr, next, node, early);
-        } while (pgd++, addr = next, addr != end);
+                kasan_pud_populate(pgdp, addr, next, node, early);
+        } while (pgdp++, addr = next, addr != end);
 }
 
 /* The early shadow maps everything to a single page of zeroes */
@@ -155,14 +155,14 @@ static void __init kasan_map_populate(unsigned long start, unsigned long end,
  */
 void __init kasan_copy_shadow(pgd_t *pgdir)
 {
-        pgd_t *pgd, *pgd_new, *pgd_end;
+        pgd_t *pgdp, *pgdp_new, *pgdp_end;
 
-        pgd = pgd_offset_k(KASAN_SHADOW_START);
-        pgd_end = pgd_offset_k(KASAN_SHADOW_END);
-        pgd_new = pgd_offset_raw(pgdir, KASAN_SHADOW_START);
+        pgdp = pgd_offset_k(KASAN_SHADOW_START);
+        pgdp_end = pgd_offset_k(KASAN_SHADOW_END);
+        pgdp_new = pgd_offset_raw(pgdir, KASAN_SHADOW_START);
         do {
-                set_pgd(pgd_new, *pgd);
-        } while (pgd++, pgd_new++, pgd != pgd_end);
+                set_pgd(pgdp_new, READ_ONCE(*pgdp));
+        } while (pgdp++, pgdp_new++, pgdp != pgdp_end);
 }
 
 static void __init clear_pgds(unsigned long start,
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 4694cda823c9..3161b853f29e 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -125,45 +125,48 @@ static bool pgattr_change_is_safe(u64 old, u64 new)
         return ((old ^ new) & ~mask) == 0;
 }
 
-static void init_pte(pmd_t *pmd, unsigned long addr, unsigned long end,
+static void init_pte(pmd_t *pmdp, unsigned long addr, unsigned long end,
                      phys_addr_t phys, pgprot_t prot)
 {
-        pte_t *pte;
+        pte_t *ptep;
 
-        pte = pte_set_fixmap_offset(pmd, addr);
+        ptep = pte_set_fixmap_offset(pmdp, addr);
         do {
-                pte_t old_pte = *pte;
+                pte_t old_pte = READ_ONCE(*ptep);
 
-                set_pte(pte, pfn_pte(__phys_to_pfn(phys), prot));
+                set_pte(ptep, pfn_pte(__phys_to_pfn(phys), prot));
 
                 /*
                  * After the PTE entry has been populated once, we
                  * only allow updates to the permission attributes.
                  */
-                BUG_ON(!pgattr_change_is_safe(pte_val(old_pte), pte_val(*pte)));
+                BUG_ON(!pgattr_change_is_safe(pte_val(old_pte),
+                                              READ_ONCE(pte_val(*ptep))));
 
                 phys += PAGE_SIZE;
-        } while (pte++, addr += PAGE_SIZE, addr != end);
+        } while (ptep++, addr += PAGE_SIZE, addr != end);
 
         pte_clear_fixmap();
 }
 
-static void alloc_init_cont_pte(pmd_t *pmd, unsigned long addr,
+static void alloc_init_cont_pte(pmd_t *pmdp, unsigned long addr,
                                 unsigned long end, phys_addr_t phys,
                                 pgprot_t prot,
                                 phys_addr_t (*pgtable_alloc)(void),
                                 int flags)
 {
         unsigned long next;
+        pmd_t pmd = READ_ONCE(*pmdp);
 
-        BUG_ON(pmd_sect(*pmd));
-        if (pmd_none(*pmd)) {
+        BUG_ON(pmd_sect(pmd));
+        if (pmd_none(pmd)) {
                 phys_addr_t pte_phys;
                 BUG_ON(!pgtable_alloc);
                 pte_phys = pgtable_alloc();
-                __pmd_populate(pmd, pte_phys, PMD_TYPE_TABLE);
+                __pmd_populate(pmdp, pte_phys, PMD_TYPE_TABLE);
+                pmd = READ_ONCE(*pmdp);
         }
-        BUG_ON(pmd_bad(*pmd));
+        BUG_ON(pmd_bad(pmd));
 
         do {
                 pgprot_t __prot = prot;
@@ -175,67 +178,69 @@ static void alloc_init_cont_pte(pmd_t *pmd, unsigned long addr,
                     (flags & NO_CONT_MAPPINGS) == 0)
                         __prot = __pgprot(pgprot_val(prot) | PTE_CONT);
 
-                init_pte(pmd, addr, next, phys, __prot);
+                init_pte(pmdp, addr, next, phys, __prot);
 
                 phys += next - addr;
         } while (addr = next, addr != end);
 }
 
-static void init_pmd(pud_t *pud, unsigned long addr, unsigned long end,
+static void init_pmd(pud_t *pudp, unsigned long addr, unsigned long end,
                      phys_addr_t phys, pgprot_t prot,
                      phys_addr_t (*pgtable_alloc)(void), int flags)
 {
         unsigned long next;
-        pmd_t *pmd;
+        pmd_t *pmdp;
 
-        pmd = pmd_set_fixmap_offset(pud, addr);
+        pmdp = pmd_set_fixmap_offset(pudp, addr);
         do {
-                pmd_t old_pmd = *pmd;
+                pmd_t old_pmd = READ_ONCE(*pmdp);
 
                 next = pmd_addr_end(addr, end);
 
                 /* try section mapping first */
                 if (((addr | next | phys) & ~SECTION_MASK) == 0 &&
                     (flags & NO_BLOCK_MAPPINGS) == 0) {
-                        pmd_set_huge(pmd, phys, prot);
+                        pmd_set_huge(pmdp, phys, prot);
 
                         /*
                          * After the PMD entry has been populated once, we
                          * only allow updates to the permission attributes.
                          */
                         BUG_ON(!pgattr_change_is_safe(pmd_val(old_pmd),
-                                                      pmd_val(*pmd)));
+                                                      READ_ONCE(pmd_val(*pmdp))));
                 } else {
-                        alloc_init_cont_pte(pmd, addr, next, phys, prot,
+                        alloc_init_cont_pte(pmdp, addr, next, phys, prot,
                                             pgtable_alloc, flags);
 
                         BUG_ON(pmd_val(old_pmd) != 0 &&
-                               pmd_val(old_pmd) != pmd_val(*pmd));
+                               pmd_val(old_pmd) != READ_ONCE(pmd_val(*pmdp)));
                 }
                 phys += next - addr;
-        } while (pmd++, addr = next, addr != end);
+        } while (pmdp++, addr = next, addr != end);
 
         pmd_clear_fixmap();
 }
 
-static void alloc_init_cont_pmd(pud_t *pud, unsigned long addr,
+static void alloc_init_cont_pmd(pud_t *pudp, unsigned long addr,
                                 unsigned long end, phys_addr_t phys,
                                 pgprot_t prot,
                                 phys_addr_t (*pgtable_alloc)(void), int flags)
 {
         unsigned long next;
+        pud_t pud = READ_ONCE(*pudp);
 
         /*
          * Check for initial section mappings in the pgd/pud.
          */
-        BUG_ON(pud_sect(*pud));
-        if (pud_none(*pud)) {
+        BUG_ON(pud_sect(pud));
+        if (pud_none(pud)) {
                 phys_addr_t pmd_phys;
                 BUG_ON(!pgtable_alloc);
                 pmd_phys = pgtable_alloc();
-                __pud_populate(pud, pmd_phys, PUD_TYPE_TABLE);
+                __pud_populate(pudp, pmd_phys, PUD_TYPE_TABLE);
+                pud = READ_ONCE(*pudp);
         }
-        BUG_ON(pud_bad(*pud));
+        BUG_ON(pud_bad(pud));
 
         do {
                 pgprot_t __prot = prot;
@@ -247,7 +252,7 @@ static void alloc_init_cont_pmd(pud_t *pud, unsigned long addr,
                     (flags & NO_CONT_MAPPINGS) == 0)
                         __prot = __pgprot(pgprot_val(prot) | PTE_CONT);
 
-                init_pmd(pud, addr, next, phys, __prot, pgtable_alloc, flags);
+                init_pmd(pudp, addr, next, phys, __prot, pgtable_alloc, flags);
 
                 phys += next - addr;
         } while (addr = next, addr != end);
@@ -265,25 +270,27 @@ static inline bool use_1G_block(unsigned long addr, unsigned long next,
         return true;
 }
 
-static void alloc_init_pud(pgd_t *pgd, unsigned long addr, unsigned long end,
-                                  phys_addr_t phys, pgprot_t prot,
-                                  phys_addr_t (*pgtable_alloc)(void),
-                                  int flags)
+static void alloc_init_pud(pgd_t *pgdp, unsigned long addr, unsigned long end,
+                           phys_addr_t phys, pgprot_t prot,
+                           phys_addr_t (*pgtable_alloc)(void),
+                           int flags)
 {
-        pud_t *pud;
         unsigned long next;
+        pud_t *pudp;
+        pgd_t pgd = READ_ONCE(*pgdp);
 
-        if (pgd_none(*pgd)) {
+        if (pgd_none(pgd)) {
                 phys_addr_t pud_phys;
                 BUG_ON(!pgtable_alloc);
                 pud_phys = pgtable_alloc();
-                __pgd_populate(pgd, pud_phys, PUD_TYPE_TABLE);
+                __pgd_populate(pgdp, pud_phys, PUD_TYPE_TABLE);
+                pgd = READ_ONCE(*pgdp);
         }
-        BUG_ON(pgd_bad(*pgd));
+        BUG_ON(pgd_bad(pgd));
 
-        pud = pud_set_fixmap_offset(pgd, addr);
+        pudp = pud_set_fixmap_offset(pgdp, addr);
         do {
-                pud_t old_pud = *pud;
+                pud_t old_pud = READ_ONCE(*pudp);
 
                 next = pud_addr_end(addr, end);
 
@@ -292,23 +299,23 @@ static void alloc_init_pud(pgd_t *pgd, unsigned long addr, unsigned long end,
                  */
                 if (use_1G_block(addr, next, phys) &&
                     (flags & NO_BLOCK_MAPPINGS) == 0) {
-                        pud_set_huge(pud, phys, prot);
+                        pud_set_huge(pudp, phys, prot);
 
                         /*
                          * After the PUD entry has been populated once, we
                          * only allow updates to the permission attributes.
                          */
                         BUG_ON(!pgattr_change_is_safe(pud_val(old_pud),
-                                                      pud_val(*pud)));
+                                                      READ_ONCE(pud_val(*pudp))));
                 } else {
-                        alloc_init_cont_pmd(pud, addr, next, phys, prot,
+                        alloc_init_cont_pmd(pudp, addr, next, phys, prot,
                                             pgtable_alloc, flags);
 
                         BUG_ON(pud_val(old_pud) != 0 &&
-                               pud_val(old_pud) != pud_val(*pud));
+                               pud_val(old_pud) != READ_ONCE(pud_val(*pudp)));
                 }
                 phys += next - addr;
-        } while (pud++, addr = next, addr != end);
+        } while (pudp++, addr = next, addr != end);
 
         pud_clear_fixmap();
 }
@@ -320,7 +327,7 @@ static void __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys,
                                  int flags)
 {
         unsigned long addr, length, end, next;
-        pgd_t *pgd = pgd_offset_raw(pgdir, virt);
+        pgd_t *pgdp = pgd_offset_raw(pgdir, virt);
 
         /*
          * If the virtual and physical address don't have the same offset
@@ -336,10 +343,10 @@ static void __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys,
         end = addr + length;
         do {
                 next = pgd_addr_end(addr, end);
-                alloc_init_pud(pgd, addr, next, phys, prot, pgtable_alloc,
+                alloc_init_pud(pgdp, addr, next, phys, prot, pgtable_alloc,
                                flags);
                 phys += next - addr;
-        } while (pgd++, addr = next, addr != end);
+        } while (pgdp++, addr = next, addr != end);
 }
 
 static phys_addr_t pgd_pgtable_alloc(void)
@@ -401,10 +408,10 @@ static void update_mapping_prot(phys_addr_t phys, unsigned long virt,
         flush_tlb_kernel_range(virt, virt + size);
 }
 
-static void __init __map_memblock(pgd_t *pgd, phys_addr_t start,
+static void __init __map_memblock(pgd_t *pgdp, phys_addr_t start,
                                   phys_addr_t end, pgprot_t prot, int flags)
 {
-        __create_pgd_mapping(pgd, start, __phys_to_virt(start), end - start,
+        __create_pgd_mapping(pgdp, start, __phys_to_virt(start), end - start,
                              prot, early_pgtable_alloc, flags);
 }
 
@@ -418,7 +425,7 @@ void __init mark_linear_text_alias_ro(void)
                             PAGE_KERNEL_RO);
 }
 
-static void __init map_mem(pgd_t *pgd)
+static void __init map_mem(pgd_t *pgdp)
 {
         phys_addr_t kernel_start = __pa_symbol(_text);
         phys_addr_t kernel_end = __pa_symbol(__init_begin);
@@ -451,7 +458,7 @@ static void __init map_mem(pgd_t *pgd)
                 if (memblock_is_nomap(reg))
                         continue;
 
-                __map_memblock(pgd, start, end, PAGE_KERNEL, flags);
+                __map_memblock(pgdp, start, end, PAGE_KERNEL, flags);
         }
 
         /*
@@ -464,7 +471,7 @@ static void __init map_mem(pgd_t *pgd)
          * Note that contiguous mappings cannot be remapped in this way,
          * so we should avoid them here.
          */
-        __map_memblock(pgd, kernel_start, kernel_end,
+        __map_memblock(pgdp, kernel_start, kernel_end,
                        PAGE_KERNEL, NO_CONT_MAPPINGS);
         memblock_clear_nomap(kernel_start, kernel_end - kernel_start);
 
@@ -475,7 +482,7 @@ static void __init map_mem(pgd_t *pgd)
          * through /sys/kernel/kexec_crash_size interface.
          */
         if (crashk_res.end) {
-                __map_memblock(pgd, crashk_res.start, crashk_res.end + 1,
+                __map_memblock(pgdp, crashk_res.start, crashk_res.end + 1,
                                PAGE_KERNEL,
                                NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS);
                 memblock_clear_nomap(crashk_res.start,
@@ -499,7 +506,7 @@ void mark_rodata_ro(void)
         debug_checkwx();
 }
 
-static void __init map_kernel_segment(pgd_t *pgd, void *va_start, void *va_end,
+static void __init map_kernel_segment(pgd_t *pgdp, void *va_start, void *va_end,
                                       pgprot_t prot, struct vm_struct *vma,
                                       int flags, unsigned long vm_flags)
 {
@@ -509,7 +516,7 @@ static void __init map_kernel_segment(pgd_t *pgd, void *va_start, void *va_end,
         BUG_ON(!PAGE_ALIGNED(pa_start));
         BUG_ON(!PAGE_ALIGNED(size));
 
-        __create_pgd_mapping(pgd, pa_start, (unsigned long)va_start, size, prot,
+        __create_pgd_mapping(pgdp, pa_start, (unsigned long)va_start, size, prot,
                              early_pgtable_alloc, flags);
 
         if (!(vm_flags & VM_NO_GUARD))
@@ -562,7 +569,7 @@ core_initcall(map_entry_trampoline);
 /*
  * Create fine-grained mappings for the kernel.
  */
-static void __init map_kernel(pgd_t *pgd)
+static void __init map_kernel(pgd_t *pgdp)
 {
         static struct vm_struct vmlinux_text, vmlinux_rodata, vmlinux_inittext,
                                 vmlinux_initdata, vmlinux_data;
@@ -578,24 +585,24 @@ static void __init map_kernel(pgd_t *pgd)
          * Only rodata will be remapped with different permissions later on,
          * all other segments are allowed to use contiguous mappings.
          */
-        map_kernel_segment(pgd, _text, _etext, text_prot, &vmlinux_text, 0,
+        map_kernel_segment(pgdp, _text, _etext, text_prot, &vmlinux_text, 0,
                            VM_NO_GUARD);
-        map_kernel_segment(pgd, __start_rodata, __inittext_begin, PAGE_KERNEL,
+        map_kernel_segment(pgdp, __start_rodata, __inittext_begin, PAGE_KERNEL,
                            &vmlinux_rodata, NO_CONT_MAPPINGS, VM_NO_GUARD);
-        map_kernel_segment(pgd, __inittext_begin, __inittext_end, text_prot,
+        map_kernel_segment(pgdp, __inittext_begin, __inittext_end, text_prot,
                            &vmlinux_inittext, 0, VM_NO_GUARD);
-        map_kernel_segment(pgd, __initdata_begin, __initdata_end, PAGE_KERNEL,
+        map_kernel_segment(pgdp, __initdata_begin, __initdata_end, PAGE_KERNEL,
                            &vmlinux_initdata, 0, VM_NO_GUARD);
-        map_kernel_segment(pgd, _data, _end, PAGE_KERNEL, &vmlinux_data, 0, 0);
+        map_kernel_segment(pgdp, _data, _end, PAGE_KERNEL, &vmlinux_data, 0, 0);
 
-        if (!pgd_val(*pgd_offset_raw(pgd, FIXADDR_START))) {
+        if (!READ_ONCE(pgd_val(*pgd_offset_raw(pgdp, FIXADDR_START)))) {
                 /*
                  * The fixmap falls in a separate pgd to the kernel, and doesn't
                  * live in the carveout for the swapper_pg_dir. We can simply
                  * re-use the existing dir for the fixmap.
                  */
-                set_pgd(pgd_offset_raw(pgd, FIXADDR_START),
-                        *pgd_offset_k(FIXADDR_START));
+                set_pgd(pgd_offset_raw(pgdp, FIXADDR_START),
+                        READ_ONCE(*pgd_offset_k(FIXADDR_START)));
         } else if (CONFIG_PGTABLE_LEVELS > 3) {
                 /*
                  * The fixmap shares its top level pgd entry with the kernel
@@ -604,14 +611,15 @@ static void __init map_kernel(pgd_t *pgd)
                  * entry instead.
                  */
                 BUG_ON(!IS_ENABLED(CONFIG_ARM64_16K_PAGES));
-                pud_populate(&init_mm, pud_set_fixmap_offset(pgd, FIXADDR_START),
+                pud_populate(&init_mm,
+                             pud_set_fixmap_offset(pgdp, FIXADDR_START),
                              lm_alias(bm_pmd));
                 pud_clear_fixmap();
         } else {
                 BUG();
         }
 
-        kasan_copy_shadow(pgd);
+        kasan_copy_shadow(pgdp);
 }
 
 /*
@@ -621,10 +629,10 @@ static void __init map_kernel(pgd_t *pgd)
 void __init paging_init(void)
 {
         phys_addr_t pgd_phys = early_pgtable_alloc();
-        pgd_t *pgd = pgd_set_fixmap(pgd_phys);
+        pgd_t *pgdp = pgd_set_fixmap(pgd_phys);
 
-        map_kernel(pgd);
-        map_mem(pgd);
+        map_kernel(pgdp);
+        map_mem(pgdp);
 
         /*
          * We want to reuse the original swapper_pg_dir so we don't have to
@@ -635,7 +643,7 @@ void __init paging_init(void)
          * To do this we need to go via a temporary pgd.
          */
         cpu_replace_ttbr1(__va(pgd_phys));
-        memcpy(swapper_pg_dir, pgd, PGD_SIZE);
+        memcpy(swapper_pg_dir, pgdp, PGD_SIZE);
         cpu_replace_ttbr1(lm_alias(swapper_pg_dir));
 
         pgd_clear_fixmap();
@@ -655,37 +663,40 @@ void __init paging_init(void)
  */
 int kern_addr_valid(unsigned long addr)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
+        pgd_t *pgdp;
+        pud_t *pudp, pud;
+        pmd_t *pmdp, pmd;
+        pte_t *ptep, pte;
 
         if ((((long)addr) >> VA_BITS) != -1UL)
                 return 0;
 
-        pgd = pgd_offset_k(addr);
-        if (pgd_none(*pgd))
+        pgdp = pgd_offset_k(addr);
+        if (pgd_none(READ_ONCE(*pgdp)))
                 return 0;
 
-        pud = pud_offset(pgd, addr);
-        if (pud_none(*pud))
+        pudp = pud_offset(pgdp, addr);
+        pud = READ_ONCE(*pudp);
+        if (pud_none(pud))
                 return 0;
 
-        if (pud_sect(*pud))
-                return pfn_valid(pud_pfn(*pud));
+        if (pud_sect(pud))
+                return pfn_valid(pud_pfn(pud));
 
-        pmd = pmd_offset(pud, addr);
-        if (pmd_none(*pmd))
+        pmdp = pmd_offset(pudp, addr);
+        pmd = READ_ONCE(*pmdp);
+        if (pmd_none(pmd))
                 return 0;
 
-        if (pmd_sect(*pmd))
-                return pfn_valid(pmd_pfn(*pmd));
+        if (pmd_sect(pmd))
+                return pfn_valid(pmd_pfn(pmd));
 
-        pte = pte_offset_kernel(pmd, addr);
-        if (pte_none(*pte))
+        ptep = pte_offset_kernel(pmdp, addr);
+        pte = READ_ONCE(*ptep);
+        if (pte_none(pte))
                 return 0;
 
-        return pfn_valid(pte_pfn(*pte));
+        return pfn_valid(pte_pfn(pte));
 }
 #ifdef CONFIG_SPARSEMEM_VMEMMAP
 #if !ARM64_SWAPPER_USES_SECTION_MAPS
@@ -700,32 +711,32 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,
 {
         unsigned long addr = start;
         unsigned long next;
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp;
+        pud_t *pudp;
+        pmd_t *pmdp;
 
         do {
                 next = pmd_addr_end(addr, end);
 
-                pgd = vmemmap_pgd_populate(addr, node);
-                if (!pgd)
+                pgdp = vmemmap_pgd_populate(addr, node);
+                if (!pgdp)
                         return -ENOMEM;
 
-                pud = vmemmap_pud_populate(pgd, addr, node);
-                if (!pud)
+                pudp = vmemmap_pud_populate(pgdp, addr, node);
+                if (!pudp)
                         return -ENOMEM;
 
-                pmd = pmd_offset(pud, addr);
-                if (pmd_none(*pmd)) {
+                pmdp = pmd_offset(pudp, addr);
+                if (pmd_none(READ_ONCE(*pmdp))) {
                         void *p = NULL;
 
                         p = vmemmap_alloc_block_buf(PMD_SIZE, node);
                         if (!p)
                                 return -ENOMEM;
 
-                        pmd_set_huge(pmd, __pa(p), __pgprot(PROT_SECT_NORMAL));
+                        pmd_set_huge(pmdp, __pa(p), __pgprot(PROT_SECT_NORMAL));
                 } else
-                        vmemmap_verify((pte_t *)pmd, node, addr, next);
+                        vmemmap_verify((pte_t *)pmdp, node, addr, next);
         } while (addr = next, addr != end);
 
         return 0;
@@ -739,20 +750,22 @@ void vmemmap_free(unsigned long start, unsigned long end,
 
 static inline pud_t * fixmap_pud(unsigned long addr)
 {
-        pgd_t *pgd = pgd_offset_k(addr);
+        pgd_t *pgdp = pgd_offset_k(addr);
+        pgd_t pgd = READ_ONCE(*pgdp);
 
-        BUG_ON(pgd_none(*pgd) || pgd_bad(*pgd));
+        BUG_ON(pgd_none(pgd) || pgd_bad(pgd));
 
-        return pud_offset_kimg(pgd, addr);
+        return pud_offset_kimg(pgdp, addr);
 }
 
 static inline pmd_t * fixmap_pmd(unsigned long addr)
 {
-        pud_t *pud = fixmap_pud(addr);
+        pud_t *pudp = fixmap_pud(addr);
+        pud_t pud = READ_ONCE(*pudp);
 
-        BUG_ON(pud_none(*pud) || pud_bad(*pud));
+        BUG_ON(pud_none(pud) || pud_bad(pud));
 
-        return pmd_offset_kimg(pud, addr);
+        return pmd_offset_kimg(pudp, addr);
 }
 
 static inline pte_t * fixmap_pte(unsigned long addr)
@@ -768,30 +781,31 @@ static inline pte_t * fixmap_pte(unsigned long addr)
  */
 void __init early_fixmap_init(void)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp, pgd;
+        pud_t *pudp;
+        pmd_t *pmdp;
         unsigned long addr = FIXADDR_START;
 
-        pgd = pgd_offset_k(addr);
+        pgdp = pgd_offset_k(addr);
+        pgd = READ_ONCE(*pgdp);
         if (CONFIG_PGTABLE_LEVELS > 3 &&
-            !(pgd_none(*pgd) || pgd_page_paddr(*pgd) == __pa_symbol(bm_pud))) {
+            !(pgd_none(pgd) || pgd_page_paddr(pgd) == __pa_symbol(bm_pud))) {
                 /*
                  * We only end up here if the kernel mapping and the fixmap
                  * share the top level pgd entry, which should only happen on
                  * 16k/4 levels configurations.
                  */
                 BUG_ON(!IS_ENABLED(CONFIG_ARM64_16K_PAGES));
-                pud = pud_offset_kimg(pgd, addr);
+                pudp = pud_offset_kimg(pgdp, addr);
         } else {
-                if (pgd_none(*pgd))
-                        __pgd_populate(pgd, __pa_symbol(bm_pud), PUD_TYPE_TABLE);
-                pud = fixmap_pud(addr);
+                if (pgd_none(pgd))
+                        __pgd_populate(pgdp, __pa_symbol(bm_pud), PUD_TYPE_TABLE);
+                pudp = fixmap_pud(addr);
         }
-        if (pud_none(*pud))
-                __pud_populate(pud, __pa_symbol(bm_pmd), PMD_TYPE_TABLE);
-        pmd = fixmap_pmd(addr);
-        __pmd_populate(pmd, __pa_symbol(bm_pte), PMD_TYPE_TABLE);
+        if (pud_none(READ_ONCE(*pudp)))
+                __pud_populate(pudp, __pa_symbol(bm_pmd), PMD_TYPE_TABLE);
+        pmdp = fixmap_pmd(addr);
+        __pmd_populate(pmdp, __pa_symbol(bm_pte), PMD_TYPE_TABLE);
 
         /*
          * The boot-ioremap range spans multiple pmds, for which
@@ -800,11 +814,11 @@ void __init early_fixmap_init(void)
         BUILD_BUG_ON((__fix_to_virt(FIX_BTMAP_BEGIN) >> PMD_SHIFT)
                      != (__fix_to_virt(FIX_BTMAP_END) >> PMD_SHIFT));
 
-        if ((pmd != fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)))
-             || pmd != fixmap_pmd(fix_to_virt(FIX_BTMAP_END))) {
+        if ((pmdp != fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)))
+             || pmdp != fixmap_pmd(fix_to_virt(FIX_BTMAP_END))) {
                 WARN_ON(1);
-                pr_warn("pmd %p != %p, %p\n",
-                        pmd, fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)),
+                pr_warn("pmdp %p != %p, %p\n",
+                        pmdp, fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)),
                         fixmap_pmd(fix_to_virt(FIX_BTMAP_END)));
                 pr_warn("fix_to_virt(FIX_BTMAP_BEGIN): %08lx\n",
                         fix_to_virt(FIX_BTMAP_BEGIN));
@@ -824,16 +838,16 @@ void __set_fixmap(enum fixed_addresses idx,
                                phys_addr_t phys, pgprot_t flags)
 {
         unsigned long addr = __fix_to_virt(idx);
-        pte_t *pte;
+        pte_t *ptep;
 
         BUG_ON(idx <= FIX_HOLE || idx >= __end_of_fixed_addresses);
 
-        pte = fixmap_pte(addr);
+        ptep = fixmap_pte(addr);
 
         if (pgprot_val(flags)) {
-                set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
+                set_pte(ptep, pfn_pte(phys >> PAGE_SHIFT, flags));
         } else {
-                pte_clear(&init_mm, addr, pte);
+                pte_clear(&init_mm, addr, ptep);
                 flush_tlb_kernel_range(addr, addr+PAGE_SIZE);
         }
 }
@@ -915,36 +929,36 @@ int __init arch_ioremap_pmd_supported(void)
         return 1;
 }
 
-int pud_set_huge(pud_t *pud, phys_addr_t phys, pgprot_t prot)
+int pud_set_huge(pud_t *pudp, phys_addr_t phys, pgprot_t prot)
 {
         pgprot_t sect_prot = __pgprot(PUD_TYPE_SECT |
                                         pgprot_val(mk_sect_prot(prot)));
         BUG_ON(phys & ~PUD_MASK);
-        set_pud(pud, pfn_pud(__phys_to_pfn(phys), sect_prot));
+        set_pud(pudp, pfn_pud(__phys_to_pfn(phys), sect_prot));
         return 1;
 }
 
-int pmd_set_huge(pmd_t *pmd, phys_addr_t phys, pgprot_t prot)
+int pmd_set_huge(pmd_t *pmdp, phys_addr_t phys, pgprot_t prot)
 {
         pgprot_t sect_prot = __pgprot(PMD_TYPE_SECT |
                                         pgprot_val(mk_sect_prot(prot)));
         BUG_ON(phys & ~PMD_MASK);
-        set_pmd(pmd, pfn_pmd(__phys_to_pfn(phys), sect_prot));
+        set_pmd(pmdp, pfn_pmd(__phys_to_pfn(phys), sect_prot));
         return 1;
 }
 
-int pud_clear_huge(pud_t *pud)
+int pud_clear_huge(pud_t *pudp)
 {
-        if (!pud_sect(*pud))
+        if (!pud_sect(READ_ONCE(*pudp)))
                 return 0;
-        pud_clear(pud);
+        pud_clear(pudp);
         return 1;
 }
 
-int pmd_clear_huge(pmd_t *pmd)
+int pmd_clear_huge(pmd_t *pmdp)
 {
-        if (!pmd_sect(*pmd))
+        if (!pmd_sect(READ_ONCE(*pmdp)))
                 return 0;
-        pmd_clear(pmd);
+        pmd_clear(pmdp);
         return 1;
 }
diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
index a682a0a2a0fa..a56359373d8b 100644
--- a/arch/arm64/mm/pageattr.c
+++ b/arch/arm64/mm/pageattr.c
@@ -29,7 +29,7 @@ static int change_page_range(pte_t *ptep, pgtable_t token, unsigned long addr,
                         void *data)
 {
         struct page_change_data *cdata = data;
-        pte_t pte = *ptep;
+        pte_t pte = READ_ONCE(*ptep);
 
         pte = clear_pte_bit(pte, cdata->clear_mask);
         pte = set_pte_bit(pte, cdata->set_mask);
@@ -156,30 +156,32 @@ void __kernel_map_pages(struct page *page, int numpages, int enable)
  */
 bool kernel_page_present(struct page *page)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
+        pgd_t *pgdp;
+        pud_t *pudp, pud;
+        pmd_t *pmdp, pmd;
+        pte_t *ptep;
         unsigned long addr = (unsigned long)page_address(page);
 
-        pgd = pgd_offset_k(addr);
-        if (pgd_none(*pgd))
+        pgdp = pgd_offset_k(addr);
+        if (pgd_none(READ_ONCE(*pgdp)))
                 return false;
 
-        pud = pud_offset(pgd, addr);
-        if (pud_none(*pud))
+        pudp = pud_offset(pgdp, addr);
+        pud = READ_ONCE(*pudp);
+        if (pud_none(pud))
                 return false;
-        if (pud_sect(*pud))
+        if (pud_sect(pud))
                 return true;
 
-        pmd = pmd_offset(pud, addr);
-        if (pmd_none(*pmd))
+        pmdp = pmd_offset(pudp, addr);
+        pmd = READ_ONCE(*pmdp);
+        if (pmd_none(pmd))
                 return false;
-        if (pmd_sect(*pmd))
+        if (pmd_sect(pmd))
                 return true;
 
-        pte = pte_offset_kernel(pmd, addr);
-        return pte_valid(*pte);
+        ptep = pte_offset_kernel(pmdp, addr);
+        return pte_valid(READ_ONCE(*ptep));
 }
 #endif /* CONFIG_HIBERNATION */
 #endif /* CONFIG_DEBUG_PAGEALLOC */
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index 71baed7e592a..c0af47617299 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -205,7 +205,8 @@ ENDPROC(idmap_cpu_replace_ttbr1)
         dc      cvac, cur_\()\type\()p          // Ensure any existing dirty
         dmb     sy                              // lines are written back before
         ldr     \type, [cur_\()\type\()p]       // loading the entry
-        tbz     \type, #0, next_\()\type        // Skip invalid entries
+        tbz     \type, #0, skip_\()\type        // Skip invalid and
+        tbnz    \type, #11, skip_\()\type       // non-global entries
         .endm
 
         .macro __idmap_kpti_put_pgtable_ent_ng, type
@@ -265,8 +266,9 @@ ENTRY(idmap_kpti_install_ng_mappings)
         add     end_pgdp, cur_pgdp, #(PTRS_PER_PGD * 8)
 do_pgd: __idmap_kpti_get_pgtable_ent    pgd
         tbnz    pgd, #1, walk_puds
-        __idmap_kpti_put_pgtable_ent_ng pgd
 next_pgd:
+        __idmap_kpti_put_pgtable_ent_ng pgd
+skip_pgd:
         add     cur_pgdp, cur_pgdp, #8
         cmp     cur_pgdp, end_pgdp
         b.ne    do_pgd
@@ -294,8 +296,9 @@ walk_puds:
         add     end_pudp, cur_pudp, #(PTRS_PER_PUD * 8)
 do_pud: __idmap_kpti_get_pgtable_ent    pud
         tbnz    pud, #1, walk_pmds
-        __idmap_kpti_put_pgtable_ent_ng pud
 next_pud:
+        __idmap_kpti_put_pgtable_ent_ng pud
+skip_pud:
         add     cur_pudp, cur_pudp, 8
         cmp     cur_pudp, end_pudp
         b.ne    do_pud
@@ -314,8 +317,9 @@ walk_pmds:
         add     end_pmdp, cur_pmdp, #(PTRS_PER_PMD * 8)
 do_pmd: __idmap_kpti_get_pgtable_ent    pmd
         tbnz    pmd, #1, walk_ptes
-        __idmap_kpti_put_pgtable_ent_ng pmd
 next_pmd:
+        __idmap_kpti_put_pgtable_ent_ng pmd
+skip_pmd:
         add     cur_pmdp, cur_pmdp, #8
         cmp     cur_pmdp, end_pmdp
         b.ne    do_pmd
@@ -333,7 +337,7 @@ walk_ptes:
         add     end_ptep, cur_ptep, #(PTRS_PER_PTE * 8)
 do_pte: __idmap_kpti_get_pgtable_ent    pte
         __idmap_kpti_put_pgtable_ent_ng pte
-next_pte:
+skip_pte:
         add     cur_ptep, cur_ptep, #8
         cmp     cur_ptep, end_ptep
         b.ne    do_pte
diff --git a/arch/cris/include/arch-v10/arch/bug.h b/arch/cris/include/arch-v10/arch/bug.h
index 905afeacfedf..06da9d49152a 100644
--- a/arch/cris/include/arch-v10/arch/bug.h
+++ b/arch/cris/include/arch-v10/arch/bug.h
@@ -44,18 +44,25 @@ struct bug_frame {
  * not be used like this with newer versions of gcc.
  */
 #define BUG()                                                           \
+do {                                                                    \
         __asm__ __volatile__ ("clear.d [" __stringify(BUG_MAGIC) "]\n\t"\
                               "movu.w " __stringify(__LINE__) ",$r0\n\t"\
                               "jump 0f\n\t"                             \
                               ".section .rodata\n"                      \
                               "0:\t.string \"" __FILE__ "\"\n\t"        \
-                              ".previous")
+                              ".previous");                             \
+        unreachable();                                                  \
+} while (0)
 #endif
 
 #else
 
 /* This just causes an oops. */
-#define BUG() (*(int *)0 = 0)
+#define BUG()                                                           \
+do {                                                                    \
+        barrier_before_unreachable();                                   \
+        __builtin_trap();                                               \
+} while (0)
 
 #endif
 
diff --git a/arch/ia64/include/asm/bug.h b/arch/ia64/include/asm/bug.h
index bd3eeb8d1cfa..66b37a532765 100644
--- a/arch/ia64/include/asm/bug.h
+++ b/arch/ia64/include/asm/bug.h
@@ -4,7 +4,11 @@
 
 #ifdef CONFIG_BUG
 #define ia64_abort()    __builtin_trap()
-#define BUG() do { printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); ia64_abort(); } while (0)
+#define BUG() do {                                              \
+        printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__);   \
+        barrier_before_unreachable();                           \
+        ia64_abort();                                           \
+} while (0)
 
 /* should this BUG be made generic? */
 #define HAVE_ARCH_BUG
diff --git a/arch/ia64/kernel/Makefile b/arch/ia64/kernel/Makefile
index 0b4c65a1af25..498f3da3f225 100644
--- a/arch/ia64/kernel/Makefile
+++ b/arch/ia64/kernel/Makefile
@@ -41,7 +41,6 @@ ifneq ($(CONFIG_IA64_ESI),)
 obj-y                           += esi_stub.o   # must be in kernel proper
 endif
 obj-$(CONFIG_INTEL_IOMMU)       += pci-dma.o
-obj-$(CONFIG_SWIOTLB)           += pci-swiotlb.o
 
 obj-$(CONFIG_BINFMT_ELF)        += elfcore.o
 
diff --git a/arch/m68k/include/asm/bug.h b/arch/m68k/include/asm/bug.h
index b7e2bf1ba4a6..275dca1435bf 100644
--- a/arch/m68k/include/asm/bug.h
+++ b/arch/m68k/include/asm/bug.h
@@ -8,16 +8,19 @@
 #ifndef CONFIG_SUN3
 #define BUG() do { \
         pr_crit("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \
+        barrier_before_unreachable(); \
         __builtin_trap(); \
 } while (0)
 #else
 #define BUG() do { \
         pr_crit("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \
+        barrier_before_unreachable(); \
         panic("BUG!"); \
 } while (0)
 #endif
 #else
 #define BUG() do { \
+        barrier_before_unreachable(); \
         __builtin_trap(); \
 } while (0)
 #endif
diff --git a/arch/mips/boot/Makefile b/arch/mips/boot/Makefile
index 1bd5c4f00d19..c22da16d67b8 100644
--- a/arch/mips/boot/Makefile
+++ b/arch/mips/boot/Makefile
@@ -126,6 +126,7 @@ $(obj)/vmlinux.its.S: $(addprefix $(srctree)/arch/mips/$(PLATFORM)/,$(ITS_INPUTS
 
 quiet_cmd_cpp_its_S = ITS     $@
       cmd_cpp_its_S = $(CPP) $(cpp_flags) -P -C -o $@ $< \
+                        -D__ASSEMBLY__ \
                         -DKERNEL_NAME="\"Linux $(KERNELRELEASE)\"" \
                         -DVMLINUX_BINARY="\"$(3)\"" \
                         -DVMLINUX_COMPRESSION="\"$(2)\"" \
diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
index 593248110902..9f421641a35c 100644
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -81,6 +81,9 @@ static inline int numa_update_cpu_topology(bool cpus_locked)
 {
         return 0;
 }
+
+static inline void update_numa_cpu_lookup_table(unsigned int cpu, int node) {}
+
 #endif /* CONFIG_NUMA */
 
 #if defined(CONFIG_NUMA) && defined(CONFIG_PPC_SPLPAR)
diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
index 5a8bfee6e187..04d0bbd7a1dd 100644
--- a/arch/powerpc/kernel/sysfs.c
+++ b/arch/powerpc/kernel/sysfs.c
@@ -788,7 +788,8 @@ static int register_cpu_online(unsigned int cpu)
         if (cpu_has_feature(CPU_FTR_PPCAS_ARCH_V2))
                 device_create_file(s, &dev_attr_pir);
 
-        if (cpu_has_feature(CPU_FTR_ARCH_206))
+        if (cpu_has_feature(CPU_FTR_ARCH_206) &&
+                !firmware_has_feature(FW_FEATURE_LPAR))
                 device_create_file(s, &dev_attr_tscr);
 #endif /* CONFIG_PPC64 */
 
@@ -873,7 +874,8 @@ static int unregister_cpu_online(unsigned int cpu)
         if (cpu_has_feature(CPU_FTR_PPCAS_ARCH_V2))
                 device_remove_file(s, &dev_attr_pir);
 
-        if (cpu_has_feature(CPU_FTR_ARCH_206))
+        if (cpu_has_feature(CPU_FTR_ARCH_206) &&
+                !firmware_has_feature(FW_FEATURE_LPAR))
                 device_remove_file(s, &dev_attr_tscr);
 #endif /* CONFIG_PPC64 */
 
diff --git a/arch/powerpc/mm/drmem.c b/arch/powerpc/mm/drmem.c
index 1604110c4238..916844f99c64 100644
--- a/arch/powerpc/mm/drmem.c
+++ b/arch/powerpc/mm/drmem.c
@@ -216,6 +216,8 @@ static void __init __walk_drmem_v1_lmbs(const __be32 *prop, const __be32 *usm,
         u32 i, n_lmbs;
 
         n_lmbs = of_read_number(prop++, 1);
+        if (n_lmbs == 0)
+                return;
 
         for (i = 0; i < n_lmbs; i++) {
                 read_drconf_v1_cell(&lmb, &prop);
@@ -245,6 +247,8 @@ static void __init __walk_drmem_v2_lmbs(const __be32 *prop, const __be32 *usm,
         u32 i, j, lmb_sets;
 
         lmb_sets = of_read_number(prop++, 1);
+        if (lmb_sets == 0)
+                return;
 
         for (i = 0; i < lmb_sets; i++) {
                 read_drconf_v2_cell(&dr_cell, &prop);
@@ -354,6 +358,8 @@ static void __init init_drmem_v1_lmbs(const __be32 *prop)
         struct drmem_lmb *lmb;
 
         drmem_info->n_lmbs = of_read_number(prop++, 1);
+        if (drmem_info->n_lmbs == 0)
+                return;
 
         drmem_info->lmbs = kcalloc(drmem_info->n_lmbs, sizeof(*lmb),
                                    GFP_KERNEL);
@@ -373,6 +379,8 @@ static void __init init_drmem_v2_lmbs(const __be32 *prop)
         int lmb_index;
 
         lmb_sets = of_read_number(prop++, 1);
+        if (lmb_sets == 0)
+                return;
 
         /* first pass, calculate the number of LMBs */
         p = prop;
diff --git a/arch/powerpc/platforms/powernv/opal-imc.c b/arch/powerpc/platforms/powernv/opal-imc.c
index dd4c9b8b8a81..f6f55ab4980e 100644
--- a/arch/powerpc/platforms/powernv/opal-imc.c
+++ b/arch/powerpc/platforms/powernv/opal-imc.c
@@ -199,9 +199,11 @@ static void disable_nest_pmu_counters(void)
         const struct cpumask *l_cpumask;
 
         get_online_cpus();
-        for_each_online_node(nid) {
+        for_each_node_with_cpus(nid) {
                 l_cpumask = cpumask_of_node(nid);
-                cpu = cpumask_first(l_cpumask);
+                cpu = cpumask_first_and(l_cpumask, cpu_online_mask);
+                if (cpu >= nr_cpu_ids)
+                        continue;
                 opal_imc_counters_stop(OPAL_IMC_COUNTERS_NEST,
                                        get_hard_smp_processor_id(cpu));
         }
diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c
index d9c4c9366049..091f1d0d0af1 100644
--- a/arch/powerpc/sysdev/xive/spapr.c
+++ b/arch/powerpc/sysdev/xive/spapr.c
@@ -356,7 +356,8 @@ static int xive_spapr_configure_queue(u32 target, struct xive_q *q, u8 prio,
 
         rc = plpar_int_get_queue_info(0, target, prio, &esn_page, &esn_size);
         if (rc) {
-                pr_err("Error %lld getting queue info prio %d\n", rc, prio);
+                pr_err("Error %lld getting queue info CPU %d prio %d\n", rc,
+                       target, prio);
                 rc = -EIO;
                 goto fail;
         }
@@ -370,7 +371,8 @@ static int xive_spapr_configure_queue(u32 target, struct xive_q *q, u8 prio,
         /* Configure and enable the queue in HW */
         rc = plpar_int_set_queue_config(flags, target, prio, qpage_phys, order);
         if (rc) {
-                pr_err("Error %lld setting queue for prio %d\n", rc, prio);
+                pr_err("Error %lld setting queue for CPU %d prio %d\n", rc,
+                       target, prio);
                 rc = -EIO;
         } else {
                 q->qpage = qpage;
@@ -389,8 +391,8 @@ static int xive_spapr_setup_queue(unsigned int cpu, struct xive_cpu *xc,
         if (IS_ERR(qpage))
                 return PTR_ERR(qpage);
 
-        return xive_spapr_configure_queue(cpu, q, prio, qpage,
-                                          xive_queue_shift);
+        return xive_spapr_configure_queue(get_hard_smp_processor_id(cpu),
+                                          q, prio, qpage, xive_queue_shift);
 }
 
 static void xive_spapr_cleanup_queue(unsigned int cpu, struct xive_cpu *xc,
@@ -399,10 +401,12 @@ static void xive_spapr_cleanup_queue(unsigned int cpu, struct xive_cpu *xc,
         struct xive_q *q = &xc->queue[prio];
         unsigned int alloc_order;
         long rc;
+        int hw_cpu = get_hard_smp_processor_id(cpu);
 
-        rc = plpar_int_set_queue_config(0, cpu, prio, 0, 0);
+        rc = plpar_int_set_queue_config(0, hw_cpu, prio, 0, 0);
         if (rc)
-                pr_err("Error %ld setting queue for prio %d\n", rc, prio);
+                pr_err("Error %ld setting queue for CPU %d prio %d\n", rc,
+                       hw_cpu, prio);
 
         alloc_order = xive_alloc_order(xive_queue_shift);
         free_pages((unsigned long)q->qpage, alloc_order);
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index b6722c246d9c..04807c7f64cc 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -8,7 +8,6 @@ config RISCV
         select OF
         select OF_EARLY_FLATTREE
         select OF_IRQ
-        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
         select ARCH_WANT_FRAME_POINTERS
         select CLONE_BACKWARDS
         select COMMON_CLK
@@ -20,7 +19,6 @@ config RISCV
         select GENERIC_STRNLEN_USER
         select GENERIC_SMP_IDLE_THREAD
         select GENERIC_ATOMIC64 if !64BIT || !RISCV_ISA_A
-        select ARCH_WANT_OPTIONAL_GPIOLIB
         select HAVE_MEMBLOCK
         select HAVE_MEMBLOCK_NODE_MAP
         select HAVE_DMA_API_DEBUG
@@ -34,7 +32,6 @@ config RISCV
         select HAVE_ARCH_TRACEHOOK
         select MODULES_USE_ELF_RELA if MODULES
         select THREAD_INFO_IN_TASK
-        select RISCV_IRQ_INTC
         select RISCV_TIMER
 
 config MMU
diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
index 87fc045be51f..56fa592cfa34 100644
--- a/arch/riscv/kernel/entry.S
+++ b/arch/riscv/kernel/entry.S
@@ -172,6 +172,9 @@ ENTRY(handle_exception)
         move a1, sp /* pt_regs */
         tail do_IRQ
 1:
+        /* Exceptions run with interrupts enabled */
+        csrs sstatus, SR_SIE
+
         /* Handle syscalls */
         li t0, EXC_SYSCALL
         beq s4, t0, handle_syscall
@@ -198,8 +201,6 @@ handle_syscall:
          */
         addi s2, s2, 0x4
         REG_S s2, PT_SEPC(sp)
-        /* System calls run with interrupts enabled */
-        csrs sstatus, SR_SIE
         /* Trace syscalls, but only if requested by the user. */
         REG_L t0, TASK_TI_FLAGS(tp)
         andi t0, t0, _TIF_SYSCALL_TRACE
diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S
index 226eeb190f90..6e07ed37bbff 100644
--- a/arch/riscv/kernel/head.S
+++ b/arch/riscv/kernel/head.S
@@ -64,7 +64,7 @@ ENTRY(_start)
         /* Start the kernel */
         mv a0, s0
         mv a1, s1
-        call sbi_save
+        call parse_dtb
         tail start_kernel
 
 relocate:
diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
index 09f7064e898c..c11f40c1b2a8 100644
--- a/arch/riscv/kernel/setup.c
+++ b/arch/riscv/kernel/setup.c
@@ -144,7 +144,7 @@ asmlinkage void __init setup_vm(void)
 #endif
 }
 
-void __init sbi_save(unsigned int hartid, void *dtb)
+void __init parse_dtb(unsigned int hartid, void *dtb)
 {
         early_init_dt_scan(__va(dtb));
 }
diff --git a/arch/sparc/include/asm/bug.h b/arch/sparc/include/asm/bug.h
index 6f17528356b2..ea53e418f6c0 100644
--- a/arch/sparc/include/asm/bug.h
+++ b/arch/sparc/include/asm/bug.h
@@ -9,10 +9,14 @@
 void do_BUG(const char *file, int line);
 #define BUG() do {                                      \
         do_BUG(__FILE__, __LINE__);                     \
+        barrier_before_unreachable();                   \
         __builtin_trap();                               \
 } while (0)
 #else
-#define BUG()           __builtin_trap()
+#define BUG() do {                                      \
+        barrier_before_unreachable();                   \
+        __builtin_trap();                               \
+} while (0)
 #endif
 
 #define HAVE_ARCH_BUG
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index a528c14d45a5..c1236b187824 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1404,7 +1404,7 @@ config HIGHMEM4G
 
 config HIGHMEM64G
         bool "64GB"
-        depends on !M486
+        depends on !M486 && !M586 && !M586TSC && !M586MMX && !MGEODE_LX && !MGEODEGX1 && !MCYRIXIII && !MELAN && !MWINCHIPC6 && !WINCHIP3D && !MK6
         select X86_PAE
         ---help---
           Select this if you have a 32-bit processor and more than 4
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index 65a9a4716e34..8b8d2297d486 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -374,7 +374,7 @@ config X86_TSC
 
 config X86_CMPXCHG64
         def_bool y
-        depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM
+        depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586TSC || M586MMX || MATOM || MGEODE_LX || MGEODEGX1 || MK6 || MK7 || MK8
 
 # this should be set for all -march=.. options where the compiler
 # generates cmov.
@@ -385,7 +385,7 @@ config X86_CMOV
 config X86_MINIMUM_CPU_FAMILY
         int
         default "64" if X86_64
-        default "6" if X86_32 && X86_P6_NOP
+        default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MCRUSOE || MCORE2 || MK7 || MK8)
         default "5" if X86_32 && X86_CMPXCHG64
         default "4"
 
diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
index 461f53d27708..a4189762b266 100644
--- a/arch/x86/include/asm/smp.h
+++ b/arch/x86/include/asm/smp.h
@@ -129,6 +129,7 @@ static inline void arch_send_call_function_ipi_mask(const struct cpumask *mask)
 void cpu_disable_common(void);
 void native_smp_prepare_boot_cpu(void);
 void native_smp_prepare_cpus(unsigned int max_cpus);
+void calculate_max_logical_packages(void);
 void native_smp_cpus_done(unsigned int max_cpus);
 void common_cpu_up(unsigned int cpunum, struct task_struct *tidle);
 int native_cpu_up(unsigned int cpunum, struct task_struct *tidle);
diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
index 1f790cf9d38f..3b7427aa7d85 100644
--- a/arch/x86/kernel/machine_kexec_64.c
+++ b/arch/x86/kernel/machine_kexec_64.c
@@ -542,6 +542,7 @@ int arch_kexec_apply_relocations_add(const Elf64_Ehdr *ehdr,
                                 goto overflow;
                         break;
                 case R_X86_64_PC32:
+                case R_X86_64_PLT32:
                         value -= (u64)address;
                         *(u32 *)location = value;
                         break;
diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
index da0c160e5589..f58336af095c 100644
--- a/arch/x86/kernel/module.c
+++ b/arch/x86/kernel/module.c
@@ -191,6 +191,7 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
                                 goto overflow;
                         break;
                 case R_X86_64_PC32:
+                case R_X86_64_PLT32:
                         if (*(u32 *)loc != 0)
                                 goto invalid_relocation;
                         val -= (u64)loc;
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index cfc61e1d45e2..9eee25d07586 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1281,11 +1281,10 @@ void __init native_smp_prepare_boot_cpu(void)
         cpu_set_state_online(me);
 }
 
-void __init native_smp_cpus_done(unsigned int max_cpus)
+void __init calculate_max_logical_packages(void)
 {
         int ncpus;
 
-        pr_debug("Boot done\n");
         /*
          * Today neither Intel nor AMD support heterogenous systems so
          * extrapolate the boot cpu's data to all packages.
@@ -1293,6 +1292,13 @@ void __init native_smp_cpus_done(unsigned int max_cpus)
         ncpus = cpu_data(0).booted_cores * topology_max_smt_threads();
         __max_logical_packages = DIV_ROUND_UP(nr_cpu_ids, ncpus);
         pr_info("Max logical packages: %u\n", __max_logical_packages);
+}
+
+void __init native_smp_cpus_done(unsigned int max_cpus)
+{
+        pr_debug("Boot done\n");
+
+        calculate_max_logical_packages();
 
         if (x86_has_numa_in_package)
                 set_sched_topology(x86_numa_in_package_topology);
diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
index 5d73c443e778..220e97841e49 100644
--- a/arch/x86/tools/relocs.c
+++ b/arch/x86/tools/relocs.c
@@ -770,9 +770,12 @@ static int do_reloc64(struct section *sec, Elf_Rel *rel, ElfW(Sym) *sym,
                 break;
 
         case R_X86_64_PC32:
+        case R_X86_64_PLT32:
                 /*
                  * PC relative relocations don't need to be adjusted unless
                  * referencing a percpu symbol.
+                 *
+                 * NB: R_X86_64_PLT32 can be treated as R_X86_64_PC32.
                  */
                 if (is_percpu_sym(sym, symname))
                         add_reloc(&relocs32neg, offset);
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index 77c959cf81e7..7a43b2ae19f1 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -122,6 +122,8 @@ void __init xen_smp_cpus_done(unsigned int max_cpus)
 
         if (xen_hvm_domain())
                 native_smp_cpus_done(max_cpus);
+        else
+                calculate_max_logical_packages();
 
         if (xen_have_vcpu_info_placement)
                 return;
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 4117524ca45b..c2033a232a44 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -812,7 +812,6 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
         struct gendisk *disk;
         struct request_queue *q;
         struct blkcg_gq *blkg;
-        struct module *owner;
         unsigned int major, minor;
         int key_len, part, ret;
         char *body;
@@ -904,9 +903,7 @@ fail_unlock:
         spin_unlock_irq(q->queue_lock);
         rcu_read_unlock();
 fail:
-        owner = disk->fops->owner;
-        put_disk(disk);
-        module_put(owner);
+        put_disk_and_module(disk);
         /*
          * If queue was bypassing, we should retry.  Do so after a
          * short msleep().  It isn't strictly necessary but queue
@@ -931,13 +928,9 @@ EXPORT_SYMBOL_GPL(blkg_conf_prep);
 void blkg_conf_finish(struct blkg_conf_ctx *ctx)
         __releases(ctx->disk->queue->queue_lock) __releases(rcu)
 {
-        struct module *owner;
-
         spin_unlock_irq(ctx->disk->queue->queue_lock);
         rcu_read_unlock();
-        owner = ctx->disk->fops->owner;
-        put_disk(ctx->disk);
-        module_put(owner);
+        put_disk_and_module(ctx->disk);
 }
 EXPORT_SYMBOL_GPL(blkg_conf_finish);
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index df93102e2149..16e83e6df404 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -712,7 +712,6 @@ static void __blk_mq_requeue_request(struct request *rq)
 
         trace_block_rq_requeue(q, rq);
         wbt_requeue(q->rq_wb, &rq->issue_stat);
-        blk_mq_sched_requeue_request(rq);
 
         if (blk_mq_rq_state(rq) != MQ_RQ_IDLE) {
                 blk_mq_rq_update_state(rq, MQ_RQ_IDLE);
@@ -725,6 +724,9 @@ void blk_mq_requeue_request(struct request *rq, bool kick_requeue_list)
 {
         __blk_mq_requeue_request(rq);
 
+        /* this request will be re-inserted to io scheduler queue */
+        blk_mq_sched_requeue_request(rq);
+
         BUG_ON(blk_queued_rq(rq));
         blk_mq_add_to_requeue_list(rq, true, kick_requeue_list);
 }
@@ -3164,6 +3166,7 @@ static bool __blk_mq_poll(struct blk_mq_hw_ctx *hctx, struct request *rq)
                 cpu_relax();
         }
 
+        __set_current_state(TASK_RUNNING);
         return false;
 }
 
diff --git a/block/genhd.c b/block/genhd.c
index 88a53c188cb7..9656f9e9f99e 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -547,7 +547,7 @@ static int exact_lock(dev_t devt, void *data)
 {
         struct gendisk *p = data;
 
-        if (!get_disk(p))
+        if (!get_disk_and_module(p))
                 return -1;
         return 0;
 }
@@ -717,6 +717,11 @@ void del_gendisk(struct gendisk *disk)
         blk_integrity_del(disk);
         disk_del_events(disk);
 
+        /*
+         * Block lookups of the disk until all bdevs are unhashed and the
+         * disk is marked as dead (GENHD_FL_UP cleared).
+         */
+        down_write(&disk->lookup_sem);
         /* invalidate stuff */
         disk_part_iter_init(&piter, disk,
                              DISK_PITER_INCL_EMPTY | DISK_PITER_REVERSE);
@@ -731,6 +736,7 @@ void del_gendisk(struct gendisk *disk)
         bdev_unhash_inode(disk_devt(disk));
         set_capacity(disk, 0);
         disk->flags &= ~GENHD_FL_UP;
+        up_write(&disk->lookup_sem);
 
         if (!(disk->flags & GENHD_FL_HIDDEN))
                 sysfs_remove_link(&disk_to_dev(disk)->kobj, "bdi");
@@ -809,16 +815,28 @@ struct gendisk *get_gendisk(dev_t devt, int *partno)
 
                 spin_lock_bh(&ext_devt_lock);
                 part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
-                if (part && get_disk(part_to_disk(part))) {
+                if (part && get_disk_and_module(part_to_disk(part))) {
                         *partno = part->partno;
                         disk = part_to_disk(part);
                 }
                 spin_unlock_bh(&ext_devt_lock);
         }
 
-        if (disk && unlikely(disk->flags & GENHD_FL_HIDDEN)) {
-                put_disk(disk);
+        if (!disk)
+                return NULL;
+
+        /*
+         * Synchronize with del_gendisk() to not return disk that is being
+         * destroyed.
+         */
+        down_read(&disk->lookup_sem);
+        if (unlikely((disk->flags & GENHD_FL_HIDDEN) ||
+                     !(disk->flags & GENHD_FL_UP))) {
+                up_read(&disk->lookup_sem);
+                put_disk_and_module(disk);
                 disk = NULL;
+        } else {
+                up_read(&disk->lookup_sem);
         }
         return disk;
 }
@@ -1418,6 +1436,7 @@ struct gendisk *__alloc_disk_node(int minors, int node_id)
                         kfree(disk);
                         return NULL;
                 }
+                init_rwsem(&disk->lookup_sem);
                 disk->node_id = node_id;
                 if (disk_expand_part_tbl(disk, 0)) {
                         free_part_stats(&disk->part0);
@@ -1453,7 +1472,7 @@ struct gendisk *__alloc_disk_node(int minors, int node_id)
 }
 EXPORT_SYMBOL(__alloc_disk_node);
 
-struct kobject *get_disk(struct gendisk *disk)
+struct kobject *get_disk_and_module(struct gendisk *disk)
 {
         struct module *owner;
         struct kobject *kobj;
@@ -1471,17 +1490,30 @@ struct kobject *get_disk(struct gendisk *disk)
         return kobj;
 
 }
-
-EXPORT_SYMBOL(get_disk);
+EXPORT_SYMBOL(get_disk_and_module);
 
 void put_disk(struct gendisk *disk)
 {
         if (disk)
                 kobject_put(&disk_to_dev(disk)->kobj);
 }
-
 EXPORT_SYMBOL(put_disk);
 
+/*
+ * This is a counterpart of get_disk_and_module() and thus also of
+ * get_gendisk().
+ */
+void put_disk_and_module(struct gendisk *disk)
+{
+        if (disk) {
+                struct module *owner = disk->fops->owner;
+
+                put_disk(disk);
+                module_put(owner);
+        }
+}
+EXPORT_SYMBOL(put_disk_and_module);
+
 static void set_disk_ro_uevent(struct gendisk *gd, int ro)
 {
         char event[] = "DISK_RO=1";
diff --git a/block/ioctl.c b/block/ioctl.c
index 1668506d8ed8..3884d810efd2 100644
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -225,7 +225,7 @@ static int blk_ioctl_discard(struct block_device *bdev, fmode_t mode,
 
         if (start + len > i_size_read(bdev->bd_inode))
                 return -EINVAL;
-        truncate_inode_pages_range(mapping, start, start + len);
+        truncate_inode_pages_range(mapping, start, start + len - 1);
         return blkdev_issue_discard(bdev, start >> 9, len >> 9,
                                     GFP_KERNEL, flags);
 }
diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c
index f95c60774ce8..0d6d25e32e1f 100644
--- a/block/kyber-iosched.c
+++ b/block/kyber-iosched.c
@@ -833,6 +833,7 @@ static struct elevator_type kyber_sched = {
                 .limit_depth = kyber_limit_depth,
                 .prepare_request = kyber_prepare_request,
                 .finish_request = kyber_finish_request,
+                .requeue_request = kyber_finish_request,
                 .completed_request = kyber_completed_request,
                 .dispatch_request = kyber_dispatch_request,
                 .has_work = kyber_has_work,
diff --git a/certs/blacklist_nohashes.c b/certs/blacklist_nohashes.c
index 73fd99098ad7..753b703ef0ef 100644
--- a/certs/blacklist_nohashes.c
+++ b/certs/blacklist_nohashes.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 #include "blacklist.h"
 
-const char __initdata *const blacklist_hashes[] = {
+const char __initconst *const blacklist_hashes[] = {
         NULL
 };
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 15e3d3c2260d..764b63a5aade 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1991,8 +1991,14 @@ static void binder_send_failed_reply(struct binder_transaction *t,
                                         &target_thread->reply_error.work);
                                 wake_up_interruptible(&target_thread->wait);
                         } else {
-                                WARN(1, "Unexpected reply error: %u\n",
-                                                target_thread->reply_error.cmd);
+                                /*
+                                 * Cannot get here for normal operation, but
+                                 * we can if multiple synchronous transactions
+                                 * are sent without blocking for responses.
+                                 * Just ignore the 2nd error in this case.
+                                 */
+                                pr_warn("Unexpected reply error: %u\n",
+                                        target_thread->reply_error.cmd);
                         }
                         binder_inner_proc_unlock(target_thread->proc);
                         binder_thread_dec_tmpref(target_thread);
@@ -2193,7 +2199,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
         int debug_id = buffer->debug_id;
 
         binder_debug(BINDER_DEBUG_TRANSACTION,
-                     "%d buffer release %d, size %zd-%zd, failed at %p\n",
+                     "%d buffer release %d, size %zd-%zd, failed at %pK\n",
                      proc->pid, buffer->debug_id,
                      buffer->data_size, buffer->offsets_size, failed_at);
 
@@ -3705,7 +3711,7 @@ static int binder_thread_write(struct binder_proc *proc,
                                 }
                         }
                         binder_debug(BINDER_DEBUG_DEAD_BINDER,
-                                     "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
+                                     "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
                                      proc->pid, thread->pid, (u64)cookie,
                                      death);
                         if (death == NULL) {
@@ -4376,6 +4382,15 @@ static int binder_thread_release(struct binder_proc *proc,
 
         binder_inner_proc_unlock(thread->proc);
 
+        /*
+         * This is needed to avoid races between wake_up_poll() above and
+         * and ep_remove_waitqueue() called for other reasons (eg the epoll file
+         * descriptor being closed); ep_remove_waitqueue() holds an RCU read
+         * lock, so we can be sure it's done after calling synchronize_rcu().
+         */
+        if (thread->looper & BINDER_LOOPER_STATE_POLL)
+                synchronize_rcu();
+
         if (send_reply)
                 binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
         binder_release_work(proc, &thread->todo);
@@ -4391,6 +4406,8 @@ static __poll_t binder_poll(struct file *filp,
         bool wait_for_proc_work;
 
         thread = binder_get_thread(proc);
+        if (!thread)
+                return POLLERR;
 
         binder_inner_proc_lock(thread->proc);
         thread->looper |= BINDER_LOOPER_STATE_POLL;
@@ -5034,7 +5051,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m,
         spin_lock(&t->lock);
         to_proc = t->to_proc;
         seq_printf(m,
-                   "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d",
+                   "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d",
                    prefix, t->debug_id, t,
                    t->from ? t->from->proc->pid : 0,
                    t->from ? t->from->pid : 0,
@@ -5058,7 +5075,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m,
         }
         if (buffer->target_node)
                 seq_printf(m, " node %d", buffer->target_node->debug_id);
-        seq_printf(m, " size %zd:%zd data %p\n",
+        seq_printf(m, " size %zd:%zd data %pK\n",
                    buffer->data_size, buffer->offsets_size,
                    buffer->data);
 }
diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
index e5aa62fcf5a8..3aaf6af3ec23 100644
--- a/drivers/block/amiflop.c
+++ b/drivers/block/amiflop.c
@@ -1758,7 +1758,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
         if (unit[drive].type->code == FD_NODRIVE)
                 return NULL;
         *part = 0;
-        return get_disk(unit[drive].gendisk);
+        return get_disk_and_module(unit[drive].gendisk);
 }
 
 static int __init amiga_floppy_probe(struct platform_device *pdev)
diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c
index 8bc3b9fd8dd2..dfb2c2622e5a 100644
--- a/drivers/block/ataflop.c
+++ b/drivers/block/ataflop.c
@@ -1917,7 +1917,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
         if (drive >= FD_MAX_UNITS || type > NUM_DISK_MINORS)
                 return NULL;
         *part = 0;
-        return get_disk(unit[drive].disk);
+        return get_disk_and_module(unit[drive].disk);
 }
 
 static int __init atari_floppy_init (void)
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index 8028a3a7e7fd..deea78e485da 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -456,7 +456,7 @@ static struct kobject *brd_probe(dev_t dev, int *part, void *data)
 
         mutex_lock(&brd_devices_mutex);
         brd = brd_init_one(MINOR(dev) / max_part, &new);
-        kobj = brd ? get_disk(brd->brd_disk) : NULL;
+        kobj = brd ? get_disk_and_module(brd->brd_disk) : NULL;
         mutex_unlock(&brd_devices_mutex);
 
         if (new)
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index eae484acfbbc..8ec7235fc93b 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4505,7 +4505,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
         if (((*part >> 2) & 0x1f) >= ARRAY_SIZE(floppy_type))
                 return NULL;
         *part = 0;
-        return get_disk(disks[drive]);
+        return get_disk_and_module(disks[drive]);
 }
 
 static int __init do_floppy_init(void)
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index d5fe720cf149..87855b5123a6 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1922,7 +1922,7 @@ static struct kobject *loop_probe(dev_t dev, int *part, void *data)
         if (err < 0)
                 kobj = NULL;
         else
-                kobj = get_disk(lo->lo_disk);
+                kobj = get_disk_and_module(lo->lo_disk);
         mutex_unlock(&loop_index_mutex);
 
         *part = 0;
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 5f2a4240a204..86258b00a1d4 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1591,7 +1591,7 @@ again:
                         if (new_index < 0) {
                                 mutex_unlock(&nbd_index_mutex);
                                 printk(KERN_ERR "nbd: failed to add new device\n");
-                                return ret;
+                                return new_index;
                         }
                         nbd = idr_find(&nbd_index_idr, new_index);
                 }
diff --git a/drivers/block/swim.c b/drivers/block/swim.c
index 84434d3ea19b..64e066eba72e 100644
--- a/drivers/block/swim.c
+++ b/drivers/block/swim.c
@@ -799,7 +799,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
                 return NULL;
 
         *part = 0;
-        return get_disk(swd->unit[drive].disk);
+        return get_disk_and_module(swd->unit[drive].disk);
 }
 
 static int swim_add_floppy(struct swim_priv *swd, enum drive_location location)
diff --git a/drivers/block/z2ram.c b/drivers/block/z2ram.c
index 41c95c9b2ab4..8f9130ab5887 100644
--- a/drivers/block/z2ram.c
+++ b/drivers/block/z2ram.c
@@ -332,7 +332,7 @@ static const struct block_device_operations z2_fops =
 static struct kobject *z2_find(dev_t dev, int *part, void *data)
 {
         *part = 0;
-        return get_disk(z2ram_gendisk);
+        return get_disk_and_module(z2ram_gendisk);
 }
 
 static struct request_queue *z2_queue;
diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
index 188f44b7eb27..5d64c08b7f47 100644
--- a/drivers/crypto/s5p-sss.c
+++ b/drivers/crypto/s5p-sss.c
@@ -1922,15 +1922,21 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode)
         uint32_t aes_control;
         unsigned long flags;
         int err;
+        u8 *iv;
 
         aes_control = SSS_AES_KEY_CHANGE_MODE;
         if (mode & FLAGS_AES_DECRYPT)
                 aes_control |= SSS_AES_MODE_DECRYPT;
 
-        if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC)
+        if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) {
                 aes_control |= SSS_AES_CHAIN_MODE_CBC;
-        else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR)
+                iv = req->info;
+        } else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) {
                 aes_control |= SSS_AES_CHAIN_MODE_CTR;
+                iv = req->info;
+        } else {
+                iv = NULL; /* AES_ECB */
+        }
 
         if (dev->ctx->keylen == AES_KEYSIZE_192)
                 aes_control |= SSS_AES_KEY_SIZE_192;
@@ -1961,7 +1967,7 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode)
                 goto outdata_error;
 
         SSS_AES_WRITE(dev, AES_CONTROL, aes_control);
-        s5p_set_aes(dev, dev->ctx->aes_key, req->info, dev->ctx->keylen);
+        s5p_set_aes(dev, dev->ctx->aes_key, iv, dev->ctx->keylen);
 
         s5p_set_dma_indata(dev,  dev->sg_src);
         s5p_set_dma_outdata(dev, dev->sg_dst);
diff --git a/drivers/extcon/extcon-axp288.c b/drivers/extcon/extcon-axp288.c
index 0a44d43802fe..3ec4c715e240 100644
--- a/drivers/extcon/extcon-axp288.c
+++ b/drivers/extcon/extcon-axp288.c
@@ -1,7 +1,6 @@
 /*
  * extcon-axp288.c - X-Power AXP288 PMIC extcon cable detection driver
  *
- * Copyright (C) 2016-2017 Hans de Goede <hdegoede@redhat.com>
  * Copyright (C) 2015 Intel Corporation
  * Author: Ramakrishna Pallala <ramakrishna.pallala@intel.com>
  *
@@ -98,15 +97,13 @@ struct axp288_extcon_info {
         struct device *dev;
         struct regmap *regmap;
         struct regmap_irq_chip_data *regmap_irqc;
-        struct delayed_work det_work;
         int irq[EXTCON_IRQ_END];
         struct extcon_dev *edev;
         unsigned int previous_cable;
-        bool first_detect_done;
 };
 
 /* Power up/down reason string array */
-static char *axp288_pwr_up_down_info[] = {
+static const char * const axp288_pwr_up_down_info[] = {
         "Last wake caused by user pressing the power button",
         "Last wake caused by a charger insertion",
         "Last wake caused by a battery insertion",
@@ -124,7 +121,7 @@ static char *axp288_pwr_up_down_info[] = {
  */
 static void axp288_extcon_log_rsi(struct axp288_extcon_info *info)
 {
-        char **rsi;
+        const char * const *rsi;
         unsigned int val, i, clear_mask = 0;
         int ret;
 
@@ -140,25 +137,6 @@ static void axp288_extcon_log_rsi(struct axp288_extcon_info *info)
         regmap_write(info->regmap, AXP288_PS_BOOT_REASON_REG, clear_mask);
 }
 
-static void axp288_chrg_detect_complete(struct axp288_extcon_info *info)
-{
-        /*
-         * We depend on other drivers to do things like mux the data lines,
-         * enable/disable vbus based on the id-pin, etc. Sometimes the BIOS has
-         * not set these things up correctly resulting in the initial charger
-         * cable type detection giving a wrong result and we end up not charging
-         * or charging at only 0.5A.
-         *
-         * So we schedule a second cable type detection after 2 seconds to
-         * give the other drivers time to load and do their thing.
-         */
-        if (!info->first_detect_done) {
-                queue_delayed_work(system_wq, &info->det_work,
-                                   msecs_to_jiffies(2000));
-                info->first_detect_done = true;
-        }
-}
-
 static int axp288_handle_chrg_det_event(struct axp288_extcon_info *info)
 {
         int ret, stat, cfg, pwr_stat;
@@ -223,8 +201,6 @@ no_vbus:
                 info->previous_cable = cable;
         }
 
-        axp288_chrg_detect_complete(info);
-
         return 0;
 
 dev_det_ret:
@@ -246,11 +222,8 @@ static irqreturn_t axp288_extcon_isr(int irq, void *data)
         return IRQ_HANDLED;
 }
 
-static void axp288_extcon_det_work(struct work_struct *work)
+static void axp288_extcon_enable(struct axp288_extcon_info *info)
 {
-        struct axp288_extcon_info *info =
-                container_of(work, struct axp288_extcon_info, det_work.work);
-
         regmap_update_bits(info->regmap, AXP288_BC_GLOBAL_REG,
                                                 BC_GLOBAL_RUN, 0);
         /* Enable the charger detection logic */
@@ -272,7 +245,6 @@ static int axp288_extcon_probe(struct platform_device *pdev)
         info->regmap = axp20x->regmap;
         info->regmap_irqc = axp20x->regmap_irqc;
         info->previous_cable = EXTCON_NONE;
-        INIT_DELAYED_WORK(&info->det_work, axp288_extcon_det_work);
 
         platform_set_drvdata(pdev, info);
 
@@ -318,7 +290,7 @@ static int axp288_extcon_probe(struct platform_device *pdev)
         }
 
         /* Start charger cable type detection */
-        queue_delayed_work(system_wq, &info->det_work, 0);
+        axp288_extcon_enable(info);
 
         return 0;
 }
diff --git a/drivers/extcon/extcon-intel-int3496.c b/drivers/extcon/extcon-intel-int3496.c
index c8691b5a9cb0..191e99f06a9a 100644
--- a/drivers/extcon/extcon-intel-int3496.c
+++ b/drivers/extcon/extcon-intel-int3496.c
@@ -153,8 +153,9 @@ static int int3496_probe(struct platform_device *pdev)
                 return ret;
         }
 
-        /* queue initial processing of id-pin */
+        /* process id-pin so that we start with the right status */
         queue_delayed_work(system_wq, &data->work, 0);
+        flush_delayed_work(&data->work);
 
         platform_set_drvdata(pdev, data);
 
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 43ddcdfbd0da..9454ac134ce2 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -645,6 +645,9 @@
 #define USB_DEVICE_ID_LD_MICROCASSYTIME         0x1033
 #define USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE  0x1035
 #define USB_DEVICE_ID_LD_MICROCASSYPH           0x1038
+#define USB_DEVICE_ID_LD_POWERANALYSERCASSY     0x1040
+#define USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY       0x1042
+#define USB_DEVICE_ID_LD_MACHINETESTCASSY       0x1043
 #define USB_DEVICE_ID_LD_JWM            0x1080
 #define USB_DEVICE_ID_LD_DMMP           0x1081
 #define USB_DEVICE_ID_LD_UMIP           0x1090
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 5f6035a5ce36..e92b77fa574a 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -809,6 +809,9 @@ static const struct hid_device_id hid_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTIME) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYPH) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POWERANALYSERCASSY) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MACHINETESTCASSY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_JWM) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_DMMP) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_UMIP) },
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 17fd55af4d92..caa20eb5f26b 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -928,7 +928,7 @@ static int exact_lock(dev_t dev, void *data)
 {
         struct gendisk *p = data;
 
-        if (!get_disk(p))
+        if (!get_disk_and_module(p))
                 return -1;
         return 0;
 }
diff --git a/drivers/iio/adc/aspeed_adc.c b/drivers/iio/adc/aspeed_adc.c
index 327a49ba1991..9515ca165dfd 100644
--- a/drivers/iio/adc/aspeed_adc.c
+++ b/drivers/iio/adc/aspeed_adc.c
@@ -243,7 +243,7 @@ static int aspeed_adc_probe(struct platform_device *pdev)
                                          ASPEED_ADC_INIT_POLLING_TIME,
                                          ASPEED_ADC_INIT_TIMEOUT);
                 if (ret)
-                        goto scaler_error;
+                        goto poll_timeout_error;
         }
 
         /* Start all channels in normal mode. */
@@ -274,9 +274,10 @@ iio_register_error:
         writel(ASPEED_OPERATION_MODE_POWER_DOWN,
                 data->base + ASPEED_REG_ENGINE_CONTROL);
         clk_disable_unprepare(data->clk_scaler->clk);
-reset_error:
-        reset_control_assert(data->rst);
 clk_enable_error:
+poll_timeout_error:
+        reset_control_assert(data->rst);
+reset_error:
         clk_hw_unregister_divider(data->clk_scaler);
 scaler_error:
         clk_hw_unregister_divider(data->clk_prescaler);
diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
index 7f5def465340..9a2583caedaa 100644
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -722,8 +722,6 @@ static int stm32h7_adc_enable(struct stm32_adc *adc)
         int ret;
         u32 val;
 
-        /* Clear ADRDY by writing one, then enable ADC */
-        stm32_adc_set_bits(adc, STM32H7_ADC_ISR, STM32H7_ADRDY);
         stm32_adc_set_bits(adc, STM32H7_ADC_CR, STM32H7_ADEN);
 
         /* Poll for ADRDY to be set (after adc startup time) */
@@ -731,8 +729,11 @@ static int stm32h7_adc_enable(struct stm32_adc *adc)
                                            val & STM32H7_ADRDY,
                                            100, STM32_ADC_TIMEOUT_US);
         if (ret) {
-                stm32_adc_clr_bits(adc, STM32H7_ADC_CR, STM32H7_ADEN);
+                stm32_adc_set_bits(adc, STM32H7_ADC_CR, STM32H7_ADDIS);
                 dev_err(&indio_dev->dev, "Failed to enable ADC\n");
+        } else {
+                /* Clear ADRDY by writing one */
+                stm32_adc_set_bits(adc, STM32H7_ADC_ISR, STM32H7_ADRDY);
         }
 
         return ret;
diff --git a/drivers/iio/imu/adis_trigger.c b/drivers/iio/imu/adis_trigger.c
index 0dd5a381be64..457372f36791 100644
--- a/drivers/iio/imu/adis_trigger.c
+++ b/drivers/iio/imu/adis_trigger.c
@@ -46,6 +46,10 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
         if (adis->trig == NULL)
                 return -ENOMEM;
 
+        adis->trig->dev.parent = &adis->spi->dev;
+        adis->trig->ops = &adis_trigger_ops;
+        iio_trigger_set_drvdata(adis->trig, adis);
+
         ret = request_irq(adis->spi->irq,
                           &iio_trigger_generic_data_rdy_poll,
                           IRQF_TRIGGER_RISING,
@@ -54,9 +58,6 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
         if (ret)
                 goto error_free_trig;
 
-        adis->trig->dev.parent = &adis->spi->dev;
-        adis->trig->ops = &adis_trigger_ops;
-        iio_trigger_set_drvdata(adis->trig, adis);
         ret = iio_trigger_register(adis->trig);
 
         indio_dev->trig = iio_trigger_get(adis->trig);
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 79abf70a126d..cd5bfe39591b 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -175,7 +175,7 @@ __poll_t iio_buffer_poll(struct file *filp,
         struct iio_dev *indio_dev = filp->private_data;
         struct iio_buffer *rb = indio_dev->buffer;
 
-        if (!indio_dev->info)
+        if (!indio_dev->info || rb == NULL)
                 return 0;
 
         poll_wait(filp, &rb->pollq, wait);
diff --git a/drivers/iio/proximity/Kconfig b/drivers/iio/proximity/Kconfig
index fcb1c4ba5e41..f726f9427602 100644
--- a/drivers/iio/proximity/Kconfig
+++ b/drivers/iio/proximity/Kconfig
@@ -68,6 +68,8 @@ config SX9500
 
 config SRF08
         tristate "Devantech SRF02/SRF08/SRF10 ultrasonic ranger sensor"
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         depends on I2C
         help
           Say Y here to build a driver for Devantech SRF02/SRF08/SRF10
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index c4560d84dfae..25bb178f6074 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -305,16 +305,21 @@ void nldev_exit(void);
 static inline struct ib_qp *_ib_create_qp(struct ib_device *dev,
                                           struct ib_pd *pd,
                                           struct ib_qp_init_attr *attr,
-                                          struct ib_udata *udata)
+                                          struct ib_udata *udata,
+                                          struct ib_uobject *uobj)
 {
         struct ib_qp *qp;
 
+        if (!dev->create_qp)
+                return ERR_PTR(-EOPNOTSUPP);
+
         qp = dev->create_qp(pd, attr, udata);
         if (IS_ERR(qp))
                 return qp;
 
         qp->device = dev;
         qp->pd = pd;
+        qp->uobject = uobj;
         /*
          * We don't track XRC QPs for now, because they don't have PD
          * and more importantly they are created internaly by driver,
diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
index 85b5ee4defa4..d8eead5d106d 100644
--- a/drivers/infiniband/core/rdma_core.c
+++ b/drivers/infiniband/core/rdma_core.c
@@ -141,7 +141,12 @@ static struct ib_uobject *alloc_uobj(struct ib_ucontext *context,
          */
         uobj->context = context;
         uobj->type = type;
-        atomic_set(&uobj->usecnt, 0);
+        /*
+         * Allocated objects start out as write locked to deny any other
+         * syscalls from accessing them until they are committed. See
+         * rdma_alloc_commit_uobject
+         */
+        atomic_set(&uobj->usecnt, -1);
         kref_init(&uobj->ref);
 
         return uobj;
@@ -196,7 +201,15 @@ static struct ib_uobject *lookup_get_idr_uobject(const struct uverbs_obj_type *t
                 goto free;
         }
 
-        uverbs_uobject_get(uobj);
+        /*
+         * The idr_find is guaranteed to return a pointer to something that
+         * isn't freed yet, or NULL, as the free after idr_remove goes through
+         * kfree_rcu(). However the object may still have been released and
+         * kfree() could be called at any time.
+         */
+        if (!kref_get_unless_zero(&uobj->ref))
+                uobj = ERR_PTR(-ENOENT);
+
 free:
         rcu_read_unlock();
         return uobj;
@@ -399,13 +412,13 @@ static int __must_check remove_commit_fd_uobject(struct ib_uobject *uobj,
         return ret;
 }
 
-static void lockdep_check(struct ib_uobject *uobj, bool exclusive)
+static void assert_uverbs_usecnt(struct ib_uobject *uobj, bool exclusive)
 {
 #ifdef CONFIG_LOCKDEP
         if (exclusive)
-                WARN_ON(atomic_read(&uobj->usecnt) > 0);
+                WARN_ON(atomic_read(&uobj->usecnt) != -1);
         else
-                WARN_ON(atomic_read(&uobj->usecnt) == -1);
+                WARN_ON(atomic_read(&uobj->usecnt) <= 0);
 #endif
 }
 
@@ -444,7 +457,7 @@ int __must_check rdma_remove_commit_uobject(struct ib_uobject *uobj)
                 WARN(true, "ib_uverbs: Cleanup is running while removing an uobject\n");
                 return 0;
         }
-        lockdep_check(uobj, true);
+        assert_uverbs_usecnt(uobj, true);
         ret = _rdma_remove_commit_uobject(uobj, RDMA_REMOVE_DESTROY);
 
         up_read(&ucontext->cleanup_rwsem);
@@ -474,16 +487,17 @@ int rdma_explicit_destroy(struct ib_uobject *uobject)
                 WARN(true, "ib_uverbs: Cleanup is running while removing an uobject\n");
                 return 0;
         }
-        lockdep_check(uobject, true);
+        assert_uverbs_usecnt(uobject, true);
         ret = uobject->type->type_class->remove_commit(uobject,
                                                        RDMA_REMOVE_DESTROY);
         if (ret)
-                return ret;
+                goto out;
 
         uobject->type = &null_obj_type;
 
+out:
         up_read(&ucontext->cleanup_rwsem);
-        return 0;
+        return ret;
 }
 
 static void alloc_commit_idr_uobject(struct ib_uobject *uobj)
@@ -527,6 +541,10 @@ int rdma_alloc_commit_uobject(struct ib_uobject *uobj)
                 return ret;
         }
 
+        /* matches atomic_set(-1) in alloc_uobj */
+        assert_uverbs_usecnt(uobj, true);
+        atomic_set(&uobj->usecnt, 0);
+
         uobj->type->type_class->alloc_commit(uobj);
         up_read(&uobj->context->cleanup_rwsem);
 
@@ -561,7 +579,7 @@ static void lookup_put_fd_uobject(struct ib_uobject *uobj, bool exclusive)
 
 void rdma_lookup_put_uobject(struct ib_uobject *uobj, bool exclusive)
 {
-        lockdep_check(uobj, exclusive);
+        assert_uverbs_usecnt(uobj, exclusive);
         uobj->type->type_class->lookup_put(uobj, exclusive);
         /*
          * In order to unlock an object, either decrease its usecnt for
diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/restrack.c
index 857637bf46da..3dbc4e4cca41 100644
--- a/drivers/infiniband/core/restrack.c
+++ b/drivers/infiniband/core/restrack.c
@@ -7,7 +7,6 @@
 #include <rdma/restrack.h>
 #include <linux/mutex.h>
 #include <linux/sched/task.h>
-#include <linux/uaccess.h>
 #include <linux/pid_namespace.h>
 
 void rdma_restrack_init(struct rdma_restrack_root *res)
@@ -63,7 +62,6 @@ static struct ib_device *res_to_dev(struct rdma_restrack_entry *res)
 {
         enum rdma_restrack_type type = res->type;
         struct ib_device *dev;
-        struct ib_xrcd *xrcd;
         struct ib_pd *pd;
         struct ib_cq *cq;
         struct ib_qp *qp;
@@ -81,10 +79,6 @@ static struct ib_device *res_to_dev(struct rdma_restrack_entry *res)
                 qp = container_of(res, struct ib_qp, res);
                 dev = qp->device;
                 break;
-        case RDMA_RESTRACK_XRCD:
-                xrcd = container_of(res, struct ib_xrcd, res);
-                dev = xrcd->device;
-                break;
         default:
                 WARN_ONCE(true, "Wrong resource tracking type %u\n", type);
                 return NULL;
@@ -93,6 +87,21 @@ static struct ib_device *res_to_dev(struct rdma_restrack_entry *res)
         return dev;
 }
 
+static bool res_is_user(struct rdma_restrack_entry *res)
+{
+        switch (res->type) {
+        case RDMA_RESTRACK_PD:
+                return container_of(res, struct ib_pd, res)->uobject;
+        case RDMA_RESTRACK_CQ:
+                return container_of(res, struct ib_cq, res)->uobject;
+        case RDMA_RESTRACK_QP:
+                return container_of(res, struct ib_qp, res)->uobject;
+        default:
+                WARN_ONCE(true, "Wrong resource tracking type %u\n", res->type);
+                return false;
+        }
+}
+
 void rdma_restrack_add(struct rdma_restrack_entry *res)
 {
         struct ib_device *dev = res_to_dev(res);
@@ -100,7 +109,7 @@ void rdma_restrack_add(struct rdma_restrack_entry *res)
         if (!dev)
                 return;
 
-        if (!uaccess_kernel()) {
+        if (res_is_user(res)) {
                 get_task_struct(current);
                 res->task = current;
                 res->kern_name = NULL;
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 256934d1f64f..a148de35df8d 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -562,9 +562,10 @@ ssize_t ib_uverbs_open_xrcd(struct ib_uverbs_file *file,
         if (f.file)
                 fdput(f);
 
+        mutex_unlock(&file->device->xrcd_tree_mutex);
+
         uobj_alloc_commit(&obj->uobject);
 
-        mutex_unlock(&file->device->xrcd_tree_mutex);
         return in_len;
 
 err_copy:
@@ -603,10 +604,8 @@ ssize_t ib_uverbs_close_xrcd(struct ib_uverbs_file *file,
 
         uobj  = uobj_get_write(uobj_get_type(xrcd), cmd.xrcd_handle,
                                file->ucontext);
-        if (IS_ERR(uobj)) {
-                mutex_unlock(&file->device->xrcd_tree_mutex);
+        if (IS_ERR(uobj))
                 return PTR_ERR(uobj);
-        }
 
         ret = uobj_remove_commit(uobj);
         return ret ?: in_len;
@@ -979,6 +978,9 @@ static struct ib_ucq_object *create_cq(struct ib_uverbs_file *file,
         struct ib_uverbs_ex_create_cq_resp resp;
         struct ib_cq_init_attr attr = {};
 
+        if (!ib_dev->create_cq)
+                return ERR_PTR(-EOPNOTSUPP);
+
         if (cmd->comp_vector >= file->device->num_comp_vectors)
                 return ERR_PTR(-EINVAL);
 
@@ -1030,14 +1032,14 @@ static struct ib_ucq_object *create_cq(struct ib_uverbs_file *file,
         resp.response_length = offsetof(typeof(resp), response_length) +
                 sizeof(resp.response_length);
 
+        cq->res.type = RDMA_RESTRACK_CQ;
+        rdma_restrack_add(&cq->res);
+
         ret = cb(file, obj, &resp, ucore, context);
         if (ret)
                 goto err_cb;
 
         uobj_alloc_commit(&obj->uobject);
-        cq->res.type = RDMA_RESTRACK_CQ;
-        rdma_restrack_add(&cq->res);
-
         return obj;
 
 err_cb:
@@ -1518,7 +1520,8 @@ static int create_qp(struct ib_uverbs_file *file,
         if (cmd->qp_type == IB_QPT_XRC_TGT)
                 qp = ib_create_qp(pd, &attr);
         else
-                qp = _ib_create_qp(device, pd, &attr, uhw);
+                qp = _ib_create_qp(device, pd, &attr, uhw,
+                                   &obj->uevent.uobject);
 
         if (IS_ERR(qp)) {
                 ret = PTR_ERR(qp);
@@ -1550,8 +1553,10 @@ static int create_qp(struct ib_uverbs_file *file,
                         atomic_inc(&attr.srq->usecnt);
                 if (ind_tbl)
                         atomic_inc(&ind_tbl->usecnt);
+        } else {
+                /* It is done in _ib_create_qp for other QP types */
+                qp->uobject = &obj->uevent.uobject;
         }
-        qp->uobject = &obj->uevent.uobject;
 
         obj->uevent.uobject.object = qp;
 
@@ -1971,8 +1976,15 @@ static int modify_qp(struct ib_uverbs_file *file,
                 goto release_qp;
         }
 
+        if ((cmd->base.attr_mask & IB_QP_AV) &&
+            !rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) {
+                ret = -EINVAL;
+                goto release_qp;
+        }
+
         if ((cmd->base.attr_mask & IB_QP_ALT_PATH) &&
-            !rdma_is_port_valid(qp->device, cmd->base.alt_port_num)) {
+            (!rdma_is_port_valid(qp->device, cmd->base.alt_port_num) ||
+            !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num))) {
                 ret = -EINVAL;
                 goto release_qp;
         }
@@ -2941,6 +2953,11 @@ int ib_uverbs_ex_create_wq(struct ib_uverbs_file *file,
                 wq_init_attr.create_flags = cmd.create_flags;
         obj->uevent.events_reported = 0;
         INIT_LIST_HEAD(&obj->uevent.event_list);
+
+        if (!pd->device->create_wq) {
+                err = -EOPNOTSUPP;
+                goto err_put_cq;
+        }
         wq = pd->device->create_wq(pd, &wq_init_attr, uhw);
         if (IS_ERR(wq)) {
                 err = PTR_ERR(wq);
@@ -3084,7 +3101,12 @@ int ib_uverbs_ex_modify_wq(struct ib_uverbs_file *file,
                 wq_attr.flags = cmd.flags;
                 wq_attr.flags_mask = cmd.flags_mask;
         }
+        if (!wq->device->modify_wq) {
+                ret = -EOPNOTSUPP;
+                goto out;
+        }
         ret = wq->device->modify_wq(wq, &wq_attr, cmd.attr_mask, uhw);
+out:
         uobj_put_obj_read(wq);
         return ret;
 }
@@ -3181,6 +3203,11 @@ int ib_uverbs_ex_create_rwq_ind_table(struct ib_uverbs_file *file,
 
         init_attr.log_ind_tbl_size = cmd.log_ind_tbl_size;
         init_attr.ind_tbl = wqs;
+
+        if (!ib_dev->create_rwq_ind_table) {
+                err = -EOPNOTSUPP;
+                goto err_uobj;
+        }
         rwq_ind_tbl = ib_dev->create_rwq_ind_table(ib_dev, &init_attr, uhw);
 
         if (IS_ERR(rwq_ind_tbl)) {
@@ -3770,6 +3797,9 @@ int ib_uverbs_ex_query_device(struct ib_uverbs_file *file,
         struct ib_device_attr attr = {0};
         int err;
 
+        if (!ib_dev->query_device)
+                return -EOPNOTSUPP;
+
         if (ucore->inlen < sizeof(cmd))
                 return -EINVAL;
 
diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c
index d96dc1d17be1..339b85145044 100644
--- a/drivers/infiniband/core/uverbs_ioctl.c
+++ b/drivers/infiniband/core/uverbs_ioctl.c
@@ -59,6 +59,9 @@ static int uverbs_process_attr(struct ib_device *ibdev,
                         return 0;
         }
 
+        if (test_bit(attr_id, attr_bundle_h->valid_bitmap))
+                return -EINVAL;
+
         spec = &attr_spec_bucket->attrs[attr_id];
         e = &elements[attr_id];
         e->uattr = uattr_ptr;
diff --git a/drivers/infiniband/core/uverbs_ioctl_merge.c b/drivers/infiniband/core/uverbs_ioctl_merge.c
index 062485f9300d..62e1eb1d2a28 100644
--- a/drivers/infiniband/core/uverbs_ioctl_merge.c
+++ b/drivers/infiniband/core/uverbs_ioctl_merge.c
@@ -114,6 +114,7 @@ static size_t get_elements_above_id(const void **iters,
         short min = SHRT_MAX;
         const void *elem;
         int i, j, last_stored = -1;
+        unsigned int equal_min = 0;
 
         for_each_element(elem, i, j, elements, num_elements, num_offset,
                          data_offset) {
@@ -136,6 +137,10 @@ static size_t get_elements_above_id(const void **iters,
                  */
                 iters[last_stored == i ? num_iters - 1 : num_iters++] = elem;
                 last_stored = i;
+                if (min == GET_ID(id))
+                        equal_min++;
+                else
+                        equal_min = 1;
                 min = GET_ID(id);
         }
 
@@ -146,15 +151,10 @@ static size_t get_elements_above_id(const void **iters,
          * Therefore, we need to clean the beginning of the array to make sure
          * all ids of final elements are equal to min.
          */
-        for (i = num_iters - 1; i >= 0 &&
-             GET_ID(*(u16 *)(iters[i] + id_offset)) == min; i--)
-                ;
-
-        num_iters -= i + 1;
-        memmove(iters, iters + i + 1, sizeof(*iters) * num_iters);
+        memmove(iters, iters + num_iters - equal_min, sizeof(*iters) * equal_min);
 
         *min_id = min;
-        return num_iters;
+        return equal_min;
 }
 
 #define find_max_element_entry_id(num_elements, elements, num_objects_fld, \
@@ -322,7 +322,7 @@ static struct uverbs_method_spec *build_method_with_attrs(const struct uverbs_me
                 hash = kzalloc(sizeof(*hash) +
                                ALIGN(sizeof(*hash->attrs) * (attr_max_bucket + 1),
                                      sizeof(long)) +
-                               BITS_TO_LONGS(attr_max_bucket) * sizeof(long),
+                               BITS_TO_LONGS(attr_max_bucket + 1) * sizeof(long),
                                GFP_KERNEL);
                 if (!hash) {
                         res = -ENOMEM;
@@ -509,7 +509,7 @@ static struct uverbs_object_spec *build_object_with_methods(const struct uverbs_
                          * first handler which != NULL. This also defines the
                          * set of flags used for this handler.
                          */
-                        for (i = num_object_defs - 1;
+                        for (i = num_method_defs - 1;
                              i >= 0 && !method_defs[i]->handler; i--)
                                 ;
                         hash->methods[min_id++] = method;
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 395a3b091229..b1ca223aa380 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -650,12 +650,21 @@ static int verify_command_mask(struct ib_device *ib_dev, __u32 command)
         return -1;
 }
 
+static bool verify_command_idx(u32 command, bool extended)
+{
+        if (extended)
+                return command < ARRAY_SIZE(uverbs_ex_cmd_table);
+
+        return command < ARRAY_SIZE(uverbs_cmd_table);
+}
+
 static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                              size_t count, loff_t *pos)
 {
         struct ib_uverbs_file *file = filp->private_data;
         struct ib_device *ib_dev;
         struct ib_uverbs_cmd_hdr hdr;
+        bool extended_command;
         __u32 command;
         __u32 flags;
         int srcu_key;
@@ -688,6 +697,15 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
         }
 
         command = hdr.command & IB_USER_VERBS_CMD_COMMAND_MASK;
+        flags = (hdr.command &
+                 IB_USER_VERBS_CMD_FLAGS_MASK) >> IB_USER_VERBS_CMD_FLAGS_SHIFT;
+
+        extended_command = flags & IB_USER_VERBS_CMD_FLAG_EXTENDED;
+        if (!verify_command_idx(command, extended_command)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         if (verify_command_mask(ib_dev, command)) {
                 ret = -EOPNOTSUPP;
                 goto out;
@@ -699,12 +717,8 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                 goto out;
         }
 
-        flags = (hdr.command &
-                 IB_USER_VERBS_CMD_FLAGS_MASK) >> IB_USER_VERBS_CMD_FLAGS_SHIFT;
-
         if (!flags) {
-                if (command >= ARRAY_SIZE(uverbs_cmd_table) ||
-                    !uverbs_cmd_table[command]) {
+                if (!uverbs_cmd_table[command]) {
                         ret = -EINVAL;
                         goto out;
                 }
@@ -725,8 +739,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                 struct ib_udata uhw;
                 size_t written_count = count;
 
-                if (command >= ARRAY_SIZE(uverbs_ex_cmd_table) ||
-                    !uverbs_ex_cmd_table[command]) {
+                if (!uverbs_ex_cmd_table[command]) {
                         ret = -ENOSYS;
                         goto out;
                 }
@@ -942,6 +955,7 @@ static const struct file_operations uverbs_fops = {
         .llseek  = no_llseek,
 #if IS_ENABLED(CONFIG_INFINIBAND_EXP_USER_ACCESS)
         .unlocked_ioctl = ib_uverbs_ioctl,
+        .compat_ioctl = ib_uverbs_ioctl,
 #endif
 };
 
@@ -954,6 +968,7 @@ static const struct file_operations uverbs_mmap_fops = {
         .llseek  = no_llseek,
 #if IS_ENABLED(CONFIG_INFINIBAND_EXP_USER_ACCESS)
         .unlocked_ioctl = ib_uverbs_ioctl,
+        .compat_ioctl = ib_uverbs_ioctl,
 #endif
 };
 
diff --git a/drivers/infiniband/core/uverbs_std_types.c b/drivers/infiniband/core/uverbs_std_types.c
index cab0ac3556eb..df1360e6774f 100644
--- a/drivers/infiniband/core/uverbs_std_types.c
+++ b/drivers/infiniband/core/uverbs_std_types.c
@@ -234,15 +234,18 @@ static void create_udata(struct uverbs_attr_bundle *ctx,
                 uverbs_attr_get(ctx, UVERBS_UHW_OUT);
 
         if (!IS_ERR(uhw_in)) {
-                udata->inbuf = uhw_in->ptr_attr.ptr;
                 udata->inlen = uhw_in->ptr_attr.len;
+                if (uverbs_attr_ptr_is_inline(uhw_in))
+                        udata->inbuf = &uhw_in->uattr->data;
+                else
+                        udata->inbuf = u64_to_user_ptr(uhw_in->ptr_attr.data);
         } else {
                 udata->inbuf = NULL;
                 udata->inlen = 0;
         }
 
         if (!IS_ERR(uhw_out)) {
-                udata->outbuf = uhw_out->ptr_attr.ptr;
+                udata->outbuf = u64_to_user_ptr(uhw_out->ptr_attr.data);
                 udata->outlen = uhw_out->ptr_attr.len;
         } else {
                 udata->outbuf = NULL;
@@ -323,7 +326,8 @@ static int uverbs_create_cq_handler(struct ib_device *ib_dev,
         cq->res.type = RDMA_RESTRACK_CQ;
         rdma_restrack_add(&cq->res);
 
-        ret = uverbs_copy_to(attrs, CREATE_CQ_RESP_CQE, &cq->cqe);
+        ret = uverbs_copy_to(attrs, CREATE_CQ_RESP_CQE, &cq->cqe,
+                             sizeof(cq->cqe));
         if (ret)
                 goto err_cq;
 
@@ -375,7 +379,7 @@ static int uverbs_destroy_cq_handler(struct ib_device *ib_dev,
         resp.comp_events_reported  = obj->comp_events_reported;
         resp.async_events_reported = obj->async_events_reported;
 
-        return uverbs_copy_to(attrs, DESTROY_CQ_RESP, &resp);
+        return uverbs_copy_to(attrs, DESTROY_CQ_RESP, &resp, sizeof(resp));
 }
 
 static DECLARE_UVERBS_METHOD(
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 16ebc6372c31..93025d2009b8 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -887,7 +887,7 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
         if (qp_init_attr->cap.max_rdma_ctxs)
                 rdma_rw_init_qp(device, qp_init_attr);
 
-        qp = _ib_create_qp(device, pd, qp_init_attr, NULL);
+        qp = _ib_create_qp(device, pd, qp_init_attr, NULL, NULL);
         if (IS_ERR(qp))
                 return qp;
 
@@ -898,7 +898,6 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
         }
 
         qp->real_qp    = qp;
-        qp->uobject    = NULL;
         qp->qp_type    = qp_init_attr->qp_type;
         qp->rwq_ind_tbl = qp_init_attr->rwq_ind_tbl;
 
diff --git a/drivers/infiniband/hw/bnxt_re/bnxt_re.h b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
index ca32057e886f..3eb7a8387116 100644
--- a/drivers/infiniband/hw/bnxt_re/bnxt_re.h
+++ b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
@@ -120,7 +120,6 @@ struct bnxt_re_dev {
 #define BNXT_RE_FLAG_HAVE_L2_REF                3
 #define BNXT_RE_FLAG_RCFW_CHANNEL_EN            4
 #define BNXT_RE_FLAG_QOS_WORK_REG               5
-#define BNXT_RE_FLAG_TASK_IN_PROG               6
 #define BNXT_RE_FLAG_ISSUE_ROCE_STATS          29
         struct net_device               *netdev;
         unsigned int                    version, major, minor;
@@ -158,6 +157,7 @@ struct bnxt_re_dev {
         atomic_t                        srq_count;
         atomic_t                        mr_count;
         atomic_t                        mw_count;
+        atomic_t                        sched_count;
         /* Max of 2 lossless traffic class supported per port */
         u16                             cosq[2];
 
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index ae9e9ff54826..643174d949a8 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -174,10 +174,8 @@ int bnxt_re_query_device(struct ib_device *ibdev,
         ib_attr->max_pd = dev_attr->max_pd;
         ib_attr->max_qp_rd_atom = dev_attr->max_qp_rd_atom;
         ib_attr->max_qp_init_rd_atom = dev_attr->max_qp_init_rd_atom;
-        if (dev_attr->is_atomic) {
-                ib_attr->atomic_cap = IB_ATOMIC_HCA;
-                ib_attr->masked_atomic_cap = IB_ATOMIC_HCA;
-        }
+        ib_attr->atomic_cap = IB_ATOMIC_NONE;
+        ib_attr->masked_atomic_cap = IB_ATOMIC_NONE;
 
         ib_attr->max_ee_rd_atom = 0;
         ib_attr->max_res_rd_atom = 0;
@@ -787,20 +785,51 @@ int bnxt_re_query_ah(struct ib_ah *ib_ah, struct rdma_ah_attr *ah_attr)
         return 0;
 }
 
+static unsigned long bnxt_re_lock_cqs(struct bnxt_re_qp *qp)
+        __acquires(&qp->scq->cq_lock) __acquires(&qp->rcq->cq_lock)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&qp->scq->cq_lock, flags);
+        if (qp->rcq != qp->scq)
+                spin_lock(&qp->rcq->cq_lock);
+        else
+                __acquire(&qp->rcq->cq_lock);
+
+        return flags;
+}
+
+static void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp,
+                               unsigned long flags)
+        __releases(&qp->scq->cq_lock) __releases(&qp->rcq->cq_lock)
+{
+        if (qp->rcq != qp->scq)
+                spin_unlock(&qp->rcq->cq_lock);
+        else
+                __release(&qp->rcq->cq_lock);
+        spin_unlock_irqrestore(&qp->scq->cq_lock, flags);
+}
+
 /* Queue Pairs */
 int bnxt_re_destroy_qp(struct ib_qp *ib_qp)
 {
         struct bnxt_re_qp *qp = container_of(ib_qp, struct bnxt_re_qp, ib_qp);
         struct bnxt_re_dev *rdev = qp->rdev;
         int rc;
+        unsigned int flags;
 
         bnxt_qplib_flush_cqn_wq(&qp->qplib_qp);
-        bnxt_qplib_del_flush_qp(&qp->qplib_qp);
         rc = bnxt_qplib_destroy_qp(&rdev->qplib_res, &qp->qplib_qp);
         if (rc) {
                 dev_err(rdev_to_dev(rdev), "Failed to destroy HW QP");
                 return rc;
         }
+
+        flags = bnxt_re_lock_cqs(qp);
+        bnxt_qplib_clean_qp(&qp->qplib_qp);
+        bnxt_re_unlock_cqs(qp, flags);
+        bnxt_qplib_free_qp_res(&rdev->qplib_res, &qp->qplib_qp);
+
         if (ib_qp->qp_type == IB_QPT_GSI && rdev->qp1_sqp) {
                 rc = bnxt_qplib_destroy_ah(&rdev->qplib_res,
                                            &rdev->sqp_ah->qplib_ah);
@@ -810,7 +839,7 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp)
                         return rc;
                 }
 
-                bnxt_qplib_del_flush_qp(&qp->qplib_qp);
+                bnxt_qplib_clean_qp(&qp->qplib_qp);
                 rc = bnxt_qplib_destroy_qp(&rdev->qplib_res,
                                            &rdev->qp1_sqp->qplib_qp);
                 if (rc) {
@@ -1069,6 +1098,7 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
                         goto fail;
                 }
                 qp->qplib_qp.scq = &cq->qplib_cq;
+                qp->scq = cq;
         }
 
         if (qp_init_attr->recv_cq) {
@@ -1080,6 +1110,7 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
                         goto fail;
                 }
                 qp->qplib_qp.rcq = &cq->qplib_cq;
+                qp->rcq = cq;
         }
 
         if (qp_init_attr->srq) {
@@ -1185,7 +1216,7 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
                 rc = bnxt_qplib_create_qp(&rdev->qplib_res, &qp->qplib_qp);
                 if (rc) {
                         dev_err(rdev_to_dev(rdev), "Failed to create HW QP");
-                        goto fail;
+                        goto free_umem;
                 }
         }
 
@@ -1213,6 +1244,13 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
         return &qp->ib_qp;
 qp_destroy:
         bnxt_qplib_destroy_qp(&rdev->qplib_res, &qp->qplib_qp);
+free_umem:
+        if (udata) {
+                if (qp->rumem)
+                        ib_umem_release(qp->rumem);
+                if (qp->sumem)
+                        ib_umem_release(qp->sumem);
+        }
 fail:
         kfree(qp);
         return ERR_PTR(rc);
@@ -1603,7 +1641,7 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
                         dev_dbg(rdev_to_dev(rdev),
                                 "Move QP = %p out of flush list\n",
                                 qp);
-                        bnxt_qplib_del_flush_qp(&qp->qplib_qp);
+                        bnxt_qplib_clean_qp(&qp->qplib_qp);
                 }
         }
         if (qp_attr_mask & IB_QP_EN_SQD_ASYNC_NOTIFY) {
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.h b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
index 423ebe012f95..b88a48d43a9d 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
@@ -89,6 +89,8 @@ struct bnxt_re_qp {
         /* QP1 */
         u32                     send_psn;
         struct ib_ud_header     qp1_hdr;
+        struct bnxt_re_cq       *scq;
+        struct bnxt_re_cq       *rcq;
 };
 
 struct bnxt_re_cq {
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index 508d00a5a106..33a448036c2e 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -656,7 +656,6 @@ static void bnxt_re_dev_remove(struct bnxt_re_dev *rdev)
         mutex_unlock(&bnxt_re_dev_lock);
 
         synchronize_rcu();
-        flush_workqueue(bnxt_re_wq);
 
         ib_dealloc_device(&rdev->ibdev);
         /* rdev is gone */
@@ -1441,7 +1440,7 @@ static void bnxt_re_task(struct work_struct *work)
                 break;
         }
         smp_mb__before_atomic();
-        clear_bit(BNXT_RE_FLAG_TASK_IN_PROG, &rdev->flags);
+        atomic_dec(&rdev->sched_count);
         kfree(re_work);
 }
 
@@ -1503,7 +1502,7 @@ static int bnxt_re_netdev_event(struct notifier_block *notifier,
                 /* netdev notifier will call NETDEV_UNREGISTER again later since
                  * we are still holding the reference to the netdev
                  */
-                if (test_bit(BNXT_RE_FLAG_TASK_IN_PROG, &rdev->flags))
+                if (atomic_read(&rdev->sched_count) > 0)
                         goto exit;
                 bnxt_re_ib_unreg(rdev, false);
                 bnxt_re_remove_one(rdev);
@@ -1523,7 +1522,7 @@ static int bnxt_re_netdev_event(struct notifier_block *notifier,
                         re_work->vlan_dev = (real_dev == netdev ?
                                              NULL : netdev);
                         INIT_WORK(&re_work->work, bnxt_re_task);
-                        set_bit(BNXT_RE_FLAG_TASK_IN_PROG, &rdev->flags);
+                        atomic_inc(&rdev->sched_count);
                         queue_work(bnxt_re_wq, &re_work->work);
                 }
         }
@@ -1578,6 +1577,11 @@ static void __exit bnxt_re_mod_exit(void)
         */
         list_for_each_entry_safe_reverse(rdev, next, &to_be_deleted, list) {
                 dev_info(rdev_to_dev(rdev), "Unregistering Device");
+                /*
+                 * Flush out any scheduled tasks before destroying the
+                 * resources
+                 */
+                flush_workqueue(bnxt_re_wq);
                 bnxt_re_dev_stop(rdev);
                 bnxt_re_ib_unreg(rdev, true);
                 bnxt_re_remove_one(rdev);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 1b0e94697fe3..3ea5b9624f6b 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -173,7 +173,7 @@ static void __bnxt_qplib_del_flush_qp(struct bnxt_qplib_qp *qp)
         }
 }
 
-void bnxt_qplib_del_flush_qp(struct bnxt_qplib_qp *qp)
+void bnxt_qplib_clean_qp(struct bnxt_qplib_qp *qp)
 {
         unsigned long flags;
 
@@ -1419,7 +1419,6 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res,
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_destroy_qp req;
         struct creq_destroy_qp_resp resp;
-        unsigned long flags;
         u16 cmd_flags = 0;
         int rc;
 
@@ -1437,19 +1436,12 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res,
                 return rc;
         }
 
-        /* Must walk the associated CQs to nullified the QP ptr */
-        spin_lock_irqsave(&qp->scq->hwq.lock, flags);
-
-        __clean_cq(qp->scq, (u64)(unsigned long)qp);
-
-        if (qp->rcq && qp->rcq != qp->scq) {
-                spin_lock(&qp->rcq->hwq.lock);
-                __clean_cq(qp->rcq, (u64)(unsigned long)qp);
-                spin_unlock(&qp->rcq->hwq.lock);
-        }
-
-        spin_unlock_irqrestore(&qp->scq->hwq.lock, flags);
+        return 0;
+}
 
+void bnxt_qplib_free_qp_res(struct bnxt_qplib_res *res,
+                            struct bnxt_qplib_qp *qp)
+{
         bnxt_qplib_free_qp_hdr_buf(res, qp);
         bnxt_qplib_free_hwq(res->pdev, &qp->sq.hwq);
         kfree(qp->sq.swq);
@@ -1462,7 +1454,6 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res,
         if (qp->orrq.max_elements)
                 bnxt_qplib_free_hwq(res->pdev, &qp->orrq);
 
-        return 0;
 }
 
 void *bnxt_qplib_get_qp1_sq_buf(struct bnxt_qplib_qp *qp,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
index 211b27a8f9e2..ca0a2ffa3509 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
@@ -478,6 +478,9 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp);
 int bnxt_qplib_modify_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp);
 int bnxt_qplib_query_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp);
 int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp);
+void bnxt_qplib_clean_qp(struct bnxt_qplib_qp *qp);
+void bnxt_qplib_free_qp_res(struct bnxt_qplib_res *res,
+                            struct bnxt_qplib_qp *qp);
 void *bnxt_qplib_get_qp1_sq_buf(struct bnxt_qplib_qp *qp,
                                 struct bnxt_qplib_sge *sge);
 void *bnxt_qplib_get_qp1_rq_buf(struct bnxt_qplib_qp *qp,
@@ -500,7 +503,6 @@ void bnxt_qplib_req_notify_cq(struct bnxt_qplib_cq *cq, u32 arm_type);
 void bnxt_qplib_free_nq(struct bnxt_qplib_nq *nq);
 int bnxt_qplib_alloc_nq(struct pci_dev *pdev, struct bnxt_qplib_nq *nq);
 void bnxt_qplib_add_flush_qp(struct bnxt_qplib_qp *qp);
-void bnxt_qplib_del_flush_qp(struct bnxt_qplib_qp *qp);
 void bnxt_qplib_acquire_cq_locks(struct bnxt_qplib_qp *qp,
                                  unsigned long *flags);
 void bnxt_qplib_release_cq_locks(struct bnxt_qplib_qp *qp,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
index c015c1861351..03057983341f 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
@@ -52,18 +52,6 @@ const struct bnxt_qplib_gid bnxt_qplib_gid_zero = {{ 0, 0, 0, 0, 0, 0, 0, 0,
 
 /* Device */
 
-static bool bnxt_qplib_is_atomic_cap(struct bnxt_qplib_rcfw *rcfw)
-{
-        int rc;
-        u16 pcie_ctl2;
-
-        rc = pcie_capability_read_word(rcfw->pdev, PCI_EXP_DEVCTL2,
-                                       &pcie_ctl2);
-        if (rc)
-                return false;
-        return !!(pcie_ctl2 & PCI_EXP_DEVCTL2_ATOMIC_REQ);
-}
-
 static void bnxt_qplib_query_version(struct bnxt_qplib_rcfw *rcfw,
                                      char *fw_ver)
 {
@@ -165,7 +153,7 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
                 attr->tqm_alloc_reqs[i * 4 + 3] = *(++tqm_alloc);
         }
 
-        attr->is_atomic = bnxt_qplib_is_atomic_cap(rcfw);
+        attr->is_atomic = 0;
 bail:
         bnxt_qplib_rcfw_free_sbuf(rcfw, sbuf);
         return rc;
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
index faa9478c14a6..f95b97646c25 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
@@ -114,6 +114,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev,
         union pvrdma_cmd_resp rsp;
         struct pvrdma_cmd_create_cq *cmd = &req.create_cq;
         struct pvrdma_cmd_create_cq_resp *resp = &rsp.create_cq_resp;
+        struct pvrdma_create_cq_resp cq_resp = {0};
         struct pvrdma_create_cq ucmd;
 
         BUILD_BUG_ON(sizeof(struct pvrdma_cqe) != 64);
@@ -197,6 +198,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev,
 
         cq->ibcq.cqe = resp->cqe;
         cq->cq_handle = resp->cq_handle;
+        cq_resp.cqn = resp->cq_handle;
         spin_lock_irqsave(&dev->cq_tbl_lock, flags);
         dev->cq_tbl[cq->cq_handle % dev->dsr->caps.max_cq] = cq;
         spin_unlock_irqrestore(&dev->cq_tbl_lock, flags);
@@ -205,7 +207,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev,
                 cq->uar = &(to_vucontext(context)->uar);
 
                 /* Copy udata back. */
-                if (ib_copy_to_udata(udata, &cq->cq_handle, sizeof(__u32))) {
+                if (ib_copy_to_udata(udata, &cq_resp, sizeof(cq_resp))) {
                         dev_warn(&dev->pdev->dev,
                                  "failed to copy back udata\n");
                         pvrdma_destroy_cq(&cq->ibcq);
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c
index 5acebb1ef631..af235967a9c2 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c
@@ -113,6 +113,7 @@ struct ib_srq *pvrdma_create_srq(struct ib_pd *pd,
         union pvrdma_cmd_resp rsp;
         struct pvrdma_cmd_create_srq *cmd = &req.create_srq;
         struct pvrdma_cmd_create_srq_resp *resp = &rsp.create_srq_resp;
+        struct pvrdma_create_srq_resp srq_resp = {0};
         struct pvrdma_create_srq ucmd;
         unsigned long flags;
         int ret;
@@ -204,12 +205,13 @@ struct ib_srq *pvrdma_create_srq(struct ib_pd *pd,
         }
 
         srq->srq_handle = resp->srqn;
+        srq_resp.srqn = resp->srqn;
         spin_lock_irqsave(&dev->srq_tbl_lock, flags);
         dev->srq_tbl[srq->srq_handle % dev->dsr->caps.max_srq] = srq;
         spin_unlock_irqrestore(&dev->srq_tbl_lock, flags);
 
         /* Copy udata back. */
-        if (ib_copy_to_udata(udata, &srq->srq_handle, sizeof(__u32))) {
+        if (ib_copy_to_udata(udata, &srq_resp, sizeof(srq_resp))) {
                 dev_warn(&dev->pdev->dev, "failed to copy back udata\n");
                 pvrdma_destroy_srq(&srq->ibsrq);
                 return ERR_PTR(-EINVAL);
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
index 16b96616ef7e..a51463cd2f37 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
@@ -447,6 +447,7 @@ struct ib_pd *pvrdma_alloc_pd(struct ib_device *ibdev,
         union pvrdma_cmd_resp rsp;
         struct pvrdma_cmd_create_pd *cmd = &req.create_pd;
         struct pvrdma_cmd_create_pd_resp *resp = &rsp.create_pd_resp;
+        struct pvrdma_alloc_pd_resp pd_resp = {0};
         int ret;
         void *ptr;
 
@@ -475,9 +476,10 @@ struct ib_pd *pvrdma_alloc_pd(struct ib_device *ibdev,
         pd->privileged = !context;
         pd->pd_handle = resp->pd_handle;
         pd->pdn = resp->pd_handle;
+        pd_resp.pdn = resp->pd_handle;
 
         if (context) {
-                if (ib_copy_to_udata(udata, &pd->pdn, sizeof(__u32))) {
+                if (ib_copy_to_udata(udata, &pd_resp, sizeof(pd_resp))) {
                         dev_warn(&dev->pdev->dev,
                                  "failed to copy back protection domain\n");
                         pvrdma_dealloc_pd(&pd->ibpd);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_fs.c b/drivers/infiniband/ulp/ipoib/ipoib_fs.c
index 11f74cbe6660..ea302b054601 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_fs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_fs.c
@@ -281,8 +281,6 @@ void ipoib_delete_debug_files(struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = ipoib_priv(dev);
 
-        WARN_ONCE(!priv->mcg_dentry, "null mcg debug file\n");
-        WARN_ONCE(!priv->path_dentry, "null path debug file\n");
         debugfs_remove(priv->mcg_dentry);
         debugfs_remove(priv->path_dentry);
         priv->mcg_dentry = priv->path_dentry = NULL;
diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c
index 55cfb986225b..faf734ff4cf3 100644
--- a/drivers/irqchip/irq-bcm7038-l1.c
+++ b/drivers/irqchip/irq-bcm7038-l1.c
@@ -339,9 +339,6 @@ int __init bcm7038_l1_of_init(struct device_node *dn,
                 goto out_unmap;
         }
 
-        pr_info("registered BCM7038 L1 intc (mem: 0x%p, IRQs: %d)\n",
-                intc->cpus[0]->map_base, IRQS_PER_WORD * intc->n_words);
-
         return 0;
 
 out_unmap:
diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c
index 983640eba418..8968e5e93fcb 100644
--- a/drivers/irqchip/irq-bcm7120-l2.c
+++ b/drivers/irqchip/irq-bcm7120-l2.c
@@ -318,9 +318,6 @@ static int __init bcm7120_l2_intc_probe(struct device_node *dn,
                 }
         }
 
-        pr_info("registered %s intc (mem: 0x%p, parent IRQ(s): %d)\n",
-                        intc_name, data->map_base[0], data->num_parent_irqs);
-
         return 0;
 
 out_free_domain:
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index 691d20eb0bec..0e65f609352e 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -262,9 +262,6 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
                 ct->chip.irq_set_wake = irq_gc_set_wake;
         }
 
-        pr_info("registered L2 intc (mem: 0x%p, parent irq: %d)\n",
-                        base, parent_irq);
-
         return 0;
 
 out_free_domain:
diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
index 993a8426a453..1ff38aff9f29 100644
--- a/drivers/irqchip/irq-gic-v2m.c
+++ b/drivers/irqchip/irq-gic-v2m.c
@@ -94,7 +94,7 @@ static struct irq_chip gicv2m_msi_irq_chip = {
 
 static struct msi_domain_info gicv2m_msi_domain_info = {
         .flags  = (MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS |
-                   MSI_FLAG_PCI_MSIX),
+                   MSI_FLAG_PCI_MSIX | MSI_FLAG_MULTI_PCI_MSI),
         .chip   = &gicv2m_msi_irq_chip,
 };
 
@@ -155,18 +155,12 @@ static int gicv2m_irq_gic_domain_alloc(struct irq_domain *domain,
         return 0;
 }
 
-static void gicv2m_unalloc_msi(struct v2m_data *v2m, unsigned int hwirq)
+static void gicv2m_unalloc_msi(struct v2m_data *v2m, unsigned int hwirq,
+                               int nr_irqs)
 {
-        int pos;
-
-        pos = hwirq - v2m->spi_start;
-        if (pos < 0 || pos >= v2m->nr_spis) {
-                pr_err("Failed to teardown msi. Invalid hwirq %d\n", hwirq);
-                return;
-        }
-
         spin_lock(&v2m_lock);
-        __clear_bit(pos, v2m->bm);
+        bitmap_release_region(v2m->bm, hwirq - v2m->spi_start,
+                              get_count_order(nr_irqs));
         spin_unlock(&v2m_lock);
 }
 
@@ -174,13 +168,13 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
                                    unsigned int nr_irqs, void *args)
 {
         struct v2m_data *v2m = NULL, *tmp;
-        int hwirq, offset, err = 0;
+        int hwirq, offset, i, err = 0;
 
         spin_lock(&v2m_lock);
         list_for_each_entry(tmp, &v2m_nodes, entry) {
-                offset = find_first_zero_bit(tmp->bm, tmp->nr_spis);
-                if (offset < tmp->nr_spis) {
-                        __set_bit(offset, tmp->bm);
+                offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+                                                 get_count_order(nr_irqs));
+                if (offset >= 0) {
                         v2m = tmp;
                         break;
                 }
@@ -192,16 +186,21 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
 
         hwirq = v2m->spi_start + offset;
 
-        err = gicv2m_irq_gic_domain_alloc(domain, virq, hwirq);
-        if (err) {
-                gicv2m_unalloc_msi(v2m, hwirq);
-                return err;
-        }
+        for (i = 0; i < nr_irqs; i++) {
+                err = gicv2m_irq_gic_domain_alloc(domain, virq + i, hwirq + i);
+                if (err)
+                        goto fail;
 
-        irq_domain_set_hwirq_and_chip(domain, virq, hwirq,
-                                      &gicv2m_irq_chip, v2m);
+                irq_domain_set_hwirq_and_chip(domain, virq + i, hwirq + i,
+                                              &gicv2m_irq_chip, v2m);
+        }
 
         return 0;
+
+fail:
+        irq_domain_free_irqs_parent(domain, virq, nr_irqs);
+        gicv2m_unalloc_msi(v2m, hwirq, get_count_order(nr_irqs));
+        return err;
 }
 
 static void gicv2m_irq_domain_free(struct irq_domain *domain,
@@ -210,8 +209,7 @@ static void gicv2m_irq_domain_free(struct irq_domain *domain,
         struct irq_data *d = irq_domain_get_irq_data(domain, virq);
         struct v2m_data *v2m = irq_data_get_irq_chip_data(d);
 
-        BUG_ON(nr_irqs != 1);
-        gicv2m_unalloc_msi(v2m, d->hwirq);
+        gicv2m_unalloc_msi(v2m, d->hwirq, nr_irqs);
         irq_domain_free_irqs_parent(domain, virq, nr_irqs);
 }
 
diff --git a/drivers/irqchip/irq-gic-v3-its-pci-msi.c b/drivers/irqchip/irq-gic-v3-its-pci-msi.c
index 14a8c0a7e095..25a98de5cfb2 100644
--- a/drivers/irqchip/irq-gic-v3-its-pci-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-pci-msi.c
@@ -132,6 +132,8 @@ static int __init its_pci_of_msi_init(void)
 
         for (np = of_find_matching_node(NULL, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller"))
                         continue;
 
diff --git a/drivers/irqchip/irq-gic-v3-its-platform-msi.c b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
index 833a90fe33ae..8881a053c173 100644
--- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
@@ -154,6 +154,8 @@ static void __init its_pmsi_of_init(void)
 
         for (np = of_find_matching_node(NULL, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller"))
                         continue;
 
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 06f025fd5726..1d3056f53747 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -3314,6 +3314,8 @@ static int __init its_of_probe(struct device_node *node)
 
         for (np = of_find_matching_node(node, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller")) {
                         pr_warn("%pOF: no msi-controller property, ITS ignored\n",
                                 np);
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index a57c0fbbd34a..d99cc07903ec 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -673,7 +673,7 @@ static void gic_send_sgi(u64 cluster_id, u16 tlist, unsigned int irq)
                MPIDR_TO_SGI_RS(cluster_id)              |
                tlist << ICC_SGI1R_TARGET_LIST_SHIFT);
 
-        pr_debug("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
+        pr_devel("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
         gic_write_sgi1r(val);
 }
 
@@ -688,7 +688,7 @@ static void gic_raise_softirq(const struct cpumask *mask, unsigned int irq)
          * Ensure that stores to Normal memory are visible to the
          * other CPUs before issuing the IPI.
          */
-        smp_wmb();
+        wmb();
 
         for_each_cpu(cpu, mask) {
                 u64 cluster_id = MPIDR_TO_SGI_CLUSTER_ID(cpu_logical_map(cpu));
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index ef92a4d2038e..d32268cc1174 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -424,8 +424,6 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
         spin_lock_irqsave(&gic_lock, flags);
         write_gic_map_pin(intr, GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin);
         write_gic_map_vp(intr, BIT(mips_cm_vp_id(cpu)));
-        gic_clear_pcpu_masks(intr);
-        set_bit(intr, per_cpu_ptr(pcpu_masks, cpu));
         irq_data_update_effective_affinity(data, cpumask_of(cpu));
         spin_unlock_irqrestore(&gic_lock, flags);
 
diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
index 62f541f968f6..07074820a167 100644
--- a/drivers/macintosh/macio_asic.c
+++ b/drivers/macintosh/macio_asic.c
@@ -375,6 +375,7 @@ static struct macio_dev * macio_add_one_device(struct macio_chip *chip,
         dev->ofdev.dev.of_node = np;
         dev->ofdev.archdata.dma_mask = 0xffffffffUL;
         dev->ofdev.dev.dma_mask = &dev->ofdev.archdata.dma_mask;
+        dev->ofdev.dev.coherent_dma_mask = dev->ofdev.archdata.dma_mask;
         dev->ofdev.dev.parent = parent;
         dev->ofdev.dev.bus = &macio_bus_type;
         dev->ofdev.dev.release = macio_release_dev;
diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
index 1a46b41dac70..6422846b546e 100644
--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -659,11 +659,11 @@ static void do_bio_hook(struct search *s, struct bio *orig_bio)
 static void search_free(struct closure *cl)
 {
         struct search *s = container_of(cl, struct search, cl);
-        bio_complete(s);
 
         if (s->iop.bio)
                 bio_put(s->iop.bio);
 
+        bio_complete(s);
         closure_debug_destroy(cl);
         mempool_free(s, s->d->c->search);
 }
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 312895788036..4d1d8dfb2d2a 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1274,7 +1274,7 @@ static int flash_devs_run(struct cache_set *c)
         struct uuid_entry *u;
 
         for (u = c->uuids;
-             u < c->uuids + c->devices_max_used && !ret;
+             u < c->uuids + c->nr_uuids && !ret;
              u++)
                 if (UUID_FLASH_ONLY(u))
                         ret = flash_dev_run(c, u);
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 3e5eabdae8d9..772d02922529 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -548,12 +548,6 @@ int mei_cldev_disable(struct mei_cl_device *cldev)
                 goto out;
         }
 
-        if (bus->dev_state == MEI_DEV_POWER_DOWN) {
-                dev_dbg(bus->dev, "Device is powering down, don't bother with disconnection\n");
-                err = 0;
-                goto out;
-        }
-
         err = mei_cl_disconnect(cl);
         if (err < 0)
                 dev_err(bus->dev, "Could not disconnect from the ME client\n");
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index be64969d986a..7e60c1817c31 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -945,6 +945,12 @@ int mei_cl_disconnect(struct mei_cl *cl)
                 return 0;
         }
 
+        if (dev->dev_state == MEI_DEV_POWER_DOWN) {
+                cl_dbg(dev, cl, "Device is powering down, don't bother with disconnection\n");
+                mei_cl_set_disconnected(cl);
+                return 0;
+        }
+
         rets = pm_runtime_get(dev->dev);
         if (rets < 0 && rets != -EINPROGRESS) {
                 pm_runtime_put_noidle(dev->dev);
diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index 0ccccbaf530d..e4b10b2d1a08 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -132,6 +132,11 @@
 #define MEI_DEV_ID_KBP        0xA2BA  /* Kaby Point */
 #define MEI_DEV_ID_KBP_2      0xA2BB  /* Kaby Point 2 */
 
+#define MEI_DEV_ID_CNP_LP     0x9DE0  /* Cannon Point LP */
+#define MEI_DEV_ID_CNP_LP_4   0x9DE4  /* Cannon Point LP 4 (iTouch) */
+#define MEI_DEV_ID_CNP_H      0xA360  /* Cannon Point H */
+#define MEI_DEV_ID_CNP_H_4    0xA364  /* Cannon Point H 4 (iTouch) */
+
 /*
  * MEI HW Section
  */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 4a0ccda4d04b..ea4e152270a3 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -98,6 +98,11 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
         {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, MEI_ME_PCH8_CFG)},
 
+        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP_4, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
+
         /* required last entry */
         {0, }
 };
diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
index 229dc18f0581..768972af8b85 100644
--- a/drivers/mmc/host/bcm2835.c
+++ b/drivers/mmc/host/bcm2835.c
@@ -1265,7 +1265,8 @@ static int bcm2835_add_host(struct bcm2835_host *host)
         char pio_limit_string[20];
         int ret;
 
-        mmc->f_max = host->max_clk;
+        if (!mmc->f_max || mmc->f_max > host->max_clk)
+                mmc->f_max = host->max_clk;
         mmc->f_min = host->max_clk / SDCDIV_MAX_CDIV;
 
         mmc->max_busy_timeout = ~0 / (mmc->f_max / 1000);
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index 22438ebfe4e6..4f972b879fe6 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -717,22 +717,6 @@ static int meson_mmc_clk_phase_tuning(struct mmc_host *mmc, u32 opcode,
 static int meson_mmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
 {
         struct meson_host *host = mmc_priv(mmc);
-        int ret;
-
-        /*
-         * If this is the initial tuning, try to get a sane Rx starting
-         * phase before doing the actual tuning.
-         */
-        if (!mmc->doing_retune) {
-                ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
-
-                if (ret)
-                        return ret;
-        }
-
-        ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->tx_clk);
-        if (ret)
-                return ret;
 
         return meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
 }
@@ -763,9 +747,8 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                 if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
 
-                /* Reset phases */
+                /* Reset rx phase */
                 clk_set_phase(host->rx_clk, 0);
-                clk_set_phase(host->tx_clk, 270);
 
                 break;
 
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index e6b8c59f2c0d..736ac887303c 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -328,7 +328,7 @@ config MTD_NAND_MARVELL
         tristate "NAND controller support on Marvell boards"
         depends on PXA3xx || ARCH_MMP || PLAT_ORION || ARCH_MVEBU || \
                    COMPILE_TEST
-        depends on HAS_IOMEM
+        depends on HAS_IOMEM && HAS_DMA
         help
           This enables the NAND flash controller driver for Marvell boards,
           including:
diff --git a/drivers/mtd/nand/vf610_nfc.c b/drivers/mtd/nand/vf610_nfc.c
index 80d31a58e558..f367144f3c6f 100644
--- a/drivers/mtd/nand/vf610_nfc.c
+++ b/drivers/mtd/nand/vf610_nfc.c
@@ -752,10 +752,8 @@ static int vf610_nfc_probe(struct platform_device *pdev)
                 if (mtd->oobsize > 64)
                         mtd->oobsize = 64;
 
-                /*
-                 * mtd->ecclayout is not specified here because we're using the
-                 * default large page ECC layout defined in NAND core.
-                 */
+                /* Use default large page ECC layout defined in NAND core */
+                mtd_set_ooblayout(mtd, &nand_ooblayout_lp_ops);
                 if (chip->ecc.strength == 32) {
                         nfc->ecc_mode = ECC_60_BYTE;
                         chip->ecc.bytes = 60;
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index a77ee2f8fb8d..c1841db1b500 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -820,7 +820,7 @@ static int tg3_ape_event_lock(struct tg3 *tp, u32 timeout_us)
 
                 tg3_ape_unlock(tp, TG3_APE_LOCK_MEM);
 
-                udelay(10);
+                usleep_range(10, 20);
                 timeout_us -= (timeout_us > 10) ? 10 : timeout_us;
         }
 
@@ -922,8 +922,8 @@ static int tg3_ape_send_event(struct tg3 *tp, u32 event)
         if (!(apedata & APE_FW_STATUS_READY))
                 return -EAGAIN;
 
-        /* Wait for up to 1 millisecond for APE to service previous event. */
-        err = tg3_ape_event_lock(tp, 1000);
+        /* Wait for up to 20 millisecond for APE to service previous event. */
+        err = tg3_ape_event_lock(tp, 20000);
         if (err)
                 return err;
 
@@ -946,6 +946,7 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
 
         switch (kind) {
         case RESET_KIND_INIT:
+                tg3_ape_write32(tp, TG3_APE_HOST_HEARTBEAT_COUNT, tp->ape_hb++);
                 tg3_ape_write32(tp, TG3_APE_HOST_SEG_SIG,
                                 APE_HOST_SEG_SIG_MAGIC);
                 tg3_ape_write32(tp, TG3_APE_HOST_SEG_LEN,
@@ -962,13 +963,6 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
                 event = APE_EVENT_STATUS_STATE_START;
                 break;
         case RESET_KIND_SHUTDOWN:
-                /* With the interface we are currently using,
-                 * APE does not track driver state.  Wiping
-                 * out the HOST SEGMENT SIGNATURE forces
-                 * the APE to assume OS absent status.
-                 */
-                tg3_ape_write32(tp, TG3_APE_HOST_SEG_SIG, 0x0);
-
                 if (device_may_wakeup(&tp->pdev->dev) &&
                     tg3_flag(tp, WOL_ENABLE)) {
                         tg3_ape_write32(tp, TG3_APE_HOST_WOL_SPEED,
@@ -990,6 +984,18 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
         tg3_ape_send_event(tp, event);
 }
 
+static void tg3_send_ape_heartbeat(struct tg3 *tp,
+                                   unsigned long interval)
+{
+        /* Check if hb interval has exceeded */
+        if (!tg3_flag(tp, ENABLE_APE) ||
+            time_before(jiffies, tp->ape_hb_jiffies + interval))
+                return;
+
+        tg3_ape_write32(tp, TG3_APE_HOST_HEARTBEAT_COUNT, tp->ape_hb++);
+        tp->ape_hb_jiffies = jiffies;
+}
+
 static void tg3_disable_ints(struct tg3 *tp)
 {
         int i;
@@ -7262,6 +7268,7 @@ static int tg3_poll_msix(struct napi_struct *napi, int budget)
                 }
         }
 
+        tg3_send_ape_heartbeat(tp, TG3_APE_HB_INTERVAL << 1);
         return work_done;
 
 tx_recovery:
@@ -7344,6 +7351,7 @@ static int tg3_poll(struct napi_struct *napi, int budget)
                 }
         }
 
+        tg3_send_ape_heartbeat(tp, TG3_APE_HB_INTERVAL << 1);
         return work_done;
 
 tx_recovery:
@@ -10732,7 +10740,7 @@ static int tg3_reset_hw(struct tg3 *tp, bool reset_phy)
         if (tg3_flag(tp, ENABLE_APE))
                 /* Write our heartbeat update interval to APE. */
                 tg3_ape_write32(tp, TG3_APE_HOST_HEARTBEAT_INT_MS,
-                                APE_HOST_HEARTBEAT_INT_DISABLE);
+                                APE_HOST_HEARTBEAT_INT_5SEC);
 
         tg3_write_sig_post_reset(tp, RESET_KIND_INIT);
 
@@ -11077,6 +11085,9 @@ static void tg3_timer(struct timer_list *t)
                 tp->asf_counter = tp->asf_multiplier;
         }
 
+        /* Update the APE heartbeat every 5 seconds.*/
+        tg3_send_ape_heartbeat(tp, TG3_APE_HB_INTERVAL);
+
         spin_unlock(&tp->lock);
 
 restart_timer:
@@ -16653,6 +16664,8 @@ static int tg3_get_invariants(struct tg3 *tp, const struct pci_device_id *ent)
                                        pci_state_reg);
 
                 tg3_ape_lock_init(tp);
+                tp->ape_hb_interval =
+                        msecs_to_jiffies(APE_HOST_HEARTBEAT_INT_5SEC);
         }
 
         /* Set up tp->grc_local_ctrl before calling
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index 47f51cc0566d..1d61aa3efda1 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -2508,6 +2508,7 @@
 #define TG3_APE_LOCK_PHY3               5
 #define TG3_APE_LOCK_GPIO               7
 
+#define TG3_APE_HB_INTERVAL             (tp->ape_hb_interval)
 #define TG3_EEPROM_SB_F1R2_MBA_OFF      0x10
 
 
@@ -3423,6 +3424,10 @@ struct tg3 {
         struct device                   *hwmon_dev;
         bool                            link_up;
         bool                            pcierr_recovery;
+
+        u32                             ape_hb;
+        unsigned long                   ape_hb_interval;
+        unsigned long                   ape_hb_jiffies;
 };
 
 /* Accessor macros for chip and asic attributes
diff --git a/drivers/net/ethernet/cavium/common/cavium_ptp.c b/drivers/net/ethernet/cavium/common/cavium_ptp.c
index c87c9c684a33..d59497a7bdce 100644
--- a/drivers/net/ethernet/cavium/common/cavium_ptp.c
+++ b/drivers/net/ethernet/cavium/common/cavium_ptp.c
@@ -75,6 +75,8 @@ EXPORT_SYMBOL(cavium_ptp_get);
 
 void cavium_ptp_put(struct cavium_ptp *ptp)
 {
+        if (!ptp)
+                return;
         pci_dev_put(ptp->pdev);
 }
 EXPORT_SYMBOL(cavium_ptp_put);
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index b68cde9f17d2..7d9c5ffbd041 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -67,11 +67,6 @@ module_param(cpi_alg, int, S_IRUGO);
 MODULE_PARM_DESC(cpi_alg,
                  "PFC algorithm (0=none, 1=VLAN, 2=VLAN16, 3=IP Diffserv)");
 
-struct nicvf_xdp_tx {
-        u64 dma_addr;
-        u8  qidx;
-};
-
 static inline u8 nicvf_netdev_qidx(struct nicvf *nic, u8 qidx)
 {
         if (nic->sqs_mode)
@@ -507,29 +502,14 @@ static int nicvf_init_resources(struct nicvf *nic)
         return 0;
 }
 
-static void nicvf_unmap_page(struct nicvf *nic, struct page *page, u64 dma_addr)
-{
-        /* Check if it's a recycled page, if not unmap the DMA mapping.
-         * Recycled page holds an extra reference.
-         */
-        if (page_ref_count(page) == 1) {
-                dma_addr &= PAGE_MASK;
-                dma_unmap_page_attrs(&nic->pdev->dev, dma_addr,
-                                     RCV_FRAG_LEN + XDP_HEADROOM,
-                                     DMA_FROM_DEVICE,
-                                     DMA_ATTR_SKIP_CPU_SYNC);
-        }
-}
-
 static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
                                 struct cqe_rx_t *cqe_rx, struct snd_queue *sq,
                                 struct rcv_queue *rq, struct sk_buff **skb)
 {
         struct xdp_buff xdp;
         struct page *page;
-        struct nicvf_xdp_tx *xdp_tx = NULL;
         u32 action;
-        u16 len, err, offset = 0;
+        u16 len, offset = 0;
         u64 dma_addr, cpu_addr;
         void *orig_data;
 
@@ -543,7 +523,7 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
         cpu_addr = (u64)phys_to_virt(cpu_addr);
         page = virt_to_page((void *)cpu_addr);
 
-        xdp.data_hard_start = page_address(page) + RCV_BUF_HEADROOM;
+        xdp.data_hard_start = page_address(page);
         xdp.data = (void *)cpu_addr;
         xdp_set_data_meta_invalid(&xdp);
         xdp.data_end = xdp.data + len;
@@ -563,7 +543,18 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
 
         switch (action) {
         case XDP_PASS:
-                nicvf_unmap_page(nic, page, dma_addr);
+                /* Check if it's a recycled page, if not
+                 * unmap the DMA mapping.
+                 *
+                 * Recycled page holds an extra reference.
+                 */
+                if (page_ref_count(page) == 1) {
+                        dma_addr &= PAGE_MASK;
+                        dma_unmap_page_attrs(&nic->pdev->dev, dma_addr,
+                                             RCV_FRAG_LEN + XDP_PACKET_HEADROOM,
+                                             DMA_FROM_DEVICE,
+                                             DMA_ATTR_SKIP_CPU_SYNC);
+                }
 
                 /* Build SKB and pass on packet to network stack */
                 *skb = build_skb(xdp.data,
@@ -576,20 +567,6 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
         case XDP_TX:
                 nicvf_xdp_sq_append_pkt(nic, sq, (u64)xdp.data, dma_addr, len);
                 return true;
-        case XDP_REDIRECT:
-                /* Save DMA address for use while transmitting */
-                xdp_tx = (struct nicvf_xdp_tx *)page_address(page);
-                xdp_tx->dma_addr = dma_addr;
-                xdp_tx->qidx = nicvf_netdev_qidx(nic, cqe_rx->rq_idx);
-
-                err = xdp_do_redirect(nic->pnicvf->netdev, &xdp, prog);
-                if (!err)
-                        return true;
-
-                /* Free the page on error */
-                nicvf_unmap_page(nic, page, dma_addr);
-                put_page(page);
-                break;
         default:
                 bpf_warn_invalid_xdp_action(action);
                 /* fall through */
@@ -597,7 +574,18 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
                 trace_xdp_exception(nic->netdev, prog, action);
                 /* fall through */
         case XDP_DROP:
-                nicvf_unmap_page(nic, page, dma_addr);
+                /* Check if it's a recycled page, if not
+                 * unmap the DMA mapping.
+                 *
+                 * Recycled page holds an extra reference.
+                 */
+                if (page_ref_count(page) == 1) {
+                        dma_addr &= PAGE_MASK;
+                        dma_unmap_page_attrs(&nic->pdev->dev, dma_addr,
+                                             RCV_FRAG_LEN + XDP_PACKET_HEADROOM,
+                                             DMA_FROM_DEVICE,
+                                             DMA_ATTR_SKIP_CPU_SYNC);
+                }
                 put_page(page);
                 return true;
         }
@@ -1864,50 +1852,6 @@ static int nicvf_xdp(struct net_device *netdev, struct netdev_bpf *xdp)
         }
 }
 
-static int nicvf_xdp_xmit(struct net_device *netdev, struct xdp_buff *xdp)
-{
-        struct nicvf *nic = netdev_priv(netdev);
-        struct nicvf *snic = nic;
-        struct nicvf_xdp_tx *xdp_tx;
-        struct snd_queue *sq;
-        struct page *page;
-        int err, qidx;
-
-        if (!netif_running(netdev) || !nic->xdp_prog)
-                return -EINVAL;
-
-        page = virt_to_page(xdp->data);
-        xdp_tx = (struct nicvf_xdp_tx *)page_address(page);
-        qidx = xdp_tx->qidx;
-
-        if (xdp_tx->qidx >= nic->xdp_tx_queues)
-                return -EINVAL;
-
-        /* Get secondary Qset's info */
-        if (xdp_tx->qidx >= MAX_SND_QUEUES_PER_QS) {
-                qidx = xdp_tx->qidx / MAX_SND_QUEUES_PER_QS;
-                snic = (struct nicvf *)nic->snicvf[qidx - 1];
-                if (!snic)
-                        return -EINVAL;
-                qidx = xdp_tx->qidx % MAX_SND_QUEUES_PER_QS;
-        }
-
-        sq = &snic->qs->sq[qidx];
-        err = nicvf_xdp_sq_append_pkt(snic, sq, (u64)xdp->data,
-                                      xdp_tx->dma_addr,
-                                      xdp->data_end - xdp->data);
-        if (err)
-                return -ENOMEM;
-
-        nicvf_xdp_sq_doorbell(snic, sq, qidx);
-        return 0;
-}
-
-static void nicvf_xdp_flush(struct net_device *dev)
-{
-        return;
-}
-
 static int nicvf_config_hwtstamp(struct net_device *netdev, struct ifreq *ifr)
 {
         struct hwtstamp_config config;
@@ -1986,8 +1930,6 @@ static const struct net_device_ops nicvf_netdev_ops = {
         .ndo_fix_features       = nicvf_fix_features,
         .ndo_set_features       = nicvf_set_features,
         .ndo_bpf                = nicvf_xdp,
-        .ndo_xdp_xmit           = nicvf_xdp_xmit,
-        .ndo_xdp_flush          = nicvf_xdp_flush,
         .ndo_do_ioctl           = nicvf_ioctl,
 };
 
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 3eae9ff9b53a..d42704d07484 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -204,7 +204,7 @@ static inline int nicvf_alloc_rcv_buffer(struct nicvf *nic, struct rbdr *rbdr,
 
         /* Reserve space for header modifications by BPF program */
         if (rbdr->is_xdp)
-                buf_len += XDP_HEADROOM;
+                buf_len += XDP_PACKET_HEADROOM;
 
         /* Check if it's recycled */
         if (pgcache)
@@ -224,9 +224,8 @@ ret:
                         nic->rb_page = NULL;
                         return -ENOMEM;
                 }
-
                 if (pgcache)
-                        pgcache->dma_addr = *rbuf + XDP_HEADROOM;
+                        pgcache->dma_addr = *rbuf + XDP_PACKET_HEADROOM;
                 nic->rb_page_offset += buf_len;
         }
 
@@ -1244,7 +1243,7 @@ int nicvf_xdp_sq_append_pkt(struct nicvf *nic, struct snd_queue *sq,
         int qentry;
 
         if (subdesc_cnt > sq->xdp_free_cnt)
-                return -1;
+                return 0;
 
         qentry = nicvf_get_sq_desc(sq, subdesc_cnt);
 
@@ -1255,7 +1254,7 @@ int nicvf_xdp_sq_append_pkt(struct nicvf *nic, struct snd_queue *sq,
 
         sq->xdp_desc_cnt += subdesc_cnt;
 
-        return 0;
+        return 1;
 }
 
 /* Calculate no of SQ subdescriptors needed to transmit all
@@ -1656,7 +1655,7 @@ static void nicvf_unmap_rcv_buffer(struct nicvf *nic, u64 dma_addr,
                 if (page_ref_count(page) != 1)
                         return;
 
-                len += XDP_HEADROOM;
+                len += XDP_PACKET_HEADROOM;
                 /* Receive buffers in XDP mode are mapped from page start */
                 dma_addr &= PAGE_MASK;
         }
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
index ce1eed7a6d63..5e9a03cf1b4d 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
@@ -11,7 +11,6 @@
 
 #include <linux/netdevice.h>
 #include <linux/iommu.h>
-#include <linux/bpf.h>
 #include <net/xdp.h>
 #include "q_struct.h"
 
@@ -94,9 +93,6 @@
 #define RCV_FRAG_LEN     (SKB_DATA_ALIGN(DMA_BUFFER_LEN + NET_SKB_PAD) + \
                          SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 
-#define RCV_BUF_HEADROOM        128 /* To store dma address for XDP redirect */
-#define XDP_HEADROOM            (XDP_PACKET_HEADROOM + RCV_BUF_HEADROOM)
-
 #define MAX_CQES_FOR_TX         ((SND_QUEUE_LEN / MIN_SQ_DESC_PER_PKT_XMIT) * \
                                  MAX_CQE_PER_PKT_XMIT)
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
index 557fd8bfd54e..00a1d2d13169 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
@@ -472,7 +472,7 @@ int cudbg_collect_cim_la(struct cudbg_init *pdbg_init,
 
         if (is_t6(padap->params.chip)) {
                 size = padap->params.cim_la_size / 10 + 1;
-                size *= 11 * sizeof(u32);
+                size *= 10 * sizeof(u32);
         } else {
                 size = padap->params.cim_la_size / 8;
                 size *= 8 * sizeof(u32);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c
index 30485f9a598f..143686c60234 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c
@@ -102,7 +102,7 @@ static u32 cxgb4_get_entity_length(struct adapter *adap, u32 entity)
         case CUDBG_CIM_LA:
                 if (is_t6(adap->params.chip)) {
                         len = adap->params.cim_la_size / 10 + 1;
-                        len *= 11 * sizeof(u32);
+                        len *= 10 * sizeof(u32);
                 } else {
                         len = adap->params.cim_la_size / 8;
                         len *= 8 * sizeof(u32);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 56bc626ef006..7b452e85de2a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4982,9 +4982,10 @@ static int cxgb4_iov_configure(struct pci_dev *pdev, int num_vfs)
 
         pcie_fw = readl(adap->regs + PCIE_FW_A);
         /* Check if cxgb4 is the MASTER and fw is initialized */
-        if (!(pcie_fw & PCIE_FW_INIT_F) ||
+        if (num_vfs &&
+            (!(pcie_fw & PCIE_FW_INIT_F) ||
             !(pcie_fw & PCIE_FW_MASTER_VLD_F) ||
-            PCIE_FW_MASTER_G(pcie_fw) != CXGB4_UNIFIED_PF) {
+            PCIE_FW_MASTER_G(pcie_fw) != CXGB4_UNIFIED_PF)) {
                 dev_warn(&pdev->dev,
                          "cxgb4 driver needs to be MASTER to support SRIOV\n");
                 return -EOPNOTSUPP;
@@ -5599,24 +5600,24 @@ static void remove_one(struct pci_dev *pdev)
 #if IS_ENABLED(CONFIG_IPV6)
                 t4_cleanup_clip_tbl(adapter);
 #endif
-                iounmap(adapter->regs);
                 if (!is_t4(adapter->params.chip))
                         iounmap(adapter->bar2);
-                pci_disable_pcie_error_reporting(pdev);
-                if ((adapter->flags & DEV_ENABLED)) {
-                        pci_disable_device(pdev);
-                        adapter->flags &= ~DEV_ENABLED;
-                }
-                pci_release_regions(pdev);
-                kfree(adapter->mbox_log);
-                synchronize_rcu();
-                kfree(adapter);
         }
 #ifdef CONFIG_PCI_IOV
         else {
                 cxgb4_iov_configure(adapter->pdev, 0);
         }
 #endif
+        iounmap(adapter->regs);
+        pci_disable_pcie_error_reporting(pdev);
+        if ((adapter->flags & DEV_ENABLED)) {
+                pci_disable_device(pdev);
+                adapter->flags &= ~DEV_ENABLED;
+        }
+        pci_release_regions(pdev);
+        kfree(adapter->mbox_log);
+        synchronize_rcu();
+        kfree(adapter);
 }
 
 /* "Shutdown" quiesces the device, stopping Ingress Packet and Interrupt
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 047609ef0515..920bccd6bc40 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -2637,7 +2637,6 @@ void t4_get_regs(struct adapter *adap, void *buf, size_t buf_size)
 }
 
 #define EEPROM_STAT_ADDR   0x7bfc
-#define VPD_SIZE           0x800
 #define VPD_BASE           0x400
 #define VPD_BASE_OLD       0
 #define VPD_LEN            1024
@@ -2704,15 +2703,6 @@ int t4_get_raw_vpd_params(struct adapter *adapter, struct vpd_params *p)
         if (!vpd)
                 return -ENOMEM;
 
-        /* We have two VPD data structures stored in the adapter VPD area.
-         * By default, Linux calculates the size of the VPD area by traversing
-         * the first VPD area at offset 0x0, so we need to tell the OS what
-         * our real VPD size is.
-         */
-        ret = pci_set_vpd_size(adapter->pdev, VPD_SIZE);
-        if (ret < 0)
-                goto out;
-
         /* Card information normally starts at VPD_BASE but early cards had
          * it at 0.
          */
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 27447260215d..996f47568f9e 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -791,6 +791,18 @@ static int ibmvnic_login(struct net_device *netdev)
         return 0;
 }
 
+static void release_login_buffer(struct ibmvnic_adapter *adapter)
+{
+        kfree(adapter->login_buf);
+        adapter->login_buf = NULL;
+}
+
+static void release_login_rsp_buffer(struct ibmvnic_adapter *adapter)
+{
+        kfree(adapter->login_rsp_buf);
+        adapter->login_rsp_buf = NULL;
+}
+
 static void release_resources(struct ibmvnic_adapter *adapter)
 {
         int i;
@@ -813,6 +825,10 @@ static void release_resources(struct ibmvnic_adapter *adapter)
                         }
                 }
         }
+        kfree(adapter->napi);
+        adapter->napi = NULL;
+
+        release_login_rsp_buffer(adapter);
 }
 
 static int set_link_state(struct ibmvnic_adapter *adapter, u8 link_state)
@@ -1057,6 +1073,35 @@ static int ibmvnic_open(struct net_device *netdev)
         return rc;
 }
 
+static void clean_rx_pools(struct ibmvnic_adapter *adapter)
+{
+        struct ibmvnic_rx_pool *rx_pool;
+        u64 rx_entries;
+        int rx_scrqs;
+        int i, j;
+
+        if (!adapter->rx_pool)
+                return;
+
+        rx_scrqs = be32_to_cpu(adapter->login_rsp_buf->num_rxadd_subcrqs);
+        rx_entries = adapter->req_rx_add_entries_per_subcrq;
+
+        /* Free any remaining skbs in the rx buffer pools */
+        for (i = 0; i < rx_scrqs; i++) {
+                rx_pool = &adapter->rx_pool[i];
+                if (!rx_pool)
+                        continue;
+
+                netdev_dbg(adapter->netdev, "Cleaning rx_pool[%d]\n", i);
+                for (j = 0; j < rx_entries; j++) {
+                        if (rx_pool->rx_buff[j].skb) {
+                                dev_kfree_skb_any(rx_pool->rx_buff[j].skb);
+                                rx_pool->rx_buff[j].skb = NULL;
+                        }
+                }
+        }
+}
+
 static void clean_tx_pools(struct ibmvnic_adapter *adapter)
 {
         struct ibmvnic_tx_pool *tx_pool;
@@ -1134,7 +1179,7 @@ static int __ibmvnic_close(struct net_device *netdev)
                         }
                 }
         }
-
+        clean_rx_pools(adapter);
         clean_tx_pools(adapter);
         adapter->state = VNIC_CLOSED;
         return rc;
@@ -1670,8 +1715,6 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                 return 0;
         }
 
-        netif_carrier_on(netdev);
-
         /* kick napi */
         for (i = 0; i < adapter->req_rx_queues; i++)
                 napi_schedule(&adapter->napi[i]);
@@ -1679,6 +1722,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
         if (adapter->reset_reason != VNIC_RESET_FAILOVER)
                 netdev_notify_peers(netdev);
 
+        netif_carrier_on(netdev);
+
         return 0;
 }
 
@@ -1853,6 +1898,7 @@ restart_poll:
                                    be16_to_cpu(next->rx_comp.rc));
                         /* free the entry */
                         next->rx_comp.first = 0;
+                        dev_kfree_skb_any(rx_buff->skb);
                         remove_buff_from_pool(adapter, rx_buff);
                         continue;
                 }
@@ -3013,6 +3059,7 @@ static void send_login(struct ibmvnic_adapter *adapter)
         struct vnic_login_client_data *vlcd;
         int i;
 
+        release_login_rsp_buffer(adapter);
         client_data_len = vnic_client_data_len(adapter);
 
         buffer_size =
@@ -3708,6 +3755,7 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq,
 
         dma_unmap_single(dev, adapter->login_buf_token, adapter->login_buf_sz,
                          DMA_BIDIRECTIONAL);
+        release_login_buffer(adapter);
         dma_unmap_single(dev, adapter->login_rsp_buf_token,
                          adapter->login_rsp_buf_sz, DMA_BIDIRECTIONAL);
 
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index a1d7b88cf083..5a1668cdb461 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -7137,6 +7137,7 @@ static void mvpp2_set_rx_mode(struct net_device *dev)
         int id = port->id;
         bool allmulti = dev->flags & IFF_ALLMULTI;
 
+retry:
         mvpp2_prs_mac_promisc_set(priv, id, dev->flags & IFF_PROMISC);
         mvpp2_prs_mac_multi_set(priv, id, MVPP2_PE_MAC_MC_ALL, allmulti);
         mvpp2_prs_mac_multi_set(priv, id, MVPP2_PE_MAC_MC_IP6, allmulti);
@@ -7144,9 +7145,13 @@ static void mvpp2_set_rx_mode(struct net_device *dev)
         /* Remove all port->id's mcast enries */
         mvpp2_prs_mcast_del_all(priv, id);
 
-        if (allmulti && !netdev_mc_empty(dev)) {
-                netdev_for_each_mc_addr(ha, dev)
-                        mvpp2_prs_mac_da_accept(priv, id, ha->addr, true);
+        if (!allmulti) {
+                netdev_for_each_mc_addr(ha, dev) {
+                        if (mvpp2_prs_mac_da_accept(priv, id, ha->addr, true)) {
+                                allmulti = true;
+                                goto retry;
+                        }
+                }
         }
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index f0b25baba09a..f7948e983637 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -788,6 +788,9 @@ static struct mlxsw_sp_vr *mlxsw_sp_vr_create(struct mlxsw_sp *mlxsw_sp,
                                               u32 tb_id,
                                               struct netlink_ext_ack *extack)
 {
+        struct mlxsw_sp_mr_table *mr4_table;
+        struct mlxsw_sp_fib *fib4;
+        struct mlxsw_sp_fib *fib6;
         struct mlxsw_sp_vr *vr;
         int err;
 
@@ -796,29 +799,30 @@ static struct mlxsw_sp_vr *mlxsw_sp_vr_create(struct mlxsw_sp *mlxsw_sp,
                 NL_SET_ERR_MSG(extack, "spectrum: Exceeded number of supported virtual routers");
                 return ERR_PTR(-EBUSY);
         }
-        vr->fib4 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV4);
-        if (IS_ERR(vr->fib4))
-                return ERR_CAST(vr->fib4);
-        vr->fib6 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV6);
-        if (IS_ERR(vr->fib6)) {
-                err = PTR_ERR(vr->fib6);
+        fib4 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV4);
+        if (IS_ERR(fib4))
+                return ERR_CAST(fib4);
+        fib6 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV6);
+        if (IS_ERR(fib6)) {
+                err = PTR_ERR(fib6);
                 goto err_fib6_create;
         }
-        vr->mr4_table = mlxsw_sp_mr_table_create(mlxsw_sp, vr->id,
-                                                 MLXSW_SP_L3_PROTO_IPV4);
-        if (IS_ERR(vr->mr4_table)) {
-                err = PTR_ERR(vr->mr4_table);
+        mr4_table = mlxsw_sp_mr_table_create(mlxsw_sp, vr->id,
+                                             MLXSW_SP_L3_PROTO_IPV4);
+        if (IS_ERR(mr4_table)) {
+                err = PTR_ERR(mr4_table);
                 goto err_mr_table_create;
         }
+        vr->fib4 = fib4;
+        vr->fib6 = fib6;
+        vr->mr4_table = mr4_table;
         vr->tb_id = tb_id;
         return vr;
 
 err_mr_table_create:
-        mlxsw_sp_fib_destroy(mlxsw_sp, vr->fib6);
-        vr->fib6 = NULL;
+        mlxsw_sp_fib_destroy(mlxsw_sp, fib6);
 err_fib6_create:
-        mlxsw_sp_fib_destroy(mlxsw_sp, vr->fib4);
-        vr->fib4 = NULL;
+        mlxsw_sp_fib_destroy(mlxsw_sp, fib4);
         return ERR_PTR(err);
 }
 
@@ -3790,6 +3794,9 @@ mlxsw_sp_fib4_entry_offload_unset(struct mlxsw_sp_fib_entry *fib_entry)
         struct mlxsw_sp_nexthop_group *nh_grp = fib_entry->nh_group;
         int i;
 
+        if (!list_is_singular(&nh_grp->fib_list))
+                return;
+
         for (i = 0; i < nh_grp->count; i++) {
                 struct mlxsw_sp_nexthop *nh = &nh_grp->nexthops[i];
 
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index 7e7704daf5f1..c4949183eef3 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -43,12 +43,6 @@
 
 /* Local Definitions and Declarations */
 
-struct rmnet_walk_data {
-        struct net_device *real_dev;
-        struct list_head *head;
-        struct rmnet_port *port;
-};
-
 static int rmnet_is_real_dev_registered(const struct net_device *real_dev)
 {
         return rcu_access_pointer(real_dev->rx_handler) == rmnet_rx_handler;
@@ -112,17 +106,14 @@ static int rmnet_register_real_device(struct net_device *real_dev)
 static void rmnet_unregister_bridge(struct net_device *dev,
                                     struct rmnet_port *port)
 {
-        struct net_device *rmnet_dev, *bridge_dev;
         struct rmnet_port *bridge_port;
+        struct net_device *bridge_dev;
 
         if (port->rmnet_mode != RMNET_EPMODE_BRIDGE)
                 return;
 
         /* bridge slave handling */
         if (!port->nr_rmnet_devs) {
-                rmnet_dev = netdev_master_upper_dev_get_rcu(dev);
-                netdev_upper_dev_unlink(dev, rmnet_dev);
-
                 bridge_dev = port->bridge_ep;
 
                 bridge_port = rmnet_get_port_rtnl(bridge_dev);
@@ -132,9 +123,6 @@ static void rmnet_unregister_bridge(struct net_device *dev,
                 bridge_dev = port->bridge_ep;
 
                 bridge_port = rmnet_get_port_rtnl(bridge_dev);
-                rmnet_dev = netdev_master_upper_dev_get_rcu(bridge_dev);
-                netdev_upper_dev_unlink(bridge_dev, rmnet_dev);
-
                 rmnet_unregister_real_device(bridge_dev, bridge_port);
         }
 }
@@ -173,10 +161,6 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev,
         if (err)
                 goto err1;
 
-        err = netdev_master_upper_dev_link(dev, real_dev, NULL, NULL, extack);
-        if (err)
-                goto err2;
-
         port->rmnet_mode = mode;
 
         hlist_add_head_rcu(&ep->hlnode, &port->muxed_ep[mux_id]);
@@ -193,8 +177,6 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev,
 
         return 0;
 
-err2:
-        rmnet_vnd_dellink(mux_id, port, ep);
 err1:
         rmnet_unregister_real_device(real_dev, port);
 err0:
@@ -204,14 +186,13 @@ err0:
 
 static void rmnet_dellink(struct net_device *dev, struct list_head *head)
 {
+        struct rmnet_priv *priv = netdev_priv(dev);
         struct net_device *real_dev;
         struct rmnet_endpoint *ep;
         struct rmnet_port *port;
         u8 mux_id;
 
-        rcu_read_lock();
-        real_dev = netdev_master_upper_dev_get_rcu(dev);
-        rcu_read_unlock();
+        real_dev = priv->real_dev;
 
         if (!real_dev || !rmnet_is_real_dev_registered(real_dev))
                 return;
@@ -219,7 +200,6 @@ static void rmnet_dellink(struct net_device *dev, struct list_head *head)
         port = rmnet_get_port_rtnl(real_dev);
 
         mux_id = rmnet_vnd_get_mux(dev);
-        netdev_upper_dev_unlink(dev, real_dev);
 
         ep = rmnet_get_endpoint(port, mux_id);
         if (ep) {
@@ -233,30 +213,13 @@ static void rmnet_dellink(struct net_device *dev, struct list_head *head)
         unregister_netdevice_queue(dev, head);
 }
 
-static int rmnet_dev_walk_unreg(struct net_device *rmnet_dev, void *data)
-{
-        struct rmnet_walk_data *d = data;
-        struct rmnet_endpoint *ep;
-        u8 mux_id;
-
-        mux_id = rmnet_vnd_get_mux(rmnet_dev);
-        ep = rmnet_get_endpoint(d->port, mux_id);
-        if (ep) {
-                hlist_del_init_rcu(&ep->hlnode);
-                rmnet_vnd_dellink(mux_id, d->port, ep);
-                kfree(ep);
-        }
-        netdev_upper_dev_unlink(rmnet_dev, d->real_dev);
-        unregister_netdevice_queue(rmnet_dev, d->head);
-
-        return 0;
-}
-
 static void rmnet_force_unassociate_device(struct net_device *dev)
 {
         struct net_device *real_dev = dev;
-        struct rmnet_walk_data d;
+        struct hlist_node *tmp_ep;
+        struct rmnet_endpoint *ep;
         struct rmnet_port *port;
+        unsigned long bkt_ep;
         LIST_HEAD(list);
 
         if (!rmnet_is_real_dev_registered(real_dev))
@@ -264,16 +227,19 @@ static void rmnet_force_unassociate_device(struct net_device *dev)
 
         ASSERT_RTNL();
 
-        d.real_dev = real_dev;
-        d.head = &list;
-
         port = rmnet_get_port_rtnl(dev);
-        d.port = port;
 
         rcu_read_lock();
         rmnet_unregister_bridge(dev, port);
 
-        netdev_walk_all_lower_dev_rcu(real_dev, rmnet_dev_walk_unreg, &d);
+        hash_for_each_safe(port->muxed_ep, bkt_ep, tmp_ep, ep, hlnode) {
+                unregister_netdevice_queue(ep->egress_dev, &list);
+                rmnet_vnd_dellink(ep->mux_id, port, ep);
+
+                hlist_del_init_rcu(&ep->hlnode);
+                kfree(ep);
+        }
+
         rcu_read_unlock();
         unregister_netdevice_many(&list);
 
@@ -422,11 +388,6 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
         if (err)
                 return -EBUSY;
 
-        err = netdev_master_upper_dev_link(slave_dev, rmnet_dev, NULL, NULL,
-                                           extack);
-        if (err)
-                return -EINVAL;
-
         slave_port = rmnet_get_port(slave_dev);
         slave_port->rmnet_mode = RMNET_EPMODE_BRIDGE;
         slave_port->bridge_ep = real_dev;
@@ -449,7 +410,6 @@ int rmnet_del_bridge(struct net_device *rmnet_dev,
         port->rmnet_mode = RMNET_EPMODE_VND;
         port->bridge_ep = NULL;
 
-        netdev_upper_dev_unlink(slave_dev, rmnet_dev);
         slave_port = rmnet_get_port(slave_dev);
         rmnet_unregister_real_device(slave_dev, slave_port);
 
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
index 6bc328fb88e1..b0dbca070c00 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
@@ -38,6 +38,11 @@ static u8 rmnet_map_do_flow_control(struct sk_buff *skb,
         }
 
         ep = rmnet_get_endpoint(port, mux_id);
+        if (!ep) {
+                kfree_skb(skb);
+                return RX_HANDLER_CONSUMED;
+        }
+
         vnd = ep->egress_dev;
 
         ip_family = cmd->flow_control.ip_family;
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
index 570a227acdd8..346d310914df 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
@@ -121,7 +121,7 @@ static void rmnet_get_stats64(struct net_device *dev,
         memset(&total_stats, 0, sizeof(struct rmnet_vnd_stats));
 
         for_each_possible_cpu(cpu) {
-                pcpu_ptr = this_cpu_ptr(priv->pcpu_stats);
+                pcpu_ptr = per_cpu_ptr(priv->pcpu_stats, cpu);
 
                 do {
                         start = u64_stats_fetch_begin_irq(&pcpu_ptr->syncp);
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index c87f57ca4437..a95fbd5510d9 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -2255,9 +2255,6 @@ static int ravb_wol_setup(struct net_device *ndev)
         /* Enable MagicPacket */
         ravb_modify(ndev, ECMR, ECMR_MPDE, ECMR_MPDE);
 
-        /* Increased clock usage so device won't be suspended */
-        clk_enable(priv->clk);
-
         return enable_irq_wake(priv->emac_irq);
 }
 
@@ -2276,9 +2273,6 @@ static int ravb_wol_restore(struct net_device *ndev)
         if (ret < 0)
                 return ret;
 
-        /* Restore clock usage count */
-        clk_disable(priv->clk);
-
         return disable_irq_wake(priv->emac_irq);
 }
 
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index a197e11f3a56..92dcf8717fc6 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -40,7 +40,6 @@
 #include <linux/slab.h>
 #include <linux/ethtool.h>
 #include <linux/if_vlan.h>
-#include <linux/clk.h>
 #include <linux/sh_eth.h>
 #include <linux/of_mdio.h>
 
@@ -2304,7 +2303,7 @@ static void sh_eth_get_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
         wol->supported = 0;
         wol->wolopts = 0;
 
-        if (mdp->cd->magic && mdp->clk) {
+        if (mdp->cd->magic) {
                 wol->supported = WAKE_MAGIC;
                 wol->wolopts = mdp->wol_enabled ? WAKE_MAGIC : 0;
         }
@@ -2314,7 +2313,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
 {
         struct sh_eth_private *mdp = netdev_priv(ndev);
 
-        if (!mdp->cd->magic || !mdp->clk || wol->wolopts & ~WAKE_MAGIC)
+        if (!mdp->cd->magic || wol->wolopts & ~WAKE_MAGIC)
                 return -EOPNOTSUPP;
 
         mdp->wol_enabled = !!(wol->wolopts & WAKE_MAGIC);
@@ -3153,11 +3152,6 @@ static int sh_eth_drv_probe(struct platform_device *pdev)
                 goto out_release;
         }
 
-        /* Get clock, if not found that's OK but Wake-On-Lan is unavailable */
-        mdp->clk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(mdp->clk))
-                mdp->clk = NULL;
-
         ndev->base_addr = res->start;
 
         spin_lock_init(&mdp->lock);
@@ -3278,7 +3272,7 @@ static int sh_eth_drv_probe(struct platform_device *pdev)
         if (ret)
                 goto out_napi_del;
 
-        if (mdp->cd->magic && mdp->clk)
+        if (mdp->cd->magic)
                 device_set_wakeup_capable(&pdev->dev, 1);
 
         /* print device information */
@@ -3331,9 +3325,6 @@ static int sh_eth_wol_setup(struct net_device *ndev)
         /* Enable MagicPacket */
         sh_eth_modify(ndev, ECMR, ECMR_MPDE, ECMR_MPDE);
 
-        /* Increased clock usage so device won't be suspended */
-        clk_enable(mdp->clk);
-
         return enable_irq_wake(ndev->irq);
 }
 
@@ -3359,9 +3350,6 @@ static int sh_eth_wol_restore(struct net_device *ndev)
         if (ret < 0)
                 return ret;
 
-        /* Restore clock usage count */
-        clk_disable(mdp->clk);
-
         return disable_irq_wake(ndev->irq);
 }
 
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index b13eed21c87d..d39ae77707ef 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1382,7 +1382,7 @@ int genphy_setup_forced(struct phy_device *phydev)
                 ctl |= BMCR_FULLDPLX;
 
         return phy_modify(phydev, MII_BMCR,
-                          BMCR_LOOPBACK | BMCR_ISOLATE | BMCR_PDOWN, ctl);
+                          ~(BMCR_LOOPBACK | BMCR_ISOLATE | BMCR_PDOWN), ctl);
 }
 EXPORT_SYMBOL(genphy_setup_forced);
 
diff --git a/drivers/net/thunderbolt.c b/drivers/net/thunderbolt.c
index ca5e375de27c..e0d6760f3219 100644
--- a/drivers/net/thunderbolt.c
+++ b/drivers/net/thunderbolt.c
@@ -166,6 +166,8 @@ struct tbnet_ring {
  * @connected_work: Worker that finalizes the ThunderboltIP connection
  *                  setup and enables DMA paths for high speed data
  *                  transfers
+ * @disconnect_work: Worker that handles tearing down the ThunderboltIP
+ *                   connection
  * @rx_hdr: Copy of the currently processed Rx frame. Used when a
  *          network packet consists of multiple Thunderbolt frames.
  *          In host byte order.
@@ -190,6 +192,7 @@ struct tbnet {
         int login_retries;
         struct delayed_work login_work;
         struct work_struct connected_work;
+        struct work_struct disconnect_work;
         struct thunderbolt_ip_frame_header rx_hdr;
         struct tbnet_ring rx_ring;
         atomic_t frame_id;
@@ -445,7 +448,7 @@ static int tbnet_handle_packet(const void *buf, size_t size, void *data)
         case TBIP_LOGOUT:
                 ret = tbnet_logout_response(net, route, sequence, command_id);
                 if (!ret)
-                        tbnet_tear_down(net, false);
+                        queue_work(system_long_wq, &net->disconnect_work);
                 break;
 
         default:
@@ -659,6 +662,13 @@ static void tbnet_login_work(struct work_struct *work)
         }
 }
 
+static void tbnet_disconnect_work(struct work_struct *work)
+{
+        struct tbnet *net = container_of(work, typeof(*net), disconnect_work);
+
+        tbnet_tear_down(net, false);
+}
+
 static bool tbnet_check_frame(struct tbnet *net, const struct tbnet_frame *tf,
                               const struct thunderbolt_ip_frame_header *hdr)
 {
@@ -881,6 +891,7 @@ static int tbnet_stop(struct net_device *dev)
 
         napi_disable(&net->napi);
 
+        cancel_work_sync(&net->disconnect_work);
         tbnet_tear_down(net, true);
 
         tb_ring_free(net->rx_ring.ring);
@@ -1195,6 +1206,7 @@ static int tbnet_probe(struct tb_service *svc, const struct tb_service_id *id)
         net = netdev_priv(dev);
         INIT_DELAYED_WORK(&net->login_work, tbnet_login_work);
         INIT_WORK(&net->connected_work, tbnet_connected_work);
+        INIT_WORK(&net->disconnect_work, tbnet_disconnect_work);
         mutex_init(&net->connection_lock);
         atomic_set(&net->command_id, 0);
         atomic_set(&net->frame_id, 0);
@@ -1270,10 +1282,7 @@ static int __maybe_unused tbnet_suspend(struct device *dev)
         stop_login(net);
         if (netif_running(net->dev)) {
                 netif_device_detach(net->dev);
-                tb_ring_stop(net->rx_ring.ring);
-                tb_ring_stop(net->tx_ring.ring);
-                tbnet_free_buffers(&net->rx_ring);
-                tbnet_free_buffers(&net->tx_ring);
+                tbnet_tear_down(net, true);
         }
 
         return 0;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 81e6cc951e7f..b52258c327d2 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1489,27 +1489,23 @@ static struct sk_buff *tun_napi_alloc_frags(struct tun_file *tfile,
         skb->truesize += skb->data_len;
 
         for (i = 1; i < it->nr_segs; i++) {
+                struct page_frag *pfrag = &current->task_frag;
                 size_t fragsz = it->iov[i].iov_len;
-                unsigned long offset;
-                struct page *page;
-                void *data;
 
                 if (fragsz == 0 || fragsz > PAGE_SIZE) {
                         err = -EINVAL;
                         goto free;
                 }
 
-                local_bh_disable();
-                data = napi_alloc_frag(fragsz);
-                local_bh_enable();
-                if (!data) {
+                if (!skb_page_frag_refill(fragsz, pfrag, GFP_KERNEL)) {
                         err = -ENOMEM;
                         goto free;
                 }
 
-                page = virt_to_head_page(data);
-                offset = data - page_address(page);
-                skb_fill_page_desc(skb, i - 1, page, offset, fragsz);
+                skb_fill_page_desc(skb, i - 1, pfrag->page,
+                                   pfrag->offset, fragsz);
+                page_ref_inc(pfrag->page);
+                pfrag->offset += fragsz;
         }
 
         return skb;
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 6088ea13a6bf..817e5e2766da 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -120,8 +120,12 @@ int nvme_reset_ctrl_sync(struct nvme_ctrl *ctrl)
         int ret;
 
         ret = nvme_reset_ctrl(ctrl);
-        if (!ret)
+        if (!ret) {
                 flush_work(&ctrl->reset_work);
+                if (ctrl->state != NVME_CTRL_LIVE)
+                        ret = -ENETRESET;
+        }
+
         return ret;
 }
 EXPORT_SYMBOL_GPL(nvme_reset_ctrl_sync);
@@ -265,7 +269,7 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
         switch (new_state) {
         case NVME_CTRL_ADMIN_ONLY:
                 switch (old_state) {
-                case NVME_CTRL_RECONNECTING:
+                case NVME_CTRL_CONNECTING:
                         changed = true;
                         /* FALLTHRU */
                 default:
@@ -276,7 +280,7 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
                 switch (old_state) {
                 case NVME_CTRL_NEW:
                 case NVME_CTRL_RESETTING:
-                case NVME_CTRL_RECONNECTING:
+                case NVME_CTRL_CONNECTING:
                         changed = true;
                         /* FALLTHRU */
                 default:
@@ -294,9 +298,9 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
                         break;
                 }
                 break;
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 switch (old_state) {
-                case NVME_CTRL_LIVE:
+                case NVME_CTRL_NEW:
                 case NVME_CTRL_RESETTING:
                         changed = true;
                         /* FALLTHRU */
@@ -309,7 +313,7 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
                 case NVME_CTRL_LIVE:
                 case NVME_CTRL_ADMIN_ONLY:
                 case NVME_CTRL_RESETTING:
-                case NVME_CTRL_RECONNECTING:
+                case NVME_CTRL_CONNECTING:
                         changed = true;
                         /* FALLTHRU */
                 default:
@@ -518,9 +522,11 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
                 u64 slba = nvme_block_nr(ns, bio->bi_iter.bi_sector);
                 u32 nlb = bio->bi_iter.bi_size >> ns->lba_shift;
 
-                range[n].cattr = cpu_to_le32(0);
-                range[n].nlb = cpu_to_le32(nlb);
-                range[n].slba = cpu_to_le64(slba);
+                if (n < segments) {
+                        range[n].cattr = cpu_to_le32(0);
+                        range[n].nlb = cpu_to_le32(nlb);
+                        range[n].slba = cpu_to_le64(slba);
+                }
                 n++;
         }
 
@@ -794,13 +800,9 @@ static void nvme_keep_alive_end_io(struct request *rq, blk_status_t status)
 
 static int nvme_keep_alive(struct nvme_ctrl *ctrl)
 {
-        struct nvme_command c;
         struct request *rq;
 
-        memset(&c, 0, sizeof(c));
-        c.common.opcode = nvme_admin_keep_alive;
-
-        rq = nvme_alloc_request(ctrl->admin_q, &c, BLK_MQ_REQ_RESERVED,
+        rq = nvme_alloc_request(ctrl->admin_q, &ctrl->ka_cmd, BLK_MQ_REQ_RESERVED,
                         NVME_QID_ANY);
         if (IS_ERR(rq))
                 return PTR_ERR(rq);
@@ -832,6 +834,8 @@ void nvme_start_keep_alive(struct nvme_ctrl *ctrl)
                 return;
 
         INIT_DELAYED_WORK(&ctrl->ka_work, nvme_keep_alive_work);
+        memset(&ctrl->ka_cmd, 0, sizeof(ctrl->ka_cmd));
+        ctrl->ka_cmd.common.opcode = nvme_admin_keep_alive;
         schedule_delayed_work(&ctrl->ka_work, ctrl->kato * HZ);
 }
 EXPORT_SYMBOL_GPL(nvme_start_keep_alive);
@@ -1117,14 +1121,19 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
 
 static void nvme_update_formats(struct nvme_ctrl *ctrl)
 {
-        struct nvme_ns *ns;
+        struct nvme_ns *ns, *next;
+        LIST_HEAD(rm_list);
 
         mutex_lock(&ctrl->namespaces_mutex);
         list_for_each_entry(ns, &ctrl->namespaces, list) {
-                if (ns->disk && nvme_revalidate_disk(ns->disk))
-                        nvme_ns_remove(ns);
+                if (ns->disk && nvme_revalidate_disk(ns->disk)) {
+                        list_move_tail(&ns->list, &rm_list);
+                }
         }
         mutex_unlock(&ctrl->namespaces_mutex);
+
+        list_for_each_entry_safe(ns, next, &rm_list, list)
+                nvme_ns_remove(ns);
 }
 
 static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
@@ -2687,7 +2696,7 @@ static ssize_t nvme_sysfs_show_state(struct device *dev,
                 [NVME_CTRL_LIVE]        = "live",
                 [NVME_CTRL_ADMIN_ONLY]  = "only-admin",
                 [NVME_CTRL_RESETTING]   = "resetting",
-                [NVME_CTRL_RECONNECTING]= "reconnecting",
+                [NVME_CTRL_CONNECTING]  = "connecting",
                 [NVME_CTRL_DELETING]    = "deleting",
                 [NVME_CTRL_DEAD]        = "dead",
         };
diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h
index 25b19f722f5b..a3145d90c1d2 100644
--- a/drivers/nvme/host/fabrics.h
+++ b/drivers/nvme/host/fabrics.h
@@ -171,13 +171,14 @@ static inline blk_status_t nvmf_check_init_req(struct nvme_ctrl *ctrl,
             cmd->common.opcode != nvme_fabrics_command ||
             cmd->fabrics.fctype != nvme_fabrics_type_connect) {
                 /*
-                 * Reconnecting state means transport disruption, which can take
-                 * a long time and even might fail permanently, fail fast to
-                 * give upper layers a chance to failover.
+                 * Connecting state means transport disruption or initial
+                 * establishment, which can take a long time and even might
+                 * fail permanently, fail fast to give upper layers a chance
+                 * to failover.
                  * Deleting state means that the ctrl will never accept commands
                  * again, fail it permanently.
                  */
-                if (ctrl->state == NVME_CTRL_RECONNECTING ||
+                if (ctrl->state == NVME_CTRL_CONNECTING ||
                     ctrl->state == NVME_CTRL_DELETING) {
                         nvme_req(rq)->status = NVME_SC_ABORT_REQ;
                         return BLK_STS_IOERR;
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index b856d7c919d2..7f51f8414b97 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -55,9 +55,7 @@ struct nvme_fc_queue {
 
 enum nvme_fcop_flags {
         FCOP_FLAGS_TERMIO       = (1 << 0),
-        FCOP_FLAGS_RELEASED     = (1 << 1),
-        FCOP_FLAGS_COMPLETE     = (1 << 2),
-        FCOP_FLAGS_AEN          = (1 << 3),
+        FCOP_FLAGS_AEN          = (1 << 1),
 };
 
 struct nvmefc_ls_req_op {
@@ -532,7 +530,7 @@ nvme_fc_resume_controller(struct nvme_fc_ctrl *ctrl)
 {
         switch (ctrl->ctrl.state) {
         case NVME_CTRL_NEW:
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 /*
                  * As all reconnects were suppressed, schedule a
                  * connect.
@@ -777,7 +775,7 @@ nvme_fc_ctrl_connectivity_loss(struct nvme_fc_ctrl *ctrl)
                 }
                 break;
 
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 /*
                  * The association has already been terminated and the
                  * controller is attempting reconnects.  No need to do anything
@@ -1470,7 +1468,6 @@ nvme_fc_xmt_disconnect_assoc(struct nvme_fc_ctrl *ctrl)
 
 /* *********************** NVME Ctrl Routines **************************** */
 
-static void __nvme_fc_final_op_cleanup(struct request *rq);
 static void nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg);
 
 static int
@@ -1512,13 +1509,19 @@ nvme_fc_exit_request(struct blk_mq_tag_set *set, struct request *rq,
 static int
 __nvme_fc_abort_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_fcp_op *op)
 {
-        int state;
+        unsigned long flags;
+        int opstate;
+
+        spin_lock_irqsave(&ctrl->lock, flags);
+        opstate = atomic_xchg(&op->state, FCPOP_STATE_ABORTED);
+        if (opstate != FCPOP_STATE_ACTIVE)
+                atomic_set(&op->state, opstate);
+        else if (ctrl->flags & FCCTRL_TERMIO)
+                ctrl->iocnt++;
+        spin_unlock_irqrestore(&ctrl->lock, flags);
 
-        state = atomic_xchg(&op->state, FCPOP_STATE_ABORTED);
-        if (state != FCPOP_STATE_ACTIVE) {
-                atomic_set(&op->state, state);
+        if (opstate != FCPOP_STATE_ACTIVE)
                 return -ECANCELED;
-        }
 
         ctrl->lport->ops->fcp_abort(&ctrl->lport->localport,
                                         &ctrl->rport->remoteport,
@@ -1532,60 +1535,26 @@ static void
 nvme_fc_abort_aen_ops(struct nvme_fc_ctrl *ctrl)
 {
         struct nvme_fc_fcp_op *aen_op = ctrl->aen_ops;
-        unsigned long flags;
-        int i, ret;
-
-        for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++) {
-                if (atomic_read(&aen_op->state) != FCPOP_STATE_ACTIVE)
-                        continue;
-
-                spin_lock_irqsave(&ctrl->lock, flags);
-                if (ctrl->flags & FCCTRL_TERMIO) {
-                        ctrl->iocnt++;
-                        aen_op->flags |= FCOP_FLAGS_TERMIO;
-                }
-                spin_unlock_irqrestore(&ctrl->lock, flags);
-
-                ret = __nvme_fc_abort_op(ctrl, aen_op);
-                if (ret) {
-                        /*
-                         * if __nvme_fc_abort_op failed the io wasn't
-                         * active. Thus this call path is running in
-                         * parallel to the io complete. Treat as non-error.
-                         */
+        int i;
 
-                        /* back out the flags/counters */
-                        spin_lock_irqsave(&ctrl->lock, flags);
-                        if (ctrl->flags & FCCTRL_TERMIO)
-                                ctrl->iocnt--;
-                        aen_op->flags &= ~FCOP_FLAGS_TERMIO;
-                        spin_unlock_irqrestore(&ctrl->lock, flags);
-                        return;
-                }
-        }
+        for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++)
+                __nvme_fc_abort_op(ctrl, aen_op);
 }
 
-static inline int
+static inline void
 __nvme_fc_fcpop_chk_teardowns(struct nvme_fc_ctrl *ctrl,
-                struct nvme_fc_fcp_op *op)
+                struct nvme_fc_fcp_op *op, int opstate)
 {
         unsigned long flags;
-        bool complete_rq = false;
 
-        spin_lock_irqsave(&ctrl->lock, flags);
-        if (unlikely(op->flags & FCOP_FLAGS_TERMIO)) {
+        if (opstate == FCPOP_STATE_ABORTED) {
+                spin_lock_irqsave(&ctrl->lock, flags);
                 if (ctrl->flags & FCCTRL_TERMIO) {
                         if (!--ctrl->iocnt)
                                 wake_up(&ctrl->ioabort_wait);
                 }
+                spin_unlock_irqrestore(&ctrl->lock, flags);
         }
-        if (op->flags & FCOP_FLAGS_RELEASED)
-                complete_rq = true;
-        else
-                op->flags |= FCOP_FLAGS_COMPLETE;
-        spin_unlock_irqrestore(&ctrl->lock, flags);
-
-        return complete_rq;
 }
 
 static void
@@ -1601,6 +1570,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
         __le16 status = cpu_to_le16(NVME_SC_SUCCESS << 1);
         union nvme_result result;
         bool terminate_assoc = true;
+        int opstate;
 
         /*
          * WARNING:
@@ -1639,11 +1609,12 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
          * association to be terminated.
          */
 
+        opstate = atomic_xchg(&op->state, FCPOP_STATE_COMPLETE);
+
         fc_dma_sync_single_for_cpu(ctrl->lport->dev, op->fcp_req.rspdma,
                                 sizeof(op->rsp_iu), DMA_FROM_DEVICE);
 
-        if (atomic_read(&op->state) == FCPOP_STATE_ABORTED ||
-                        op->flags & FCOP_FLAGS_TERMIO)
+        if (opstate == FCPOP_STATE_ABORTED)
                 status = cpu_to_le16(NVME_SC_ABORT_REQ << 1);
         else if (freq->status)
                 status = cpu_to_le16(NVME_SC_INTERNAL << 1);
@@ -1708,7 +1679,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
 done:
         if (op->flags & FCOP_FLAGS_AEN) {
                 nvme_complete_async_event(&queue->ctrl->ctrl, status, &result);
-                __nvme_fc_fcpop_chk_teardowns(ctrl, op);
+                __nvme_fc_fcpop_chk_teardowns(ctrl, op, opstate);
                 atomic_set(&op->state, FCPOP_STATE_IDLE);
                 op->flags = FCOP_FLAGS_AEN;     /* clear other flags */
                 nvme_fc_ctrl_put(ctrl);
@@ -1722,13 +1693,11 @@ done:
         if (status &&
             (blk_queue_dying(rq->q) ||
              ctrl->ctrl.state == NVME_CTRL_NEW ||
-             ctrl->ctrl.state == NVME_CTRL_RECONNECTING))
+             ctrl->ctrl.state == NVME_CTRL_CONNECTING))
                 status |= cpu_to_le16(NVME_SC_DNR << 1);
 
-        if (__nvme_fc_fcpop_chk_teardowns(ctrl, op))
-                __nvme_fc_final_op_cleanup(rq);
-        else
-                nvme_end_request(rq, status, result);
+        __nvme_fc_fcpop_chk_teardowns(ctrl, op, opstate);
+        nvme_end_request(rq, status, result);
 
 check_error:
         if (terminate_assoc)
@@ -2415,46 +2384,16 @@ nvme_fc_submit_async_event(struct nvme_ctrl *arg)
 }
 
 static void
-__nvme_fc_final_op_cleanup(struct request *rq)
+nvme_fc_complete_rq(struct request *rq)
 {
         struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(rq);
         struct nvme_fc_ctrl *ctrl = op->ctrl;
 
         atomic_set(&op->state, FCPOP_STATE_IDLE);
-        op->flags &= ~(FCOP_FLAGS_TERMIO | FCOP_FLAGS_RELEASED |
-                        FCOP_FLAGS_COMPLETE);
 
         nvme_fc_unmap_data(ctrl, rq, op);
         nvme_complete_rq(rq);
         nvme_fc_ctrl_put(ctrl);
-
-}
-
-static void
-nvme_fc_complete_rq(struct request *rq)
-{
-        struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(rq);
-        struct nvme_fc_ctrl *ctrl = op->ctrl;
-        unsigned long flags;
-        bool completed = false;
-
-        /*
-         * the core layer, on controller resets after calling
-         * nvme_shutdown_ctrl(), calls complete_rq without our
-         * calling blk_mq_complete_request(), thus there may still
-         * be live i/o outstanding with the LLDD. Means transport has
-         * to track complete calls vs fcpio_done calls to know what
-         * path to take on completes and dones.
-         */
-        spin_lock_irqsave(&ctrl->lock, flags);
-        if (op->flags & FCOP_FLAGS_COMPLETE)
-                completed = true;
-        else
-                op->flags |= FCOP_FLAGS_RELEASED;
-        spin_unlock_irqrestore(&ctrl->lock, flags);
-
-        if (completed)
-                __nvme_fc_final_op_cleanup(rq);
 }
 
 /*
@@ -2476,35 +2415,11 @@ nvme_fc_terminate_exchange(struct request *req, void *data, bool reserved)
         struct nvme_ctrl *nctrl = data;
         struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
         struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(req);
-        unsigned long flags;
-        int status;
 
         if (!blk_mq_request_started(req))
                 return;
 
-        spin_lock_irqsave(&ctrl->lock, flags);
-        if (ctrl->flags & FCCTRL_TERMIO) {
-                ctrl->iocnt++;
-                op->flags |= FCOP_FLAGS_TERMIO;
-        }
-        spin_unlock_irqrestore(&ctrl->lock, flags);
-
-        status = __nvme_fc_abort_op(ctrl, op);
-        if (status) {
-                /*
-                 * if __nvme_fc_abort_op failed the io wasn't
-                 * active. Thus this call path is running in
-                 * parallel to the io complete. Treat as non-error.
-                 */
-
-                /* back out the flags/counters */
-                spin_lock_irqsave(&ctrl->lock, flags);
-                if (ctrl->flags & FCCTRL_TERMIO)
-                        ctrl->iocnt--;
-                op->flags &= ~FCOP_FLAGS_TERMIO;
-                spin_unlock_irqrestore(&ctrl->lock, flags);
-                return;
-        }
+        __nvme_fc_abort_op(ctrl, op);
 }
 
 
@@ -2943,7 +2858,7 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
         unsigned long recon_delay = ctrl->ctrl.opts->reconnect_delay * HZ;
         bool recon = true;
 
-        if (ctrl->ctrl.state != NVME_CTRL_RECONNECTING)
+        if (ctrl->ctrl.state != NVME_CTRL_CONNECTING)
                 return;
 
         if (portptr->port_state == FC_OBJSTATE_ONLINE)
@@ -2991,10 +2906,10 @@ nvme_fc_reset_ctrl_work(struct work_struct *work)
         /* will block will waiting for io to terminate */
         nvme_fc_delete_association(ctrl);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
                 dev_err(ctrl->ctrl.device,
                         "NVME-FC{%d}: error_recovery: Couldn't change state "
-                        "to RECONNECTING\n", ctrl->cnum);
+                        "to CONNECTING\n", ctrl->cnum);
                 return;
         }
 
@@ -3195,7 +3110,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
          * transport errors (frame drop, LS failure) inherently must kill
          * the association. The transport is coded so that any command used
          * to create the association (prior to a LIVE state transition
-         * while NEW or RECONNECTING) will fail if it completes in error or
+         * while NEW or CONNECTING) will fail if it completes in error or
          * times out.
          *
          * As such: as the connect request was mostly likely due to a
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 8e4550fa08f8..0521e4707d1c 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -123,7 +123,7 @@ enum nvme_ctrl_state {
         NVME_CTRL_LIVE,
         NVME_CTRL_ADMIN_ONLY,    /* Only admin queue live */
         NVME_CTRL_RESETTING,
-        NVME_CTRL_RECONNECTING,
+        NVME_CTRL_CONNECTING,
         NVME_CTRL_DELETING,
         NVME_CTRL_DEAD,
 };
@@ -183,6 +183,7 @@ struct nvme_ctrl {
         struct work_struct scan_work;
         struct work_struct async_event_work;
         struct delayed_work ka_work;
+        struct nvme_command ka_cmd;
         struct work_struct fw_act_work;
 
         /* Power saving configuration */
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 022b070e60b7..5933a5c732e8 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1141,7 +1141,7 @@ static bool nvme_should_reset(struct nvme_dev *dev, u32 csts)
         /* If there is a reset/reinit ongoing, we shouldn't reset again. */
         switch (dev->ctrl.state) {
         case NVME_CTRL_RESETTING:
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 return false;
         default:
                 break;
@@ -1215,13 +1215,17 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
          * cancellation error. All outstanding requests are completed on
          * shutdown, so we return BLK_EH_HANDLED.
          */
-        if (dev->ctrl.state == NVME_CTRL_RESETTING) {
+        switch (dev->ctrl.state) {
+        case NVME_CTRL_CONNECTING:
+        case NVME_CTRL_RESETTING:
                 dev_warn(dev->ctrl.device,
                          "I/O %d QID %d timeout, disable controller\n",
                          req->tag, nvmeq->qid);
                 nvme_dev_disable(dev, false);
                 nvme_req(req)->flags |= NVME_REQ_CANCELLED;
                 return BLK_EH_HANDLED;
+        default:
+                break;
         }
 
         /*
@@ -1364,18 +1368,14 @@ static int nvme_cmb_qdepth(struct nvme_dev *dev, int nr_io_queues,
 static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq,
                                 int qid, int depth)
 {
-        if (qid && dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS)) {
-                unsigned offset = (qid - 1) * roundup(SQ_SIZE(depth),
-                                                      dev->ctrl.page_size);
-                nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset;
-                nvmeq->sq_cmds_io = dev->cmb + offset;
-        } else {
-                nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
-                                        &nvmeq->sq_dma_addr, GFP_KERNEL);
-                if (!nvmeq->sq_cmds)
-                        return -ENOMEM;
-        }
+        /* CMB SQEs will be mapped before creation */
+        if (qid && dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS))
+                return 0;
 
+        nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
+                                            &nvmeq->sq_dma_addr, GFP_KERNEL);
+        if (!nvmeq->sq_cmds)
+                return -ENOMEM;
         return 0;
 }
 
@@ -1449,6 +1449,13 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
         struct nvme_dev *dev = nvmeq->dev;
         int result;
 
+        if (dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS)) {
+                unsigned offset = (qid - 1) * roundup(SQ_SIZE(nvmeq->q_depth),
+                                                      dev->ctrl.page_size);
+                nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset;
+                nvmeq->sq_cmds_io = dev->cmb + offset;
+        }
+
         nvmeq->cq_vector = qid - 1;
         result = adapter_alloc_cq(dev, qid, nvmeq);
         if (result < 0)
@@ -2291,12 +2298,12 @@ static void nvme_reset_work(struct work_struct *work)
                 nvme_dev_disable(dev, false);
 
         /*
-         * Introduce RECONNECTING state from nvme-fc/rdma transports to mark the
+         * Introduce CONNECTING state from nvme-fc/rdma transports to mark the
          * initializing procedure here.
          */
-        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_CONNECTING)) {
                 dev_warn(dev->ctrl.device,
-                        "failed to mark controller RECONNECTING\n");
+                        "failed to mark controller CONNECTING\n");
                 goto out;
         }
 
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index acc9eb21c242..4d84a73ee12d 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -887,7 +887,7 @@ free_ctrl:
 static void nvme_rdma_reconnect_or_remove(struct nvme_rdma_ctrl *ctrl)
 {
         /* If we are resetting/deleting then do nothing */
-        if (ctrl->ctrl.state != NVME_CTRL_RECONNECTING) {
+        if (ctrl->ctrl.state != NVME_CTRL_CONNECTING) {
                 WARN_ON_ONCE(ctrl->ctrl.state == NVME_CTRL_NEW ||
                         ctrl->ctrl.state == NVME_CTRL_LIVE);
                 return;
@@ -973,7 +973,7 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
         blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
         nvme_start_queues(&ctrl->ctrl);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
                 /* state change failure should never happen */
                 WARN_ON_ONCE(1);
                 return;
@@ -1756,7 +1756,7 @@ static void nvme_rdma_reset_ctrl_work(struct work_struct *work)
         nvme_stop_ctrl(&ctrl->ctrl);
         nvme_rdma_shutdown_ctrl(ctrl, false);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
                 /* state change failure should never happen */
                 WARN_ON_ONCE(1);
                 return;
@@ -1784,11 +1784,8 @@ static void nvme_rdma_reset_ctrl_work(struct work_struct *work)
         return;
 
 out_fail:
-        dev_warn(ctrl->ctrl.device, "Removing after reset failure\n");
-        nvme_remove_namespaces(&ctrl->ctrl);
-        nvme_rdma_shutdown_ctrl(ctrl, true);
-        nvme_uninit_ctrl(&ctrl->ctrl);
-        nvme_put_ctrl(&ctrl->ctrl);
+        ++ctrl->ctrl.nr_reconnects;
+        nvme_rdma_reconnect_or_remove(ctrl);
 }
 
 static const struct nvme_ctrl_ops nvme_rdma_ctrl_ops = {
@@ -1942,6 +1939,9 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
         if (!ctrl->queues)
                 goto out_uninit_ctrl;
 
+        changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING);
+        WARN_ON_ONCE(!changed);
+
         ret = nvme_rdma_configure_admin_queue(ctrl, true);
         if (ret)
                 goto out_kfree_queues;
diff --git a/drivers/nvme/target/io-cmd.c b/drivers/nvme/target/io-cmd.c
index 0a4372a016f2..28bbdff4a88b 100644
--- a/drivers/nvme/target/io-cmd.c
+++ b/drivers/nvme/target/io-cmd.c
@@ -105,10 +105,13 @@ static void nvmet_execute_flush(struct nvmet_req *req)
 static u16 nvmet_discard_range(struct nvmet_ns *ns,
                 struct nvme_dsm_range *range, struct bio **bio)
 {
-        if (__blkdev_issue_discard(ns->bdev,
+        int ret;
+
+        ret = __blkdev_issue_discard(ns->bdev,
                         le64_to_cpu(range->slba) << (ns->blksize_shift - 9),
                         le32_to_cpu(range->nlb) << (ns->blksize_shift - 9),
-                        GFP_KERNEL, 0, bio))
+                        GFP_KERNEL, 0, bio);
+        if (ret && ret != -EOPNOTSUPP)
                 return NVME_SC_INTERNAL | NVME_SC_DNR;
         return 0;
 }
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index fc734014206f..8b14bd326d4a 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3419,22 +3419,29 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PORT_RIDGE,
 
 static void quirk_chelsio_extend_vpd(struct pci_dev *dev)
 {
-        pci_set_vpd_size(dev, 8192);
-}
-
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x20, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x21, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x22, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x23, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x24, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x25, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x26, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x30, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x31, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x32, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x35, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x36, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x37, quirk_chelsio_extend_vpd);
+        int chip = (dev->device & 0xf000) >> 12;
+        int func = (dev->device & 0x0f00) >>  8;
+        int prod = (dev->device & 0x00ff) >>  0;
+
+        /*
+         * If this is a T3-based adapter, there's a 1KB VPD area at offset
+         * 0xc00 which contains the preferred VPD values.  If this is a T4 or
+         * later based adapter, the special VPD is at offset 0x400 for the
+         * Physical Functions (the SR-IOV Virtual Functions have no VPD
+         * Capabilities).  The PCI VPD Access core routines will normally
+         * compute the size of the VPD by parsing the VPD Data Structure at
+         * offset 0x000.  This will result in silent failures when attempting
+         * to accesses these other VPD areas which are beyond those computed
+         * limits.
+         */
+        if (chip == 0x0 && prod >= 0x20)
+                pci_set_vpd_size(dev, 8192);
+        else if (chip >= 0x4 && func < 0x8)
+                pci_set_vpd_size(dev, 2048);
+}
+
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, PCI_ANY_ID,
+                        quirk_chelsio_extend_vpd);
 
 #ifdef CONFIG_ACPI
 /*
diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index bbdc53b686dd..6dbba5aff191 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -702,30 +702,32 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
         size_t pgstart, pgend;
         int ret = -EINVAL;
 
+        mutex_lock(&ashmem_mutex);
+
         if (unlikely(!asma->file))
-                return -EINVAL;
+                goto out_unlock;
 
-        if (unlikely(copy_from_user(&pin, p, sizeof(pin))))
-                return -EFAULT;
+        if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) {
+                ret = -EFAULT;
+                goto out_unlock;
+        }
 
         /* per custom, you can pass zero for len to mean "everything onward" */
         if (!pin.len)
                 pin.len = PAGE_ALIGN(asma->size) - pin.offset;
 
         if (unlikely((pin.offset | pin.len) & ~PAGE_MASK))
-                return -EINVAL;
+                goto out_unlock;
 
         if (unlikely(((__u32)-1) - pin.offset < pin.len))
-                return -EINVAL;
+                goto out_unlock;
 
         if (unlikely(PAGE_ALIGN(asma->size) < pin.offset + pin.len))
-                return -EINVAL;
+                goto out_unlock;
 
         pgstart = pin.offset / PAGE_SIZE;
         pgend = pgstart + (pin.len / PAGE_SIZE) - 1;
 
-        mutex_lock(&ashmem_mutex);
-
         switch (cmd) {
         case ASHMEM_PIN:
                 ret = ashmem_pin(asma, pgstart, pgend);
@@ -738,6 +740,7 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
                 break;
         }
 
+out_unlock:
         mutex_unlock(&ashmem_mutex);
 
         return ret;
diff --git a/drivers/staging/android/ion/ion_cma_heap.c b/drivers/staging/android/ion/ion_cma_heap.c
index 94e06925c712..49718c96bf9e 100644
--- a/drivers/staging/android/ion/ion_cma_heap.c
+++ b/drivers/staging/android/ion/ion_cma_heap.c
@@ -12,6 +12,7 @@
 #include <linux/err.h>
 #include <linux/cma.h>
 #include <linux/scatterlist.h>
+#include <linux/highmem.h>
 
 #include "ion.h"
 
@@ -42,6 +43,22 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer,
         if (!pages)
                 return -ENOMEM;
 
+        if (PageHighMem(pages)) {
+                unsigned long nr_clear_pages = nr_pages;
+                struct page *page = pages;
+
+                while (nr_clear_pages > 0) {
+                        void *vaddr = kmap_atomic(page);
+
+                        memset(vaddr, 0, PAGE_SIZE);
+                        kunmap_atomic(vaddr);
+                        page++;
+                        nr_clear_pages--;
+                }
+        } else {
+                memset(page_address(pages), 0, size);
+        }
+
         table = kmalloc(sizeof(*table), GFP_KERNEL);
         if (!table)
                 goto err;
diff --git a/drivers/staging/fsl-mc/bus/Kconfig b/drivers/staging/fsl-mc/bus/Kconfig
index 1f9100049176..b35ef7ee6901 100644
--- a/drivers/staging/fsl-mc/bus/Kconfig
+++ b/drivers/staging/fsl-mc/bus/Kconfig
@@ -7,7 +7,7 @@
 
 config FSL_MC_BUS
         bool "QorIQ DPAA2 fsl-mc bus driver"
-        depends on OF && (ARCH_LAYERSCAPE || (COMPILE_TEST && (ARM || ARM64 || X86 || PPC)))
+        depends on OF && (ARCH_LAYERSCAPE || (COMPILE_TEST && (ARM || ARM64 || X86_LOCAL_APIC || PPC)))
         select GENERIC_MSI_IRQ_DOMAIN
         help
           Driver to enable the bus infrastructure for the QorIQ DPAA2
diff --git a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
index 5064d5ddf581..fc2013aade51 100644
--- a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
+++ b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
@@ -73,6 +73,8 @@ static int __init its_fsl_mc_msi_init(void)
 
         for (np = of_find_matching_node(NULL, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller"))
                         continue;
 
diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
index f01595593ce2..425e8b82533b 100644
--- a/drivers/staging/iio/adc/ad7192.c
+++ b/drivers/staging/iio/adc/ad7192.c
@@ -141,6 +141,8 @@
 #define AD7192_GPOCON_P1DAT     BIT(1) /* P1 state */
 #define AD7192_GPOCON_P0DAT     BIT(0) /* P0 state */
 
+#define AD7192_EXT_FREQ_MHZ_MIN 2457600
+#define AD7192_EXT_FREQ_MHZ_MAX 5120000
 #define AD7192_INT_FREQ_MHZ     4915200
 
 /* NOTE:
@@ -218,6 +220,12 @@ static int ad7192_calibrate_all(struct ad7192_state *st)
                                 ARRAY_SIZE(ad7192_calib_arr));
 }
 
+static inline bool ad7192_valid_external_frequency(u32 freq)
+{
+        return (freq >= AD7192_EXT_FREQ_MHZ_MIN &&
+                freq <= AD7192_EXT_FREQ_MHZ_MAX);
+}
+
 static int ad7192_setup(struct ad7192_state *st,
                         const struct ad7192_platform_data *pdata)
 {
@@ -243,17 +251,20 @@ static int ad7192_setup(struct ad7192_state *st,
                          id);
 
         switch (pdata->clock_source_sel) {
-        case AD7192_CLK_EXT_MCLK1_2:
-        case AD7192_CLK_EXT_MCLK2:
-                st->mclk = AD7192_INT_FREQ_MHZ;
-                break;
         case AD7192_CLK_INT:
         case AD7192_CLK_INT_CO:
-                if (pdata->ext_clk_hz)
-                        st->mclk = pdata->ext_clk_hz;
-                else
-                        st->mclk = AD7192_INT_FREQ_MHZ;
+                st->mclk = AD7192_INT_FREQ_MHZ;
                 break;
+        case AD7192_CLK_EXT_MCLK1_2:
+        case AD7192_CLK_EXT_MCLK2:
+                if (ad7192_valid_external_frequency(pdata->ext_clk_hz)) {
+                        st->mclk = pdata->ext_clk_hz;
+                        break;
+                }
+                dev_err(&st->sd.spi->dev, "Invalid frequency setting %u\n",
+                        pdata->ext_clk_hz);
+                ret = -EINVAL;
+                goto out;
         default:
                 ret = -EINVAL;
                 goto out;
diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
index 2b28fb9c0048..3bcf49466361 100644
--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
@@ -648,8 +648,6 @@ static int ad5933_register_ring_funcs_and_init(struct iio_dev *indio_dev)
         /* Ring buffer functions - here trigger setup related */
         indio_dev->setup_ops = &ad5933_ring_setup_ops;
 
-        indio_dev->modes |= INDIO_BUFFER_HARDWARE;
-
         return 0;
 }
 
@@ -762,7 +760,7 @@ static int ad5933_probe(struct i2c_client *client,
         indio_dev->dev.parent = &client->dev;
         indio_dev->info = &ad5933_info;
         indio_dev->name = id->name;
-        indio_dev->modes = INDIO_DIRECT_MODE;
+        indio_dev->modes = (INDIO_BUFFER_SOFTWARE | INDIO_DIRECT_MODE);
         indio_dev->channels = ad5933_channels;
         indio_dev->num_channels = ARRAY_SIZE(ad5933_channels);
 
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 06b3b54a0e68..7b366a6c0b49 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -174,6 +174,7 @@ static int acm_wb_alloc(struct acm *acm)
                 wb = &acm->wb[wbn];
                 if (!wb->use) {
                         wb->use = 1;
+                        wb->len = 0;
                         return wbn;
                 }
                 wbn = (wbn + 1) % ACM_NW;
@@ -805,16 +806,18 @@ static int acm_tty_write(struct tty_struct *tty,
 static void acm_tty_flush_chars(struct tty_struct *tty)
 {
         struct acm *acm = tty->driver_data;
-        struct acm_wb *cur = acm->putbuffer;
+        struct acm_wb *cur;
         int err;
         unsigned long flags;
 
+        spin_lock_irqsave(&acm->write_lock, flags);
+
+        cur = acm->putbuffer;
         if (!cur) /* nothing to do */
-                return;
+                goto out;
 
         acm->putbuffer = NULL;
         err = usb_autopm_get_interface_async(acm->control);
-        spin_lock_irqsave(&acm->write_lock, flags);
         if (err < 0) {
                 cur->use = 0;
                 acm->putbuffer = cur;
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 4024926c1d68..f4a548471f0f 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -226,6 +226,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
                         USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
 
+        /* Corsair K70 RGB */
+        { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
+
         /* Corsair Strafe RGB */
         { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
 
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index e4c3ce0de5de..5bcad1d869b5 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -1917,7 +1917,9 @@ static void dwc2_hsotg_program_zlp(struct dwc2_hsotg *hsotg,
                 /* Not specific buffer needed for ep0 ZLP */
                 dma_addr_t dma = hs_ep->desc_list_dma;
 
-                dwc2_gadget_set_ep0_desc_chain(hsotg, hs_ep);
+                if (!index)
+                        dwc2_gadget_set_ep0_desc_chain(hsotg, hs_ep);
+
                 dwc2_gadget_config_nonisoc_xfer_ddma(hs_ep, dma, 0);
         } else {
                 dwc2_writel(DXEPTSIZ_MC(1) | DXEPTSIZ_PKTCNT(1) |
@@ -2974,9 +2976,13 @@ static void dwc2_hsotg_epint(struct dwc2_hsotg *hsotg, unsigned int idx,
         if (ints & DXEPINT_STSPHSERCVD) {
                 dev_dbg(hsotg->dev, "%s: StsPhseRcvd\n", __func__);
 
-                /* Move to STATUS IN for DDMA */
-                if (using_desc_dma(hsotg))
-                        dwc2_hsotg_ep0_zlp(hsotg, true);
+                /* Safety check EP0 state when STSPHSERCVD asserted */
+                if (hsotg->ep0_state == DWC2_EP0_DATA_OUT) {
+                        /* Move to STATUS IN for DDMA */
+                        if (using_desc_dma(hsotg))
+                                dwc2_hsotg_ep0_zlp(hsotg, true);
+                }
+
         }
 
         if (ints & DXEPINT_BACK2BACKSETUP)
@@ -3375,12 +3381,6 @@ void dwc2_hsotg_core_init_disconnected(struct dwc2_hsotg *hsotg,
         dwc2_writel(dwc2_hsotg_ep0_mps(hsotg->eps_out[0]->ep.maxpacket) |
                DXEPCTL_USBACTEP, hsotg->regs + DIEPCTL0);
 
-        dwc2_hsotg_enqueue_setup(hsotg);
-
-        dev_dbg(hsotg->dev, "EP0: DIEPCTL0=0x%08x, DOEPCTL0=0x%08x\n",
-                dwc2_readl(hsotg->regs + DIEPCTL0),
-                dwc2_readl(hsotg->regs + DOEPCTL0));
-
         /* clear global NAKs */
         val = DCTL_CGOUTNAK | DCTL_CGNPINNAK;
         if (!is_usb_reset)
@@ -3391,6 +3391,12 @@ void dwc2_hsotg_core_init_disconnected(struct dwc2_hsotg *hsotg,
         mdelay(3);
 
         hsotg->lx_state = DWC2_L0;
+
+        dwc2_hsotg_enqueue_setup(hsotg);
+
+        dev_dbg(hsotg->dev, "EP0: DIEPCTL0=0x%08x, DOEPCTL0=0x%08x\n",
+                dwc2_readl(hsotg->regs + DIEPCTL0),
+                dwc2_readl(hsotg->regs + DOEPCTL0));
 }
 
 static void dwc2_hsotg_core_disconnect(struct dwc2_hsotg *hsotg)
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index ade2ab00d37a..f1d838a4acd6 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -100,6 +100,8 @@ static void dwc3_set_prtcap(struct dwc3 *dwc, u32 mode)
         reg &= ~(DWC3_GCTL_PRTCAPDIR(DWC3_GCTL_PRTCAP_OTG));
         reg |= DWC3_GCTL_PRTCAPDIR(mode);
         dwc3_writel(dwc->regs, DWC3_GCTL, reg);
+
+        dwc->current_dr_role = mode;
 }
 
 static void __dwc3_set_mode(struct work_struct *work)
@@ -133,8 +135,6 @@ static void __dwc3_set_mode(struct work_struct *work)
 
         dwc3_set_prtcap(dwc, dwc->desired_dr_role);
 
-        dwc->current_dr_role = dwc->desired_dr_role;
-
         spin_unlock_irqrestore(&dwc->lock, flags);
 
         switch (dwc->desired_dr_role) {
@@ -219,7 +219,7 @@ static int dwc3_core_soft_reset(struct dwc3 *dwc)
          * XHCI driver will reset the host block. If dwc3 was configured for
          * host-only mode, then we can return early.
          */
-        if (dwc->dr_mode == USB_DR_MODE_HOST)
+        if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST)
                 return 0;
 
         reg = dwc3_readl(dwc->regs, DWC3_DCTL);
@@ -234,6 +234,9 @@ static int dwc3_core_soft_reset(struct dwc3 *dwc)
                 udelay(1);
         } while (--retries);
 
+        phy_exit(dwc->usb3_generic_phy);
+        phy_exit(dwc->usb2_generic_phy);
+
         return -ETIMEDOUT;
 }
 
@@ -483,6 +486,22 @@ static void dwc3_cache_hwparams(struct dwc3 *dwc)
         parms->hwparams8 = dwc3_readl(dwc->regs, DWC3_GHWPARAMS8);
 }
 
+static int dwc3_core_ulpi_init(struct dwc3 *dwc)
+{
+        int intf;
+        int ret = 0;
+
+        intf = DWC3_GHWPARAMS3_HSPHY_IFC(dwc->hwparams.hwparams3);
+
+        if (intf == DWC3_GHWPARAMS3_HSPHY_IFC_ULPI ||
+            (intf == DWC3_GHWPARAMS3_HSPHY_IFC_UTMI_ULPI &&
+             dwc->hsphy_interface &&
+             !strncmp(dwc->hsphy_interface, "ulpi", 4)))
+                ret = dwc3_ulpi_init(dwc);
+
+        return ret;
+}
+
 /**
  * dwc3_phy_setup - Configure USB PHY Interface of DWC3 Core
  * @dwc: Pointer to our controller context structure
@@ -494,7 +513,6 @@ static void dwc3_cache_hwparams(struct dwc3 *dwc)
 static int dwc3_phy_setup(struct dwc3 *dwc)
 {
         u32 reg;
-        int ret;
 
         reg = dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0));
 
@@ -565,9 +583,6 @@ static int dwc3_phy_setup(struct dwc3 *dwc)
                 }
                 /* FALLTHROUGH */
         case DWC3_GHWPARAMS3_HSPHY_IFC_ULPI:
-                ret = dwc3_ulpi_init(dwc);
-                if (ret)
-                        return ret;
                 /* FALLTHROUGH */
         default:
                 break;
@@ -724,6 +739,7 @@ static void dwc3_core_setup_global_control(struct dwc3 *dwc)
 }
 
 static int dwc3_core_get_phy(struct dwc3 *dwc);
+static int dwc3_core_ulpi_init(struct dwc3 *dwc);
 
 /**
  * dwc3_core_init - Low-level initialization of DWC3 Core
@@ -755,17 +771,27 @@ static int dwc3_core_init(struct dwc3 *dwc)
                         dwc->maximum_speed = USB_SPEED_HIGH;
         }
 
-        ret = dwc3_core_get_phy(dwc);
+        ret = dwc3_phy_setup(dwc);
         if (ret)
                 goto err0;
 
-        ret = dwc3_core_soft_reset(dwc);
-        if (ret)
-                goto err0;
+        if (!dwc->ulpi_ready) {
+                ret = dwc3_core_ulpi_init(dwc);
+                if (ret)
+                        goto err0;
+                dwc->ulpi_ready = true;
+        }
 
-        ret = dwc3_phy_setup(dwc);
+        if (!dwc->phys_ready) {
+                ret = dwc3_core_get_phy(dwc);
+                if (ret)
+                        goto err0a;
+                dwc->phys_ready = true;
+        }
+
+        ret = dwc3_core_soft_reset(dwc);
         if (ret)
-                goto err0;
+                goto err0a;
 
         dwc3_core_setup_global_control(dwc);
         dwc3_core_num_eps(dwc);
@@ -838,6 +864,9 @@ err1:
         phy_exit(dwc->usb2_generic_phy);
         phy_exit(dwc->usb3_generic_phy);
 
+err0a:
+        dwc3_ulpi_exit(dwc);
+
 err0:
         return ret;
 }
@@ -916,7 +945,6 @@ static int dwc3_core_init_mode(struct dwc3 *dwc)
 
         switch (dwc->dr_mode) {
         case USB_DR_MODE_PERIPHERAL:
-                dwc->current_dr_role = DWC3_GCTL_PRTCAP_DEVICE;
                 dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_DEVICE);
 
                 if (dwc->usb2_phy)
@@ -932,7 +960,6 @@ static int dwc3_core_init_mode(struct dwc3 *dwc)
                 }
                 break;
         case USB_DR_MODE_HOST:
-                dwc->current_dr_role = DWC3_GCTL_PRTCAP_HOST;
                 dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_HOST);
 
                 if (dwc->usb2_phy)
@@ -1234,7 +1261,6 @@ err4:
 
 err3:
         dwc3_free_event_buffers(dwc);
-        dwc3_ulpi_exit(dwc);
 
 err2:
         pm_runtime_allow(&pdev->dev);
@@ -1284,7 +1310,7 @@ static int dwc3_remove(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_PM
-static int dwc3_suspend_common(struct dwc3 *dwc)
+static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
 {
         unsigned long   flags;
 
@@ -1296,6 +1322,10 @@ static int dwc3_suspend_common(struct dwc3 *dwc)
                 dwc3_core_exit(dwc);
                 break;
         case DWC3_GCTL_PRTCAP_HOST:
+                /* do nothing during host runtime_suspend */
+                if (!PMSG_IS_AUTO(msg))
+                        dwc3_core_exit(dwc);
+                break;
         default:
                 /* do nothing */
                 break;
@@ -1304,7 +1334,7 @@ static int dwc3_suspend_common(struct dwc3 *dwc)
         return 0;
 }
 
-static int dwc3_resume_common(struct dwc3 *dwc)
+static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg)
 {
         unsigned long   flags;
         int             ret;
@@ -1320,6 +1350,13 @@ static int dwc3_resume_common(struct dwc3 *dwc)
                 spin_unlock_irqrestore(&dwc->lock, flags);
                 break;
         case DWC3_GCTL_PRTCAP_HOST:
+                /* nothing to do on host runtime_resume */
+                if (!PMSG_IS_AUTO(msg)) {
+                        ret = dwc3_core_init(dwc);
+                        if (ret)
+                                return ret;
+                }
+                break;
         default:
                 /* do nothing */
                 break;
@@ -1331,12 +1368,11 @@ static int dwc3_resume_common(struct dwc3 *dwc)
 static int dwc3_runtime_checks(struct dwc3 *dwc)
 {
         switch (dwc->current_dr_role) {
-        case USB_DR_MODE_PERIPHERAL:
-        case USB_DR_MODE_OTG:
+        case DWC3_GCTL_PRTCAP_DEVICE:
                 if (dwc->connected)
                         return -EBUSY;
                 break;
-        case USB_DR_MODE_HOST:
+        case DWC3_GCTL_PRTCAP_HOST:
         default:
                 /* do nothing */
                 break;
@@ -1353,7 +1389,7 @@ static int dwc3_runtime_suspend(struct device *dev)
         if (dwc3_runtime_checks(dwc))
                 return -EBUSY;
 
-        ret = dwc3_suspend_common(dwc);
+        ret = dwc3_suspend_common(dwc, PMSG_AUTO_SUSPEND);
         if (ret)
                 return ret;
 
@@ -1369,7 +1405,7 @@ static int dwc3_runtime_resume(struct device *dev)
 
         device_init_wakeup(dev, false);
 
-        ret = dwc3_resume_common(dwc);
+        ret = dwc3_resume_common(dwc, PMSG_AUTO_RESUME);
         if (ret)
                 return ret;
 
@@ -1416,7 +1452,7 @@ static int dwc3_suspend(struct device *dev)
         struct dwc3     *dwc = dev_get_drvdata(dev);
         int             ret;
 
-        ret = dwc3_suspend_common(dwc);
+        ret = dwc3_suspend_common(dwc, PMSG_SUSPEND);
         if (ret)
                 return ret;
 
@@ -1432,7 +1468,7 @@ static int dwc3_resume(struct device *dev)
 
         pinctrl_pm_select_default_state(dev);
 
-        ret = dwc3_resume_common(dwc);
+        ret = dwc3_resume_common(dwc, PMSG_RESUME);
         if (ret)
                 return ret;
 
diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 03c7aaaac926..860d2bc184d1 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -158,13 +158,15 @@
 #define DWC3_GDBGFIFOSPACE_TYPE(n)      (((n) << 5) & 0x1e0)
 #define DWC3_GDBGFIFOSPACE_SPACE_AVAILABLE(n) (((n) >> 16) & 0xffff)
 
-#define DWC3_TXFIFOQ            1
-#define DWC3_RXFIFOQ            3
-#define DWC3_TXREQQ             5
-#define DWC3_RXREQQ             7
-#define DWC3_RXINFOQ            9
-#define DWC3_DESCFETCHQ         13
-#define DWC3_EVENTQ             15
+#define DWC3_TXFIFOQ            0
+#define DWC3_RXFIFOQ            1
+#define DWC3_TXREQQ             2
+#define DWC3_RXREQQ             3
+#define DWC3_RXINFOQ            4
+#define DWC3_PSTATQ             5
+#define DWC3_DESCFETCHQ         6
+#define DWC3_EVENTQ             7
+#define DWC3_AUXEVENTQ          8
 
 /* Global RX Threshold Configuration Register */
 #define DWC3_GRXTHRCFG_MAXRXBURSTSIZE(n) (((n) & 0x1f) << 19)
@@ -795,7 +797,9 @@ struct dwc3_scratchpad_array {
  * @usb3_phy: pointer to USB3 PHY
  * @usb2_generic_phy: pointer to USB2 PHY
  * @usb3_generic_phy: pointer to USB3 PHY
+ * @phys_ready: flag to indicate that PHYs are ready
  * @ulpi: pointer to ulpi interface
+ * @ulpi_ready: flag to indicate that ULPI is initialized
  * @u2sel: parameter from Set SEL request.
  * @u2pel: parameter from Set SEL request.
  * @u1sel: parameter from Set SEL request.
@@ -893,7 +897,10 @@ struct dwc3 {
         struct phy              *usb2_generic_phy;
         struct phy              *usb3_generic_phy;
 
+        bool                    phys_ready;
+
         struct ulpi             *ulpi;
+        bool                    ulpi_ready;
 
         void __iomem            *regs;
         size_t                  regs_size;
diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index 7ae0eefc7cc7..e54c3622eb28 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -143,6 +143,7 @@ static int dwc3_of_simple_remove(struct platform_device *pdev)
                 clk_disable_unprepare(simple->clks[i]);
                 clk_put(simple->clks[i]);
         }
+        simple->num_clocks = 0;
 
         reset_control_assert(simple->resets);
         reset_control_put(simple->resets);
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index a4719e853b85..ed8b86517675 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -582,9 +582,25 @@ static int dwc3_omap_resume(struct device *dev)
         return 0;
 }
 
+static void dwc3_omap_complete(struct device *dev)
+{
+        struct dwc3_omap        *omap = dev_get_drvdata(dev);
+
+        if (extcon_get_state(omap->edev, EXTCON_USB))
+                dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_VALID);
+        else
+                dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_OFF);
+
+        if (extcon_get_state(omap->edev, EXTCON_USB_HOST))
+                dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_GROUND);
+        else
+                dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_FLOAT);
+}
+
 static const struct dev_pm_ops dwc3_omap_dev_pm_ops = {
 
         SET_SYSTEM_SLEEP_PM_OPS(dwc3_omap_suspend, dwc3_omap_resume)
+        .complete = dwc3_omap_complete,
 };
 
 #define DEV_PM_OPS      (&dwc3_omap_dev_pm_ops)
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 9c2e4a17918e..18be31d5743a 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -854,7 +854,12 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
                 trb++;
                 trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
                 trace_dwc3_complete_trb(ep0, trb);
-                ep0->trb_enqueue = 0;
+
+                if (r->direction)
+                        dwc->eps[1]->trb_enqueue = 0;
+                else
+                        dwc->eps[0]->trb_enqueue = 0;
+
                 dwc->ep0_bounced = false;
         }
 
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 616ef49ccb49..2bda4eb1e9ac 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2745,6 +2745,8 @@ static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc)
                 break;
         }
 
+        dwc->eps[1]->endpoint.maxpacket = dwc->gadget.ep0->maxpacket;
+
         /* Enable USB2 LPM Capability */
 
         if ((dwc->revision > DWC3_REVISION_194A) &&
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 8f2cf3baa19c..c2592d883f67 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1855,44 +1855,20 @@ static int ffs_func_eps_enable(struct ffs_function *func)
 
         spin_lock_irqsave(&func->ffs->eps_lock, flags);
         while(count--) {
-                struct usb_endpoint_descriptor *ds;
-                struct usb_ss_ep_comp_descriptor *comp_desc = NULL;
-                int needs_comp_desc = false;
-                int desc_idx;
-
-                if (ffs->gadget->speed == USB_SPEED_SUPER) {
-                        desc_idx = 2;
-                        needs_comp_desc = true;
-                } else if (ffs->gadget->speed == USB_SPEED_HIGH)
-                        desc_idx = 1;
-                else
-                        desc_idx = 0;
-
-                /* fall-back to lower speed if desc missing for current speed */
-                do {
-                        ds = ep->descs[desc_idx];
-                } while (!ds && --desc_idx >= 0);
-
-                if (!ds) {
-                        ret = -EINVAL;
-                        break;
-                }
-
                 ep->ep->driver_data = ep;
-                ep->ep->desc = ds;
 
-                if (needs_comp_desc) {
-                        comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
-                                        USB_DT_ENDPOINT_SIZE);
-                        ep->ep->maxburst = comp_desc->bMaxBurst + 1;
-                        ep->ep->comp_desc = comp_desc;
+                ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
+                if (ret) {
+                        pr_err("%s: config_ep_by_speed(%s) returned %d\n",
+                                        __func__, ep->ep->name, ret);
+                        break;
                 }
 
                 ret = usb_ep_enable(ep->ep);
                 if (likely(!ret)) {
                         epfile->ep = ep;
-                        epfile->in = usb_endpoint_dir_in(ds);
-                        epfile->isoc = usb_endpoint_xfer_isoc(ds);
+                        epfile->in = usb_endpoint_dir_in(ep->ep->desc);
+                        epfile->isoc = usb_endpoint_xfer_isoc(ep->ep->desc);
                 } else {
                         break;
                 }
@@ -2979,10 +2955,8 @@ static int _ffs_func_bind(struct usb_configuration *c,
         struct ffs_data *ffs = func->ffs;
 
         const int full = !!func->ffs->fs_descs_count;
-        const int high = gadget_is_dualspeed(func->gadget) &&
-                func->ffs->hs_descs_count;
-        const int super = gadget_is_superspeed(func->gadget) &&
-                func->ffs->ss_descs_count;
+        const int high = !!func->ffs->hs_descs_count;
+        const int super = !!func->ffs->ss_descs_count;
 
         int fs_len, hs_len, ss_len, ret, i;
         struct ffs_ep *eps_ptr;
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 11fe788b4308..d2dc1f00180b 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -524,6 +524,8 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
                 dev_err(dev, "%s:%d Error!\n", __func__, __LINE__);
                 return ret;
         }
+        iad_desc.bFirstInterface = ret;
+
         std_ac_if_desc.bInterfaceNumber = ret;
         uac2->ac_intf = ret;
         uac2->ac_alt = 0;
diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
index 1e9567091d86..0875d38476ee 100644
--- a/drivers/usb/gadget/udc/Kconfig
+++ b/drivers/usb/gadget/udc/Kconfig
@@ -274,7 +274,6 @@ config USB_SNP_UDC_PLAT
         tristate "Synopsys USB 2.0 Device controller"
         depends on USB_GADGET && OF && HAS_DMA
         depends on EXTCON || EXTCON=n
-        select USB_GADGET_DUALSPEED
         select USB_SNP_CORE
         default ARCH_BCM_IPROC
         help
diff --git a/drivers/usb/gadget/udc/bdc/bdc_pci.c b/drivers/usb/gadget/udc/bdc/bdc_pci.c
index 1e940f054cb8..6dbc489513cd 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_pci.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_pci.c
@@ -77,6 +77,7 @@ static int bdc_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
         if (ret) {
                 dev_err(&pci->dev,
                         "couldn't add resources to bdc device\n");
+                platform_device_put(bdc);
                 return ret;
         }
 
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 859d5b11ba4c..1f8b19d9cf97 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -180,8 +180,8 @@ EXPORT_SYMBOL_GPL(usb_ep_alloc_request);
 void usb_ep_free_request(struct usb_ep *ep,
                                        struct usb_request *req)
 {
-        ep->ops->free_request(ep, req);
         trace_usb_ep_free_request(ep, req, 0);
+        ep->ops->free_request(ep, req);
 }
 EXPORT_SYMBOL_GPL(usb_ep_free_request);
 
diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c
index e5b4ee96c4bf..56b517a38865 100644
--- a/drivers/usb/gadget/udc/fsl_udc_core.c
+++ b/drivers/usb/gadget/udc/fsl_udc_core.c
@@ -1305,7 +1305,7 @@ static void udc_reset_ep_queue(struct fsl_udc *udc, u8 pipe)
 {
         struct fsl_ep *ep = get_ep_by_pipe(udc, pipe);
 
-        if (ep->name)
+        if (ep->ep.name)
                 nuke(ep, -ESHUTDOWN);
 }
 
@@ -1693,7 +1693,7 @@ static void dtd_complete_irq(struct fsl_udc *udc)
                 curr_ep = get_ep_by_pipe(udc, i);
 
                 /* If the ep is configured */
-                if (curr_ep->name == NULL) {
+                if (!curr_ep->ep.name) {
                         WARNING("Invalid EP?");
                         continue;
                 }
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 6e87af248367..409cde4e6a51 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -2410,7 +2410,7 @@ static int renesas_usb3_remove(struct platform_device *pdev)
         __renesas_usb3_ep_free_request(usb3->ep0_req);
         if (usb3->phy)
                 phy_put(usb3->phy);
-        pm_runtime_disable(usb3_to_dev(usb3));
+        pm_runtime_disable(&pdev->dev);
 
         return 0;
 }
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index facafdf8fb95..d7641cbdee43 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -774,12 +774,12 @@ static struct urb *request_single_step_set_feature_urb(
         atomic_inc(&urb->use_count);
         atomic_inc(&urb->dev->urbnum);
         urb->setup_dma = dma_map_single(
-                        hcd->self.controller,
+                        hcd->self.sysdev,
                         urb->setup_packet,
                         sizeof(struct usb_ctrlrequest),
                         DMA_TO_DEVICE);
         urb->transfer_dma = dma_map_single(
-                        hcd->self.controller,
+                        hcd->self.sysdev,
                         urb->transfer_buffer,
                         urb->transfer_buffer_length,
                         DMA_FROM_DEVICE);
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 88158324dcae..327630405695 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -1188,10 +1188,10 @@ static int submit_single_step_set_feature(
          * 15 secs after the setup
          */
         if (is_setup) {
-                /* SETUP pid */
+                /* SETUP pid, and interrupt after SETUP completion */
                 qtd_fill(ehci, qtd, urb->setup_dma,
                                 sizeof(struct usb_ctrlrequest),
-                                token | (2 /* "setup" */ << 8), 8);
+                                QTD_IOC | token | (2 /* "setup" */ << 8), 8);
 
                 submit_async(ehci, urb, &qtd_list, GFP_ATOMIC);
                 return 0; /*Return now; we shall come back after 15 seconds*/
@@ -1228,12 +1228,8 @@ static int submit_single_step_set_feature(
         qtd_prev->hw_next = QTD_NEXT(ehci, qtd->qtd_dma);
         list_add_tail(&qtd->qtd_list, head);
 
-        /* dont fill any data in such packets */
-        qtd_fill(ehci, qtd, 0, 0, token, 0);
-
-        /* by default, enable interrupt on urb completion */
-        if (likely(!(urb->transfer_flags & URB_NO_INTERRUPT)))
-                qtd->hw_token |= cpu_to_hc32(ehci, QTD_IOC);
+        /* Interrupt after STATUS completion */
+        qtd_fill(ehci, qtd, 0, 0, token | QTD_IOC, 0);
 
         submit_async(ehci, urb, &qtd_list, GFP_KERNEL);
 
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index ee9676349333..84f88fa411cd 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -74,6 +74,7 @@ static const char	hcd_name [] = "ohci_hcd";
 
 #define STATECHANGE_DELAY       msecs_to_jiffies(300)
 #define IO_WATCHDOG_DELAY       msecs_to_jiffies(275)
+#define IO_WATCHDOG_OFF         0xffffff00
 
 #include "ohci.h"
 #include "pci-quirks.h"
@@ -231,7 +232,7 @@ static int ohci_urb_enqueue (
                 }
 
                 /* Start up the I/O watchdog timer, if it's not running */
-                if (!timer_pending(&ohci->io_watchdog) &&
+                if (ohci->prev_frame_no == IO_WATCHDOG_OFF &&
                                 list_empty(&ohci->eds_in_use) &&
                                 !(ohci->flags & OHCI_QUIRK_QEMU)) {
                         ohci->prev_frame_no = ohci_frame_no(ohci);
@@ -501,6 +502,7 @@ static int ohci_init (struct ohci_hcd *ohci)
                 return 0;
 
         timer_setup(&ohci->io_watchdog, io_watchdog_func, 0);
+        ohci->prev_frame_no = IO_WATCHDOG_OFF;
 
         ohci->hcca = dma_alloc_coherent (hcd->self.controller,
                         sizeof(*ohci->hcca), &ohci->hcca_dma, GFP_KERNEL);
@@ -730,7 +732,7 @@ static void io_watchdog_func(struct timer_list *t)
         u32             head;
         struct ed       *ed;
         struct td       *td, *td_start, *td_next;
-        unsigned        frame_no;
+        unsigned        frame_no, prev_frame_no = IO_WATCHDOG_OFF;
         unsigned long   flags;
 
         spin_lock_irqsave(&ohci->lock, flags);
@@ -835,7 +837,7 @@ static void io_watchdog_func(struct timer_list *t)
                         }
                 }
                 if (!list_empty(&ohci->eds_in_use)) {
-                        ohci->prev_frame_no = frame_no;
+                        prev_frame_no = frame_no;
                         ohci->prev_wdh_cnt = ohci->wdh_cnt;
                         ohci->prev_donehead = ohci_readl(ohci,
                                         &ohci->regs->donehead);
@@ -845,6 +847,7 @@ static void io_watchdog_func(struct timer_list *t)
         }
 
  done:
+        ohci->prev_frame_no = prev_frame_no;
         spin_unlock_irqrestore(&ohci->lock, flags);
 }
 
@@ -973,6 +976,7 @@ static void ohci_stop (struct usb_hcd *hcd)
         if (quirk_nec(ohci))
                 flush_work(&ohci->nec_work);
         del_timer_sync(&ohci->io_watchdog);
+        ohci->prev_frame_no = IO_WATCHDOG_OFF;
 
         ohci_writel (ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);
         ohci_usb_reset(ohci);
diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
index fb7aaa3b9d06..634f3c7bf774 100644
--- a/drivers/usb/host/ohci-hub.c
+++ b/drivers/usb/host/ohci-hub.c
@@ -311,8 +311,10 @@ static int ohci_bus_suspend (struct usb_hcd *hcd)
                 rc = ohci_rh_suspend (ohci, 0);
         spin_unlock_irq (&ohci->lock);
 
-        if (rc == 0)
+        if (rc == 0) {
                 del_timer_sync(&ohci->io_watchdog);
+                ohci->prev_frame_no = IO_WATCHDOG_OFF;
+        }
         return rc;
 }
 
diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index b2ec8c399363..4ccb85a67bb3 100644
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -1019,6 +1019,8 @@ skip_ed:
                  * have modified this list.  normally it's just prepending
                  * entries (which we'd ignore), but paranoia won't hurt.
                  */
+                *last = ed->ed_next;
+                ed->ed_next = NULL;
                 modified = 0;
 
                 /* unlink urbs as requested, but rescan the list after
@@ -1077,21 +1079,22 @@ rescan_this:
                         goto rescan_this;
 
                 /*
-                 * If no TDs are queued, take ED off the ed_rm_list.
+                 * If no TDs are queued, ED is now idle.
                  * Otherwise, if the HC is running, reschedule.
-                 * If not, leave it on the list for further dequeues.
+                 * If the HC isn't running, add ED back to the
+                 * start of the list for later processing.
                  */
                 if (list_empty(&ed->td_list)) {
-                        *last = ed->ed_next;
-                        ed->ed_next = NULL;
                         ed->state = ED_IDLE;
                         list_del(&ed->in_use_list);
                 } else if (ohci->rh_state == OHCI_RH_RUNNING) {
-                        *last = ed->ed_next;
-                        ed->ed_next = NULL;
                         ed_schedule(ohci, ed);
                 } else {
-                        last = &ed->ed_next;
+                        ed->ed_next = ohci->ed_rm_list;
+                        ohci->ed_rm_list = ed;
+                        /* Don't loop on the same ED */
+                        if (last == &ohci->ed_rm_list)
+                                last = &ed->ed_next;
                 }
 
                 if (modified)
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 161536717025..67ad4bb6919a 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -66,6 +66,23 @@
 #define AX_INDXC                0x30
 #define AX_DATAC                0x34
 
+#define PT_ADDR_INDX            0xE8
+#define PT_READ_INDX            0xE4
+#define PT_SIG_1_ADDR           0xA520
+#define PT_SIG_2_ADDR           0xA521
+#define PT_SIG_3_ADDR           0xA522
+#define PT_SIG_4_ADDR           0xA523
+#define PT_SIG_1_DATA           0x78
+#define PT_SIG_2_DATA           0x56
+#define PT_SIG_3_DATA           0x34
+#define PT_SIG_4_DATA           0x12
+#define PT4_P1_REG              0xB521
+#define PT4_P2_REG              0xB522
+#define PT2_P1_REG              0xD520
+#define PT2_P2_REG              0xD521
+#define PT1_P1_REG              0xD522
+#define PT1_P2_REG              0xD523
+
 #define NB_PCIE_INDX_ADDR       0xe0
 #define NB_PCIE_INDX_DATA       0xe4
 #define PCIE_P_CNTL             0x10040
@@ -513,6 +530,98 @@ void usb_amd_dev_put(void)
 EXPORT_SYMBOL_GPL(usb_amd_dev_put);
 
 /*
+ * Check if port is disabled in BIOS on AMD Promontory host.
+ * BIOS Disabled ports may wake on connect/disconnect and need
+ * driver workaround to keep them disabled.
+ * Returns true if port is marked disabled.
+ */
+bool usb_amd_pt_check_port(struct device *device, int port)
+{
+        unsigned char value, port_shift;
+        struct pci_dev *pdev;
+        u16 reg;
+
+        pdev = to_pci_dev(device);
+        pci_write_config_word(pdev, PT_ADDR_INDX, PT_SIG_1_ADDR);
+
+        pci_read_config_byte(pdev, PT_READ_INDX, &value);
+        if (value != PT_SIG_1_DATA)
+                return false;
+
+        pci_write_config_word(pdev, PT_ADDR_INDX, PT_SIG_2_ADDR);
+
+        pci_read_config_byte(pdev, PT_READ_INDX, &value);
+        if (value != PT_SIG_2_DATA)
+                return false;
+
+        pci_write_config_word(pdev, PT_ADDR_INDX, PT_SIG_3_ADDR);
+
+        pci_read_config_byte(pdev, PT_READ_INDX, &value);
+        if (value != PT_SIG_3_DATA)
+                return false;
+
+        pci_write_config_word(pdev, PT_ADDR_INDX, PT_SIG_4_ADDR);
+
+        pci_read_config_byte(pdev, PT_READ_INDX, &value);
+        if (value != PT_SIG_4_DATA)
+                return false;
+
+        /* Check disabled port setting, if bit is set port is enabled */
+        switch (pdev->device) {
+        case 0x43b9:
+        case 0x43ba:
+        /*
+         * device is AMD_PROMONTORYA_4(0x43b9) or PROMONTORYA_3(0x43ba)
+         * PT4_P1_REG bits[7..1] represents USB2.0 ports 6 to 0
+         * PT4_P2_REG bits[6..0] represents ports 13 to 7
+         */
+                if (port > 6) {
+                        reg = PT4_P2_REG;
+                        port_shift = port - 7;
+                } else {
+                        reg = PT4_P1_REG;
+                        port_shift = port + 1;
+                }
+                break;
+        case 0x43bb:
+        /*
+         * device is AMD_PROMONTORYA_2(0x43bb)
+         * PT2_P1_REG bits[7..5] represents USB2.0 ports 2 to 0
+         * PT2_P2_REG bits[5..0] represents ports 9 to 3
+         */
+                if (port > 2) {
+                        reg = PT2_P2_REG;
+                        port_shift = port - 3;
+                } else {
+                        reg = PT2_P1_REG;
+                        port_shift = port + 5;
+                }
+                break;
+        case 0x43bc:
+        /*
+         * device is AMD_PROMONTORYA_1(0x43bc)
+         * PT1_P1_REG[7..4] represents USB2.0 ports 3 to 0
+         * PT1_P2_REG[5..0] represents ports 9 to 4
+         */
+                if (port > 3) {
+                        reg = PT1_P2_REG;
+                        port_shift = port - 4;
+                } else {
+                        reg = PT1_P1_REG;
+                        port_shift = port + 4;
+                }
+                break;
+        default:
+                return false;
+        }
+        pci_write_config_word(pdev, PT_ADDR_INDX, reg);
+        pci_read_config_byte(pdev, PT_READ_INDX, &value);
+
+        return !(value & BIT(port_shift));
+}
+EXPORT_SYMBOL_GPL(usb_amd_pt_check_port);
+
+/*
  * Make sure the controller is completely inactive, unable to
  * generate interrupts or do DMA.
  */
diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h
index b68dcb5dd0fd..4ca0d9b7e463 100644
--- a/drivers/usb/host/pci-quirks.h
+++ b/drivers/usb/host/pci-quirks.h
@@ -17,6 +17,7 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev);
 void usb_disable_xhci_ports(struct pci_dev *xhci_pdev);
 void sb800_prefetch(struct device *dev, int on);
 bool usb_xhci_needs_pci_reset(struct pci_dev *pdev);
+bool usb_amd_pt_check_port(struct device *device, int port);
 #else
 struct pci_dev;
 static inline void usb_amd_quirk_pll_disable(void) {}
@@ -25,6 +26,10 @@ static inline void usb_asmedia_modifyflowcontrol(struct pci_dev *pdev) {}
 static inline void usb_amd_dev_put(void) {}
 static inline void usb_disable_xhci_ports(struct pci_dev *xhci_pdev) {}
 static inline void sb800_prefetch(struct device *dev, int on) {}
+static inline bool usb_amd_pt_check_port(struct device *device, int port)
+{
+        return false;
+}
 #endif  /* CONFIG_USB_PCI */
 
 #endif  /*  __LINUX_USB_PCI_QUIRKS_H  */
diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
index e26e685d8a57..5851052d4668 100644
--- a/drivers/usb/host/xhci-debugfs.c
+++ b/drivers/usb/host/xhci-debugfs.c
@@ -211,7 +211,7 @@ static void xhci_ring_dump_segment(struct seq_file *s,
 static int xhci_ring_trb_show(struct seq_file *s, void *unused)
 {
         int                     i;
-        struct xhci_ring        *ring = s->private;
+        struct xhci_ring        *ring = *(struct xhci_ring **)s->private;
         struct xhci_segment     *seg = ring->first_seg;
 
         for (i = 0; i < ring->num_segs; i++) {
@@ -387,7 +387,7 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci,
 
         snprintf(epriv->name, sizeof(epriv->name), "ep%02d", ep_index);
         epriv->root = xhci_debugfs_create_ring_dir(xhci,
-                                                   &dev->eps[ep_index].new_ring,
+                                                   &dev->eps[ep_index].ring,
                                                    epriv->name,
                                                    spriv->root);
         spriv->eps[ep_index] = epriv;
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 46d5e08f05f1..72ebbc908e19 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1224,17 +1224,17 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                                 temp = readl(port_array[wIndex]);
                                 break;
                         }
-
-                        /* Software should not attempt to set
-                         * port link state above '3' (U3) and the port
-                         * must be enabled.
-                         */
-                        if ((temp & PORT_PE) == 0 ||
-                                (link_state > USB_SS_PORT_LS_U3)) {
-                                xhci_warn(xhci, "Cannot set link state.\n");
+                        /* Port must be enabled */
+                        if (!(temp & PORT_PE)) {
+                                retval = -ENODEV;
+                                break;
+                        }
+                        /* Can't set port link state above '3' (U3) */
+                        if (link_state > USB_SS_PORT_LS_U3) {
+                                xhci_warn(xhci, "Cannot set port %d link state %d\n",
+                                         wIndex, link_state);
                                 goto error;
                         }
-
                         if (link_state == USB_SS_PORT_LS_U3) {
                                 slot_id = xhci_find_slot_id_by_port(hcd, xhci,
                                                 wIndex + 1);
@@ -1522,6 +1522,13 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                                 t2 |= PORT_WKOC_E | PORT_WKCONN_E;
                                 t2 &= ~PORT_WKDISC_E;
                         }
+
+                        if ((xhci->quirks & XHCI_U2_DISABLE_WAKE) &&
+                            (hcd->speed < HCD_USB3)) {
+                                if (usb_amd_pt_check_port(hcd->self.controller,
+                                                          port_index))
+                                        t2 &= ~PORT_WAKE_BITS;
+                        }
                 } else
                         t2 &= ~PORT_WAKE_BITS;
 
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 6c79037876db..5262fa571a5d 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -42,6 +42,10 @@
 #define PCI_DEVICE_ID_INTEL_APL_XHCI                    0x5aa8
 #define PCI_DEVICE_ID_INTEL_DNV_XHCI                    0x19d0
 
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_4                 0x43b9
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_3                 0x43ba
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_2                 0x43bb
+#define PCI_DEVICE_ID_AMD_PROMONTORYA_1                 0x43bc
 #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI                0x1142
 
 static const char hcd_name[] = "xhci_hcd";
@@ -125,6 +129,13 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_AMD)
                 xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 
+        if ((pdev->vendor == PCI_VENDOR_ID_AMD) &&
+                ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) ||
+                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_3) ||
+                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2) ||
+                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_1)))
+                xhci->quirks |= XHCI_U2_DISABLE_WAKE;
+
         if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
                 xhci->quirks |= XHCI_LPM_SUPPORT;
                 xhci->quirks |= XHCI_INTEL_HOST;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 1eeb3396300f..25d4b748a56f 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -646,8 +646,6 @@ static void xhci_stop(struct usb_hcd *hcd)
                 return;
         }
 
-        xhci_debugfs_exit(xhci);
-
         xhci_dbc_exit(xhci);
 
         spin_lock_irq(&xhci->lock);
@@ -680,6 +678,7 @@ static void xhci_stop(struct usb_hcd *hcd)
 
         xhci_dbg_trace(xhci, trace_xhci_dbg_init, "cleaning up memory");
         xhci_mem_cleanup(xhci);
+        xhci_debugfs_exit(xhci);
         xhci_dbg_trace(xhci, trace_xhci_dbg_init,
                         "xhci_stop completed - status = %x",
                         readl(&xhci->op_regs->status));
@@ -1014,6 +1013,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 
                 xhci_dbg(xhci, "cleaning up memory\n");
                 xhci_mem_cleanup(xhci);
+                xhci_debugfs_exit(xhci);
                 xhci_dbg(xhci, "xhci_stop completed - status = %x\n",
                             readl(&xhci->op_regs->status));
 
@@ -3544,12 +3544,10 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
                 virt_dev->eps[i].ep_state &= ~EP_STOP_CMD_PENDING;
                 del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
         }
-
+        xhci_debugfs_remove_slot(xhci, udev->slot_id);
         ret = xhci_disable_slot(xhci, udev->slot_id);
-        if (ret) {
-                xhci_debugfs_remove_slot(xhci, udev->slot_id);
+        if (ret)
                 xhci_free_virt_device(xhci, udev->slot_id);
-        }
 }
 
 int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 96099a245c69..e4d7d3d06a75 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1822,7 +1822,7 @@ struct xhci_hcd {
 /* For controller with a broken Port Disable implementation */
 #define XHCI_BROKEN_PORT_PED    (1 << 25)
 #define XHCI_LIMIT_ENDPOINT_INTERVAL_7  (1 << 26)
-/* Reserved. It was XHCI_U2_DISABLE_WAKE */
+#define XHCI_U2_DISABLE_WAKE    (1 << 27)
 #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28)
 #define XHCI_HW_LPM_DISABLE     (1 << 29)
 
diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
index 63b9e85dc0e9..236a60f53099 100644
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -42,6 +42,9 @@
 #define USB_DEVICE_ID_LD_MICROCASSYTIME         0x1033  /* USB Product ID of Micro-CASSY Time (reserved) */
 #define USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE  0x1035  /* USB Product ID of Micro-CASSY Temperature */
 #define USB_DEVICE_ID_LD_MICROCASSYPH           0x1038  /* USB Product ID of Micro-CASSY pH */
+#define USB_DEVICE_ID_LD_POWERANALYSERCASSY     0x1040  /* USB Product ID of Power Analyser CASSY */
+#define USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY       0x1042  /* USB Product ID of Converter Controller CASSY */
+#define USB_DEVICE_ID_LD_MACHINETESTCASSY       0x1043  /* USB Product ID of Machine Test CASSY */
 #define USB_DEVICE_ID_LD_JWM            0x1080  /* USB Product ID of Joule and Wattmeter */
 #define USB_DEVICE_ID_LD_DMMP           0x1081  /* USB Product ID of Digital Multimeter P (reserved) */
 #define USB_DEVICE_ID_LD_UMIP           0x1090  /* USB Product ID of UMI P */
@@ -84,6 +87,9 @@ static const struct usb_device_id ld_usb_table[] = {
         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTIME) },
         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE) },
         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYPH) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POWERANALYSERCASSY) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MACHINETESTCASSY) },
         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_JWM) },
         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_DMMP) },
         { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_UMIP) },
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 968bf1e8b0fe..eef4ad578b31 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2708,7 +2708,8 @@ static int musb_resume(struct device *dev)
         if ((devctl & mask) != (musb->context.devctl & mask))
                 musb->port1_status = 0;
 
-        musb_start(musb);
+        musb_enable_interrupts(musb);
+        musb_platform_enable(musb);
 
         spin_lock_irqsave(&musb->lock, flags);
         error = musb_run_resume_work(musb);
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 394b4ac86161..45ed32c2cba9 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -391,13 +391,7 @@ static void musb_advance_schedule(struct musb *musb, struct urb *urb,
                 }
         }
 
-        /*
-         * The pipe must be broken if current urb->status is set, so don't
-         * start next urb.
-         * TODO: to minimize the risk of regression, only check urb->status
-         * for RX, until we have a test case to understand the behavior of TX.
-         */
-        if ((!status || !is_in) && qh && qh->is_ready) {
+        if (qh != NULL && qh->is_ready) {
                 musb_dbg(musb, "... next ep%d %cX urb %p",
                     hw_ep->epnum, is_in ? 'R' : 'T', next_urb(qh));
                 musb_start_urb(musb, is_in, qh);
diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
index da031c45395a..fbec863350f6 100644
--- a/drivers/usb/phy/phy-mxs-usb.c
+++ b/drivers/usb/phy/phy-mxs-usb.c
@@ -602,6 +602,9 @@ static enum usb_charger_type mxs_phy_charger_detect(struct usb_phy *phy)
         void __iomem *base = phy->io_priv;
         enum usb_charger_type chgr_type = UNKNOWN_TYPE;
 
+        if (!regmap)
+                return UNKNOWN_TYPE;
+
         if (mxs_charger_data_contact_detect(mxs_phy))
                 return chgr_type;
 
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index 5925d111bd47..39fa2fc1b8b7 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -982,6 +982,10 @@ static int usbhsf_dma_prepare_pop_with_usb_dmac(struct usbhs_pkt *pkt,
         if ((uintptr_t)pkt->buf & (USBHS_USB_DMAC_XFER_SIZE - 1))
                 goto usbhsf_pio_prepare_pop;
 
+        /* return at this time if the pipe is running */
+        if (usbhs_pipe_is_running(pipe))
+                return 0;
+
         usbhs_pipe_config_change_bfre(pipe, 1);
 
         ret = usbhsf_fifo_select(pipe, fifo, 0);
@@ -1172,6 +1176,7 @@ static int usbhsf_dma_pop_done_with_usb_dmac(struct usbhs_pkt *pkt,
         usbhsf_fifo_clear(pipe, fifo);
         pkt->actual = usbhs_dma_calc_received_size(pkt, chan, rcv_len);
 
+        usbhs_pipe_running(pipe, 0);
         usbhsf_dma_stop(pipe, fifo);
         usbhsf_dma_unmap(pkt);
         usbhsf_fifo_unselect(pipe, pipe->fifo);
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 5db8ed517e0e..2d8d9150da0c 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -241,6 +241,7 @@ static void option_instat_callback(struct urb *urb);
 #define QUECTEL_PRODUCT_EC21                    0x0121
 #define QUECTEL_PRODUCT_EC25                    0x0125
 #define QUECTEL_PRODUCT_BG96                    0x0296
+#define QUECTEL_PRODUCT_EP06                    0x0306
 
 #define CMOTECH_VENDOR_ID                       0x16d8
 #define CMOTECH_PRODUCT_6001                    0x6001
@@ -689,6 +690,10 @@ static const struct option_blacklist_info yuga_clm920_nc5_blacklist = {
         .reserved = BIT(1) | BIT(4),
 };
 
+static const struct option_blacklist_info quectel_ep06_blacklist = {
+        .reserved = BIT(4) | BIT(5),
+};
+
 static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -1203,6 +1208,8 @@ static const struct usb_device_id option_ids[] = {
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06),
+          .driver_info = (kernel_ulong_t)&quectel_ep06_blacklist },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
index 49e552472c3f..dd8ef36ab10e 100644
--- a/drivers/usb/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -73,6 +73,7 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a
                         goto err;
 
                 sdev->ud.tcp_socket = socket;
+                sdev->ud.sockfd = sockfd;
 
                 spin_unlock_irq(&sdev->ud.lock);
 
@@ -172,6 +173,7 @@ static void stub_shutdown_connection(struct usbip_device *ud)
         if (ud->tcp_socket) {
                 sockfd_put(ud->tcp_socket);
                 ud->tcp_socket = NULL;
+                ud->sockfd = -1;
         }
 
         /* 3. free used data */
@@ -266,6 +268,7 @@ static struct stub_device *stub_device_alloc(struct usb_device *udev)
         sdev->ud.status         = SDEV_ST_AVAILABLE;
         spin_lock_init(&sdev->ud.lock);
         sdev->ud.tcp_socket     = NULL;
+        sdev->ud.sockfd         = -1;
 
         INIT_LIST_HEAD(&sdev->priv_init);
         INIT_LIST_HEAD(&sdev->priv_tx);
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index c3e1008aa491..20e3d4609583 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -984,6 +984,7 @@ static void vhci_shutdown_connection(struct usbip_device *ud)
         if (vdev->ud.tcp_socket) {
                 sockfd_put(vdev->ud.tcp_socket);
                 vdev->ud.tcp_socket = NULL;
+                vdev->ud.sockfd = -1;
         }
         pr_info("release socket\n");
 
@@ -1030,6 +1031,7 @@ static void vhci_device_reset(struct usbip_device *ud)
         if (ud->tcp_socket) {
                 sockfd_put(ud->tcp_socket);
                 ud->tcp_socket = NULL;
+                ud->sockfd = -1;
         }
         ud->status = VDEV_ST_NULL;
 
diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
index 753d9cb437d0..aedbee3b2838 100644
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@ -60,6 +60,7 @@ struct sock_mapping {
         bool active_socket;
         struct list_head list;
         struct socket *sock;
+        atomic_t refcount;
         union {
                 struct {
                         int irq;
@@ -93,6 +94,32 @@ struct sock_mapping {
         };
 };
 
+static inline struct sock_mapping *pvcalls_enter_sock(struct socket *sock)
+{
+        struct sock_mapping *map;
+
+        if (!pvcalls_front_dev ||
+                dev_get_drvdata(&pvcalls_front_dev->dev) == NULL)
+                return ERR_PTR(-ENOTCONN);
+
+        map = (struct sock_mapping *)sock->sk->sk_send_head;
+        if (map == NULL)
+                return ERR_PTR(-ENOTSOCK);
+
+        pvcalls_enter();
+        atomic_inc(&map->refcount);
+        return map;
+}
+
+static inline void pvcalls_exit_sock(struct socket *sock)
+{
+        struct sock_mapping *map;
+
+        map = (struct sock_mapping *)sock->sk->sk_send_head;
+        atomic_dec(&map->refcount);
+        pvcalls_exit();
+}
+
 static inline int get_request(struct pvcalls_bedata *bedata, int *req_id)
 {
         *req_id = bedata->ring.req_prod_pvt & (RING_SIZE(&bedata->ring) - 1);
@@ -369,31 +396,23 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
         if (addr->sa_family != AF_INET || sock->type != SOCK_STREAM)
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
 
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *)sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         spin_lock(&bedata->socket_lock);
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         ret = create_active(map, &evtchn);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
 
@@ -423,7 +442,7 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
         smp_rmb();
         ret = bedata->rsp[req_id].ret;
         bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -488,23 +507,15 @@ int pvcalls_front_sendmsg(struct socket *sock, struct msghdr *msg,
         if (flags & (MSG_CONFIRM|MSG_DONTROUTE|MSG_EOR|MSG_OOB))
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         mutex_lock(&map->active.out_mutex);
         if ((flags & MSG_DONTWAIT) && !pvcalls_front_write_todo(map)) {
                 mutex_unlock(&map->active.out_mutex);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EAGAIN;
         }
         if (len > INT_MAX)
@@ -526,7 +537,7 @@ again:
                 tot_sent = sent;
 
         mutex_unlock(&map->active.out_mutex);
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return tot_sent;
 }
 
@@ -591,19 +602,11 @@ int pvcalls_front_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
         if (flags & (MSG_CMSG_CLOEXEC|MSG_ERRQUEUE|MSG_OOB|MSG_TRUNC))
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         mutex_lock(&map->active.in_mutex);
         if (len > XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER))
                 len = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
@@ -623,7 +626,7 @@ int pvcalls_front_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                 ret = 0;
 
         mutex_unlock(&map->active.in_mutex);
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -637,24 +640,16 @@ int pvcalls_front_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
         if (addr->sa_family != AF_INET || sock->type != SOCK_STREAM)
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (map == NULL) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         spin_lock(&bedata->socket_lock);
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         req = RING_GET_REQUEST(&bedata->ring, req_id);
@@ -684,7 +679,7 @@ int pvcalls_front_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
         bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
 
         map->passive.status = PVCALLS_STATUS_BIND;
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return 0;
 }
 
@@ -695,21 +690,13 @@ int pvcalls_front_listen(struct socket *sock, int backlog)
         struct xen_pvcalls_request *req;
         int notify, req_id, ret;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         if (map->passive.status != PVCALLS_STATUS_BIND) {
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EOPNOTSUPP;
         }
 
@@ -717,7 +704,7 @@ int pvcalls_front_listen(struct socket *sock, int backlog)
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         req = RING_GET_REQUEST(&bedata->ring, req_id);
@@ -741,7 +728,7 @@ int pvcalls_front_listen(struct socket *sock, int backlog)
         bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
 
         map->passive.status = PVCALLS_STATUS_LISTEN;
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -753,21 +740,13 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
         struct xen_pvcalls_request *req;
         int notify, req_id, ret, evtchn, nonblock;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         if (map->passive.status != PVCALLS_STATUS_LISTEN) {
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EINVAL;
         }
 
@@ -785,13 +764,13 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                         goto received;
                 }
                 if (nonblock) {
-                        pvcalls_exit();
+                        pvcalls_exit_sock(sock);
                         return -EAGAIN;
                 }
                 if (wait_event_interruptible(map->passive.inflight_accept_req,
                         !test_and_set_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                                           (void *)&map->passive.flags))) {
-                        pvcalls_exit();
+                        pvcalls_exit_sock(sock);
                         return -EINTR;
                 }
         }
@@ -802,7 +781,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         map2 = kzalloc(sizeof(*map2), GFP_ATOMIC);
@@ -810,7 +789,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -ENOMEM;
         }
         ret = create_active(map2, &evtchn);
@@ -819,7 +798,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         list_add_tail(&map2->list, &bedata->socket_mappings);
@@ -841,13 +820,13 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
         /* We could check if we have received a response before returning. */
         if (nonblock) {
                 WRITE_ONCE(map->passive.inflight_req_id, req_id);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EAGAIN;
         }
 
         if (wait_event_interruptible(bedata->inflight_req,
                 READ_ONCE(bedata->rsp[req_id].req_id) == req_id)) {
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EINTR;
         }
         /* read req_id, then the content */
@@ -862,7 +841,7 @@ received:
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 pvcalls_front_free_map(bedata, map2);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -ENOMEM;
         }
         newsock->sk->sk_send_head = (void *)map2;
@@ -874,7 +853,7 @@ received:
         clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, (void *)&map->passive.flags);
         wake_up(&map->passive.inflight_accept_req);
 
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -965,23 +944,16 @@ __poll_t pvcalls_front_poll(struct file *file, struct socket *sock,
         struct sock_mapping *map;
         __poll_t ret;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
                 return EPOLLNVAL;
-        }
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return EPOLLNVAL;
-        }
         if (map->active_socket)
                 ret = pvcalls_front_poll_active(file, bedata, map, wait);
         else
                 ret = pvcalls_front_poll_passive(file, bedata, map, wait);
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -995,25 +967,20 @@ int pvcalls_front_release(struct socket *sock)
         if (sock->sk == NULL)
                 return 0;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -EIO;
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map)) {
+                if (PTR_ERR(map) == -ENOTCONN)
+                        return -EIO;
+                else
+                        return 0;
         }
-
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (map == NULL) {
-                pvcalls_exit();
-                return 0;
-        }
-
         spin_lock(&bedata->socket_lock);
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         sock->sk->sk_send_head = NULL;
@@ -1043,14 +1010,20 @@ int pvcalls_front_release(struct socket *sock)
                 /*
                  * We need to make sure that sendmsg/recvmsg on this socket have
                  * not started before we've cleared sk_send_head here. The
-                 * easiest (though not optimal) way to guarantee this is to see
-                 * that no pvcall (other than us) is in progress.
+                 * easiest way to guarantee this is to see that no pvcalls
+                 * (other than us) is in progress on this socket.
                  */
-                while (atomic_read(&pvcalls_refcount) > 1)
+                while (atomic_read(&map->refcount) > 1)
                         cpu_relax();
 
                 pvcalls_front_free_map(bedata, map);
         } else {
+                wake_up(&bedata->inflight_req);
+                wake_up(&map->passive.inflight_accept_req);
+
+                while (atomic_read(&map->refcount) > 1)
+                        cpu_relax();
+
                 spin_lock(&bedata->socket_lock);
                 list_del(&map->list);
                 spin_unlock(&bedata->socket_lock);
diff --git a/drivers/xen/tmem.c b/drivers/xen/tmem.c
index bf13d1ec51f3..04e7b3b29bac 100644
--- a/drivers/xen/tmem.c
+++ b/drivers/xen/tmem.c
@@ -284,6 +284,10 @@ static int tmem_frontswap_store(unsigned type, pgoff_t offset,
         int pool = tmem_frontswap_poolid;
         int ret;
 
+        /* THP isn't supported */
+        if (PageTransHuge(page))
+                return -1;
+
         if (pool < 0)
                 return -1;
         if (ind64 != ind)
diff --git a/drivers/xen/xenbus/xenbus.h b/drivers/xen/xenbus/xenbus.h
index 149c5e7efc89..092981171df1 100644
--- a/drivers/xen/xenbus/xenbus.h
+++ b/drivers/xen/xenbus/xenbus.h
@@ -76,6 +76,7 @@ struct xb_req_data {
         struct list_head list;
         wait_queue_head_t wq;
         struct xsd_sockmsg msg;
+        uint32_t caller_req_id;
         enum xsd_sockmsg_type type;
         char *body;
         const struct kvec *vec;
diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c
index 5b081a01779d..d239fc3c5e3d 100644
--- a/drivers/xen/xenbus/xenbus_comms.c
+++ b/drivers/xen/xenbus/xenbus_comms.c
@@ -309,6 +309,7 @@ static int process_msg(void)
                         goto out;
 
                 if (req->state == xb_req_state_wait_reply) {
+                        req->msg.req_id = req->caller_req_id;
                         req->msg.type = state.msg.type;
                         req->msg.len = state.msg.len;
                         req->body = state.body;
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index 3e59590c7254..3f3b29398ab8 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -227,6 +227,8 @@ static void xs_send(struct xb_req_data *req, struct xsd_sockmsg *msg)
         req->state = xb_req_state_queued;
         init_waitqueue_head(&req->wq);
 
+        /* Save the caller req_id and restore it later in the reply */
+        req->caller_req_id = req->msg.req_id;
         req->msg.req_id = xs_request_enter(req);
 
         mutex_lock(&xb_write_mutex);
@@ -310,6 +312,7 @@ static void *xs_talkv(struct xenbus_transaction t,
         req->num_vecs = num_vecs;
         req->cb = xs_wake_up;
 
+        msg.req_id = 0;
         msg.tx_id = t.id;
         msg.type = type;
         msg.len = 0;
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 4a181fcb5175..fe09ef9c21f3 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1058,6 +1058,27 @@ retry:
         return 0;
 }
 
+static struct gendisk *bdev_get_gendisk(struct block_device *bdev, int *partno)
+{
+        struct gendisk *disk = get_gendisk(bdev->bd_dev, partno);
+
+        if (!disk)
+                return NULL;
+        /*
+         * Now that we hold gendisk reference we make sure bdev we looked up is
+         * not stale. If it is, it means device got removed and created before
+         * we looked up gendisk and we fail open in such case. Associating
+         * unhashed bdev with newly created gendisk could lead to two bdevs
+         * (and thus two independent caches) being associated with one device
+         * which is bad.
+         */
+        if (inode_unhashed(bdev->bd_inode)) {
+                put_disk_and_module(disk);
+                return NULL;
+        }
+        return disk;
+}
+
 /**
  * bd_start_claiming - start claiming a block device
  * @bdev: block device of interest
@@ -1094,7 +1115,7 @@ static struct block_device *bd_start_claiming(struct block_device *bdev,
          * @bdev might not have been initialized properly yet, look up
          * and grab the outer block device the hard way.
          */
-        disk = get_gendisk(bdev->bd_dev, &partno);
+        disk = bdev_get_gendisk(bdev, &partno);
         if (!disk)
                 return ERR_PTR(-ENXIO);
 
@@ -1111,8 +1132,7 @@ static struct block_device *bd_start_claiming(struct block_device *bdev,
         else
                 whole = bdgrab(bdev);
 
-        module_put(disk->fops->owner);
-        put_disk(disk);
+        put_disk_and_module(disk);
         if (!whole)
                 return ERR_PTR(-ENOMEM);
 
@@ -1407,10 +1427,10 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part);
 static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
 {
         struct gendisk *disk;
-        struct module *owner;
         int ret;
         int partno;
         int perm = 0;
+        bool first_open = false;
 
         if (mode & FMODE_READ)
                 perm |= MAY_READ;
@@ -1430,14 +1450,14 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
  restart:
 
         ret = -ENXIO;
-        disk = get_gendisk(bdev->bd_dev, &partno);
+        disk = bdev_get_gendisk(bdev, &partno);
         if (!disk)
                 goto out;
-        owner = disk->fops->owner;
 
         disk_block_events(disk);
         mutex_lock_nested(&bdev->bd_mutex, for_part);
         if (!bdev->bd_openers) {
+                first_open = true;
                 bdev->bd_disk = disk;
                 bdev->bd_queue = disk->queue;
                 bdev->bd_contains = bdev;
@@ -1463,8 +1483,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                                         bdev->bd_queue = NULL;
                                         mutex_unlock(&bdev->bd_mutex);
                                         disk_unblock_events(disk);
-                                        put_disk(disk);
-                                        module_put(owner);
+                                        put_disk_and_module(disk);
                                         goto restart;
                                 }
                         }
@@ -1524,15 +1543,15 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                         if (ret)
                                 goto out_unlock_bdev;
                 }
-                /* only one opener holds refs to the module and disk */
-                put_disk(disk);
-                module_put(owner);
         }
         bdev->bd_openers++;
         if (for_part)
                 bdev->bd_part_count++;
         mutex_unlock(&bdev->bd_mutex);
         disk_unblock_events(disk);
+        /* only one opener holds refs to the module and disk */
+        if (!first_open)
+                put_disk_and_module(disk);
         return 0;
 
  out_clear:
@@ -1546,8 +1565,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
  out_unlock_bdev:
         mutex_unlock(&bdev->bd_mutex);
         disk_unblock_events(disk);
-        put_disk(disk);
-        module_put(owner);
+        put_disk_and_module(disk);
  out:
         bdput(bdev);
 
@@ -1770,8 +1788,6 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part)
                         disk->fops->release(disk, mode);
         }
         if (!bdev->bd_openers) {
-                struct module *owner = disk->fops->owner;
-
                 disk_put_part(bdev->bd_part);
                 bdev->bd_part = NULL;
                 bdev->bd_disk = NULL;
@@ -1779,8 +1795,7 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part)
                         victim = bdev->bd_contains;
                 bdev->bd_contains = NULL;
 
-                put_disk(disk);
-                module_put(owner);
+                put_disk_and_module(disk);
         }
         mutex_unlock(&bdev->bd_mutex);
         bdput(bdev);
diff --git a/fs/direct-io.c b/fs/direct-io.c
index a0ca9e48e993..1357ef563893 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -1274,8 +1274,7 @@ do_blockdev_direct_IO(struct kiocb *iocb, struct inode *inode,
          */
         if (dio->is_async && iov_iter_rw(iter) == WRITE) {
                 retval = 0;
-                if ((iocb->ki_filp->f_flags & O_DSYNC) ||
-                    IS_SYNC(iocb->ki_filp->f_mapping->host))
+                if (iocb->ki_flags & IOCB_DSYNC)
                         retval = dio_set_defer_completion(dio);
                 else if (!dio->inode->i_sb->s_dio_done_wq) {
                         /*
diff --git a/fs/efivarfs/file.c b/fs/efivarfs/file.c
index 5f22e74bbade..8e568428c88b 100644
--- a/fs/efivarfs/file.c
+++ b/fs/efivarfs/file.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/efi.h>
+#include <linux/delay.h>
 #include <linux/fs.h>
 #include <linux/slab.h>
 #include <linux/mount.h>
@@ -74,6 +75,11 @@ static ssize_t efivarfs_file_read(struct file *file, char __user *userbuf,
         ssize_t size = 0;
         int err;
 
+        while (!__ratelimit(&file->f_cred->user->ratelimit)) {
+                if (!msleep_interruptible(50))
+                        return -EINTR;
+        }
+
         err = efivar_entry_size(var, &datasize);
 
         /*
diff --git a/fs/signalfd.c b/fs/signalfd.c
index 9990957264e3..76bf9cc62074 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -118,13 +118,22 @@ static int signalfd_copyinfo(struct signalfd_siginfo __user *uinfo,
                 err |= __put_user(kinfo->si_trapno, &uinfo->ssi_trapno);
 #endif
 #ifdef BUS_MCEERR_AO
-                /* 
+                /*
+                 * Other callers might not initialize the si_lsb field,
+                 * so check explicitly for the right codes here.
+                 */
+                if (kinfo->si_signo == SIGBUS &&
+                     kinfo->si_code == BUS_MCEERR_AO)
+                        err |= __put_user((short) kinfo->si_addr_lsb,
+                                          &uinfo->ssi_addr_lsb);
+#endif
+#ifdef BUS_MCEERR_AR
+                /*
                  * Other callers might not initialize the si_lsb field,
                  * so check explicitly for the right codes here.
                  */
                 if (kinfo->si_signo == SIGBUS &&
-                    (kinfo->si_code == BUS_MCEERR_AR ||
-                     kinfo->si_code == BUS_MCEERR_AO))
+                    kinfo->si_code == BUS_MCEERR_AR)
                         err |= __put_user((short) kinfo->si_addr_lsb,
                                           &uinfo->ssi_addr_lsb);
 #endif
diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h
index 963b755d19b0..a7613e1b0c87 100644
--- a/include/asm-generic/bug.h
+++ b/include/asm-generic/bug.h
@@ -52,6 +52,7 @@ struct bug_entry {
 #ifndef HAVE_ARCH_BUG
 #define BUG() do { \
         printk("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \
+        barrier_before_unreachable(); \
         panic("BUG!"); \
 } while (0)
 #endif
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 4f3df807cf8f..ed63f3b69c12 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -49,7 +49,7 @@ struct blk_stat_callback;
 #define BLKDEV_MIN_RQ   4
 #define BLKDEV_MAX_RQ   128     /* Default maximum */
 
-/* Must be consisitent with blk_mq_poll_stats_bkt() */
+/* Must be consistent with blk_mq_poll_stats_bkt() */
 #define BLK_MQ_POLL_STATS_BKTS 16
 
 /*
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 73bc63e0a1c4..901c1ccb3374 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -208,6 +208,15 @@
 #endif
 
 /*
+ * calling noreturn functions, __builtin_unreachable() and __builtin_trap()
+ * confuse the stack allocation in gcc, leading to overly large stack
+ * frames, see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82365
+ *
+ * Adding an empty inline assembly before it works around the problem
+ */
+#define barrier_before_unreachable() asm volatile("")
+
+/*
  * Mark a position in code as unreachable.  This can be used to
  * suppress control flow warnings after asm blocks that transfer
  * control elsewhere.
@@ -217,7 +226,11 @@
  * unreleased.  Really, we need to have autoconf for the kernel.
  */
 #define unreachable() \
-        do { annotate_unreachable(); __builtin_unreachable(); } while (0)
+        do {                                    \
+                annotate_unreachable();         \
+                barrier_before_unreachable();   \
+                __builtin_unreachable();        \
+        } while (0)
 
 /* Mark a function definition as prohibited from being cloned. */
 #define __noclone       __attribute__((__noclone__, __optimize__("no-tracer")))
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index e835fc0423ec..ab4711c63601 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -86,6 +86,11 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
 # define barrier_data(ptr) barrier()
 #endif
 
+/* workaround for GCC PR82365 if needed */
+#ifndef barrier_before_unreachable
+# define barrier_before_unreachable() do { } while (0)
+#endif
+
 /* Unreachable code */
 #ifdef CONFIG_STACK_VALIDATION
 /*
diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
index d4a2a7dcd72d..bf53d893ad02 100644
--- a/include/linux/cpumask.h
+++ b/include/linux/cpumask.h
@@ -170,6 +170,8 @@ static inline unsigned int cpumask_local_spread(unsigned int i, int node)
         for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask)
 #define for_each_cpu_not(cpu, mask)             \
         for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask)
+#define for_each_cpu_wrap(cpu, mask, start)     \
+        for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)(start))
 #define for_each_cpu_and(cpu, mask, and)        \
         for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)and)
 #else
diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
index 34fe8463d10e..eb9eab4ecd6d 100644
--- a/include/linux/dma-mapping.h
+++ b/include/linux/dma-mapping.h
@@ -578,7 +578,7 @@ static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
 
 /*
  * This is a hack for the legacy x86 forbid_dac and iommu_sac_force. Please
- * don't use this is new code.
+ * don't use this in new code.
  */
 #ifndef arch_dma_supported
 #define arch_dma_supported(dev, mask)   (1)
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index 5e3531027b51..c826b0b5232a 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -198,6 +198,7 @@ struct gendisk {
         void *private_data;
 
         int flags;
+        struct rw_semaphore lookup_sem;
         struct kobject *slave_dir;
 
         struct timer_rand_state *random;
@@ -600,8 +601,9 @@ extern void delete_partition(struct gendisk *, int);
 extern void printk_all_partitions(void);
 
 extern struct gendisk *__alloc_disk_node(int minors, int node_id);
-extern struct kobject *get_disk(struct gendisk *disk);
+extern struct kobject *get_disk_and_module(struct gendisk *disk);
 extern void put_disk(struct gendisk *disk);
+extern void put_disk_and_module(struct gendisk *disk);
 extern void blk_register_region(dev_t devt, unsigned long range,
                         struct module *module,
                         struct kobject *(*probe)(dev_t, int *, void *),
diff --git a/include/linux/kconfig.h b/include/linux/kconfig.h
index fec5076eda91..dcde9471897d 100644
--- a/include/linux/kconfig.h
+++ b/include/linux/kconfig.h
@@ -4,6 +4,12 @@
 
 #include <generated/autoconf.h>
 
+#ifdef CONFIG_CPU_BIG_ENDIAN
+#define __BIG_ENDIAN 4321
+#else
+#define __LITTLE_ENDIAN 1234
+#endif
+
 #define __ARG_PLACEHOLDER_1 0,
 #define __take_second_arg(__ignored, val, ...) val
 
@@ -64,4 +70,7 @@
  */
 #define IS_ENABLED(option) __or(IS_BUILTIN(option), IS_MODULE(option))
 
+/* Make sure we always have all types and struct attributes defined. */
+#include <linux/compiler_types.h>
+
 #endif /* __LINUX_KCONFIG_H */
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 882046863581..c46016bb25eb 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -523,9 +523,11 @@ static inline void __mod_memcg_state(struct mem_cgroup *memcg,
 static inline void mod_memcg_state(struct mem_cgroup *memcg,
                                    int idx, int val)
 {
-        preempt_disable();
+        unsigned long flags;
+
+        local_irq_save(flags);
         __mod_memcg_state(memcg, idx, val);
-        preempt_enable();
+        local_irq_restore(flags);
 }
 
 /**
@@ -606,9 +608,11 @@ static inline void __mod_lruvec_state(struct lruvec *lruvec,
 static inline void mod_lruvec_state(struct lruvec *lruvec,
                                     enum node_stat_item idx, int val)
 {
-        preempt_disable();
+        unsigned long flags;
+
+        local_irq_save(flags);
         __mod_lruvec_state(lruvec, idx, val);
-        preempt_enable();
+        local_irq_restore(flags);
 }
 
 static inline void __mod_lruvec_page_state(struct page *page,
@@ -630,9 +634,11 @@ static inline void __mod_lruvec_page_state(struct page *page,
 static inline void mod_lruvec_page_state(struct page *page,
                                          enum node_stat_item idx, int val)
 {
-        preempt_disable();
+        unsigned long flags;
+
+        local_irq_save(flags);
         __mod_lruvec_page_state(page, idx, val);
-        preempt_enable();
+        local_irq_restore(flags);
 }
 
 unsigned long mem_cgroup_soft_limit_reclaim(pg_data_t *pgdat, int order,
@@ -659,9 +665,11 @@ static inline void __count_memcg_events(struct mem_cgroup *memcg,
 static inline void count_memcg_events(struct mem_cgroup *memcg,
                                       int idx, unsigned long count)
 {
-        preempt_disable();
+        unsigned long flags;
+
+        local_irq_save(flags);
         __count_memcg_events(memcg, idx, count);
-        preempt_enable();
+        local_irq_restore(flags);
 }
 
 /* idx can be of type enum memcg_event_item or vm_event_item */
diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
index b884b7794187..e6335227b844 100644
--- a/include/linux/ptr_ring.h
+++ b/include/linux/ptr_ring.h
@@ -469,7 +469,7 @@ static inline int ptr_ring_consume_batched_bh(struct ptr_ring *r,
  */
 static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp)
 {
-        if (size * sizeof(void *) > KMALLOC_MAX_SIZE)
+        if (size > KMALLOC_MAX_SIZE / sizeof(void *))
                 return NULL;
         return kvmalloc_array(size, sizeof(void *), gfp | __GFP_ZERO);
 }
diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h
index 1149533aa2fa..9806184bb3d5 100644
--- a/include/linux/sched/mm.h
+++ b/include/linux/sched/mm.h
@@ -36,7 +36,18 @@ static inline void mmgrab(struct mm_struct *mm)
         atomic_inc(&mm->mm_count);
 }
 
-extern void mmdrop(struct mm_struct *mm);
+extern void __mmdrop(struct mm_struct *mm);
+
+static inline void mmdrop(struct mm_struct *mm)
+{
+        /*
+         * The implicit full barrier implied by atomic_dec_and_test() is
+         * required by the membarrier system call before returning to
+         * user-space, after storing to rq->curr.
+         */
+        if (unlikely(atomic_dec_and_test(&mm->mm_count)))
+                __mmdrop(mm);
+}
 
 /**
  * mmget() - Pin the address space associated with a &struct mm_struct.
diff --git a/include/linux/sched/user.h b/include/linux/sched/user.h
index 0dcf4e480ef7..96fe289c4c6e 100644
--- a/include/linux/sched/user.h
+++ b/include/linux/sched/user.h
@@ -4,6 +4,7 @@
 
 #include <linux/uidgid.h>
 #include <linux/atomic.h>
+#include <linux/ratelimit.h>
 
 struct key;
 
@@ -41,6 +42,9 @@ struct user_struct {
     defined(CONFIG_NET)
         atomic_long_t locked_vm;
 #endif
+
+        /* Miscellaneous per-user rate limit */
+        struct ratelimit_state ratelimit;
 };
 
 extern int uids_sysfs_init(void);
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 5ebc0f869720..c1e66bdcf583 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3646,7 +3646,7 @@ static inline bool __skb_checksum_validate_needed(struct sk_buff *skb,
         return true;
 }
 
-/* For small packets <= CHECKSUM_BREAK peform checksum complete directly
+/* For small packets <= CHECKSUM_BREAK perform checksum complete directly
  * in checksum_init.
  */
 #define CHECKSUM_BREAK 76
diff --git a/include/linux/swap.h b/include/linux/swap.h
index 7b6a59f722a3..a1a3f4ed94ce 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -337,8 +337,6 @@ extern void deactivate_file_page(struct page *page);
 extern void mark_page_lazyfree(struct page *page);
 extern void swap_setup(void);
 
-extern void add_page_to_unevictable_list(struct page *page);
-
 extern void lru_cache_add_active_or_unevictable(struct page *page,
                                                 struct vm_area_struct *vma);
 
diff --git a/include/net/udplite.h b/include/net/udplite.h
index 81bdbf97319b..9185e45b997f 100644
--- a/include/net/udplite.h
+++ b/include/net/udplite.h
@@ -64,6 +64,7 @@ static inline int udplite_checksum_init(struct sk_buff *skb, struct udphdr *uh)
                 UDP_SKB_CB(skb)->cscov = cscov;
                 if (skb->ip_summed == CHECKSUM_COMPLETE)
                         skb->ip_summed = CHECKSUM_NONE;
+                skb->csum_valid = 0;
         }
 
         return 0;
diff --git a/include/rdma/restrack.h b/include/rdma/restrack.h
index c2d81167c858..2cdf8dcf4bdc 100644
--- a/include/rdma/restrack.h
+++ b/include/rdma/restrack.h
@@ -29,10 +29,6 @@ enum rdma_restrack_type {
          */
         RDMA_RESTRACK_QP,
         /**
-         * @RDMA_RESTRACK_XRCD: XRC domain (XRCD)
-         */
-        RDMA_RESTRACK_XRCD,
-        /**
          * @RDMA_RESTRACK_MAX: Last entry, used for array dclarations
          */
         RDMA_RESTRACK_MAX
diff --git a/include/rdma/uverbs_ioctl.h b/include/rdma/uverbs_ioctl.h
index 6da44079aa58..38287d9d23a1 100644
--- a/include/rdma/uverbs_ioctl.h
+++ b/include/rdma/uverbs_ioctl.h
@@ -276,10 +276,7 @@ struct uverbs_object_tree_def {
  */
 
 struct uverbs_ptr_attr {
-        union {
-                u64             data;
-                void    __user *ptr;
-        };
+        u64             data;
         u16             len;
         /* Combination of bits from enum UVERBS_ATTR_F_XXXX */
         u16             flags;
@@ -351,38 +348,60 @@ static inline const struct uverbs_attr *uverbs_attr_get(const struct uverbs_attr
 }
 
 static inline int uverbs_copy_to(const struct uverbs_attr_bundle *attrs_bundle,
-                                 size_t idx, const void *from)
+                                 size_t idx, const void *from, size_t size)
 {
         const struct uverbs_attr *attr = uverbs_attr_get(attrs_bundle, idx);
         u16 flags;
+        size_t min_size;
 
         if (IS_ERR(attr))
                 return PTR_ERR(attr);
 
+        min_size = min_t(size_t, attr->ptr_attr.len, size);
+        if (copy_to_user(u64_to_user_ptr(attr->ptr_attr.data), from, min_size))
+                return -EFAULT;
+
         flags = attr->ptr_attr.flags | UVERBS_ATTR_F_VALID_OUTPUT;
-        return (!copy_to_user(attr->ptr_attr.ptr, from, attr->ptr_attr.len) &&
-                !put_user(flags, &attr->uattr->flags)) ? 0 : -EFAULT;
+        if (put_user(flags, &attr->uattr->flags))
+                return -EFAULT;
+
+        return 0;
 }
 
-static inline int _uverbs_copy_from(void *to, size_t to_size,
+static inline bool uverbs_attr_ptr_is_inline(const struct uverbs_attr *attr)
+{
+        return attr->ptr_attr.len <= sizeof(attr->ptr_attr.data);
+}
+
+static inline int _uverbs_copy_from(void *to,
                                     const struct uverbs_attr_bundle *attrs_bundle,
-                                    size_t idx)
+                                    size_t idx,
+                                    size_t size)
 {
         const struct uverbs_attr *attr = uverbs_attr_get(attrs_bundle, idx);
 
         if (IS_ERR(attr))
                 return PTR_ERR(attr);
 
-        if (to_size <= sizeof(((struct ib_uverbs_attr *)0)->data))
+        /*
+         * Validation ensures attr->ptr_attr.len >= size. If the caller is
+         * using UVERBS_ATTR_SPEC_F_MIN_SZ then it must call copy_from with
+         * the right size.
+         */
+        if (unlikely(size < attr->ptr_attr.len))
+                return -EINVAL;
+
+        if (uverbs_attr_ptr_is_inline(attr))
                 memcpy(to, &attr->ptr_attr.data, attr->ptr_attr.len);
-        else if (copy_from_user(to, attr->ptr_attr.ptr, attr->ptr_attr.len))
+        else if (copy_from_user(to, u64_to_user_ptr(attr->ptr_attr.data),
+                                attr->ptr_attr.len))
                 return -EFAULT;
 
         return 0;
 }
 
 #define uverbs_copy_from(to, attrs_bundle, idx)                               \
-        _uverbs_copy_from(to, sizeof(*(to)), attrs_bundle, idx)
+        _uverbs_copy_from(to, attrs_bundle, idx, sizeof(*to))
 
 /* =================================================
  *       Definitions -> Specs infrastructure
diff --git a/include/uapi/linux/blktrace_api.h b/include/uapi/linux/blktrace_api.h
index 20d1490d6377..3c50e07ee833 100644
--- a/include/uapi/linux/blktrace_api.h
+++ b/include/uapi/linux/blktrace_api.h
@@ -131,7 +131,7 @@ enum {
 #define BLKTRACE_BDEV_SIZE      32
 
 /*
- * User setup structure passed with BLKTRACESTART
+ * User setup structure passed with BLKTRACESETUP
  */
 struct blk_user_trace_setup {
         char name[BLKTRACE_BDEV_SIZE];  /* output */
diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h
index f8cb5760ea4f..8bbbcb5cd94b 100644
--- a/include/uapi/linux/if_ether.h
+++ b/include/uapi/linux/if_ether.h
@@ -23,7 +23,6 @@
 #define _UAPI_LINUX_IF_ETHER_H
 
 #include <linux/types.h>
-#include <linux/libc-compat.h>
 
 /*
  *      IEEE 802.3 Ethernet magic constants.  The frame sizes omit the preamble
@@ -151,6 +150,11 @@
  *      This is an Ethernet frame header.
  */
 
+/* allow libcs like musl to deactivate this, glibc does not implement this. */
+#ifndef __UAPI_DEF_ETHHDR
+#define __UAPI_DEF_ETHHDR               1
+#endif
+
 #if __UAPI_DEF_ETHHDR
 struct ethhdr {
         unsigned char   h_dest[ETH_ALEN];       /* destination eth addr */
diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
index fc29efaa918c..8254c937c9f4 100644
--- a/include/uapi/linux/libc-compat.h
+++ b/include/uapi/linux/libc-compat.h
@@ -264,10 +264,4 @@
 
 #endif /* __GLIBC__ */
 
-/* Definitions for if_ether.h */
-/* allow libcs like musl to deactivate this, glibc does not implement this. */
-#ifndef __UAPI_DEF_ETHHDR
-#define __UAPI_DEF_ETHHDR               1
-#endif
-
 #endif /* _UAPI_LIBC_COMPAT_H */
diff --git a/include/uapi/rdma/rdma_user_ioctl.h b/include/uapi/rdma/rdma_user_ioctl.h
index 03557b5f9aa6..46de0885e800 100644
--- a/include/uapi/rdma/rdma_user_ioctl.h
+++ b/include/uapi/rdma/rdma_user_ioctl.h
@@ -65,7 +65,7 @@ struct ib_uverbs_attr {
         __u16 len;              /* only for pointers */
         __u16 flags;            /* combination of UVERBS_ATTR_F_XXXX */
         __u16 reserved;
-        __u64 data;             /* ptr to command, inline data or idr/fd */
+        __aligned_u64 data;     /* ptr to command, inline data or idr/fd */
 };
 
 struct ib_uverbs_ioctl_hdr {
@@ -73,7 +73,7 @@ struct ib_uverbs_ioctl_hdr {
         __u16 object_id;
         __u16 method_id;
         __u16 num_attrs;
-        __u64 reserved;
+        __aligned_u64 reserved;
         struct ib_uverbs_attr  attrs[0];
 };
 
diff --git a/kernel/fork.c b/kernel/fork.c
index be8aa5b98666..e5d9d405ae4e 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -592,7 +592,7 @@ static void check_mm(struct mm_struct *mm)
  * is dropped: either by a lazy thread or by
  * mmput. Free the page directory and the mm.
  */
-static void __mmdrop(struct mm_struct *mm)
+void __mmdrop(struct mm_struct *mm)
 {
         BUG_ON(mm == &init_mm);
         mm_free_pgd(mm);
@@ -603,18 +603,7 @@ static void __mmdrop(struct mm_struct *mm)
         put_user_ns(mm->user_ns);
         free_mm(mm);
 }
-
-void mmdrop(struct mm_struct *mm)
-{
-        /*
-         * The implicit full barrier implied by atomic_dec_and_test() is
-         * required by the membarrier system call before returning to
-         * user-space, after storing to rq->curr.
-         */
-        if (unlikely(atomic_dec_and_test(&mm->mm_count)))
-                __mmdrop(mm);
-}
-EXPORT_SYMBOL_GPL(mmdrop);
+EXPORT_SYMBOL_GPL(__mmdrop);
 
 static void mmdrop_async_fn(struct work_struct *work)
 {
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index e6a9c36470ee..82b8b18ee1eb 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1726,25 +1726,14 @@ static int irq_domain_debug_show(struct seq_file *m, void *p)
         irq_domain_debug_show_one(m, d, 0);
         return 0;
 }
-
-static int irq_domain_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, irq_domain_debug_show, inode->i_private);
-}
-
-static const struct file_operations dfs_domain_ops = {
-        .open           = irq_domain_debug_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-};
+DEFINE_SHOW_ATTRIBUTE(irq_domain_debug);
 
 static void debugfs_add_domain_dir(struct irq_domain *d)
 {
         if (!d->name || !domain_dir || d->debugfs_file)
                 return;
         d->debugfs_file = debugfs_create_file(d->name, 0444, domain_dir, d,
-                                              &dfs_domain_ops);
+                                              &irq_domain_debug_fops);
 }
 
 static void debugfs_remove_domain_dir(struct irq_domain *d)
@@ -1760,7 +1749,8 @@ void __init irq_domain_debugfs_init(struct dentry *root)
         if (!domain_dir)
                 return;
 
-        debugfs_create_file("default", 0444, domain_dir, NULL, &dfs_domain_ops);
+        debugfs_create_file("default", 0444, domain_dir, NULL,
+                            &irq_domain_debug_fops);
         mutex_lock(&irq_domain_mutex);
         list_for_each_entry(d, &irq_domain_list, link)
                 debugfs_add_domain_dir(d);
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index da2ccf142358..102160ff5c66 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -978,67 +978,90 @@ static int prepare_kprobe(struct kprobe *p)
 }
 
 /* Caller must lock kprobe_mutex */
-static void arm_kprobe_ftrace(struct kprobe *p)
+static int arm_kprobe_ftrace(struct kprobe *p)
 {
-        int ret;
+        int ret = 0;
 
         ret = ftrace_set_filter_ip(&kprobe_ftrace_ops,
                                    (unsigned long)p->addr, 0, 0);
-        WARN(ret < 0, "Failed to arm kprobe-ftrace at %p (%d)\n", p->addr, ret);
-        kprobe_ftrace_enabled++;
-        if (kprobe_ftrace_enabled == 1) {
+        if (ret) {
+                pr_debug("Failed to arm kprobe-ftrace at %p (%d)\n", p->addr, ret);
+                return ret;
+        }
+
+        if (kprobe_ftrace_enabled == 0) {
                 ret = register_ftrace_function(&kprobe_ftrace_ops);
-                WARN(ret < 0, "Failed to init kprobe-ftrace (%d)\n", ret);
+                if (ret) {
+                        pr_debug("Failed to init kprobe-ftrace (%d)\n", ret);
+                        goto err_ftrace;
+                }
         }
+
+        kprobe_ftrace_enabled++;
+        return ret;
+
+err_ftrace:
+        /*
+         * Note: Since kprobe_ftrace_ops has IPMODIFY set, and ftrace requires a
+         * non-empty filter_hash for IPMODIFY ops, we're safe from an accidental
+         * empty filter_hash which would undesirably trace all functions.
+         */
+        ftrace_set_filter_ip(&kprobe_ftrace_ops, (unsigned long)p->addr, 1, 0);
+        return ret;
 }
 
 /* Caller must lock kprobe_mutex */
-static void disarm_kprobe_ftrace(struct kprobe *p)
+static int disarm_kprobe_ftrace(struct kprobe *p)
 {
-        int ret;
+        int ret = 0;
 
-        kprobe_ftrace_enabled--;
-        if (kprobe_ftrace_enabled == 0) {
+        if (kprobe_ftrace_enabled == 1) {
                 ret = unregister_ftrace_function(&kprobe_ftrace_ops);
-                WARN(ret < 0, "Failed to init kprobe-ftrace (%d)\n", ret);
+                if (WARN(ret < 0, "Failed to unregister kprobe-ftrace (%d)\n", ret))
+                        return ret;
         }
+
+        kprobe_ftrace_enabled--;
+
         ret = ftrace_set_filter_ip(&kprobe_ftrace_ops,
                            (unsigned long)p->addr, 1, 0);
         WARN(ret < 0, "Failed to disarm kprobe-ftrace at %p (%d)\n", p->addr, ret);
+        return ret;
 }
 #else   /* !CONFIG_KPROBES_ON_FTRACE */
 #define prepare_kprobe(p)       arch_prepare_kprobe(p)
-#define arm_kprobe_ftrace(p)    do {} while (0)
-#define disarm_kprobe_ftrace(p) do {} while (0)
+#define arm_kprobe_ftrace(p)    (-ENODEV)
+#define disarm_kprobe_ftrace(p) (-ENODEV)
 #endif
 
 /* Arm a kprobe with text_mutex */
-static void arm_kprobe(struct kprobe *kp)
+static int arm_kprobe(struct kprobe *kp)
 {
-        if (unlikely(kprobe_ftrace(kp))) {
-                arm_kprobe_ftrace(kp);
-                return;
-        }
+        if (unlikely(kprobe_ftrace(kp)))
+                return arm_kprobe_ftrace(kp);
+
         cpus_read_lock();
         mutex_lock(&text_mutex);
         __arm_kprobe(kp);
         mutex_unlock(&text_mutex);
         cpus_read_unlock();
+
+        return 0;
 }
 
 /* Disarm a kprobe with text_mutex */
-static void disarm_kprobe(struct kprobe *kp, bool reopt)
+static int disarm_kprobe(struct kprobe *kp, bool reopt)
 {
-        if (unlikely(kprobe_ftrace(kp))) {
-                disarm_kprobe_ftrace(kp);
-                return;
-        }
+        if (unlikely(kprobe_ftrace(kp)))
+                return disarm_kprobe_ftrace(kp);
 
         cpus_read_lock();
         mutex_lock(&text_mutex);
         __disarm_kprobe(kp, reopt);
         mutex_unlock(&text_mutex);
         cpus_read_unlock();
+
+        return 0;
 }
 
 /*
@@ -1362,9 +1385,15 @@ out:
 
         if (ret == 0 && kprobe_disabled(ap) && !kprobe_disabled(p)) {
                 ap->flags &= ~KPROBE_FLAG_DISABLED;
-                if (!kprobes_all_disarmed)
+                if (!kprobes_all_disarmed) {
                         /* Arm the breakpoint again. */
-                        arm_kprobe(ap);
+                        ret = arm_kprobe(ap);
+                        if (ret) {
+                                ap->flags |= KPROBE_FLAG_DISABLED;
+                                list_del_rcu(&p->list);
+                                synchronize_sched();
+                        }
+                }
         }
         return ret;
 }
@@ -1573,8 +1602,14 @@ int register_kprobe(struct kprobe *p)
         hlist_add_head_rcu(&p->hlist,
                        &kprobe_table[hash_ptr(p->addr, KPROBE_HASH_BITS)]);
 
-        if (!kprobes_all_disarmed && !kprobe_disabled(p))
-                arm_kprobe(p);
+        if (!kprobes_all_disarmed && !kprobe_disabled(p)) {
+                ret = arm_kprobe(p);
+                if (ret) {
+                        hlist_del_rcu(&p->hlist);
+                        synchronize_sched();
+                        goto out;
+                }
+        }
 
         /* Try to optimize kprobe */
         try_to_optimize_kprobe(p);
@@ -1608,11 +1643,12 @@ static int aggr_kprobe_disabled(struct kprobe *ap)
 static struct kprobe *__disable_kprobe(struct kprobe *p)
 {
         struct kprobe *orig_p;
+        int ret;
 
         /* Get an original kprobe for return */
         orig_p = __get_valid_kprobe(p);
         if (unlikely(orig_p == NULL))
-                return NULL;
+                return ERR_PTR(-EINVAL);
 
         if (!kprobe_disabled(p)) {
                 /* Disable probe if it is a child probe */
@@ -1626,8 +1662,13 @@ static struct kprobe *__disable_kprobe(struct kprobe *p)
                          * should have already been disarmed, so
                          * skip unneed disarming process.
                          */
-                        if (!kprobes_all_disarmed)
-                                disarm_kprobe(orig_p, true);
+                        if (!kprobes_all_disarmed) {
+                                ret = disarm_kprobe(orig_p, true);
+                                if (ret) {
+                                        p->flags &= ~KPROBE_FLAG_DISABLED;
+                                        return ERR_PTR(ret);
+                                }
+                        }
                         orig_p->flags |= KPROBE_FLAG_DISABLED;
                 }
         }
@@ -1644,8 +1685,8 @@ static int __unregister_kprobe_top(struct kprobe *p)
 
         /* Disable kprobe. This will disarm it if needed. */
         ap = __disable_kprobe(p);
-        if (ap == NULL)
-                return -EINVAL;
+        if (IS_ERR(ap))
+                return PTR_ERR(ap);
 
         if (ap == p)
                 /*
@@ -2078,12 +2119,14 @@ static void kill_kprobe(struct kprobe *p)
 int disable_kprobe(struct kprobe *kp)
 {
         int ret = 0;
+        struct kprobe *p;
 
         mutex_lock(&kprobe_mutex);
 
         /* Disable this kprobe */
-        if (__disable_kprobe(kp) == NULL)
-                ret = -EINVAL;
+        p = __disable_kprobe(kp);
+        if (IS_ERR(p))
+                ret = PTR_ERR(p);
 
         mutex_unlock(&kprobe_mutex);
         return ret;
@@ -2116,7 +2159,9 @@ int enable_kprobe(struct kprobe *kp)
 
         if (!kprobes_all_disarmed && kprobe_disabled(p)) {
                 p->flags &= ~KPROBE_FLAG_DISABLED;
-                arm_kprobe(p);
+                ret = arm_kprobe(p);
+                if (ret)
+                        p->flags |= KPROBE_FLAG_DISABLED;
         }
 out:
         mutex_unlock(&kprobe_mutex);
@@ -2407,11 +2452,12 @@ static const struct file_operations debugfs_kprobe_blacklist_ops = {
         .release        = seq_release,
 };
 
-static void arm_all_kprobes(void)
+static int arm_all_kprobes(void)
 {
         struct hlist_head *head;
         struct kprobe *p;
-        unsigned int i;
+        unsigned int i, total = 0, errors = 0;
+        int err, ret = 0;
 
         mutex_lock(&kprobe_mutex);
 
@@ -2428,46 +2474,74 @@ static void arm_all_kprobes(void)
         /* Arming kprobes doesn't optimize kprobe itself */
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
-                hlist_for_each_entry_rcu(p, head, hlist)
-                        if (!kprobe_disabled(p))
-                                arm_kprobe(p);
+                /* Arm all kprobes on a best-effort basis */
+                hlist_for_each_entry_rcu(p, head, hlist) {
+                        if (!kprobe_disabled(p)) {
+                                err = arm_kprobe(p);
+                                if (err)  {
+                                        errors++;
+                                        ret = err;
+                                }
+                                total++;
+                        }
+                }
         }
 
-        printk(KERN_INFO "Kprobes globally enabled\n");
+        if (errors)
+                pr_warn("Kprobes globally enabled, but failed to arm %d out of %d probes\n",
+                        errors, total);
+        else
+                pr_info("Kprobes globally enabled\n");
 
 already_enabled:
         mutex_unlock(&kprobe_mutex);
-        return;
+        return ret;
 }
 
-static void disarm_all_kprobes(void)
+static int disarm_all_kprobes(void)
 {
         struct hlist_head *head;
         struct kprobe *p;
-        unsigned int i;
+        unsigned int i, total = 0, errors = 0;
+        int err, ret = 0;
 
         mutex_lock(&kprobe_mutex);
 
         /* If kprobes are already disarmed, just return */
         if (kprobes_all_disarmed) {
                 mutex_unlock(&kprobe_mutex);
-                return;
+                return 0;
         }
 
         kprobes_all_disarmed = true;
-        printk(KERN_INFO "Kprobes globally disabled\n");
 
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
+                /* Disarm all kprobes on a best-effort basis */
                 hlist_for_each_entry_rcu(p, head, hlist) {
-                        if (!arch_trampoline_kprobe(p) && !kprobe_disabled(p))
-                                disarm_kprobe(p, false);
+                        if (!arch_trampoline_kprobe(p) && !kprobe_disabled(p)) {
+                                err = disarm_kprobe(p, false);
+                                if (err) {
+                                        errors++;
+                                        ret = err;
+                                }
+                                total++;
+                        }
                 }
         }
+
+        if (errors)
+                pr_warn("Kprobes globally disabled, but failed to disarm %d out of %d probes\n",
+                        errors, total);
+        else
+                pr_info("Kprobes globally disabled\n");
+
         mutex_unlock(&kprobe_mutex);
 
         /* Wait for disarming all kprobes by optimizer */
         wait_for_kprobe_optimizer();
+
+        return ret;
 }
 
 /*
@@ -2494,6 +2568,7 @@ static ssize_t write_enabled_file_bool(struct file *file,
 {
         char buf[32];
         size_t buf_size;
+        int ret = 0;
 
         buf_size = min(count, (sizeof(buf)-1));
         if (copy_from_user(buf, user_buf, buf_size))
@@ -2504,17 +2579,20 @@ static ssize_t write_enabled_file_bool(struct file *file,
         case 'y':
         case 'Y':
         case '1':
-                arm_all_kprobes();
+                ret = arm_all_kprobes();
                 break;
         case 'n':
         case 'N':
         case '0':
-                disarm_all_kprobes();
+                ret = disarm_all_kprobes();
                 break;
         default:
                 return -EINVAL;
         }
 
+        if (ret)
+                return ret;
+
         return count;
 }
 
diff --git a/kernel/relay.c b/kernel/relay.c
index c3029402f15c..c955b10c973c 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -163,7 +163,7 @@ static struct rchan_buf *relay_create_buf(struct rchan *chan)
 {
         struct rchan_buf *buf;
 
-        if (chan->n_subbufs > UINT_MAX / sizeof(size_t *))
+        if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t *))
                 return NULL;
 
         buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
diff --git a/kernel/user.c b/kernel/user.c
index 9a20acce460d..36288d840675 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -101,6 +101,7 @@ struct user_struct root_user = {
         .sigpending     = ATOMIC_INIT(0),
         .locked_shm     = 0,
         .uid            = GLOBAL_ROOT_UID,
+        .ratelimit      = RATELIMIT_STATE_INIT(root_user.ratelimit, 0, 0),
 };
 
 /*
@@ -191,6 +192,8 @@ struct user_struct *alloc_uid(kuid_t uid)
 
                 new->uid = uid;
                 atomic_set(&new->__count, 1);
+                ratelimit_state_init(&new->ratelimit, HZ, 100);
+                ratelimit_set_flags(&new->ratelimit, RATELIMIT_MSG_ON_RELEASE);
 
                 /*
                  * Before adding this, check whether we raced
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 6088408ef26c..64155e310a9f 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1642,6 +1642,7 @@ config DMA_API_DEBUG
 
 menuconfig RUNTIME_TESTING_MENU
         bool "Runtime Testing"
+        def_bool y
 
 if RUNTIME_TESTING_MENU
 
diff --git a/lib/dma-direct.c b/lib/dma-direct.c
index 40b1f92f2214..c9e8e21cb334 100644
--- a/lib/dma-direct.c
+++ b/lib/dma-direct.c
@@ -84,6 +84,10 @@ again:
         return page_address(page);
 }
 
+/*
+ * NOTE: this function must never look at the dma_addr argument, because we want
+ * to be able to use it as a helper for iommu implementations as well.
+ */
 void dma_direct_free(struct device *dev, size_t size, void *cpu_addr,
                 dma_addr_t dma_addr, unsigned long attrs)
 {
@@ -152,5 +156,6 @@ const struct dma_map_ops dma_direct_ops = {
         .map_sg                 = dma_direct_map_sg,
         .dma_supported          = dma_direct_supported,
         .mapping_error          = dma_direct_mapping_error,
+        .is_phys                = 1,
 };
 EXPORT_SYMBOL(dma_direct_ops);
diff --git a/lib/idr.c b/lib/idr.c
index c98d77fcf393..99ec5bc89d25 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -431,7 +431,6 @@ int ida_get_new_above(struct ida *ida, int start, int *id)
                         bitmap = this_cpu_xchg(ida_bitmap, NULL);
                         if (!bitmap)
                                 return -EAGAIN;
-                        memset(bitmap, 0, sizeof(*bitmap));
                         bitmap->bitmap[0] = tmp >> RADIX_TREE_EXCEPTIONAL_SHIFT;
                         rcu_assign_pointer(*slot, bitmap);
                 }
@@ -464,7 +463,6 @@ int ida_get_new_above(struct ida *ida, int start, int *id)
                         bitmap = this_cpu_xchg(ida_bitmap, NULL);
                         if (!bitmap)
                                 return -EAGAIN;
-                        memset(bitmap, 0, sizeof(*bitmap));
                         __set_bit(bit, bitmap->bitmap);
                         radix_tree_iter_replace(root, &iter, slot, bitmap);
                 }
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 0a7ae3288a24..8e00138d593f 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -2125,7 +2125,7 @@ int ida_pre_get(struct ida *ida, gfp_t gfp)
                 preempt_enable();
 
         if (!this_cpu_read(ida_bitmap)) {
-                struct ida_bitmap *bitmap = kmalloc(sizeof(*bitmap), gfp);
+                struct ida_bitmap *bitmap = kzalloc(sizeof(*bitmap), gfp);
                 if (!bitmap)
                         return 0;
                 if (this_cpu_cmpxchg(ida_bitmap, NULL, bitmap))
diff --git a/mm/mlock.c b/mm/mlock.c
index 79398200e423..74e5a6547c3d 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -64,6 +64,12 @@ void clear_page_mlock(struct page *page)
         mod_zone_page_state(page_zone(page), NR_MLOCK,
                             -hpage_nr_pages(page));
         count_vm_event(UNEVICTABLE_PGCLEARED);
+        /*
+         * The previous TestClearPageMlocked() corresponds to the smp_mb()
+         * in __pagevec_lru_add_fn().
+         *
+         * See __pagevec_lru_add_fn for more explanation.
+         */
         if (!isolate_lru_page(page)) {
                 putback_lru_page(page);
         } else {
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 81e18ceef579..cb416723538f 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -46,6 +46,7 @@
 #include <linux/stop_machine.h>
 #include <linux/sort.h>
 #include <linux/pfn.h>
+#include <xen/xen.h>
 #include <linux/backing-dev.h>
 #include <linux/fault-inject.h>
 #include <linux/page-isolation.h>
@@ -347,6 +348,9 @@ static inline bool update_defer_init(pg_data_t *pgdat,
         /* Always populate low zones for address-constrained allocations */
         if (zone_end < pgdat_end_pfn(pgdat))
                 return true;
+        /* Xen PV domains need page structures early */
+        if (xen_pv_domain())
+                return true;
         (*nr_initialised)++;
         if ((*nr_initialised > pgdat->static_init_pgcnt) &&
             (pfn & (PAGES_PER_SECTION - 1)) == 0) {
diff --git a/mm/swap.c b/mm/swap.c
index 567a7b96e41d..0f17330dd0e5 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -446,30 +446,6 @@ void lru_cache_add(struct page *page)
 }
 
 /**
- * add_page_to_unevictable_list - add a page to the unevictable list
- * @page:  the page to be added to the unevictable list
- *
- * Add page directly to its zone's unevictable list.  To avoid races with
- * tasks that might be making the page evictable, through eg. munlock,
- * munmap or exit, while it's not on the lru, we want to add the page
- * while it's locked or otherwise "invisible" to other tasks.  This is
- * difficult to do when using the pagevec cache, so bypass that.
- */
-void add_page_to_unevictable_list(struct page *page)
-{
-        struct pglist_data *pgdat = page_pgdat(page);
-        struct lruvec *lruvec;
-
-        spin_lock_irq(&pgdat->lru_lock);
-        lruvec = mem_cgroup_page_lruvec(page, pgdat);
-        ClearPageActive(page);
-        SetPageUnevictable(page);
-        SetPageLRU(page);
-        add_page_to_lru_list(page, lruvec, LRU_UNEVICTABLE);
-        spin_unlock_irq(&pgdat->lru_lock);
-}
-
-/**
  * lru_cache_add_active_or_unevictable
  * @page:  the page to be added to LRU
  * @vma:   vma in which page is mapped for determining reclaimability
@@ -484,13 +460,9 @@ void lru_cache_add_active_or_unevictable(struct page *page,
 {
         VM_BUG_ON_PAGE(PageLRU(page), page);
 
-        if (likely((vma->vm_flags & (VM_LOCKED | VM_SPECIAL)) != VM_LOCKED)) {
+        if (likely((vma->vm_flags & (VM_LOCKED | VM_SPECIAL)) != VM_LOCKED))
                 SetPageActive(page);
-                lru_cache_add(page);
-                return;
-        }
-
-        if (!TestSetPageMlocked(page)) {
+        else if (!TestSetPageMlocked(page)) {
                 /*
                  * We use the irq-unsafe __mod_zone_page_stat because this
                  * counter is not modified from interrupt context, and the pte
@@ -500,7 +472,7 @@ void lru_cache_add_active_or_unevictable(struct page *page,
                                     hpage_nr_pages(page));
                 count_vm_event(UNEVICTABLE_PGMLOCKED);
         }
-        add_page_to_unevictable_list(page);
+        lru_cache_add(page);
 }
 
 /*
@@ -886,15 +858,55 @@ void lru_add_page_tail(struct page *page, struct page *page_tail,
 static void __pagevec_lru_add_fn(struct page *page, struct lruvec *lruvec,
                                  void *arg)
 {
-        int file = page_is_file_cache(page);
-        int active = PageActive(page);
-        enum lru_list lru = page_lru(page);
+        enum lru_list lru;
+        int was_unevictable = TestClearPageUnevictable(page);
 
         VM_BUG_ON_PAGE(PageLRU(page), page);
 
         SetPageLRU(page);
+        /*
+         * Page becomes evictable in two ways:
+         * 1) Within LRU lock [munlock_vma_pages() and __munlock_pagevec()].
+         * 2) Before acquiring LRU lock to put the page to correct LRU and then
+         *   a) do PageLRU check with lock [check_move_unevictable_pages]
+         *   b) do PageLRU check before lock [clear_page_mlock]
+         *
+         * (1) & (2a) are ok as LRU lock will serialize them. For (2b), we need
+         * following strict ordering:
+         *
+         * #0: __pagevec_lru_add_fn             #1: clear_page_mlock
+         *
+         * SetPageLRU()                         TestClearPageMlocked()
+         * smp_mb() // explicit ordering        // above provides strict
+         *                                      // ordering
+         * PageMlocked()                        PageLRU()
+         *
+         *
+         * if '#1' does not observe setting of PG_lru by '#0' and fails
+         * isolation, the explicit barrier will make sure that page_evictable
+         * check will put the page in correct LRU. Without smp_mb(), SetPageLRU
+         * can be reordered after PageMlocked check and can make '#1' to fail
+         * the isolation of the page whose Mlocked bit is cleared (#0 is also
+         * looking at the same page) and the evictable page will be stranded
+         * in an unevictable LRU.
+         */
+        smp_mb();
+
+        if (page_evictable(page)) {
+                lru = page_lru(page);
+                update_page_reclaim_stat(lruvec, page_is_file_cache(page),
+                                         PageActive(page));
+                if (was_unevictable)
+                        count_vm_event(UNEVICTABLE_PGRESCUED);
+        } else {
+                lru = LRU_UNEVICTABLE;
+                ClearPageActive(page);
+                SetPageUnevictable(page);
+                if (!was_unevictable)
+                        count_vm_event(UNEVICTABLE_PGCULLED);
+        }
+
         add_page_to_lru_list(page, lruvec, lru);
-        update_page_reclaim_stat(lruvec, file, active);
         trace_mm_lru_insertion(page, lru);
 }
 
@@ -913,7 +925,7 @@ EXPORT_SYMBOL(__pagevec_lru_add);
  * @pvec:       Where the resulting entries are placed
  * @mapping:    The address_space to search
  * @start:      The starting entry index
- * @nr_pages:   The maximum number of pages
+ * @nr_entries: The maximum number of pages
  * @indices:    The cache indices corresponding to the entries in @pvec
  *
  * pagevec_lookup_entries() will search for and return a group of up
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 673942094328..ebff729cc956 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1943,11 +1943,15 @@ void *vmalloc_exec(unsigned long size)
 }
 
 #if defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA32)
-#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL
+#define GFP_VMALLOC32 (GFP_DMA32 | GFP_KERNEL)
 #elif defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA)
-#define GFP_VMALLOC32 GFP_DMA | GFP_KERNEL
+#define GFP_VMALLOC32 (GFP_DMA | GFP_KERNEL)
 #else
-#define GFP_VMALLOC32 GFP_KERNEL
+/*
+ * 64b systems should always have either DMA or DMA32 zones. For others
+ * GFP_DMA32 should do the right thing and use the normal zone.
+ */
+#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL
 #endif
 
 /**
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 444749669187..bee53495a829 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -769,64 +769,7 @@ int remove_mapping(struct address_space *mapping, struct page *page)
  */
 void putback_lru_page(struct page *page)
 {
-        bool is_unevictable;
-        int was_unevictable = PageUnevictable(page);
-
-        VM_BUG_ON_PAGE(PageLRU(page), page);
-
-redo:
-        ClearPageUnevictable(page);
-
-        if (page_evictable(page)) {
-                /*
-                 * For evictable pages, we can use the cache.
-                 * In event of a race, worst case is we end up with an
-                 * unevictable page on [in]active list.
-                 * We know how to handle that.
-                 */
-                is_unevictable = false;
-                lru_cache_add(page);
-        } else {
-                /*
-                 * Put unevictable pages directly on zone's unevictable
-                 * list.
-                 */
-                is_unevictable = true;
-                add_page_to_unevictable_list(page);
-                /*
-                 * When racing with an mlock or AS_UNEVICTABLE clearing
-                 * (page is unlocked) make sure that if the other thread
-                 * does not observe our setting of PG_lru and fails
-                 * isolation/check_move_unevictable_pages,
-                 * we see PG_mlocked/AS_UNEVICTABLE cleared below and move
-                 * the page back to the evictable list.
-                 *
-                 * The other side is TestClearPageMlocked() or shmem_lock().
-                 */
-                smp_mb();
-        }
-
-        /*
-         * page's status can change while we move it among lru. If an evictable
-         * page is on unevictable list, it never be freed. To avoid that,
-         * check after we added it to the list, again.
-         */
-        if (is_unevictable && page_evictable(page)) {
-                if (!isolate_lru_page(page)) {
-                        put_page(page);
-                        goto redo;
-                }
-                /* This means someone else dropped this page from LRU
-                 * So, it will be freed or putback to LRU again. There is
-                 * nothing to do here.
-                 */
-        }
-
-        if (was_unevictable && !is_unevictable)
-                count_vm_event(UNEVICTABLE_PGRESCUED);
-        else if (!was_unevictable && is_unevictable)
-                count_vm_event(UNEVICTABLE_PGCULLED);
-
+        lru_cache_add(page);
         put_page(page);         /* drop ref from isolate */
 }
 
diff --git a/mm/zpool.c b/mm/zpool.c
index f8cb83e7699b..01a771e304fa 100644
--- a/mm/zpool.c
+++ b/mm/zpool.c
@@ -360,7 +360,7 @@ u64 zpool_get_total_size(struct zpool *zpool)
 
 /**
  * zpool_evictable() - Test if zpool is potentially evictable
- * @pool        The zpool to test
+ * @zpool:      The zpool to test
  *
  * Zpool is only potentially evictable when it's created with struct
  * zpool_ops.evict and its driver implements struct zpool_driver.shrink.
diff --git a/mm/zswap.c b/mm/zswap.c
index c004aa4fd3f4..61a5c41972db 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -1007,6 +1007,12 @@ static int zswap_frontswap_store(unsigned type, pgoff_t offset,
         u8 *src, *dst;
         struct zswap_header zhdr = { .swpentry = swp_entry(type, offset) };
 
+        /* THP isn't supported */
+        if (PageTransHuge(page)) {
+                ret = -EINVAL;
+                goto reject;
+        }
+
         if (!zswap_enabled || !tree) {
                 ret = -ENODEV;
                 goto reject;
diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
index 0254c35b2bf0..126a8ea73c96 100644
--- a/net/bridge/br_sysfs_if.c
+++ b/net/bridge/br_sysfs_if.c
@@ -255,6 +255,9 @@ static ssize_t brport_show(struct kobject *kobj,
         struct brport_attribute *brport_attr = to_brport_attr(attr);
         struct net_bridge_port *p = to_brport(kobj);
 
+        if (!brport_attr->show)
+                return -EINVAL;
+
         return brport_attr->show(p, buf);
 }
 
diff --git a/net/core/dev.c b/net/core/dev.c
index dda9d7b9a840..d4362befe7e2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2382,8 +2382,11 @@ EXPORT_SYMBOL(netdev_set_num_tc);
  */
 int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
 {
+        bool disabling;
         int rc;
 
+        disabling = txq < dev->real_num_tx_queues;
+
         if (txq < 1 || txq > dev->num_tx_queues)
                 return -EINVAL;
 
@@ -2399,15 +2402,19 @@ int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
                 if (dev->num_tc)
                         netif_setup_tc(dev, txq);
 
-                if (txq < dev->real_num_tx_queues) {
+                dev->real_num_tx_queues = txq;
+
+                if (disabling) {
+                        synchronize_net();
                         qdisc_reset_all_tx_gt(dev, txq);
 #ifdef CONFIG_XPS
                         netif_reset_xps_queues_gt(dev, txq);
 #endif
                 }
+        } else {
+                dev->real_num_tx_queues = txq;
         }
 
-        dev->real_num_tx_queues = txq;
         return 0;
 }
 EXPORT_SYMBOL(netif_set_real_num_tx_queues);
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 91dd09f79808..791aff68af88 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1338,6 +1338,12 @@ static int dn_setsockopt(struct socket *sock, int level, int optname, char __use
         lock_sock(sk);
         err = __dn_setsockopt(sock, level, optname, optval, optlen, 0);
         release_sock(sk);
+#ifdef CONFIG_NETFILTER
+        /* we need to exclude all possible ENOPROTOOPTs except default case */
+        if (err == -ENOPROTOOPT && optname != DSO_LINKINFO &&
+            optname != DSO_STREAM && optname != DSO_SEQPACKET)
+                err = nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
+#endif
 
         return err;
 }
@@ -1445,15 +1451,6 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us
                 dn_nsp_send_disc(sk, 0x38, 0, sk->sk_allocation);
                 break;
 
-        default:
-#ifdef CONFIG_NETFILTER
-                return nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
-#endif
-        case DSO_LINKINFO:
-        case DSO_STREAM:
-        case DSO_SEQPACKET:
-                return -ENOPROTOOPT;
-
         case DSO_MAXWINDOW:
                 if (optlen != sizeof(unsigned long))
                         return -EINVAL;
@@ -1501,6 +1498,12 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us
                         return -EINVAL;
                 scp->info_loc = u.info;
                 break;
+
+        case DSO_LINKINFO:
+        case DSO_STREAM:
+        case DSO_SEQPACKET:
+        default:
+                return -ENOPROTOOPT;
         }
 
         return 0;
@@ -1514,6 +1517,20 @@ static int dn_getsockopt(struct socket *sock, int level, int optname, char __use
         lock_sock(sk);
         err = __dn_getsockopt(sock, level, optname, optval, optlen, 0);
         release_sock(sk);
+#ifdef CONFIG_NETFILTER
+        if (err == -ENOPROTOOPT && optname != DSO_STREAM &&
+            optname != DSO_SEQPACKET && optname != DSO_CONACCEPT &&
+            optname != DSO_CONREJECT) {
+                int len;
+
+                if (get_user(len, optlen))
+                        return -EFAULT;
+
+                err = nf_getsockopt(sk, PF_DECnet, optname, optval, &len);
+                if (err >= 0)
+                        err = put_user(len, optlen);
+        }
+#endif
 
         return err;
 }
@@ -1579,26 +1596,6 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
                 r_data = &link;
                 break;
 
-        default:
-#ifdef CONFIG_NETFILTER
-        {
-                int ret, len;
-
-                if (get_user(len, optlen))
-                        return -EFAULT;
-
-                ret = nf_getsockopt(sk, PF_DECnet, optname, optval, &len);
-                if (ret >= 0)
-                        ret = put_user(len, optlen);
-                return ret;
-        }
-#endif
-        case DSO_STREAM:
-        case DSO_SEQPACKET:
-        case DSO_CONACCEPT:
-        case DSO_CONREJECT:
-                return -ENOPROTOOPT;
-
         case DSO_MAXWINDOW:
                 if (r_len > sizeof(unsigned long))
                         r_len = sizeof(unsigned long);
@@ -1630,6 +1627,13 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
                         r_len = sizeof(unsigned char);
                 r_data = &scp->info_rem;
                 break;
+
+        case DSO_STREAM:
+        case DSO_SEQPACKET:
+        case DSO_CONACCEPT:
+        case DSO_CONREJECT:
+        default:
+                return -ENOPROTOOPT;
         }
 
         if (r_data) {
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index c586597da20d..7d36a950d961 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -646,6 +646,11 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi,
                                             fi->fib_nh, cfg, extack))
                                 return 1;
                 }
+#ifdef CONFIG_IP_ROUTE_CLASSID
+                if (cfg->fc_flow &&
+                    cfg->fc_flow != fi->fib_nh->nh_tclassid)
+                        return 1;
+#endif
                 if ((!cfg->fc_oif || cfg->fc_oif == fi->fib_nh->nh_oif) &&
                     (!cfg->fc_gw  || cfg->fc_gw == fi->fib_nh->nh_gw))
                         return 0;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index e9f985e42405..b2bca373f8be 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2027,6 +2027,24 @@ static inline void tcp_mtu_check_reprobe(struct sock *sk)
         }
 }
 
+static bool tcp_can_coalesce_send_queue_head(struct sock *sk, int len)
+{
+        struct sk_buff *skb, *next;
+
+        skb = tcp_send_head(sk);
+        tcp_for_write_queue_from_safe(skb, next, sk) {
+                if (len <= skb->len)
+                        break;
+
+                if (unlikely(TCP_SKB_CB(skb)->eor))
+                        return false;
+
+                len -= skb->len;
+        }
+
+        return true;
+}
+
 /* Create a new MTU probe if we are ready.
  * MTU probe is regularly attempting to increase the path MTU by
  * deliberately sending larger packets.  This discovers routing
@@ -2099,6 +2117,9 @@ static int tcp_mtu_probe(struct sock *sk)
                         return 0;
         }
 
+        if (!tcp_can_coalesce_send_queue_head(sk, probe_size))
+                return -1;
+
         /* We're allowed to probe.  Build it now. */
         nskb = sk_stream_alloc_skb(sk, probe_size, GFP_ATOMIC, false);
         if (!nskb)
@@ -2134,6 +2155,10 @@ static int tcp_mtu_probe(struct sock *sk)
                         /* We've eaten all the data from this skb.
                          * Throw it away. */
                         TCP_SKB_CB(nskb)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags;
+                        /* If this is the last SKB we copy and eor is set
+                         * we need to propagate it to the new skb.
+                         */
+                        TCP_SKB_CB(nskb)->eor = TCP_SKB_CB(skb)->eor;
                         tcp_unlink_write_queue(skb, sk);
                         sk_wmem_free_skb(sk, skb);
                 } else {
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index bfaefe560b5c..e5ef7c38c934 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2024,6 +2024,11 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
                 err = udplite_checksum_init(skb, uh);
                 if (err)
                         return err;
+
+                if (UDP_SKB_CB(skb)->partial_cov) {
+                        skb->csum = inet_compute_pseudo(skb, proto);
+                        return 0;
+                }
         }
 
         /* Note, we are only interested in != 0 or == 0, thus the
diff --git a/net/ipv6/ip6_checksum.c b/net/ipv6/ip6_checksum.c
index ec43d18b5ff9..547515e8450a 100644
--- a/net/ipv6/ip6_checksum.c
+++ b/net/ipv6/ip6_checksum.c
@@ -73,6 +73,11 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto)
                 err = udplite_checksum_init(skb, uh);
                 if (err)
                         return err;
+
+                if (UDP_SKB_CB(skb)->partial_cov) {
+                        skb->csum = ip6_compute_pseudo(skb, proto);
+                        return 0;
+                }
         }
 
         /* To support RFC 6936 (allow zero checksum in UDP/IPV6 for tunnels)
diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
index 367d8c027101..2ceefa183cee 100644
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -149,6 +149,10 @@ struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri,
 
         pr_debug("uri: %s, len: %zu\n", uri, uri_len);
 
+        /* sdreq->tlv_len is u8, takes uri_len, + 3 for header, + 1 for NULL */
+        if (WARN_ON_ONCE(uri_len > U8_MAX - 4))
+                return NULL;
+
         sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
         if (sdreq == NULL)
                 return NULL;
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index c0b83dc9d993..f018eafc2a0d 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -61,7 +61,8 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
 };
 
 static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = {
-        [NFC_SDP_ATTR_URI] = { .type = NLA_STRING },
+        [NFC_SDP_ATTR_URI] = { .type = NLA_STRING,
+                               .len = U8_MAX - 4 },
         [NFC_SDP_ATTR_SAP] = { .type = NLA_U8 },
 };
 
diff --git a/net/rds/connection.c b/net/rds/connection.c
index 94e190febfdd..2da3176bf792 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -224,7 +224,7 @@ static struct rds_connection *__rds_conn_create(struct net *net,
         if (rds_destroy_pending(conn))
                 ret = -ENETDOWN;
         else
-                ret = trans->conn_alloc(conn, gfp);
+                ret = trans->conn_alloc(conn, GFP_ATOMIC);
         if (ret) {
                 rcu_read_unlock();
                 kfree(conn->c_path);
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index cc21e8db25b0..9d45d8b56744 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -517,9 +517,10 @@ try_again:
                         ret = put_cmsg(msg, SOL_RXRPC, RXRPC_USER_CALL_ID,
                                        sizeof(unsigned int), &id32);
                 } else {
+                        unsigned long idl = call->user_call_ID;
+
                         ret = put_cmsg(msg, SOL_RXRPC, RXRPC_USER_CALL_ID,
-                                       sizeof(unsigned long),
-                                       &call->user_call_ID);
+                                       sizeof(unsigned long), &idl);
                 }
                 if (ret < 0)
                         goto error_unlock_call;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 2bc1bc23d42e..a7dc7271042a 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -376,17 +376,12 @@ struct tcf_net {
 static unsigned int tcf_net_id;
 
 static int tcf_block_insert(struct tcf_block *block, struct net *net,
-                            u32 block_index, struct netlink_ext_ack *extack)
+                            struct netlink_ext_ack *extack)
 {
         struct tcf_net *tn = net_generic(net, tcf_net_id);
-        int err;
 
-        err = idr_alloc_u32(&tn->idr, block, &block_index, block_index,
-                            GFP_KERNEL);
-        if (err)
-                return err;
-        block->index = block_index;
-        return 0;
+        return idr_alloc_u32(&tn->idr, block, &block->index, block->index,
+                             GFP_KERNEL);
 }
 
 static void tcf_block_remove(struct tcf_block *block, struct net *net)
@@ -397,6 +392,7 @@ static void tcf_block_remove(struct tcf_block *block, struct net *net)
 }
 
 static struct tcf_block *tcf_block_create(struct net *net, struct Qdisc *q,
+                                          u32 block_index,
                                           struct netlink_ext_ack *extack)
 {
         struct tcf_block *block;
@@ -419,10 +415,13 @@ static struct tcf_block *tcf_block_create(struct net *net, struct Qdisc *q,
                 err = -ENOMEM;
                 goto err_chain_create;
         }
-        block->net = qdisc_net(q);
         block->refcnt = 1;
         block->net = net;
-        block->q = q;
+        block->index = block_index;
+
+        /* Don't store q pointer for blocks which are shared */
+        if (!tcf_block_shared(block))
+                block->q = q;
         return block;
 
 err_chain_create:
@@ -518,13 +517,12 @@ int tcf_block_get_ext(struct tcf_block **p_block, struct Qdisc *q,
         }
 
         if (!block) {
-                block = tcf_block_create(net, q, extack);
+                block = tcf_block_create(net, q, ei->block_index, extack);
                 if (IS_ERR(block))
                         return PTR_ERR(block);
                 created = true;
-                if (ei->block_index) {
-                        err = tcf_block_insert(block, net,
-                                               ei->block_index, extack);
+                if (tcf_block_shared(block)) {
+                        err = tcf_block_insert(block, net, extack);
                         if (err)
                                 goto err_block_insert;
                 }
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 6c7601a530e3..ed8b6a24b9e9 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -96,7 +96,7 @@ struct tc_u_hnode {
 
 struct tc_u_common {
         struct tc_u_hnode __rcu *hlist;
-        struct tcf_block        *block;
+        void                    *ptr;
         int                     refcnt;
         struct idr              handle_idr;
         struct hlist_node       hnode;
@@ -330,9 +330,25 @@ static struct hlist_head *tc_u_common_hash;
 #define U32_HASH_SHIFT 10
 #define U32_HASH_SIZE (1 << U32_HASH_SHIFT)
 
+static void *tc_u_common_ptr(const struct tcf_proto *tp)
+{
+        struct tcf_block *block = tp->chain->block;
+
+        /* The block sharing is currently supported only
+         * for classless qdiscs. In that case we use block
+         * for tc_u_common identification. In case the
+         * block is not shared, block->q is a valid pointer
+         * and we can use that. That works for classful qdiscs.
+         */
+        if (tcf_block_shared(block))
+                return block;
+        else
+                return block->q;
+}
+
 static unsigned int tc_u_hash(const struct tcf_proto *tp)
 {
-        return hash_ptr(tp->chain->block, U32_HASH_SHIFT);
+        return hash_ptr(tc_u_common_ptr(tp), U32_HASH_SHIFT);
 }
 
 static struct tc_u_common *tc_u_common_find(const struct tcf_proto *tp)
@@ -342,7 +358,7 @@ static struct tc_u_common *tc_u_common_find(const struct tcf_proto *tp)
 
         h = tc_u_hash(tp);
         hlist_for_each_entry(tc, &tc_u_common_hash[h], hnode) {
-                if (tc->block == tp->chain->block)
+                if (tc->ptr == tc_u_common_ptr(tp))
                         return tc;
         }
         return NULL;
@@ -371,7 +387,7 @@ static int u32_init(struct tcf_proto *tp)
                         kfree(root_ht);
                         return -ENOBUFS;
                 }
-                tp_c->block = tp->chain->block;
+                tp_c->ptr = tc_u_common_ptr(tp);
                 INIT_HLIST_NODE(&tp_c->hnode);
                 idr_init(&tp_c->handle_idr);
 
diff --git a/net/sctp/debug.c b/net/sctp/debug.c
index 291c97b07058..8f6c2e8c0953 100644
--- a/net/sctp/debug.c
+++ b/net/sctp/debug.c
@@ -81,6 +81,12 @@ const char *sctp_cname(const union sctp_subtype cid)
         case SCTP_CID_RECONF:
                 return "RECONF";
 
+        case SCTP_CID_I_DATA:
+                return "I_DATA";
+
+        case SCTP_CID_I_FWD_TSN:
+                return "I_FWD_TSN";
+
         default:
                 break;
         }
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 141c9c466ec1..0247cc432e02 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -897,15 +897,12 @@ int sctp_hash_transport(struct sctp_transport *t)
         rhl_for_each_entry_rcu(transport, tmp, list, node)
                 if (transport->asoc->ep == t->asoc->ep) {
                         rcu_read_unlock();
-                        err = -EEXIST;
-                        goto out;
+                        return -EEXIST;
                 }
         rcu_read_unlock();
 
         err = rhltable_insert_key(&sctp_transport_hashtable, &arg,
                                   &t->node, sctp_hash_params);
-
-out:
         if (err)
                 pr_err_once("insert transport fail, errno %d\n", err);
 
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index cedf672487f9..f799043abec9 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -6,7 +6,7 @@
  *
  * This file is part of the SCTP kernel implementation
  *
- * These functions manipulate sctp tsn mapping array.
+ * This file contains sctp stream maniuplation primitives and helpers.
  *
  * This SCTP implementation is free software;
  * you can redistribute it and/or modify it under the terms of
diff --git a/net/sctp/stream_interleave.c b/net/sctp/stream_interleave.c
index 8c7cf8f08711..d3764c181299 100644
--- a/net/sctp/stream_interleave.c
+++ b/net/sctp/stream_interleave.c
@@ -3,7 +3,8 @@
  *
  * This file is part of the SCTP kernel implementation
  *
- * These functions manipulate sctp stream queue/scheduling.
+ * These functions implement sctp stream message interleaving, mostly
+ * including I-DATA and I-FORWARD-TSN chunks process.
  *
  * This SCTP implementation is free software;
  * you can redistribute it and/or modify it under the terms of
@@ -954,12 +955,8 @@ static void sctp_renege_events(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
         __u32 freed = 0;
         __u16 needed;
 
-        if (chunk) {
-                needed = ntohs(chunk->chunk_hdr->length);
-                needed -= sizeof(struct sctp_idata_chunk);
-        } else {
-                needed = SCTP_DEFAULT_MAXWINDOW;
-        }
+        needed = ntohs(chunk->chunk_hdr->length) -
+                 sizeof(struct sctp_idata_chunk);
 
         if (skb_queue_empty(&asoc->base.sk->sk_receive_queue)) {
                 freed = sctp_ulpq_renege_list(ulpq, &ulpq->lobby, needed);
@@ -971,9 +968,8 @@ static void sctp_renege_events(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
                                                        needed);
         }
 
-        if (chunk && freed >= needed)
-                if (sctp_ulpevent_idata(ulpq, chunk, gfp) <= 0)
-                        sctp_intl_start_pd(ulpq, gfp);
+        if (freed >= needed && sctp_ulpevent_idata(ulpq, chunk, gfp) <= 0)
+                sctp_intl_start_pd(ulpq, gfp);
 
         sk_mem_reclaim(asoc->base.sk);
 }
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index c8001471da6c..3e3dce3d4c63 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -813,7 +813,7 @@ err_out:
         return err;
 }
 
-int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         char *name;
@@ -835,20 +835,27 @@ int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
 
         name = nla_data(attrs[TIPC_NLA_BEARER_NAME]);
 
-        rtnl_lock();
         bearer = tipc_bearer_find(net, name);
-        if (!bearer) {
-                rtnl_unlock();
+        if (!bearer)
                 return -EINVAL;
-        }
 
         bearer_disable(net, bearer);
-        rtnl_unlock();
 
         return 0;
 }
 
-int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
+int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_bearer_disable(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
+
+int __tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         char *bearer;
@@ -890,15 +897,18 @@ int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
                         prio = nla_get_u32(props[TIPC_NLA_PROP_PRIO]);
         }
 
+        return tipc_enable_bearer(net, bearer, domain, prio, attrs);
+}
+
+int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
         rtnl_lock();
-        err = tipc_enable_bearer(net, bearer, domain, prio, attrs);
-        if (err) {
-                rtnl_unlock();
-                return err;
-        }
+        err = __tipc_nl_bearer_enable(skb, info);
         rtnl_unlock();
 
-        return 0;
+        return err;
 }
 
 int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info)
@@ -944,7 +954,7 @@ int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info)
         return 0;
 }
 
-int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         char *name;
@@ -965,22 +975,17 @@ int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
         name = nla_data(attrs[TIPC_NLA_BEARER_NAME]);
 
-        rtnl_lock();
         b = tipc_bearer_find(net, name);
-        if (!b) {
-                rtnl_unlock();
+        if (!b)
                 return -EINVAL;
-        }
 
         if (attrs[TIPC_NLA_BEARER_PROP]) {
                 struct nlattr *props[TIPC_NLA_PROP_MAX + 1];
 
                 err = tipc_nl_parse_link_prop(attrs[TIPC_NLA_BEARER_PROP],
                                               props);
-                if (err) {
-                        rtnl_unlock();
+                if (err)
                         return err;
-                }
 
                 if (props[TIPC_NLA_PROP_TOL])
                         b->tolerance = nla_get_u32(props[TIPC_NLA_PROP_TOL]);
@@ -989,11 +994,21 @@ int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
                 if (props[TIPC_NLA_PROP_WIN])
                         b->window = nla_get_u32(props[TIPC_NLA_PROP_WIN]);
         }
-        rtnl_unlock();
 
         return 0;
 }
 
+int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_bearer_set(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
+
 static int __tipc_nl_add_media(struct tipc_nl_msg *msg,
                                struct tipc_media *media, int nlflags)
 {
@@ -1115,7 +1130,7 @@ err_out:
         return err;
 }
 
-int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         char *name;
@@ -1133,22 +1148,17 @@ int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
         name = nla_data(attrs[TIPC_NLA_MEDIA_NAME]);
 
-        rtnl_lock();
         m = tipc_media_find(name);
-        if (!m) {
-                rtnl_unlock();
+        if (!m)
                 return -EINVAL;
-        }
 
         if (attrs[TIPC_NLA_MEDIA_PROP]) {
                 struct nlattr *props[TIPC_NLA_PROP_MAX + 1];
 
                 err = tipc_nl_parse_link_prop(attrs[TIPC_NLA_MEDIA_PROP],
                                               props);
-                if (err) {
-                        rtnl_unlock();
+                if (err)
                         return err;
-                }
 
                 if (props[TIPC_NLA_PROP_TOL])
                         m->tolerance = nla_get_u32(props[TIPC_NLA_PROP_TOL]);
@@ -1157,7 +1167,17 @@ int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
                 if (props[TIPC_NLA_PROP_WIN])
                         m->window = nla_get_u32(props[TIPC_NLA_PROP_WIN]);
         }
-        rtnl_unlock();
 
         return 0;
 }
+
+int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_media_set(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index 42d6eeeb646d..a53613d95bc9 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -188,15 +188,19 @@ extern struct tipc_media udp_media_info;
 #endif
 
 int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_bearer_get(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info);
 
 int tipc_nl_media_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_media_get(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info);
 
 int tipc_media_set_priority(const char *name, u32 new_value);
 int tipc_media_set_window(const char *name, u32 new_value);
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 719c5924b638..1a2fde0d6f61 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -200,7 +200,7 @@ out:
         return skb->len;
 }
 
-int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
 {
         struct net *net = sock_net(skb->sk);
         struct tipc_net *tn = net_generic(net, tipc_net_id);
@@ -241,10 +241,19 @@ int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
                 if (!tipc_addr_node_valid(addr))
                         return -EINVAL;
 
-                rtnl_lock();
                 tipc_net_start(net, addr);
-                rtnl_unlock();
         }
 
         return 0;
 }
+
+int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_net_set(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
diff --git a/net/tipc/net.h b/net/tipc/net.h
index c7c254902873..c0306aa2374b 100644
--- a/net/tipc/net.h
+++ b/net/tipc/net.h
@@ -47,5 +47,6 @@ void tipc_net_stop(struct net *net);
 
 int tipc_nl_net_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info);
 
 #endif
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index e48f0b2c01b9..4492cda45566 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -285,10 +285,6 @@ static int __tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
         if (!trans_buf)
                 return -ENOMEM;
 
-        err = (*cmd->transcode)(cmd, trans_buf, msg);
-        if (err)
-                goto trans_out;
-
         attrbuf = kmalloc((tipc_genl_family.maxattr + 1) *
                         sizeof(struct nlattr *), GFP_KERNEL);
         if (!attrbuf) {
@@ -296,27 +292,34 @@ static int __tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
                 goto trans_out;
         }
 
-        err = nla_parse(attrbuf, tipc_genl_family.maxattr,
-                        (const struct nlattr *)trans_buf->data,
-                        trans_buf->len, NULL, NULL);
-        if (err)
-                goto parse_out;
-
         doit_buf = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
         if (!doit_buf) {
                 err = -ENOMEM;
-                goto parse_out;
+                goto attrbuf_out;
         }
 
-        doit_buf->sk = msg->dst_sk;
-
         memset(&info, 0, sizeof(info));
         info.attrs = attrbuf;
 
+        rtnl_lock();
+        err = (*cmd->transcode)(cmd, trans_buf, msg);
+        if (err)
+                goto doit_out;
+
+        err = nla_parse(attrbuf, tipc_genl_family.maxattr,
+                        (const struct nlattr *)trans_buf->data,
+                        trans_buf->len, NULL, NULL);
+        if (err)
+                goto doit_out;
+
+        doit_buf->sk = msg->dst_sk;
+
         err = (*cmd->doit)(doit_buf, &info);
+doit_out:
+        rtnl_unlock();
 
         kfree_skb(doit_buf);
-parse_out:
+attrbuf_out:
         kfree(attrbuf);
 trans_out:
         kfree_skb(trans_buf);
@@ -722,13 +725,13 @@ static int tipc_nl_compat_link_set(struct tipc_nl_compat_cmd_doit *cmd,
 
         media = tipc_media_find(lc->name);
         if (media) {
-                cmd->doit = &tipc_nl_media_set;
+                cmd->doit = &__tipc_nl_media_set;
                 return tipc_nl_compat_media_set(skb, msg);
         }
 
         bearer = tipc_bearer_find(msg->net, lc->name);
         if (bearer) {
-                cmd->doit = &tipc_nl_bearer_set;
+                cmd->doit = &__tipc_nl_bearer_set;
                 return tipc_nl_compat_bearer_set(skb, msg);
         }
 
@@ -1089,12 +1092,12 @@ static int tipc_nl_compat_handle(struct tipc_nl_compat_msg *msg)
                 return tipc_nl_compat_dumpit(&dump, msg);
         case TIPC_CMD_ENABLE_BEARER:
                 msg->req_type = TIPC_TLV_BEARER_CONFIG;
-                doit.doit = tipc_nl_bearer_enable;
+                doit.doit = __tipc_nl_bearer_enable;
                 doit.transcode = tipc_nl_compat_bearer_enable;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_DISABLE_BEARER:
                 msg->req_type = TIPC_TLV_BEARER_NAME;
-                doit.doit = tipc_nl_bearer_disable;
+                doit.doit = __tipc_nl_bearer_disable;
                 doit.transcode = tipc_nl_compat_bearer_disable;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_SHOW_LINK_STATS:
@@ -1148,12 +1151,12 @@ static int tipc_nl_compat_handle(struct tipc_nl_compat_msg *msg)
                 return tipc_nl_compat_dumpit(&dump, msg);
         case TIPC_CMD_SET_NODE_ADDR:
                 msg->req_type = TIPC_TLV_NET_ADDR;
-                doit.doit = tipc_nl_net_set;
+                doit.doit = __tipc_nl_net_set;
                 doit.transcode = tipc_nl_compat_net_set;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_SET_NETID:
                 msg->req_type = TIPC_TLV_UNSIGNED;
-                doit.doit = tipc_nl_net_set;
+                doit.doit = __tipc_nl_net_set;
                 doit.transcode = tipc_nl_compat_net_set;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_GET_NETID:
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index b0d5fcea47e7..e9b4b53ab53e 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -308,8 +308,11 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
                         goto out;
                 }
                 lock_sock(sk);
-                memcpy(crypto_info_aes_gcm_128->iv, ctx->iv,
+                memcpy(crypto_info_aes_gcm_128->iv,
+                       ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
                        TLS_CIPHER_AES_GCM_128_IV_SIZE);
+                memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->rec_seq,
+                       TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
                 release_sock(sk);
                 if (copy_to_user(optval,
                                  crypto_info_aes_gcm_128,
@@ -375,7 +378,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
         rc = copy_from_user(crypto_info, optval, sizeof(*crypto_info));
         if (rc) {
                 rc = -EFAULT;
-                goto out;
+                goto err_crypto_info;
         }
 
         /* check version */
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index d545e1d0dea2..2d465bdeccbc 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1825,7 +1825,7 @@ out:
 }
 
 /* We use paged skbs for stream sockets, and limit occupancy to 32768
- * bytes, and a minimun of a full page.
+ * bytes, and a minimum of a full page.
  */
 #define UNIX_SKB_FRAGS_SZ (PAGE_SIZE << get_order(32768))
 
diff --git a/tools/arch/powerpc/include/uapi/asm/kvm.h b/tools/arch/powerpc/include/uapi/asm/kvm.h
index 637b7263cb86..833ed9a16adf 100644
--- a/tools/arch/powerpc/include/uapi/asm/kvm.h
+++ b/tools/arch/powerpc/include/uapi/asm/kvm.h
@@ -632,6 +632,8 @@ struct kvm_ppc_cpu_char {
 #define KVM_REG_PPC_TIDR        (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbc)
 #define KVM_REG_PPC_PSSCR       (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbd)
 
+#define KVM_REG_PPC_DEC_EXPIRY  (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbe)
+
 /* Transactional Memory checkpointed state:
  * This is all GPRs, all VSX regs and a subset of SPRs
  */
diff --git a/tools/arch/s390/include/uapi/asm/unistd.h b/tools/arch/s390/include/uapi/asm/unistd.h
deleted file mode 100644
index 725120939051..000000000000
--- a/tools/arch/s390/include/uapi/asm/unistd.h
+++ /dev/null
@@ -1,412 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/*
- *  S390 version
- *
- *  Derived from "include/asm-i386/unistd.h"
- */
-
-#ifndef _UAPI_ASM_S390_UNISTD_H_
-#define _UAPI_ASM_S390_UNISTD_H_
-
-/*
- * This file contains the system call numbers.
- */
-
-#define __NR_exit                 1
-#define __NR_fork                 2
-#define __NR_read                 3
-#define __NR_write                4
-#define __NR_open                 5
-#define __NR_close                6
-#define __NR_restart_syscall      7
-#define __NR_creat                8
-#define __NR_link                 9
-#define __NR_unlink              10
-#define __NR_execve              11
-#define __NR_chdir               12
-#define __NR_mknod               14
-#define __NR_chmod               15
-#define __NR_lseek               19
-#define __NR_getpid              20
-#define __NR_mount               21
-#define __NR_umount              22
-#define __NR_ptrace              26
-#define __NR_alarm               27
-#define __NR_pause               29
-#define __NR_utime               30
-#define __NR_access              33
-#define __NR_nice                34
-#define __NR_sync                36
-#define __NR_kill                37
-#define __NR_rename              38
-#define __NR_mkdir               39
-#define __NR_rmdir               40
-#define __NR_dup                 41
-#define __NR_pipe                42
-#define __NR_times               43
-#define __NR_brk                 45
-#define __NR_signal              48
-#define __NR_acct                51
-#define __NR_umount2             52
-#define __NR_ioctl               54
-#define __NR_fcntl               55
-#define __NR_setpgid             57
-#define __NR_umask               60
-#define __NR_chroot              61
-#define __NR_ustat               62
-#define __NR_dup2                63
-#define __NR_getppid             64
-#define __NR_getpgrp             65
-#define __NR_setsid              66
-#define __NR_sigaction           67
-#define __NR_sigsuspend          72
-#define __NR_sigpending          73
-#define __NR_sethostname         74
-#define __NR_setrlimit           75
-#define __NR_getrusage           77
-#define __NR_gettimeofday        78
-#define __NR_settimeofday        79
-#define __NR_symlink             83
-#define __NR_readlink            85
-#define __NR_uselib              86
-#define __NR_swapon              87
-#define __NR_reboot              88
-#define __NR_readdir             89
-#define __NR_mmap                90
-#define __NR_munmap              91
-#define __NR_truncate            92
-#define __NR_ftruncate           93
-#define __NR_fchmod              94
-#define __NR_getpriority         96
-#define __NR_setpriority         97
-#define __NR_statfs              99
-#define __NR_fstatfs            100
-#define __NR_socketcall         102
-#define __NR_syslog             103
-#define __NR_setitimer          104
-#define __NR_getitimer          105
-#define __NR_stat               106
-#define __NR_lstat              107
-#define __NR_fstat              108
-#define __NR_lookup_dcookie     110
-#define __NR_vhangup            111
-#define __NR_idle               112
-#define __NR_wait4              114
-#define __NR_swapoff            115
-#define __NR_sysinfo            116
-#define __NR_ipc                117
-#define __NR_fsync              118
-#define __NR_sigreturn          119
-#define __NR_clone              120
-#define __NR_setdomainname      121
-#define __NR_uname              122
-#define __NR_adjtimex           124
-#define __NR_mprotect           125
-#define __NR_sigprocmask        126
-#define __NR_create_module      127
-#define __NR_init_module        128
-#define __NR_delete_module      129
-#define __NR_get_kernel_syms    130
-#define __NR_quotactl           131
-#define __NR_getpgid            132
-#define __NR_fchdir             133
-#define __NR_bdflush            134
-#define __NR_sysfs              135
-#define __NR_personality        136
-#define __NR_afs_syscall        137 /* Syscall for Andrew File System */
-#define __NR_getdents           141
-#define __NR_flock              143
-#define __NR_msync              144
-#define __NR_readv              145
-#define __NR_writev             146
-#define __NR_getsid             147
-#define __NR_fdatasync          148
-#define __NR__sysctl            149
-#define __NR_mlock              150
-#define __NR_munlock            151
-#define __NR_mlockall           152
-#define __NR_munlockall         153
-#define __NR_sched_setparam             154
-#define __NR_sched_getparam             155
-#define __NR_sched_setscheduler         156
-#define __NR_sched_getscheduler         157
-#define __NR_sched_yield                158
-#define __NR_sched_get_priority_max     159
-#define __NR_sched_get_priority_min     160
-#define __NR_sched_rr_get_interval      161
-#define __NR_nanosleep          162
-#define __NR_mremap             163
-#define __NR_query_module       167
-#define __NR_poll               168
-#define __NR_nfsservctl         169
-#define __NR_prctl              172
-#define __NR_rt_sigreturn       173
-#define __NR_rt_sigaction       174
-#define __NR_rt_sigprocmask     175
-#define __NR_rt_sigpending      176
-#define __NR_rt_sigtimedwait    177
-#define __NR_rt_sigqueueinfo    178
-#define __NR_rt_sigsuspend      179
-#define __NR_pread64            180
-#define __NR_pwrite64           181
-#define __NR_getcwd             183
-#define __NR_capget             184
-#define __NR_capset             185
-#define __NR_sigaltstack        186
-#define __NR_sendfile           187
-#define __NR_getpmsg            188
-#define __NR_putpmsg            189
-#define __NR_vfork              190
-#define __NR_pivot_root         217
-#define __NR_mincore            218
-#define __NR_madvise            219
-#define __NR_getdents64         220
-#define __NR_readahead          222
-#define __NR_setxattr           224
-#define __NR_lsetxattr          225
-#define __NR_fsetxattr          226
-#define __NR_getxattr           227
-#define __NR_lgetxattr          228
-#define __NR_fgetxattr          229
-#define __NR_listxattr          230
-#define __NR_llistxattr         231
-#define __NR_flistxattr         232
-#define __NR_removexattr        233
-#define __NR_lremovexattr       234
-#define __NR_fremovexattr       235
-#define __NR_gettid             236
-#define __NR_tkill              237
-#define __NR_futex              238
-#define __NR_sched_setaffinity  239
-#define __NR_sched_getaffinity  240
-#define __NR_tgkill             241
-/* Number 242 is reserved for tux */
-#define __NR_io_setup           243
-#define __NR_io_destroy         244
-#define __NR_io_getevents       245
-#define __NR_io_submit          246
-#define __NR_io_cancel          247
-#define __NR_exit_group         248
-#define __NR_epoll_create       249
-#define __NR_epoll_ctl          250
-#define __NR_epoll_wait         251
-#define __NR_set_tid_address    252
-#define __NR_fadvise64          253
-#define __NR_timer_create       254
-#define __NR_timer_settime      255
-#define __NR_timer_gettime      256
-#define __NR_timer_getoverrun   257
-#define __NR_timer_delete       258
-#define __NR_clock_settime      259
-#define __NR_clock_gettime      260
-#define __NR_clock_getres       261
-#define __NR_clock_nanosleep    262
-/* Number 263 is reserved for vserver */
-#define __NR_statfs64           265
-#define __NR_fstatfs64          266
-#define __NR_remap_file_pages   267
-#define __NR_mbind              268
-#define __NR_get_mempolicy      269
-#define __NR_set_mempolicy      270
-#define __NR_mq_open            271
-#define __NR_mq_unlink          272
-#define __NR_mq_timedsend       273
-#define __NR_mq_timedreceive    274
-#define __NR_mq_notify          275
-#define __NR_mq_getsetattr      276
-#define __NR_kexec_load         277
-#define __NR_add_key            278
-#define __NR_request_key        279
-#define __NR_keyctl             280
-#define __NR_waitid             281
-#define __NR_ioprio_set         282
-#define __NR_ioprio_get         283
-#define __NR_inotify_init       284
-#define __NR_inotify_add_watch  285
-#define __NR_inotify_rm_watch   286
-#define __NR_migrate_pages      287
-#define __NR_openat             288
-#define __NR_mkdirat            289
-#define __NR_mknodat            290
-#define __NR_fchownat           291
-#define __NR_futimesat          292
-#define __NR_unlinkat           294
-#define __NR_renameat           295
-#define __NR_linkat             296
-#define __NR_symlinkat          297
-#define __NR_readlinkat         298
-#define __NR_fchmodat           299
-#define __NR_faccessat          300
-#define __NR_pselect6           301
-#define __NR_ppoll              302
-#define __NR_unshare            303
-#define __NR_set_robust_list    304
-#define __NR_get_robust_list    305
-#define __NR_splice             306
-#define __NR_sync_file_range    307
-#define __NR_tee                308
-#define __NR_vmsplice           309
-#define __NR_move_pages         310
-#define __NR_getcpu             311
-#define __NR_epoll_pwait        312
-#define __NR_utimes             313
-#define __NR_fallocate          314
-#define __NR_utimensat          315
-#define __NR_signalfd           316
-#define __NR_timerfd            317
-#define __NR_eventfd            318
-#define __NR_timerfd_create     319
-#define __NR_timerfd_settime    320
-#define __NR_timerfd_gettime    321
-#define __NR_signalfd4          322
-#define __NR_eventfd2           323
-#define __NR_inotify_init1      324
-#define __NR_pipe2              325
-#define __NR_dup3               326
-#define __NR_epoll_create1      327
-#define __NR_preadv             328
-#define __NR_pwritev            329
-#define __NR_rt_tgsigqueueinfo  330
-#define __NR_perf_event_open    331
-#define __NR_fanotify_init      332
-#define __NR_fanotify_mark      333
-#define __NR_prlimit64          334
-#define __NR_name_to_handle_at  335
-#define __NR_open_by_handle_at  336
-#define __NR_clock_adjtime      337
-#define __NR_syncfs             338
-#define __NR_setns              339
-#define __NR_process_vm_readv   340
-#define __NR_process_vm_writev  341
-#define __NR_s390_runtime_instr 342
-#define __NR_kcmp               343
-#define __NR_finit_module       344
-#define __NR_sched_setattr      345
-#define __NR_sched_getattr      346
-#define __NR_renameat2          347
-#define __NR_seccomp            348
-#define __NR_getrandom          349
-#define __NR_memfd_create       350
-#define __NR_bpf                351
-#define __NR_s390_pci_mmio_write        352
-#define __NR_s390_pci_mmio_read         353
-#define __NR_execveat           354
-#define __NR_userfaultfd        355
-#define __NR_membarrier         356
-#define __NR_recvmmsg           357
-#define __NR_sendmmsg           358
-#define __NR_socket             359
-#define __NR_socketpair         360
-#define __NR_bind               361
-#define __NR_connect            362
-#define __NR_listen             363
-#define __NR_accept4            364
-#define __NR_getsockopt         365
-#define __NR_setsockopt         366
-#define __NR_getsockname        367
-#define __NR_getpeername        368
-#define __NR_sendto             369
-#define __NR_sendmsg            370
-#define __NR_recvfrom           371
-#define __NR_recvmsg            372
-#define __NR_shutdown           373
-#define __NR_mlock2             374
-#define __NR_copy_file_range    375
-#define __NR_preadv2            376
-#define __NR_pwritev2           377
-#define __NR_s390_guarded_storage       378
-#define __NR_statx              379
-#define __NR_s390_sthyi         380
-#define NR_syscalls 381
-
-/* 
- * There are some system calls that are not present on 64 bit, some
- * have a different name although they do the same (e.g. __NR_chown32
- * is __NR_chown on 64 bit).
- */
-#ifndef __s390x__
-
-#define __NR_time                13
-#define __NR_lchown              16
-#define __NR_setuid              23
-#define __NR_getuid              24
-#define __NR_stime               25
-#define __NR_setgid              46
-#define __NR_getgid              47
-#define __NR_geteuid             49
-#define __NR_getegid             50
-#define __NR_setreuid            70
-#define __NR_setregid            71
-#define __NR_getrlimit           76
-#define __NR_getgroups           80
-#define __NR_setgroups           81
-#define __NR_fchown              95
-#define __NR_ioperm             101
-#define __NR_setfsuid           138
-#define __NR_setfsgid           139
-#define __NR__llseek            140
-#define __NR__newselect         142
-#define __NR_setresuid          164
-#define __NR_getresuid          165
-#define __NR_setresgid          170
-#define __NR_getresgid          171
-#define __NR_chown              182
-#define __NR_ugetrlimit         191     /* SuS compliant getrlimit */
-#define __NR_mmap2              192
-#define __NR_truncate64         193
-#define __NR_ftruncate64        194
-#define __NR_stat64             195
-#define __NR_lstat64            196
-#define __NR_fstat64            197
-#define __NR_lchown32           198
-#define __NR_getuid32           199
-#define __NR_getgid32           200
-#define __NR_geteuid32          201
-#define __NR_getegid32          202
-#define __NR_setreuid32         203
-#define __NR_setregid32         204
-#define __NR_getgroups32        205
-#define __NR_setgroups32        206
-#define __NR_fchown32           207
-#define __NR_setresuid32        208
-#define __NR_getresuid32        209
-#define __NR_setresgid32        210
-#define __NR_getresgid32        211
-#define __NR_chown32            212
-#define __NR_setuid32           213
-#define __NR_setgid32           214
-#define __NR_setfsuid32         215
-#define __NR_setfsgid32         216
-#define __NR_fcntl64            221
-#define __NR_sendfile64         223
-#define __NR_fadvise64_64       264
-#define __NR_fstatat64          293
-
-#else
-
-#define __NR_select             142
-#define __NR_getrlimit          191     /* SuS compliant getrlimit */
-#define __NR_lchown             198
-#define __NR_getuid             199
-#define __NR_getgid             200
-#define __NR_geteuid            201
-#define __NR_getegid            202
-#define __NR_setreuid           203
-#define __NR_setregid           204
-#define __NR_getgroups          205
-#define __NR_setgroups          206
-#define __NR_fchown             207
-#define __NR_setresuid          208
-#define __NR_getresuid          209
-#define __NR_setresgid          210
-#define __NR_getresgid          211
-#define __NR_chown              212
-#define __NR_setuid             213
-#define __NR_setgid             214
-#define __NR_setfsuid           215
-#define __NR_setfsgid           216
-#define __NR_newfstatat         293
-
-#endif
-
-#endif /* _UAPI_ASM_S390_UNISTD_H_ */
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 1d9199e1c2ad..0dfe4d3f74e2 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -210,6 +210,7 @@
 
 #define X86_FEATURE_MBA                 ( 7*32+18) /* Memory Bandwidth Allocation */
 #define X86_FEATURE_RSB_CTXSW           ( 7*32+19) /* "" Fill RSB on context switches */
+#define X86_FEATURE_SEV                 ( 7*32+20) /* AMD Secure Encrypted Virtualization */
 
 #define X86_FEATURE_USE_IBPB            ( 7*32+21) /* "" Indirect Branch Prediction Barrier enabled */
 
diff --git a/tools/cgroup/Makefile b/tools/cgroup/Makefile
index 860fa151640a..ffca068e4a76 100644
--- a/tools/cgroup/Makefile
+++ b/tools/cgroup/Makefile
@@ -1,7 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 # Makefile for cgroup tools
 
-CC = $(CROSS_COMPILE)gcc
 CFLAGS = -Wall -Wextra
 
 all: cgroup_event_listener
diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile
index 805a2c0cf4cd..240eda014b37 100644
--- a/tools/gpio/Makefile
+++ b/tools/gpio/Makefile
@@ -12,8 +12,6 @@ endif
 # (this improves performance and avoids hard-to-debug behaviour);
 MAKEFLAGS += -r
 
-CC = $(CROSS_COMPILE)gcc
-LD = $(CROSS_COMPILE)ld
 CFLAGS += -O2 -Wall -g -D_GNU_SOURCE -I$(OUTPUT)include
 
 ALL_TARGETS := lsgpio gpio-hammer gpio-event-mon
diff --git a/tools/hv/Makefile b/tools/hv/Makefile
index 1139d71fa0cf..5db5e62cebda 100644
--- a/tools/hv/Makefile
+++ b/tools/hv/Makefile
@@ -1,7 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 # Makefile for Hyper-V tools
 
-CC = $(CROSS_COMPILE)gcc
 WARNINGS = -Wall -Wextra
 CFLAGS = $(WARNINGS) -g $(shell getconf LFS_CFLAGS)
 
diff --git a/tools/iio/Makefile b/tools/iio/Makefile
index a08e7a47d6a3..332ed2f6c2c2 100644
--- a/tools/iio/Makefile
+++ b/tools/iio/Makefile
@@ -12,8 +12,6 @@ endif
 # (this improves performance and avoids hard-to-debug behaviour);
 MAKEFLAGS += -r
 
-CC = $(CROSS_COMPILE)gcc
-LD = $(CROSS_COMPILE)ld
 CFLAGS += -O2 -Wall -g -D_GNU_SOURCE -I$(OUTPUT)include
 
 ALL_TARGETS := iio_event_monitor lsiio iio_generic_buffer
diff --git a/tools/include/uapi/drm/i915_drm.h b/tools/include/uapi/drm/i915_drm.h
index ac3c6503ca27..536ee4febd74 100644
--- a/tools/include/uapi/drm/i915_drm.h
+++ b/tools/include/uapi/drm/i915_drm.h
@@ -86,6 +86,62 @@ enum i915_mocs_table_index {
         I915_MOCS_CACHED,
 };
 
+/*
+ * Different engines serve different roles, and there may be more than one
+ * engine serving each role. enum drm_i915_gem_engine_class provides a
+ * classification of the role of the engine, which may be used when requesting
+ * operations to be performed on a certain subset of engines, or for providing
+ * information about that group.
+ */
+enum drm_i915_gem_engine_class {
+        I915_ENGINE_CLASS_RENDER        = 0,
+        I915_ENGINE_CLASS_COPY          = 1,
+        I915_ENGINE_CLASS_VIDEO         = 2,
+        I915_ENGINE_CLASS_VIDEO_ENHANCE = 3,
+
+        I915_ENGINE_CLASS_INVALID       = -1
+};
+
+/**
+ * DOC: perf_events exposed by i915 through /sys/bus/event_sources/drivers/i915
+ *
+ */
+
+enum drm_i915_pmu_engine_sample {
+        I915_SAMPLE_BUSY = 0,
+        I915_SAMPLE_WAIT = 1,
+        I915_SAMPLE_SEMA = 2
+};
+
+#define I915_PMU_SAMPLE_BITS (4)
+#define I915_PMU_SAMPLE_MASK (0xf)
+#define I915_PMU_SAMPLE_INSTANCE_BITS (8)
+#define I915_PMU_CLASS_SHIFT \
+        (I915_PMU_SAMPLE_BITS + I915_PMU_SAMPLE_INSTANCE_BITS)
+
+#define __I915_PMU_ENGINE(class, instance, sample) \
+        ((class) << I915_PMU_CLASS_SHIFT | \
+        (instance) << I915_PMU_SAMPLE_BITS | \
+        (sample))
+
+#define I915_PMU_ENGINE_BUSY(class, instance) \
+        __I915_PMU_ENGINE(class, instance, I915_SAMPLE_BUSY)
+
+#define I915_PMU_ENGINE_WAIT(class, instance) \
+        __I915_PMU_ENGINE(class, instance, I915_SAMPLE_WAIT)
+
+#define I915_PMU_ENGINE_SEMA(class, instance) \
+        __I915_PMU_ENGINE(class, instance, I915_SAMPLE_SEMA)
+
+#define __I915_PMU_OTHER(x) (__I915_PMU_ENGINE(0xff, 0xff, 0xf) + 1 + (x))
+
+#define I915_PMU_ACTUAL_FREQUENCY       __I915_PMU_OTHER(0)
+#define I915_PMU_REQUESTED_FREQUENCY    __I915_PMU_OTHER(1)
+#define I915_PMU_INTERRUPTS             __I915_PMU_OTHER(2)
+#define I915_PMU_RC6_RESIDENCY          __I915_PMU_OTHER(3)
+
+#define I915_PMU_LAST I915_PMU_RC6_RESIDENCY
+
 /* Each region is a minimum of 16k, and there are at most 255 of them.
  */
 #define I915_NR_TEX_REGIONS 255 /* table size 2k - maximum due to use
@@ -450,6 +506,27 @@ typedef struct drm_i915_irq_wait {
  */
 #define I915_PARAM_HAS_EXEC_FENCE_ARRAY  49
 
+/*
+ * Query whether every context (both per-file default and user created) is
+ * isolated (insofar as HW supports). If this parameter is not true, then
+ * freshly created contexts may inherit values from an existing context,
+ * rather than default HW values. If true, it also ensures (insofar as HW
+ * supports) that all state set by this context will not leak to any other
+ * context.
+ *
+ * As not every engine across every gen support contexts, the returned
+ * value reports the support of context isolation for individual engines by
+ * returning a bitmask of each engine class set to true if that class supports
+ * isolation.
+ */
+#define I915_PARAM_HAS_CONTEXT_ISOLATION 50
+
+/* Frequency of the command streamer timestamps given by the *_TIMESTAMP
+ * registers. This used to be fixed per platform but from CNL onwards, this
+ * might vary depending on the parts.
+ */
+#define I915_PARAM_CS_TIMESTAMP_FREQUENCY 51
+
 typedef struct drm_i915_getparam {
         __s32 param;
         /*
diff --git a/tools/include/uapi/linux/if_link.h b/tools/include/uapi/linux/if_link.h
index 8616131e2c61..6d9447700e18 100644
--- a/tools/include/uapi/linux/if_link.h
+++ b/tools/include/uapi/linux/if_link.h
@@ -163,6 +163,7 @@ enum {
         IFLA_IF_NETNSID,
         IFLA_CARRIER_UP_COUNT,
         IFLA_CARRIER_DOWN_COUNT,
+        IFLA_NEW_IFINDEX,
         __IFLA_MAX
 };
 
diff --git a/tools/include/uapi/linux/kvm.h b/tools/include/uapi/linux/kvm.h
index 8fb90a0819c3..0fb5ef939732 100644
--- a/tools/include/uapi/linux/kvm.h
+++ b/tools/include/uapi/linux/kvm.h
@@ -1362,6 +1362,96 @@ struct kvm_s390_ucas_mapping {
 /* Available with KVM_CAP_S390_CMMA_MIGRATION */
 #define KVM_S390_GET_CMMA_BITS      _IOWR(KVMIO, 0xb8, struct kvm_s390_cmma_log)
 #define KVM_S390_SET_CMMA_BITS      _IOW(KVMIO, 0xb9, struct kvm_s390_cmma_log)
+/* Memory Encryption Commands */
+#define KVM_MEMORY_ENCRYPT_OP      _IOWR(KVMIO, 0xba, unsigned long)
+
+struct kvm_enc_region {
+        __u64 addr;
+        __u64 size;
+};
+
+#define KVM_MEMORY_ENCRYPT_REG_REGION    _IOR(KVMIO, 0xbb, struct kvm_enc_region)
+#define KVM_MEMORY_ENCRYPT_UNREG_REGION  _IOR(KVMIO, 0xbc, struct kvm_enc_region)
+
+/* Secure Encrypted Virtualization command */
+enum sev_cmd_id {
+        /* Guest initialization commands */
+        KVM_SEV_INIT = 0,
+        KVM_SEV_ES_INIT,
+        /* Guest launch commands */
+        KVM_SEV_LAUNCH_START,
+        KVM_SEV_LAUNCH_UPDATE_DATA,
+        KVM_SEV_LAUNCH_UPDATE_VMSA,
+        KVM_SEV_LAUNCH_SECRET,
+        KVM_SEV_LAUNCH_MEASURE,
+        KVM_SEV_LAUNCH_FINISH,
+        /* Guest migration commands (outgoing) */
+        KVM_SEV_SEND_START,
+        KVM_SEV_SEND_UPDATE_DATA,
+        KVM_SEV_SEND_UPDATE_VMSA,
+        KVM_SEV_SEND_FINISH,
+        /* Guest migration commands (incoming) */
+        KVM_SEV_RECEIVE_START,
+        KVM_SEV_RECEIVE_UPDATE_DATA,
+        KVM_SEV_RECEIVE_UPDATE_VMSA,
+        KVM_SEV_RECEIVE_FINISH,
+        /* Guest status and debug commands */
+        KVM_SEV_GUEST_STATUS,
+        KVM_SEV_DBG_DECRYPT,
+        KVM_SEV_DBG_ENCRYPT,
+        /* Guest certificates commands */
+        KVM_SEV_CERT_EXPORT,
+
+        KVM_SEV_NR_MAX,
+};
+
+struct kvm_sev_cmd {
+        __u32 id;
+        __u64 data;
+        __u32 error;
+        __u32 sev_fd;
+};
+
+struct kvm_sev_launch_start {
+        __u32 handle;
+        __u32 policy;
+        __u64 dh_uaddr;
+        __u32 dh_len;
+        __u64 session_uaddr;
+        __u32 session_len;
+};
+
+struct kvm_sev_launch_update_data {
+        __u64 uaddr;
+        __u32 len;
+};
+
+
+struct kvm_sev_launch_secret {
+        __u64 hdr_uaddr;
+        __u32 hdr_len;
+        __u64 guest_uaddr;
+        __u32 guest_len;
+        __u64 trans_uaddr;
+        __u32 trans_len;
+};
+
+struct kvm_sev_launch_measure {
+        __u64 uaddr;
+        __u32 len;
+};
+
+struct kvm_sev_guest_status {
+        __u32 handle;
+        __u32 policy;
+        __u32 state;
+};
+
+struct kvm_sev_dbg {
+        __u64 src_uaddr;
+        __u64 dst_uaddr;
+        __u32 len;
+};
 
 #define KVM_DEV_ASSIGN_ENABLE_IOMMU     (1 << 0)
 #define KVM_DEV_ASSIGN_PCI_2_3          (1 << 1)
diff --git a/tools/laptop/freefall/Makefile b/tools/laptop/freefall/Makefile
index 5f758c489a20..b572d94255f6 100644
--- a/tools/laptop/freefall/Makefile
+++ b/tools/laptop/freefall/Makefile
@@ -2,7 +2,6 @@
 PREFIX ?= /usr
 SBINDIR ?= sbin
 INSTALL ?= install
-CC = $(CROSS_COMPILE)gcc
 
 TARGET = freefall
 
diff --git a/tools/leds/Makefile b/tools/leds/Makefile
index c379af003807..7b6bed13daaa 100644
--- a/tools/leds/Makefile
+++ b/tools/leds/Makefile
@@ -1,7 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 # Makefile for LEDs tools
 
-CC = $(CROSS_COMPILE)gcc
 CFLAGS = -Wall -Wextra -g -I../../include/uapi
 
 all: uledmon led_hw_brightness_mon
diff --git a/tools/perf/Documentation/perf-data.txt b/tools/perf/Documentation/perf-data.txt
index f0796a47dfa3..90bb4aabe4f8 100644
--- a/tools/perf/Documentation/perf-data.txt
+++ b/tools/perf/Documentation/perf-data.txt
@@ -30,6 +30,10 @@ OPTIONS for 'convert'
 -i::
         Specify input perf data file path.
 
+-f::
+--force::
+        Don't complain, do it.
+
 -v::
 --verbose::
         Be more verbose (show counter open errors, etc).
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index 9b0351d3ce34..012328038594 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -146,12 +146,6 @@ define allow-override
     $(eval $(1) = $(2)))
 endef
 
-# Allow setting CC and AR and LD, or setting CROSS_COMPILE as a prefix.
-$(call allow-override,CC,$(CROSS_COMPILE)gcc)
-$(call allow-override,AR,$(CROSS_COMPILE)ar)
-$(call allow-override,LD,$(CROSS_COMPILE)ld)
-$(call allow-override,CXX,$(CROSS_COMPILE)g++)
-
 LD += $(EXTRA_LDFLAGS)
 
 HOSTCC  ?= gcc
diff --git a/tools/perf/arch/s390/Makefile b/tools/perf/arch/s390/Makefile
index 48228de415d0..dfa6e3103437 100644
--- a/tools/perf/arch/s390/Makefile
+++ b/tools/perf/arch/s390/Makefile
@@ -10,15 +10,19 @@ PERF_HAVE_ARCH_REGS_QUERY_REGISTER_OFFSET := 1
 
 out    := $(OUTPUT)arch/s390/include/generated/asm
 header := $(out)/syscalls_64.c
-sysdef := $(srctree)/tools/arch/s390/include/uapi/asm/unistd.h
-sysprf := $(srctree)/tools/perf/arch/s390/entry/syscalls/
+syskrn := $(srctree)/arch/s390/kernel/syscalls/syscall.tbl
+sysprf := $(srctree)/tools/perf/arch/s390/entry/syscalls
+sysdef := $(sysprf)/syscall.tbl
 systbl := $(sysprf)/mksyscalltbl
 
 # Create output directory if not already present
 _dummy := $(shell [ -d '$(out)' ] || mkdir -p '$(out)')
 
 $(header): $(sysdef) $(systbl)
-        $(Q)$(SHELL) '$(systbl)' '$(CC)' $(sysdef) > $@
+        @(test -d ../../kernel -a -d ../../tools -a -d ../perf && ( \
+        (diff -B $(sysdef) $(syskrn) >/dev/null) \
+        || echo "Warning: Kernel ABI header at '$(sysdef)' differs from latest version at '$(syskrn)'" >&2 )) || true
+        $(Q)$(SHELL) '$(systbl)' $(sysdef) > $@
 
 clean::
         $(call QUIET_CLEAN, s390) $(RM) $(header)
diff --git a/tools/perf/arch/s390/entry/syscalls/mksyscalltbl b/tools/perf/arch/s390/entry/syscalls/mksyscalltbl
index 7fa0d0abd419..72ecbb676370 100755
--- a/tools/perf/arch/s390/entry/syscalls/mksyscalltbl
+++ b/tools/perf/arch/s390/entry/syscalls/mksyscalltbl
@@ -3,25 +3,23 @@
 #
 # Generate system call table for perf
 #
-#
-# Copyright IBM Corp. 2017
+# Copyright IBM Corp. 2017, 2018
 # Author(s):  Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
 #
 
-gcc=$1
-input=$2
+SYSCALL_TBL=$1
 
-if ! test -r $input; then
+if ! test -r $SYSCALL_TBL; then
         echo "Could not read input file" >&2
         exit 1
 fi
 
 create_table()
 {
-        local max_nr
+        local max_nr nr abi sc discard
 
         echo 'static const char *syscalltbl_s390_64[] = {'
-        while read sc nr; do
+        while read nr abi sc discard; do
                 printf '\t[%d] = "%s",\n' $nr $sc
                 max_nr=$nr
         done
@@ -29,8 +27,6 @@ create_table()
         echo "#define SYSCALLTBL_S390_64_MAX_ID $max_nr"
 }
 
-
-$gcc -m64 -E -dM -x c  $input          \
-        |sed -ne 's/^#define __NR_//p' \
-        |sort -t' ' -k2 -nu            \
+grep -E "^[[:digit:]]+[[:space:]]+(common|64)" $SYSCALL_TBL     \
+        |sort -k1 -n                                    \
         |create_table
diff --git a/tools/perf/arch/s390/entry/syscalls/syscall.tbl b/tools/perf/arch/s390/entry/syscalls/syscall.tbl
new file mode 100644
index 000000000000..b38d48464368
--- /dev/null
+++ b/tools/perf/arch/s390/entry/syscalls/syscall.tbl
@@ -0,0 +1,390 @@
+# SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
+#
+# System call table for s390
+#
+# Format:
+#
+# <nr> <abi> <syscall> <entry-64bit> <compat-entry>
+#
+# where <abi> can be common, 64, or 32
+
+1    common     exit                    sys_exit                        sys_exit
+2    common     fork                    sys_fork                        sys_fork
+3    common     read                    sys_read                        compat_sys_s390_read
+4    common     write                   sys_write                       compat_sys_s390_write
+5    common     open                    sys_open                        compat_sys_open
+6    common     close                   sys_close                       sys_close
+7    common     restart_syscall         sys_restart_syscall             sys_restart_syscall
+8    common     creat                   sys_creat                       compat_sys_creat
+9    common     link                    sys_link                        compat_sys_link
+10   common     unlink                  sys_unlink                      compat_sys_unlink
+11   common     execve                  sys_execve                      compat_sys_execve
+12   common     chdir                   sys_chdir                       compat_sys_chdir
+13   32         time                    -                               compat_sys_time
+14   common     mknod                   sys_mknod                       compat_sys_mknod
+15   common     chmod                   sys_chmod                       compat_sys_chmod
+16   32         lchown                  -                               compat_sys_s390_lchown16
+19   common     lseek                   sys_lseek                       compat_sys_lseek
+20   common     getpid                  sys_getpid                      sys_getpid
+21   common     mount                   sys_mount                       compat_sys_mount
+22   common     umount                  sys_oldumount                   compat_sys_oldumount
+23   32         setuid                  -                               compat_sys_s390_setuid16
+24   32         getuid                  -                               compat_sys_s390_getuid16
+25   32         stime                   -                               compat_sys_stime
+26   common     ptrace                  sys_ptrace                      compat_sys_ptrace
+27   common     alarm                   sys_alarm                       sys_alarm
+29   common     pause                   sys_pause                       sys_pause
+30   common     utime                   sys_utime                       compat_sys_utime
+33   common     access                  sys_access                      compat_sys_access
+34   common     nice                    sys_nice                        sys_nice
+36   common     sync                    sys_sync                        sys_sync
+37   common     kill                    sys_kill                        sys_kill
+38   common     rename                  sys_rename                      compat_sys_rename
+39   common     mkdir                   sys_mkdir                       compat_sys_mkdir
+40   common     rmdir                   sys_rmdir                       compat_sys_rmdir
+41   common     dup                     sys_dup                         sys_dup
+42   common     pipe                    sys_pipe                        compat_sys_pipe
+43   common     times                   sys_times                       compat_sys_times
+45   common     brk                     sys_brk                         compat_sys_brk
+46   32         setgid                  -                               compat_sys_s390_setgid16
+47   32         getgid                  -                               compat_sys_s390_getgid16
+48   common     signal                  sys_signal                      compat_sys_signal
+49   32         geteuid                 -                               compat_sys_s390_geteuid16
+50   32         getegid                 -                               compat_sys_s390_getegid16
+51   common     acct                    sys_acct                        compat_sys_acct
+52   common     umount2                 sys_umount                      compat_sys_umount
+54   common     ioctl                   sys_ioctl                       compat_sys_ioctl
+55   common     fcntl                   sys_fcntl                       compat_sys_fcntl
+57   common     setpgid                 sys_setpgid                     sys_setpgid
+60   common     umask                   sys_umask                       sys_umask
+61   common     chroot                  sys_chroot                      compat_sys_chroot
+62   common     ustat                   sys_ustat                       compat_sys_ustat
+63   common     dup2                    sys_dup2                        sys_dup2
+64   common     getppid                 sys_getppid                     sys_getppid
+65   common     getpgrp                 sys_getpgrp                     sys_getpgrp
+66   common     setsid                  sys_setsid                      sys_setsid
+67   common     sigaction               sys_sigaction                   compat_sys_sigaction
+70   32         setreuid                -                               compat_sys_s390_setreuid16
+71   32         setregid                -                               compat_sys_s390_setregid16
+72   common     sigsuspend              sys_sigsuspend                  compat_sys_sigsuspend
+73   common     sigpending              sys_sigpending                  compat_sys_sigpending
+74   common     sethostname             sys_sethostname                 compat_sys_sethostname
+75   common     setrlimit               sys_setrlimit                   compat_sys_setrlimit
+76   32         getrlimit               -                               compat_sys_old_getrlimit
+77   common     getrusage               sys_getrusage                   compat_sys_getrusage
+78   common     gettimeofday            sys_gettimeofday                compat_sys_gettimeofday
+79   common     settimeofday            sys_settimeofday                compat_sys_settimeofday
+80   32         getgroups               -                               compat_sys_s390_getgroups16
+81   32         setgroups               -                               compat_sys_s390_setgroups16
+83   common     symlink                 sys_symlink                     compat_sys_symlink
+85   common     readlink                sys_readlink                    compat_sys_readlink
+86   common     uselib                  sys_uselib                      compat_sys_uselib
+87   common     swapon                  sys_swapon                      compat_sys_swapon
+88   common     reboot                  sys_reboot                      compat_sys_reboot
+89   common     readdir                 -                               compat_sys_old_readdir
+90   common     mmap                    sys_old_mmap                    compat_sys_s390_old_mmap
+91   common     munmap                  sys_munmap                      compat_sys_munmap
+92   common     truncate                sys_truncate                    compat_sys_truncate
+93   common     ftruncate               sys_ftruncate                   compat_sys_ftruncate
+94   common     fchmod                  sys_fchmod                      sys_fchmod
+95   32         fchown                  -                               compat_sys_s390_fchown16
+96   common     getpriority             sys_getpriority                 sys_getpriority
+97   common     setpriority             sys_setpriority                 sys_setpriority
+99   common     statfs                  sys_statfs                      compat_sys_statfs
+100  common     fstatfs                 sys_fstatfs                     compat_sys_fstatfs
+101  32         ioperm                  -                               -
+102  common     socketcall              sys_socketcall                  compat_sys_socketcall
+103  common     syslog                  sys_syslog                      compat_sys_syslog
+104  common     setitimer               sys_setitimer                   compat_sys_setitimer
+105  common     getitimer               sys_getitimer                   compat_sys_getitimer
+106  common     stat                    sys_newstat                     compat_sys_newstat
+107  common     lstat                   sys_newlstat                    compat_sys_newlstat
+108  common     fstat                   sys_newfstat                    compat_sys_newfstat
+110  common     lookup_dcookie          sys_lookup_dcookie              compat_sys_lookup_dcookie
+111  common     vhangup                 sys_vhangup                     sys_vhangup
+112  common     idle                    -                               -
+114  common     wait4                   sys_wait4                       compat_sys_wait4
+115  common     swapoff                 sys_swapoff                     compat_sys_swapoff
+116  common     sysinfo                 sys_sysinfo                     compat_sys_sysinfo
+117  common     ipc                     sys_s390_ipc                    compat_sys_s390_ipc
+118  common     fsync                   sys_fsync                       sys_fsync
+119  common     sigreturn               sys_sigreturn                   compat_sys_sigreturn
+120  common     clone                   sys_clone                       compat_sys_clone
+121  common     setdomainname           sys_setdomainname               compat_sys_setdomainname
+122  common     uname                   sys_newuname                    compat_sys_newuname
+124  common     adjtimex                sys_adjtimex                    compat_sys_adjtimex
+125  common     mprotect                sys_mprotect                    compat_sys_mprotect
+126  common     sigprocmask             sys_sigprocmask                 compat_sys_sigprocmask
+127  common     create_module           -                               -
+128  common     init_module             sys_init_module                 compat_sys_init_module
+129  common     delete_module           sys_delete_module               compat_sys_delete_module
+130  common     get_kernel_syms         -                               -
+131  common     quotactl                sys_quotactl                    compat_sys_quotactl
+132  common     getpgid                 sys_getpgid                     sys_getpgid
+133  common     fchdir                  sys_fchdir                      sys_fchdir
+134  common     bdflush                 sys_bdflush                     compat_sys_bdflush
+135  common     sysfs                   sys_sysfs                       compat_sys_sysfs
+136  common     personality             sys_s390_personality            sys_s390_personality
+137  common     afs_syscall             -                               -
+138  32         setfsuid                -                               compat_sys_s390_setfsuid16
+139  32         setfsgid                -                               compat_sys_s390_setfsgid16
+140  32         _llseek                 -                               compat_sys_llseek
+141  common     getdents                sys_getdents                    compat_sys_getdents
+142  32         _newselect              -                               compat_sys_select
+142  64         select                  sys_select                      -
+143  common     flock                   sys_flock                       sys_flock
+144  common     msync                   sys_msync                       compat_sys_msync
+145  common     readv                   sys_readv                       compat_sys_readv
+146  common     writev                  sys_writev                      compat_sys_writev
+147  common     getsid                  sys_getsid                      sys_getsid
+148  common     fdatasync               sys_fdatasync                   sys_fdatasync
+149  common     _sysctl                 sys_sysctl                      compat_sys_sysctl
+150  common     mlock                   sys_mlock                       compat_sys_mlock
+151  common     munlock                 sys_munlock                     compat_sys_munlock
+152  common     mlockall                sys_mlockall                    sys_mlockall
+153  common     munlockall              sys_munlockall                  sys_munlockall
+154  common     sched_setparam          sys_sched_setparam              compat_sys_sched_setparam
+155  common     sched_getparam          sys_sched_getparam              compat_sys_sched_getparam
+156  common     sched_setscheduler      sys_sched_setscheduler          compat_sys_sched_setscheduler
+157  common     sched_getscheduler      sys_sched_getscheduler          sys_sched_getscheduler
+158  common     sched_yield             sys_sched_yield                 sys_sched_yield
+159  common     sched_get_priority_max  sys_sched_get_priority_max      sys_sched_get_priority_max
+160  common     sched_get_priority_min  sys_sched_get_priority_min      sys_sched_get_priority_min
+161  common     sched_rr_get_interval   sys_sched_rr_get_interval       compat_sys_sched_rr_get_interval
+162  common     nanosleep               sys_nanosleep                   compat_sys_nanosleep
+163  common     mremap                  sys_mremap                      compat_sys_mremap
+164  32         setresuid               -                               compat_sys_s390_setresuid16
+165  32         getresuid               -                               compat_sys_s390_getresuid16
+167  common     query_module            -                               -
+168  common     poll                    sys_poll                        compat_sys_poll
+169  common     nfsservctl              -                               -
+170  32         setresgid               -                               compat_sys_s390_setresgid16
+171  32         getresgid               -                               compat_sys_s390_getresgid16
+172  common     prctl                   sys_prctl                       compat_sys_prctl
+173  common     rt_sigreturn            sys_rt_sigreturn                compat_sys_rt_sigreturn
+174  common     rt_sigaction            sys_rt_sigaction                compat_sys_rt_sigaction
+175  common     rt_sigprocmask          sys_rt_sigprocmask              compat_sys_rt_sigprocmask
+176  common     rt_sigpending           sys_rt_sigpending               compat_sys_rt_sigpending
+177  common     rt_sigtimedwait         sys_rt_sigtimedwait             compat_sys_rt_sigtimedwait
+178  common     rt_sigqueueinfo         sys_rt_sigqueueinfo             compat_sys_rt_sigqueueinfo
+179  common     rt_sigsuspend           sys_rt_sigsuspend               compat_sys_rt_sigsuspend
+180  common     pread64                 sys_pread64                     compat_sys_s390_pread64
+181  common     pwrite64                sys_pwrite64                    compat_sys_s390_pwrite64
+182  32         chown                   -                               compat_sys_s390_chown16
+183  common     getcwd                  sys_getcwd                      compat_sys_getcwd
+184  common     capget                  sys_capget                      compat_sys_capget
+185  common     capset                  sys_capset                      compat_sys_capset
+186  common     sigaltstack             sys_sigaltstack                 compat_sys_sigaltstack
+187  common     sendfile                sys_sendfile64                  compat_sys_sendfile
+188  common     getpmsg                 -                               -
+189  common     putpmsg                 -                               -
+190  common     vfork                   sys_vfork                       sys_vfork
+191  32         ugetrlimit              -                               compat_sys_getrlimit
+191  64         getrlimit               sys_getrlimit                   -
+192  32         mmap2                   -                               compat_sys_s390_mmap2
+193  32         truncate64              -                               compat_sys_s390_truncate64
+194  32         ftruncate64             -                               compat_sys_s390_ftruncate64
+195  32         stat64                  -                               compat_sys_s390_stat64
+196  32         lstat64                 -                               compat_sys_s390_lstat64
+197  32         fstat64                 -                               compat_sys_s390_fstat64
+198  32         lchown32                -                               compat_sys_lchown
+198  64         lchown                  sys_lchown                      -
+199  32         getuid32                -                               sys_getuid
+199  64         getuid                  sys_getuid                      -
+200  32         getgid32                -                               sys_getgid
+200  64         getgid                  sys_getgid                      -
+201  32         geteuid32               -                               sys_geteuid
+201  64         geteuid                 sys_geteuid                     -
+202  32         getegid32               -                               sys_getegid
+202  64         getegid                 sys_getegid                     -
+203  32         setreuid32              -                               sys_setreuid
+203  64         setreuid                sys_setreuid                    -
+204  32         setregid32              -                               sys_setregid
+204  64         setregid                sys_setregid                    -
+205  32         getgroups32             -                               compat_sys_getgroups
+205  64         getgroups               sys_getgroups                   -
+206  32         setgroups32             -                               compat_sys_setgroups
+206  64         setgroups               sys_setgroups                   -
+207  32         fchown32                -                               sys_fchown
+207  64         fchown                  sys_fchown                      -
+208  32         setresuid32             -                               sys_setresuid
+208  64         setresuid               sys_setresuid                   -
+209  32         getresuid32             -                               compat_sys_getresuid
+209  64         getresuid               sys_getresuid                   -
+210  32         setresgid32             -                               sys_setresgid
+210  64         setresgid               sys_setresgid                   -
+211  32         getresgid32             -                               compat_sys_getresgid
+211  64         getresgid               sys_getresgid                   -
+212  32         chown32                 -                               compat_sys_chown
+212  64         chown                   sys_chown                       -
+213  32         setuid32                -                               sys_setuid
+213  64         setuid                  sys_setuid                      -
+214  32         setgid32                -                               sys_setgid
+214  64         setgid                  sys_setgid                      -
+215  32         setfsuid32              -                               sys_setfsuid
+215  64         setfsuid                sys_setfsuid                    -
+216  32         setfsgid32              -                               sys_setfsgid
+216  64         setfsgid                sys_setfsgid                    -
+217  common     pivot_root              sys_pivot_root                  compat_sys_pivot_root
+218  common     mincore                 sys_mincore                     compat_sys_mincore
+219  common     madvise                 sys_madvise                     compat_sys_madvise
+220  common     getdents64              sys_getdents64                  compat_sys_getdents64
+221  32         fcntl64                 -                               compat_sys_fcntl64
+222  common     readahead               sys_readahead                   compat_sys_s390_readahead
+223  32         sendfile64              -                               compat_sys_sendfile64
+224  common     setxattr                sys_setxattr                    compat_sys_setxattr
+225  common     lsetxattr               sys_lsetxattr                   compat_sys_lsetxattr
+226  common     fsetxattr               sys_fsetxattr                   compat_sys_fsetxattr
+227  common     getxattr                sys_getxattr                    compat_sys_getxattr
+228  common     lgetxattr               sys_lgetxattr                   compat_sys_lgetxattr
+229  common     fgetxattr               sys_fgetxattr                   compat_sys_fgetxattr
+230  common     listxattr               sys_listxattr                   compat_sys_listxattr
+231  common     llistxattr              sys_llistxattr                  compat_sys_llistxattr
+232  common     flistxattr              sys_flistxattr                  compat_sys_flistxattr
+233  common     removexattr             sys_removexattr                 compat_sys_removexattr
+234  common     lremovexattr            sys_lremovexattr                compat_sys_lremovexattr
+235  common     fremovexattr            sys_fremovexattr                compat_sys_fremovexattr
+236  common     gettid                  sys_gettid                      sys_gettid
+237  common     tkill                   sys_tkill                       sys_tkill
+238  common     futex                   sys_futex                       compat_sys_futex
+239  common     sched_setaffinity       sys_sched_setaffinity           compat_sys_sched_setaffinity
+240  common     sched_getaffinity       sys_sched_getaffinity           compat_sys_sched_getaffinity
+241  common     tgkill                  sys_tgkill                      sys_tgkill
+243  common     io_setup                sys_io_setup                    compat_sys_io_setup
+244  common     io_destroy              sys_io_destroy                  compat_sys_io_destroy
+245  common     io_getevents            sys_io_getevents                compat_sys_io_getevents
+246  common     io_submit               sys_io_submit                   compat_sys_io_submit
+247  common     io_cancel               sys_io_cancel                   compat_sys_io_cancel
+248  common     exit_group              sys_exit_group                  sys_exit_group
+249  common     epoll_create            sys_epoll_create                sys_epoll_create
+250  common     epoll_ctl               sys_epoll_ctl                   compat_sys_epoll_ctl
+251  common     epoll_wait              sys_epoll_wait                  compat_sys_epoll_wait
+252  common     set_tid_address         sys_set_tid_address             compat_sys_set_tid_address
+253  common     fadvise64               sys_fadvise64_64                compat_sys_s390_fadvise64
+254  common     timer_create            sys_timer_create                compat_sys_timer_create
+255  common     timer_settime           sys_timer_settime               compat_sys_timer_settime
+256  common     timer_gettime           sys_timer_gettime               compat_sys_timer_gettime
+257  common     timer_getoverrun        sys_timer_getoverrun            sys_timer_getoverrun
+258  common     timer_delete            sys_timer_delete                sys_timer_delete
+259  common     clock_settime           sys_clock_settime               compat_sys_clock_settime
+260  common     clock_gettime           sys_clock_gettime               compat_sys_clock_gettime
+261  common     clock_getres            sys_clock_getres                compat_sys_clock_getres
+262  common     clock_nanosleep         sys_clock_nanosleep             compat_sys_clock_nanosleep
+264  32         fadvise64_64            -                               compat_sys_s390_fadvise64_64
+265  common     statfs64                sys_statfs64                    compat_sys_statfs64
+266  common     fstatfs64               sys_fstatfs64                   compat_sys_fstatfs64
+267  common     remap_file_pages        sys_remap_file_pages            compat_sys_remap_file_pages
+268  common     mbind                   sys_mbind                       compat_sys_mbind
+269  common     get_mempolicy           sys_get_mempolicy               compat_sys_get_mempolicy
+270  common     set_mempolicy           sys_set_mempolicy               compat_sys_set_mempolicy
+271  common     mq_open                 sys_mq_open                     compat_sys_mq_open
+272  common     mq_unlink               sys_mq_unlink                   compat_sys_mq_unlink
+273  common     mq_timedsend            sys_mq_timedsend                compat_sys_mq_timedsend
+274  common     mq_timedreceive         sys_mq_timedreceive             compat_sys_mq_timedreceive
+275  common     mq_notify               sys_mq_notify                   compat_sys_mq_notify
+276  common     mq_getsetattr           sys_mq_getsetattr               compat_sys_mq_getsetattr
+277  common     kexec_load              sys_kexec_load                  compat_sys_kexec_load
+278  common     add_key                 sys_add_key                     compat_sys_add_key
+279  common     request_key             sys_request_key                 compat_sys_request_key
+280  common     keyctl                  sys_keyctl                      compat_sys_keyctl
+281  common     waitid                  sys_waitid                      compat_sys_waitid
+282  common     ioprio_set              sys_ioprio_set                  sys_ioprio_set
+283  common     ioprio_get              sys_ioprio_get                  sys_ioprio_get
+284  common     inotify_init            sys_inotify_init                sys_inotify_init
+285  common     inotify_add_watch       sys_inotify_add_watch           compat_sys_inotify_add_watch
+286  common     inotify_rm_watch        sys_inotify_rm_watch            sys_inotify_rm_watch
+287  common     migrate_pages           sys_migrate_pages               compat_sys_migrate_pages
+288  common     openat                  sys_openat                      compat_sys_openat
+289  common     mkdirat                 sys_mkdirat                     compat_sys_mkdirat
+290  common     mknodat                 sys_mknodat                     compat_sys_mknodat
+291  common     fchownat                sys_fchownat                    compat_sys_fchownat
+292  common     futimesat               sys_futimesat                   compat_sys_futimesat
+293  32         fstatat64               -                               compat_sys_s390_fstatat64
+293  64         newfstatat              sys_newfstatat                  -
+294  common     unlinkat                sys_unlinkat                    compat_sys_unlinkat
+295  common     renameat                sys_renameat                    compat_sys_renameat
+296  common     linkat                  sys_linkat                      compat_sys_linkat
+297  common     symlinkat               sys_symlinkat                   compat_sys_symlinkat
+298  common     readlinkat              sys_readlinkat                  compat_sys_readlinkat
+299  common     fchmodat                sys_fchmodat                    compat_sys_fchmodat
+300  common     faccessat               sys_faccessat                   compat_sys_faccessat
+301  common     pselect6                sys_pselect6                    compat_sys_pselect6
+302  common     ppoll                   sys_ppoll                       compat_sys_ppoll
+303  common     unshare                 sys_unshare                     compat_sys_unshare
+304  common     set_robust_list         sys_set_robust_list             compat_sys_set_robust_list
+305  common     get_robust_list         sys_get_robust_list             compat_sys_get_robust_list
+306  common     splice                  sys_splice                      compat_sys_splice
+307  common     sync_file_range         sys_sync_file_range             compat_sys_s390_sync_file_range
+308  common     tee                     sys_tee                         compat_sys_tee
+309  common     vmsplice                sys_vmsplice                    compat_sys_vmsplice
+310  common     move_pages              sys_move_pages                  compat_sys_move_pages
+311  common     getcpu                  sys_getcpu                      compat_sys_getcpu
+312  common     epoll_pwait             sys_epoll_pwait                 compat_sys_epoll_pwait
+313  common     utimes                  sys_utimes                      compat_sys_utimes
+314  common     fallocate               sys_fallocate                   compat_sys_s390_fallocate
+315  common     utimensat               sys_utimensat                   compat_sys_utimensat
+316  common     signalfd                sys_signalfd                    compat_sys_signalfd
+317  common     timerfd                 -                               -
+318  common     eventfd                 sys_eventfd                     sys_eventfd
+319  common     timerfd_create          sys_timerfd_create              sys_timerfd_create
+320  common     timerfd_settime         sys_timerfd_settime             compat_sys_timerfd_settime
+321  common     timerfd_gettime         sys_timerfd_gettime             compat_sys_timerfd_gettime
+322  common     signalfd4               sys_signalfd4                   compat_sys_signalfd4
+323  common     eventfd2                sys_eventfd2                    sys_eventfd2
+324  common     inotify_init1           sys_inotify_init1               sys_inotify_init1
+325  common     pipe2                   sys_pipe2                       compat_sys_pipe2
+326  common     dup3                    sys_dup3                        sys_dup3
+327  common     epoll_create1           sys_epoll_create1               sys_epoll_create1
+328  common     preadv                  sys_preadv                      compat_sys_preadv
+329  common     pwritev                 sys_pwritev                     compat_sys_pwritev
+330  common     rt_tgsigqueueinfo       sys_rt_tgsigqueueinfo           compat_sys_rt_tgsigqueueinfo
+331  common     perf_event_open         sys_perf_event_open             compat_sys_perf_event_open
+332  common     fanotify_init           sys_fanotify_init               sys_fanotify_init
+333  common     fanotify_mark           sys_fanotify_mark               compat_sys_fanotify_mark
+334  common     prlimit64               sys_prlimit64                   compat_sys_prlimit64
+335  common     name_to_handle_at       sys_name_to_handle_at           compat_sys_name_to_handle_at
+336  common     open_by_handle_at       sys_open_by_handle_at           compat_sys_open_by_handle_at
+337  common     clock_adjtime           sys_clock_adjtime               compat_sys_clock_adjtime
+338  common     syncfs                  sys_syncfs                      sys_syncfs
+339  common     setns                   sys_setns                       sys_setns
+340  common     process_vm_readv        sys_process_vm_readv            compat_sys_process_vm_readv
+341  common     process_vm_writev       sys_process_vm_writev           compat_sys_process_vm_writev
+342  common     s390_runtime_instr      sys_s390_runtime_instr          sys_s390_runtime_instr
+343  common     kcmp                    sys_kcmp                        compat_sys_kcmp
+344  common     finit_module            sys_finit_module                compat_sys_finit_module
+345  common     sched_setattr           sys_sched_setattr               compat_sys_sched_setattr
+346  common     sched_getattr           sys_sched_getattr               compat_sys_sched_getattr
+347  common     renameat2               sys_renameat2                   compat_sys_renameat2
+348  common     seccomp                 sys_seccomp                     compat_sys_seccomp
+349  common     getrandom               sys_getrandom                   compat_sys_getrandom
+350  common     memfd_create            sys_memfd_create                compat_sys_memfd_create
+351  common     bpf                     sys_bpf                         compat_sys_bpf
+352  common     s390_pci_mmio_write     sys_s390_pci_mmio_write         compat_sys_s390_pci_mmio_write
+353  common     s390_pci_mmio_read      sys_s390_pci_mmio_read          compat_sys_s390_pci_mmio_read
+354  common     execveat                sys_execveat                    compat_sys_execveat
+355  common     userfaultfd             sys_userfaultfd                 sys_userfaultfd
+356  common     membarrier              sys_membarrier                  sys_membarrier
+357  common     recvmmsg                sys_recvmmsg                    compat_sys_recvmmsg
+358  common     sendmmsg                sys_sendmmsg                    compat_sys_sendmmsg
+359  common     socket                  sys_socket                      sys_socket
+360  common     socketpair              sys_socketpair                  compat_sys_socketpair
+361  common     bind                    sys_bind                        compat_sys_bind
+362  common     connect                 sys_connect                     compat_sys_connect
+363  common     listen                  sys_listen                      sys_listen
+364  common     accept4                 sys_accept4                     compat_sys_accept4
+365  common     getsockopt              sys_getsockopt                  compat_sys_getsockopt
+366  common     setsockopt              sys_setsockopt                  compat_sys_setsockopt
+367  common     getsockname             sys_getsockname                 compat_sys_getsockname
+368  common     getpeername             sys_getpeername                 compat_sys_getpeername
+369  common     sendto                  sys_sendto                      compat_sys_sendto
+370  common     sendmsg                 sys_sendmsg                     compat_sys_sendmsg
+371  common     recvfrom                sys_recvfrom                    compat_sys_recvfrom
+372  common     recvmsg                 sys_recvmsg                     compat_sys_recvmsg
+373  common     shutdown                sys_shutdown                    sys_shutdown
+374  common     mlock2                  sys_mlock2                      compat_sys_mlock2
+375  common     copy_file_range         sys_copy_file_range             compat_sys_copy_file_range
+376  common     preadv2                 sys_preadv2                     compat_sys_preadv2
+377  common     pwritev2                sys_pwritev2                    compat_sys_pwritev2
+378  common     s390_guarded_storage    sys_s390_guarded_storage        compat_sys_s390_guarded_storage
+379  common     statx                   sys_statx                       compat_sys_statx
+380  common     s390_sthyi              sys_s390_sthyi                  compat_sys_s390_sthyi
diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
index c0815a37fdb5..539c3d460158 100644
--- a/tools/perf/builtin-c2c.c
+++ b/tools/perf/builtin-c2c.c
@@ -2245,7 +2245,7 @@ static int perf_c2c__browse_cacheline(struct hist_entry *he)
         c2c_browser__update_nr_entries(browser);
 
         while (1) {
-                key = hist_browser__run(browser, "? - help");
+                key = hist_browser__run(browser, "? - help", true);
 
                 switch (key) {
                 case 's':
@@ -2314,7 +2314,7 @@ static int perf_c2c__hists_browse(struct hists *hists)
         c2c_browser__update_nr_entries(browser);
 
         while (1) {
-                key = hist_browser__run(browser, "? - help");
+                key = hist_browser__run(browser, "? - help", true);
 
                 switch (key) {
                 case 'q':
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 42a52dcc41cd..4ad5dc649716 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -530,7 +530,8 @@ static int report__browse_hists(struct report *rep)
         case 1:
                 ret = perf_evlist__tui_browse_hists(evlist, help, NULL,
                                                     rep->min_percent,
-                                                    &session->header.env);
+                                                    &session->header.env,
+                                                    true);
                 /*
                  * Usually "ret" is the last pressed key, and we only
                  * care if the key notifies us to switch data file.
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index c6ccda52117d..b7c823ba8374 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -283,8 +283,9 @@ static void perf_top__print_sym_table(struct perf_top *top)
 
         printf("%-*.*s\n", win_width, win_width, graph_dotted_line);
 
-        if (hists->stats.nr_lost_warned !=
-            hists->stats.nr_events[PERF_RECORD_LOST]) {
+        if (!top->record_opts.overwrite &&
+            (hists->stats.nr_lost_warned !=
+            hists->stats.nr_events[PERF_RECORD_LOST])) {
                 hists->stats.nr_lost_warned =
                               hists->stats.nr_events[PERF_RECORD_LOST];
                 color_fprintf(stdout, PERF_COLOR_RED,
@@ -611,7 +612,8 @@ static void *display_thread_tui(void *arg)
 
         perf_evlist__tui_browse_hists(top->evlist, help, &hbt,
                                       top->min_percent,
-                                      &top->session->header.env);
+                                      &top->session->header.env,
+                                      !top->record_opts.overwrite);
 
         done = 1;
         return NULL;
@@ -807,15 +809,23 @@ static void perf_event__process_sample(struct perf_tool *tool,
 
 static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
 {
+        struct record_opts *opts = &top->record_opts;
+        struct perf_evlist *evlist = top->evlist;
         struct perf_sample sample;
         struct perf_evsel *evsel;
+        struct perf_mmap *md;
         struct perf_session *session = top->session;
         union perf_event *event;
         struct machine *machine;
+        u64 end, start;
         int ret;
 
-        while ((event = perf_evlist__mmap_read(top->evlist, idx)) != NULL) {
-                ret = perf_evlist__parse_sample(top->evlist, event, &sample);
+        md = opts->overwrite ? &evlist->overwrite_mmap[idx] : &evlist->mmap[idx];
+        if (perf_mmap__read_init(md, opts->overwrite, &start, &end) < 0)
+                return;
+
+        while ((event = perf_mmap__read_event(md, opts->overwrite, &start, end)) != NULL) {
+                ret = perf_evlist__parse_sample(evlist, event, &sample);
                 if (ret) {
                         pr_err("Can't parse sample, err = %d\n", ret);
                         goto next_event;
@@ -869,16 +879,120 @@ static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
                 } else
                         ++session->evlist->stats.nr_unknown_events;
 next_event:
-                perf_evlist__mmap_consume(top->evlist, idx);
+                perf_mmap__consume(md, opts->overwrite);
         }
+
+        perf_mmap__read_done(md);
 }
 
 static void perf_top__mmap_read(struct perf_top *top)
 {
+        bool overwrite = top->record_opts.overwrite;
+        struct perf_evlist *evlist = top->evlist;
+        unsigned long long start, end;
         int i;
 
+        start = rdclock();
+        if (overwrite)
+                perf_evlist__toggle_bkw_mmap(evlist, BKW_MMAP_DATA_PENDING);
+
         for (i = 0; i < top->evlist->nr_mmaps; i++)
                 perf_top__mmap_read_idx(top, i);
+
+        if (overwrite) {
+                perf_evlist__toggle_bkw_mmap(evlist, BKW_MMAP_EMPTY);
+                perf_evlist__toggle_bkw_mmap(evlist, BKW_MMAP_RUNNING);
+        }
+        end = rdclock();
+
+        if ((end - start) > (unsigned long long)top->delay_secs * NSEC_PER_SEC)
+                ui__warning("Too slow to read ring buffer.\n"
+                            "Please try increasing the period (-c) or\n"
+                            "decreasing the freq (-F) or\n"
+                            "limiting the number of CPUs (-C)\n");
+}
+
+/*
+ * Check per-event overwrite term.
+ * perf top should support consistent term for all events.
+ * - All events don't have per-event term
+ *   E.g. "cpu/cpu-cycles/,cpu/instructions/"
+ *   Nothing change, return 0.
+ * - All events have same per-event term
+ *   E.g. "cpu/cpu-cycles,no-overwrite/,cpu/instructions,no-overwrite/
+ *   Using the per-event setting to replace the opts->overwrite if
+ *   they are different, then return 0.
+ * - Events have different per-event term
+ *   E.g. "cpu/cpu-cycles,overwrite/,cpu/instructions,no-overwrite/"
+ *   Return -1
+ * - Some of the event set per-event term, but some not.
+ *   E.g. "cpu/cpu-cycles/,cpu/instructions,no-overwrite/"
+ *   Return -1
+ */
+static int perf_top__overwrite_check(struct perf_top *top)
+{
+        struct record_opts *opts = &top->record_opts;
+        struct perf_evlist *evlist = top->evlist;
+        struct perf_evsel_config_term *term;
+        struct list_head *config_terms;
+        struct perf_evsel *evsel;
+        int set, overwrite = -1;
+
+        evlist__for_each_entry(evlist, evsel) {
+                set = -1;
+                config_terms = &evsel->config_terms;
+                list_for_each_entry(term, config_terms, list) {
+                        if (term->type == PERF_EVSEL__CONFIG_TERM_OVERWRITE)
+                                set = term->val.overwrite ? 1 : 0;
+                }
+
+                /* no term for current and previous event (likely) */
+                if ((overwrite < 0) && (set < 0))
+                        continue;
+
+                /* has term for both current and previous event, compare */
+                if ((overwrite >= 0) && (set >= 0) && (overwrite != set))
+                        return -1;
+
+                /* no term for current event but has term for previous one */
+                if ((overwrite >= 0) && (set < 0))
+                        return -1;
+
+                /* has term for current event */
+                if ((overwrite < 0) && (set >= 0)) {
+                        /* if it's first event, set overwrite */
+                        if (evsel == perf_evlist__first(evlist))
+                                overwrite = set;
+                        else
+                                return -1;
+                }
+        }
+
+        if ((overwrite >= 0) && (opts->overwrite != overwrite))
+                opts->overwrite = overwrite;
+
+        return 0;
+}
+
+static int perf_top_overwrite_fallback(struct perf_top *top,
+                                       struct perf_evsel *evsel)
+{
+        struct record_opts *opts = &top->record_opts;
+        struct perf_evlist *evlist = top->evlist;
+        struct perf_evsel *counter;
+
+        if (!opts->overwrite)
+                return 0;
+
+        /* only fall back when first event fails */
+        if (evsel != perf_evlist__first(evlist))
+                return 0;
+
+        evlist__for_each_entry(evlist, counter)
+                counter->attr.write_backward = false;
+        opts->overwrite = false;
+        ui__warning("fall back to non-overwrite mode\n");
+        return 1;
 }
 
 static int perf_top__start_counters(struct perf_top *top)
@@ -888,12 +1002,33 @@ static int perf_top__start_counters(struct perf_top *top)
         struct perf_evlist *evlist = top->evlist;
         struct record_opts *opts = &top->record_opts;
 
+        if (perf_top__overwrite_check(top)) {
+                ui__error("perf top only support consistent per-event "
+                          "overwrite setting for all events\n");
+                goto out_err;
+        }
+
         perf_evlist__config(evlist, opts, &callchain_param);
 
         evlist__for_each_entry(evlist, counter) {
 try_again:
                 if (perf_evsel__open(counter, top->evlist->cpus,
                                      top->evlist->threads) < 0) {
+
+                        /*
+                         * Specially handle overwrite fall back.
+                         * Because perf top is the only tool which has
+                         * overwrite mode by default, support
+                         * both overwrite and non-overwrite mode, and
+                         * require consistent mode for all events.
+                         *
+                         * May move it to generic code with more tools
+                         * have similar attribute.
+                         */
+                        if (perf_missing_features.write_backward &&
+                            perf_top_overwrite_fallback(top, counter))
+                                goto try_again;
+
                         if (perf_evsel__fallback(counter, errno, msg, sizeof(msg))) {
                                 if (verbose > 0)
                                         ui__warning("%s\n", msg);
@@ -1033,7 +1168,7 @@ static int __cmd_top(struct perf_top *top)
 
                 perf_top__mmap_read(top);
 
-                if (hits == top->samples)
+                if (opts->overwrite || (hits == top->samples))
                         ret = perf_evlist__poll(top->evlist, 100);
 
                 if (resize) {
@@ -1127,6 +1262,7 @@ int cmd_top(int argc, const char **argv)
                                 .uses_mmap   = true,
                         },
                         .proc_map_timeout    = 500,
+                        .overwrite      = 1,
                 },
                 .max_stack           = sysctl_perf_event_max_stack,
                 .sym_pcnt_filter     = 5,
diff --git a/tools/perf/check-headers.sh b/tools/perf/check-headers.sh
index 51abdb0a4047..790ec25919a0 100755
--- a/tools/perf/check-headers.sh
+++ b/tools/perf/check-headers.sh
@@ -33,7 +33,6 @@ arch/s390/include/uapi/asm/kvm.h
 arch/s390/include/uapi/asm/kvm_perf.h
 arch/s390/include/uapi/asm/ptrace.h
 arch/s390/include/uapi/asm/sie.h
-arch/s390/include/uapi/asm/unistd.h
 arch/arm/include/uapi/asm/kvm.h
 arch/arm64/include/uapi/asm/kvm.h
 arch/alpha/include/uapi/asm/errno.h
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/branch.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/branch.json
new file mode 100644
index 000000000000..3b6208763e50
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/branch.json
@@ -0,0 +1,27 @@
+[
+  {,
+    "EventCode": "0x7A",
+    "EventName": "BR_INDIRECT_SPEC",
+    "BriefDescription": "Branch speculatively executed - Indirect branch"
+  },
+  {,
+    "EventCode": "0xC9",
+    "EventName": "BR_COND",
+    "BriefDescription": "Conditional branch executed"
+  },
+  {,
+    "EventCode": "0xCA",
+    "EventName": "BR_INDIRECT_MISPRED",
+    "BriefDescription": "Indirect branch mispredicted"
+  },
+  {,
+    "EventCode": "0xCB",
+    "EventName": "BR_INDIRECT_MISPRED_ADDR",
+    "BriefDescription": "Indirect branch mispredicted because of address miscompare"
+  },
+  {,
+    "EventCode": "0xCC",
+    "EventName": "BR_COND_MISPRED",
+    "BriefDescription": "Conditional branch mispredicted"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/bus.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/bus.json
new file mode 100644
index 000000000000..480d9f7460ab
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/bus.json
@@ -0,0 +1,22 @@
+[
+  {,
+    "EventCode": "0x60",
+    "EventName": "BUS_ACCESS_LD",
+    "BriefDescription": "Bus access - Read"
+  },
+  {,
+    "EventCode": "0x61",
+    "EventName": "BUS_ACCESS_ST",
+    "BriefDescription": "Bus access - Write"
+  },
+  {,
+    "EventCode": "0xC0",
+    "EventName": "EXT_MEM_REQ",
+    "BriefDescription": "External memory request"
+  },
+  {,
+    "EventCode": "0xC1",
+    "EventName": "EXT_MEM_REQ_NC",
+    "BriefDescription": "Non-cacheable external memory request"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/cache.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/cache.json
new file mode 100644
index 000000000000..11baad6344b9
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/cache.json
@@ -0,0 +1,27 @@
+[
+  {,
+    "EventCode": "0xC2",
+    "EventName": "PREFETCH_LINEFILL",
+    "BriefDescription": "Linefill because of prefetch"
+  },
+  {,
+    "EventCode": "0xC3",
+    "EventName": "PREFETCH_LINEFILL_DROP",
+    "BriefDescription": "Instruction Cache Throttle occurred"
+  },
+  {,
+    "EventCode": "0xC4",
+    "EventName": "READ_ALLOC_ENTER",
+    "BriefDescription": "Entering read allocate mode"
+  },
+  {,
+    "EventCode": "0xC5",
+    "EventName": "READ_ALLOC",
+    "BriefDescription": "Read allocate mode"
+  },
+  {,
+    "EventCode": "0xC8",
+    "EventName": "EXT_SNOOP",
+    "BriefDescription": "SCU Snooped data from another CPU for this CPU"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/memory.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/memory.json
new file mode 100644
index 000000000000..480d9f7460ab
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/memory.json
@@ -0,0 +1,22 @@
+[
+  {,
+    "EventCode": "0x60",
+    "EventName": "BUS_ACCESS_LD",
+    "BriefDescription": "Bus access - Read"
+  },
+  {,
+    "EventCode": "0x61",
+    "EventName": "BUS_ACCESS_ST",
+    "BriefDescription": "Bus access - Write"
+  },
+  {,
+    "EventCode": "0xC0",
+    "EventName": "EXT_MEM_REQ",
+    "BriefDescription": "External memory request"
+  },
+  {,
+    "EventCode": "0xC1",
+    "EventName": "EXT_MEM_REQ_NC",
+    "BriefDescription": "Non-cacheable external memory request"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/other.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/other.json
new file mode 100644
index 000000000000..73a22402d003
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/other.json
@@ -0,0 +1,32 @@
+[
+  {,
+    "EventCode": "0x86",
+    "EventName": "EXC_IRQ",
+    "BriefDescription": "Exception taken, IRQ"
+  },
+  {,
+    "EventCode": "0x87",
+    "EventName": "EXC_FIQ",
+    "BriefDescription": "Exception taken, FIQ"
+  },
+  {,
+    "EventCode": "0xC6",
+    "EventName": "PRE_DECODE_ERR",
+    "BriefDescription": "Pre-decode error"
+  },
+  {,
+    "EventCode": "0xD0",
+    "EventName": "L1I_CACHE_ERR",
+    "BriefDescription": "L1 Instruction Cache (data or tag) memory error"
+  },
+  {,
+    "EventCode": "0xD1",
+    "EventName": "L1D_CACHE_ERR",
+    "BriefDescription": "L1 Data Cache (data, tag or dirty) memory error, correctable or non-correctable"
+  },
+  {,
+    "EventCode": "0xD2",
+    "EventName": "TLB_ERR",
+    "BriefDescription": "TLB memory error"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/pipeline.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/pipeline.json
new file mode 100644
index 000000000000..3149fb90555a
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/pipeline.json
@@ -0,0 +1,52 @@
+[
+  {,
+    "EventCode": "0xC7",
+    "EventName": "STALL_SB_FULL",
+    "BriefDescription": "Data Write operation that stalls the pipeline because the store buffer is full"
+  },
+  {,
+    "EventCode": "0xE0",
+    "EventName": "OTHER_IQ_DEP_STALL",
+    "BriefDescription": "Cycles that the DPU IQ is empty and that is not because of a recent micro-TLB miss, instruction cache miss or pre-decode error"
+  },
+  {,
+    "EventCode": "0xE1",
+    "EventName": "IC_DEP_STALL",
+    "BriefDescription": "Cycles the DPU IQ is empty and there is an instruction cache miss being processed"
+  },
+  {,
+    "EventCode": "0xE2",
+    "EventName": "IUTLB_DEP_STALL",
+    "BriefDescription": "Cycles the DPU IQ is empty and there is an instruction micro-TLB miss being processed"
+  },
+  {,
+    "EventCode": "0xE3",
+    "EventName": "DECODE_DEP_STALL",
+    "BriefDescription": "Cycles the DPU IQ is empty and there is a pre-decode error being processed"
+  },
+  {,
+    "EventCode": "0xE4",
+    "EventName": "OTHER_INTERLOCK_STALL",
+    "BriefDescription": "Cycles there is an interlock other than  Advanced SIMD/Floating-point instructions or load/store instruction"
+  },
+  {,
+    "EventCode": "0xE5",
+    "EventName": "AGU_DEP_STALL",
+    "BriefDescription": "Cycles there is an interlock for a load/store instruction waiting for data to calculate the address in the AGU"
+  },
+  {,
+    "EventCode": "0xE6",
+    "EventName": "SIMD_DEP_STALL",
+    "BriefDescription": "Cycles there is an interlock for an Advanced SIMD/Floating-point operation."
+  },
+  {,
+    "EventCode": "0xE7",
+    "EventName": "LD_DEP_STALL",
+    "BriefDescription": "Cycles there is a stall in the Wr stage because of a load miss"
+  },
+  {,
+    "EventCode": "0xE8",
+    "EventName": "ST_DEP_STALL",
+    "BriefDescription": "Cycles there is a stall in the Wr stage because of a store"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/mapfile.csv b/tools/perf/pmu-events/arch/arm64/mapfile.csv
index 219d6756134e..e61c9ca6cf9e 100644
--- a/tools/perf/pmu-events/arch/arm64/mapfile.csv
+++ b/tools/perf/pmu-events/arch/arm64/mapfile.csv
@@ -13,3 +13,4 @@
 #
 #Family-model,Version,Filename,EventType
 0x00000000420f5160,v1,cavium,core
+0x00000000410fd03[[:xdigit:]],v1,cortex-a53,core
diff --git a/tools/perf/tests/backward-ring-buffer.c b/tools/perf/tests/backward-ring-buffer.c
index 4035d43523c3..e0b1b414d466 100644
--- a/tools/perf/tests/backward-ring-buffer.c
+++ b/tools/perf/tests/backward-ring-buffer.c
@@ -31,10 +31,12 @@ static int count_samples(struct perf_evlist *evlist, int *sample_count,
         int i;
 
         for (i = 0; i < evlist->nr_mmaps; i++) {
+                struct perf_mmap *map = &evlist->overwrite_mmap[i];
                 union perf_event *event;
+                u64 start, end;
 
-                perf_mmap__read_catchup(&evlist->overwrite_mmap[i]);
-                while ((event = perf_mmap__read_backward(&evlist->overwrite_mmap[i])) != NULL) {
+                perf_mmap__read_init(map, true, &start, &end);
+                while ((event = perf_mmap__read_event(map, true, &start, end)) != NULL) {
                         const u32 type = event->header.type;
 
                         switch (type) {
@@ -49,6 +51,7 @@ static int count_samples(struct perf_evlist *evlist, int *sample_count,
                                 return TEST_FAIL;
                         }
                 }
+                perf_mmap__read_done(map);
         }
         return TEST_OK;
 }
diff --git a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
index 8b3da21a08f1..c446c894b297 100755
--- a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
+++ b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
@@ -22,10 +22,23 @@ trace_libc_inet_pton_backtrace() {
         expected[4]="rtt min.*"
         expected[5]="[0-9]+\.[0-9]+[[:space:]]+probe_libc:inet_pton:\([[:xdigit:]]+\)"
         expected[6]=".*inet_pton[[:space:]]\($libc\)$"
-        expected[7]="getaddrinfo[[:space:]]\($libc\)$"
-        expected[8]=".*\(.*/bin/ping.*\)$"
-
-        perf trace --no-syscalls -e probe_libc:inet_pton/max-stack=3/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do
+        case "$(uname -m)" in
+        s390x)
+                eventattr='call-graph=dwarf'
+                expected[7]="gaih_inet[[:space:]]\(inlined\)$"
+                expected[8]="__GI_getaddrinfo[[:space:]]\(inlined\)$"
+                expected[9]="main[[:space:]]\(.*/bin/ping.*\)$"
+                expected[10]="__libc_start_main[[:space:]]\($libc\)$"
+                expected[11]="_start[[:space:]]\(.*/bin/ping.*\)$"
+                ;;
+        *)
+                eventattr='max-stack=3'
+                expected[7]="getaddrinfo[[:space:]]\($libc\)$"
+                expected[8]=".*\(.*/bin/ping.*\)$"
+                ;;
+        esac
+
+        perf trace --no-syscalls -e probe_libc:inet_pton/$eventattr/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do
                 echo $line
                 echo "$line" | egrep -q "${expected[$idx]}"
                 if [ $? -ne 0 ] ; then
@@ -33,7 +46,7 @@ trace_libc_inet_pton_backtrace() {
                         exit 1
                 fi
                 let idx+=1
-                [ $idx -eq 9 ] && break
+                [ -z "${expected[$idx]}" ] && break
         done
 }
 
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index 68146f4620a5..6495ee55d9c3 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -608,7 +608,8 @@ static int hist_browser__title(struct hist_browser *browser, char *bf, size_t si
         return browser->title ? browser->title(browser, bf, size) : 0;
 }
 
-int hist_browser__run(struct hist_browser *browser, const char *help)
+int hist_browser__run(struct hist_browser *browser, const char *help,
+                      bool warn_lost_event)
 {
         int key;
         char title[160];
@@ -638,8 +639,9 @@ int hist_browser__run(struct hist_browser *browser, const char *help)
                         nr_entries = hist_browser__nr_entries(browser);
                         ui_browser__update_nr_entries(&browser->b, nr_entries);
 
-                        if (browser->hists->stats.nr_lost_warned !=
-                            browser->hists->stats.nr_events[PERF_RECORD_LOST]) {
+                        if (warn_lost_event &&
+                            (browser->hists->stats.nr_lost_warned !=
+                            browser->hists->stats.nr_events[PERF_RECORD_LOST])) {
                                 browser->hists->stats.nr_lost_warned =
                                         browser->hists->stats.nr_events[PERF_RECORD_LOST];
                                 ui_browser__warn_lost_events(&browser->b);
@@ -2763,7 +2765,8 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                                     bool left_exits,
                                     struct hist_browser_timer *hbt,
                                     float min_pcnt,
-                                    struct perf_env *env)
+                                    struct perf_env *env,
+                                    bool warn_lost_event)
 {
         struct hists *hists = evsel__hists(evsel);
         struct hist_browser *browser = perf_evsel_browser__new(evsel, hbt, env);
@@ -2844,7 +2847,8 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
 
                 nr_options = 0;
 
-                key = hist_browser__run(browser, helpline);
+                key = hist_browser__run(browser, helpline,
+                                        warn_lost_event);
 
                 if (browser->he_selection != NULL) {
                         thread = hist_browser__selected_thread(browser);
@@ -3184,7 +3188,8 @@ static void perf_evsel_menu__write(struct ui_browser *browser,
 
 static int perf_evsel_menu__run(struct perf_evsel_menu *menu,
                                 int nr_events, const char *help,
-                                struct hist_browser_timer *hbt)
+                                struct hist_browser_timer *hbt,
+                                bool warn_lost_event)
 {
         struct perf_evlist *evlist = menu->b.priv;
         struct perf_evsel *pos;
@@ -3203,7 +3208,9 @@ static int perf_evsel_menu__run(struct perf_evsel_menu *menu,
                 case K_TIMER:
                         hbt->timer(hbt->arg);
 
-                        if (!menu->lost_events_warned && menu->lost_events) {
+                        if (!menu->lost_events_warned &&
+                            menu->lost_events &&
+                            warn_lost_event) {
                                 ui_browser__warn_lost_events(&menu->b);
                                 menu->lost_events_warned = true;
                         }
@@ -3224,7 +3231,8 @@ browse_hists:
                         key = perf_evsel__hists_browse(pos, nr_events, help,
                                                        true, hbt,
                                                        menu->min_pcnt,
-                                                       menu->env);
+                                                       menu->env,
+                                                       warn_lost_event);
                         ui_browser__show_title(&menu->b, title);
                         switch (key) {
                         case K_TAB:
@@ -3282,7 +3290,8 @@ static int __perf_evlist__tui_browse_hists(struct perf_evlist *evlist,
                                            int nr_entries, const char *help,
                                            struct hist_browser_timer *hbt,
                                            float min_pcnt,
-                                           struct perf_env *env)
+                                           struct perf_env *env,
+                                           bool warn_lost_event)
 {
         struct perf_evsel *pos;
         struct perf_evsel_menu menu = {
@@ -3309,13 +3318,15 @@ static int __perf_evlist__tui_browse_hists(struct perf_evlist *evlist,
                         menu.b.width = line_len;
         }
 
-        return perf_evsel_menu__run(&menu, nr_entries, help, hbt);
+        return perf_evsel_menu__run(&menu, nr_entries, help,
+                                    hbt, warn_lost_event);
 }
 
 int perf_evlist__tui_browse_hists(struct perf_evlist *evlist, const char *help,
                                   struct hist_browser_timer *hbt,
                                   float min_pcnt,
-                                  struct perf_env *env)
+                                  struct perf_env *env,
+                                  bool warn_lost_event)
 {
         int nr_entries = evlist->nr_entries;
 
@@ -3325,7 +3336,7 @@ single_entry:
 
                 return perf_evsel__hists_browse(first, nr_entries, help,
                                                 false, hbt, min_pcnt,
-                                                env);
+                                                env, warn_lost_event);
         }
 
         if (symbol_conf.event_group) {
@@ -3342,5 +3353,6 @@ single_entry:
         }
 
         return __perf_evlist__tui_browse_hists(evlist, nr_entries, help,
-                                               hbt, min_pcnt, env);
+                                               hbt, min_pcnt, env,
+                                               warn_lost_event);
 }
diff --git a/tools/perf/ui/browsers/hists.h b/tools/perf/ui/browsers/hists.h
index ba431777f559..9428bee076f2 100644
--- a/tools/perf/ui/browsers/hists.h
+++ b/tools/perf/ui/browsers/hists.h
@@ -28,7 +28,8 @@ struct hist_browser {
 
 struct hist_browser *hist_browser__new(struct hists *hists);
 void hist_browser__delete(struct hist_browser *browser);
-int hist_browser__run(struct hist_browser *browser, const char *help);
+int hist_browser__run(struct hist_browser *browser, const char *help,
+                      bool warn_lost_event);
 void hist_browser__init(struct hist_browser *browser,
                         struct hists *hists);
 #endif /* _PERF_UI_BROWSER_HISTS_H_ */
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index ac35cd214feb..e5fc14e53c05 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -715,28 +715,11 @@ union perf_event *perf_evlist__mmap_read_forward(struct perf_evlist *evlist, int
         return perf_mmap__read_forward(md);
 }
 
-union perf_event *perf_evlist__mmap_read_backward(struct perf_evlist *evlist, int idx)
-{
-        struct perf_mmap *md = &evlist->mmap[idx];
-
-        /*
-         * No need to check messup for backward ring buffer:
-         * We can always read arbitrary long data from a backward
-         * ring buffer unless we forget to pause it before reading.
-         */
-        return perf_mmap__read_backward(md);
-}
-
 union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx)
 {
         return perf_evlist__mmap_read_forward(evlist, idx);
 }
 
-void perf_evlist__mmap_read_catchup(struct perf_evlist *evlist, int idx)
-{
-        perf_mmap__read_catchup(&evlist->mmap[idx]);
-}
-
 void perf_evlist__mmap_consume(struct perf_evlist *evlist, int idx)
 {
         perf_mmap__consume(&evlist->mmap[idx], false);
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index 75f8e0ad5d76..336b838e6957 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -133,10 +133,6 @@ union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx);
 
 union perf_event *perf_evlist__mmap_read_forward(struct perf_evlist *evlist,
                                                  int idx);
-union perf_event *perf_evlist__mmap_read_backward(struct perf_evlist *evlist,
-                                                  int idx);
-void perf_evlist__mmap_read_catchup(struct perf_evlist *evlist, int idx);
-
 void perf_evlist__mmap_consume(struct perf_evlist *evlist, int idx);
 
 int perf_evlist__open(struct perf_evlist *evlist);
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index ff359c9ece2e..ef351688b797 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -41,17 +41,7 @@
 
 #include "sane_ctype.h"
 
-static struct {
-        bool sample_id_all;
-        bool exclude_guest;
-        bool mmap2;
-        bool cloexec;
-        bool clockid;
-        bool clockid_wrong;
-        bool lbr_flags;
-        bool write_backward;
-        bool group_read;
-} perf_missing_features;
+struct perf_missing_features perf_missing_features;
 
 static clockid_t clockid;
 
diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
index 846e41644525..a7487c6d1866 100644
--- a/tools/perf/util/evsel.h
+++ b/tools/perf/util/evsel.h
@@ -149,6 +149,20 @@ union u64_swap {
         u32 val32[2];
 };
 
+struct perf_missing_features {
+        bool sample_id_all;
+        bool exclude_guest;
+        bool mmap2;
+        bool cloexec;
+        bool clockid;
+        bool clockid_wrong;
+        bool lbr_flags;
+        bool write_backward;
+        bool group_read;
+};
+
+extern struct perf_missing_features perf_missing_features;
+
 struct cpu_map;
 struct target;
 struct thread_map;
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index f6630cb95eff..02721b579746 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -430,7 +430,8 @@ int hist_entry__tui_annotate(struct hist_entry *he, struct perf_evsel *evsel,
 int perf_evlist__tui_browse_hists(struct perf_evlist *evlist, const char *help,
                                   struct hist_browser_timer *hbt,
                                   float min_pcnt,
-                                  struct perf_env *env);
+                                  struct perf_env *env,
+                                  bool warn_lost_event);
 int script_browse(const char *script_opt);
 #else
 static inline
@@ -438,7 +439,8 @@ int perf_evlist__tui_browse_hists(struct perf_evlist *evlist __maybe_unused,
                                   const char *help __maybe_unused,
                                   struct hist_browser_timer *hbt __maybe_unused,
                                   float min_pcnt __maybe_unused,
-                                  struct perf_env *env __maybe_unused)
+                                  struct perf_env *env __maybe_unused,
+                                  bool warn_lost_event __maybe_unused)
 {
         return 0;
 }
diff --git a/tools/perf/util/mmap.c b/tools/perf/util/mmap.c
index 05076e683938..91531a7c8fbf 100644
--- a/tools/perf/util/mmap.c
+++ b/tools/perf/util/mmap.c
@@ -22,29 +22,27 @@ size_t perf_mmap__mmap_len(struct perf_mmap *map)
 
 /* When check_messup is true, 'end' must points to a good entry */
 static union perf_event *perf_mmap__read(struct perf_mmap *map,
-                                         u64 start, u64 end, u64 *prev)
+                                         u64 *startp, u64 end)
 {
         unsigned char *data = map->base + page_size;
         union perf_event *event = NULL;
-        int diff = end - start;
+        int diff = end - *startp;
 
         if (diff >= (int)sizeof(event->header)) {
                 size_t size;
 
-                event = (union perf_event *)&data[start & map->mask];
+                event = (union perf_event *)&data[*startp & map->mask];
                 size = event->header.size;
 
-                if (size < sizeof(event->header) || diff < (int)size) {
-                        event = NULL;
-                        goto broken_event;
-                }
+                if (size < sizeof(event->header) || diff < (int)size)
+                        return NULL;
 
                 /*
                  * Event straddles the mmap boundary -- header should always
                  * be inside due to u64 alignment of output.
                  */
-                if ((start & map->mask) + size != ((start + size) & map->mask)) {
-                        unsigned int offset = start;
+                if ((*startp & map->mask) + size != ((*startp + size) & map->mask)) {
+                        unsigned int offset = *startp;
                         unsigned int len = min(sizeof(*event), size), cpy;
                         void *dst = map->event_copy;
 
@@ -59,20 +57,19 @@ static union perf_event *perf_mmap__read(struct perf_mmap *map,
                         event = (union perf_event *)map->event_copy;
                 }
 
-                start += size;
+                *startp += size;
         }
 
-broken_event:
-        if (prev)
-                *prev = start;
-
         return event;
 }
 
+/*
+ * legacy interface for mmap read.
+ * Don't use it. Use perf_mmap__read_event().
+ */
 union perf_event *perf_mmap__read_forward(struct perf_mmap *map)
 {
         u64 head;
-        u64 old = map->prev;
 
         /*
          * Check if event was unmapped due to a POLLHUP/POLLERR.
@@ -82,13 +79,26 @@ union perf_event *perf_mmap__read_forward(struct perf_mmap *map)
 
         head = perf_mmap__read_head(map);
 
-        return perf_mmap__read(map, old, head, &map->prev);
+        return perf_mmap__read(map, &map->prev, head);
 }
 
-union perf_event *perf_mmap__read_backward(struct perf_mmap *map)
+/*
+ * Read event from ring buffer one by one.
+ * Return one event for each call.
+ *
+ * Usage:
+ * perf_mmap__read_init()
+ * while(event = perf_mmap__read_event()) {
+ *      //process the event
+ *      perf_mmap__consume()
+ * }
+ * perf_mmap__read_done()
+ */
+union perf_event *perf_mmap__read_event(struct perf_mmap *map,
+                                        bool overwrite,
+                                        u64 *startp, u64 end)
 {
-        u64 head, end;
-        u64 start = map->prev;
+        union perf_event *event;
 
         /*
          * Check if event was unmapped due to a POLLHUP/POLLERR.
@@ -96,40 +106,19 @@ union perf_event *perf_mmap__read_backward(struct perf_mmap *map)
         if (!refcount_read(&map->refcnt))
                 return NULL;
 
-        head = perf_mmap__read_head(map);
-        if (!head)
+        if (startp == NULL)
                 return NULL;
 
-        /*
-         * 'head' pointer starts from 0. Kernel minus sizeof(record) form
-         * it each time when kernel writes to it, so in fact 'head' is
-         * negative. 'end' pointer is made manually by adding the size of
-         * the ring buffer to 'head' pointer, means the validate data can
-         * read is the whole ring buffer. If 'end' is positive, the ring
-         * buffer has not fully filled, so we must adjust 'end' to 0.
-         *
-         * However, since both 'head' and 'end' is unsigned, we can't
-         * simply compare 'end' against 0. Here we compare '-head' and
-         * the size of the ring buffer, where -head is the number of bytes
-         * kernel write to the ring buffer.
-         */
-        if (-head < (u64)(map->mask + 1))
-                end = 0;
-        else
-                end = head + map->mask + 1;
-
-        return perf_mmap__read(map, start, end, &map->prev);
-}
+        /* non-overwirte doesn't pause the ringbuffer */
+        if (!overwrite)
+                end = perf_mmap__read_head(map);
 
-void perf_mmap__read_catchup(struct perf_mmap *map)
-{
-        u64 head;
+        event = perf_mmap__read(map, startp, end);
 
-        if (!refcount_read(&map->refcnt))
-                return;
+        if (!overwrite)
+                map->prev = *startp;
 
-        head = perf_mmap__read_head(map);
-        map->prev = head;
+        return event;
 }
 
 static bool perf_mmap__empty(struct perf_mmap *map)
@@ -267,41 +256,60 @@ static int overwrite_rb_find_range(void *buf, int mask, u64 head, u64 *start, u6
         return -1;
 }
 
-int perf_mmap__push(struct perf_mmap *md, bool overwrite,
-                    void *to, int push(void *to, void *buf, size_t size))
+/*
+ * Report the start and end of the available data in ringbuffer
+ */
+int perf_mmap__read_init(struct perf_mmap *md, bool overwrite,
+                         u64 *startp, u64 *endp)
 {
         u64 head = perf_mmap__read_head(md);
         u64 old = md->prev;
-        u64 end = head, start = old;
         unsigned char *data = md->base + page_size;
         unsigned long size;
-        void *buf;
-        int rc = 0;
 
-        start = overwrite ? head : old;
-        end = overwrite ? old : head;
+        *startp = overwrite ? head : old;
+        *endp = overwrite ? old : head;
 
-        if (start == end)
-                return 0;
+        if (*startp == *endp)
+                return -EAGAIN;
 
-        size = end - start;
+        size = *endp - *startp;
         if (size > (unsigned long)(md->mask) + 1) {
                 if (!overwrite) {
                         WARN_ONCE(1, "failed to keep up with mmap data. (warn only once)\n");
 
                         md->prev = head;
                         perf_mmap__consume(md, overwrite);
-                        return 0;
+                        return -EAGAIN;
                 }
 
                 /*
                  * Backward ring buffer is full. We still have a chance to read
                  * most of data from it.
                  */
-                if (overwrite_rb_find_range(data, md->mask, head, &start, &end))
-                        return -1;
+                if (overwrite_rb_find_range(data, md->mask, head, startp, endp))
+                        return -EINVAL;
         }
 
+        return 0;
+}
+
+int perf_mmap__push(struct perf_mmap *md, bool overwrite,
+                    void *to, int push(void *to, void *buf, size_t size))
+{
+        u64 head = perf_mmap__read_head(md);
+        u64 end, start;
+        unsigned char *data = md->base + page_size;
+        unsigned long size;
+        void *buf;
+        int rc = 0;
+
+        rc = perf_mmap__read_init(md, overwrite, &start, &end);
+        if (rc < 0)
+                return (rc == -EAGAIN) ? 0 : -1;
+
+        size = end - start;
+
         if ((start & md->mask) + size != (end & md->mask)) {
                 buf = &data[start & md->mask];
                 size = md->mask + 1 - (start & md->mask);
@@ -327,3 +335,14 @@ int perf_mmap__push(struct perf_mmap *md, bool overwrite,
 out:
         return rc;
 }
+
+/*
+ * Mandatory for overwrite mode
+ * The direction of overwrite mode is backward.
+ * The last perf_mmap__read() will set tail to map->prev.
+ * Need to correct the map->prev to head which is the end of next read.
+ */
+void perf_mmap__read_done(struct perf_mmap *map)
+{
+        map->prev = perf_mmap__read_head(map);
+}
diff --git a/tools/perf/util/mmap.h b/tools/perf/util/mmap.h
index e43d7b55a55f..ec7d3a24e276 100644
--- a/tools/perf/util/mmap.h
+++ b/tools/perf/util/mmap.h
@@ -65,8 +65,6 @@ void perf_mmap__put(struct perf_mmap *map);
 
 void perf_mmap__consume(struct perf_mmap *map, bool overwrite);
 
-void perf_mmap__read_catchup(struct perf_mmap *md);
-
 static inline u64 perf_mmap__read_head(struct perf_mmap *mm)
 {
         struct perf_event_mmap_page *pc = mm->base;
@@ -87,11 +85,17 @@ static inline void perf_mmap__write_tail(struct perf_mmap *md, u64 tail)
 }
 
 union perf_event *perf_mmap__read_forward(struct perf_mmap *map);
-union perf_event *perf_mmap__read_backward(struct perf_mmap *map);
+
+union perf_event *perf_mmap__read_event(struct perf_mmap *map,
+                                        bool overwrite,
+                                        u64 *startp, u64 end);
 
 int perf_mmap__push(struct perf_mmap *md, bool backward,
                     void *to, int push(void *to, void *buf, size_t size));
 
 size_t perf_mmap__mmap_len(struct perf_mmap *map);
 
+int perf_mmap__read_init(struct perf_mmap *md, bool overwrite,
+                         u64 *startp, u64 *endp);
+void perf_mmap__read_done(struct perf_mmap *map);
 #endif /*__PERF_MMAP_H */
diff --git a/tools/perf/util/util.c b/tools/perf/util/util.c
index 443892dabedb..1019bbc5dbd8 100644
--- a/tools/perf/util/util.c
+++ b/tools/perf/util/util.c
@@ -340,35 +340,15 @@ size_t hex_width(u64 v)
         return n;
 }
 
-static int hex(char ch)
-{
-        if ((ch >= '0') && (ch <= '9'))
-                return ch - '0';
-        if ((ch >= 'a') && (ch <= 'f'))
-                return ch - 'a' + 10;
-        if ((ch >= 'A') && (ch <= 'F'))
-                return ch - 'A' + 10;
-        return -1;
-}
-
 /*
  * While we find nice hex chars, build a long_val.
  * Return number of chars processed.
  */
 int hex2u64(const char *ptr, u64 *long_val)
 {
-        const char *p = ptr;
-        *long_val = 0;
-
-        while (*p) {
-                const int hex_val = hex(*p);
+        char *p;
 
-                if (hex_val < 0)
-                        break;
-
-                *long_val = (*long_val << 4) | hex_val;
-                p++;
-        }
+        *long_val = strtoull(ptr, &p, 16);
 
         return p - ptr;
 }
diff --git a/tools/power/acpi/Makefile.config b/tools/power/acpi/Makefile.config
index a1883bbb0144..2cccbba64418 100644
--- a/tools/power/acpi/Makefile.config
+++ b/tools/power/acpi/Makefile.config
@@ -56,9 +56,6 @@ INSTALL_SCRIPT = ${INSTALL_PROGRAM}
 # to compile vs uClibc, that can be done here as well.
 CROSS = #/usr/i386-linux-uclibc/usr/bin/i386-uclibc-
 CROSS_COMPILE ?= $(CROSS)
-CC = $(CROSS_COMPILE)gcc
-LD = $(CROSS_COMPILE)gcc
-STRIP = $(CROSS_COMPILE)strip
 HOSTCC = gcc
 
 # check if compiler option is supported
diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include
index fcb3ed0be5f8..dd614463d4d6 100644
--- a/tools/scripts/Makefile.include
+++ b/tools/scripts/Makefile.include
@@ -42,6 +42,24 @@ EXTRA_WARNINGS += -Wformat
 
 CC_NO_CLANG := $(shell $(CC) -dM -E -x c /dev/null | grep -Fq "__clang__"; echo $$?)
 
+# Makefiles suck: This macro sets a default value of $(2) for the
+# variable named by $(1), unless the variable has been set by
+# environment or command line. This is necessary for CC and AR
+# because make sets default values, so the simpler ?= approach
+# won't work as expected.
+define allow-override
+  $(if $(or $(findstring environment,$(origin $(1))),\
+            $(findstring command line,$(origin $(1)))),,\
+    $(eval $(1) = $(2)))
+endef
+
+# Allow setting various cross-compile vars or setting CROSS_COMPILE as a prefix.
+$(call allow-override,CC,$(CROSS_COMPILE)gcc)
+$(call allow-override,AR,$(CROSS_COMPILE)ar)
+$(call allow-override,LD,$(CROSS_COMPILE)ld)
+$(call allow-override,CXX,$(CROSS_COMPILE)g++)
+$(call allow-override,STRIP,$(CROSS_COMPILE)strip)
+
 ifeq ($(CC_NO_CLANG), 1)
 EXTRA_WARNINGS += -Wstrict-aliasing=3
 endif
diff --git a/tools/spi/Makefile b/tools/spi/Makefile
index 90615e10c79a..815d15589177 100644
--- a/tools/spi/Makefile
+++ b/tools/spi/Makefile
@@ -11,8 +11,6 @@ endif
 # (this improves performance and avoids hard-to-debug behaviour);
 MAKEFLAGS += -r
 
-CC = $(CROSS_COMPILE)gcc
-LD = $(CROSS_COMPILE)ld
 CFLAGS += -O2 -Wall -g -D_GNU_SOURCE -I$(OUTPUT)include
 
 ALL_TARGETS := spidev_test spidev_fdx
diff --git a/tools/testing/selftests/memfd/Makefile b/tools/testing/selftests/memfd/Makefile
index a5276a91dfbf..0862e6f47a38 100644
--- a/tools/testing/selftests/memfd/Makefile
+++ b/tools/testing/selftests/memfd/Makefile
@@ -5,6 +5,7 @@ CFLAGS += -I../../../../include/
 CFLAGS += -I../../../../usr/include/
 
 TEST_PROGS := run_tests.sh
+TEST_FILES := run_fuse_test.sh
 TEST_GEN_FILES := memfd_test fuse_mnt fuse_test
 
 fuse_mnt.o: CFLAGS += $(shell pkg-config fuse --cflags)
diff --git a/tools/usb/Makefile b/tools/usb/Makefile
index 4e6506078494..01d758d73b6d 100644
--- a/tools/usb/Makefile
+++ b/tools/usb/Makefile
@@ -1,7 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 # Makefile for USB tools
 
-CC = $(CROSS_COMPILE)gcc
 PTHREAD_LIBS = -lpthread
 WARNINGS = -Wall -Wextra
 CFLAGS = $(WARNINGS) -g -I../include
diff --git a/tools/vm/Makefile b/tools/vm/Makefile
index be320b905ea7..20f6cf04377f 100644
--- a/tools/vm/Makefile
+++ b/tools/vm/Makefile
@@ -6,7 +6,6 @@ TARGETS=page-types slabinfo page_owner_sort
 LIB_DIR = ../lib/api
 LIBS = $(LIB_DIR)/libapi.a
 
-CC = $(CROSS_COMPILE)gcc
 CFLAGS = -Wall -Wextra -I../lib/
 LDFLAGS = $(LIBS)
 
diff --git a/tools/wmi/Makefile b/tools/wmi/Makefile
index e664f1167388..e0e87239126b 100644
--- a/tools/wmi/Makefile
+++ b/tools/wmi/Makefile
@@ -2,7 +2,6 @@ PREFIX ?= /usr
 SBINDIR ?= sbin
 INSTALL ?= install
 CFLAGS += -D__EXPORTED_HEADERS__ -I../../include/uapi -I../../include
-CC = $(CROSS_COMPILE)gcc
 
 TARGET = dell-smbios-example