383 files changed, 4701 insertions, 3069 deletions

diff --git a/.gitignore b/.gitignore
index 705e09913dc2..1be78fd8163b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -127,3 +127,7 @@ all.config
 
 # Kdevelop4
 *.kdev4
+
+#Automatically generated by ASN.1 compiler
+net/ipv4/netfilter/nf_nat_snmp_basic-asn1.c
+net/ipv4/netfilter/nf_nat_snmp_basic-asn1.h
diff --git a/Documentation/ABI/testing/sysfs-devices-platform-dock b/Documentation/ABI/testing/sysfs-devices-platform-dock
new file mode 100644
index 000000000000..1d8c18f905c7
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-devices-platform-dock
@@ -0,0 +1,39 @@
+What:           /sys/devices/platform/dock.N/docked
+Date:           Dec, 2006
+KernelVersion:  2.6.19
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Value 1 or 0 indicates whether the software believes the
+                laptop is docked in a docking station.
+
+What:           /sys/devices/platform/dock.N/undock
+Date:           Dec, 2006
+KernelVersion:  2.6.19
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (WO) Writing to this file causes the software to initiate an
+                undock request to the firmware.
+
+What:           /sys/devices/platform/dock.N/uid
+Date:           Feb, 2007
+KernelVersion:  v2.6.21
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Displays the docking station the laptop is docked to.
+
+What:           /sys/devices/platform/dock.N/flags
+Date:           May, 2007
+KernelVersion:  v2.6.21
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Show dock station flags, useful for checking if undock
+                request has been made by the user (from the immediate_undock
+                option).
+
+What:           /sys/devices/platform/dock.N/type
+Date:           Aug, 2008
+KernelVersion:  v2.6.27
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Display the dock station type- dock_station, ata_bay or
+                battery_bay.
diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
index bfd29bc8d37a..4ed63b6cfb15 100644
--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
@@ -108,6 +108,8 @@ Description:	CPU topology files that describe a logical CPU's relationship
 
 What:           /sys/devices/system/cpu/cpuidle/current_driver
                 /sys/devices/system/cpu/cpuidle/current_governer_ro
+                /sys/devices/system/cpu/cpuidle/available_governors
+                /sys/devices/system/cpu/cpuidle/current_governor
 Date:           September 2007
 Contact:        Linux kernel mailing list <linux-kernel@vger.kernel.org>
 Description:    Discover cpuidle policy and mechanism
@@ -119,13 +121,84 @@ Description:	Discover cpuidle policy and mechanism
                 Idle policy (governor) is differentiated from idle mechanism
                 (driver)
 
-                current_driver: displays current idle mechanism
+                current_driver: (RO) displays current idle mechanism
 
-                current_governor_ro: displays current idle policy
+                current_governor_ro: (RO) displays current idle policy
+
+                With the cpuidle_sysfs_switch boot option enabled (meant for
+                developer testing), the following three attributes are visible
+                instead:
+
+                current_driver: same as described above
+
+                available_governors: (RO) displays a space separated list of
+                available governors
+
+                current_governor: (RW) displays current idle policy. Users can
+                switch the governor at runtime by writing to this file.
 
                 See files in Documentation/cpuidle/ for more information.
 
 
+What:           /sys/devices/system/cpu/cpuX/cpuidle/stateN/name
+                /sys/devices/system/cpu/cpuX/cpuidle/stateN/latency
+                /sys/devices/system/cpu/cpuX/cpuidle/stateN/power
+                /sys/devices/system/cpu/cpuX/cpuidle/stateN/time
+                /sys/devices/system/cpu/cpuX/cpuidle/stateN/usage
+Date:           September 2007
+KernelVersion:  v2.6.24
+Contact:        Linux power management list <linux-pm@vger.kernel.org>
+Description:
+                The directory /sys/devices/system/cpu/cpuX/cpuidle contains per
+                logical CPU specific cpuidle information for each online cpu X.
+                The processor idle states which are available for use have the
+                following attributes:
+
+                name: (RO) Name of the idle state (string).
+
+                latency: (RO) The latency to exit out of this idle state (in
+                microseconds).
+
+                power: (RO) The power consumed while in this idle state (in
+                milliwatts).
+
+                time: (RO) The total time spent in this idle state (in microseconds).
+
+                usage: (RO) Number of times this state was entered (a count).
+
+
+What:           /sys/devices/system/cpu/cpuX/cpuidle/stateN/desc
+Date:           February 2008
+KernelVersion:  v2.6.25
+Contact:        Linux power management list <linux-pm@vger.kernel.org>
+Description:
+                (RO) A small description about the idle state (string).
+
+
+What:           /sys/devices/system/cpu/cpuX/cpuidle/stateN/disable
+Date:           March 2012
+KernelVersion:  v3.10
+Contact:        Linux power management list <linux-pm@vger.kernel.org>
+Description:
+                (RW) Option to disable this idle state (bool). The behavior and
+                the effect of the disable variable depends on the implementation
+                of a particular governor. In the ladder governor, for example,
+                it is not coherent, i.e. if one is disabling a light state, then
+                all deeper states are disabled as well, but the disable variable
+                does not reflect it. Likewise, if one enables a deep state but a
+                lighter state still is disabled, then this has no effect.
+
+
+What:           /sys/devices/system/cpu/cpuX/cpuidle/stateN/residency
+Date:           March 2014
+KernelVersion:  v3.15
+Contact:        Linux power management list <linux-pm@vger.kernel.org>
+Description:
+                (RO) Display the target residency i.e. the minimum amount of
+                time (in microseconds) this cpu should spend in this idle state
+                to make the transition worth the effort.
+
+
 What:           /sys/devices/system/cpu/cpu#/cpufreq/*
 Date:           pre-git history
 Contact:        linux-pm@vger.kernel.org
diff --git a/Documentation/ABI/testing/sysfs-platform-dptf b/Documentation/ABI/testing/sysfs-platform-dptf
new file mode 100644
index 000000000000..325dc0667dbb
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-platform-dptf
@@ -0,0 +1,40 @@
+What:           /sys/bus/platform/devices/INT3407:00/dptf_power/charger_type
+Date:           Jul, 2016
+KernelVersion:  v4.10
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) The charger type - Traditional, Hybrid or NVDC.
+
+What:           /sys/bus/platform/devices/INT3407:00/dptf_power/adapter_rating_mw
+Date:           Jul, 2016
+KernelVersion:  v4.10
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Adapter rating in milliwatts (the maximum Adapter power).
+                Must be 0 if no AC Adaptor is plugged in.
+
+What:           /sys/bus/platform/devices/INT3407:00/dptf_power/max_platform_power_mw
+Date:           Jul, 2016
+KernelVersion:  v4.10
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Maximum platform power that can be supported by the battery
+                in milliwatts.
+
+What:           /sys/bus/platform/devices/INT3407:00/dptf_power/platform_power_source
+Date:           Jul, 2016
+KernelVersion:  v4.10
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Display the platform power source
+                0x00 = DC
+                0x01 = AC
+                0x02 = USB
+                0x03 = Wireless Charger
+
+What:           /sys/bus/platform/devices/INT3407:00/dptf_power/battery_steady_power
+Date:           Jul, 2016
+KernelVersion:  v4.10
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) The maximum sustained power for battery in milliwatts.
diff --git a/Documentation/atomic_bitops.txt b/Documentation/atomic_bitops.txt
index 5550bfdcce5f..be70b32c95d9 100644
--- a/Documentation/atomic_bitops.txt
+++ b/Documentation/atomic_bitops.txt
@@ -58,7 +58,12 @@ Like with atomic_t, the rule of thumb is:
 
  - RMW operations that have a return value are fully ordered.
 
-Except for test_and_set_bit_lock() which has ACQUIRE semantics and
+ - RMW operations that are conditional are unordered on FAILURE,
+   otherwise the above rules apply. In the case of test_and_{}_bit() operations,
+   if the bit in memory is unchanged by the operation then it is deemed to have
+   failed.
+
+Except for a successful test_and_set_bit_lock() which has ACQUIRE semantics and
 clear_bit_unlock() which has RELEASE semantics.
 
 Since a platform only has a single means of achieving atomic operations
diff --git a/Documentation/devicetree/bindings/power/mti,mips-cpc.txt b/Documentation/devicetree/bindings/power/mti,mips-cpc.txt
new file mode 100644
index 000000000000..c6b82511ae8a
--- /dev/null
+++ b/Documentation/devicetree/bindings/power/mti,mips-cpc.txt
@@ -0,0 +1,8 @@
+Binding for MIPS Cluster Power Controller (CPC).
+
+This binding allows a system to specify where the CPC registers are
+located.
+
+Required properties:
+compatible : Should be "mti,mips-cpc".
+regs: Should describe the address & size of the CPC register region.
diff --git a/Documentation/features/sched/membarrier-sync-core/arch-support.txt b/Documentation/features/sched/membarrier-sync-core/arch-support.txt
new file mode 100644
index 000000000000..2c815a7f1ba7
--- /dev/null
+++ b/Documentation/features/sched/membarrier-sync-core/arch-support.txt
@@ -0,0 +1,62 @@
+#
+# Feature name:          membarrier-sync-core
+#         Kconfig:       ARCH_HAS_MEMBARRIER_SYNC_CORE
+#         description:   arch supports core serializing membarrier
+#
+# Architecture requirements
+#
+# * arm64
+#
+# Rely on eret context synchronization when returning from IPI handler, and
+# when returning to user-space.
+#
+# * x86
+#
+# x86-32 uses IRET as return from interrupt, which takes care of the IPI.
+# However, it uses both IRET and SYSEXIT to go back to user-space. The IRET
+# instruction is core serializing, but not SYSEXIT.
+#
+# x86-64 uses IRET as return from interrupt, which takes care of the IPI.
+# However, it can return to user-space through either SYSRETL (compat code),
+# SYSRETQ, or IRET.
+#
+# Given that neither SYSRET{L,Q}, nor SYSEXIT, are core serializing, we rely
+# instead on write_cr3() performed by switch_mm() to provide core serialization
+# after changing the current mm, and deal with the special case of kthread ->
+# uthread (temporarily keeping current mm into active_mm) by issuing a
+# sync_core_before_usermode() in that specific case.
+#
+    -----------------------
+    |         arch |status|
+    -----------------------
+    |       alpha: | TODO |
+    |         arc: | TODO |
+    |         arm: | TODO |
+    |       arm64: |  ok  |
+    |    blackfin: | TODO |
+    |         c6x: | TODO |
+    |        cris: | TODO |
+    |         frv: | TODO |
+    |       h8300: | TODO |
+    |     hexagon: | TODO |
+    |        ia64: | TODO |
+    |        m32r: | TODO |
+    |        m68k: | TODO |
+    |       metag: | TODO |
+    |  microblaze: | TODO |
+    |        mips: | TODO |
+    |     mn10300: | TODO |
+    |       nios2: | TODO |
+    |    openrisc: | TODO |
+    |      parisc: | TODO |
+    |     powerpc: | TODO |
+    |        s390: | TODO |
+    |       score: | TODO |
+    |          sh: | TODO |
+    |       sparc: | TODO |
+    |        tile: | TODO |
+    |          um: | TODO |
+    |   unicore32: | TODO |
+    |         x86: |  ok  |
+    |      xtensa: | TODO |
+    -----------------------
diff --git a/Documentation/locking/mutex-design.txt b/Documentation/locking/mutex-design.txt
index 60c482df1a38..818aca19612f 100644
--- a/Documentation/locking/mutex-design.txt
+++ b/Documentation/locking/mutex-design.txt
@@ -21,37 +21,23 @@ Implementation
 --------------
 
 Mutexes are represented by 'struct mutex', defined in include/linux/mutex.h
-and implemented in kernel/locking/mutex.c. These locks use a three
-state atomic counter (->count) to represent the different possible
-transitions that can occur during the lifetime of a lock:
-
-          1: unlocked
-          0: locked, no waiters
-   negative: locked, with potential waiters
-
-In its most basic form it also includes a wait-queue and a spinlock
-that serializes access to it. CONFIG_SMP systems can also include
-a pointer to the lock task owner (->owner) as well as a spinner MCS
-lock (->osq), both described below in (ii).
+and implemented in kernel/locking/mutex.c. These locks use an atomic variable
+(->owner) to keep track of the lock state during its lifetime.  Field owner
+actually contains 'struct task_struct *' to the current lock owner and it is
+therefore NULL if not currently owned. Since task_struct pointers are aligned
+at at least L1_CACHE_BYTES, low bits (3) are used to store extra state (e.g.,
+if waiter list is non-empty).  In its most basic form it also includes a
+wait-queue and a spinlock that serializes access to it. Furthermore,
+CONFIG_MUTEX_SPIN_ON_OWNER=y systems use a spinner MCS lock (->osq), described
+below in (ii).
 
 When acquiring a mutex, there are three possible paths that can be
 taken, depending on the state of the lock:
 
-(i) fastpath: tries to atomically acquire the lock by decrementing the
-    counter. If it was already taken by another task it goes to the next
-    possible path. This logic is architecture specific. On x86-64, the
-    locking fastpath is 2 instructions:
-
-    0000000000000e10 <mutex_lock>:
-    e21:   f0 ff 0b                lock decl (%rbx)
-    e24:   79 08                   jns    e2e <mutex_lock+0x1e>
-
-   the unlocking fastpath is equally tight:
-
-    0000000000000bc0 <mutex_unlock>:
-    bc8:   f0 ff 07                lock incl (%rdi)
-    bcb:   7f 0a                   jg     bd7 <mutex_unlock+0x17>
-
+(i) fastpath: tries to atomically acquire the lock by cmpxchg()ing the owner with
+    the current task. This only works in the uncontended case (cmpxchg() checks
+    against 0UL, so all 3 state bits above have to be 0). If the lock is
+    contended it goes to the next possible path.
 
 (ii) midpath: aka optimistic spinning, tries to spin for acquisition
      while the lock owner is running and there are no other tasks ready
@@ -143,11 +129,10 @@ Test if the mutex is taken:
 Disadvantages
 -------------
 
-Unlike its original design and purpose, 'struct mutex' is larger than
-most locks in the kernel. E.g: on x86-64 it is 40 bytes, almost twice
-as large as 'struct semaphore' (24 bytes) and tied, along with rwsems,
-for the largest lock in the kernel. Larger structure sizes mean more
-CPU cache and memory footprint.
+Unlike its original design and purpose, 'struct mutex' is among the largest
+locks in the kernel. E.g: on x86-64 it is 32 bytes, where 'struct semaphore'
+is 24 bytes and rw_semaphore is 40 bytes. Larger structure sizes mean more CPU
+cache and memory footprint.
 
 When to use mutexes
 -------------------
diff --git a/Documentation/networking/segmentation-offloads.txt b/Documentation/networking/segmentation-offloads.txt
index 2f09455a993a..d47480b61ac6 100644
--- a/Documentation/networking/segmentation-offloads.txt
+++ b/Documentation/networking/segmentation-offloads.txt
@@ -13,6 +13,7 @@ The following technologies are described:
  * Generic Segmentation Offload - GSO
  * Generic Receive Offload - GRO
  * Partial Generic Segmentation Offload - GSO_PARTIAL
+ * SCTP accelleration with GSO - GSO_BY_FRAGS
 
 TCP Segmentation Offload
 ========================
@@ -49,6 +50,10 @@ datagram into multiple IPv4 fragments.  Many of the requirements for UDP
 fragmentation offload are the same as TSO.  However the IPv4 ID for
 fragments should not increment as a single IPv4 datagram is fragmented.
 
+UFO is deprecated: modern kernels will no longer generate UFO skbs, but can
+still receive them from tuntap and similar devices. Offload of UDP-based
+tunnel protocols is still supported.
+
 IPIP, SIT, GRE, UDP Tunnel, and Remote Checksum Offloads
 ========================================================
 
@@ -83,10 +88,10 @@ SKB_GSO_UDP_TUNNEL_CSUM.  These two additional tunnel types reflect the
 fact that the outer header also requests to have a non-zero checksum
 included in the outer header.
 
-Finally there is SKB_GSO_REMCSUM which indicates that a given tunnel header
-has requested a remote checksum offload.  In this case the inner headers
-will be left with a partial checksum and only the outer header checksum
-will be computed.
+Finally there is SKB_GSO_TUNNEL_REMCSUM which indicates that a given tunnel
+header has requested a remote checksum offload.  In this case the inner
+headers will be left with a partial checksum and only the outer header
+checksum will be computed.
 
 Generic Segmentation Offload
 ============================
@@ -128,3 +133,28 @@ values for if the header was simply duplicated.  The one exception to this
 is the outer IPv4 ID field.  It is up to the device drivers to guarantee
 that the IPv4 ID field is incremented in the case that a given header does
 not have the DF bit set.
+
+SCTP accelleration with GSO
+===========================
+
+SCTP - despite the lack of hardware support - can still take advantage of
+GSO to pass one large packet through the network stack, rather than
+multiple small packets.
+
+This requires a different approach to other offloads, as SCTP packets
+cannot be just segmented to (P)MTU. Rather, the chunks must be contained in
+IP segments, padding respected. So unlike regular GSO, SCTP can't just
+generate a big skb, set gso_size to the fragmentation point and deliver it
+to IP layer.
+
+Instead, the SCTP protocol layer builds an skb with the segments correctly
+padded and stored as chained skbs, and skb_segment() splits based on those.
+To signal this, gso_size is set to the special value GSO_BY_FRAGS.
+
+Therefore, any code in the core networking stack must be aware of the
+possibility that gso_size will be GSO_BY_FRAGS and handle that case
+appropriately. (For size checks, the skb_gso_validate_*_len family of
+helpers do this automatically.)
+
+This also affects drivers with the NETIF_F_FRAGLIST & NETIF_F_GSO_SCTP bits
+set. Note also that NETIF_F_GSO_SCTP is included in NETIF_F_GSO_SOFTWARE.
diff --git a/MAINTAINERS b/MAINTAINERS
index 3bdc260e36b7..9a7f76eadae9 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -9206,6 +9206,7 @@ MIPS GENERIC PLATFORM
 M:      Paul Burton <paul.burton@mips.com>
 L:      linux-mips@linux-mips.org
 S:      Supported
+F:      Documentation/devicetree/bindings/power/mti,mips-cpc.txt
 F:      arch/mips/generic/
 F:      arch/mips/tools/generic-board-config.sh
 
@@ -9945,6 +9946,7 @@ F:	drivers/nfc/nxp-nci
 
 OBJTOOL
 M:      Josh Poimboeuf <jpoimboe@redhat.com>
+M:      Peter Zijlstra <peterz@infradead.org>
 S:      Supported
 F:      tools/objtool/
 
diff --git a/Makefile b/Makefile
index 79ad2bfa24b6..d9cf3a40eda9 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 16
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc2
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
index be7bd19c87ec..eda8c5f629fc 100644
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@@ -20,7 +20,7 @@
 
 #define MPIDR_UP_BITMASK        (0x1 << 30)
 #define MPIDR_MT_BITMASK        (0x1 << 24)
-#define MPIDR_HWID_BITMASK      0xff00ffffff
+#define MPIDR_HWID_BITMASK      0xff00ffffffUL
 
 #define MPIDR_LEVEL_BITS_SHIFT  3
 #define MPIDR_LEVEL_BITS        (1 << MPIDR_LEVEL_BITS_SHIFT)
diff --git a/arch/arm64/include/asm/hugetlb.h b/arch/arm64/include/asm/hugetlb.h
index 1dca41bea16a..e73f68569624 100644
--- a/arch/arm64/include/asm/hugetlb.h
+++ b/arch/arm64/include/asm/hugetlb.h
@@ -22,7 +22,7 @@
 
 static inline pte_t huge_ptep_get(pte_t *ptep)
 {
-        return *ptep;
+        return READ_ONCE(*ptep);
 }
 
 
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index 9679067a1574..7faed6e48b46 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -185,42 +185,42 @@ static inline pmd_t kvm_s2pmd_mkexec(pmd_t pmd)
         return pmd;
 }
 
-static inline void kvm_set_s2pte_readonly(pte_t *pte)
+static inline void kvm_set_s2pte_readonly(pte_t *ptep)
 {
         pteval_t old_pteval, pteval;
 
-        pteval = READ_ONCE(pte_val(*pte));
+        pteval = READ_ONCE(pte_val(*ptep));
         do {
                 old_pteval = pteval;
                 pteval &= ~PTE_S2_RDWR;
                 pteval |= PTE_S2_RDONLY;
-                pteval = cmpxchg_relaxed(&pte_val(*pte), old_pteval, pteval);
+                pteval = cmpxchg_relaxed(&pte_val(*ptep), old_pteval, pteval);
         } while (pteval != old_pteval);
 }
 
-static inline bool kvm_s2pte_readonly(pte_t *pte)
+static inline bool kvm_s2pte_readonly(pte_t *ptep)
 {
-        return (pte_val(*pte) & PTE_S2_RDWR) == PTE_S2_RDONLY;
+        return (READ_ONCE(pte_val(*ptep)) & PTE_S2_RDWR) == PTE_S2_RDONLY;
 }
 
-static inline bool kvm_s2pte_exec(pte_t *pte)
+static inline bool kvm_s2pte_exec(pte_t *ptep)
 {
-        return !(pte_val(*pte) & PTE_S2_XN);
+        return !(READ_ONCE(pte_val(*ptep)) & PTE_S2_XN);
 }
 
-static inline void kvm_set_s2pmd_readonly(pmd_t *pmd)
+static inline void kvm_set_s2pmd_readonly(pmd_t *pmdp)
 {
-        kvm_set_s2pte_readonly((pte_t *)pmd);
+        kvm_set_s2pte_readonly((pte_t *)pmdp);
 }
 
-static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
+static inline bool kvm_s2pmd_readonly(pmd_t *pmdp)
 {
-        return kvm_s2pte_readonly((pte_t *)pmd);
+        return kvm_s2pte_readonly((pte_t *)pmdp);
 }
 
-static inline bool kvm_s2pmd_exec(pmd_t *pmd)
+static inline bool kvm_s2pmd_exec(pmd_t *pmdp)
 {
-        return !(pmd_val(*pmd) & PMD_S2_XN);
+        return !(READ_ONCE(pmd_val(*pmdp)) & PMD_S2_XN);
 }
 
 static inline bool kvm_page_empty(void *ptr)
diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
index 8d3331985d2e..39ec0b8a689e 100644
--- a/arch/arm64/include/asm/mmu_context.h
+++ b/arch/arm64/include/asm/mmu_context.h
@@ -141,13 +141,13 @@ static inline void cpu_install_idmap(void)
  * Atomically replaces the active TTBR1_EL1 PGD with a new VA-compatible PGD,
  * avoiding the possibility of conflicting TLB entries being allocated.
  */
-static inline void cpu_replace_ttbr1(pgd_t *pgd)
+static inline void cpu_replace_ttbr1(pgd_t *pgdp)
 {
         typedef void (ttbr_replace_func)(phys_addr_t);
         extern ttbr_replace_func idmap_cpu_replace_ttbr1;
         ttbr_replace_func *replace_phys;
 
-        phys_addr_t pgd_phys = virt_to_phys(pgd);
+        phys_addr_t pgd_phys = virt_to_phys(pgdp);
 
         replace_phys = (void *)__pa_symbol(idmap_cpu_replace_ttbr1);
 
diff --git a/arch/arm64/include/asm/pgalloc.h b/arch/arm64/include/asm/pgalloc.h
index e9d9f1b006ef..2e05bcd944c8 100644
--- a/arch/arm64/include/asm/pgalloc.h
+++ b/arch/arm64/include/asm/pgalloc.h
@@ -36,23 +36,23 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
         return (pmd_t *)__get_free_page(PGALLOC_GFP);
 }
 
-static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+static inline void pmd_free(struct mm_struct *mm, pmd_t *pmdp)
 {
-        BUG_ON((unsigned long)pmd & (PAGE_SIZE-1));
-        free_page((unsigned long)pmd);
+        BUG_ON((unsigned long)pmdp & (PAGE_SIZE-1));
+        free_page((unsigned long)pmdp);
 }
 
-static inline void __pud_populate(pud_t *pud, phys_addr_t pmd, pudval_t prot)
+static inline void __pud_populate(pud_t *pudp, phys_addr_t pmdp, pudval_t prot)
 {
-        set_pud(pud, __pud(__phys_to_pud_val(pmd) | prot));
+        set_pud(pudp, __pud(__phys_to_pud_val(pmdp) | prot));
 }
 
-static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
+static inline void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmdp)
 {
-        __pud_populate(pud, __pa(pmd), PMD_TYPE_TABLE);
+        __pud_populate(pudp, __pa(pmdp), PMD_TYPE_TABLE);
 }
 #else
-static inline void __pud_populate(pud_t *pud, phys_addr_t pmd, pudval_t prot)
+static inline void __pud_populate(pud_t *pudp, phys_addr_t pmdp, pudval_t prot)
 {
         BUILD_BUG();
 }
@@ -65,30 +65,30 @@ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
         return (pud_t *)__get_free_page(PGALLOC_GFP);
 }
 
-static inline void pud_free(struct mm_struct *mm, pud_t *pud)
+static inline void pud_free(struct mm_struct *mm, pud_t *pudp)
 {
-        BUG_ON((unsigned long)pud & (PAGE_SIZE-1));
-        free_page((unsigned long)pud);
+        BUG_ON((unsigned long)pudp & (PAGE_SIZE-1));
+        free_page((unsigned long)pudp);
 }
 
-static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pud, pgdval_t prot)
+static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pudp, pgdval_t prot)
 {
-        set_pgd(pgdp, __pgd(__phys_to_pgd_val(pud) | prot));
+        set_pgd(pgdp, __pgd(__phys_to_pgd_val(pudp) | prot));
 }
 
-static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
+static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgdp, pud_t *pudp)
 {
-        __pgd_populate(pgd, __pa(pud), PUD_TYPE_TABLE);
+        __pgd_populate(pgdp, __pa(pudp), PUD_TYPE_TABLE);
 }
 #else
-static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pud, pgdval_t prot)
+static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pudp, pgdval_t prot)
 {
         BUILD_BUG();
 }
 #endif  /* CONFIG_PGTABLE_LEVELS > 3 */
 
 extern pgd_t *pgd_alloc(struct mm_struct *mm);
-extern void pgd_free(struct mm_struct *mm, pgd_t *pgd);
+extern void pgd_free(struct mm_struct *mm, pgd_t *pgdp);
 
 static inline pte_t *
 pte_alloc_one_kernel(struct mm_struct *mm, unsigned long addr)
@@ -114,10 +114,10 @@ pte_alloc_one(struct mm_struct *mm, unsigned long addr)
 /*
  * Free a PTE table.
  */
-static inline void pte_free_kernel(struct mm_struct *mm, pte_t *pte)
+static inline void pte_free_kernel(struct mm_struct *mm, pte_t *ptep)
 {
-        if (pte)
-                free_page((unsigned long)pte);
+        if (ptep)
+                free_page((unsigned long)ptep);
 }
 
 static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
@@ -126,10 +126,10 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         __free_page(pte);
 }
 
-static inline void __pmd_populate(pmd_t *pmdp, phys_addr_t pte,
+static inline void __pmd_populate(pmd_t *pmdp, phys_addr_t ptep,
                                   pmdval_t prot)
 {
-        set_pmd(pmdp, __pmd(__phys_to_pmd_val(pte) | prot));
+        set_pmd(pmdp, __pmd(__phys_to_pmd_val(ptep) | prot));
 }
 
 /*
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 094374c82db0..7e2c27e63cd8 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -218,7 +218,7 @@ static inline pmd_t pmd_mkcont(pmd_t pmd)
 
 static inline void set_pte(pte_t *ptep, pte_t pte)
 {
-        *ptep = pte;
+        WRITE_ONCE(*ptep, pte);
 
         /*
          * Only if the new pte is valid and kernel, otherwise TLB maintenance
@@ -250,6 +250,8 @@ extern void __sync_icache_dcache(pte_t pteval, unsigned long addr);
 static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
                               pte_t *ptep, pte_t pte)
 {
+        pte_t old_pte;
+
         if (pte_present(pte) && pte_user_exec(pte) && !pte_special(pte))
                 __sync_icache_dcache(pte, addr);
 
@@ -258,14 +260,15 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
          * hardware updates of the pte (ptep_set_access_flags safely changes
          * valid ptes without going through an invalid entry).
          */
-        if (IS_ENABLED(CONFIG_DEBUG_VM) && pte_valid(*ptep) && pte_valid(pte) &&
+        old_pte = READ_ONCE(*ptep);
+        if (IS_ENABLED(CONFIG_DEBUG_VM) && pte_valid(old_pte) && pte_valid(pte) &&
            (mm == current->active_mm || atomic_read(&mm->mm_users) > 1)) {
                 VM_WARN_ONCE(!pte_young(pte),
                              "%s: racy access flag clearing: 0x%016llx -> 0x%016llx",
-                             __func__, pte_val(*ptep), pte_val(pte));
-                VM_WARN_ONCE(pte_write(*ptep) && !pte_dirty(pte),
+                             __func__, pte_val(old_pte), pte_val(pte));
+                VM_WARN_ONCE(pte_write(old_pte) && !pte_dirty(pte),
                              "%s: racy dirty state clearing: 0x%016llx -> 0x%016llx",
-                             __func__, pte_val(*ptep), pte_val(pte));
+                             __func__, pte_val(old_pte), pte_val(pte));
         }
 
         set_pte(ptep, pte);
@@ -431,7 +434,7 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
 
 static inline void set_pmd(pmd_t *pmdp, pmd_t pmd)
 {
-        *pmdp = pmd;
+        WRITE_ONCE(*pmdp, pmd);
         dsb(ishst);
         isb();
 }
@@ -482,7 +485,7 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd)
 
 static inline void set_pud(pud_t *pudp, pud_t pud)
 {
-        *pudp = pud;
+        WRITE_ONCE(*pudp, pud);
         dsb(ishst);
         isb();
 }
@@ -500,7 +503,7 @@ static inline phys_addr_t pud_page_paddr(pud_t pud)
 /* Find an entry in the second-level page table. */
 #define pmd_index(addr)         (((addr) >> PMD_SHIFT) & (PTRS_PER_PMD - 1))
 
-#define pmd_offset_phys(dir, addr)      (pud_page_paddr(*(dir)) + pmd_index(addr) * sizeof(pmd_t))
+#define pmd_offset_phys(dir, addr)      (pud_page_paddr(READ_ONCE(*(dir))) + pmd_index(addr) * sizeof(pmd_t))
 #define pmd_offset(dir, addr)           ((pmd_t *)__va(pmd_offset_phys((dir), (addr))))
 
 #define pmd_set_fixmap(addr)            ((pmd_t *)set_fixmap_offset(FIX_PMD, addr))
@@ -535,7 +538,7 @@ static inline phys_addr_t pud_page_paddr(pud_t pud)
 
 static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
 {
-        *pgdp = pgd;
+        WRITE_ONCE(*pgdp, pgd);
         dsb(ishst);
 }
 
@@ -552,7 +555,7 @@ static inline phys_addr_t pgd_page_paddr(pgd_t pgd)
 /* Find an entry in the frst-level page table. */
 #define pud_index(addr)         (((addr) >> PUD_SHIFT) & (PTRS_PER_PUD - 1))
 
-#define pud_offset_phys(dir, addr)      (pgd_page_paddr(*(dir)) + pud_index(addr) * sizeof(pud_t))
+#define pud_offset_phys(dir, addr)      (pgd_page_paddr(READ_ONCE(*(dir))) + pud_index(addr) * sizeof(pud_t))
 #define pud_offset(dir, addr)           ((pud_t *)__va(pud_offset_phys((dir), (addr))))
 
 #define pud_set_fixmap(addr)            ((pud_t *)set_fixmap_offset(FIX_PUD, addr))
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 07823595b7f0..52f15cd896e1 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -408,6 +408,15 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
         },
         {
                 .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
+                MIDR_ALL_VERSIONS(MIDR_QCOM_FALKOR),
+                .enable = qcom_enable_link_stack_sanitization,
+        },
+        {
+                .capability = ARM64_HARDEN_BP_POST_GUEST_EXIT,
+                MIDR_ALL_VERSIONS(MIDR_QCOM_FALKOR),
+        },
+        {
+                .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
                 MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
                 .enable = enable_smccc_arch_workaround_1,
         },
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index f85ac58d08a3..a8bf1c892b90 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -90,7 +90,7 @@ static int __init set_permissions(pte_t *ptep, pgtable_t token,
                                   unsigned long addr, void *data)
 {
         efi_memory_desc_t *md = data;
-        pte_t pte = *ptep;
+        pte_t pte = READ_ONCE(*ptep);
 
         if (md->attribute & EFI_MEMORY_RO)
                 pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index f20cf7e99249..1ec5f28c39fc 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -202,10 +202,10 @@ static int create_safe_exec_page(void *src_start, size_t length,
                                  gfp_t mask)
 {
         int rc = 0;
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
+        pgd_t *pgdp;
+        pud_t *pudp;
+        pmd_t *pmdp;
+        pte_t *ptep;
         unsigned long dst = (unsigned long)allocator(mask);
 
         if (!dst) {
@@ -216,38 +216,38 @@ static int create_safe_exec_page(void *src_start, size_t length,
         memcpy((void *)dst, src_start, length);
         flush_icache_range(dst, dst + length);
 
-        pgd = pgd_offset_raw(allocator(mask), dst_addr);
-        if (pgd_none(*pgd)) {
-                pud = allocator(mask);
-                if (!pud) {
+        pgdp = pgd_offset_raw(allocator(mask), dst_addr);
+        if (pgd_none(READ_ONCE(*pgdp))) {
+                pudp = allocator(mask);
+                if (!pudp) {
                         rc = -ENOMEM;
                         goto out;
                 }
-                pgd_populate(&init_mm, pgd, pud);
+                pgd_populate(&init_mm, pgdp, pudp);
         }
 
-        pud = pud_offset(pgd, dst_addr);
-        if (pud_none(*pud)) {
-                pmd = allocator(mask);
-                if (!pmd) {
+        pudp = pud_offset(pgdp, dst_addr);
+        if (pud_none(READ_ONCE(*pudp))) {
+                pmdp = allocator(mask);
+                if (!pmdp) {
                         rc = -ENOMEM;
                         goto out;
                 }
-                pud_populate(&init_mm, pud, pmd);
+                pud_populate(&init_mm, pudp, pmdp);
         }
 
-        pmd = pmd_offset(pud, dst_addr);
-        if (pmd_none(*pmd)) {
-                pte = allocator(mask);
-                if (!pte) {
+        pmdp = pmd_offset(pudp, dst_addr);
+        if (pmd_none(READ_ONCE(*pmdp))) {
+                ptep = allocator(mask);
+                if (!ptep) {
                         rc = -ENOMEM;
                         goto out;
                 }
-                pmd_populate_kernel(&init_mm, pmd, pte);
+                pmd_populate_kernel(&init_mm, pmdp, ptep);
         }
 
-        pte = pte_offset_kernel(pmd, dst_addr);
-        set_pte(pte, pfn_pte(virt_to_pfn(dst), PAGE_KERNEL_EXEC));
+        ptep = pte_offset_kernel(pmdp, dst_addr);
+        set_pte(ptep, pfn_pte(virt_to_pfn(dst), PAGE_KERNEL_EXEC));
 
         /*
          * Load our new page tables. A strict BBM approach requires that we
@@ -263,7 +263,7 @@ static int create_safe_exec_page(void *src_start, size_t length,
          */
         cpu_set_reserved_ttbr0();
         local_flush_tlb_all();
-        write_sysreg(phys_to_ttbr(virt_to_phys(pgd)), ttbr0_el1);
+        write_sysreg(phys_to_ttbr(virt_to_phys(pgdp)), ttbr0_el1);
         isb();
 
         *phys_dst_addr = virt_to_phys((void *)dst);
@@ -320,9 +320,9 @@ int swsusp_arch_suspend(void)
         return ret;
 }
 
-static void _copy_pte(pte_t *dst_pte, pte_t *src_pte, unsigned long addr)
+static void _copy_pte(pte_t *dst_ptep, pte_t *src_ptep, unsigned long addr)
 {
-        pte_t pte = *src_pte;
+        pte_t pte = READ_ONCE(*src_ptep);
 
         if (pte_valid(pte)) {
                 /*
@@ -330,7 +330,7 @@ static void _copy_pte(pte_t *dst_pte, pte_t *src_pte, unsigned long addr)
                  * read only (code, rodata). Clear the RDONLY bit from
                  * the temporary mappings we use during restore.
                  */
-                set_pte(dst_pte, pte_mkwrite(pte));
+                set_pte(dst_ptep, pte_mkwrite(pte));
         } else if (debug_pagealloc_enabled() && !pte_none(pte)) {
                 /*
                  * debug_pagealloc will removed the PTE_VALID bit if
@@ -343,112 +343,116 @@ static void _copy_pte(pte_t *dst_pte, pte_t *src_pte, unsigned long addr)
                  */
                 BUG_ON(!pfn_valid(pte_pfn(pte)));
 
-                set_pte(dst_pte, pte_mkpresent(pte_mkwrite(pte)));
+                set_pte(dst_ptep, pte_mkpresent(pte_mkwrite(pte)));
         }
 }
 
-static int copy_pte(pmd_t *dst_pmd, pmd_t *src_pmd, unsigned long start,
+static int copy_pte(pmd_t *dst_pmdp, pmd_t *src_pmdp, unsigned long start,
                     unsigned long end)
 {
-        pte_t *src_pte;
-        pte_t *dst_pte;
+        pte_t *src_ptep;
+        pte_t *dst_ptep;
         unsigned long addr = start;
 
-        dst_pte = (pte_t *)get_safe_page(GFP_ATOMIC);
-        if (!dst_pte)
+        dst_ptep = (pte_t *)get_safe_page(GFP_ATOMIC);
+        if (!dst_ptep)
                 return -ENOMEM;
-        pmd_populate_kernel(&init_mm, dst_pmd, dst_pte);
-        dst_pte = pte_offset_kernel(dst_pmd, start);
+        pmd_populate_kernel(&init_mm, dst_pmdp, dst_ptep);
+        dst_ptep = pte_offset_kernel(dst_pmdp, start);
 
-        src_pte = pte_offset_kernel(src_pmd, start);
+        src_ptep = pte_offset_kernel(src_pmdp, start);
         do {
-                _copy_pte(dst_pte, src_pte, addr);
-        } while (dst_pte++, src_pte++, addr += PAGE_SIZE, addr != end);
+                _copy_pte(dst_ptep, src_ptep, addr);
+        } while (dst_ptep++, src_ptep++, addr += PAGE_SIZE, addr != end);
 
         return 0;
 }
 
-static int copy_pmd(pud_t *dst_pud, pud_t *src_pud, unsigned long start,
+static int copy_pmd(pud_t *dst_pudp, pud_t *src_pudp, unsigned long start,
                     unsigned long end)
 {
-        pmd_t *src_pmd;
-        pmd_t *dst_pmd;
+        pmd_t *src_pmdp;
+        pmd_t *dst_pmdp;
         unsigned long next;
         unsigned long addr = start;
 
-        if (pud_none(*dst_pud)) {
-                dst_pmd = (pmd_t *)get_safe_page(GFP_ATOMIC);
-                if (!dst_pmd)
+        if (pud_none(READ_ONCE(*dst_pudp))) {
+                dst_pmdp = (pmd_t *)get_safe_page(GFP_ATOMIC);
+                if (!dst_pmdp)
                         return -ENOMEM;
-                pud_populate(&init_mm, dst_pud, dst_pmd);
+                pud_populate(&init_mm, dst_pudp, dst_pmdp);
         }
-        dst_pmd = pmd_offset(dst_pud, start);
+        dst_pmdp = pmd_offset(dst_pudp, start);
 
-        src_pmd = pmd_offset(src_pud, start);
+        src_pmdp = pmd_offset(src_pudp, start);
         do {
+                pmd_t pmd = READ_ONCE(*src_pmdp);
+
                 next = pmd_addr_end(addr, end);
-                if (pmd_none(*src_pmd))
+                if (pmd_none(pmd))
                         continue;
-                if (pmd_table(*src_pmd)) {
-                        if (copy_pte(dst_pmd, src_pmd, addr, next))
+                if (pmd_table(pmd)) {
+                        if (copy_pte(dst_pmdp, src_pmdp, addr, next))
                                 return -ENOMEM;
                 } else {
-                        set_pmd(dst_pmd,
-                                __pmd(pmd_val(*src_pmd) & ~PMD_SECT_RDONLY));
+                        set_pmd(dst_pmdp,
+                                __pmd(pmd_val(pmd) & ~PMD_SECT_RDONLY));
                 }
-        } while (dst_pmd++, src_pmd++, addr = next, addr != end);
+        } while (dst_pmdp++, src_pmdp++, addr = next, addr != end);
 
         return 0;
 }
 
-static int copy_pud(pgd_t *dst_pgd, pgd_t *src_pgd, unsigned long start,
+static int copy_pud(pgd_t *dst_pgdp, pgd_t *src_pgdp, unsigned long start,
                     unsigned long end)
 {
-        pud_t *dst_pud;
-        pud_t *src_pud;
+        pud_t *dst_pudp;
+        pud_t *src_pudp;
         unsigned long next;
         unsigned long addr = start;
 
-        if (pgd_none(*dst_pgd)) {
-                dst_pud = (pud_t *)get_safe_page(GFP_ATOMIC);
-                if (!dst_pud)
+        if (pgd_none(READ_ONCE(*dst_pgdp))) {
+                dst_pudp = (pud_t *)get_safe_page(GFP_ATOMIC);
+                if (!dst_pudp)
                         return -ENOMEM;
-                pgd_populate(&init_mm, dst_pgd, dst_pud);
+                pgd_populate(&init_mm, dst_pgdp, dst_pudp);
         }
-        dst_pud = pud_offset(dst_pgd, start);
+        dst_pudp = pud_offset(dst_pgdp, start);
 
-        src_pud = pud_offset(src_pgd, start);
+        src_pudp = pud_offset(src_pgdp, start);
         do {
+                pud_t pud = READ_ONCE(*src_pudp);
+
                 next = pud_addr_end(addr, end);
-                if (pud_none(*src_pud))
+                if (pud_none(pud))
                         continue;
-                if (pud_table(*(src_pud))) {
-                        if (copy_pmd(dst_pud, src_pud, addr, next))
+                if (pud_table(pud)) {
+                        if (copy_pmd(dst_pudp, src_pudp, addr, next))
                                 return -ENOMEM;
                 } else {
-                        set_pud(dst_pud,
-                                __pud(pud_val(*src_pud) & ~PMD_SECT_RDONLY));
+                        set_pud(dst_pudp,
+                                __pud(pud_val(pud) & ~PMD_SECT_RDONLY));
                 }
-        } while (dst_pud++, src_pud++, addr = next, addr != end);
+        } while (dst_pudp++, src_pudp++, addr = next, addr != end);
 
         return 0;
 }
 
-static int copy_page_tables(pgd_t *dst_pgd, unsigned long start,
+static int copy_page_tables(pgd_t *dst_pgdp, unsigned long start,
                             unsigned long end)
 {
         unsigned long next;
         unsigned long addr = start;
-        pgd_t *src_pgd = pgd_offset_k(start);
+        pgd_t *src_pgdp = pgd_offset_k(start);
 
-        dst_pgd = pgd_offset_raw(dst_pgd, start);
+        dst_pgdp = pgd_offset_raw(dst_pgdp, start);
         do {
                 next = pgd_addr_end(addr, end);
-                if (pgd_none(*src_pgd))
+                if (pgd_none(READ_ONCE(*src_pgdp)))
                         continue;
-                if (copy_pud(dst_pgd, src_pgd, addr, next))
+                if (copy_pud(dst_pgdp, src_pgdp, addr, next))
                         return -ENOMEM;
-        } while (dst_pgd++, src_pgd++, addr = next, addr != end);
+        } while (dst_pgdp++, src_pgdp++, addr = next, addr != end);
 
         return 0;
 }
diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index 116252a8d3a5..870f4b1587f9 100644
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -407,8 +407,10 @@ again:
                 u32 midr = read_cpuid_id();
 
                 /* Apply BTAC predictors mitigation to all Falkor chips */
-                if ((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR_V1)
+                if (((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR) ||
+                    ((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR_V1)) {
                         __qcom_hyp_sanitize_btac_predictors();
+                }
         }
 
         fp_enabled = __fpsimd_enabled();
diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
index 7b60d62ac593..65dfc8571bf8 100644
--- a/arch/arm64/mm/dump.c
+++ b/arch/arm64/mm/dump.c
@@ -286,48 +286,52 @@ static void note_page(struct pg_state *st, unsigned long addr, unsigned level,
 
 }
 
-static void walk_pte(struct pg_state *st, pmd_t *pmd, unsigned long start)
+static void walk_pte(struct pg_state *st, pmd_t *pmdp, unsigned long start)
 {
-        pte_t *pte = pte_offset_kernel(pmd, 0UL);
+        pte_t *ptep = pte_offset_kernel(pmdp, 0UL);
         unsigned long addr;
         unsigned i;
 
-        for (i = 0; i < PTRS_PER_PTE; i++, pte++) {
+        for (i = 0; i < PTRS_PER_PTE; i++, ptep++) {
                 addr = start + i * PAGE_SIZE;
-                note_page(st, addr, 4, pte_val(*pte));
+                note_page(st, addr, 4, READ_ONCE(pte_val(*ptep)));
         }
 }
 
-static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
+static void walk_pmd(struct pg_state *st, pud_t *pudp, unsigned long start)
 {
-        pmd_t *pmd = pmd_offset(pud, 0UL);
+        pmd_t *pmdp = pmd_offset(pudp, 0UL);
         unsigned long addr;
         unsigned i;
 
-        for (i = 0; i < PTRS_PER_PMD; i++, pmd++) {
+        for (i = 0; i < PTRS_PER_PMD; i++, pmdp++) {
+                pmd_t pmd = READ_ONCE(*pmdp);
+
                 addr = start + i * PMD_SIZE;
-                if (pmd_none(*pmd) || pmd_sect(*pmd)) {
-                        note_page(st, addr, 3, pmd_val(*pmd));
+                if (pmd_none(pmd) || pmd_sect(pmd)) {
+                        note_page(st, addr, 3, pmd_val(pmd));
                 } else {
-                        BUG_ON(pmd_bad(*pmd));
-                        walk_pte(st, pmd, addr);
+                        BUG_ON(pmd_bad(pmd));
+                        walk_pte(st, pmdp, addr);
                 }
         }
 }
 
-static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
+static void walk_pud(struct pg_state *st, pgd_t *pgdp, unsigned long start)
 {
-        pud_t *pud = pud_offset(pgd, 0UL);
+        pud_t *pudp = pud_offset(pgdp, 0UL);
         unsigned long addr;
         unsigned i;
 
-        for (i = 0; i < PTRS_PER_PUD; i++, pud++) {
+        for (i = 0; i < PTRS_PER_PUD; i++, pudp++) {
+                pud_t pud = READ_ONCE(*pudp);
+
                 addr = start + i * PUD_SIZE;
-                if (pud_none(*pud) || pud_sect(*pud)) {
-                        note_page(st, addr, 2, pud_val(*pud));
+                if (pud_none(pud) || pud_sect(pud)) {
+                        note_page(st, addr, 2, pud_val(pud));
                 } else {
-                        BUG_ON(pud_bad(*pud));
-                        walk_pmd(st, pud, addr);
+                        BUG_ON(pud_bad(pud));
+                        walk_pmd(st, pudp, addr);
                 }
         }
 }
@@ -335,17 +339,19 @@ static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
 static void walk_pgd(struct pg_state *st, struct mm_struct *mm,
                      unsigned long start)
 {
-        pgd_t *pgd = pgd_offset(mm, 0UL);
+        pgd_t *pgdp = pgd_offset(mm, 0UL);
         unsigned i;
         unsigned long addr;
 
-        for (i = 0; i < PTRS_PER_PGD; i++, pgd++) {
+        for (i = 0; i < PTRS_PER_PGD; i++, pgdp++) {
+                pgd_t pgd = READ_ONCE(*pgdp);
+
                 addr = start + i * PGDIR_SIZE;
-                if (pgd_none(*pgd)) {
-                        note_page(st, addr, 1, pgd_val(*pgd));
+                if (pgd_none(pgd)) {
+                        note_page(st, addr, 1, pgd_val(pgd));
                 } else {
-                        BUG_ON(pgd_bad(*pgd));
-                        walk_pud(st, pgd, addr);
+                        BUG_ON(pgd_bad(pgd));
+                        walk_pud(st, pgdp, addr);
                 }
         }
 }
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index f76bb2c3c943..bff11553eb05 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -130,7 +130,8 @@ static void mem_abort_decode(unsigned int esr)
 void show_pte(unsigned long addr)
 {
         struct mm_struct *mm;
-        pgd_t *pgd;
+        pgd_t *pgdp;
+        pgd_t pgd;
 
         if (addr < TASK_SIZE) {
                 /* TTBR0 */
@@ -149,33 +150,37 @@ void show_pte(unsigned long addr)
                 return;
         }
 
-        pr_alert("%s pgtable: %luk pages, %u-bit VAs, pgd = %p\n",
+        pr_alert("%s pgtable: %luk pages, %u-bit VAs, pgdp = %p\n",
                  mm == &init_mm ? "swapper" : "user", PAGE_SIZE / SZ_1K,
                  VA_BITS, mm->pgd);
-        pgd = pgd_offset(mm, addr);
-        pr_alert("[%016lx] *pgd=%016llx", addr, pgd_val(*pgd));
+        pgdp = pgd_offset(mm, addr);
+        pgd = READ_ONCE(*pgdp);
+        pr_alert("[%016lx] pgd=%016llx", addr, pgd_val(pgd));
 
         do {
-                pud_t *pud;
-                pmd_t *pmd;
-                pte_t *pte;
+                pud_t *pudp, pud;
+                pmd_t *pmdp, pmd;
+                pte_t *ptep, pte;
 
-                if (pgd_none(*pgd) || pgd_bad(*pgd))
+                if (pgd_none(pgd) || pgd_bad(pgd))
                         break;
 
-                pud = pud_offset(pgd, addr);
-                pr_cont(", *pud=%016llx", pud_val(*pud));
-                if (pud_none(*pud) || pud_bad(*pud))
+                pudp = pud_offset(pgdp, addr);
+                pud = READ_ONCE(*pudp);
+                pr_cont(", pud=%016llx", pud_val(pud));
+                if (pud_none(pud) || pud_bad(pud))
                         break;
 
-                pmd = pmd_offset(pud, addr);
-                pr_cont(", *pmd=%016llx", pmd_val(*pmd));
-                if (pmd_none(*pmd) || pmd_bad(*pmd))
+                pmdp = pmd_offset(pudp, addr);
+                pmd = READ_ONCE(*pmdp);
+                pr_cont(", pmd=%016llx", pmd_val(pmd));
+                if (pmd_none(pmd) || pmd_bad(pmd))
                         break;
 
-                pte = pte_offset_map(pmd, addr);
-                pr_cont(", *pte=%016llx", pte_val(*pte));
-                pte_unmap(pte);
+                ptep = pte_offset_map(pmdp, addr);
+                pte = READ_ONCE(*ptep);
+                pr_cont(", pte=%016llx", pte_val(pte));
+                pte_unmap(ptep);
         } while(0);
 
         pr_cont("\n");
@@ -196,8 +201,9 @@ int ptep_set_access_flags(struct vm_area_struct *vma,
                           pte_t entry, int dirty)
 {
         pteval_t old_pteval, pteval;
+        pte_t pte = READ_ONCE(*ptep);
 
-        if (pte_same(*ptep, entry))
+        if (pte_same(pte, entry))
                 return 0;
 
         /* only preserve the access flags and write permission */
@@ -210,7 +216,7 @@ int ptep_set_access_flags(struct vm_area_struct *vma,
          * (calculated as: a & b == ~(~a | ~b)).
          */
         pte_val(entry) ^= PTE_RDONLY;
-        pteval = READ_ONCE(pte_val(*ptep));
+        pteval = pte_val(pte);
         do {
                 old_pteval = pteval;
                 pteval ^= PTE_RDONLY;
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 6cb0fa92a651..ecc6818191df 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -54,14 +54,14 @@ static inline pgprot_t pte_pgprot(pte_t pte)
 static int find_num_contig(struct mm_struct *mm, unsigned long addr,
                            pte_t *ptep, size_t *pgsize)
 {
-        pgd_t *pgd = pgd_offset(mm, addr);
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp = pgd_offset(mm, addr);
+        pud_t *pudp;
+        pmd_t *pmdp;
 
         *pgsize = PAGE_SIZE;
-        pud = pud_offset(pgd, addr);
-        pmd = pmd_offset(pud, addr);
-        if ((pte_t *)pmd == ptep) {
+        pudp = pud_offset(pgdp, addr);
+        pmdp = pmd_offset(pudp, addr);
+        if ((pte_t *)pmdp == ptep) {
                 *pgsize = PMD_SIZE;
                 return CONT_PMDS;
         }
@@ -181,11 +181,8 @@ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
 
         clear_flush(mm, addr, ptep, pgsize, ncontig);
 
-        for (i = 0; i < ncontig; i++, ptep++, addr += pgsize, pfn += dpfn) {
-                pr_debug("%s: set pte %p to 0x%llx\n", __func__, ptep,
-                         pte_val(pfn_pte(pfn, hugeprot)));
+        for (i = 0; i < ncontig; i++, ptep++, addr += pgsize, pfn += dpfn)
                 set_pte_at(mm, addr, ptep, pfn_pte(pfn, hugeprot));
-        }
 }
 
 void set_huge_swap_pte_at(struct mm_struct *mm, unsigned long addr,
@@ -203,20 +200,20 @@ void set_huge_swap_pte_at(struct mm_struct *mm, unsigned long addr,
 pte_t *huge_pte_alloc(struct mm_struct *mm,
                       unsigned long addr, unsigned long sz)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pte_t *pte = NULL;
-
-        pr_debug("%s: addr:0x%lx sz:0x%lx\n", __func__, addr, sz);
-        pgd = pgd_offset(mm, addr);
-        pud = pud_alloc(mm, pgd, addr);
-        if (!pud)
+        pgd_t *pgdp;
+        pud_t *pudp;
+        pmd_t *pmdp;
+        pte_t *ptep = NULL;
+
+        pgdp = pgd_offset(mm, addr);
+        pudp = pud_alloc(mm, pgdp, addr);
+        if (!pudp)
                 return NULL;
 
         if (sz == PUD_SIZE) {
-                pte = (pte_t *)pud;
+                ptep = (pte_t *)pudp;
         } else if (sz == (PAGE_SIZE * CONT_PTES)) {
-                pmd_t *pmd = pmd_alloc(mm, pud, addr);
+                pmdp = pmd_alloc(mm, pudp, addr);
 
                 WARN_ON(addr & (sz - 1));
                 /*
@@ -226,60 +223,55 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
                  * will be no pte_unmap() to correspond with this
                  * pte_alloc_map().
                  */
-                pte = pte_alloc_map(mm, pmd, addr);
+                ptep = pte_alloc_map(mm, pmdp, addr);
         } else if (sz == PMD_SIZE) {
                 if (IS_ENABLED(CONFIG_ARCH_WANT_HUGE_PMD_SHARE) &&
-                    pud_none(*pud))
-                        pte = huge_pmd_share(mm, addr, pud);
+                    pud_none(READ_ONCE(*pudp)))
+                        ptep = huge_pmd_share(mm, addr, pudp);
                 else
-                        pte = (pte_t *)pmd_alloc(mm, pud, addr);
+                        ptep = (pte_t *)pmd_alloc(mm, pudp, addr);
         } else if (sz == (PMD_SIZE * CONT_PMDS)) {
-                pmd_t *pmd;
-
-                pmd = pmd_alloc(mm, pud, addr);
+                pmdp = pmd_alloc(mm, pudp, addr);
                 WARN_ON(addr & (sz - 1));
-                return (pte_t *)pmd;
+                return (pte_t *)pmdp;
         }
 
-        pr_debug("%s: addr:0x%lx sz:0x%lx ret pte=%p/0x%llx\n", __func__, addr,
-               sz, pte, pte_val(*pte));
-        return pte;
+        return ptep;
 }
 
 pte_t *huge_pte_offset(struct mm_struct *mm,
                        unsigned long addr, unsigned long sz)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp;
+        pud_t *pudp, pud;
+        pmd_t *pmdp, pmd;
 
-        pgd = pgd_offset(mm, addr);
-        pr_debug("%s: addr:0x%lx pgd:%p\n", __func__, addr, pgd);
-        if (!pgd_present(*pgd))
+        pgdp = pgd_offset(mm, addr);
+        if (!pgd_present(READ_ONCE(*pgdp)))
                 return NULL;
 
-        pud = pud_offset(pgd, addr);
-        if (sz != PUD_SIZE && pud_none(*pud))
+        pudp = pud_offset(pgdp, addr);
+        pud = READ_ONCE(*pudp);
+        if (sz != PUD_SIZE && pud_none(pud))
                 return NULL;
         /* hugepage or swap? */
-        if (pud_huge(*pud) || !pud_present(*pud))
-                return (pte_t *)pud;
+        if (pud_huge(pud) || !pud_present(pud))
+                return (pte_t *)pudp;
         /* table; check the next level */
 
         if (sz == CONT_PMD_SIZE)
                 addr &= CONT_PMD_MASK;
 
-        pmd = pmd_offset(pud, addr);
+        pmdp = pmd_offset(pudp, addr);
+        pmd = READ_ONCE(*pmdp);
         if (!(sz == PMD_SIZE || sz == CONT_PMD_SIZE) &&
-            pmd_none(*pmd))
+            pmd_none(pmd))
                 return NULL;
-        if (pmd_huge(*pmd) || !pmd_present(*pmd))
-                return (pte_t *)pmd;
+        if (pmd_huge(pmd) || !pmd_present(pmd))
+                return (pte_t *)pmdp;
 
-        if (sz == CONT_PTE_SIZE) {
-                pte_t *pte = pte_offset_kernel(pmd, (addr & CONT_PTE_MASK));
-                return pte;
-        }
+        if (sz == CONT_PTE_SIZE)
+                return pte_offset_kernel(pmdp, (addr & CONT_PTE_MASK));
 
         return NULL;
 }
@@ -367,7 +359,7 @@ void huge_ptep_set_wrprotect(struct mm_struct *mm,
         size_t pgsize;
         pte_t pte;
 
-        if (!pte_cont(*ptep)) {
+        if (!pte_cont(READ_ONCE(*ptep))) {
                 ptep_set_wrprotect(mm, addr, ptep);
                 return;
         }
@@ -391,7 +383,7 @@ void huge_ptep_clear_flush(struct vm_area_struct *vma,
         size_t pgsize;
         int ncontig;
 
-        if (!pte_cont(*ptep)) {
+        if (!pte_cont(READ_ONCE(*ptep))) {
                 ptep_clear_flush(vma, addr, ptep);
                 return;
         }
diff --git a/arch/arm64/mm/kasan_init.c b/arch/arm64/mm/kasan_init.c
index 6e02e6fb4c7b..dabfc1ecda3d 100644
--- a/arch/arm64/mm/kasan_init.c
+++ b/arch/arm64/mm/kasan_init.c
@@ -44,92 +44,92 @@ static phys_addr_t __init kasan_alloc_zeroed_page(int node)
         return __pa(p);
 }
 
-static pte_t *__init kasan_pte_offset(pmd_t *pmd, unsigned long addr, int node,
+static pte_t *__init kasan_pte_offset(pmd_t *pmdp, unsigned long addr, int node,
                                       bool early)
 {
-        if (pmd_none(*pmd)) {
+        if (pmd_none(READ_ONCE(*pmdp))) {
                 phys_addr_t pte_phys = early ? __pa_symbol(kasan_zero_pte)
                                              : kasan_alloc_zeroed_page(node);
-                __pmd_populate(pmd, pte_phys, PMD_TYPE_TABLE);
+                __pmd_populate(pmdp, pte_phys, PMD_TYPE_TABLE);
         }
 
-        return early ? pte_offset_kimg(pmd, addr)
-                     : pte_offset_kernel(pmd, addr);
+        return early ? pte_offset_kimg(pmdp, addr)
+                     : pte_offset_kernel(pmdp, addr);
 }
 
-static pmd_t *__init kasan_pmd_offset(pud_t *pud, unsigned long addr, int node,
+static pmd_t *__init kasan_pmd_offset(pud_t *pudp, unsigned long addr, int node,
                                       bool early)
 {
-        if (pud_none(*pud)) {
+        if (pud_none(READ_ONCE(*pudp))) {
                 phys_addr_t pmd_phys = early ? __pa_symbol(kasan_zero_pmd)
                                              : kasan_alloc_zeroed_page(node);
-                __pud_populate(pud, pmd_phys, PMD_TYPE_TABLE);
+                __pud_populate(pudp, pmd_phys, PMD_TYPE_TABLE);
         }
 
-        return early ? pmd_offset_kimg(pud, addr) : pmd_offset(pud, addr);
+        return early ? pmd_offset_kimg(pudp, addr) : pmd_offset(pudp, addr);
 }
 
-static pud_t *__init kasan_pud_offset(pgd_t *pgd, unsigned long addr, int node,
+static pud_t *__init kasan_pud_offset(pgd_t *pgdp, unsigned long addr, int node,
                                       bool early)
 {
-        if (pgd_none(*pgd)) {
+        if (pgd_none(READ_ONCE(*pgdp))) {
                 phys_addr_t pud_phys = early ? __pa_symbol(kasan_zero_pud)
                                              : kasan_alloc_zeroed_page(node);
-                __pgd_populate(pgd, pud_phys, PMD_TYPE_TABLE);
+                __pgd_populate(pgdp, pud_phys, PMD_TYPE_TABLE);
         }
 
-        return early ? pud_offset_kimg(pgd, addr) : pud_offset(pgd, addr);
+        return early ? pud_offset_kimg(pgdp, addr) : pud_offset(pgdp, addr);
 }
 
-static void __init kasan_pte_populate(pmd_t *pmd, unsigned long addr,
+static void __init kasan_pte_populate(pmd_t *pmdp, unsigned long addr,
                                       unsigned long end, int node, bool early)
 {
         unsigned long next;
-        pte_t *pte = kasan_pte_offset(pmd, addr, node, early);
+        pte_t *ptep = kasan_pte_offset(pmdp, addr, node, early);
 
         do {
                 phys_addr_t page_phys = early ? __pa_symbol(kasan_zero_page)
                                               : kasan_alloc_zeroed_page(node);
                 next = addr + PAGE_SIZE;
-                set_pte(pte, pfn_pte(__phys_to_pfn(page_phys), PAGE_KERNEL));
-        } while (pte++, addr = next, addr != end && pte_none(*pte));
+                set_pte(ptep, pfn_pte(__phys_to_pfn(page_phys), PAGE_KERNEL));
+        } while (ptep++, addr = next, addr != end && pte_none(READ_ONCE(*ptep)));
 }
 
-static void __init kasan_pmd_populate(pud_t *pud, unsigned long addr,
+static void __init kasan_pmd_populate(pud_t *pudp, unsigned long addr,
                                       unsigned long end, int node, bool early)
 {
         unsigned long next;
-        pmd_t *pmd = kasan_pmd_offset(pud, addr, node, early);
+        pmd_t *pmdp = kasan_pmd_offset(pudp, addr, node, early);
 
         do {
                 next = pmd_addr_end(addr, end);
-                kasan_pte_populate(pmd, addr, next, node, early);
-        } while (pmd++, addr = next, addr != end && pmd_none(*pmd));
+                kasan_pte_populate(pmdp, addr, next, node, early);
+        } while (pmdp++, addr = next, addr != end && pmd_none(READ_ONCE(*pmdp)));
 }
 
-static void __init kasan_pud_populate(pgd_t *pgd, unsigned long addr,
+static void __init kasan_pud_populate(pgd_t *pgdp, unsigned long addr,
                                       unsigned long end, int node, bool early)
 {
         unsigned long next;
-        pud_t *pud = kasan_pud_offset(pgd, addr, node, early);
+        pud_t *pudp = kasan_pud_offset(pgdp, addr, node, early);
 
         do {
                 next = pud_addr_end(addr, end);
-                kasan_pmd_populate(pud, addr, next, node, early);
-        } while (pud++, addr = next, addr != end && pud_none(*pud));
+                kasan_pmd_populate(pudp, addr, next, node, early);
+        } while (pudp++, addr = next, addr != end && pud_none(READ_ONCE(*pudp)));
 }
 
 static void __init kasan_pgd_populate(unsigned long addr, unsigned long end,
                                       int node, bool early)
 {
         unsigned long next;
-        pgd_t *pgd;
+        pgd_t *pgdp;
 
-        pgd = pgd_offset_k(addr);
+        pgdp = pgd_offset_k(addr);
         do {
                 next = pgd_addr_end(addr, end);
-                kasan_pud_populate(pgd, addr, next, node, early);
-        } while (pgd++, addr = next, addr != end);
+                kasan_pud_populate(pgdp, addr, next, node, early);
+        } while (pgdp++, addr = next, addr != end);
 }
 
 /* The early shadow maps everything to a single page of zeroes */
@@ -155,14 +155,14 @@ static void __init kasan_map_populate(unsigned long start, unsigned long end,
  */
 void __init kasan_copy_shadow(pgd_t *pgdir)
 {
-        pgd_t *pgd, *pgd_new, *pgd_end;
+        pgd_t *pgdp, *pgdp_new, *pgdp_end;
 
-        pgd = pgd_offset_k(KASAN_SHADOW_START);
-        pgd_end = pgd_offset_k(KASAN_SHADOW_END);
-        pgd_new = pgd_offset_raw(pgdir, KASAN_SHADOW_START);
+        pgdp = pgd_offset_k(KASAN_SHADOW_START);
+        pgdp_end = pgd_offset_k(KASAN_SHADOW_END);
+        pgdp_new = pgd_offset_raw(pgdir, KASAN_SHADOW_START);
         do {
-                set_pgd(pgd_new, *pgd);
-        } while (pgd++, pgd_new++, pgd != pgd_end);
+                set_pgd(pgdp_new, READ_ONCE(*pgdp));
+        } while (pgdp++, pgdp_new++, pgdp != pgdp_end);
 }
 
 static void __init clear_pgds(unsigned long start,
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 4694cda823c9..3161b853f29e 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -125,45 +125,48 @@ static bool pgattr_change_is_safe(u64 old, u64 new)
         return ((old ^ new) & ~mask) == 0;
 }
 
-static void init_pte(pmd_t *pmd, unsigned long addr, unsigned long end,
+static void init_pte(pmd_t *pmdp, unsigned long addr, unsigned long end,
                      phys_addr_t phys, pgprot_t prot)
 {
-        pte_t *pte;
+        pte_t *ptep;
 
-        pte = pte_set_fixmap_offset(pmd, addr);
+        ptep = pte_set_fixmap_offset(pmdp, addr);
         do {
-                pte_t old_pte = *pte;
+                pte_t old_pte = READ_ONCE(*ptep);
 
-                set_pte(pte, pfn_pte(__phys_to_pfn(phys), prot));
+                set_pte(ptep, pfn_pte(__phys_to_pfn(phys), prot));
 
                 /*
                  * After the PTE entry has been populated once, we
                  * only allow updates to the permission attributes.
                  */
-                BUG_ON(!pgattr_change_is_safe(pte_val(old_pte), pte_val(*pte)));
+                BUG_ON(!pgattr_change_is_safe(pte_val(old_pte),
+                                              READ_ONCE(pte_val(*ptep))));
 
                 phys += PAGE_SIZE;
-        } while (pte++, addr += PAGE_SIZE, addr != end);
+        } while (ptep++, addr += PAGE_SIZE, addr != end);
 
         pte_clear_fixmap();
 }
 
-static void alloc_init_cont_pte(pmd_t *pmd, unsigned long addr,
+static void alloc_init_cont_pte(pmd_t *pmdp, unsigned long addr,
                                 unsigned long end, phys_addr_t phys,
                                 pgprot_t prot,
                                 phys_addr_t (*pgtable_alloc)(void),
                                 int flags)
 {
         unsigned long next;
+        pmd_t pmd = READ_ONCE(*pmdp);
 
-        BUG_ON(pmd_sect(*pmd));
-        if (pmd_none(*pmd)) {
+        BUG_ON(pmd_sect(pmd));
+        if (pmd_none(pmd)) {
                 phys_addr_t pte_phys;
                 BUG_ON(!pgtable_alloc);
                 pte_phys = pgtable_alloc();
-                __pmd_populate(pmd, pte_phys, PMD_TYPE_TABLE);
+                __pmd_populate(pmdp, pte_phys, PMD_TYPE_TABLE);
+                pmd = READ_ONCE(*pmdp);
         }
-        BUG_ON(pmd_bad(*pmd));
+        BUG_ON(pmd_bad(pmd));
 
         do {
                 pgprot_t __prot = prot;
@@ -175,67 +178,69 @@ static void alloc_init_cont_pte(pmd_t *pmd, unsigned long addr,
                     (flags & NO_CONT_MAPPINGS) == 0)
                         __prot = __pgprot(pgprot_val(prot) | PTE_CONT);
 
-                init_pte(pmd, addr, next, phys, __prot);
+                init_pte(pmdp, addr, next, phys, __prot);
 
                 phys += next - addr;
         } while (addr = next, addr != end);
 }
 
-static void init_pmd(pud_t *pud, unsigned long addr, unsigned long end,
+static void init_pmd(pud_t *pudp, unsigned long addr, unsigned long end,
                      phys_addr_t phys, pgprot_t prot,
                      phys_addr_t (*pgtable_alloc)(void), int flags)
 {
         unsigned long next;
-        pmd_t *pmd;
+        pmd_t *pmdp;
 
-        pmd = pmd_set_fixmap_offset(pud, addr);
+        pmdp = pmd_set_fixmap_offset(pudp, addr);
         do {
-                pmd_t old_pmd = *pmd;
+                pmd_t old_pmd = READ_ONCE(*pmdp);
 
                 next = pmd_addr_end(addr, end);
 
                 /* try section mapping first */
                 if (((addr | next | phys) & ~SECTION_MASK) == 0 &&
                     (flags & NO_BLOCK_MAPPINGS) == 0) {
-                        pmd_set_huge(pmd, phys, prot);
+                        pmd_set_huge(pmdp, phys, prot);
 
                         /*
                          * After the PMD entry has been populated once, we
                          * only allow updates to the permission attributes.
                          */
                         BUG_ON(!pgattr_change_is_safe(pmd_val(old_pmd),
-                                                      pmd_val(*pmd)));
+                                                      READ_ONCE(pmd_val(*pmdp))));
                 } else {
-                        alloc_init_cont_pte(pmd, addr, next, phys, prot,
+                        alloc_init_cont_pte(pmdp, addr, next, phys, prot,
                                             pgtable_alloc, flags);
 
                         BUG_ON(pmd_val(old_pmd) != 0 &&
-                               pmd_val(old_pmd) != pmd_val(*pmd));
+                               pmd_val(old_pmd) != READ_ONCE(pmd_val(*pmdp)));
                 }
                 phys += next - addr;
-        } while (pmd++, addr = next, addr != end);
+        } while (pmdp++, addr = next, addr != end);
 
         pmd_clear_fixmap();
 }
 
-static void alloc_init_cont_pmd(pud_t *pud, unsigned long addr,
+static void alloc_init_cont_pmd(pud_t *pudp, unsigned long addr,
                                 unsigned long end, phys_addr_t phys,
                                 pgprot_t prot,
                                 phys_addr_t (*pgtable_alloc)(void), int flags)
 {
         unsigned long next;
+        pud_t pud = READ_ONCE(*pudp);
 
         /*
          * Check for initial section mappings in the pgd/pud.
          */
-        BUG_ON(pud_sect(*pud));
-        if (pud_none(*pud)) {
+        BUG_ON(pud_sect(pud));
+        if (pud_none(pud)) {
                 phys_addr_t pmd_phys;
                 BUG_ON(!pgtable_alloc);
                 pmd_phys = pgtable_alloc();
-                __pud_populate(pud, pmd_phys, PUD_TYPE_TABLE);
+                __pud_populate(pudp, pmd_phys, PUD_TYPE_TABLE);
+                pud = READ_ONCE(*pudp);
         }
-        BUG_ON(pud_bad(*pud));
+        BUG_ON(pud_bad(pud));
 
         do {
                 pgprot_t __prot = prot;
@@ -247,7 +252,7 @@ static void alloc_init_cont_pmd(pud_t *pud, unsigned long addr,
                     (flags & NO_CONT_MAPPINGS) == 0)
                         __prot = __pgprot(pgprot_val(prot) | PTE_CONT);
 
-                init_pmd(pud, addr, next, phys, __prot, pgtable_alloc, flags);
+                init_pmd(pudp, addr, next, phys, __prot, pgtable_alloc, flags);
 
                 phys += next - addr;
         } while (addr = next, addr != end);
@@ -265,25 +270,27 @@ static inline bool use_1G_block(unsigned long addr, unsigned long next,
         return true;
 }
 
-static void alloc_init_pud(pgd_t *pgd, unsigned long addr, unsigned long end,
-                                  phys_addr_t phys, pgprot_t prot,
-                                  phys_addr_t (*pgtable_alloc)(void),
-                                  int flags)
+static void alloc_init_pud(pgd_t *pgdp, unsigned long addr, unsigned long end,
+                           phys_addr_t phys, pgprot_t prot,
+                           phys_addr_t (*pgtable_alloc)(void),
+                           int flags)
 {
-        pud_t *pud;
         unsigned long next;
+        pud_t *pudp;
+        pgd_t pgd = READ_ONCE(*pgdp);
 
-        if (pgd_none(*pgd)) {
+        if (pgd_none(pgd)) {
                 phys_addr_t pud_phys;
                 BUG_ON(!pgtable_alloc);
                 pud_phys = pgtable_alloc();
-                __pgd_populate(pgd, pud_phys, PUD_TYPE_TABLE);
+                __pgd_populate(pgdp, pud_phys, PUD_TYPE_TABLE);
+                pgd = READ_ONCE(*pgdp);
         }
-        BUG_ON(pgd_bad(*pgd));
+        BUG_ON(pgd_bad(pgd));
 
-        pud = pud_set_fixmap_offset(pgd, addr);
+        pudp = pud_set_fixmap_offset(pgdp, addr);
         do {
-                pud_t old_pud = *pud;
+                pud_t old_pud = READ_ONCE(*pudp);
 
                 next = pud_addr_end(addr, end);
 
@@ -292,23 +299,23 @@ static void alloc_init_pud(pgd_t *pgd, unsigned long addr, unsigned long end,
                  */
                 if (use_1G_block(addr, next, phys) &&
                     (flags & NO_BLOCK_MAPPINGS) == 0) {
-                        pud_set_huge(pud, phys, prot);
+                        pud_set_huge(pudp, phys, prot);
 
                         /*
                          * After the PUD entry has been populated once, we
                          * only allow updates to the permission attributes.
                          */
                         BUG_ON(!pgattr_change_is_safe(pud_val(old_pud),
-                                                      pud_val(*pud)));
+                                                      READ_ONCE(pud_val(*pudp))));
                 } else {
-                        alloc_init_cont_pmd(pud, addr, next, phys, prot,
+                        alloc_init_cont_pmd(pudp, addr, next, phys, prot,
                                             pgtable_alloc, flags);
 
                         BUG_ON(pud_val(old_pud) != 0 &&
-                               pud_val(old_pud) != pud_val(*pud));
+                               pud_val(old_pud) != READ_ONCE(pud_val(*pudp)));
                 }
                 phys += next - addr;
-        } while (pud++, addr = next, addr != end);
+        } while (pudp++, addr = next, addr != end);
 
         pud_clear_fixmap();
 }
@@ -320,7 +327,7 @@ static void __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys,
                                  int flags)
 {
         unsigned long addr, length, end, next;
-        pgd_t *pgd = pgd_offset_raw(pgdir, virt);
+        pgd_t *pgdp = pgd_offset_raw(pgdir, virt);
 
         /*
          * If the virtual and physical address don't have the same offset
@@ -336,10 +343,10 @@ static void __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys,
         end = addr + length;
         do {
                 next = pgd_addr_end(addr, end);
-                alloc_init_pud(pgd, addr, next, phys, prot, pgtable_alloc,
+                alloc_init_pud(pgdp, addr, next, phys, prot, pgtable_alloc,
                                flags);
                 phys += next - addr;
-        } while (pgd++, addr = next, addr != end);
+        } while (pgdp++, addr = next, addr != end);
 }
 
 static phys_addr_t pgd_pgtable_alloc(void)
@@ -401,10 +408,10 @@ static void update_mapping_prot(phys_addr_t phys, unsigned long virt,
         flush_tlb_kernel_range(virt, virt + size);
 }
 
-static void __init __map_memblock(pgd_t *pgd, phys_addr_t start,
+static void __init __map_memblock(pgd_t *pgdp, phys_addr_t start,
                                   phys_addr_t end, pgprot_t prot, int flags)
 {
-        __create_pgd_mapping(pgd, start, __phys_to_virt(start), end - start,
+        __create_pgd_mapping(pgdp, start, __phys_to_virt(start), end - start,
                              prot, early_pgtable_alloc, flags);
 }
 
@@ -418,7 +425,7 @@ void __init mark_linear_text_alias_ro(void)
                             PAGE_KERNEL_RO);
 }
 
-static void __init map_mem(pgd_t *pgd)
+static void __init map_mem(pgd_t *pgdp)
 {
         phys_addr_t kernel_start = __pa_symbol(_text);
         phys_addr_t kernel_end = __pa_symbol(__init_begin);
@@ -451,7 +458,7 @@ static void __init map_mem(pgd_t *pgd)
                 if (memblock_is_nomap(reg))
                         continue;
 
-                __map_memblock(pgd, start, end, PAGE_KERNEL, flags);
+                __map_memblock(pgdp, start, end, PAGE_KERNEL, flags);
         }
 
         /*
@@ -464,7 +471,7 @@ static void __init map_mem(pgd_t *pgd)
          * Note that contiguous mappings cannot be remapped in this way,
          * so we should avoid them here.
          */
-        __map_memblock(pgd, kernel_start, kernel_end,
+        __map_memblock(pgdp, kernel_start, kernel_end,
                        PAGE_KERNEL, NO_CONT_MAPPINGS);
         memblock_clear_nomap(kernel_start, kernel_end - kernel_start);
 
@@ -475,7 +482,7 @@ static void __init map_mem(pgd_t *pgd)
          * through /sys/kernel/kexec_crash_size interface.
          */
         if (crashk_res.end) {
-                __map_memblock(pgd, crashk_res.start, crashk_res.end + 1,
+                __map_memblock(pgdp, crashk_res.start, crashk_res.end + 1,
                                PAGE_KERNEL,
                                NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS);
                 memblock_clear_nomap(crashk_res.start,
@@ -499,7 +506,7 @@ void mark_rodata_ro(void)
         debug_checkwx();
 }
 
-static void __init map_kernel_segment(pgd_t *pgd, void *va_start, void *va_end,
+static void __init map_kernel_segment(pgd_t *pgdp, void *va_start, void *va_end,
                                       pgprot_t prot, struct vm_struct *vma,
                                       int flags, unsigned long vm_flags)
 {
@@ -509,7 +516,7 @@ static void __init map_kernel_segment(pgd_t *pgd, void *va_start, void *va_end,
         BUG_ON(!PAGE_ALIGNED(pa_start));
         BUG_ON(!PAGE_ALIGNED(size));
 
-        __create_pgd_mapping(pgd, pa_start, (unsigned long)va_start, size, prot,
+        __create_pgd_mapping(pgdp, pa_start, (unsigned long)va_start, size, prot,
                              early_pgtable_alloc, flags);
 
         if (!(vm_flags & VM_NO_GUARD))
@@ -562,7 +569,7 @@ core_initcall(map_entry_trampoline);
 /*
  * Create fine-grained mappings for the kernel.
  */
-static void __init map_kernel(pgd_t *pgd)
+static void __init map_kernel(pgd_t *pgdp)
 {
         static struct vm_struct vmlinux_text, vmlinux_rodata, vmlinux_inittext,
                                 vmlinux_initdata, vmlinux_data;
@@ -578,24 +585,24 @@ static void __init map_kernel(pgd_t *pgd)
          * Only rodata will be remapped with different permissions later on,
          * all other segments are allowed to use contiguous mappings.
          */
-        map_kernel_segment(pgd, _text, _etext, text_prot, &vmlinux_text, 0,
+        map_kernel_segment(pgdp, _text, _etext, text_prot, &vmlinux_text, 0,
                            VM_NO_GUARD);
-        map_kernel_segment(pgd, __start_rodata, __inittext_begin, PAGE_KERNEL,
+        map_kernel_segment(pgdp, __start_rodata, __inittext_begin, PAGE_KERNEL,
                            &vmlinux_rodata, NO_CONT_MAPPINGS, VM_NO_GUARD);
-        map_kernel_segment(pgd, __inittext_begin, __inittext_end, text_prot,
+        map_kernel_segment(pgdp, __inittext_begin, __inittext_end, text_prot,
                            &vmlinux_inittext, 0, VM_NO_GUARD);
-        map_kernel_segment(pgd, __initdata_begin, __initdata_end, PAGE_KERNEL,
+        map_kernel_segment(pgdp, __initdata_begin, __initdata_end, PAGE_KERNEL,
                            &vmlinux_initdata, 0, VM_NO_GUARD);
-        map_kernel_segment(pgd, _data, _end, PAGE_KERNEL, &vmlinux_data, 0, 0);
+        map_kernel_segment(pgdp, _data, _end, PAGE_KERNEL, &vmlinux_data, 0, 0);
 
-        if (!pgd_val(*pgd_offset_raw(pgd, FIXADDR_START))) {
+        if (!READ_ONCE(pgd_val(*pgd_offset_raw(pgdp, FIXADDR_START)))) {
                 /*
                  * The fixmap falls in a separate pgd to the kernel, and doesn't
                  * live in the carveout for the swapper_pg_dir. We can simply
                  * re-use the existing dir for the fixmap.
                  */
-                set_pgd(pgd_offset_raw(pgd, FIXADDR_START),
-                        *pgd_offset_k(FIXADDR_START));
+                set_pgd(pgd_offset_raw(pgdp, FIXADDR_START),
+                        READ_ONCE(*pgd_offset_k(FIXADDR_START)));
         } else if (CONFIG_PGTABLE_LEVELS > 3) {
                 /*
                  * The fixmap shares its top level pgd entry with the kernel
@@ -604,14 +611,15 @@ static void __init map_kernel(pgd_t *pgd)
                  * entry instead.
                  */
                 BUG_ON(!IS_ENABLED(CONFIG_ARM64_16K_PAGES));
-                pud_populate(&init_mm, pud_set_fixmap_offset(pgd, FIXADDR_START),
+                pud_populate(&init_mm,
+                             pud_set_fixmap_offset(pgdp, FIXADDR_START),
                              lm_alias(bm_pmd));
                 pud_clear_fixmap();
         } else {
                 BUG();
         }
 
-        kasan_copy_shadow(pgd);
+        kasan_copy_shadow(pgdp);
 }
 
 /*
@@ -621,10 +629,10 @@ static void __init map_kernel(pgd_t *pgd)
 void __init paging_init(void)
 {
         phys_addr_t pgd_phys = early_pgtable_alloc();
-        pgd_t *pgd = pgd_set_fixmap(pgd_phys);
+        pgd_t *pgdp = pgd_set_fixmap(pgd_phys);
 
-        map_kernel(pgd);
-        map_mem(pgd);
+        map_kernel(pgdp);
+        map_mem(pgdp);
 
         /*
          * We want to reuse the original swapper_pg_dir so we don't have to
@@ -635,7 +643,7 @@ void __init paging_init(void)
          * To do this we need to go via a temporary pgd.
          */
         cpu_replace_ttbr1(__va(pgd_phys));
-        memcpy(swapper_pg_dir, pgd, PGD_SIZE);
+        memcpy(swapper_pg_dir, pgdp, PGD_SIZE);
         cpu_replace_ttbr1(lm_alias(swapper_pg_dir));
 
         pgd_clear_fixmap();
@@ -655,37 +663,40 @@ void __init paging_init(void)
  */
 int kern_addr_valid(unsigned long addr)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
+        pgd_t *pgdp;
+        pud_t *pudp, pud;
+        pmd_t *pmdp, pmd;
+        pte_t *ptep, pte;
 
         if ((((long)addr) >> VA_BITS) != -1UL)
                 return 0;
 
-        pgd = pgd_offset_k(addr);
-        if (pgd_none(*pgd))
+        pgdp = pgd_offset_k(addr);
+        if (pgd_none(READ_ONCE(*pgdp)))
                 return 0;
 
-        pud = pud_offset(pgd, addr);
-        if (pud_none(*pud))
+        pudp = pud_offset(pgdp, addr);
+        pud = READ_ONCE(*pudp);
+        if (pud_none(pud))
                 return 0;
 
-        if (pud_sect(*pud))
-                return pfn_valid(pud_pfn(*pud));
+        if (pud_sect(pud))
+                return pfn_valid(pud_pfn(pud));
 
-        pmd = pmd_offset(pud, addr);
-        if (pmd_none(*pmd))
+        pmdp = pmd_offset(pudp, addr);
+        pmd = READ_ONCE(*pmdp);
+        if (pmd_none(pmd))
                 return 0;
 
-        if (pmd_sect(*pmd))
-                return pfn_valid(pmd_pfn(*pmd));
+        if (pmd_sect(pmd))
+                return pfn_valid(pmd_pfn(pmd));
 
-        pte = pte_offset_kernel(pmd, addr);
-        if (pte_none(*pte))
+        ptep = pte_offset_kernel(pmdp, addr);
+        pte = READ_ONCE(*ptep);
+        if (pte_none(pte))
                 return 0;
 
-        return pfn_valid(pte_pfn(*pte));
+        return pfn_valid(pte_pfn(pte));
 }
 #ifdef CONFIG_SPARSEMEM_VMEMMAP
 #if !ARM64_SWAPPER_USES_SECTION_MAPS
@@ -700,32 +711,32 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,
 {
         unsigned long addr = start;
         unsigned long next;
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp;
+        pud_t *pudp;
+        pmd_t *pmdp;
 
         do {
                 next = pmd_addr_end(addr, end);
 
-                pgd = vmemmap_pgd_populate(addr, node);
-                if (!pgd)
+                pgdp = vmemmap_pgd_populate(addr, node);
+                if (!pgdp)
                         return -ENOMEM;
 
-                pud = vmemmap_pud_populate(pgd, addr, node);
-                if (!pud)
+                pudp = vmemmap_pud_populate(pgdp, addr, node);
+                if (!pudp)
                         return -ENOMEM;
 
-                pmd = pmd_offset(pud, addr);
-                if (pmd_none(*pmd)) {
+                pmdp = pmd_offset(pudp, addr);
+                if (pmd_none(READ_ONCE(*pmdp))) {
                         void *p = NULL;
 
                         p = vmemmap_alloc_block_buf(PMD_SIZE, node);
                         if (!p)
                                 return -ENOMEM;
 
-                        pmd_set_huge(pmd, __pa(p), __pgprot(PROT_SECT_NORMAL));
+                        pmd_set_huge(pmdp, __pa(p), __pgprot(PROT_SECT_NORMAL));
                 } else
-                        vmemmap_verify((pte_t *)pmd, node, addr, next);
+                        vmemmap_verify((pte_t *)pmdp, node, addr, next);
         } while (addr = next, addr != end);
 
         return 0;
@@ -739,20 +750,22 @@ void vmemmap_free(unsigned long start, unsigned long end,
 
 static inline pud_t * fixmap_pud(unsigned long addr)
 {
-        pgd_t *pgd = pgd_offset_k(addr);
+        pgd_t *pgdp = pgd_offset_k(addr);
+        pgd_t pgd = READ_ONCE(*pgdp);
 
-        BUG_ON(pgd_none(*pgd) || pgd_bad(*pgd));
+        BUG_ON(pgd_none(pgd) || pgd_bad(pgd));
 
-        return pud_offset_kimg(pgd, addr);
+        return pud_offset_kimg(pgdp, addr);
 }
 
 static inline pmd_t * fixmap_pmd(unsigned long addr)
 {
-        pud_t *pud = fixmap_pud(addr);
+        pud_t *pudp = fixmap_pud(addr);
+        pud_t pud = READ_ONCE(*pudp);
 
-        BUG_ON(pud_none(*pud) || pud_bad(*pud));
+        BUG_ON(pud_none(pud) || pud_bad(pud));
 
-        return pmd_offset_kimg(pud, addr);
+        return pmd_offset_kimg(pudp, addr);
 }
 
 static inline pte_t * fixmap_pte(unsigned long addr)
@@ -768,30 +781,31 @@ static inline pte_t * fixmap_pte(unsigned long addr)
  */
 void __init early_fixmap_init(void)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp, pgd;
+        pud_t *pudp;
+        pmd_t *pmdp;
         unsigned long addr = FIXADDR_START;
 
-        pgd = pgd_offset_k(addr);
+        pgdp = pgd_offset_k(addr);
+        pgd = READ_ONCE(*pgdp);
         if (CONFIG_PGTABLE_LEVELS > 3 &&
-            !(pgd_none(*pgd) || pgd_page_paddr(*pgd) == __pa_symbol(bm_pud))) {
+            !(pgd_none(pgd) || pgd_page_paddr(pgd) == __pa_symbol(bm_pud))) {
                 /*
                  * We only end up here if the kernel mapping and the fixmap
                  * share the top level pgd entry, which should only happen on
                  * 16k/4 levels configurations.
                  */
                 BUG_ON(!IS_ENABLED(CONFIG_ARM64_16K_PAGES));
-                pud = pud_offset_kimg(pgd, addr);
+                pudp = pud_offset_kimg(pgdp, addr);
         } else {
-                if (pgd_none(*pgd))
-                        __pgd_populate(pgd, __pa_symbol(bm_pud), PUD_TYPE_TABLE);
-                pud = fixmap_pud(addr);
+                if (pgd_none(pgd))
+                        __pgd_populate(pgdp, __pa_symbol(bm_pud), PUD_TYPE_TABLE);
+                pudp = fixmap_pud(addr);
         }
-        if (pud_none(*pud))
-                __pud_populate(pud, __pa_symbol(bm_pmd), PMD_TYPE_TABLE);
-        pmd = fixmap_pmd(addr);
-        __pmd_populate(pmd, __pa_symbol(bm_pte), PMD_TYPE_TABLE);
+        if (pud_none(READ_ONCE(*pudp)))
+                __pud_populate(pudp, __pa_symbol(bm_pmd), PMD_TYPE_TABLE);
+        pmdp = fixmap_pmd(addr);
+        __pmd_populate(pmdp, __pa_symbol(bm_pte), PMD_TYPE_TABLE);
 
         /*
          * The boot-ioremap range spans multiple pmds, for which
@@ -800,11 +814,11 @@ void __init early_fixmap_init(void)
         BUILD_BUG_ON((__fix_to_virt(FIX_BTMAP_BEGIN) >> PMD_SHIFT)
                      != (__fix_to_virt(FIX_BTMAP_END) >> PMD_SHIFT));
 
-        if ((pmd != fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)))
-             || pmd != fixmap_pmd(fix_to_virt(FIX_BTMAP_END))) {
+        if ((pmdp != fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)))
+             || pmdp != fixmap_pmd(fix_to_virt(FIX_BTMAP_END))) {
                 WARN_ON(1);
-                pr_warn("pmd %p != %p, %p\n",
-                        pmd, fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)),
+                pr_warn("pmdp %p != %p, %p\n",
+                        pmdp, fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)),
                         fixmap_pmd(fix_to_virt(FIX_BTMAP_END)));
                 pr_warn("fix_to_virt(FIX_BTMAP_BEGIN): %08lx\n",
                         fix_to_virt(FIX_BTMAP_BEGIN));
@@ -824,16 +838,16 @@ void __set_fixmap(enum fixed_addresses idx,
                                phys_addr_t phys, pgprot_t flags)
 {
         unsigned long addr = __fix_to_virt(idx);
-        pte_t *pte;
+        pte_t *ptep;
 
         BUG_ON(idx <= FIX_HOLE || idx >= __end_of_fixed_addresses);
 
-        pte = fixmap_pte(addr);
+        ptep = fixmap_pte(addr);
 
         if (pgprot_val(flags)) {
-                set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
+                set_pte(ptep, pfn_pte(phys >> PAGE_SHIFT, flags));
         } else {
-                pte_clear(&init_mm, addr, pte);
+                pte_clear(&init_mm, addr, ptep);
                 flush_tlb_kernel_range(addr, addr+PAGE_SIZE);
         }
 }
@@ -915,36 +929,36 @@ int __init arch_ioremap_pmd_supported(void)
         return 1;
 }
 
-int pud_set_huge(pud_t *pud, phys_addr_t phys, pgprot_t prot)
+int pud_set_huge(pud_t *pudp, phys_addr_t phys, pgprot_t prot)
 {
         pgprot_t sect_prot = __pgprot(PUD_TYPE_SECT |
                                         pgprot_val(mk_sect_prot(prot)));
         BUG_ON(phys & ~PUD_MASK);
-        set_pud(pud, pfn_pud(__phys_to_pfn(phys), sect_prot));
+        set_pud(pudp, pfn_pud(__phys_to_pfn(phys), sect_prot));
         return 1;
 }
 
-int pmd_set_huge(pmd_t *pmd, phys_addr_t phys, pgprot_t prot)
+int pmd_set_huge(pmd_t *pmdp, phys_addr_t phys, pgprot_t prot)
 {
         pgprot_t sect_prot = __pgprot(PMD_TYPE_SECT |
                                         pgprot_val(mk_sect_prot(prot)));
         BUG_ON(phys & ~PMD_MASK);
-        set_pmd(pmd, pfn_pmd(__phys_to_pfn(phys), sect_prot));
+        set_pmd(pmdp, pfn_pmd(__phys_to_pfn(phys), sect_prot));
         return 1;
 }
 
-int pud_clear_huge(pud_t *pud)
+int pud_clear_huge(pud_t *pudp)
 {
-        if (!pud_sect(*pud))
+        if (!pud_sect(READ_ONCE(*pudp)))
                 return 0;
-        pud_clear(pud);
+        pud_clear(pudp);
         return 1;
 }
 
-int pmd_clear_huge(pmd_t *pmd)
+int pmd_clear_huge(pmd_t *pmdp)
 {
-        if (!pmd_sect(*pmd))
+        if (!pmd_sect(READ_ONCE(*pmdp)))
                 return 0;
-        pmd_clear(pmd);
+        pmd_clear(pmdp);
         return 1;
 }
diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
index a682a0a2a0fa..a56359373d8b 100644
--- a/arch/arm64/mm/pageattr.c
+++ b/arch/arm64/mm/pageattr.c
@@ -29,7 +29,7 @@ static int change_page_range(pte_t *ptep, pgtable_t token, unsigned long addr,
                         void *data)
 {
         struct page_change_data *cdata = data;
-        pte_t pte = *ptep;
+        pte_t pte = READ_ONCE(*ptep);
 
         pte = clear_pte_bit(pte, cdata->clear_mask);
         pte = set_pte_bit(pte, cdata->set_mask);
@@ -156,30 +156,32 @@ void __kernel_map_pages(struct page *page, int numpages, int enable)
  */
 bool kernel_page_present(struct page *page)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
+        pgd_t *pgdp;
+        pud_t *pudp, pud;
+        pmd_t *pmdp, pmd;
+        pte_t *ptep;
         unsigned long addr = (unsigned long)page_address(page);
 
-        pgd = pgd_offset_k(addr);
-        if (pgd_none(*pgd))
+        pgdp = pgd_offset_k(addr);
+        if (pgd_none(READ_ONCE(*pgdp)))
                 return false;
 
-        pud = pud_offset(pgd, addr);
-        if (pud_none(*pud))
+        pudp = pud_offset(pgdp, addr);
+        pud = READ_ONCE(*pudp);
+        if (pud_none(pud))
                 return false;
-        if (pud_sect(*pud))
+        if (pud_sect(pud))
                 return true;
 
-        pmd = pmd_offset(pud, addr);
-        if (pmd_none(*pmd))
+        pmdp = pmd_offset(pudp, addr);
+        pmd = READ_ONCE(*pmdp);
+        if (pmd_none(pmd))
                 return false;
-        if (pmd_sect(*pmd))
+        if (pmd_sect(pmd))
                 return true;
 
-        pte = pte_offset_kernel(pmd, addr);
-        return pte_valid(*pte);
+        ptep = pte_offset_kernel(pmdp, addr);
+        return pte_valid(READ_ONCE(*ptep));
 }
 #endif /* CONFIG_HIBERNATION */
 #endif /* CONFIG_DEBUG_PAGEALLOC */
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index 71baed7e592a..c0af47617299 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -205,7 +205,8 @@ ENDPROC(idmap_cpu_replace_ttbr1)
         dc      cvac, cur_\()\type\()p          // Ensure any existing dirty
         dmb     sy                              // lines are written back before
         ldr     \type, [cur_\()\type\()p]       // loading the entry
-        tbz     \type, #0, next_\()\type        // Skip invalid entries
+        tbz     \type, #0, skip_\()\type        // Skip invalid and
+        tbnz    \type, #11, skip_\()\type       // non-global entries
         .endm
 
         .macro __idmap_kpti_put_pgtable_ent_ng, type
@@ -265,8 +266,9 @@ ENTRY(idmap_kpti_install_ng_mappings)
         add     end_pgdp, cur_pgdp, #(PTRS_PER_PGD * 8)
 do_pgd: __idmap_kpti_get_pgtable_ent    pgd
         tbnz    pgd, #1, walk_puds
-        __idmap_kpti_put_pgtable_ent_ng pgd
 next_pgd:
+        __idmap_kpti_put_pgtable_ent_ng pgd
+skip_pgd:
         add     cur_pgdp, cur_pgdp, #8
         cmp     cur_pgdp, end_pgdp
         b.ne    do_pgd
@@ -294,8 +296,9 @@ walk_puds:
         add     end_pudp, cur_pudp, #(PTRS_PER_PUD * 8)
 do_pud: __idmap_kpti_get_pgtable_ent    pud
         tbnz    pud, #1, walk_pmds
-        __idmap_kpti_put_pgtable_ent_ng pud
 next_pud:
+        __idmap_kpti_put_pgtable_ent_ng pud
+skip_pud:
         add     cur_pudp, cur_pudp, 8
         cmp     cur_pudp, end_pudp
         b.ne    do_pud
@@ -314,8 +317,9 @@ walk_pmds:
         add     end_pmdp, cur_pmdp, #(PTRS_PER_PMD * 8)
 do_pmd: __idmap_kpti_get_pgtable_ent    pmd
         tbnz    pmd, #1, walk_ptes
-        __idmap_kpti_put_pgtable_ent_ng pmd
 next_pmd:
+        __idmap_kpti_put_pgtable_ent_ng pmd
+skip_pmd:
         add     cur_pmdp, cur_pmdp, #8
         cmp     cur_pmdp, end_pmdp
         b.ne    do_pmd
@@ -333,7 +337,7 @@ walk_ptes:
         add     end_ptep, cur_ptep, #(PTRS_PER_PTE * 8)
 do_pte: __idmap_kpti_get_pgtable_ent    pte
         __idmap_kpti_put_pgtable_ent_ng pte
-next_pte:
+skip_pte:
         add     cur_ptep, cur_ptep, #8
         cmp     cur_ptep, end_ptep
         b.ne    do_pte
diff --git a/arch/ia64/kernel/Makefile b/arch/ia64/kernel/Makefile
index 0b4c65a1af25..498f3da3f225 100644
--- a/arch/ia64/kernel/Makefile
+++ b/arch/ia64/kernel/Makefile
@@ -41,7 +41,6 @@ ifneq ($(CONFIG_IA64_ESI),)
 obj-y                           += esi_stub.o   # must be in kernel proper
 endif
 obj-$(CONFIG_INTEL_IOMMU)       += pci-dma.o
-obj-$(CONFIG_SWIOTLB)           += pci-swiotlb.o
 
 obj-$(CONFIG_BINFMT_ELF)        += elfcore.o
 
diff --git a/arch/mips/kernel/mips-cpc.c b/arch/mips/kernel/mips-cpc.c
index 19c88d770054..fcf9af492d60 100644
--- a/arch/mips/kernel/mips-cpc.c
+++ b/arch/mips/kernel/mips-cpc.c
@@ -10,6 +10,8 @@
 
 #include <linux/errno.h>
 #include <linux/percpu.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
 #include <linux/spinlock.h>
 
 #include <asm/mips-cps.h>
@@ -22,6 +24,17 @@ static DEFINE_PER_CPU_ALIGNED(unsigned long, cpc_core_lock_flags);
 
 phys_addr_t __weak mips_cpc_default_phys_base(void)
 {
+        struct device_node *cpc_node;
+        struct resource res;
+        int err;
+
+        cpc_node = of_find_compatible_node(of_root, NULL, "mti,mips-cpc");
+        if (cpc_node) {
+                err = of_address_to_resource(cpc_node, 0, &res);
+                if (!err)
+                        return res.start;
+        }
+
         return 0;
 }
 
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index 85bc601e9a0d..5f8b0a9e30b3 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -375,6 +375,7 @@ static void __init bootmem_init(void)
         unsigned long reserved_end;
         unsigned long mapstart = ~0UL;
         unsigned long bootmap_size;
+        phys_addr_t ramstart = (phys_addr_t)ULLONG_MAX;
         bool bootmap_valid = false;
         int i;
 
@@ -395,7 +396,8 @@ static void __init bootmem_init(void)
         max_low_pfn = 0;
 
         /*
-         * Find the highest page frame number we have available.
+         * Find the highest page frame number we have available
+         * and the lowest used RAM address
          */
         for (i = 0; i < boot_mem_map.nr_map; i++) {
                 unsigned long start, end;
@@ -407,6 +409,8 @@ static void __init bootmem_init(void)
                 end = PFN_DOWN(boot_mem_map.map[i].addr
                                 + boot_mem_map.map[i].size);
 
+                ramstart = min(ramstart, boot_mem_map.map[i].addr);
+
 #ifndef CONFIG_HIGHMEM
                 /*
                  * Skip highmem here so we get an accurate max_low_pfn if low
@@ -436,6 +440,13 @@ static void __init bootmem_init(void)
                 mapstart = max(reserved_end, start);
         }
 
+        /*
+         * Reserve any memory between the start of RAM and PHYS_OFFSET
+         */
+        if (ramstart > PHYS_OFFSET)
+                add_memory_region(PHYS_OFFSET, ramstart - PHYS_OFFSET,
+                                  BOOT_MEM_RESERVED);
+
         if (min_low_pfn >= max_low_pfn)
                 panic("Incorrect memory mapping !!!");
         if (min_low_pfn > ARCH_PFN_OFFSET) {
@@ -664,9 +675,6 @@ static int __init early_parse_mem(char *p)
 
         add_memory_region(start, size, BOOT_MEM_RAM);
 
-        if (start && start > PHYS_OFFSET)
-                add_memory_region(PHYS_OFFSET, start - PHYS_OFFSET,
-                                BOOT_MEM_RESERVED);
         return 0;
 }
 early_param("mem", early_parse_mem);
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index 87dcac2447c8..9d41732a9146 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -572,7 +572,7 @@ asmlinkage void __weak plat_wired_tlb_setup(void)
          */
 }
 
-void __init bmips_cpu_setup(void)
+void bmips_cpu_setup(void)
 {
         void __iomem __maybe_unused *cbr = BMIPS_GET_CBR();
         u32 __maybe_unused cfg;
diff --git a/arch/powerpc/include/asm/book3s/32/pgtable.h b/arch/powerpc/include/asm/book3s/32/pgtable.h
index 30a155c0a6b0..c615abdce119 100644
--- a/arch/powerpc/include/asm/book3s/32/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/32/pgtable.h
@@ -16,6 +16,7 @@
 #define PGD_INDEX_SIZE  (32 - PGDIR_SHIFT)
 
 #define PMD_CACHE_INDEX PMD_INDEX_SIZE
+#define PUD_CACHE_INDEX PUD_INDEX_SIZE
 
 #ifndef __ASSEMBLY__
 #define PTE_TABLE_SIZE  (sizeof(pte_t) << PTE_INDEX_SIZE)
diff --git a/arch/powerpc/include/asm/book3s/64/hash-4k.h b/arch/powerpc/include/asm/book3s/64/hash-4k.h
index 949d691094a4..67c5475311ee 100644
--- a/arch/powerpc/include/asm/book3s/64/hash-4k.h
+++ b/arch/powerpc/include/asm/book3s/64/hash-4k.h
@@ -63,7 +63,8 @@ static inline int hash__hugepd_ok(hugepd_t hpd)
  * keeping the prototype consistent across the two formats.
  */
 static inline unsigned long pte_set_hidx(pte_t *ptep, real_pte_t rpte,
-                        unsigned int subpg_index, unsigned long hidx)
+                                         unsigned int subpg_index, unsigned long hidx,
+                                         int offset)
 {
         return (hidx << H_PAGE_F_GIX_SHIFT) &
                 (H_PAGE_F_SECOND | H_PAGE_F_GIX);
diff --git a/arch/powerpc/include/asm/book3s/64/hash-64k.h b/arch/powerpc/include/asm/book3s/64/hash-64k.h
index 338b7da468ce..3bcf269f8f55 100644
--- a/arch/powerpc/include/asm/book3s/64/hash-64k.h
+++ b/arch/powerpc/include/asm/book3s/64/hash-64k.h
@@ -45,7 +45,7 @@
  * generic accessors and iterators here
  */
 #define __real_pte __real_pte
-static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep)
+static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep, int offset)
 {
         real_pte_t rpte;
         unsigned long *hidxp;
@@ -59,7 +59,7 @@ static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep)
          */
         smp_rmb();
 
-        hidxp = (unsigned long *)(ptep + PTRS_PER_PTE);
+        hidxp = (unsigned long *)(ptep + offset);
         rpte.hidx = *hidxp;
         return rpte;
 }
@@ -86,9 +86,10 @@ static inline unsigned long __rpte_to_hidx(real_pte_t rpte, unsigned long index)
  * expected to modify the PTE bits accordingly and commit the PTE to memory.
  */
 static inline unsigned long pte_set_hidx(pte_t *ptep, real_pte_t rpte,
-                unsigned int subpg_index, unsigned long hidx)
+                                         unsigned int subpg_index,
+                                         unsigned long hidx, int offset)
 {
-        unsigned long *hidxp = (unsigned long *)(ptep + PTRS_PER_PTE);
+        unsigned long *hidxp = (unsigned long *)(ptep + offset);
 
         rpte.hidx &= ~HIDX_BITS(0xfUL, subpg_index);
         *hidxp = rpte.hidx  | HIDX_BITS(HIDX_SHIFT_BY_ONE(hidx), subpg_index);
@@ -140,13 +141,18 @@ static inline int hash__remap_4k_pfn(struct vm_area_struct *vma, unsigned long a
 }
 
 #define H_PTE_TABLE_SIZE        PTE_FRAG_SIZE
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+#if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined (CONFIG_HUGETLB_PAGE)
 #define H_PMD_TABLE_SIZE        ((sizeof(pmd_t) << PMD_INDEX_SIZE) + \
                                  (sizeof(unsigned long) << PMD_INDEX_SIZE))
 #else
 #define H_PMD_TABLE_SIZE        (sizeof(pmd_t) << PMD_INDEX_SIZE)
 #endif
+#ifdef CONFIG_HUGETLB_PAGE
+#define H_PUD_TABLE_SIZE        ((sizeof(pud_t) << PUD_INDEX_SIZE) +    \
+                                 (sizeof(unsigned long) << PUD_INDEX_SIZE))
+#else
 #define H_PUD_TABLE_SIZE        (sizeof(pud_t) << PUD_INDEX_SIZE)
+#endif
 #define H_PGD_TABLE_SIZE        (sizeof(pgd_t) << PGD_INDEX_SIZE)
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
diff --git a/arch/powerpc/include/asm/book3s/64/hash.h b/arch/powerpc/include/asm/book3s/64/hash.h
index 0920eff731b3..935adcd92a81 100644
--- a/arch/powerpc/include/asm/book3s/64/hash.h
+++ b/arch/powerpc/include/asm/book3s/64/hash.h
@@ -23,7 +23,8 @@
                                  H_PUD_INDEX_SIZE + H_PGD_INDEX_SIZE + PAGE_SHIFT)
 #define H_PGTABLE_RANGE         (ASM_CONST(1) << H_PGTABLE_EADDR_SIZE)
 
-#if defined(CONFIG_TRANSPARENT_HUGEPAGE) &&  defined(CONFIG_PPC_64K_PAGES)
+#if (defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_HUGETLB_PAGE)) && \
+        defined(CONFIG_PPC_64K_PAGES)
 /*
  * only with hash 64k we need to use the second half of pmd page table
  * to store pointer to deposited pgtable_t
@@ -33,6 +34,16 @@
 #define H_PMD_CACHE_INDEX       H_PMD_INDEX_SIZE
 #endif
 /*
+ * We store the slot details in the second half of page table.
+ * Increase the pud level table so that hugetlb ptes can be stored
+ * at pud level.
+ */
+#if defined(CONFIG_HUGETLB_PAGE) &&  defined(CONFIG_PPC_64K_PAGES)
+#define H_PUD_CACHE_INDEX       (H_PUD_INDEX_SIZE + 1)
+#else
+#define H_PUD_CACHE_INDEX       (H_PUD_INDEX_SIZE)
+#endif
+/*
  * Define the address range of the kernel non-linear virtual area
  */
 #define H_KERN_VIRT_START ASM_CONST(0xD000000000000000)
diff --git a/arch/powerpc/include/asm/book3s/64/pgalloc.h b/arch/powerpc/include/asm/book3s/64/pgalloc.h
index 1fcfa425cefa..4746bc68d446 100644
--- a/arch/powerpc/include/asm/book3s/64/pgalloc.h
+++ b/arch/powerpc/include/asm/book3s/64/pgalloc.h
@@ -73,10 +73,16 @@ static inline void radix__pgd_free(struct mm_struct *mm, pgd_t *pgd)
 
 static inline pgd_t *pgd_alloc(struct mm_struct *mm)
 {
+        pgd_t *pgd;
+
         if (radix_enabled())
                 return radix__pgd_alloc(mm);
-        return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
-                pgtable_gfp_flags(mm, GFP_KERNEL));
+
+        pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
+                               pgtable_gfp_flags(mm, GFP_KERNEL));
+        memset(pgd, 0, PGD_TABLE_SIZE);
+
+        return pgd;
 }
 
 static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
@@ -93,13 +99,13 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
 
 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
-        return kmem_cache_alloc(PGT_CACHE(PUD_INDEX_SIZE),
+        return kmem_cache_alloc(PGT_CACHE(PUD_CACHE_INDEX),
                 pgtable_gfp_flags(mm, GFP_KERNEL));
 }
 
 static inline void pud_free(struct mm_struct *mm, pud_t *pud)
 {
-        kmem_cache_free(PGT_CACHE(PUD_INDEX_SIZE), pud);
+        kmem_cache_free(PGT_CACHE(PUD_CACHE_INDEX), pud);
 }
 
 static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
@@ -115,7 +121,7 @@ static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pud,
          * ahead and flush the page walk cache
          */
         flush_tlb_pgtable(tlb, address);
-        pgtable_free_tlb(tlb, pud, PUD_INDEX_SIZE);
+        pgtable_free_tlb(tlb, pud, PUD_CACHE_INDEX);
 }
 
 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
index 51017726d495..a6b9f1d74600 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
@@ -232,11 +232,13 @@ extern unsigned long __pmd_index_size;
 extern unsigned long __pud_index_size;
 extern unsigned long __pgd_index_size;
 extern unsigned long __pmd_cache_index;
+extern unsigned long __pud_cache_index;
 #define PTE_INDEX_SIZE  __pte_index_size
 #define PMD_INDEX_SIZE  __pmd_index_size
 #define PUD_INDEX_SIZE  __pud_index_size
 #define PGD_INDEX_SIZE  __pgd_index_size
 #define PMD_CACHE_INDEX __pmd_cache_index
+#define PUD_CACHE_INDEX __pud_cache_index
 /*
  * Because of use of pte fragments and THP, size of page table
  * are not always derived out of index size above.
@@ -348,7 +350,7 @@ extern unsigned long pci_io_base;
  */
 #ifndef __real_pte
 
-#define __real_pte(e,p)         ((real_pte_t){(e)})
+#define __real_pte(e, p, o)             ((real_pte_t){(e)})
 #define __rpte_to_pte(r)        ((r).pte)
 #define __rpte_to_hidx(r,index) (pte_val(__rpte_to_pte(r)) >> H_PAGE_F_GIX_SHIFT)
 
diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
index 176dfb73d42c..471b2274fbeb 100644
--- a/arch/powerpc/include/asm/exception-64s.h
+++ b/arch/powerpc/include/asm/exception-64s.h
@@ -645,7 +645,7 @@ END_FTR_SECTION_NESTED(ftr,ftr,943)
                                           EXC_HV, SOFTEN_TEST_HV, bitmask)
 
 #define MASKABLE_RELON_EXCEPTION_HV_OOL(vec, label, bitmask)            \
-        MASKABLE_EXCEPTION_PROLOG_1(PACA_EXGEN, SOFTEN_NOTEST_HV, vec, bitmask);\
+        MASKABLE_EXCEPTION_PROLOG_1(PACA_EXGEN, SOFTEN_TEST_HV, vec, bitmask);\
         EXCEPTION_RELON_PROLOG_PSERIES_1(label, EXC_HV)
 
 /*
diff --git a/arch/powerpc/include/asm/hw_irq.h b/arch/powerpc/include/asm/hw_irq.h
index 88e5e8f17e98..855e17d158b1 100644
--- a/arch/powerpc/include/asm/hw_irq.h
+++ b/arch/powerpc/include/asm/hw_irq.h
@@ -30,6 +30,16 @@
 #define PACA_IRQ_PMI            0x40
 
 /*
+ * Some soft-masked interrupts must be hard masked until they are replayed
+ * (e.g., because the soft-masked handler does not clear the exception).
+ */
+#ifdef CONFIG_PPC_BOOK3S
+#define PACA_IRQ_MUST_HARD_MASK (PACA_IRQ_EE|PACA_IRQ_PMI)
+#else
+#define PACA_IRQ_MUST_HARD_MASK (PACA_IRQ_EE)
+#endif
+
+/*
  * flags for paca->irq_soft_mask
  */
 #define IRQS_ENABLED            0
@@ -244,7 +254,7 @@ static inline bool lazy_irq_pending(void)
 static inline void may_hard_irq_enable(void)
 {
         get_paca()->irq_happened &= ~PACA_IRQ_HARD_DIS;
-        if (!(get_paca()->irq_happened & PACA_IRQ_EE))
+        if (!(get_paca()->irq_happened & PACA_IRQ_MUST_HARD_MASK))
                 __hard_irq_enable();
 }
 
diff --git a/arch/powerpc/include/asm/kexec.h b/arch/powerpc/include/asm/kexec.h
index 9dcbfa6bbb91..d8b1e8e7e035 100644
--- a/arch/powerpc/include/asm/kexec.h
+++ b/arch/powerpc/include/asm/kexec.h
@@ -140,6 +140,12 @@ static inline bool kdump_in_progress(void)
         return false;
 }
 
+static inline void crash_ipi_callback(struct pt_regs *regs) { }
+
+static inline void crash_send_ipi(void (*crash_ipi_callback)(struct pt_regs *))
+{
+}
+
 #endif /* CONFIG_KEXEC_CORE */
 #endif /* ! __ASSEMBLY__ */
 #endif /* __KERNEL__ */
diff --git a/arch/powerpc/include/asm/nohash/32/pgtable.h b/arch/powerpc/include/asm/nohash/32/pgtable.h
index 504a3c36ce5c..03bbd1149530 100644
--- a/arch/powerpc/include/asm/nohash/32/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/32/pgtable.h
@@ -24,6 +24,7 @@ extern int icache_44x_need_flush;
 #define PGD_INDEX_SIZE  (32 - PGDIR_SHIFT)
 
 #define PMD_CACHE_INDEX PMD_INDEX_SIZE
+#define PUD_CACHE_INDEX PUD_INDEX_SIZE
 
 #ifndef __ASSEMBLY__
 #define PTE_TABLE_SIZE  (sizeof(pte_t) << PTE_INDEX_SIZE)
diff --git a/arch/powerpc/include/asm/nohash/64/pgtable.h b/arch/powerpc/include/asm/nohash/64/pgtable.h
index abddf5830ad5..5c5f75d005ad 100644
--- a/arch/powerpc/include/asm/nohash/64/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/64/pgtable.h
@@ -27,6 +27,7 @@
 #else
 #define PMD_CACHE_INDEX PMD_INDEX_SIZE
 #endif
+#define PUD_CACHE_INDEX PUD_INDEX_SIZE
 
 /*
  * Define the address range of the kernel non-linear virtual area
diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
index 88187c285c70..9f421641a35c 100644
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -44,6 +44,11 @@ extern int sysfs_add_device_to_node(struct device *dev, int nid);
 extern void sysfs_remove_device_from_node(struct device *dev, int nid);
 extern int numa_update_cpu_topology(bool cpus_locked);
 
+static inline void update_numa_cpu_lookup_table(unsigned int cpu, int node)
+{
+        numa_cpu_lookup_table[cpu] = node;
+}
+
 static inline int early_cpu_to_node(int cpu)
 {
         int nid;
@@ -76,12 +81,16 @@ static inline int numa_update_cpu_topology(bool cpus_locked)
 {
         return 0;
 }
+
+static inline void update_numa_cpu_lookup_table(unsigned int cpu, int node) {}
+
 #endif /* CONFIG_NUMA */
 
 #if defined(CONFIG_NUMA) && defined(CONFIG_PPC_SPLPAR)
 extern int start_topology_update(void);
 extern int stop_topology_update(void);
 extern int prrn_is_enabled(void);
+extern int find_and_online_cpu_nid(int cpu);
 #else
 static inline int start_topology_update(void)
 {
@@ -95,6 +104,10 @@ static inline int prrn_is_enabled(void)
 {
         return 0;
 }
+static inline int find_and_online_cpu_nid(int cpu)
+{
+        return 0;
+}
 #endif /* CONFIG_NUMA && CONFIG_PPC_SPLPAR */
 
 #if defined(CONFIG_HOTPLUG_CPU) || defined(CONFIG_NEED_MULTIPLE_NODES)
diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
index ee832d344a5a..9b6e653e501a 100644
--- a/arch/powerpc/kernel/exceptions-64e.S
+++ b/arch/powerpc/kernel/exceptions-64e.S
@@ -943,6 +943,8 @@ kernel_dbg_exc:
 /*
  * An interrupt came in while soft-disabled; We mark paca->irq_happened
  * accordingly and if the interrupt is level sensitive, we hard disable
+ * hard disable (full_mask) corresponds to PACA_IRQ_MUST_HARD_MASK, so
+ * keep these in synch.
  */
 
 .macro masked_interrupt_book3e paca_irq full_mask
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 243d072a225a..3ac87e53b3da 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1426,7 +1426,7 @@ EXC_COMMON_BEGIN(soft_nmi_common)
  *   triggered and won't automatically refire.
  * - If it was a HMI we return immediately since we handled it in realmode
  *   and it won't refire.
- * - else we hard disable and return.
+ * - Else it is one of PACA_IRQ_MUST_HARD_MASK, so hard disable and return.
  * This is called with r10 containing the value to OR to the paca field.
  */
 #define MASKED_INTERRUPT(_H)                            \
@@ -1441,8 +1441,8 @@ masked_##_H##interrupt:					\
         ori     r10,r10,0xffff;                         \
         mtspr   SPRN_DEC,r10;                           \
         b       MASKED_DEC_HANDLER_LABEL;               \
-1:      andi.   r10,r10,(PACA_IRQ_DBELL|PACA_IRQ_HMI);  \
-        bne     2f;                                     \
+1:      andi.   r10,r10,PACA_IRQ_MUST_HARD_MASK;        \
+        beq     2f;                                     \
         mfspr   r10,SPRN_##_H##SRR1;                    \
         xori    r10,r10,MSR_EE; /* clear MSR_EE */      \
         mtspr   SPRN_##_H##SRR1,r10;                    \
diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
index 5a8bfee6e187..04d0bbd7a1dd 100644
--- a/arch/powerpc/kernel/sysfs.c
+++ b/arch/powerpc/kernel/sysfs.c
@@ -788,7 +788,8 @@ static int register_cpu_online(unsigned int cpu)
         if (cpu_has_feature(CPU_FTR_PPCAS_ARCH_V2))
                 device_create_file(s, &dev_attr_pir);
 
-        if (cpu_has_feature(CPU_FTR_ARCH_206))
+        if (cpu_has_feature(CPU_FTR_ARCH_206) &&
+                !firmware_has_feature(FW_FEATURE_LPAR))
                 device_create_file(s, &dev_attr_tscr);
 #endif /* CONFIG_PPC64 */
 
@@ -873,7 +874,8 @@ static int unregister_cpu_online(unsigned int cpu)
         if (cpu_has_feature(CPU_FTR_PPCAS_ARCH_V2))
                 device_remove_file(s, &dev_attr_pir);
 
-        if (cpu_has_feature(CPU_FTR_ARCH_206))
+        if (cpu_has_feature(CPU_FTR_ARCH_206) &&
+                !firmware_has_feature(FW_FEATURE_LPAR))
                 device_remove_file(s, &dev_attr_tscr);
 #endif /* CONFIG_PPC64 */
 
diff --git a/arch/powerpc/mm/drmem.c b/arch/powerpc/mm/drmem.c
index 1604110c4238..916844f99c64 100644
--- a/arch/powerpc/mm/drmem.c
+++ b/arch/powerpc/mm/drmem.c
@@ -216,6 +216,8 @@ static void __init __walk_drmem_v1_lmbs(const __be32 *prop, const __be32 *usm,
         u32 i, n_lmbs;
 
         n_lmbs = of_read_number(prop++, 1);
+        if (n_lmbs == 0)
+                return;
 
         for (i = 0; i < n_lmbs; i++) {
                 read_drconf_v1_cell(&lmb, &prop);
@@ -245,6 +247,8 @@ static void __init __walk_drmem_v2_lmbs(const __be32 *prop, const __be32 *usm,
         u32 i, j, lmb_sets;
 
         lmb_sets = of_read_number(prop++, 1);
+        if (lmb_sets == 0)
+                return;
 
         for (i = 0; i < lmb_sets; i++) {
                 read_drconf_v2_cell(&dr_cell, &prop);
@@ -354,6 +358,8 @@ static void __init init_drmem_v1_lmbs(const __be32 *prop)
         struct drmem_lmb *lmb;
 
         drmem_info->n_lmbs = of_read_number(prop++, 1);
+        if (drmem_info->n_lmbs == 0)
+                return;
 
         drmem_info->lmbs = kcalloc(drmem_info->n_lmbs, sizeof(*lmb),
                                    GFP_KERNEL);
@@ -373,6 +379,8 @@ static void __init init_drmem_v2_lmbs(const __be32 *prop)
         int lmb_index;
 
         lmb_sets = of_read_number(prop++, 1);
+        if (lmb_sets == 0)
+                return;
 
         /* first pass, calculate the number of LMBs */
         p = prop;
diff --git a/arch/powerpc/mm/hash64_4k.c b/arch/powerpc/mm/hash64_4k.c
index 5a69b51d08a3..d573d7d07f25 100644
--- a/arch/powerpc/mm/hash64_4k.c
+++ b/arch/powerpc/mm/hash64_4k.c
@@ -55,7 +55,7 @@ int __hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid,
          * need to add in 0x1 if it's a read-only user page
          */
         rflags = htab_convert_pte_flags(new_pte);
-        rpte = __real_pte(__pte(old_pte), ptep);
+        rpte = __real_pte(__pte(old_pte), ptep, PTRS_PER_PTE);
 
         if (cpu_has_feature(CPU_FTR_NOEXECUTE) &&
             !cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
@@ -117,7 +117,7 @@ repeat:
                         return -1;
                 }
                 new_pte = (new_pte & ~_PAGE_HPTEFLAGS) | H_PAGE_HASHPTE;
-                new_pte |= pte_set_hidx(ptep, rpte, 0, slot);
+                new_pte |= pte_set_hidx(ptep, rpte, 0, slot, PTRS_PER_PTE);
         }
         *ptep = __pte(new_pte & ~H_PAGE_BUSY);
         return 0;
diff --git a/arch/powerpc/mm/hash64_64k.c b/arch/powerpc/mm/hash64_64k.c
index 2253bbc6a599..e601d95c3b20 100644
--- a/arch/powerpc/mm/hash64_64k.c
+++ b/arch/powerpc/mm/hash64_64k.c
@@ -86,7 +86,7 @@ int __hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid,
 
         subpg_index = (ea & (PAGE_SIZE - 1)) >> shift;
         vpn  = hpt_vpn(ea, vsid, ssize);
-        rpte = __real_pte(__pte(old_pte), ptep);
+        rpte = __real_pte(__pte(old_pte), ptep, PTRS_PER_PTE);
         /*
          *None of the sub 4k page is hashed
          */
@@ -214,7 +214,7 @@ repeat:
                 return -1;
         }
 
-        new_pte |= pte_set_hidx(ptep, rpte, subpg_index, slot);
+        new_pte |= pte_set_hidx(ptep, rpte, subpg_index, slot, PTRS_PER_PTE);
         new_pte |= H_PAGE_HASHPTE;
 
         *ptep = __pte(new_pte & ~H_PAGE_BUSY);
@@ -262,7 +262,7 @@ int __hash_page_64K(unsigned long ea, unsigned long access,
         } while (!pte_xchg(ptep, __pte(old_pte), __pte(new_pte)));
 
         rflags = htab_convert_pte_flags(new_pte);
-        rpte = __real_pte(__pte(old_pte), ptep);
+        rpte = __real_pte(__pte(old_pte), ptep, PTRS_PER_PTE);
 
         if (cpu_has_feature(CPU_FTR_NOEXECUTE) &&
             !cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
@@ -327,7 +327,7 @@ repeat:
                 }
 
                 new_pte = (new_pte & ~_PAGE_HPTEFLAGS) | H_PAGE_HASHPTE;
-                new_pte |= pte_set_hidx(ptep, rpte, 0, slot);
+                new_pte |= pte_set_hidx(ptep, rpte, 0, slot, PTRS_PER_PTE);
         }
         *ptep = __pte(new_pte & ~H_PAGE_BUSY);
         return 0;
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index 7d07c7e17db6..cf290d415dcd 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -1008,6 +1008,7 @@ void __init hash__early_init_mmu(void)
         __pmd_index_size = H_PMD_INDEX_SIZE;
         __pud_index_size = H_PUD_INDEX_SIZE;
         __pgd_index_size = H_PGD_INDEX_SIZE;
+        __pud_cache_index = H_PUD_CACHE_INDEX;
         __pmd_cache_index = H_PMD_CACHE_INDEX;
         __pte_table_size = H_PTE_TABLE_SIZE;
         __pmd_table_size = H_PMD_TABLE_SIZE;
diff --git a/arch/powerpc/mm/hugetlbpage-hash64.c b/arch/powerpc/mm/hugetlbpage-hash64.c
index 12511f5a015f..b320f5097a06 100644
--- a/arch/powerpc/mm/hugetlbpage-hash64.c
+++ b/arch/powerpc/mm/hugetlbpage-hash64.c
@@ -27,7 +27,7 @@ int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
         unsigned long vpn;
         unsigned long old_pte, new_pte;
         unsigned long rflags, pa, sz;
-        long slot;
+        long slot, offset;
 
         BUG_ON(shift != mmu_psize_defs[mmu_psize].shift);
 
@@ -63,7 +63,11 @@ int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
         } while(!pte_xchg(ptep, __pte(old_pte), __pte(new_pte)));
 
         rflags = htab_convert_pte_flags(new_pte);
-        rpte = __real_pte(__pte(old_pte), ptep);
+        if (unlikely(mmu_psize == MMU_PAGE_16G))
+                offset = PTRS_PER_PUD;
+        else
+                offset = PTRS_PER_PMD;
+        rpte = __real_pte(__pte(old_pte), ptep, offset);
 
         sz = ((1UL) << shift);
         if (!cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
@@ -104,7 +108,7 @@ int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
                         return -1;
                 }
 
-                new_pte |= pte_set_hidx(ptep, rpte, 0, slot);
+                new_pte |= pte_set_hidx(ptep, rpte, 0, slot, offset);
         }
 
         /*
diff --git a/arch/powerpc/mm/init-common.c b/arch/powerpc/mm/init-common.c
index eb8c6c8c4851..2b656e67f2ea 100644
--- a/arch/powerpc/mm/init-common.c
+++ b/arch/powerpc/mm/init-common.c
@@ -100,6 +100,6 @@ void pgtable_cache_init(void)
          * same size as either the pgd or pmd index except with THP enabled
          * on book3s 64
          */
-        if (PUD_INDEX_SIZE && !PGT_CACHE(PUD_INDEX_SIZE))
-                pgtable_cache_add(PUD_INDEX_SIZE, pud_ctor);
+        if (PUD_CACHE_INDEX && !PGT_CACHE(PUD_CACHE_INDEX))
+                pgtable_cache_add(PUD_CACHE_INDEX, pud_ctor);
 }
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 314d19ab9385..edd8d0bc9364 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -143,11 +143,6 @@ static void reset_numa_cpu_lookup_table(void)
                 numa_cpu_lookup_table[cpu] = -1;
 }
 
-static void update_numa_cpu_lookup_table(unsigned int cpu, int node)
-{
-        numa_cpu_lookup_table[cpu] = node;
-}
-
 static void map_cpu_to_node(int cpu, int node)
 {
         update_numa_cpu_lookup_table(cpu, node);
diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
index 573a9a2ee455..2e10a964e290 100644
--- a/arch/powerpc/mm/pgtable-radix.c
+++ b/arch/powerpc/mm/pgtable-radix.c
@@ -17,9 +17,11 @@
 #include <linux/of_fdt.h>
 #include <linux/mm.h>
 #include <linux/string_helpers.h>
+#include <linux/stop_machine.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
+#include <asm/mmu_context.h>
 #include <asm/dma.h>
 #include <asm/machdep.h>
 #include <asm/mmu.h>
@@ -333,6 +335,22 @@ static void __init radix_init_pgtable(void)
                      "r" (TLBIEL_INVAL_SET_LPID), "r" (0));
         asm volatile("eieio; tlbsync; ptesync" : : : "memory");
         trace_tlbie(0, 0, TLBIEL_INVAL_SET_LPID, 0, 2, 1, 1);
+
+        /*
+         * The init_mm context is given the first available (non-zero) PID,
+         * which is the "guard PID" and contains no page table. PIDR should
+         * never be set to zero because that duplicates the kernel address
+         * space at the 0x0... offset (quadrant 0)!
+         *
+         * An arbitrary PID that may later be allocated by the PID allocator
+         * for userspace processes must not be used either, because that
+         * would cause stale user mappings for that PID on CPUs outside of
+         * the TLB invalidation scheme (because it won't be in mm_cpumask).
+         *
+         * So permanently carve out one PID for the purpose of a guard PID.
+         */
+        init_mm.context.id = mmu_base_pid;
+        mmu_base_pid++;
 }
 
 static void __init radix_init_partition_table(void)
@@ -535,6 +553,7 @@ void __init radix__early_init_mmu(void)
         __pmd_index_size = RADIX_PMD_INDEX_SIZE;
         __pud_index_size = RADIX_PUD_INDEX_SIZE;
         __pgd_index_size = RADIX_PGD_INDEX_SIZE;
+        __pud_cache_index = RADIX_PUD_INDEX_SIZE;
         __pmd_cache_index = RADIX_PMD_INDEX_SIZE;
         __pte_table_size = RADIX_PTE_TABLE_SIZE;
         __pmd_table_size = RADIX_PMD_TABLE_SIZE;
@@ -579,7 +598,8 @@ void __init radix__early_init_mmu(void)
 
         radix_init_iamr();
         radix_init_pgtable();
-
+        /* Switch to the guard PID before turning on MMU */
+        radix__switch_mmu_context(NULL, &init_mm);
         if (cpu_has_feature(CPU_FTR_HVMODE))
                 tlbiel_all();
 }
@@ -604,6 +624,7 @@ void radix__early_init_mmu_secondary(void)
         }
         radix_init_iamr();
 
+        radix__switch_mmu_context(NULL, &init_mm);
         if (cpu_has_feature(CPU_FTR_HVMODE))
                 tlbiel_all();
 }
@@ -666,6 +687,30 @@ static void free_pmd_table(pmd_t *pmd_start, pud_t *pud)
         pud_clear(pud);
 }
 
+struct change_mapping_params {
+        pte_t *pte;
+        unsigned long start;
+        unsigned long end;
+        unsigned long aligned_start;
+        unsigned long aligned_end;
+};
+
+static int stop_machine_change_mapping(void *data)
+{
+        struct change_mapping_params *params =
+                        (struct change_mapping_params *)data;
+
+        if (!data)
+                return -1;
+
+        spin_unlock(&init_mm.page_table_lock);
+        pte_clear(&init_mm, params->aligned_start, params->pte);
+        create_physical_mapping(params->aligned_start, params->start);
+        create_physical_mapping(params->end, params->aligned_end);
+        spin_lock(&init_mm.page_table_lock);
+        return 0;
+}
+
 static void remove_pte_table(pte_t *pte_start, unsigned long addr,
                              unsigned long end)
 {
@@ -694,6 +739,52 @@ static void remove_pte_table(pte_t *pte_start, unsigned long addr,
         }
 }
 
+/*
+ * clear the pte and potentially split the mapping helper
+ */
+static void split_kernel_mapping(unsigned long addr, unsigned long end,
+                                unsigned long size, pte_t *pte)
+{
+        unsigned long mask = ~(size - 1);
+        unsigned long aligned_start = addr & mask;
+        unsigned long aligned_end = addr + size;
+        struct change_mapping_params params;
+        bool split_region = false;
+
+        if ((end - addr) < size) {
+                /*
+                 * We're going to clear the PTE, but not flushed
+                 * the mapping, time to remap and flush. The
+                 * effects if visible outside the processor or
+                 * if we are running in code close to the
+                 * mapping we cleared, we are in trouble.
+                 */
+                if (overlaps_kernel_text(aligned_start, addr) ||
+                        overlaps_kernel_text(end, aligned_end)) {
+                        /*
+                         * Hack, just return, don't pte_clear
+                         */
+                        WARN_ONCE(1, "Linear mapping %lx->%lx overlaps kernel "
+                                  "text, not splitting\n", addr, end);
+                        return;
+                }
+                split_region = true;
+        }
+
+        if (split_region) {
+                params.pte = pte;
+                params.start = addr;
+                params.end = end;
+                params.aligned_start = addr & ~(size - 1);
+                params.aligned_end = min_t(unsigned long, aligned_end,
+                                (unsigned long)__va(memblock_end_of_DRAM()));
+                stop_machine(stop_machine_change_mapping, &params, NULL);
+                return;
+        }
+
+        pte_clear(&init_mm, addr, pte);
+}
+
 static void remove_pmd_table(pmd_t *pmd_start, unsigned long addr,
                              unsigned long end)
 {
@@ -709,13 +800,7 @@ static void remove_pmd_table(pmd_t *pmd_start, unsigned long addr,
                         continue;
 
                 if (pmd_huge(*pmd)) {
-                        if (!IS_ALIGNED(addr, PMD_SIZE) ||
-                            !IS_ALIGNED(next, PMD_SIZE)) {
-                                WARN_ONCE(1, "%s: unaligned range\n", __func__);
-                                continue;
-                        }
-
-                        pte_clear(&init_mm, addr, (pte_t *)pmd);
+                        split_kernel_mapping(addr, end, PMD_SIZE, (pte_t *)pmd);
                         continue;
                 }
 
@@ -740,13 +825,7 @@ static void remove_pud_table(pud_t *pud_start, unsigned long addr,
                         continue;
 
                 if (pud_huge(*pud)) {
-                        if (!IS_ALIGNED(addr, PUD_SIZE) ||
-                            !IS_ALIGNED(next, PUD_SIZE)) {
-                                WARN_ONCE(1, "%s: unaligned range\n", __func__);
-                                continue;
-                        }
-
-                        pte_clear(&init_mm, addr, (pte_t *)pud);
+                        split_kernel_mapping(addr, end, PUD_SIZE, (pte_t *)pud);
                         continue;
                 }
 
@@ -772,13 +851,7 @@ static void remove_pagetable(unsigned long start, unsigned long end)
                         continue;
 
                 if (pgd_huge(*pgd)) {
-                        if (!IS_ALIGNED(addr, PGDIR_SIZE) ||
-                            !IS_ALIGNED(next, PGDIR_SIZE)) {
-                                WARN_ONCE(1, "%s: unaligned range\n", __func__);
-                                continue;
-                        }
-
-                        pte_clear(&init_mm, addr, (pte_t *)pgd);
+                        split_kernel_mapping(addr, end, PGDIR_SIZE, (pte_t *)pgd);
                         continue;
                 }
 
diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
index c9a623c2d8a2..28c980eb4422 100644
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -82,6 +82,8 @@ unsigned long __pgd_index_size;
 EXPORT_SYMBOL(__pgd_index_size);
 unsigned long __pmd_cache_index;
 EXPORT_SYMBOL(__pmd_cache_index);
+unsigned long __pud_cache_index;
+EXPORT_SYMBOL(__pud_cache_index);
 unsigned long __pte_table_size;
 EXPORT_SYMBOL(__pte_table_size);
 unsigned long __pmd_table_size;
@@ -471,6 +473,8 @@ void mmu_partition_table_set_entry(unsigned int lpid, unsigned long dw0,
         if (old & PATB_HR) {
                 asm volatile(PPC_TLBIE_5(%0,%1,2,0,1) : :
                              "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
+                asm volatile(PPC_TLBIE_5(%0,%1,2,1,1) : :
+                             "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
                 trace_tlbie(lpid, 0, TLBIEL_INVAL_SET_LPID, lpid, 2, 0, 1);
         } else {
                 asm volatile(PPC_TLBIE_5(%0,%1,2,0,0) : :
diff --git a/arch/powerpc/mm/tlb_hash64.c b/arch/powerpc/mm/tlb_hash64.c
index 881ebd53ffc2..9b23f12e863c 100644
--- a/arch/powerpc/mm/tlb_hash64.c
+++ b/arch/powerpc/mm/tlb_hash64.c
@@ -51,7 +51,7 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
         unsigned int psize;
         int ssize;
         real_pte_t rpte;
-        int i;
+        int i, offset;
 
         i = batch->index;
 
@@ -67,6 +67,10 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
                 psize = get_slice_psize(mm, addr);
                 /* Mask the address for the correct page size */
                 addr &= ~((1UL << mmu_psize_defs[psize].shift) - 1);
+                if (unlikely(psize == MMU_PAGE_16G))
+                        offset = PTRS_PER_PUD;
+                else
+                        offset = PTRS_PER_PMD;
 #else
                 BUG();
                 psize = pte_pagesize_index(mm, addr, pte); /* shutup gcc */
@@ -78,6 +82,7 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
                  * support 64k pages, this might be different from the
                  * hardware page size encoded in the slice table. */
                 addr &= PAGE_MASK;
+                offset = PTRS_PER_PTE;
         }
 
 
@@ -91,7 +96,7 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
         }
         WARN_ON(vsid == 0);
         vpn = hpt_vpn(addr, vsid, ssize);
-        rpte = __real_pte(__pte(pte), ptep);
+        rpte = __real_pte(__pte(pte), ptep, offset);
 
         /*
          * Check if we have an active batch on this CPU. If not, just
diff --git a/arch/powerpc/platforms/powernv/opal-imc.c b/arch/powerpc/platforms/powernv/opal-imc.c
index dd4c9b8b8a81..f6f55ab4980e 100644
--- a/arch/powerpc/platforms/powernv/opal-imc.c
+++ b/arch/powerpc/platforms/powernv/opal-imc.c
@@ -199,9 +199,11 @@ static void disable_nest_pmu_counters(void)
         const struct cpumask *l_cpumask;
 
         get_online_cpus();
-        for_each_online_node(nid) {
+        for_each_node_with_cpus(nid) {
                 l_cpumask = cpumask_of_node(nid);
-                cpu = cpumask_first(l_cpumask);
+                cpu = cpumask_first_and(l_cpumask, cpu_online_mask);
+                if (cpu >= nr_cpu_ids)
+                        continue;
                 opal_imc_counters_stop(OPAL_IMC_COUNTERS_NEST,
                                        get_hard_smp_processor_id(cpu));
         }
diff --git a/arch/powerpc/platforms/powernv/vas-window.c b/arch/powerpc/platforms/powernv/vas-window.c
index 2b3eb01ab110..b7c53a51c31b 100644
--- a/arch/powerpc/platforms/powernv/vas-window.c
+++ b/arch/powerpc/platforms/powernv/vas-window.c
@@ -1063,16 +1063,16 @@ struct vas_window *vas_tx_win_open(int vasid, enum vas_cop_type cop,
                         rc = PTR_ERR(txwin->paste_kaddr);
                         goto free_window;
                 }
+        } else {
+                /*
+                 * A user mapping must ensure that context switch issues
+                 * CP_ABORT for this thread.
+                 */
+                rc = set_thread_uses_vas();
+                if (rc)
+                        goto free_window;
         }
 
-        /*
-         * Now that we have a send window, ensure context switch issues
-         * CP_ABORT for this thread.
-         */
-        rc = -EINVAL;
-        if (set_thread_uses_vas() < 0)
-                goto free_window;
-
         set_vinst_win(vinst, txwin);
 
         return txwin;
diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
index dceb51454d8d..652d3e96b812 100644
--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
@@ -36,6 +36,7 @@
 #include <asm/xics.h>
 #include <asm/xive.h>
 #include <asm/plpar_wrappers.h>
+#include <asm/topology.h>
 
 #include "pseries.h"
 #include "offline_states.h"
@@ -331,6 +332,7 @@ static void pseries_remove_processor(struct device_node *np)
                         BUG_ON(cpu_online(cpu));
                         set_cpu_present(cpu, false);
                         set_hard_smp_processor_id(cpu, -1);
+                        update_numa_cpu_lookup_table(cpu, -1);
                         break;
                 }
                 if (cpu >= nr_cpu_ids)
@@ -340,8 +342,6 @@ static void pseries_remove_processor(struct device_node *np)
         cpu_maps_update_done();
 }
 
-extern int find_and_online_cpu_nid(int cpu);
-
 static int dlpar_online_cpu(struct device_node *dn)
 {
         int rc = 0;
diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
index 81d8614e7379..5e1ef9150182 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -49,6 +49,28 @@ static irqreturn_t ras_error_interrupt(int irq, void *dev_id);
 
 
 /*
+ * Enable the hotplug interrupt late because processing them may touch other
+ * devices or systems (e.g. hugepages) that have not been initialized at the
+ * subsys stage.
+ */
+int __init init_ras_hotplug_IRQ(void)
+{
+        struct device_node *np;
+
+        /* Hotplug Events */
+        np = of_find_node_by_path("/event-sources/hot-plug-events");
+        if (np != NULL) {
+                if (dlpar_workqueue_init() == 0)
+                        request_event_sources_irqs(np, ras_hotplug_interrupt,
+                                                   "RAS_HOTPLUG");
+                of_node_put(np);
+        }
+
+        return 0;
+}
+machine_late_initcall(pseries, init_ras_hotplug_IRQ);
+
+/*
  * Initialize handlers for the set of interrupts caused by hardware errors
  * and power system events.
  */
@@ -66,15 +88,6 @@ static int __init init_ras_IRQ(void)
                 of_node_put(np);
         }
 
-        /* Hotplug Events */
-        np = of_find_node_by_path("/event-sources/hot-plug-events");
-        if (np != NULL) {
-                if (dlpar_workqueue_init() == 0)
-                        request_event_sources_irqs(np, ras_hotplug_interrupt,
-                                           "RAS_HOTPLUG");
-                of_node_put(np);
-        }
-
         /* EPOW Events */
         np = of_find_node_by_path("/event-sources/epow-events");
         if (np != NULL) {
diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c
index d9c4c9366049..091f1d0d0af1 100644
--- a/arch/powerpc/sysdev/xive/spapr.c
+++ b/arch/powerpc/sysdev/xive/spapr.c
@@ -356,7 +356,8 @@ static int xive_spapr_configure_queue(u32 target, struct xive_q *q, u8 prio,
 
         rc = plpar_int_get_queue_info(0, target, prio, &esn_page, &esn_size);
         if (rc) {
-                pr_err("Error %lld getting queue info prio %d\n", rc, prio);
+                pr_err("Error %lld getting queue info CPU %d prio %d\n", rc,
+                       target, prio);
                 rc = -EIO;
                 goto fail;
         }
@@ -370,7 +371,8 @@ static int xive_spapr_configure_queue(u32 target, struct xive_q *q, u8 prio,
         /* Configure and enable the queue in HW */
         rc = plpar_int_set_queue_config(flags, target, prio, qpage_phys, order);
         if (rc) {
-                pr_err("Error %lld setting queue for prio %d\n", rc, prio);
+                pr_err("Error %lld setting queue for CPU %d prio %d\n", rc,
+                       target, prio);
                 rc = -EIO;
         } else {
                 q->qpage = qpage;
@@ -389,8 +391,8 @@ static int xive_spapr_setup_queue(unsigned int cpu, struct xive_cpu *xc,
         if (IS_ERR(qpage))
                 return PTR_ERR(qpage);
 
-        return xive_spapr_configure_queue(cpu, q, prio, qpage,
-                                          xive_queue_shift);
+        return xive_spapr_configure_queue(get_hard_smp_processor_id(cpu),
+                                          q, prio, qpage, xive_queue_shift);
 }
 
 static void xive_spapr_cleanup_queue(unsigned int cpu, struct xive_cpu *xc,
@@ -399,10 +401,12 @@ static void xive_spapr_cleanup_queue(unsigned int cpu, struct xive_cpu *xc,
         struct xive_q *q = &xc->queue[prio];
         unsigned int alloc_order;
         long rc;
+        int hw_cpu = get_hard_smp_processor_id(cpu);
 
-        rc = plpar_int_set_queue_config(0, cpu, prio, 0, 0);
+        rc = plpar_int_set_queue_config(0, hw_cpu, prio, 0, 0);
         if (rc)
-                pr_err("Error %ld setting queue for prio %d\n", rc, prio);
+                pr_err("Error %ld setting queue for CPU %d prio %d\n", rc,
+                       hw_cpu, prio);
 
         alloc_order = xive_alloc_order(xive_queue_shift);
         free_pages((unsigned long)q->qpage, alloc_order);
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 6bf594ace663..8767e45f1b2b 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -430,6 +430,8 @@ config SPARC_LEON
         depends on SPARC32
         select USB_EHCI_BIG_ENDIAN_MMIO
         select USB_EHCI_BIG_ENDIAN_DESC
+        select USB_UHCI_BIG_ENDIAN_MMIO
+        select USB_UHCI_BIG_ENDIAN_DESC
         ---help---
           If you say Y here if you are running on a SPARC-LEON processor.
           The LEON processor is a synthesizable VHDL model of the
diff --git a/arch/x86/.gitignore b/arch/x86/.gitignore
index aff152c87cf4..5a82bac5e0bc 100644
--- a/arch/x86/.gitignore
+++ b/arch/x86/.gitignore
@@ -1,6 +1,7 @@
 boot/compressed/vmlinux
 tools/test_get_len
 tools/insn_sanity
+tools/insn_decoder_test
 purgatory/kexec-purgatory.c
 purgatory/purgatory.ro
 
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 63bf349b2b24..c1236b187824 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -423,12 +423,6 @@ config X86_MPPARSE
           For old smp systems that do not have proper acpi support. Newer systems
           (esp with 64bit cpus) with acpi support, MADT and DSDT will override it
 
-config X86_BIGSMP
-        bool "Support for big SMP systems with more than 8 CPUs"
-        depends on X86_32 && SMP
-        ---help---
-          This option is needed for the systems that have more than 8 CPUs
-
 config GOLDFISH
        def_bool y
        depends on X86_GOLDFISH
@@ -460,6 +454,12 @@ config INTEL_RDT
           Say N if unsure.
 
 if X86_32
+config X86_BIGSMP
+        bool "Support for big SMP systems with more than 8 CPUs"
+        depends on SMP
+        ---help---
+          This option is needed for the systems that have more than 8 CPUs
+
 config X86_EXTENDED_PLATFORM
         bool "Support for extended (non-PC) x86 platforms"
         default y
@@ -949,25 +949,66 @@ config MAXSMP
           Enable maximum number of CPUS and NUMA Nodes for this architecture.
           If unsure, say N.
 
+#
+# The maximum number of CPUs supported:
+#
+# The main config value is NR_CPUS, which defaults to NR_CPUS_DEFAULT,
+# and which can be configured interactively in the
+# [NR_CPUS_RANGE_BEGIN ... NR_CPUS_RANGE_END] range.
+#
+# The ranges are different on 32-bit and 64-bit kernels, depending on
+# hardware capabilities and scalability features of the kernel.
+#
+# ( If MAXSMP is enabled we just use the highest possible value and disable
+#   interactive configuration. )
+#
+
+config NR_CPUS_RANGE_BEGIN
+        int
+        default NR_CPUS_RANGE_END if MAXSMP
+        default    1 if !SMP
+        default    2
+
+config NR_CPUS_RANGE_END
+        int
+        depends on X86_32
+        default   64 if  SMP &&  X86_BIGSMP
+        default    8 if  SMP && !X86_BIGSMP
+        default    1 if !SMP
+
+config NR_CPUS_RANGE_END
+        int
+        depends on X86_64
+        default 8192 if  SMP && ( MAXSMP ||  CPUMASK_OFFSTACK)
+        default  512 if  SMP && (!MAXSMP && !CPUMASK_OFFSTACK)
+        default    1 if !SMP
+
+config NR_CPUS_DEFAULT
+        int
+        depends on X86_32
+        default   32 if  X86_BIGSMP
+        default    8 if  SMP
+        default    1 if !SMP
+
+config NR_CPUS_DEFAULT
+        int
+        depends on X86_64
+        default 8192 if  MAXSMP
+        default   64 if  SMP
+        default    1 if !SMP
+
 config NR_CPUS
         int "Maximum number of CPUs" if SMP && !MAXSMP
-        range 2 8 if SMP && X86_32 && !X86_BIGSMP
-        range 2 64 if SMP && X86_32 && X86_BIGSMP
-        range 2 512 if SMP && !MAXSMP && !CPUMASK_OFFSTACK && X86_64
-        range 2 8192 if SMP && !MAXSMP && CPUMASK_OFFSTACK && X86_64
-        default "1" if !SMP
-        default "8192" if MAXSMP
-        default "32" if SMP && X86_BIGSMP
-        default "8" if SMP && X86_32
-        default "64" if SMP
+        range NR_CPUS_RANGE_BEGIN NR_CPUS_RANGE_END
+        default NR_CPUS_DEFAULT
         ---help---
           This allows you to specify the maximum number of CPUs which this
           kernel will support.  If CPUMASK_OFFSTACK is enabled, the maximum
           supported value is 8192, otherwise the maximum value is 512.  The
           minimum value which makes sense is 2.
 
-          This is purely to save memory - each supported CPU adds
-          approximately eight kilobytes to the kernel image.
+          This is purely to save memory: each supported CPU adds about 8KB
+          to the kernel image.
 
 config SCHED_SMT
         bool "SMT (Hyperthreading) scheduler support"
@@ -1363,7 +1404,7 @@ config HIGHMEM4G
 
 config HIGHMEM64G
         bool "64GB"
-        depends on !M486
+        depends on !M486 && !M586 && !M586TSC && !M586MMX && !MGEODE_LX && !MGEODEGX1 && !MCYRIXIII && !MELAN && !MWINCHIPC6 && !WINCHIP3D && !MK6
         select X86_PAE
         ---help---
           Select this if you have a 32-bit processor and more than 4
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index 65a9a4716e34..8b8d2297d486 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -374,7 +374,7 @@ config X86_TSC
 
 config X86_CMPXCHG64
         def_bool y
-        depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM
+        depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586TSC || M586MMX || MATOM || MGEODE_LX || MGEODEGX1 || MK6 || MK7 || MK8
 
 # this should be set for all -march=.. options where the compiler
 # generates cmov.
@@ -385,7 +385,7 @@ config X86_CMOV
 config X86_MINIMUM_CPU_FAMILY
         int
         default "64" if X86_64
-        default "6" if X86_32 && X86_P6_NOP
+        default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MCRUSOE || MCORE2 || MK7 || MK8)
         default "5" if X86_32 && X86_CMPXCHG64
         default "4"
 
diff --git a/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c b/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c
index 36870b26067a..d08805032f01 100644
--- a/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c
+++ b/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c
@@ -57,10 +57,12 @@ void sha512_mb_mgr_init_avx2(struct sha512_mb_mgr *state)
 {
         unsigned int j;
 
-        state->lens[0] = 0;
-        state->lens[1] = 1;
-        state->lens[2] = 2;
-        state->lens[3] = 3;
+        /* initially all lanes are unused */
+        state->lens[0] = 0xFFFFFFFF00000000;
+        state->lens[1] = 0xFFFFFFFF00000001;
+        state->lens[2] = 0xFFFFFFFF00000002;
+        state->lens[3] = 0xFFFFFFFF00000003;
+
         state->unused_lanes = 0xFF03020100;
         for (j = 0; j < 4; j++)
                 state->ldata[j].job_in_lane = NULL;
diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
index 3f48f695d5e6..dce7092ab24a 100644
--- a/arch/x86/entry/calling.h
+++ b/arch/x86/entry/calling.h
@@ -97,80 +97,69 @@ For 32-bit we have the following conventions - kernel is built with
 
 #define SIZEOF_PTREGS   21*8
 
-        .macro ALLOC_PT_GPREGS_ON_STACK
-        addq    $-(15*8), %rsp
-        .endm
+.macro PUSH_AND_CLEAR_REGS rdx=%rdx rax=%rax
+        /*
+         * Push registers and sanitize registers of values that a
+         * speculation attack might otherwise want to exploit. The
+         * lower registers are likely clobbered well before they
+         * could be put to use in a speculative execution gadget.
+         * Interleave XOR with PUSH for better uop scheduling:
+         */
+        pushq   %rdi            /* pt_regs->di */
+        pushq   %rsi            /* pt_regs->si */
+        pushq   \rdx            /* pt_regs->dx */
+        pushq   %rcx            /* pt_regs->cx */
+        pushq   \rax            /* pt_regs->ax */
+        pushq   %r8             /* pt_regs->r8 */
+        xorq    %r8, %r8        /* nospec   r8 */
+        pushq   %r9             /* pt_regs->r9 */
+        xorq    %r9, %r9        /* nospec   r9 */
+        pushq   %r10            /* pt_regs->r10 */
+        xorq    %r10, %r10      /* nospec   r10 */
+        pushq   %r11            /* pt_regs->r11 */
+        xorq    %r11, %r11      /* nospec   r11*/
+        pushq   %rbx            /* pt_regs->rbx */
+        xorl    %ebx, %ebx      /* nospec   rbx*/
+        pushq   %rbp            /* pt_regs->rbp */
+        xorl    %ebp, %ebp      /* nospec   rbp*/
+        pushq   %r12            /* pt_regs->r12 */
+        xorq    %r12, %r12      /* nospec   r12*/
+        pushq   %r13            /* pt_regs->r13 */
+        xorq    %r13, %r13      /* nospec   r13*/
+        pushq   %r14            /* pt_regs->r14 */
+        xorq    %r14, %r14      /* nospec   r14*/
+        pushq   %r15            /* pt_regs->r15 */
+        xorq    %r15, %r15      /* nospec   r15*/
+        UNWIND_HINT_REGS
+.endm
 
-        .macro SAVE_C_REGS_HELPER offset=0 rax=1 rcx=1 r8910=1 r11=1
-        .if \r11
-        movq %r11, 6*8+\offset(%rsp)
-        .endif
-        .if \r8910
-        movq %r10, 7*8+\offset(%rsp)
-        movq %r9,  8*8+\offset(%rsp)
-        movq %r8,  9*8+\offset(%rsp)
-        .endif
-        .if \rax
-        movq %rax, 10*8+\offset(%rsp)
-        .endif
-        .if \rcx
-        movq %rcx, 11*8+\offset(%rsp)
-        .endif
-        movq %rdx, 12*8+\offset(%rsp)
-        movq %rsi, 13*8+\offset(%rsp)
-        movq %rdi, 14*8+\offset(%rsp)
-        UNWIND_HINT_REGS offset=\offset extra=0
-        .endm
-        .macro SAVE_C_REGS offset=0
-        SAVE_C_REGS_HELPER \offset, 1, 1, 1, 1
-        .endm
-        .macro SAVE_C_REGS_EXCEPT_RAX_RCX offset=0
-        SAVE_C_REGS_HELPER \offset, 0, 0, 1, 1
-        .endm
-        .macro SAVE_C_REGS_EXCEPT_R891011
-        SAVE_C_REGS_HELPER 0, 1, 1, 0, 0
-        .endm
-        .macro SAVE_C_REGS_EXCEPT_RCX_R891011
-        SAVE_C_REGS_HELPER 0, 1, 0, 0, 0
-        .endm
-        .macro SAVE_C_REGS_EXCEPT_RAX_RCX_R11
-        SAVE_C_REGS_HELPER 0, 0, 0, 1, 0
-        .endm
-
-        .macro SAVE_EXTRA_REGS offset=0
-        movq %r15, 0*8+\offset(%rsp)
-        movq %r14, 1*8+\offset(%rsp)
-        movq %r13, 2*8+\offset(%rsp)
-        movq %r12, 3*8+\offset(%rsp)
-        movq %rbp, 4*8+\offset(%rsp)
-        movq %rbx, 5*8+\offset(%rsp)
-        UNWIND_HINT_REGS offset=\offset
-        .endm
-
-        .macro POP_EXTRA_REGS
+.macro POP_REGS pop_rdi=1 skip_r11rcx=0
         popq %r15
         popq %r14
         popq %r13
         popq %r12
         popq %rbp
         popq %rbx
-        .endm
-
-        .macro POP_C_REGS
+        .if \skip_r11rcx
+        popq %rsi
+        .else
         popq %r11
+        .endif
         popq %r10
         popq %r9
         popq %r8
         popq %rax
+        .if \skip_r11rcx
+        popq %rsi
+        .else
         popq %rcx
+        .endif
         popq %rdx
         popq %rsi
+        .if \pop_rdi
         popq %rdi
-        .endm
-
-        .macro icebp
-        .byte 0xf1
-        .endm
+        .endif
+.endm
 
 /*
  * This is a sneaky trick to help the unwinder find pt_regs on the stack.  The
@@ -178,7 +167,7 @@ For 32-bit we have the following conventions - kernel is built with
  * is just setting the LSB, which makes it an invalid stack address and is also
  * a signal to the unwinder that it's a pt_regs pointer in disguise.
  *
- * NOTE: This macro must be used *after* SAVE_EXTRA_REGS because it corrupts
+ * NOTE: This macro must be used *after* PUSH_AND_CLEAR_REGS because it corrupts
  * the original rbp.
  */
 .macro ENCODE_FRAME_POINTER ptregs_offset=0
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 30c8c5344c4a..8971bd64d515 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -213,7 +213,7 @@ ENTRY(entry_SYSCALL_64)
 
         swapgs
         /*
-         * This path is not taken when PAGE_TABLE_ISOLATION is disabled so it
+         * This path is only taken when PAGE_TABLE_ISOLATION is disabled so it
          * is not required to switch CR3.
          */
         movq    %rsp, PER_CPU_VAR(rsp_scratch)
@@ -227,22 +227,8 @@ ENTRY(entry_SYSCALL_64)
         pushq   %rcx                            /* pt_regs->ip */
 GLOBAL(entry_SYSCALL_64_after_hwframe)
         pushq   %rax                            /* pt_regs->orig_ax */
-        pushq   %rdi                            /* pt_regs->di */
-        pushq   %rsi                            /* pt_regs->si */
-        pushq   %rdx                            /* pt_regs->dx */
-        pushq   %rcx                            /* pt_regs->cx */
-        pushq   $-ENOSYS                        /* pt_regs->ax */
-        pushq   %r8                             /* pt_regs->r8 */
-        pushq   %r9                             /* pt_regs->r9 */
-        pushq   %r10                            /* pt_regs->r10 */
-        pushq   %r11                            /* pt_regs->r11 */
-        pushq   %rbx                            /* pt_regs->rbx */
-        pushq   %rbp                            /* pt_regs->rbp */
-        pushq   %r12                            /* pt_regs->r12 */
-        pushq   %r13                            /* pt_regs->r13 */
-        pushq   %r14                            /* pt_regs->r14 */
-        pushq   %r15                            /* pt_regs->r15 */
-        UNWIND_HINT_REGS
+
+        PUSH_AND_CLEAR_REGS rax=$-ENOSYS
 
         TRACE_IRQS_OFF
 
@@ -321,15 +307,7 @@ GLOBAL(entry_SYSCALL_64_after_hwframe)
 syscall_return_via_sysret:
         /* rcx and r11 are already restored (see code above) */
         UNWIND_HINT_EMPTY
-        POP_EXTRA_REGS
-        popq    %rsi    /* skip r11 */
-        popq    %r10
-        popq    %r9
-        popq    %r8
-        popq    %rax
-        popq    %rsi    /* skip rcx */
-        popq    %rdx
-        popq    %rsi
+        POP_REGS pop_rdi=0 skip_r11rcx=1
 
         /*
          * Now all regs are restored except RSP and RDI.
@@ -559,9 +537,7 @@ END(irq_entries_start)
         call    switch_to_thread_stack
 1:
 
-        ALLOC_PT_GPREGS_ON_STACK
-        SAVE_C_REGS
-        SAVE_EXTRA_REGS
+        PUSH_AND_CLEAR_REGS
         ENCODE_FRAME_POINTER
 
         testb   $3, CS(%rsp)
@@ -622,15 +598,7 @@ GLOBAL(swapgs_restore_regs_and_return_to_usermode)
         ud2
 1:
 #endif
-        POP_EXTRA_REGS
-        popq    %r11
-        popq    %r10
-        popq    %r9
-        popq    %r8
-        popq    %rax
-        popq    %rcx
-        popq    %rdx
-        popq    %rsi
+        POP_REGS pop_rdi=0
 
         /*
          * The stack is now user RDI, orig_ax, RIP, CS, EFLAGS, RSP, SS.
@@ -688,8 +656,7 @@ GLOBAL(restore_regs_and_return_to_kernel)
         ud2
 1:
 #endif
-        POP_EXTRA_REGS
-        POP_C_REGS
+        POP_REGS
         addq    $8, %rsp        /* skip regs->orig_ax */
         /*
          * ARCH_HAS_MEMBARRIER_SYNC_CORE rely on IRET core serialization
@@ -908,7 +875,9 @@ ENTRY(\sym)
         pushq   $-1                             /* ORIG_RAX: no syscall to restart */
         .endif
 
-        ALLOC_PT_GPREGS_ON_STACK
+        /* Save all registers in pt_regs */
+        PUSH_AND_CLEAR_REGS
+        ENCODE_FRAME_POINTER
 
         .if \paranoid < 2
         testb   $3, CS(%rsp)                    /* If coming from userspace, switch stacks */
@@ -1121,9 +1090,7 @@ ENTRY(xen_failsafe_callback)
         addq    $0x30, %rsp
         UNWIND_HINT_IRET_REGS
         pushq   $-1 /* orig_ax = -1 => not a system call */
-        ALLOC_PT_GPREGS_ON_STACK
-        SAVE_C_REGS
-        SAVE_EXTRA_REGS
+        PUSH_AND_CLEAR_REGS
         ENCODE_FRAME_POINTER
         jmp     error_exit
 END(xen_failsafe_callback)
@@ -1163,16 +1130,13 @@ idtentry machine_check		do_mce			has_error_code=0	paranoid=1
 #endif
 
 /*
- * Save all registers in pt_regs, and switch gs if needed.
+ * Switch gs if needed.
  * Use slow, but surefire "are we in kernel?" check.
  * Return: ebx=0: need swapgs on exit, ebx=1: otherwise
  */
 ENTRY(paranoid_entry)
         UNWIND_HINT_FUNC
         cld
-        SAVE_C_REGS 8
-        SAVE_EXTRA_REGS 8
-        ENCODE_FRAME_POINTER 8
         movl    $1, %ebx
         movl    $MSR_GS_BASE, %ecx
         rdmsr
@@ -1211,21 +1175,18 @@ ENTRY(paranoid_exit)
         jmp     .Lparanoid_exit_restore
 .Lparanoid_exit_no_swapgs:
         TRACE_IRQS_IRETQ_DEBUG
+        RESTORE_CR3     scratch_reg=%rbx save_reg=%r14
 .Lparanoid_exit_restore:
         jmp restore_regs_and_return_to_kernel
 END(paranoid_exit)
 
 /*
- * Save all registers in pt_regs, and switch gs if needed.
+ * Switch gs if needed.
  * Return: EBX=0: came from user mode; EBX=1: otherwise
  */
 ENTRY(error_entry)
-        UNWIND_HINT_FUNC
+        UNWIND_HINT_REGS offset=8
         cld
-        SAVE_C_REGS 8
-        SAVE_EXTRA_REGS 8
-        ENCODE_FRAME_POINTER 8
-        xorl    %ebx, %ebx
         testb   $3, CS+8(%rsp)
         jz      .Lerror_kernelspace
 
@@ -1406,22 +1367,7 @@ ENTRY(nmi)
         pushq   1*8(%rdx)       /* pt_regs->rip */
         UNWIND_HINT_IRET_REGS
         pushq   $-1             /* pt_regs->orig_ax */
-        pushq   %rdi            /* pt_regs->di */
-        pushq   %rsi            /* pt_regs->si */
-        pushq   (%rdx)          /* pt_regs->dx */
-        pushq   %rcx            /* pt_regs->cx */
-        pushq   %rax            /* pt_regs->ax */
-        pushq   %r8             /* pt_regs->r8 */
-        pushq   %r9             /* pt_regs->r9 */
-        pushq   %r10            /* pt_regs->r10 */
-        pushq   %r11            /* pt_regs->r11 */
-        pushq   %rbx            /* pt_regs->rbx */
-        pushq   %rbp            /* pt_regs->rbp */
-        pushq   %r12            /* pt_regs->r12 */
-        pushq   %r13            /* pt_regs->r13 */
-        pushq   %r14            /* pt_regs->r14 */
-        pushq   %r15            /* pt_regs->r15 */
-        UNWIND_HINT_REGS
+        PUSH_AND_CLEAR_REGS rdx=(%rdx)
         ENCODE_FRAME_POINTER
 
         /*
@@ -1631,7 +1577,8 @@ end_repeat_nmi:
          * frame to point back to repeat_nmi.
          */
         pushq   $-1                             /* ORIG_RAX: no syscall to restart */
-        ALLOC_PT_GPREGS_ON_STACK
+        PUSH_AND_CLEAR_REGS
+        ENCODE_FRAME_POINTER
 
         /*
          * Use paranoid_entry to handle SWAPGS, but no need to use paranoid_exit
@@ -1655,8 +1602,7 @@ end_repeat_nmi:
 nmi_swapgs:
         SWAPGS_UNSAFE_STACK
 nmi_restore:
-        POP_EXTRA_REGS
-        POP_C_REGS
+        POP_REGS
 
         /*
          * Skip orig_ax and the "outermost" frame to point RSP at the "iret"
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index 98d5358e4041..fd65e016e413 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -85,15 +85,25 @@ ENTRY(entry_SYSENTER_compat)
         pushq   %rcx                    /* pt_regs->cx */
         pushq   $-ENOSYS                /* pt_regs->ax */
         pushq   $0                      /* pt_regs->r8  = 0 */
+        xorq    %r8, %r8                /* nospec   r8 */
         pushq   $0                      /* pt_regs->r9  = 0 */
+        xorq    %r9, %r9                /* nospec   r9 */
         pushq   $0                      /* pt_regs->r10 = 0 */
+        xorq    %r10, %r10              /* nospec   r10 */
         pushq   $0                      /* pt_regs->r11 = 0 */
+        xorq    %r11, %r11              /* nospec   r11 */
         pushq   %rbx                    /* pt_regs->rbx */
+        xorl    %ebx, %ebx              /* nospec   rbx */
         pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
+        xorl    %ebp, %ebp              /* nospec   rbp */
         pushq   $0                      /* pt_regs->r12 = 0 */
+        xorq    %r12, %r12              /* nospec   r12 */
         pushq   $0                      /* pt_regs->r13 = 0 */
+        xorq    %r13, %r13              /* nospec   r13 */
         pushq   $0                      /* pt_regs->r14 = 0 */
+        xorq    %r14, %r14              /* nospec   r14 */
         pushq   $0                      /* pt_regs->r15 = 0 */
+        xorq    %r15, %r15              /* nospec   r15 */
         cld
 
         /*
@@ -214,15 +224,25 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe)
         pushq   %rbp                    /* pt_regs->cx (stashed in bp) */
         pushq   $-ENOSYS                /* pt_regs->ax */
         pushq   $0                      /* pt_regs->r8  = 0 */
+        xorq    %r8, %r8                /* nospec   r8 */
         pushq   $0                      /* pt_regs->r9  = 0 */
+        xorq    %r9, %r9                /* nospec   r9 */
         pushq   $0                      /* pt_regs->r10 = 0 */
+        xorq    %r10, %r10              /* nospec   r10 */
         pushq   $0                      /* pt_regs->r11 = 0 */
+        xorq    %r11, %r11              /* nospec   r11 */
         pushq   %rbx                    /* pt_regs->rbx */
+        xorl    %ebx, %ebx              /* nospec   rbx */
         pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
+        xorl    %ebp, %ebp              /* nospec   rbp */
         pushq   $0                      /* pt_regs->r12 = 0 */
+        xorq    %r12, %r12              /* nospec   r12 */
         pushq   $0                      /* pt_regs->r13 = 0 */
+        xorq    %r13, %r13              /* nospec   r13 */
         pushq   $0                      /* pt_regs->r14 = 0 */
+        xorq    %r14, %r14              /* nospec   r14 */
         pushq   $0                      /* pt_regs->r15 = 0 */
+        xorq    %r15, %r15              /* nospec   r15 */
 
         /*
          * User mode is traced as though IRQs are on, and SYSENTER
@@ -338,15 +358,25 @@ ENTRY(entry_INT80_compat)
         pushq   %rcx                    /* pt_regs->cx */
         pushq   $-ENOSYS                /* pt_regs->ax */
         pushq   $0                      /* pt_regs->r8  = 0 */
+        xorq    %r8, %r8                /* nospec   r8 */
         pushq   $0                      /* pt_regs->r9  = 0 */
+        xorq    %r9, %r9                /* nospec   r9 */
         pushq   $0                      /* pt_regs->r10 = 0 */
+        xorq    %r10, %r10              /* nospec   r10 */
         pushq   $0                      /* pt_regs->r11 = 0 */
+        xorq    %r11, %r11              /* nospec   r11 */
         pushq   %rbx                    /* pt_regs->rbx */
+        xorl    %ebx, %ebx              /* nospec   rbx */
         pushq   %rbp                    /* pt_regs->rbp */
+        xorl    %ebp, %ebp              /* nospec   rbp */
         pushq   %r12                    /* pt_regs->r12 */
+        xorq    %r12, %r12              /* nospec   r12 */
         pushq   %r13                    /* pt_regs->r13 */
+        xorq    %r13, %r13              /* nospec   r13 */
         pushq   %r14                    /* pt_regs->r14 */
+        xorq    %r14, %r14              /* nospec   r14 */
         pushq   %r15                    /* pt_regs->r15 */
+        xorq    %r15, %r15              /* nospec   r15 */
         cld
 
         /*
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 731153a4681e..56457cb73448 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3559,7 +3559,7 @@ static int intel_snb_pebs_broken(int cpu)
                 break;
 
         case INTEL_FAM6_SANDYBRIDGE_X:
-                switch (cpu_data(cpu).x86_mask) {
+                switch (cpu_data(cpu).x86_stepping) {
                 case 6: rev = 0x618; break;
                 case 7: rev = 0x70c; break;
                 }
diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
index ae64d0b69729..cf372b90557e 100644
--- a/arch/x86/events/intel/lbr.c
+++ b/arch/x86/events/intel/lbr.c
@@ -1186,7 +1186,7 @@ void __init intel_pmu_lbr_init_atom(void)
          * on PMU interrupt
          */
         if (boot_cpu_data.x86_model == 28
-            && boot_cpu_data.x86_mask < 10) {
+            && boot_cpu_data.x86_stepping < 10) {
                 pr_cont("LBR disabled due to erratum");
                 return;
         }
diff --git a/arch/x86/events/intel/p6.c b/arch/x86/events/intel/p6.c
index a5604c352930..408879b0c0d4 100644
--- a/arch/x86/events/intel/p6.c
+++ b/arch/x86/events/intel/p6.c
@@ -234,7 +234,7 @@ static __initconst const struct x86_pmu p6_pmu = {
 
 static __init void p6_pmu_rdpmc_quirk(void)
 {
-        if (boot_cpu_data.x86_mask < 9) {
+        if (boot_cpu_data.x86_stepping < 9) {
                 /*
                  * PPro erratum 26; fixed in stepping 9 and above.
                  */
diff --git a/arch/x86/include/asm/acpi.h b/arch/x86/include/asm/acpi.h
index 44f5d79d5105..11881726ed37 100644
--- a/arch/x86/include/asm/acpi.h
+++ b/arch/x86/include/asm/acpi.h
@@ -94,7 +94,7 @@ static inline unsigned int acpi_processor_cstate_check(unsigned int max_cstate)
         if (boot_cpu_data.x86 == 0x0F &&
             boot_cpu_data.x86_vendor == X86_VENDOR_AMD &&
             boot_cpu_data.x86_model <= 0x05 &&
-            boot_cpu_data.x86_mask < 0x0A)
+            boot_cpu_data.x86_stepping < 0x0A)
                 return 1;
         else if (boot_cpu_has(X86_BUG_AMD_APIC_C1E))
                 return 1;
diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
index 30d406146016..e1259f043ae9 100644
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -40,7 +40,7 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 
         asm ("cmp %1,%2; sbb %0,%0;"
                         :"=r" (mask)
-                        :"r"(size),"r" (index)
+                        :"g"(size),"r" (index)
                         :"cc");
         return mask;
 }
diff --git a/arch/x86/include/asm/bug.h b/arch/x86/include/asm/bug.h
index 34d99af43994..6804d6642767 100644
--- a/arch/x86/include/asm/bug.h
+++ b/arch/x86/include/asm/bug.h
@@ -5,23 +5,20 @@
 #include <linux/stringify.h>
 
 /*
- * Since some emulators terminate on UD2, we cannot use it for WARN.
- * Since various instruction decoders disagree on the length of UD1,
- * we cannot use it either. So use UD0 for WARN.
+ * Despite that some emulators terminate on UD2, we use it for WARN().
  *
- * (binutils knows about "ud1" but {en,de}codes it as 2 bytes, whereas
- *  our kernel decoder thinks it takes a ModRM byte, which seems consistent
- *  with various things like the Intel SDM instruction encoding rules)
+ * Since various instruction decoders/specs disagree on the encoding of
+ * UD0/UD1.
  */
 
-#define ASM_UD0         ".byte 0x0f, 0xff"
+#define ASM_UD0         ".byte 0x0f, 0xff" /* + ModRM (for Intel) */
 #define ASM_UD1         ".byte 0x0f, 0xb9" /* + ModRM */
 #define ASM_UD2         ".byte 0x0f, 0x0b"
 
 #define INSN_UD0        0xff0f
 #define INSN_UD2        0x0b0f
 
-#define LEN_UD0         2
+#define LEN_UD2         2
 
 #ifdef CONFIG_GENERIC_BUG
 
@@ -77,7 +74,11 @@ do {								\
         unreachable();                                          \
 } while (0)
 
-#define __WARN_FLAGS(flags)     _BUG_FLAGS(ASM_UD0, BUGFLAG_WARNING|(flags))
+#define __WARN_FLAGS(flags)                                     \
+do {                                                            \
+        _BUG_FLAGS(ASM_UD2, BUGFLAG_WARNING|(flags));           \
+        annotate_reachable();                                   \
+} while (0)
 
 #include <asm-generic/bug.h>
 
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 70eddb3922ff..736771c9822e 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -148,45 +148,46 @@ extern void clear_cpu_cap(struct cpuinfo_x86 *c, unsigned int bit);
  */
 static __always_inline __pure bool _static_cpu_has(u16 bit)
 {
-                asm_volatile_goto("1: jmp 6f\n"
-                         "2:\n"
-                         ".skip -(((5f-4f) - (2b-1b)) > 0) * "
-                                 "((5f-4f) - (2b-1b)),0x90\n"
-                         "3:\n"
-                         ".section .altinstructions,\"a\"\n"
-                         " .long 1b - .\n"              /* src offset */
-                         " .long 4f - .\n"              /* repl offset */
-                         " .word %P1\n"                 /* always replace */
-                         " .byte 3b - 1b\n"             /* src len */
-                         " .byte 5f - 4f\n"             /* repl len */
-                         " .byte 3b - 2b\n"             /* pad len */
-                         ".previous\n"
-                         ".section .altinstr_replacement,\"ax\"\n"
-                         "4: jmp %l[t_no]\n"
-                         "5:\n"
-                         ".previous\n"
-                         ".section .altinstructions,\"a\"\n"
-                         " .long 1b - .\n"              /* src offset */
-                         " .long 0\n"                   /* no replacement */
-                         " .word %P0\n"                 /* feature bit */
-                         " .byte 3b - 1b\n"             /* src len */
-                         " .byte 0\n"                   /* repl len */
-                         " .byte 0\n"                   /* pad len */
-                         ".previous\n"
-                         ".section .altinstr_aux,\"ax\"\n"
-                         "6:\n"
-                         " testb %[bitnum],%[cap_byte]\n"
-                         " jnz %l[t_yes]\n"
-                         " jmp %l[t_no]\n"
-                         ".previous\n"
-                         : : "i" (bit), "i" (X86_FEATURE_ALWAYS),
-                             [bitnum] "i" (1 << (bit & 7)),
-                             [cap_byte] "m" (((const char *)boot_cpu_data.x86_capability)[bit >> 3])
-                         : : t_yes, t_no);
-        t_yes:
-                return true;
-        t_no:
-                return false;
+        asm_volatile_goto("1: jmp 6f\n"
+                 "2:\n"
+                 ".skip -(((5f-4f) - (2b-1b)) > 0) * "
+                         "((5f-4f) - (2b-1b)),0x90\n"
+                 "3:\n"
+                 ".section .altinstructions,\"a\"\n"
+                 " .long 1b - .\n"              /* src offset */
+                 " .long 4f - .\n"              /* repl offset */
+                 " .word %P[always]\n"          /* always replace */
+                 " .byte 3b - 1b\n"             /* src len */
+                 " .byte 5f - 4f\n"             /* repl len */
+                 " .byte 3b - 2b\n"             /* pad len */
+                 ".previous\n"
+                 ".section .altinstr_replacement,\"ax\"\n"
+                 "4: jmp %l[t_no]\n"
+                 "5:\n"
+                 ".previous\n"
+                 ".section .altinstructions,\"a\"\n"
+                 " .long 1b - .\n"              /* src offset */
+                 " .long 0\n"                   /* no replacement */
+                 " .word %P[feature]\n"         /* feature bit */
+                 " .byte 3b - 1b\n"             /* src len */
+                 " .byte 0\n"                   /* repl len */
+                 " .byte 0\n"                   /* pad len */
+                 ".previous\n"
+                 ".section .altinstr_aux,\"ax\"\n"
+                 "6:\n"
+                 " testb %[bitnum],%[cap_byte]\n"
+                 " jnz %l[t_yes]\n"
+                 " jmp %l[t_no]\n"
+                 ".previous\n"
+                 : : [feature]  "i" (bit),
+                     [always]   "i" (X86_FEATURE_ALWAYS),
+                     [bitnum]   "i" (1 << (bit & 7)),
+                     [cap_byte] "m" (((const char *)boot_cpu_data.x86_capability)[bit >> 3])
+                 : : t_yes, t_no);
+t_yes:
+        return true;
+t_no:
+        return false;
 }
 
 #define static_cpu_has(bit)                                     \
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index 4d57894635f2..76b058533e47 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -6,6 +6,7 @@
 #include <asm/alternative.h>
 #include <asm/alternative-asm.h>
 #include <asm/cpufeatures.h>
+#include <asm/msr-index.h>
 
 #ifdef __ASSEMBLY__
 
@@ -164,10 +165,15 @@ static inline void vmexit_fill_RSB(void)
 
 static inline void indirect_branch_prediction_barrier(void)
 {
-        alternative_input("",
-                          "call __ibp_barrier",
-                          X86_FEATURE_USE_IBPB,
-                          ASM_NO_INPUT_CLOBBER("eax", "ecx", "edx", "memory"));
+        asm volatile(ALTERNATIVE("",
+                                 "movl %[msr], %%ecx\n\t"
+                                 "movl %[val], %%eax\n\t"
+                                 "movl $0, %%edx\n\t"
+                                 "wrmsr",
+                                 X86_FEATURE_USE_IBPB)
+                     : : [msr] "i" (MSR_IA32_PRED_CMD),
+                         [val] "i" (PRED_CMD_IBPB)
+                     : "eax", "ecx", "edx", "memory");
 }
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
index 4baa6bceb232..d652a3808065 100644
--- a/arch/x86/include/asm/page_64.h
+++ b/arch/x86/include/asm/page_64.h
@@ -52,10 +52,6 @@ static inline void clear_page(void *page)
 
 void copy_page(void *to, void *from);
 
-#ifdef CONFIG_X86_MCE
-#define arch_unmap_kpfn arch_unmap_kpfn
-#endif
-
 #endif  /* !__ASSEMBLY__ */
 
 #ifdef CONFIG_X86_VSYSCALL_EMULATION
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index 892df375b615..554841fab717 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -297,9 +297,9 @@ static inline void __flush_tlb_global(void)
 {
         PVOP_VCALL0(pv_mmu_ops.flush_tlb_kernel);
 }
-static inline void __flush_tlb_single(unsigned long addr)
+static inline void __flush_tlb_one_user(unsigned long addr)
 {
-        PVOP_VCALL1(pv_mmu_ops.flush_tlb_single, addr);
+        PVOP_VCALL1(pv_mmu_ops.flush_tlb_one_user, addr);
 }
 
 static inline void flush_tlb_others(const struct cpumask *cpumask,
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
index 6ec54d01972d..f624f1f10316 100644
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -217,7 +217,7 @@ struct pv_mmu_ops {
         /* TLB operations */
         void (*flush_tlb_user)(void);
         void (*flush_tlb_kernel)(void);
-        void (*flush_tlb_single)(unsigned long addr);
+        void (*flush_tlb_one_user)(unsigned long addr);
         void (*flush_tlb_others)(const struct cpumask *cpus,
                                  const struct flush_tlb_info *info);
 
diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
index e67c0620aec2..e55466760ff8 100644
--- a/arch/x86/include/asm/pgtable_32.h
+++ b/arch/x86/include/asm/pgtable_32.h
@@ -61,7 +61,7 @@ void paging_init(void);
 #define kpte_clear_flush(ptep, vaddr)           \
 do {                                            \
         pte_clear(&init_mm, (vaddr), (ptep));   \
-        __flush_tlb_one((vaddr));               \
+        __flush_tlb_one_kernel((vaddr));                \
 } while (0)
 
 #endif /* !__ASSEMBLY__ */
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 793bae7e7ce3..1bd9ed87606f 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -91,7 +91,7 @@ struct cpuinfo_x86 {
         __u8                    x86;            /* CPU family */
         __u8                    x86_vendor;     /* CPU vendor */
         __u8                    x86_model;
-        __u8                    x86_mask;
+        __u8                    x86_stepping;
 #ifdef CONFIG_X86_64
         /* Number of 4K pages in DTLB/ITLB combined(in pages): */
         int                     x86_tlbsize;
@@ -109,7 +109,7 @@ struct cpuinfo_x86 {
         char                    x86_vendor_id[16];
         char                    x86_model_id[64];
         /* in KB - valid for CPUS which support this call: */
-        int                     x86_cache_size;
+        unsigned int            x86_cache_size;
         int                     x86_cache_alignment;    /* In bytes */
         /* Cache QoS architectural values: */
         int                     x86_cache_max_rmid;     /* max index */
@@ -977,7 +977,4 @@ bool xen_set_default_idle(void);
 
 void stop_this_cpu(void *dummy);
 void df_debug(struct pt_regs *regs, long error_code);
-
-void __ibp_barrier(void);
-
 #endif /* _ASM_X86_PROCESSOR_H */
diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
index 461f53d27708..a4189762b266 100644
--- a/arch/x86/include/asm/smp.h
+++ b/arch/x86/include/asm/smp.h
@@ -129,6 +129,7 @@ static inline void arch_send_call_function_ipi_mask(const struct cpumask *mask)
 void cpu_disable_common(void);
 void native_smp_prepare_boot_cpu(void);
 void native_smp_prepare_cpus(unsigned int max_cpus);
+void calculate_max_logical_packages(void);
 void native_smp_cpus_done(unsigned int max_cpus);
 void common_cpu_up(unsigned int cpunum, struct task_struct *tidle);
 int native_cpu_up(unsigned int cpunum, struct task_struct *tidle);
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index 2b8f18ca5874..84137c22fdfa 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -140,7 +140,7 @@ static inline unsigned long build_cr3_noflush(pgd_t *pgd, u16 asid)
 #else
 #define __flush_tlb() __native_flush_tlb()
 #define __flush_tlb_global() __native_flush_tlb_global()
-#define __flush_tlb_single(addr) __native_flush_tlb_single(addr)
+#define __flush_tlb_one_user(addr) __native_flush_tlb_one_user(addr)
 #endif
 
 static inline bool tlb_defer_switch_to_init_mm(void)
@@ -400,7 +400,7 @@ static inline void __native_flush_tlb_global(void)
 /*
  * flush one page in the user mapping
  */
-static inline void __native_flush_tlb_single(unsigned long addr)
+static inline void __native_flush_tlb_one_user(unsigned long addr)
 {
         u32 loaded_mm_asid = this_cpu_read(cpu_tlbstate.loaded_mm_asid);
 
@@ -437,18 +437,31 @@ static inline void __flush_tlb_all(void)
 /*
  * flush one page in the kernel mapping
  */
-static inline void __flush_tlb_one(unsigned long addr)
+static inline void __flush_tlb_one_kernel(unsigned long addr)
 {
         count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ONE);
-        __flush_tlb_single(addr);
+
+        /*
+         * If PTI is off, then __flush_tlb_one_user() is just INVLPG or its
+         * paravirt equivalent.  Even with PCID, this is sufficient: we only
+         * use PCID if we also use global PTEs for the kernel mapping, and
+         * INVLPG flushes global translations across all address spaces.
+         *
+         * If PTI is on, then the kernel is mapped with non-global PTEs, and
+         * __flush_tlb_one_user() will flush the given address for the current
+         * kernel address space and for its usermode counterpart, but it does
+         * not flush it for other address spaces.
+         */
+        __flush_tlb_one_user(addr);
 
         if (!static_cpu_has(X86_FEATURE_PTI))
                 return;
 
         /*
-         * __flush_tlb_single() will have cleared the TLB entry for this ASID,
-         * but since kernel space is replicated across all, we must also
-         * invalidate all others.
+         * See above.  We need to propagate the flush to all other address
+         * spaces.  In principle, we only need to propagate it to kernelmode
+         * address spaces, but the extra bookkeeping we would need is not
+         * worth it.
          */
         invalidate_other_asid();
 }
diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
index 6db28f17ff28..c88e0b127810 100644
--- a/arch/x86/kernel/amd_nb.c
+++ b/arch/x86/kernel/amd_nb.c
@@ -235,7 +235,7 @@ int amd_cache_northbridges(void)
         if (boot_cpu_data.x86 == 0x10 &&
             boot_cpu_data.x86_model >= 0x8 &&
             (boot_cpu_data.x86_model > 0x9 ||
-             boot_cpu_data.x86_mask >= 0x1))
+             boot_cpu_data.x86_stepping >= 0x1))
                 amd_northbridges.flags |= AMD_NB_L3_INDEX_DISABLE;
 
         if (boot_cpu_data.x86 == 0x15)
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 25ddf02598d2..b203af0855b5 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -546,7 +546,7 @@ static DEFINE_PER_CPU(struct clock_event_device, lapic_events);
 
 static u32 hsx_deadline_rev(void)
 {
-        switch (boot_cpu_data.x86_mask) {
+        switch (boot_cpu_data.x86_stepping) {
         case 0x02: return 0x3a; /* EP */
         case 0x04: return 0x0f; /* EX */
         }
@@ -556,7 +556,7 @@ static u32 hsx_deadline_rev(void)
 
 static u32 bdx_deadline_rev(void)
 {
-        switch (boot_cpu_data.x86_mask) {
+        switch (boot_cpu_data.x86_stepping) {
         case 0x02: return 0x00000011;
         case 0x03: return 0x0700000e;
         case 0x04: return 0x0f00000c;
@@ -568,7 +568,7 @@ static u32 bdx_deadline_rev(void)
 
 static u32 skx_deadline_rev(void)
 {
-        switch (boot_cpu_data.x86_mask) {
+        switch (boot_cpu_data.x86_stepping) {
         case 0x03: return 0x01000136;
         case 0x04: return 0x02000014;
         }
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 46b675aaf20b..f11910b44638 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -1176,16 +1176,25 @@ static void __init decode_gam_rng_tbl(unsigned long ptr)
 
         uv_gre_table = gre;
         for (; gre->type != UV_GAM_RANGE_TYPE_UNUSED; gre++) {
+                unsigned long size = ((unsigned long)(gre->limit - lgre)
+                                        << UV_GAM_RANGE_SHFT);
+                int order = 0;
+                char suffix[] = " KMGTPE";
+
+                while (size > 9999 && order < sizeof(suffix)) {
+                        size /= 1024;
+                        order++;
+                }
+
                 if (!index) {
                         pr_info("UV: GAM Range Table...\n");
                         pr_info("UV:  # %20s %14s %5s %4s %5s %3s %2s\n", "Range", "", "Size", "Type", "NASID", "SID", "PN");
                 }
-                pr_info("UV: %2d: 0x%014lx-0x%014lx %5luG %3d   %04x  %02x %02x\n",
+                pr_info("UV: %2d: 0x%014lx-0x%014lx %5lu%c %3d   %04x  %02x %02x\n",
                         index++,
                         (unsigned long)lgre << UV_GAM_RANGE_SHFT,
                         (unsigned long)gre->limit << UV_GAM_RANGE_SHFT,
-                        ((unsigned long)(gre->limit - lgre)) >>
-                                (30 - UV_GAM_RANGE_SHFT), /* 64M -> 1G */
+                        size, suffix[order],
                         gre->type, gre->nasid, gre->sockid, gre->pnode);
 
                 lgre = gre->limit;
diff --git a/arch/x86/kernel/asm-offsets_32.c b/arch/x86/kernel/asm-offsets_32.c
index fa1261eefa16..f91ba53e06c8 100644
--- a/arch/x86/kernel/asm-offsets_32.c
+++ b/arch/x86/kernel/asm-offsets_32.c
@@ -18,7 +18,7 @@ void foo(void)
         OFFSET(CPUINFO_x86, cpuinfo_x86, x86);
         OFFSET(CPUINFO_x86_vendor, cpuinfo_x86, x86_vendor);
         OFFSET(CPUINFO_x86_model, cpuinfo_x86, x86_model);
-        OFFSET(CPUINFO_x86_mask, cpuinfo_x86, x86_mask);
+        OFFSET(CPUINFO_x86_stepping, cpuinfo_x86, x86_stepping);
         OFFSET(CPUINFO_cpuid_level, cpuinfo_x86, cpuid_level);
         OFFSET(CPUINFO_x86_capability, cpuinfo_x86, x86_capability);
         OFFSET(CPUINFO_x86_vendor_id, cpuinfo_x86, x86_vendor_id);
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 5bddbdcbc4a3..f0e6456ca7d3 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -119,7 +119,7 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
                 return;
         }
 
-        if (c->x86_model == 6 && c->x86_mask == 1) {
+        if (c->x86_model == 6 && c->x86_stepping == 1) {
                 const int K6_BUG_LOOP = 1000000;
                 int n;
                 void (*f_vide)(void);
@@ -149,7 +149,7 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
 
         /* K6 with old style WHCR */
         if (c->x86_model < 8 ||
-           (c->x86_model == 8 && c->x86_mask < 8)) {
+           (c->x86_model == 8 && c->x86_stepping < 8)) {
                 /* We can only write allocate on the low 508Mb */
                 if (mbytes > 508)
                         mbytes = 508;
@@ -168,7 +168,7 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
                 return;
         }
 
-        if ((c->x86_model == 8 && c->x86_mask > 7) ||
+        if ((c->x86_model == 8 && c->x86_stepping > 7) ||
              c->x86_model == 9 || c->x86_model == 13) {
                 /* The more serious chips .. */
 
@@ -221,7 +221,7 @@ static void init_amd_k7(struct cpuinfo_x86 *c)
          * are more robust with CLK_CTL set to 200xxxxx instead of 600xxxxx
          * As per AMD technical note 27212 0.2
          */
-        if ((c->x86_model == 8 && c->x86_mask >= 1) || (c->x86_model > 8)) {
+        if ((c->x86_model == 8 && c->x86_stepping >= 1) || (c->x86_model > 8)) {
                 rdmsr(MSR_K7_CLK_CTL, l, h);
                 if ((l & 0xfff00000) != 0x20000000) {
                         pr_info("CPU: CLK_CTL MSR was %x. Reprogramming to %x\n",
@@ -241,12 +241,12 @@ static void init_amd_k7(struct cpuinfo_x86 *c)
          * but they are not certified as MP capable.
          */
         /* Athlon 660/661 is valid. */
-        if ((c->x86_model == 6) && ((c->x86_mask == 0) ||
-            (c->x86_mask == 1)))
+        if ((c->x86_model == 6) && ((c->x86_stepping == 0) ||
+            (c->x86_stepping == 1)))
                 return;
 
         /* Duron 670 is valid */
-        if ((c->x86_model == 7) && (c->x86_mask == 0))
+        if ((c->x86_model == 7) && (c->x86_stepping == 0))
                 return;
 
         /*
@@ -256,8 +256,8 @@ static void init_amd_k7(struct cpuinfo_x86 *c)
          * See http://www.heise.de/newsticker/data/jow-18.10.01-000 for
          * more.
          */
-        if (((c->x86_model == 6) && (c->x86_mask >= 2)) ||
-            ((c->x86_model == 7) && (c->x86_mask >= 1)) ||
+        if (((c->x86_model == 6) && (c->x86_stepping >= 2)) ||
+            ((c->x86_model == 7) && (c->x86_stepping >= 1)) ||
              (c->x86_model > 7))
                 if (cpu_has(c, X86_FEATURE_MP))
                         return;
@@ -628,7 +628,7 @@ static void early_init_amd(struct cpuinfo_x86 *c)
         /*  Set MTRR capability flag if appropriate */
         if (c->x86 == 5)
                 if (c->x86_model == 13 || c->x86_model == 9 ||
-                    (c->x86_model == 8 && c->x86_mask >= 8))
+                    (c->x86_model == 8 && c->x86_stepping >= 8))
                         set_cpu_cap(c, X86_FEATURE_K6_MTRR);
 #endif
 #if defined(CONFIG_X86_LOCAL_APIC) && defined(CONFIG_PCI)
@@ -795,7 +795,7 @@ static void init_amd_zn(struct cpuinfo_x86 *c)
          * Fix erratum 1076: CPB feature bit not being set in CPUID. It affects
          * all up to and including B1.
          */
-        if (c->x86_model <= 1 && c->x86_mask <= 1)
+        if (c->x86_model <= 1 && c->x86_stepping <= 1)
                 set_cpu_cap(c, X86_FEATURE_CPB);
 }
 
@@ -906,11 +906,11 @@ static unsigned int amd_size_cache(struct cpuinfo_x86 *c, unsigned int size)
         /* AMD errata T13 (order #21922) */
         if ((c->x86 == 6)) {
                 /* Duron Rev A0 */
-                if (c->x86_model == 3 && c->x86_mask == 0)
+                if (c->x86_model == 3 && c->x86_stepping == 0)
                         size = 64;
                 /* Tbird rev A1/A2 */
                 if (c->x86_model == 4 &&
-                        (c->x86_mask == 0 || c->x86_mask == 1))
+                        (c->x86_stepping == 0 || c->x86_stepping == 1))
                         size = 256;
         }
         return size;
@@ -1047,7 +1047,7 @@ static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum)
         }
 
         /* OSVW unavailable or ID unknown, match family-model-stepping range */
-        ms = (cpu->x86_model << 4) | cpu->x86_mask;
+        ms = (cpu->x86_model << 4) | cpu->x86_stepping;
         while ((range = *erratum++))
                 if ((cpu->x86 == AMD_MODEL_RANGE_FAMILY(range)) &&
                     (ms >= AMD_MODEL_RANGE_START(range)) &&
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 71949bf2de5a..d71c8b54b696 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -162,8 +162,7 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
         if (cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
                 return SPECTRE_V2_CMD_NONE;
         else {
-                ret = cmdline_find_option(boot_command_line, "spectre_v2", arg,
-                                          sizeof(arg));
+                ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, sizeof(arg));
                 if (ret < 0)
                         return SPECTRE_V2_CMD_AUTO;
 
@@ -175,8 +174,7 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
                 }
 
                 if (i >= ARRAY_SIZE(mitigation_options)) {
-                        pr_err("unknown option (%s). Switching to AUTO select\n",
-                               mitigation_options[i].option);
+                        pr_err("unknown option (%s). Switching to AUTO select\n", arg);
                         return SPECTRE_V2_CMD_AUTO;
                 }
         }
@@ -185,8 +183,7 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
              cmd == SPECTRE_V2_CMD_RETPOLINE_AMD ||
              cmd == SPECTRE_V2_CMD_RETPOLINE_GENERIC) &&
             !IS_ENABLED(CONFIG_RETPOLINE)) {
-                pr_err("%s selected but not compiled in. Switching to AUTO select\n",
-                       mitigation_options[i].option);
+                pr_err("%s selected but not compiled in. Switching to AUTO select\n", mitigation_options[i].option);
                 return SPECTRE_V2_CMD_AUTO;
         }
 
@@ -256,14 +253,14 @@ static void __init spectre_v2_select_mitigation(void)
                         goto retpoline_auto;
                 break;
         }
-        pr_err("kernel not compiled with retpoline; no mitigation available!");
+        pr_err("Spectre mitigation: kernel not compiled with retpoline; no mitigation available!");
         return;
 
 retpoline_auto:
         if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) {
         retpoline_amd:
                 if (!boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) {
-                        pr_err("LFENCE not serializing. Switching to generic retpoline\n");
+                        pr_err("Spectre mitigation: LFENCE not serializing, switching to generic retpoline\n");
                         goto retpoline_generic;
                 }
                 mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_AMD :
@@ -281,7 +278,7 @@ retpoline_auto:
         pr_info("%s\n", spectre_v2_strings[mode]);
 
         /*
-         * If neither SMEP or KPTI are available, there is a risk of
+         * If neither SMEP nor PTI are available, there is a risk of
          * hitting userspace addresses in the RSB after a context switch
          * from a shallow call stack to a deeper one. To prevent this fill
          * the entire RSB, even when using IBRS.
@@ -295,21 +292,20 @@ retpoline_auto:
         if ((!boot_cpu_has(X86_FEATURE_PTI) &&
              !boot_cpu_has(X86_FEATURE_SMEP)) || is_skylake_era()) {
                 setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
-                pr_info("Filling RSB on context switch\n");
+                pr_info("Spectre v2 mitigation: Filling RSB on context switch\n");
         }
 
         /* Initialize Indirect Branch Prediction Barrier if supported */
         if (boot_cpu_has(X86_FEATURE_IBPB)) {
                 setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
-                pr_info("Enabling Indirect Branch Prediction Barrier\n");
+                pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n");
         }
 }
 
 #undef pr_fmt
 
 #ifdef CONFIG_SYSFS
-ssize_t cpu_show_meltdown(struct device *dev,
-                          struct device_attribute *attr, char *buf)
+ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf)
 {
         if (!boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN))
                 return sprintf(buf, "Not affected\n");
@@ -318,16 +314,14 @@ ssize_t cpu_show_meltdown(struct device *dev,
         return sprintf(buf, "Vulnerable\n");
 }
 
-ssize_t cpu_show_spectre_v1(struct device *dev,
-                            struct device_attribute *attr, char *buf)
+ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, char *buf)
 {
         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V1))
                 return sprintf(buf, "Not affected\n");
         return sprintf(buf, "Mitigation: __user pointer sanitization\n");
 }
 
-ssize_t cpu_show_spectre_v2(struct device *dev,
-                            struct device_attribute *attr, char *buf)
+ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, char *buf)
 {
         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
                 return sprintf(buf, "Not affected\n");
@@ -337,9 +331,3 @@ ssize_t cpu_show_spectre_v2(struct device *dev,
                        spectre_v2_module_string());
 }
 #endif
-
-void __ibp_barrier(void)
-{
-        __wrmsr(MSR_IA32_PRED_CMD, PRED_CMD_IBPB, 0);
-}
-EXPORT_SYMBOL_GPL(__ibp_barrier);
diff --git a/arch/x86/kernel/cpu/centaur.c b/arch/x86/kernel/cpu/centaur.c
index c578cd29c2d2..e5ec0f11c0de 100644
--- a/arch/x86/kernel/cpu/centaur.c
+++ b/arch/x86/kernel/cpu/centaur.c
@@ -140,7 +140,7 @@ static void init_centaur(struct cpuinfo_x86 *c)
                         clear_cpu_cap(c, X86_FEATURE_TSC);
                         break;
                 case 8:
-                        switch (c->x86_mask) {
+                        switch (c->x86_stepping) {
                         default:
                         name = "2";
                                 break;
@@ -215,7 +215,7 @@ centaur_size_cache(struct cpuinfo_x86 *c, unsigned int size)
          *  - Note, it seems this may only be in engineering samples.
          */
         if ((c->x86 == 6) && (c->x86_model == 9) &&
-                                (c->x86_mask == 1) && (size == 65))
+                                (c->x86_stepping == 1) && (size == 65))
                 size -= 1;
         return size;
 }
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index d63f4b5706e4..824aee0117bb 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -731,7 +731,7 @@ void cpu_detect(struct cpuinfo_x86 *c)
                 cpuid(0x00000001, &tfms, &misc, &junk, &cap0);
                 c->x86          = x86_family(tfms);
                 c->x86_model    = x86_model(tfms);
-                c->x86_mask     = x86_stepping(tfms);
+                c->x86_stepping = x86_stepping(tfms);
 
                 if (cap0 & (1<<19)) {
                         c->x86_clflush_size = ((misc >> 8) & 0xff) * 8;
@@ -1184,9 +1184,9 @@ static void identify_cpu(struct cpuinfo_x86 *c)
         int i;
 
         c->loops_per_jiffy = loops_per_jiffy;
-        c->x86_cache_size = -1;
+        c->x86_cache_size = 0;
         c->x86_vendor = X86_VENDOR_UNKNOWN;
-        c->x86_model = c->x86_mask = 0; /* So far unknown... */
+        c->x86_model = c->x86_stepping = 0;     /* So far unknown... */
         c->x86_vendor_id[0] = '\0'; /* Unset */
         c->x86_model_id[0] = '\0';  /* Unset */
         c->x86_max_cores = 1;
@@ -1378,8 +1378,8 @@ void print_cpu_info(struct cpuinfo_x86 *c)
 
         pr_cont(" (family: 0x%x, model: 0x%x", c->x86, c->x86_model);
 
-        if (c->x86_mask || c->cpuid_level >= 0)
-                pr_cont(", stepping: 0x%x)\n", c->x86_mask);
+        if (c->x86_stepping || c->cpuid_level >= 0)
+                pr_cont(", stepping: 0x%x)\n", c->x86_stepping);
         else
                 pr_cont(")\n");
 }
diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
index 6b4bb335641f..8949b7ae6d92 100644
--- a/arch/x86/kernel/cpu/cyrix.c
+++ b/arch/x86/kernel/cpu/cyrix.c
@@ -215,7 +215,7 @@ static void init_cyrix(struct cpuinfo_x86 *c)
 
         /* common case step number/rev -- exceptions handled below */
         c->x86_model = (dir1 >> 4) + 1;
-        c->x86_mask = dir1 & 0xf;
+        c->x86_stepping = dir1 & 0xf;
 
         /* Now cook; the original recipe is by Channing Corn, from Cyrix.
          * We do the same thing for each generation: we work out
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 319bf989fad1..d19e903214b4 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -116,14 +116,13 @@ struct sku_microcode {
         u32 microcode;
 };
 static const struct sku_microcode spectre_bad_microcodes[] = {
-        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0B,   0x84 },
-        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0A,   0x84 },
-        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x09,   0x84 },
-        { INTEL_FAM6_KABYLAKE_MOBILE,   0x0A,   0x84 },
-        { INTEL_FAM6_KABYLAKE_MOBILE,   0x09,   0x84 },
+        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0B,   0x80 },
+        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0A,   0x80 },
+        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x09,   0x80 },
+        { INTEL_FAM6_KABYLAKE_MOBILE,   0x0A,   0x80 },
+        { INTEL_FAM6_KABYLAKE_MOBILE,   0x09,   0x80 },
         { INTEL_FAM6_SKYLAKE_X,         0x03,   0x0100013e },
         { INTEL_FAM6_SKYLAKE_X,         0x04,   0x0200003c },
-        { INTEL_FAM6_SKYLAKE_MOBILE,    0x03,   0xc2 },
         { INTEL_FAM6_SKYLAKE_DESKTOP,   0x03,   0xc2 },
         { INTEL_FAM6_BROADWELL_CORE,    0x04,   0x28 },
         { INTEL_FAM6_BROADWELL_GT3E,    0x01,   0x1b },
@@ -136,8 +135,6 @@ static const struct sku_microcode spectre_bad_microcodes[] = {
         { INTEL_FAM6_HASWELL_X,         0x02,   0x3b },
         { INTEL_FAM6_HASWELL_X,         0x04,   0x10 },
         { INTEL_FAM6_IVYBRIDGE_X,       0x04,   0x42a },
-        /* Updated in the 20180108 release; blacklist until we know otherwise */
-        { INTEL_FAM6_ATOM_GEMINI_LAKE,  0x01,   0x22 },
         /* Observed in the wild */
         { INTEL_FAM6_SANDYBRIDGE_X,     0x06,   0x61b },
         { INTEL_FAM6_SANDYBRIDGE_X,     0x07,   0x712 },
@@ -149,7 +146,7 @@ static bool bad_spectre_microcode(struct cpuinfo_x86 *c)
 
         for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) {
                 if (c->x86_model == spectre_bad_microcodes[i].model &&
-                    c->x86_mask == spectre_bad_microcodes[i].stepping)
+                    c->x86_stepping == spectre_bad_microcodes[i].stepping)
                         return (c->microcode <= spectre_bad_microcodes[i].microcode);
         }
         return false;
@@ -196,7 +193,7 @@ static void early_init_intel(struct cpuinfo_x86 *c)
          * need the microcode to have already been loaded... so if it is
          * not, recommend a BIOS update and disable large pages.
          */
-        if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_mask <= 2 &&
+        if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_stepping <= 2 &&
             c->microcode < 0x20e) {
                 pr_warn("Atom PSE erratum detected, BIOS microcode update recommended\n");
                 clear_cpu_cap(c, X86_FEATURE_PSE);
@@ -212,7 +209,7 @@ static void early_init_intel(struct cpuinfo_x86 *c)
 
         /* CPUID workaround for 0F33/0F34 CPU */
         if (c->x86 == 0xF && c->x86_model == 0x3
-            && (c->x86_mask == 0x3 || c->x86_mask == 0x4))
+            && (c->x86_stepping == 0x3 || c->x86_stepping == 0x4))
                 c->x86_phys_bits = 36;
 
         /*
@@ -310,7 +307,7 @@ int ppro_with_ram_bug(void)
         if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
             boot_cpu_data.x86 == 6 &&
             boot_cpu_data.x86_model == 1 &&
-            boot_cpu_data.x86_mask < 8) {
+            boot_cpu_data.x86_stepping < 8) {
                 pr_info("Pentium Pro with Errata#50 detected. Taking evasive action.\n");
                 return 1;
         }
@@ -327,7 +324,7 @@ static void intel_smp_check(struct cpuinfo_x86 *c)
          * Mask B, Pentium, but not Pentium MMX
          */
         if (c->x86 == 5 &&
-            c->x86_mask >= 1 && c->x86_mask <= 4 &&
+            c->x86_stepping >= 1 && c->x86_stepping <= 4 &&
             c->x86_model <= 3) {
                 /*
                  * Remember we have B step Pentia with bugs
@@ -370,7 +367,7 @@ static void intel_workarounds(struct cpuinfo_x86 *c)
          * SEP CPUID bug: Pentium Pro reports SEP but doesn't have it until
          * model 3 mask 3
          */
-        if ((c->x86<<8 | c->x86_model<<4 | c->x86_mask) < 0x633)
+        if ((c->x86<<8 | c->x86_model<<4 | c->x86_stepping) < 0x633)
                 clear_cpu_cap(c, X86_FEATURE_SEP);
 
         /*
@@ -388,7 +385,7 @@ static void intel_workarounds(struct cpuinfo_x86 *c)
          * P4 Xeon erratum 037 workaround.
          * Hardware prefetcher may cause stale data to be loaded into the cache.
          */
-        if ((c->x86 == 15) && (c->x86_model == 1) && (c->x86_mask == 1)) {
+        if ((c->x86 == 15) && (c->x86_model == 1) && (c->x86_stepping == 1)) {
                 if (msr_set_bit(MSR_IA32_MISC_ENABLE,
                                 MSR_IA32_MISC_ENABLE_PREFETCH_DISABLE_BIT) > 0) {
                         pr_info("CPU: C0 stepping P4 Xeon detected.\n");
@@ -403,7 +400,7 @@ static void intel_workarounds(struct cpuinfo_x86 *c)
          * Specification Update").
          */
         if (boot_cpu_has(X86_FEATURE_APIC) && (c->x86<<8 | c->x86_model<<4) == 0x520 &&
-            (c->x86_mask < 0x6 || c->x86_mask == 0xb))
+            (c->x86_stepping < 0x6 || c->x86_stepping == 0xb))
                 set_cpu_bug(c, X86_BUG_11AP);
 
 
@@ -650,7 +647,7 @@ static void init_intel(struct cpuinfo_x86 *c)
                 case 6:
                         if (l2 == 128)
                                 p = "Celeron (Mendocino)";
-                        else if (c->x86_mask == 0 || c->x86_mask == 5)
+                        else if (c->x86_stepping == 0 || c->x86_stepping == 5)
                                 p = "Celeron-A";
                         break;
 
diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c
index 410629f10ad3..589b948e6e01 100644
--- a/arch/x86/kernel/cpu/intel_rdt.c
+++ b/arch/x86/kernel/cpu/intel_rdt.c
@@ -819,7 +819,7 @@ static __init void rdt_quirks(void)
                         cache_alloc_hsw_probe();
                 break;
         case INTEL_FAM6_SKYLAKE_X:
-                if (boot_cpu_data.x86_mask <= 4)
+                if (boot_cpu_data.x86_stepping <= 4)
                         set_rdt_options("!cmt,!mbmtotal,!mbmlocal,!l3cat");
         }
 }
diff --git a/arch/x86/kernel/cpu/mcheck/mce-internal.h b/arch/x86/kernel/cpu/mcheck/mce-internal.h
index aa0d5df9dc60..e956eb267061 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-internal.h
+++ b/arch/x86/kernel/cpu/mcheck/mce-internal.h
@@ -115,4 +115,19 @@ static inline void mce_unregister_injector_chain(struct notifier_block *nb)	{ }
 
 extern struct mca_config mca_cfg;
 
+#ifndef CONFIG_X86_64
+/*
+ * On 32-bit systems it would be difficult to safely unmap a poison page
+ * from the kernel 1:1 map because there are no non-canonical addresses that
+ * we can use to refer to the address without risking a speculative access.
+ * However, this isn't much of an issue because:
+ * 1) Few unmappable pages are in the 1:1 map. Most are in HIGHMEM which
+ *    are only mapped into the kernel as needed
+ * 2) Few people would run a 32-bit kernel on a machine that supports
+ *    recoverable errors because they have too much memory to boot 32-bit.
+ */
+static inline void mce_unmap_kpfn(unsigned long pfn) {}
+#define mce_unmap_kpfn mce_unmap_kpfn
+#endif
+
 #endif /* __X86_MCE_INTERNAL_H__ */
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 3a8e88a611eb..8ff94d1e2dce 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -105,6 +105,10 @@ static struct irq_work mce_irq_work;
 
 static void (*quirk_no_way_out)(int bank, struct mce *m, struct pt_regs *regs);
 
+#ifndef mce_unmap_kpfn
+static void mce_unmap_kpfn(unsigned long pfn);
+#endif
+
 /*
  * CPU/chipset specific EDAC code can register a notifier call here to print
  * MCE errors in a human-readable form.
@@ -234,7 +238,7 @@ static void __print_mce(struct mce *m)
                         m->cs, m->ip);
 
                 if (m->cs == __KERNEL_CS)
-                        pr_cont("{%pS}", (void *)m->ip);
+                        pr_cont("{%pS}", (void *)(unsigned long)m->ip);
                 pr_cont("\n");
         }
 
@@ -590,7 +594,8 @@ static int srao_decode_notifier(struct notifier_block *nb, unsigned long val,
 
         if (mce_usable_address(mce) && (mce->severity == MCE_AO_SEVERITY)) {
                 pfn = mce->addr >> PAGE_SHIFT;
-                memory_failure(pfn, 0);
+                if (!memory_failure(pfn, 0))
+                        mce_unmap_kpfn(pfn);
         }
 
         return NOTIFY_OK;
@@ -1057,12 +1062,13 @@ static int do_memory_failure(struct mce *m)
         ret = memory_failure(m->addr >> PAGE_SHIFT, flags);
         if (ret)
                 pr_err("Memory error not recovered");
+        else
+                mce_unmap_kpfn(m->addr >> PAGE_SHIFT);
         return ret;
 }
 
-#if defined(arch_unmap_kpfn) && defined(CONFIG_MEMORY_FAILURE)
-
-void arch_unmap_kpfn(unsigned long pfn)
+#ifndef mce_unmap_kpfn
+static void mce_unmap_kpfn(unsigned long pfn)
 {
         unsigned long decoy_addr;
 
@@ -1073,7 +1079,7 @@ void arch_unmap_kpfn(unsigned long pfn)
          * We would like to just call:
          *      set_memory_np((unsigned long)pfn_to_kaddr(pfn), 1);
          * but doing that would radically increase the odds of a
-         * speculative access to the posion page because we'd have
+         * speculative access to the poison page because we'd have
          * the virtual address of the kernel 1:1 mapping sitting
          * around in registers.
          * Instead we get tricky.  We create a non-canonical address
@@ -1098,7 +1104,6 @@ void arch_unmap_kpfn(unsigned long pfn)
 
         if (set_memory_np(decoy_addr, 1))
                 pr_warn("Could not invalidate pfn=0x%lx from 1:1 map\n", pfn);
-
 }
 #endif
 
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index f7c55b0e753a..a15db2b4e0d6 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -921,7 +921,7 @@ static bool is_blacklisted(unsigned int cpu)
          */
         if (c->x86 == 6 &&
             c->x86_model == INTEL_FAM6_BROADWELL_X &&
-            c->x86_mask == 0x01 &&
+            c->x86_stepping == 0x01 &&
             llc_size_per_core > 2621440 &&
             c->microcode < 0x0b000021) {
                 pr_err_once("Erratum BDF90: late loading with revision < 0x0b000021 (0x%x) disabled.\n", c->microcode);
@@ -944,7 +944,7 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device,
                 return UCODE_NFOUND;
 
         sprintf(name, "intel-ucode/%02x-%02x-%02x",
-                c->x86, c->x86_model, c->x86_mask);
+                c->x86, c->x86_model, c->x86_stepping);
 
         if (request_firmware_direct(&firmware, name, device)) {
                 pr_debug("data file %s load failed\n", name);
@@ -982,7 +982,7 @@ static struct microcode_ops microcode_intel_ops = {
 
 static int __init calc_llc_size_per_core(struct cpuinfo_x86 *c)
 {
-        u64 llc_size = c->x86_cache_size * 1024;
+        u64 llc_size = c->x86_cache_size * 1024ULL;
 
         do_div(llc_size, c->x86_max_cores);
 
diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
index fdc55215d44d..e12ee86906c6 100644
--- a/arch/x86/kernel/cpu/mtrr/generic.c
+++ b/arch/x86/kernel/cpu/mtrr/generic.c
@@ -859,7 +859,7 @@ int generic_validate_add_page(unsigned long base, unsigned long size,
          */
         if (is_cpu(INTEL) && boot_cpu_data.x86 == 6 &&
             boot_cpu_data.x86_model == 1 &&
-            boot_cpu_data.x86_mask <= 7) {
+            boot_cpu_data.x86_stepping <= 7) {
                 if (base & ((1 << (22 - PAGE_SHIFT)) - 1)) {
                         pr_warn("mtrr: base(0x%lx000) is not 4 MiB aligned\n", base);
                         return -EINVAL;
diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
index 40d5a8a75212..7468de429087 100644
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -711,8 +711,8 @@ void __init mtrr_bp_init(void)
                         if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
                             boot_cpu_data.x86 == 0xF &&
                             boot_cpu_data.x86_model == 0x3 &&
-                            (boot_cpu_data.x86_mask == 0x3 ||
-                             boot_cpu_data.x86_mask == 0x4))
+                            (boot_cpu_data.x86_stepping == 0x3 ||
+                             boot_cpu_data.x86_stepping == 0x4))
                                 phys_addr = 36;
 
                         size_or_mask = SIZE_OR_MASK_BITS(phys_addr);
diff --git a/arch/x86/kernel/cpu/proc.c b/arch/x86/kernel/cpu/proc.c
index e7ecedafa1c8..2c8522a39ed5 100644
--- a/arch/x86/kernel/cpu/proc.c
+++ b/arch/x86/kernel/cpu/proc.c
@@ -72,8 +72,8 @@ static int show_cpuinfo(struct seq_file *m, void *v)
                    c->x86_model,
                    c->x86_model_id[0] ? c->x86_model_id : "unknown");
 
-        if (c->x86_mask || c->cpuid_level >= 0)
-                seq_printf(m, "stepping\t: %d\n", c->x86_mask);
+        if (c->x86_stepping || c->cpuid_level >= 0)
+                seq_printf(m, "stepping\t: %d\n", c->x86_stepping);
         else
                 seq_puts(m, "stepping\t: unknown\n");
         if (c->microcode)
@@ -91,8 +91,8 @@ static int show_cpuinfo(struct seq_file *m, void *v)
         }
 
         /* Cache size */
-        if (c->x86_cache_size >= 0)
-                seq_printf(m, "cache size\t: %d KB\n", c->x86_cache_size);
+        if (c->x86_cache_size)
+                seq_printf(m, "cache size\t: %u KB\n", c->x86_cache_size);
 
         show_cpuinfo_core(m, c, cpu);
         show_cpuinfo_misc(m, c);
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index c29020907886..b59e4fb40fd9 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -37,7 +37,7 @@
 #define X86             new_cpu_data+CPUINFO_x86
 #define X86_VENDOR      new_cpu_data+CPUINFO_x86_vendor
 #define X86_MODEL       new_cpu_data+CPUINFO_x86_model
-#define X86_MASK        new_cpu_data+CPUINFO_x86_mask
+#define X86_STEPPING    new_cpu_data+CPUINFO_x86_stepping
 #define X86_HARD_MATH   new_cpu_data+CPUINFO_hard_math
 #define X86_CPUID       new_cpu_data+CPUINFO_cpuid_level
 #define X86_CAPABILITY  new_cpu_data+CPUINFO_x86_capability
@@ -332,7 +332,7 @@ ENTRY(startup_32_smp)
         shrb $4,%al
         movb %al,X86_MODEL
         andb $0x0f,%cl          # mask mask revision
-        movb %cl,X86_MASK
+        movb %cl,X86_STEPPING
         movl %edx,X86_CAPABILITY
 
 .Lis486:
diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
index 27d0a1712663..f1c5eb99d445 100644
--- a/arch/x86/kernel/mpparse.c
+++ b/arch/x86/kernel/mpparse.c
@@ -410,7 +410,7 @@ static inline void __init construct_default_ISA_mptable(int mpc_default_type)
         processor.apicver = mpc_default_type > 4 ? 0x10 : 0x01;
         processor.cpuflag = CPU_ENABLED;
         processor.cpufeature = (boot_cpu_data.x86 << 8) |
-            (boot_cpu_data.x86_model << 4) | boot_cpu_data.x86_mask;
+            (boot_cpu_data.x86_model << 4) | boot_cpu_data.x86_stepping;
         processor.featureflag = boot_cpu_data.x86_capability[CPUID_1_EDX];
         processor.reserved[0] = 0;
         processor.reserved[1] = 0;
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index 041096bdef86..99dc79e76bdc 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -200,9 +200,9 @@ static void native_flush_tlb_global(void)
         __native_flush_tlb_global();
 }
 
-static void native_flush_tlb_single(unsigned long addr)
+static void native_flush_tlb_one_user(unsigned long addr)
 {
-        __native_flush_tlb_single(addr);
+        __native_flush_tlb_one_user(addr);
 }
 
 struct static_key paravirt_steal_enabled;
@@ -401,7 +401,7 @@ struct pv_mmu_ops pv_mmu_ops __ro_after_init = {
 
         .flush_tlb_user = native_flush_tlb,
         .flush_tlb_kernel = native_flush_tlb_global,
-        .flush_tlb_single = native_flush_tlb_single,
+        .flush_tlb_one_user = native_flush_tlb_one_user,
         .flush_tlb_others = native_flush_tlb_others,
 
         .pgd_alloc = __paravirt_pgd_alloc,
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 6f27facbaa9b..9eee25d07586 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1281,11 +1281,10 @@ void __init native_smp_prepare_boot_cpu(void)
         cpu_set_state_online(me);
 }
 
-void __init native_smp_cpus_done(unsigned int max_cpus)
+void __init calculate_max_logical_packages(void)
 {
         int ncpus;
 
-        pr_debug("Boot done\n");
         /*
          * Today neither Intel nor AMD support heterogenous systems so
          * extrapolate the boot cpu's data to all packages.
@@ -1293,6 +1292,13 @@ void __init native_smp_cpus_done(unsigned int max_cpus)
         ncpus = cpu_data(0).booted_cores * topology_max_smt_threads();
         __max_logical_packages = DIV_ROUND_UP(nr_cpu_ids, ncpus);
         pr_info("Max logical packages: %u\n", __max_logical_packages);
+}
+
+void __init native_smp_cpus_done(unsigned int max_cpus)
+{
+        pr_debug("Boot done\n");
+
+        calculate_max_logical_packages();
 
         if (x86_has_numa_in_package)
                 set_sched_topology(x86_numa_in_package_topology);
@@ -1430,7 +1436,6 @@ static void remove_siblinginfo(int cpu)
         cpumask_clear(cpu_llc_shared_mask(cpu));
         cpumask_clear(topology_sibling_cpumask(cpu));
         cpumask_clear(topology_core_cpumask(cpu));
-        c->phys_proc_id = 0;
         c->cpu_core_id = 0;
         cpumask_clear_cpu(cpu, cpu_sibling_setup_mask);
         recompute_smt_state();
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 446c9ef8cfc3..3d9b2308e7fa 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -181,7 +181,7 @@ int fixup_bug(struct pt_regs *regs, int trapnr)
                 break;
 
         case BUG_TRAP_TYPE_WARN:
-                regs->ip += LEN_UD0;
+                regs->ip += LEN_UD2;
                 return 1;
         }
 
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 8eca1d04aeb8..46ff304140c7 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -5080,7 +5080,7 @@ void kvm_mmu_uninit_vm(struct kvm *kvm)
 typedef bool (*slot_level_handler) (struct kvm *kvm, struct kvm_rmap_head *rmap_head);
 
 /* The caller should hold mmu-lock before calling this function. */
-static bool
+static __always_inline bool
 slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot,
                         slot_level_handler fn, int start_level, int end_level,
                         gfn_t start_gfn, gfn_t end_gfn, bool lock_flush_tlb)
@@ -5110,7 +5110,7 @@ slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot,
         return flush;
 }
 
-static bool
+static __always_inline bool
 slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                   slot_level_handler fn, int start_level, int end_level,
                   bool lock_flush_tlb)
@@ -5121,7 +5121,7 @@ slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                         lock_flush_tlb);
 }
 
-static bool
+static __always_inline bool
 slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                       slot_level_handler fn, bool lock_flush_tlb)
 {
@@ -5129,7 +5129,7 @@ slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                                  PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
 }
 
-static bool
+static __always_inline bool
 slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                         slot_level_handler fn, bool lock_flush_tlb)
 {
@@ -5137,7 +5137,7 @@ slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                                  PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
 }
 
-static bool
+static __always_inline bool
 slot_handle_leaf(struct kvm *kvm, struct kvm_memory_slot *memslot,
                  slot_level_handler fn, bool lock_flush_tlb)
 {
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index f427723dc7db..3dec126aa302 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -10136,7 +10136,10 @@ static void nested_get_vmcs12_pages(struct kvm_vcpu *vcpu,
                         (unsigned long)(vmcs12->posted_intr_desc_addr &
                         (PAGE_SIZE - 1)));
         }
-        if (!nested_vmx_prepare_msr_bitmap(vcpu, vmcs12))
+        if (nested_vmx_prepare_msr_bitmap(vcpu, vmcs12))
+                vmcs_set_bits(CPU_BASED_VM_EXEC_CONTROL,
+                              CPU_BASED_USE_MSR_BITMAPS);
+        else
                 vmcs_clear_bits(CPU_BASED_VM_EXEC_CONTROL,
                                 CPU_BASED_USE_MSR_BITMAPS);
 }
@@ -10224,8 +10227,8 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,
          *    updated to reflect this when L1 (or its L2s) actually write to
          *    the MSR.
          */
-        bool pred_cmd = msr_write_intercepted_l01(vcpu, MSR_IA32_PRED_CMD);
-        bool spec_ctrl = msr_write_intercepted_l01(vcpu, MSR_IA32_SPEC_CTRL);
+        bool pred_cmd = !msr_write_intercepted_l01(vcpu, MSR_IA32_PRED_CMD);
+        bool spec_ctrl = !msr_write_intercepted_l01(vcpu, MSR_IA32_SPEC_CTRL);
 
         /* Nothing to do if the MSR bitmap is not in use.  */
         if (!cpu_has_vmx_msr_bitmap() ||
diff --git a/arch/x86/lib/cpu.c b/arch/x86/lib/cpu.c
index d6f848d1211d..2dd1fe13a37b 100644
--- a/arch/x86/lib/cpu.c
+++ b/arch/x86/lib/cpu.c
@@ -18,7 +18,7 @@ unsigned int x86_model(unsigned int sig)
 {
         unsigned int fam, model;
 
-         fam = x86_family(sig);
+        fam = x86_family(sig);
 
         model = (sig >> 4) & 0xf;
 
diff --git a/arch/x86/lib/error-inject.c b/arch/x86/lib/error-inject.c
index 7b881d03d0dd..3cdf06128d13 100644
--- a/arch/x86/lib/error-inject.c
+++ b/arch/x86/lib/error-inject.c
@@ -7,6 +7,7 @@ asmlinkage void just_return_func(void);
 
 asm(
         ".type just_return_func, @function\n"
+        ".globl just_return_func\n"
         "just_return_func:\n"
         "       ret\n"
         ".size just_return_func, .-just_return_func\n"
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 1ab42c852069..8b72923f1d35 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -256,7 +256,7 @@ static void __set_pte_vaddr(pud_t *pud, unsigned long vaddr, pte_t new_pte)
          * It's enough to flush this one mapping.
          * (PGE mappings get flushed as well)
          */
-        __flush_tlb_one(vaddr);
+        __flush_tlb_one_kernel(vaddr);
 }
 
 void set_pte_vaddr_p4d(p4d_t *p4d_page, unsigned long vaddr, pte_t new_pte)
@@ -1193,8 +1193,8 @@ void __init mem_init(void)
         register_page_bootmem_info();
 
         /* Register memory areas for /proc/kcore */
-        kclist_add(&kcore_vsyscall, (void *)VSYSCALL_ADDR,
-                         PAGE_SIZE, KCORE_OTHER);
+        if (get_gate_vma(&init_mm))
+                kclist_add(&kcore_vsyscall, (void *)VSYSCALL_ADDR, PAGE_SIZE, KCORE_USER);
 
         mem_init_print_info(NULL);
 }
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index c45b6ec5357b..e2db83bebc3b 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -820,5 +820,5 @@ void __init __early_set_fixmap(enum fixed_addresses idx,
                 set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
         else
                 pte_clear(&init_mm, addr, pte);
-        __flush_tlb_one(addr);
+        __flush_tlb_one_kernel(addr);
 }
diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c
index 58477ec3d66d..7c8686709636 100644
--- a/arch/x86/mm/kmmio.c
+++ b/arch/x86/mm/kmmio.c
@@ -168,7 +168,7 @@ static int clear_page_presence(struct kmmio_fault_page *f, bool clear)
                 return -1;
         }
 
-        __flush_tlb_one(f->addr);
+        __flush_tlb_one_kernel(f->addr);
         return 0;
 }
 
diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
index c3c5274410a9..9bb7f0ab9fe6 100644
--- a/arch/x86/mm/pgtable_32.c
+++ b/arch/x86/mm/pgtable_32.c
@@ -63,7 +63,7 @@ void set_pte_vaddr(unsigned long vaddr, pte_t pteval)
          * It's enough to flush this one mapping.
          * (PGE mappings get flushed as well)
          */
-        __flush_tlb_one(vaddr);
+        __flush_tlb_one_kernel(vaddr);
 }
 
 unsigned long __FIXADDR_TOP = 0xfffff000;
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 8dcc0607f805..7f1a51399674 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -498,7 +498,7 @@ static void flush_tlb_func_common(const struct flush_tlb_info *f,
          *    flush that changes context.tlb_gen from 2 to 3.  If they get
          *    processed on this CPU in reverse order, we'll see
          *     local_tlb_gen == 1, mm_tlb_gen == 3, and end != TLB_FLUSH_ALL.
-         *    If we were to use __flush_tlb_single() and set local_tlb_gen to
+         *    If we were to use __flush_tlb_one_user() and set local_tlb_gen to
          *    3, we'd be break the invariant: we'd update local_tlb_gen above
          *    1 without the full flush that's needed for tlb_gen 2.
          *
@@ -519,7 +519,7 @@ static void flush_tlb_func_common(const struct flush_tlb_info *f,
 
                 addr = f->start;
                 while (addr < f->end) {
-                        __flush_tlb_single(addr);
+                        __flush_tlb_one_user(addr);
                         addr += PAGE_SIZE;
                 }
                 if (local)
@@ -666,7 +666,7 @@ static void do_kernel_range_flush(void *info)
 
         /* flush range by one by one 'invlpg' */
         for (addr = f->start; addr < f->end; addr += PAGE_SIZE)
-                __flush_tlb_one(addr);
+                __flush_tlb_one_kernel(addr);
 }
 
 void flush_tlb_kernel_range(unsigned long start, unsigned long end)
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index c2e9285d1bf1..db77e087adaf 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -299,7 +299,7 @@ static void bau_process_message(struct msg_desc *mdp, struct bau_control *bcp,
                 local_flush_tlb();
                 stat->d_alltlb++;
         } else {
-                __flush_tlb_single(msg->address);
+                __flush_tlb_one_user(msg->address);
                 stat->d_onetlb++;
         }
         stat->d_requestee++;
diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
index d85076223a69..aae88fec9941 100644
--- a/arch/x86/xen/mmu_pv.c
+++ b/arch/x86/xen/mmu_pv.c
@@ -1300,12 +1300,12 @@ static void xen_flush_tlb(void)
         preempt_enable();
 }
 
-static void xen_flush_tlb_single(unsigned long addr)
+static void xen_flush_tlb_one_user(unsigned long addr)
 {
         struct mmuext_op *op;
         struct multicall_space mcs;
 
-        trace_xen_mmu_flush_tlb_single(addr);
+        trace_xen_mmu_flush_tlb_one_user(addr);
 
         preempt_disable();
 
@@ -2370,7 +2370,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
 
         .flush_tlb_user = xen_flush_tlb,
         .flush_tlb_kernel = xen_flush_tlb,
-        .flush_tlb_single = xen_flush_tlb_single,
+        .flush_tlb_one_user = xen_flush_tlb_one_user,
         .flush_tlb_others = xen_flush_tlb_others,
 
         .pgd_alloc = xen_pgd_alloc,
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index 77c959cf81e7..7a43b2ae19f1 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -122,6 +122,8 @@ void __init xen_smp_cpus_done(unsigned int max_cpus)
 
         if (xen_hvm_domain())
                 native_smp_cpus_done(max_cpus);
+        else
+                calculate_max_logical_packages();
 
         if (xen_have_vcpu_info_placement)
                 return;
diff --git a/block/blk-mq.c b/block/blk-mq.c
index df93102e2149..357492712b0e 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -3164,6 +3164,7 @@ static bool __blk_mq_poll(struct blk_mq_hw_ctx *hctx, struct request *rq)
                 cpu_relax();
         }
 
+        __set_current_state(TASK_RUNNING);
         return false;
 }
 
diff --git a/crypto/sha3_generic.c b/crypto/sha3_generic.c
index a965b9d80559..ded148783303 100644
--- a/crypto/sha3_generic.c
+++ b/crypto/sha3_generic.c
@@ -20,6 +20,20 @@
 #include <crypto/sha3.h>
 #include <asm/unaligned.h>
 
+/*
+ * On some 32-bit architectures (mn10300 and h8300), GCC ends up using
+ * over 1 KB of stack if we inline the round calculation into the loop
+ * in keccakf(). On the other hand, on 64-bit architectures with plenty
+ * of [64-bit wide] general purpose registers, not inlining it severely
+ * hurts performance. So let's use 64-bitness as a heuristic to decide
+ * whether to inline or not.
+ */
+#ifdef CONFIG_64BIT
+#define SHA3_INLINE     inline
+#else
+#define SHA3_INLINE     noinline
+#endif
+
 #define KECCAK_ROUNDS 24
 
 static const u64 keccakf_rndc[24] = {
@@ -35,111 +49,115 @@ static const u64 keccakf_rndc[24] = {
 
 /* update the state with given number of rounds */
 
-static void __attribute__((__optimize__("O3"))) keccakf(u64 st[25])
+static SHA3_INLINE void keccakf_round(u64 st[25])
 {
         u64 t[5], tt, bc[5];
-        int round;
 
-        for (round = 0; round < KECCAK_ROUNDS; round++) {
+        /* Theta */
+        bc[0] = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];
+        bc[1] = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];
+        bc[2] = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];
+        bc[3] = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];
+        bc[4] = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];
+
+        t[0] = bc[4] ^ rol64(bc[1], 1);
+        t[1] = bc[0] ^ rol64(bc[2], 1);
+        t[2] = bc[1] ^ rol64(bc[3], 1);
+        t[3] = bc[2] ^ rol64(bc[4], 1);
+        t[4] = bc[3] ^ rol64(bc[0], 1);
+
+        st[0] ^= t[0];
+
+        /* Rho Pi */
+        tt = st[1];
+        st[ 1] = rol64(st[ 6] ^ t[1], 44);
+        st[ 6] = rol64(st[ 9] ^ t[4], 20);
+        st[ 9] = rol64(st[22] ^ t[2], 61);
+        st[22] = rol64(st[14] ^ t[4], 39);
+        st[14] = rol64(st[20] ^ t[0], 18);
+        st[20] = rol64(st[ 2] ^ t[2], 62);
+        st[ 2] = rol64(st[12] ^ t[2], 43);
+        st[12] = rol64(st[13] ^ t[3], 25);
+        st[13] = rol64(st[19] ^ t[4],  8);
+        st[19] = rol64(st[23] ^ t[3], 56);
+        st[23] = rol64(st[15] ^ t[0], 41);
+        st[15] = rol64(st[ 4] ^ t[4], 27);
+        st[ 4] = rol64(st[24] ^ t[4], 14);
+        st[24] = rol64(st[21] ^ t[1],  2);
+        st[21] = rol64(st[ 8] ^ t[3], 55);
+        st[ 8] = rol64(st[16] ^ t[1], 45);
+        st[16] = rol64(st[ 5] ^ t[0], 36);
+        st[ 5] = rol64(st[ 3] ^ t[3], 28);
+        st[ 3] = rol64(st[18] ^ t[3], 21);
+        st[18] = rol64(st[17] ^ t[2], 15);
+        st[17] = rol64(st[11] ^ t[1], 10);
+        st[11] = rol64(st[ 7] ^ t[2],  6);
+        st[ 7] = rol64(st[10] ^ t[0],  3);
+        st[10] = rol64(    tt ^ t[1],  1);
+
+        /* Chi */
+        bc[ 0] = ~st[ 1] & st[ 2];
+        bc[ 1] = ~st[ 2] & st[ 3];
+        bc[ 2] = ~st[ 3] & st[ 4];
+        bc[ 3] = ~st[ 4] & st[ 0];
+        bc[ 4] = ~st[ 0] & st[ 1];
+        st[ 0] ^= bc[ 0];
+        st[ 1] ^= bc[ 1];
+        st[ 2] ^= bc[ 2];
+        st[ 3] ^= bc[ 3];
+        st[ 4] ^= bc[ 4];
+
+        bc[ 0] = ~st[ 6] & st[ 7];
+        bc[ 1] = ~st[ 7] & st[ 8];
+        bc[ 2] = ~st[ 8] & st[ 9];
+        bc[ 3] = ~st[ 9] & st[ 5];
+        bc[ 4] = ~st[ 5] & st[ 6];
+        st[ 5] ^= bc[ 0];
+        st[ 6] ^= bc[ 1];
+        st[ 7] ^= bc[ 2];
+        st[ 8] ^= bc[ 3];
+        st[ 9] ^= bc[ 4];
+
+        bc[ 0] = ~st[11] & st[12];
+        bc[ 1] = ~st[12] & st[13];
+        bc[ 2] = ~st[13] & st[14];
+        bc[ 3] = ~st[14] & st[10];
+        bc[ 4] = ~st[10] & st[11];
+        st[10] ^= bc[ 0];
+        st[11] ^= bc[ 1];
+        st[12] ^= bc[ 2];
+        st[13] ^= bc[ 3];
+        st[14] ^= bc[ 4];
+
+        bc[ 0] = ~st[16] & st[17];
+        bc[ 1] = ~st[17] & st[18];
+        bc[ 2] = ~st[18] & st[19];
+        bc[ 3] = ~st[19] & st[15];
+        bc[ 4] = ~st[15] & st[16];
+        st[15] ^= bc[ 0];
+        st[16] ^= bc[ 1];
+        st[17] ^= bc[ 2];
+        st[18] ^= bc[ 3];
+        st[19] ^= bc[ 4];
+
+        bc[ 0] = ~st[21] & st[22];
+        bc[ 1] = ~st[22] & st[23];
+        bc[ 2] = ~st[23] & st[24];
+        bc[ 3] = ~st[24] & st[20];
+        bc[ 4] = ~st[20] & st[21];
+        st[20] ^= bc[ 0];
+        st[21] ^= bc[ 1];
+        st[22] ^= bc[ 2];
+        st[23] ^= bc[ 3];
+        st[24] ^= bc[ 4];
+}
 
-                /* Theta */
-                bc[0] = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];
-                bc[1] = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];
-                bc[2] = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];
-                bc[3] = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];
-                bc[4] = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];
-
-                t[0] = bc[4] ^ rol64(bc[1], 1);
-                t[1] = bc[0] ^ rol64(bc[2], 1);
-                t[2] = bc[1] ^ rol64(bc[3], 1);
-                t[3] = bc[2] ^ rol64(bc[4], 1);
-                t[4] = bc[3] ^ rol64(bc[0], 1);
-
-                st[0] ^= t[0];
-
-                /* Rho Pi */
-                tt = st[1];
-                st[ 1] = rol64(st[ 6] ^ t[1], 44);
-                st[ 6] = rol64(st[ 9] ^ t[4], 20);
-                st[ 9] = rol64(st[22] ^ t[2], 61);
-                st[22] = rol64(st[14] ^ t[4], 39);
-                st[14] = rol64(st[20] ^ t[0], 18);
-                st[20] = rol64(st[ 2] ^ t[2], 62);
-                st[ 2] = rol64(st[12] ^ t[2], 43);
-                st[12] = rol64(st[13] ^ t[3], 25);
-                st[13] = rol64(st[19] ^ t[4],  8);
-                st[19] = rol64(st[23] ^ t[3], 56);
-                st[23] = rol64(st[15] ^ t[0], 41);
-                st[15] = rol64(st[ 4] ^ t[4], 27);
-                st[ 4] = rol64(st[24] ^ t[4], 14);
-                st[24] = rol64(st[21] ^ t[1],  2);
-                st[21] = rol64(st[ 8] ^ t[3], 55);
-                st[ 8] = rol64(st[16] ^ t[1], 45);
-                st[16] = rol64(st[ 5] ^ t[0], 36);
-                st[ 5] = rol64(st[ 3] ^ t[3], 28);
-                st[ 3] = rol64(st[18] ^ t[3], 21);
-                st[18] = rol64(st[17] ^ t[2], 15);
-                st[17] = rol64(st[11] ^ t[1], 10);
-                st[11] = rol64(st[ 7] ^ t[2],  6);
-                st[ 7] = rol64(st[10] ^ t[0],  3);
-                st[10] = rol64(    tt ^ t[1],  1);
-
-                /* Chi */
-                bc[ 0] = ~st[ 1] & st[ 2];
-                bc[ 1] = ~st[ 2] & st[ 3];
-                bc[ 2] = ~st[ 3] & st[ 4];
-                bc[ 3] = ~st[ 4] & st[ 0];
-                bc[ 4] = ~st[ 0] & st[ 1];
-                st[ 0] ^= bc[ 0];
-                st[ 1] ^= bc[ 1];
-                st[ 2] ^= bc[ 2];
-                st[ 3] ^= bc[ 3];
-                st[ 4] ^= bc[ 4];
-
-                bc[ 0] = ~st[ 6] & st[ 7];
-                bc[ 1] = ~st[ 7] & st[ 8];
-                bc[ 2] = ~st[ 8] & st[ 9];
-                bc[ 3] = ~st[ 9] & st[ 5];
-                bc[ 4] = ~st[ 5] & st[ 6];
-                st[ 5] ^= bc[ 0];
-                st[ 6] ^= bc[ 1];
-                st[ 7] ^= bc[ 2];
-                st[ 8] ^= bc[ 3];
-                st[ 9] ^= bc[ 4];
-
-                bc[ 0] = ~st[11] & st[12];
-                bc[ 1] = ~st[12] & st[13];
-                bc[ 2] = ~st[13] & st[14];
-                bc[ 3] = ~st[14] & st[10];
-                bc[ 4] = ~st[10] & st[11];
-                st[10] ^= bc[ 0];
-                st[11] ^= bc[ 1];
-                st[12] ^= bc[ 2];
-                st[13] ^= bc[ 3];
-                st[14] ^= bc[ 4];
-
-                bc[ 0] = ~st[16] & st[17];
-                bc[ 1] = ~st[17] & st[18];
-                bc[ 2] = ~st[18] & st[19];
-                bc[ 3] = ~st[19] & st[15];
-                bc[ 4] = ~st[15] & st[16];
-                st[15] ^= bc[ 0];
-                st[16] ^= bc[ 1];
-                st[17] ^= bc[ 2];
-                st[18] ^= bc[ 3];
-                st[19] ^= bc[ 4];
-
-                bc[ 0] = ~st[21] & st[22];
-                bc[ 1] = ~st[22] & st[23];
-                bc[ 2] = ~st[23] & st[24];
-                bc[ 3] = ~st[24] & st[20];
-                bc[ 4] = ~st[20] & st[21];
-                st[20] ^= bc[ 0];
-                st[21] ^= bc[ 1];
-                st[22] ^= bc[ 2];
-                st[23] ^= bc[ 3];
-                st[24] ^= bc[ 4];
+static void __optimize("O3") keccakf(u64 st[25])
+{
+        int round;
 
+        for (round = 0; round < KECCAK_ROUNDS; round++) {
+                keccakf_round(st);
                 /* Iota */
                 st[0] ^= keccakf_rndc[round];
         }
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 676c9788e1c8..0dad0bd9327b 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -660,13 +660,15 @@ struct acpi_device *acpi_companion_match(const struct device *dev)
  * acpi_of_match_device - Match device object using the "compatible" property.
  * @adev: ACPI device object to match.
  * @of_match_table: List of device IDs to match against.
+ * @of_id: OF ID if matched
  *
  * If @dev has an ACPI companion which has ACPI_DT_NAMESPACE_HID in its list of
  * identifiers and a _DSD object with the "compatible" property, use that
  * property to match against the given list of identifiers.
  */
 static bool acpi_of_match_device(struct acpi_device *adev,
-                                 const struct of_device_id *of_match_table)
+                                 const struct of_device_id *of_match_table,
+                                 const struct of_device_id **of_id)
 {
         const union acpi_object *of_compatible, *obj;
         int i, nval;
@@ -690,8 +692,11 @@ static bool acpi_of_match_device(struct acpi_device *adev,
                 const struct of_device_id *id;
 
                 for (id = of_match_table; id->compatible[0]; id++)
-                        if (!strcasecmp(obj->string.pointer, id->compatible))
+                        if (!strcasecmp(obj->string.pointer, id->compatible)) {
+                                if (of_id)
+                                        *of_id = id;
                                 return true;
+                        }
         }
 
         return false;
@@ -762,10 +767,11 @@ static bool __acpi_match_device_cls(const struct acpi_device_id *id,
         return true;
 }
 
-static const struct acpi_device_id *__acpi_match_device(
-        struct acpi_device *device,
-        const struct acpi_device_id *ids,
-        const struct of_device_id *of_ids)
+static bool __acpi_match_device(struct acpi_device *device,
+                                const struct acpi_device_id *acpi_ids,
+                                const struct of_device_id *of_ids,
+                                const struct acpi_device_id **acpi_id,
+                                const struct of_device_id **of_id)
 {
         const struct acpi_device_id *id;
         struct acpi_hardware_id *hwid;
@@ -775,30 +781,32 @@ static const struct acpi_device_id *__acpi_match_device(
          * driver for it.
          */
         if (!device || !device->status.present)
-                return NULL;
+                return false;
 
         list_for_each_entry(hwid, &device->pnp.ids, list) {
                 /* First, check the ACPI/PNP IDs provided by the caller. */
-                for (id = ids; id->id[0] || id->cls; id++) {
-                        if (id->id[0] && !strcmp((char *) id->id, hwid->id))
-                                return id;
-                        else if (id->cls && __acpi_match_device_cls(id, hwid))
-                                return id;
+                if (acpi_ids) {
+                        for (id = acpi_ids; id->id[0] || id->cls; id++) {
+                                if (id->id[0] && !strcmp((char *)id->id, hwid->id))
+                                        goto out_acpi_match;
+                                if (id->cls && __acpi_match_device_cls(id, hwid))
+                                        goto out_acpi_match;
+                        }
                 }
 
                 /*
                  * Next, check ACPI_DT_NAMESPACE_HID and try to match the
                  * "compatible" property if found.
-                 *
-                 * The id returned by the below is not valid, but the only
-                 * caller passing non-NULL of_ids here is only interested in
-                 * whether or not the return value is NULL.
                  */
-                if (!strcmp(ACPI_DT_NAMESPACE_HID, hwid->id)
-                    && acpi_of_match_device(device, of_ids))
-                        return id;
+                if (!strcmp(ACPI_DT_NAMESPACE_HID, hwid->id))
+                        return acpi_of_match_device(device, of_ids, of_id);
         }
-        return NULL;
+        return false;
+
+out_acpi_match:
+        if (acpi_id)
+                *acpi_id = id;
+        return true;
 }
 
 /**
@@ -815,32 +823,29 @@ static const struct acpi_device_id *__acpi_match_device(
 const struct acpi_device_id *acpi_match_device(const struct acpi_device_id *ids,
                                                const struct device *dev)
 {
-        return __acpi_match_device(acpi_companion_match(dev), ids, NULL);
+        const struct acpi_device_id *id = NULL;
+
+        __acpi_match_device(acpi_companion_match(dev), ids, NULL, &id, NULL);
+        return id;
 }
 EXPORT_SYMBOL_GPL(acpi_match_device);
 
-void *acpi_get_match_data(const struct device *dev)
+const void *acpi_device_get_match_data(const struct device *dev)
 {
         const struct acpi_device_id *match;
 
-        if (!dev->driver)
-                return NULL;
-
-        if (!dev->driver->acpi_match_table)
-                return NULL;
-
         match = acpi_match_device(dev->driver->acpi_match_table, dev);
         if (!match)
                 return NULL;
 
-        return (void *)match->driver_data;
+        return (const void *)match->driver_data;
 }
-EXPORT_SYMBOL_GPL(acpi_get_match_data);
+EXPORT_SYMBOL_GPL(acpi_device_get_match_data);
 
 int acpi_match_device_ids(struct acpi_device *device,
                           const struct acpi_device_id *ids)
 {
-        return __acpi_match_device(device, ids, NULL) ? 0 : -ENOENT;
+        return __acpi_match_device(device, ids, NULL, NULL, NULL) ? 0 : -ENOENT;
 }
 EXPORT_SYMBOL(acpi_match_device_ids);
 
@@ -849,10 +854,12 @@ bool acpi_driver_match_device(struct device *dev,
 {
         if (!drv->acpi_match_table)
                 return acpi_of_match_device(ACPI_COMPANION(dev),
-                                            drv->of_match_table);
+                                            drv->of_match_table,
+                                            NULL);
 
-        return !!__acpi_match_device(acpi_companion_match(dev),
-                                     drv->acpi_match_table, drv->of_match_table);
+        return __acpi_match_device(acpi_companion_match(dev),
+                                   drv->acpi_match_table, drv->of_match_table,
+                                   NULL, NULL);
 }
 EXPORT_SYMBOL_GPL(acpi_driver_match_device);
 
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index d9f38c645e4a..30a572956557 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1927,6 +1927,9 @@ static int acpi_ec_suspend_noirq(struct device *dev)
             ec->reference_count >= 1)
                 acpi_set_gpe(NULL, ec->gpe, ACPI_GPE_DISABLE);
 
+        if (acpi_sleep_no_ec_events())
+                acpi_ec_enter_noirq(ec);
+
         return 0;
 }
 
@@ -1934,6 +1937,9 @@ static int acpi_ec_resume_noirq(struct device *dev)
 {
         struct acpi_ec *ec = acpi_driver_data(to_acpi_device(dev));
 
+        if (acpi_sleep_no_ec_events())
+                acpi_ec_leave_noirq(ec);
+
         if (ec_no_wakeup && test_bit(EC_FLAGS_STARTED, &ec->flags) &&
             ec->reference_count >= 1)
                 acpi_set_gpe(NULL, ec->gpe, ACPI_GPE_ENABLE);
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 466d1503aba0..5815356ea6ad 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -1271,11 +1271,11 @@ static int acpi_fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,
         return 0;
 }
 
-static void *
+static const void *
 acpi_fwnode_device_get_match_data(const struct fwnode_handle *fwnode,
                                   const struct device *dev)
 {
-        return acpi_get_match_data(dev);
+        return acpi_device_get_match_data(dev);
 }
 
 #define DECLARE_ACPI_FWNODE_OPS(ops) \
diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
index 89e97d21a89c..9d52743080a4 100644
--- a/drivers/acpi/spcr.c
+++ b/drivers/acpi/spcr.c
@@ -115,6 +115,7 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console)
                         table->serial_port.access_width))) {
                 default:
                         pr_err("Unexpected SPCR Access Width.  Defaulting to byte size\n");
+                        /* fall through */
                 case 8:
                         iotype = "mmio";
                         break;
diff --git a/drivers/base/core.c b/drivers/base/core.c
index b2261f92f2f1..5847364f25d9 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -310,6 +310,9 @@ static void __device_link_del(struct device_link *link)
         dev_info(link->consumer, "Dropping the link to %s\n",
                  dev_name(link->supplier));
 
+        if (link->flags & DL_FLAG_PM_RUNTIME)
+                pm_runtime_drop_link(link->consumer);
+
         list_del(&link->s_node);
         list_del(&link->c_node);
         device_link_free(link);
diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c
index a8ac86e4d79e..6637fc319269 100644
--- a/drivers/base/power/wakeirq.c
+++ b/drivers/base/power/wakeirq.c
@@ -321,7 +321,8 @@ void dev_pm_arm_wake_irq(struct wake_irq *wirq)
                 return;
 
         if (device_may_wakeup(wirq->dev)) {
-                if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED)
+                if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED &&
+                    !pm_runtime_status_suspended(wirq->dev))
                         enable_irq(wirq->irq);
 
                 enable_irq_wake(wirq->irq);
@@ -343,7 +344,8 @@ void dev_pm_disarm_wake_irq(struct wake_irq *wirq)
         if (device_may_wakeup(wirq->dev)) {
                 disable_irq_wake(wirq->irq);
 
-                if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED)
+                if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED &&
+                    !pm_runtime_status_suspended(wirq->dev))
                         disable_irq_nosync(wirq->irq);
         }
 }
diff --git a/drivers/base/property.c b/drivers/base/property.c
index 302236281d83..8f205f6461ed 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -1410,9 +1410,8 @@ int fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,
 }
 EXPORT_SYMBOL(fwnode_graph_parse_endpoint);
 
-void *device_get_match_data(struct device *dev)
+const void *device_get_match_data(struct device *dev)
 {
-        return fwnode_call_ptr_op(dev_fwnode(dev), device_get_match_data,
-                                  dev);
+        return fwnode_call_ptr_op(dev_fwnode(dev), device_get_match_data, dev);
 }
 EXPORT_SYMBOL_GPL(device_get_match_data);
diff --git a/drivers/char/hw_random/via-rng.c b/drivers/char/hw_random/via-rng.c
index d1f5bb534e0e..6e9df558325b 100644
--- a/drivers/char/hw_random/via-rng.c
+++ b/drivers/char/hw_random/via-rng.c
@@ -162,7 +162,7 @@ static int via_rng_init(struct hwrng *rng)
         /* Enable secondary noise source on CPUs where it is present. */
 
         /* Nehemiah stepping 8 and higher */
-        if ((c->x86_model == 9) && (c->x86_mask > 7))
+        if ((c->x86_model == 9) && (c->x86_stepping > 7))
                 lo |= VIA_NOISESRC2;
 
         /* Esther */
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index 3a2ca0f79daf..d0c34df0529c 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -629,7 +629,7 @@ static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c)
         if (c->x86_vendor == X86_VENDOR_INTEL) {
                 if ((c->x86 == 15) &&
                     (c->x86_model == 6) &&
-                    (c->x86_mask == 8)) {
+                    (c->x86_stepping == 8)) {
                         pr_info("Intel(R) Xeon(R) 7100 Errata AL30, processors may lock up on frequency changes: disabling acpi-cpufreq\n");
                         return -ENODEV;
                     }
diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
index 942632a27b50..f730b6528c18 100644
--- a/drivers/cpufreq/longhaul.c
+++ b/drivers/cpufreq/longhaul.c
@@ -775,7 +775,7 @@ static int longhaul_cpu_init(struct cpufreq_policy *policy)
                 break;
 
         case 7:
-                switch (c->x86_mask) {
+                switch (c->x86_stepping) {
                 case 0:
                         longhaul_version = TYPE_LONGHAUL_V1;
                         cpu_model = CPU_SAMUEL2;
@@ -787,7 +787,7 @@ static int longhaul_cpu_init(struct cpufreq_policy *policy)
                         break;
                 case 1 ... 15:
                         longhaul_version = TYPE_LONGHAUL_V2;
-                        if (c->x86_mask < 8) {
+                        if (c->x86_stepping < 8) {
                                 cpu_model = CPU_SAMUEL2;
                                 cpuname = "C3 'Samuel 2' [C5B]";
                         } else {
@@ -814,7 +814,7 @@ static int longhaul_cpu_init(struct cpufreq_policy *policy)
                 numscales = 32;
                 memcpy(mults, nehemiah_mults, sizeof(nehemiah_mults));
                 memcpy(eblcr, nehemiah_eblcr, sizeof(nehemiah_eblcr));
-                switch (c->x86_mask) {
+                switch (c->x86_stepping) {
                 case 0 ... 1:
                         cpu_model = CPU_NEHEMIAH;
                         cpuname = "C3 'Nehemiah A' [C5XLOE]";
diff --git a/drivers/cpufreq/p4-clockmod.c b/drivers/cpufreq/p4-clockmod.c
index fd77812313f3..a25741b1281b 100644
--- a/drivers/cpufreq/p4-clockmod.c
+++ b/drivers/cpufreq/p4-clockmod.c
@@ -168,7 +168,7 @@ static int cpufreq_p4_cpu_init(struct cpufreq_policy *policy)
 #endif
 
         /* Errata workaround */
-        cpuid = (c->x86 << 8) | (c->x86_model << 4) | c->x86_mask;
+        cpuid = (c->x86 << 8) | (c->x86_model << 4) | c->x86_stepping;
         switch (cpuid) {
         case 0x0f07:
         case 0x0f0a:
diff --git a/drivers/cpufreq/powernow-k7.c b/drivers/cpufreq/powernow-k7.c
index 80ac313e6c59..302e9ce793a0 100644
--- a/drivers/cpufreq/powernow-k7.c
+++ b/drivers/cpufreq/powernow-k7.c
@@ -131,7 +131,7 @@ static int check_powernow(void)
                 return 0;
         }
 
-        if ((c->x86_model == 6) && (c->x86_mask == 0)) {
+        if ((c->x86_model == 6) && (c->x86_stepping == 0)) {
                 pr_info("K7 660[A0] core detected, enabling errata workarounds\n");
                 have_a0 = 1;
         }
diff --git a/drivers/cpufreq/speedstep-centrino.c b/drivers/cpufreq/speedstep-centrino.c
index 41bc5397f4bb..4fa5adf16c70 100644
--- a/drivers/cpufreq/speedstep-centrino.c
+++ b/drivers/cpufreq/speedstep-centrino.c
@@ -37,7 +37,7 @@ struct cpu_id
 {
         __u8    x86;            /* CPU family */
         __u8    x86_model;      /* model */
-        __u8    x86_mask;       /* stepping */
+        __u8    x86_stepping;   /* stepping */
 };
 
 enum {
@@ -277,7 +277,7 @@ static int centrino_verify_cpu_id(const struct cpuinfo_x86 *c,
 {
         if ((c->x86 == x->x86) &&
             (c->x86_model == x->x86_model) &&
-            (c->x86_mask == x->x86_mask))
+            (c->x86_stepping == x->x86_stepping))
                 return 1;
         return 0;
 }
diff --git a/drivers/cpufreq/speedstep-lib.c b/drivers/cpufreq/speedstep-lib.c
index 8085ec9000d1..e3a9962ee410 100644
--- a/drivers/cpufreq/speedstep-lib.c
+++ b/drivers/cpufreq/speedstep-lib.c
@@ -272,9 +272,9 @@ unsigned int speedstep_detect_processor(void)
                 ebx = cpuid_ebx(0x00000001);
                 ebx &= 0x000000FF;
 
-                pr_debug("ebx value is %x, x86_mask is %x\n", ebx, c->x86_mask);
+                pr_debug("ebx value is %x, x86_stepping is %x\n", ebx, c->x86_stepping);
 
-                switch (c->x86_mask) {
+                switch (c->x86_stepping) {
                 case 4:
                         /*
                          * B-stepping [M-P4-M]
@@ -361,7 +361,7 @@ unsigned int speedstep_detect_processor(void)
                                 msr_lo, msr_hi);
                 if ((msr_hi & (1<<18)) &&
                     (relaxed_check ? 1 : (msr_hi & (3<<24)))) {
-                        if (c->x86_mask == 0x01) {
+                        if (c->x86_stepping == 0x01) {
                                 pr_debug("early PIII version\n");
                                 return SPEEDSTEP_CPU_PIII_C_EARLY;
                         } else
diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
index 75d280cb2dc0..e843cf410373 100644
--- a/drivers/crypto/caam/ctrl.c
+++ b/drivers/crypto/caam/ctrl.c
@@ -228,12 +228,16 @@ static int instantiate_rng(struct device *ctrldev, int state_handle_mask,
                  * without any error (HW optimizations for later
                  * CAAM eras), then try again.
                  */
+                if (ret)
+                        break;
+
                 rdsta_val = rd_reg32(&ctrl->r4tst[0].rdsta) & RDSTA_IFMASK;
                 if ((status && status != JRSTA_SSRC_JUMP_HALT_CC) ||
-                    !(rdsta_val & (1 << sh_idx)))
+                    !(rdsta_val & (1 << sh_idx))) {
                         ret = -EAGAIN;
-                if (ret)
                         break;
+                }
+
                 dev_info(ctrldev, "Instantiated RNG4 SH%d\n", sh_idx);
                 /* Clear the contents before recreating the descriptor */
                 memset(desc, 0x00, CAAM_CMD_SZ * 7);
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index 4b6642a25df5..1c6cbda56afe 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -512,7 +512,7 @@ static int __init padlock_init(void)
 
         printk(KERN_NOTICE PFX "Using VIA PadLock ACE for AES algorithm.\n");
 
-        if (c->x86 == 6 && c->x86_model == 15 && c->x86_mask == 2) {
+        if (c->x86 == 6 && c->x86_model == 15 && c->x86_stepping == 2) {
                 ecb_fetch_blocks = MAX_ECB_FETCH_BLOCKS;
                 cbc_fetch_blocks = MAX_CBC_FETCH_BLOCKS;
                 printk(KERN_NOTICE PFX "VIA Nano stepping 2 detected: enabling workaround.\n");
diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-prng.c b/drivers/crypto/sunxi-ss/sun4i-ss-prng.c
index 0d01d1624252..63d636424161 100644
--- a/drivers/crypto/sunxi-ss/sun4i-ss-prng.c
+++ b/drivers/crypto/sunxi-ss/sun4i-ss-prng.c
@@ -28,7 +28,7 @@ int sun4i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src,
         algt = container_of(alg, struct sun4i_ss_alg_template, alg.rng);
         ss = algt->ss;
 
-        spin_lock(&ss->slock);
+        spin_lock_bh(&ss->slock);
 
         writel(mode, ss->base + SS_CTL);
 
@@ -51,6 +51,6 @@ int sun4i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src,
         }
 
         writel(0, ss->base + SS_CTL);
-        spin_unlock(&ss->slock);
-        return dlen;
+        spin_unlock_bh(&ss->slock);
+        return 0;
 }
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 9c80e0cb1664..6882fa2f8bad 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1138,6 +1138,10 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src,
         struct talitos_private *priv = dev_get_drvdata(dev);
         bool is_sec1 = has_ftr_sec1(priv);
 
+        if (!src) {
+                to_talitos_ptr(ptr, 0, 0, is_sec1);
+                return 1;
+        }
         if (sg_count == 1) {
                 to_talitos_ptr(ptr, sg_dma_address(src) + offset, len, is_sec1);
                 return sg_count;
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 8b16ec595fa7..329cb96f886f 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -3147,7 +3147,7 @@ static struct amd64_family_type *per_family_init(struct amd64_pvt *pvt)
         struct amd64_family_type *fam_type = NULL;
 
         pvt->ext_model  = boot_cpu_data.x86_model >> 4;
-        pvt->stepping   = boot_cpu_data.x86_mask;
+        pvt->stepping   = boot_cpu_data.x86_stepping;
         pvt->model      = boot_cpu_data.x86_model;
         pvt->fam        = boot_cpu_data.x86;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index e2c3c5ec42d1..c53095b3b0fb 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -568,6 +568,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
         /* HG _PR3 doesn't seem to work on this A+A weston board */
         { 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
+        { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0, 0, 0, 0, 0 },
 };
 
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index 909499b73d03..021f722e2481 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -733,6 +733,25 @@ static ssize_t intel_vgpu_rw(struct mdev_device *mdev, char *buf,
         return ret == 0 ? count : ret;
 }
 
+static bool gtt_entry(struct mdev_device *mdev, loff_t *ppos)
+{
+        struct intel_vgpu *vgpu = mdev_get_drvdata(mdev);
+        unsigned int index = VFIO_PCI_OFFSET_TO_INDEX(*ppos);
+        struct intel_gvt *gvt = vgpu->gvt;
+        int offset;
+
+        /* Only allow MMIO GGTT entry access */
+        if (index != PCI_BASE_ADDRESS_0)
+                return false;
+
+        offset = (u64)(*ppos & VFIO_PCI_OFFSET_MASK) -
+                intel_vgpu_get_bar_gpa(vgpu, PCI_BASE_ADDRESS_0);
+
+        return (offset >= gvt->device_info.gtt_start_offset &&
+                offset < gvt->device_info.gtt_start_offset + gvt_ggtt_sz(gvt)) ?
+                        true : false;
+}
+
 static ssize_t intel_vgpu_read(struct mdev_device *mdev, char __user *buf,
                         size_t count, loff_t *ppos)
 {
@@ -742,7 +761,21 @@ static ssize_t intel_vgpu_read(struct mdev_device *mdev, char __user *buf,
         while (count) {
                 size_t filled;
 
-                if (count >= 4 && !(*ppos % 4)) {
+                /* Only support GGTT entry 8 bytes read */
+                if (count >= 8 && !(*ppos % 8) &&
+                        gtt_entry(mdev, ppos)) {
+                        u64 val;
+
+                        ret = intel_vgpu_rw(mdev, (char *)&val, sizeof(val),
+                                        ppos, false);
+                        if (ret <= 0)
+                                goto read_err;
+
+                        if (copy_to_user(buf, &val, sizeof(val)))
+                                goto read_err;
+
+                        filled = 8;
+                } else if (count >= 4 && !(*ppos % 4)) {
                         u32 val;
 
                         ret = intel_vgpu_rw(mdev, (char *)&val, sizeof(val),
@@ -802,7 +835,21 @@ static ssize_t intel_vgpu_write(struct mdev_device *mdev,
         while (count) {
                 size_t filled;
 
-                if (count >= 4 && !(*ppos % 4)) {
+                /* Only support GGTT entry 8 bytes write */
+                if (count >= 8 && !(*ppos % 8) &&
+                        gtt_entry(mdev, ppos)) {
+                        u64 val;
+
+                        if (copy_from_user(&val, buf, sizeof(val)))
+                                goto write_err;
+
+                        ret = intel_vgpu_rw(mdev, (char *)&val, sizeof(val),
+                                        ppos, true);
+                        if (ret <= 0)
+                                goto write_err;
+
+                        filled = 8;
+                } else if (count >= 4 && !(*ppos % 4)) {
                         u32 val;
 
                         if (copy_from_user(&val, buf, sizeof(val)))
diff --git a/drivers/gpu/drm/i915/gvt/mmio_context.c b/drivers/gpu/drm/i915/gvt/mmio_context.c
index 73ad6e90e49d..256f1bb522b7 100644
--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
+++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
@@ -118,6 +118,7 @@ static struct engine_mmio gen9_engine_mmio_list[] __cacheline_aligned = {
         {RCS, HALF_SLICE_CHICKEN3, 0xffff, true}, /* 0xe184 */
         {RCS, GEN9_HALF_SLICE_CHICKEN5, 0xffff, true}, /* 0xe188 */
         {RCS, GEN9_HALF_SLICE_CHICKEN7, 0xffff, true}, /* 0xe194 */
+        {RCS, GEN8_ROW_CHICKEN, 0xffff, true}, /* 0xe4f0 */
         {RCS, TRVATTL3PTRDW(0), 0, false}, /* 0x4de0 */
         {RCS, TRVATTL3PTRDW(1), 0, false}, /* 0x4de4 */
         {RCS, TRNULLDETCT, 0, false}, /* 0x4de8 */
diff --git a/drivers/gpu/drm/i915/gvt/trace.h b/drivers/gpu/drm/i915/gvt/trace.h
index 7a2511538f34..736bd2bc5127 100644
--- a/drivers/gpu/drm/i915/gvt/trace.h
+++ b/drivers/gpu/drm/i915/gvt/trace.h
@@ -333,7 +333,7 @@ TRACE_EVENT(render_mmio,
         TP_PROTO(int old_id, int new_id, char *action, unsigned int reg,
                  unsigned int old_val, unsigned int new_val),
 
-        TP_ARGS(old_id, new_id, action, reg, new_val, old_val),
+        TP_ARGS(old_id, new_id, action, reg, old_val, new_val),
 
         TP_STRUCT__entry(
                 __field(int, old_id)
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 173d0095e3b2..2f5209de0391 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1433,19 +1433,7 @@ void i915_driver_unload(struct drm_device *dev)
 
         intel_modeset_cleanup(dev);
 
-        /*
-         * free the memory space allocated for the child device
-         * config parsed from VBT
-         */
-        if (dev_priv->vbt.child_dev && dev_priv->vbt.child_dev_num) {
-                kfree(dev_priv->vbt.child_dev);
-                dev_priv->vbt.child_dev = NULL;
-                dev_priv->vbt.child_dev_num = 0;
-        }
-        kfree(dev_priv->vbt.sdvo_lvds_vbt_mode);
-        dev_priv->vbt.sdvo_lvds_vbt_mode = NULL;
-        kfree(dev_priv->vbt.lfp_lvds_vbt_mode);
-        dev_priv->vbt.lfp_lvds_vbt_mode = NULL;
+        intel_bios_cleanup(dev_priv);
 
         vga_switcheroo_unregister_client(pdev);
         vga_client_register(pdev, NULL, NULL, NULL);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index a42deebedb0f..d307429a5ae0 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1349,6 +1349,7 @@ struct intel_vbt_data {
                 u32 size;
                 u8 *data;
                 const u8 *sequence[MIPI_SEQ_MAX];
+                u8 *deassert_seq; /* Used by fixup_mipi_sequences() */
         } dsi;
 
         int crt_ddc_pin;
@@ -3657,6 +3658,7 @@ extern void intel_i2c_reset(struct drm_i915_private *dev_priv);
 
 /* intel_bios.c */
 void intel_bios_init(struct drm_i915_private *dev_priv);
+void intel_bios_cleanup(struct drm_i915_private *dev_priv);
 bool intel_bios_is_valid_vbt(const void *buf, size_t size);
 bool intel_bios_is_tv_present(struct drm_i915_private *dev_priv);
 bool intel_bios_is_lvds_present(struct drm_i915_private *dev_priv, u8 *i2c_pin);
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 648e7536ff51..0c963fcf31ff 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -803,7 +803,7 @@ int i915_gem_context_setparam_ioctl(struct drm_device *dev, void *data,
 
         case I915_CONTEXT_PARAM_PRIORITY:
                 {
-                        int priority = args->value;
+                        s64 priority = args->value;
 
                         if (args->size)
                                 ret = -EINVAL;
diff --git a/drivers/gpu/drm/i915/i915_oa_cflgt3.c b/drivers/gpu/drm/i915/i915_oa_cflgt3.c
index 42ff06fe54a3..792facdb6702 100644
--- a/drivers/gpu/drm/i915/i915_oa_cflgt3.c
+++ b/drivers/gpu/drm/i915/i915_oa_cflgt3.c
@@ -84,9 +84,9 @@ show_test_oa_id(struct device *kdev, struct device_attribute *attr, char *buf)
 void
 i915_perf_load_test_config_cflgt3(struct drm_i915_private *dev_priv)
 {
-        strncpy(dev_priv->perf.oa.test_config.uuid,
+        strlcpy(dev_priv->perf.oa.test_config.uuid,
                 "577e8e2c-3fa0-4875-8743-3538d585e3b0",
-                UUID_STRING_LEN);
+                sizeof(dev_priv->perf.oa.test_config.uuid));
         dev_priv->perf.oa.test_config.id = 1;
 
         dev_priv->perf.oa.test_config.mux_regs = mux_config_test_oa;
diff --git a/drivers/gpu/drm/i915/i915_oa_cnl.c b/drivers/gpu/drm/i915/i915_oa_cnl.c
index ff0ac3627cc4..ba9140c87cc0 100644
--- a/drivers/gpu/drm/i915/i915_oa_cnl.c
+++ b/drivers/gpu/drm/i915/i915_oa_cnl.c
@@ -96,9 +96,9 @@ show_test_oa_id(struct device *kdev, struct device_attribute *attr, char *buf)
 void
 i915_perf_load_test_config_cnl(struct drm_i915_private *dev_priv)
 {
-        strncpy(dev_priv->perf.oa.test_config.uuid,
+        strlcpy(dev_priv->perf.oa.test_config.uuid,
                 "db41edd4-d8e7-4730-ad11-b9a2d6833503",
-                UUID_STRING_LEN);
+                sizeof(dev_priv->perf.oa.test_config.uuid));
         dev_priv->perf.oa.test_config.id = 1;
 
         dev_priv->perf.oa.test_config.mux_regs = mux_config_test_oa;
diff --git a/drivers/gpu/drm/i915/i915_pmu.c b/drivers/gpu/drm/i915/i915_pmu.c
index 55a8a1e29424..0e9b98c32b62 100644
--- a/drivers/gpu/drm/i915/i915_pmu.c
+++ b/drivers/gpu/drm/i915/i915_pmu.c
@@ -285,26 +285,41 @@ static u64 count_interrupts(struct drm_i915_private *i915)
         return sum;
 }
 
-static void i915_pmu_event_destroy(struct perf_event *event)
+static void engine_event_destroy(struct perf_event *event)
 {
-        WARN_ON(event->parent);
+        struct drm_i915_private *i915 =
+                container_of(event->pmu, typeof(*i915), pmu.base);
+        struct intel_engine_cs *engine;
+
+        engine = intel_engine_lookup_user(i915,
+                                          engine_event_class(event),
+                                          engine_event_instance(event));
+        if (WARN_ON_ONCE(!engine))
+                return;
+
+        if (engine_event_sample(event) == I915_SAMPLE_BUSY &&
+            intel_engine_supports_stats(engine))
+                intel_disable_engine_stats(engine);
 }
 
-static int engine_event_init(struct perf_event *event)
+static void i915_pmu_event_destroy(struct perf_event *event)
 {
-        struct drm_i915_private *i915 =
-                container_of(event->pmu, typeof(*i915), pmu.base);
+        WARN_ON(event->parent);
 
-        if (!intel_engine_lookup_user(i915, engine_event_class(event),
-                                      engine_event_instance(event)))
-                return -ENODEV;
+        if (is_engine_event(event))
+                engine_event_destroy(event);
+}
 
-        switch (engine_event_sample(event)) {
+static int
+engine_event_status(struct intel_engine_cs *engine,
+                    enum drm_i915_pmu_engine_sample sample)
+{
+        switch (sample) {
         case I915_SAMPLE_BUSY:
         case I915_SAMPLE_WAIT:
                 break;
         case I915_SAMPLE_SEMA:
-                if (INTEL_GEN(i915) < 6)
+                if (INTEL_GEN(engine->i915) < 6)
                         return -ENODEV;
                 break;
         default:
@@ -314,6 +329,30 @@ static int engine_event_init(struct perf_event *event)
         return 0;
 }
 
+static int engine_event_init(struct perf_event *event)
+{
+        struct drm_i915_private *i915 =
+                container_of(event->pmu, typeof(*i915), pmu.base);
+        struct intel_engine_cs *engine;
+        u8 sample;
+        int ret;
+
+        engine = intel_engine_lookup_user(i915, engine_event_class(event),
+                                          engine_event_instance(event));
+        if (!engine)
+                return -ENODEV;
+
+        sample = engine_event_sample(event);
+        ret = engine_event_status(engine, sample);
+        if (ret)
+                return ret;
+
+        if (sample == I915_SAMPLE_BUSY && intel_engine_supports_stats(engine))
+                ret = intel_enable_engine_stats(engine);
+
+        return ret;
+}
+
 static int i915_pmu_event_init(struct perf_event *event)
 {
         struct drm_i915_private *i915 =
@@ -370,7 +409,94 @@ static int i915_pmu_event_init(struct perf_event *event)
         return 0;
 }
 
-static u64 __i915_pmu_event_read(struct perf_event *event)
+static u64 __get_rc6(struct drm_i915_private *i915)
+{
+        u64 val;
+
+        val = intel_rc6_residency_ns(i915,
+                                     IS_VALLEYVIEW(i915) ?
+                                     VLV_GT_RENDER_RC6 :
+                                     GEN6_GT_GFX_RC6);
+
+        if (HAS_RC6p(i915))
+                val += intel_rc6_residency_ns(i915, GEN6_GT_GFX_RC6p);
+
+        if (HAS_RC6pp(i915))
+                val += intel_rc6_residency_ns(i915, GEN6_GT_GFX_RC6pp);
+
+        return val;
+}
+
+static u64 get_rc6(struct drm_i915_private *i915, bool locked)
+{
+#if IS_ENABLED(CONFIG_PM)
+        unsigned long flags;
+        u64 val;
+
+        if (intel_runtime_pm_get_if_in_use(i915)) {
+                val = __get_rc6(i915);
+                intel_runtime_pm_put(i915);
+
+                /*
+                 * If we are coming back from being runtime suspended we must
+                 * be careful not to report a larger value than returned
+                 * previously.
+                 */
+
+                if (!locked)
+                        spin_lock_irqsave(&i915->pmu.lock, flags);
+
+                if (val >= i915->pmu.sample[__I915_SAMPLE_RC6_ESTIMATED].cur) {
+                        i915->pmu.sample[__I915_SAMPLE_RC6_ESTIMATED].cur = 0;
+                        i915->pmu.sample[__I915_SAMPLE_RC6].cur = val;
+                } else {
+                        val = i915->pmu.sample[__I915_SAMPLE_RC6_ESTIMATED].cur;
+                }
+
+                if (!locked)
+                        spin_unlock_irqrestore(&i915->pmu.lock, flags);
+        } else {
+                struct pci_dev *pdev = i915->drm.pdev;
+                struct device *kdev = &pdev->dev;
+                unsigned long flags2;
+
+                /*
+                 * We are runtime suspended.
+                 *
+                 * Report the delta from when the device was suspended to now,
+                 * on top of the last known real value, as the approximated RC6
+                 * counter value.
+                 */
+                if (!locked)
+                        spin_lock_irqsave(&i915->pmu.lock, flags);
+
+                spin_lock_irqsave(&kdev->power.lock, flags2);
+
+                if (!i915->pmu.sample[__I915_SAMPLE_RC6_ESTIMATED].cur)
+                        i915->pmu.suspended_jiffies_last =
+                                                kdev->power.suspended_jiffies;
+
+                val = kdev->power.suspended_jiffies -
+                      i915->pmu.suspended_jiffies_last;
+                val += jiffies - kdev->power.accounting_timestamp;
+
+                spin_unlock_irqrestore(&kdev->power.lock, flags2);
+
+                val = jiffies_to_nsecs(val);
+                val += i915->pmu.sample[__I915_SAMPLE_RC6].cur;
+                i915->pmu.sample[__I915_SAMPLE_RC6_ESTIMATED].cur = val;
+
+                if (!locked)
+                        spin_unlock_irqrestore(&i915->pmu.lock, flags);
+        }
+
+        return val;
+#else
+        return __get_rc6(i915);
+#endif
+}
+
+static u64 __i915_pmu_event_read(struct perf_event *event, bool locked)
 {
         struct drm_i915_private *i915 =
                 container_of(event->pmu, typeof(*i915), pmu.base);
@@ -387,7 +513,7 @@ static u64 __i915_pmu_event_read(struct perf_event *event)
                 if (WARN_ON_ONCE(!engine)) {
                         /* Do nothing */
                 } else if (sample == I915_SAMPLE_BUSY &&
-                           engine->pmu.busy_stats) {
+                           intel_engine_supports_stats(engine)) {
                         val = ktime_to_ns(intel_engine_get_busy_time(engine));
                 } else {
                         val = engine->pmu.sample[sample].cur;
@@ -408,18 +534,7 @@ static u64 __i915_pmu_event_read(struct perf_event *event)
                         val = count_interrupts(i915);
                         break;
                 case I915_PMU_RC6_RESIDENCY:
-                        intel_runtime_pm_get(i915);
-                        val = intel_rc6_residency_ns(i915,
-                                                     IS_VALLEYVIEW(i915) ?
-                                                     VLV_GT_RENDER_RC6 :
-                                                     GEN6_GT_GFX_RC6);
-                        if (HAS_RC6p(i915))
-                                val += intel_rc6_residency_ns(i915,
-                                                              GEN6_GT_GFX_RC6p);
-                        if (HAS_RC6pp(i915))
-                                val += intel_rc6_residency_ns(i915,
-                                                              GEN6_GT_GFX_RC6pp);
-                        intel_runtime_pm_put(i915);
+                        val = get_rc6(i915, locked);
                         break;
                 }
         }
@@ -434,7 +549,7 @@ static void i915_pmu_event_read(struct perf_event *event)
 
 again:
         prev = local64_read(&hwc->prev_count);
-        new = __i915_pmu_event_read(event);
+        new = __i915_pmu_event_read(event, false);
 
         if (local64_cmpxchg(&hwc->prev_count, prev, new) != prev)
                 goto again;
@@ -442,12 +557,6 @@ again:
         local64_add(new - prev, &event->count);
 }
 
-static bool engine_needs_busy_stats(struct intel_engine_cs *engine)
-{
-        return intel_engine_supports_stats(engine) &&
-               (engine->pmu.enable & BIT(I915_SAMPLE_BUSY));
-}
-
 static void i915_pmu_enable(struct perf_event *event)
 {
         struct drm_i915_private *i915 =
@@ -487,21 +596,7 @@ static void i915_pmu_enable(struct perf_event *event)
 
                 GEM_BUG_ON(sample >= I915_PMU_SAMPLE_BITS);
                 GEM_BUG_ON(engine->pmu.enable_count[sample] == ~0);
-                if (engine->pmu.enable_count[sample]++ == 0) {
-                        /*
-                         * Enable engine busy stats tracking if needed or
-                         * alternatively cancel the scheduled disable.
-                         *
-                         * If the delayed disable was pending, cancel it and
-                         * in this case do not enable since it already is.
-                         */
-                        if (engine_needs_busy_stats(engine) &&
-                            !engine->pmu.busy_stats) {
-                                engine->pmu.busy_stats = true;
-                                if (!cancel_delayed_work(&engine->pmu.disable_busy_stats))
-                                        intel_enable_engine_stats(engine);
-                        }
-                }
+                engine->pmu.enable_count[sample]++;
         }
 
         /*
@@ -509,19 +604,11 @@ static void i915_pmu_enable(struct perf_event *event)
          * for all listeners. Even when the event was already enabled and has
          * an existing non-zero value.
          */
-        local64_set(&event->hw.prev_count, __i915_pmu_event_read(event));
+        local64_set(&event->hw.prev_count, __i915_pmu_event_read(event, true));
 
         spin_unlock_irqrestore(&i915->pmu.lock, flags);
 }
 
-static void __disable_busy_stats(struct work_struct *work)
-{
-        struct intel_engine_cs *engine =
-               container_of(work, typeof(*engine), pmu.disable_busy_stats.work);
-
-        intel_disable_engine_stats(engine);
-}
-
 static void i915_pmu_disable(struct perf_event *event)
 {
         struct drm_i915_private *i915 =
@@ -545,26 +632,8 @@ static void i915_pmu_disable(struct perf_event *event)
                  * Decrement the reference count and clear the enabled
                  * bitmask when the last listener on an event goes away.
                  */
-                if (--engine->pmu.enable_count[sample] == 0) {
+                if (--engine->pmu.enable_count[sample] == 0)
                         engine->pmu.enable &= ~BIT(sample);
-                        if (!engine_needs_busy_stats(engine) &&
-                            engine->pmu.busy_stats) {
-                                engine->pmu.busy_stats = false;
-                                /*
-                                 * We request a delayed disable to handle the
-                                 * rapid on/off cycles on events, which can
-                                 * happen when tools like perf stat start, in a
-                                 * nicer way.
-                                 *
-                                 * In addition, this also helps with busy stats
-                                 * accuracy with background CPU offline/online
-                                 * migration events.
-                                 */
-                                queue_delayed_work(system_wq,
-                                                   &engine->pmu.disable_busy_stats,
-                                                   round_jiffies_up_relative(HZ));
-                        }
-                }
         }
 
         GEM_BUG_ON(bit >= I915_PMU_MASK_BITS);
@@ -797,8 +866,6 @@ static void i915_pmu_unregister_cpuhp_state(struct drm_i915_private *i915)
 
 void i915_pmu_register(struct drm_i915_private *i915)
 {
-        struct intel_engine_cs *engine;
-        enum intel_engine_id id;
         int ret;
 
         if (INTEL_GEN(i915) <= 2) {
@@ -820,10 +887,6 @@ void i915_pmu_register(struct drm_i915_private *i915)
         hrtimer_init(&i915->pmu.timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
         i915->pmu.timer.function = i915_sample;
 
-        for_each_engine(engine, i915, id)
-                INIT_DELAYED_WORK(&engine->pmu.disable_busy_stats,
-                                  __disable_busy_stats);
-
         ret = perf_pmu_register(&i915->pmu.base, "i915", -1);
         if (ret)
                 goto err;
@@ -843,9 +906,6 @@ err:
 
 void i915_pmu_unregister(struct drm_i915_private *i915)
 {
-        struct intel_engine_cs *engine;
-        enum intel_engine_id id;
-
         if (!i915->pmu.base.event_init)
                 return;
 
@@ -853,11 +913,6 @@ void i915_pmu_unregister(struct drm_i915_private *i915)
 
         hrtimer_cancel(&i915->pmu.timer);
 
-        for_each_engine(engine, i915, id) {
-                GEM_BUG_ON(engine->pmu.busy_stats);
-                flush_delayed_work(&engine->pmu.disable_busy_stats);
-        }
-
         i915_pmu_unregister_cpuhp_state(i915);
 
         perf_pmu_unregister(&i915->pmu.base);
diff --git a/drivers/gpu/drm/i915/i915_pmu.h b/drivers/gpu/drm/i915/i915_pmu.h
index 40c154d13565..bb62df15afa4 100644
--- a/drivers/gpu/drm/i915/i915_pmu.h
+++ b/drivers/gpu/drm/i915/i915_pmu.h
@@ -27,6 +27,8 @@
 enum {
         __I915_SAMPLE_FREQ_ACT = 0,
         __I915_SAMPLE_FREQ_REQ,
+        __I915_SAMPLE_RC6,
+        __I915_SAMPLE_RC6_ESTIMATED,
         __I915_NUM_PMU_SAMPLERS
 };
 
@@ -94,6 +96,10 @@ struct i915_pmu {
          * struct intel_engine_cs.
          */
         struct i915_pmu_sample sample[__I915_NUM_PMU_SAMPLERS];
+        /**
+         * @suspended_jiffies_last: Cached suspend time from PM core.
+         */
+        unsigned long suspended_jiffies_last;
 };
 
 #ifdef CONFIG_PERF_EVENTS
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index f7f771749e48..b49a2df44430 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -947,6 +947,86 @@ static int goto_next_sequence_v3(const u8 *data, int index, int total)
         return 0;
 }
 
+/*
+ * Get len of pre-fixed deassert fragment from a v1 init OTP sequence,
+ * skip all delay + gpio operands and stop at the first DSI packet op.
+ */
+static int get_init_otp_deassert_fragment_len(struct drm_i915_private *dev_priv)
+{
+        const u8 *data = dev_priv->vbt.dsi.sequence[MIPI_SEQ_INIT_OTP];
+        int index, len;
+
+        if (WARN_ON(!data || dev_priv->vbt.dsi.seq_version != 1))
+                return 0;
+
+        /* index = 1 to skip sequence byte */
+        for (index = 1; data[index] != MIPI_SEQ_ELEM_END; index += len) {
+                switch (data[index]) {
+                case MIPI_SEQ_ELEM_SEND_PKT:
+                        return index == 1 ? 0 : index;
+                case MIPI_SEQ_ELEM_DELAY:
+                        len = 5; /* 1 byte for operand + uint32 */
+                        break;
+                case MIPI_SEQ_ELEM_GPIO:
+                        len = 3; /* 1 byte for op, 1 for gpio_nr, 1 for value */
+                        break;
+                default:
+                        return 0;
+                }
+        }
+
+        return 0;
+}
+
+/*
+ * Some v1 VBT MIPI sequences do the deassert in the init OTP sequence.
+ * The deassert must be done before calling intel_dsi_device_ready, so for
+ * these devices we split the init OTP sequence into a deassert sequence and
+ * the actual init OTP part.
+ */
+static void fixup_mipi_sequences(struct drm_i915_private *dev_priv)
+{
+        u8 *init_otp;
+        int len;
+
+        /* Limit this to VLV for now. */
+        if (!IS_VALLEYVIEW(dev_priv))
+                return;
+
+        /* Limit this to v1 vid-mode sequences */
+        if (dev_priv->vbt.dsi.config->is_cmd_mode ||
+            dev_priv->vbt.dsi.seq_version != 1)
+                return;
+
+        /* Only do this if there are otp and assert seqs and no deassert seq */
+        if (!dev_priv->vbt.dsi.sequence[MIPI_SEQ_INIT_OTP] ||
+            !dev_priv->vbt.dsi.sequence[MIPI_SEQ_ASSERT_RESET] ||
+            dev_priv->vbt.dsi.sequence[MIPI_SEQ_DEASSERT_RESET])
+                return;
+
+        /* The deassert-sequence ends at the first DSI packet */
+        len = get_init_otp_deassert_fragment_len(dev_priv);
+        if (!len)
+                return;
+
+        DRM_DEBUG_KMS("Using init OTP fragment to deassert reset\n");
+
+        /* Copy the fragment, update seq byte and terminate it */
+        init_otp = (u8 *)dev_priv->vbt.dsi.sequence[MIPI_SEQ_INIT_OTP];
+        dev_priv->vbt.dsi.deassert_seq = kmemdup(init_otp, len + 1, GFP_KERNEL);
+        if (!dev_priv->vbt.dsi.deassert_seq)
+                return;
+        dev_priv->vbt.dsi.deassert_seq[0] = MIPI_SEQ_DEASSERT_RESET;
+        dev_priv->vbt.dsi.deassert_seq[len] = MIPI_SEQ_ELEM_END;
+        /* Use the copy for deassert */
+        dev_priv->vbt.dsi.sequence[MIPI_SEQ_DEASSERT_RESET] =
+                dev_priv->vbt.dsi.deassert_seq;
+        /* Replace the last byte of the fragment with init OTP seq byte */
+        init_otp[len - 1] = MIPI_SEQ_INIT_OTP;
+        /* And make MIPI_MIPI_SEQ_INIT_OTP point to it */
+        dev_priv->vbt.dsi.sequence[MIPI_SEQ_INIT_OTP] = init_otp + len - 1;
+}
+
 static void
 parse_mipi_sequence(struct drm_i915_private *dev_priv,
                     const struct bdb_header *bdb)
@@ -1016,6 +1096,8 @@ parse_mipi_sequence(struct drm_i915_private *dev_priv,
         dev_priv->vbt.dsi.size = seq_size;
         dev_priv->vbt.dsi.seq_version = sequence->version;
 
+        fixup_mipi_sequences(dev_priv);
+
         DRM_DEBUG_DRIVER("MIPI related VBT parsing complete\n");
         return;
 
@@ -1589,6 +1671,29 @@ out:
 }
 
 /**
+ * intel_bios_cleanup - Free any resources allocated by intel_bios_init()
+ * @dev_priv: i915 device instance
+ */
+void intel_bios_cleanup(struct drm_i915_private *dev_priv)
+{
+        kfree(dev_priv->vbt.child_dev);
+        dev_priv->vbt.child_dev = NULL;
+        dev_priv->vbt.child_dev_num = 0;
+        kfree(dev_priv->vbt.sdvo_lvds_vbt_mode);
+        dev_priv->vbt.sdvo_lvds_vbt_mode = NULL;
+        kfree(dev_priv->vbt.lfp_lvds_vbt_mode);
+        dev_priv->vbt.lfp_lvds_vbt_mode = NULL;
+        kfree(dev_priv->vbt.dsi.data);
+        dev_priv->vbt.dsi.data = NULL;
+        kfree(dev_priv->vbt.dsi.pps);
+        dev_priv->vbt.dsi.pps = NULL;
+        kfree(dev_priv->vbt.dsi.config);
+        dev_priv->vbt.dsi.config = NULL;
+        kfree(dev_priv->vbt.dsi.deassert_seq);
+        dev_priv->vbt.dsi.deassert_seq = NULL;
+}
+
+/**
  * intel_bios_is_tv_present - is integrated TV present in VBT
  * @dev_priv:   i915 device instance
  *
diff --git a/drivers/gpu/drm/i915/intel_breadcrumbs.c b/drivers/gpu/drm/i915/intel_breadcrumbs.c
index bd40fea16b4f..f54ddda9fdad 100644
--- a/drivers/gpu/drm/i915/intel_breadcrumbs.c
+++ b/drivers/gpu/drm/i915/intel_breadcrumbs.c
@@ -594,29 +594,16 @@ void intel_engine_remove_wait(struct intel_engine_cs *engine,
         spin_unlock_irq(&b->rb_lock);
 }
 
-static bool signal_valid(const struct drm_i915_gem_request *request)
-{
-        return intel_wait_check_request(&request->signaling.wait, request);
-}
-
 static bool signal_complete(const struct drm_i915_gem_request *request)
 {
         if (!request)
                 return false;
 
-        /* If another process served as the bottom-half it may have already
-         * signalled that this wait is already completed.
-         */
-        if (intel_wait_complete(&request->signaling.wait))
-                return signal_valid(request);
-
-        /* Carefully check if the request is complete, giving time for the
+        /*
+         * Carefully check if the request is complete, giving time for the
          * seqno to be visible or if the GPU hung.
          */
-        if (__i915_request_irq_complete(request))
-                return true;
-
-        return false;
+        return __i915_request_irq_complete(request);
 }
 
 static struct drm_i915_gem_request *to_signaler(struct rb_node *rb)
@@ -659,9 +646,13 @@ static int intel_breadcrumbs_signaler(void *arg)
                         request = i915_gem_request_get_rcu(request);
                 rcu_read_unlock();
                 if (signal_complete(request)) {
-                        local_bh_disable();
-                        dma_fence_signal(&request->fence);
-                        local_bh_enable(); /* kick start the tasklets */
+                        if (!test_bit(DMA_FENCE_FLAG_SIGNALED_BIT,
+                                      &request->fence.flags)) {
+                                local_bh_disable();
+                                dma_fence_signal(&request->fence);
+                                GEM_BUG_ON(!i915_gem_request_completed(request));
+                                local_bh_enable(); /* kick start the tasklets */
+                        }
 
                         spin_lock_irq(&b->rb_lock);
 
diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c
index 5dc118f26b51..1704c8897afd 100644
--- a/drivers/gpu/drm/i915/intel_cdclk.c
+++ b/drivers/gpu/drm/i915/intel_cdclk.c
@@ -1952,6 +1952,14 @@ int intel_crtc_compute_min_cdclk(const struct intel_crtc_state *crtc_state)
         if (crtc_state->has_audio && INTEL_GEN(dev_priv) >= 9)
                 min_cdclk = max(2 * 96000, min_cdclk);
 
+        /*
+         * On Valleyview some DSI panels lose (v|h)sync when the clock is lower
+         * than 320000KHz.
+         */
+        if (intel_crtc_has_type(crtc_state, INTEL_OUTPUT_DSI) &&
+            IS_VALLEYVIEW(dev_priv))
+                min_cdclk = max(320000, min_cdclk);
+
         if (min_cdclk > dev_priv->max_cdclk_freq) {
                 DRM_DEBUG_KMS("required cdclk (%d kHz) exceeds max (%d kHz)\n",
                               min_cdclk, dev_priv->max_cdclk_freq);
diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index d790bdc227ff..fa960cfd2764 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -1458,7 +1458,9 @@ static bool ring_is_idle(struct intel_engine_cs *engine)
         struct drm_i915_private *dev_priv = engine->i915;
         bool idle = true;
 
-        intel_runtime_pm_get(dev_priv);
+        /* If the whole device is asleep, the engine must be idle */
+        if (!intel_runtime_pm_get_if_in_use(dev_priv))
+                return true;
 
         /* First check that no commands are left in the ring */
         if ((I915_READ_HEAD(engine) & HEAD_ADDR) !=
@@ -1943,16 +1945,22 @@ intel_engine_lookup_user(struct drm_i915_private *i915, u8 class, u8 instance)
  */
 int intel_enable_engine_stats(struct intel_engine_cs *engine)
 {
+        struct intel_engine_execlists *execlists = &engine->execlists;
         unsigned long flags;
+        int err = 0;
 
         if (!intel_engine_supports_stats(engine))
                 return -ENODEV;
 
+        tasklet_disable(&execlists->tasklet);
         spin_lock_irqsave(&engine->stats.lock, flags);
-        if (engine->stats.enabled == ~0)
-                goto busy;
+
+        if (unlikely(engine->stats.enabled == ~0)) {
+                err = -EBUSY;
+                goto unlock;
+        }
+
         if (engine->stats.enabled++ == 0) {
-                struct intel_engine_execlists *execlists = &engine->execlists;
                 const struct execlist_port *port = execlists->port;
                 unsigned int num_ports = execlists_num_ports(execlists);
 
@@ -1967,14 +1975,12 @@ int intel_enable_engine_stats(struct intel_engine_cs *engine)
                 if (engine->stats.active)
                         engine->stats.start = engine->stats.enabled_at;
         }
-        spin_unlock_irqrestore(&engine->stats.lock, flags);
-
-        return 0;
 
-busy:
+unlock:
         spin_unlock_irqrestore(&engine->stats.lock, flags);
+        tasklet_enable(&execlists->tasklet);
 
-        return -EBUSY;
+        return err;
 }
 
 static ktime_t __intel_engine_get_busy_time(struct intel_engine_cs *engine)
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index c5ff203e42d6..a0e7a6c2a57c 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -366,20 +366,6 @@ struct intel_engine_cs {
                  */
 #define I915_ENGINE_SAMPLE_MAX (I915_SAMPLE_SEMA + 1)
                 struct i915_pmu_sample sample[I915_ENGINE_SAMPLE_MAX];
-                /**
-                 * @busy_stats: Has enablement of engine stats tracking been
-                 *              requested.
-                 */
-                bool busy_stats;
-                /**
-                 * @disable_busy_stats: Work item for busy stats disabling.
-                 *
-                 * Same as with @enable_busy_stats action, with the difference
-                 * that we delay it in case there are rapid enable-disable
-                 * actions, which can happen during tool startup (like perf
-                 * stat).
-                 */
-                struct delayed_work disable_busy_stats;
         } pmu;
 
         /*
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
index bf62303571b3..3695cde669f8 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
@@ -301,7 +301,7 @@ nvkm_therm_attr_set(struct nvkm_therm *therm,
 void
 nvkm_therm_clkgate_enable(struct nvkm_therm *therm)
 {
-        if (!therm->func->clkgate_enable || !therm->clkgating_enabled)
+        if (!therm || !therm->func->clkgate_enable || !therm->clkgating_enabled)
                 return;
 
         nvkm_debug(&therm->subdev,
@@ -312,7 +312,7 @@ nvkm_therm_clkgate_enable(struct nvkm_therm *therm)
 void
 nvkm_therm_clkgate_fini(struct nvkm_therm *therm, bool suspend)
 {
-        if (!therm->func->clkgate_fini || !therm->clkgating_enabled)
+        if (!therm || !therm->func->clkgate_fini || !therm->clkgating_enabled)
                 return;
 
         nvkm_debug(&therm->subdev,
@@ -395,7 +395,7 @@ void
 nvkm_therm_clkgate_init(struct nvkm_therm *therm,
                         const struct nvkm_therm_clkgate_pack *p)
 {
-        if (!therm->func->clkgate_init || !therm->clkgating_enabled)
+        if (!therm || !therm->func->clkgate_init || !therm->clkgating_enabled)
                 return;
 
         therm->func->clkgate_init(therm, p);
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 4bdbf77f7197..72c338eb5fae 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -269,13 +269,13 @@ static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
         for (i = 0; i < ARRAY_SIZE(tjmax_model_table); i++) {
                 const struct tjmax_model *tm = &tjmax_model_table[i];
                 if (c->x86_model == tm->model &&
-                    (tm->mask == ANY || c->x86_mask == tm->mask))
+                    (tm->mask == ANY || c->x86_stepping == tm->mask))
                         return tm->tjmax;
         }
 
         /* Early chips have no MSR for TjMax */
 
-        if (c->x86_model == 0xf && c->x86_mask < 4)
+        if (c->x86_model == 0xf && c->x86_stepping < 4)
                 usemsr_ee = 0;
 
         if (c->x86_model > 0xe && usemsr_ee) {
@@ -426,7 +426,7 @@ static int chk_ucode_version(unsigned int cpu)
          * Readings might stop update when processor visited too deep sleep,
          * fixed for stepping D0 (6EC).
          */
-        if (c->x86_model == 0xe && c->x86_mask < 0xc && c->microcode < 0x39) {
+        if (c->x86_model == 0xe && c->x86_stepping < 0xc && c->microcode < 0x39) {
                 pr_err("Errata AE18 not fixed, update BIOS or microcode of the CPU!\n");
                 return -ENODEV;
         }
diff --git a/drivers/hwmon/hwmon-vid.c b/drivers/hwmon/hwmon-vid.c
index ef91b8a67549..84e91286fc4f 100644
--- a/drivers/hwmon/hwmon-vid.c
+++ b/drivers/hwmon/hwmon-vid.c
@@ -293,7 +293,7 @@ u8 vid_which_vrm(void)
         if (c->x86 < 6)         /* Any CPU with family lower than 6 */
                 return 0;       /* doesn't have VID */
 
-        vrm_ret = find_vrm(c->x86, c->x86_model, c->x86_mask, c->x86_vendor);
+        vrm_ret = find_vrm(c->x86, c->x86_model, c->x86_stepping, c->x86_vendor);
         if (vrm_ret == 134)
                 vrm_ret = get_via_model_d_vrm();
         if (vrm_ret == 0)
diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
index 06b4e1c78bd8..051a72eecb24 100644
--- a/drivers/hwmon/k10temp.c
+++ b/drivers/hwmon/k10temp.c
@@ -129,7 +129,10 @@ static ssize_t temp1_input_show(struct device *dev,
 
         data->read_tempreg(data->pdev, &regval);
         temp = (regval >> 21) * 125;
-        temp -= data->temp_offset;
+        if (temp > data->temp_offset)
+                temp -= data->temp_offset;
+        else
+                temp = 0;
 
         return sprintf(buf, "%u\n", temp);
 }
@@ -227,7 +230,7 @@ static bool has_erratum_319(struct pci_dev *pdev)
          * and AM3 formats, but that's the best we can do.
          */
         return boot_cpu_data.x86_model < 4 ||
-               (boot_cpu_data.x86_model == 4 && boot_cpu_data.x86_mask <= 2);
+               (boot_cpu_data.x86_model == 4 && boot_cpu_data.x86_stepping <= 2);
 }
 
 static int k10temp_probe(struct pci_dev *pdev,
diff --git a/drivers/hwmon/k8temp.c b/drivers/hwmon/k8temp.c
index 5a632bcf869b..e59f9113fb93 100644
--- a/drivers/hwmon/k8temp.c
+++ b/drivers/hwmon/k8temp.c
@@ -187,7 +187,7 @@ static int k8temp_probe(struct pci_dev *pdev,
                 return -ENOMEM;
 
         model = boot_cpu_data.x86_model;
-        stepping = boot_cpu_data.x86_mask;
+        stepping = boot_cpu_data.x86_stepping;
 
         /* feature available since SH-C0, exclude older revisions */
         if ((model == 4 && stepping == 0) ||
diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c
index 55cfb986225b..faf734ff4cf3 100644
--- a/drivers/irqchip/irq-bcm7038-l1.c
+++ b/drivers/irqchip/irq-bcm7038-l1.c
@@ -339,9 +339,6 @@ int __init bcm7038_l1_of_init(struct device_node *dn,
                 goto out_unmap;
         }
 
-        pr_info("registered BCM7038 L1 intc (mem: 0x%p, IRQs: %d)\n",
-                intc->cpus[0]->map_base, IRQS_PER_WORD * intc->n_words);
-
         return 0;
 
 out_unmap:
diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c
index 983640eba418..8968e5e93fcb 100644
--- a/drivers/irqchip/irq-bcm7120-l2.c
+++ b/drivers/irqchip/irq-bcm7120-l2.c
@@ -318,9 +318,6 @@ static int __init bcm7120_l2_intc_probe(struct device_node *dn,
                 }
         }
 
-        pr_info("registered %s intc (mem: 0x%p, parent IRQ(s): %d)\n",
-                        intc_name, data->map_base[0], data->num_parent_irqs);
-
         return 0;
 
 out_free_domain:
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index 691d20eb0bec..0e65f609352e 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -262,9 +262,6 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
                 ct->chip.irq_set_wake = irq_gc_set_wake;
         }
 
-        pr_info("registered L2 intc (mem: 0x%p, parent irq: %d)\n",
-                        base, parent_irq);
-
         return 0;
 
 out_free_domain:
diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
index 993a8426a453..1ff38aff9f29 100644
--- a/drivers/irqchip/irq-gic-v2m.c
+++ b/drivers/irqchip/irq-gic-v2m.c
@@ -94,7 +94,7 @@ static struct irq_chip gicv2m_msi_irq_chip = {
 
 static struct msi_domain_info gicv2m_msi_domain_info = {
         .flags  = (MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS |
-                   MSI_FLAG_PCI_MSIX),
+                   MSI_FLAG_PCI_MSIX | MSI_FLAG_MULTI_PCI_MSI),
         .chip   = &gicv2m_msi_irq_chip,
 };
 
@@ -155,18 +155,12 @@ static int gicv2m_irq_gic_domain_alloc(struct irq_domain *domain,
         return 0;
 }
 
-static void gicv2m_unalloc_msi(struct v2m_data *v2m, unsigned int hwirq)
+static void gicv2m_unalloc_msi(struct v2m_data *v2m, unsigned int hwirq,
+                               int nr_irqs)
 {
-        int pos;
-
-        pos = hwirq - v2m->spi_start;
-        if (pos < 0 || pos >= v2m->nr_spis) {
-                pr_err("Failed to teardown msi. Invalid hwirq %d\n", hwirq);
-                return;
-        }
-
         spin_lock(&v2m_lock);
-        __clear_bit(pos, v2m->bm);
+        bitmap_release_region(v2m->bm, hwirq - v2m->spi_start,
+                              get_count_order(nr_irqs));
         spin_unlock(&v2m_lock);
 }
 
@@ -174,13 +168,13 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
                                    unsigned int nr_irqs, void *args)
 {
         struct v2m_data *v2m = NULL, *tmp;
-        int hwirq, offset, err = 0;
+        int hwirq, offset, i, err = 0;
 
         spin_lock(&v2m_lock);
         list_for_each_entry(tmp, &v2m_nodes, entry) {
-                offset = find_first_zero_bit(tmp->bm, tmp->nr_spis);
-                if (offset < tmp->nr_spis) {
-                        __set_bit(offset, tmp->bm);
+                offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+                                                 get_count_order(nr_irqs));
+                if (offset >= 0) {
                         v2m = tmp;
                         break;
                 }
@@ -192,16 +186,21 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
 
         hwirq = v2m->spi_start + offset;
 
-        err = gicv2m_irq_gic_domain_alloc(domain, virq, hwirq);
-        if (err) {
-                gicv2m_unalloc_msi(v2m, hwirq);
-                return err;
-        }
+        for (i = 0; i < nr_irqs; i++) {
+                err = gicv2m_irq_gic_domain_alloc(domain, virq + i, hwirq + i);
+                if (err)
+                        goto fail;
 
-        irq_domain_set_hwirq_and_chip(domain, virq, hwirq,
-                                      &gicv2m_irq_chip, v2m);
+                irq_domain_set_hwirq_and_chip(domain, virq + i, hwirq + i,
+                                              &gicv2m_irq_chip, v2m);
+        }
 
         return 0;
+
+fail:
+        irq_domain_free_irqs_parent(domain, virq, nr_irqs);
+        gicv2m_unalloc_msi(v2m, hwirq, get_count_order(nr_irqs));
+        return err;
 }
 
 static void gicv2m_irq_domain_free(struct irq_domain *domain,
@@ -210,8 +209,7 @@ static void gicv2m_irq_domain_free(struct irq_domain *domain,
         struct irq_data *d = irq_domain_get_irq_data(domain, virq);
         struct v2m_data *v2m = irq_data_get_irq_chip_data(d);
 
-        BUG_ON(nr_irqs != 1);
-        gicv2m_unalloc_msi(v2m, d->hwirq);
+        gicv2m_unalloc_msi(v2m, d->hwirq, nr_irqs);
         irq_domain_free_irqs_parent(domain, virq, nr_irqs);
 }
 
diff --git a/drivers/irqchip/irq-gic-v3-its-pci-msi.c b/drivers/irqchip/irq-gic-v3-its-pci-msi.c
index 14a8c0a7e095..25a98de5cfb2 100644
--- a/drivers/irqchip/irq-gic-v3-its-pci-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-pci-msi.c
@@ -132,6 +132,8 @@ static int __init its_pci_of_msi_init(void)
 
         for (np = of_find_matching_node(NULL, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller"))
                         continue;
 
diff --git a/drivers/irqchip/irq-gic-v3-its-platform-msi.c b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
index 833a90fe33ae..8881a053c173 100644
--- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
@@ -154,6 +154,8 @@ static void __init its_pmsi_of_init(void)
 
         for (np = of_find_matching_node(NULL, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller"))
                         continue;
 
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 06f025fd5726..1d3056f53747 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -3314,6 +3314,8 @@ static int __init its_of_probe(struct device_node *node)
 
         for (np = of_find_matching_node(node, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller")) {
                         pr_warn("%pOF: no msi-controller property, ITS ignored\n",
                                 np);
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index a57c0fbbd34a..d99cc07903ec 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -673,7 +673,7 @@ static void gic_send_sgi(u64 cluster_id, u16 tlist, unsigned int irq)
                MPIDR_TO_SGI_RS(cluster_id)              |
                tlist << ICC_SGI1R_TARGET_LIST_SHIFT);
 
-        pr_debug("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
+        pr_devel("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
         gic_write_sgi1r(val);
 }
 
@@ -688,7 +688,7 @@ static void gic_raise_softirq(const struct cpumask *mask, unsigned int irq)
          * Ensure that stores to Normal memory are visible to the
          * other CPUs before issuing the IPI.
          */
-        smp_wmb();
+        wmb();
 
         for_each_cpu(cpu, mask) {
                 u64 cluster_id = MPIDR_TO_SGI_CLUSTER_ID(cpu_logical_map(cpu));
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index ef92a4d2038e..d32268cc1174 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -424,8 +424,6 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
         spin_lock_irqsave(&gic_lock, flags);
         write_gic_map_pin(intr, GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin);
         write_gic_map_vp(intr, BIT(mips_cm_vp_id(cpu)));
-        gic_clear_pcpu_masks(intr);
-        set_bit(intr, per_cpu_ptr(pcpu_masks, cpu));
         irq_data_update_effective_affinity(data, cpumask_of(cpu));
         spin_unlock_irqrestore(&gic_lock, flags);
 
diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
index 62f541f968f6..07074820a167 100644
--- a/drivers/macintosh/macio_asic.c
+++ b/drivers/macintosh/macio_asic.c
@@ -375,6 +375,7 @@ static struct macio_dev * macio_add_one_device(struct macio_chip *chip,
         dev->ofdev.dev.of_node = np;
         dev->ofdev.archdata.dma_mask = 0xffffffffUL;
         dev->ofdev.dev.dma_mask = &dev->ofdev.archdata.dma_mask;
+        dev->ofdev.dev.coherent_dma_mask = dev->ofdev.archdata.dma_mask;
         dev->ofdev.dev.parent = parent;
         dev->ofdev.dev.bus = &macio_bus_type;
         dev->ofdev.dev.release = macio_release_dev;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index d6de00f367ef..68136806d365 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -903,7 +903,8 @@ static void dec_pending(struct dm_io *io, blk_status_t error)
                         queue_io(md, bio);
                 } else {
                         /* done with normal IO or empty flush */
-                        bio->bi_status = io_error;
+                        if (io_error)
+                                bio->bi_status = io_error;
                         bio_endio(bio);
                 }
         }
diff --git a/drivers/misc/ocxl/file.c b/drivers/misc/ocxl/file.c
index d9aa407db06a..2dd2db9bc1c9 100644
--- a/drivers/misc/ocxl/file.c
+++ b/drivers/misc/ocxl/file.c
@@ -277,7 +277,7 @@ static ssize_t afu_read(struct file *file, char __user *buf, size_t count,
         struct ocxl_context *ctx = file->private_data;
         struct ocxl_kernel_event_header header;
         ssize_t rc;
-        size_t used = 0;
+        ssize_t used = 0;
         DEFINE_WAIT(event_wait);
 
         memset(&header, 0, sizeof(header));
diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
index 229dc18f0581..768972af8b85 100644
--- a/drivers/mmc/host/bcm2835.c
+++ b/drivers/mmc/host/bcm2835.c
@@ -1265,7 +1265,8 @@ static int bcm2835_add_host(struct bcm2835_host *host)
         char pio_limit_string[20];
         int ret;
 
-        mmc->f_max = host->max_clk;
+        if (!mmc->f_max || mmc->f_max > host->max_clk)
+                mmc->f_max = host->max_clk;
         mmc->f_min = host->max_clk / SDCDIV_MAX_CDIV;
 
         mmc->max_busy_timeout = ~0 / (mmc->f_max / 1000);
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index 22438ebfe4e6..4f972b879fe6 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -717,22 +717,6 @@ static int meson_mmc_clk_phase_tuning(struct mmc_host *mmc, u32 opcode,
 static int meson_mmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
 {
         struct meson_host *host = mmc_priv(mmc);
-        int ret;
-
-        /*
-         * If this is the initial tuning, try to get a sane Rx starting
-         * phase before doing the actual tuning.
-         */
-        if (!mmc->doing_retune) {
-                ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
-
-                if (ret)
-                        return ret;
-        }
-
-        ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->tx_clk);
-        if (ret)
-                return ret;
 
         return meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
 }
@@ -763,9 +747,8 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                 if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
 
-                /* Reset phases */
+                /* Reset rx phase */
                 clk_set_phase(host->rx_clk, 0);
-                clk_set_phase(host->tx_clk, 270);
 
                 break;
 
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index e6b8c59f2c0d..736ac887303c 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -328,7 +328,7 @@ config MTD_NAND_MARVELL
         tristate "NAND controller support on Marvell boards"
         depends on PXA3xx || ARCH_MMP || PLAT_ORION || ARCH_MVEBU || \
                    COMPILE_TEST
-        depends on HAS_IOMEM
+        depends on HAS_IOMEM && HAS_DMA
         help
           This enables the NAND flash controller driver for Marvell boards,
           including:
diff --git a/drivers/mtd/nand/vf610_nfc.c b/drivers/mtd/nand/vf610_nfc.c
index 80d31a58e558..f367144f3c6f 100644
--- a/drivers/mtd/nand/vf610_nfc.c
+++ b/drivers/mtd/nand/vf610_nfc.c
@@ -752,10 +752,8 @@ static int vf610_nfc_probe(struct platform_device *pdev)
                 if (mtd->oobsize > 64)
                         mtd->oobsize = 64;
 
-                /*
-                 * mtd->ecclayout is not specified here because we're using the
-                 * default large page ECC layout defined in NAND core.
-                 */
+                /* Use default large page ECC layout defined in NAND core */
+                mtd_set_ooblayout(mtd, &nand_ooblayout_lp_ops);
                 if (chip->ecc.strength == 32) {
                         nfc->ecc_mode = ECC_60_BYTE;
                         chip->ecc.bytes = 60;
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index a77ee2f8fb8d..c1841db1b500 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -820,7 +820,7 @@ static int tg3_ape_event_lock(struct tg3 *tp, u32 timeout_us)
 
                 tg3_ape_unlock(tp, TG3_APE_LOCK_MEM);
 
-                udelay(10);
+                usleep_range(10, 20);
                 timeout_us -= (timeout_us > 10) ? 10 : timeout_us;
         }
 
@@ -922,8 +922,8 @@ static int tg3_ape_send_event(struct tg3 *tp, u32 event)
         if (!(apedata & APE_FW_STATUS_READY))
                 return -EAGAIN;
 
-        /* Wait for up to 1 millisecond for APE to service previous event. */
-        err = tg3_ape_event_lock(tp, 1000);
+        /* Wait for up to 20 millisecond for APE to service previous event. */
+        err = tg3_ape_event_lock(tp, 20000);
         if (err)
                 return err;
 
@@ -946,6 +946,7 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
 
         switch (kind) {
         case RESET_KIND_INIT:
+                tg3_ape_write32(tp, TG3_APE_HOST_HEARTBEAT_COUNT, tp->ape_hb++);
                 tg3_ape_write32(tp, TG3_APE_HOST_SEG_SIG,
                                 APE_HOST_SEG_SIG_MAGIC);
                 tg3_ape_write32(tp, TG3_APE_HOST_SEG_LEN,
@@ -962,13 +963,6 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
                 event = APE_EVENT_STATUS_STATE_START;
                 break;
         case RESET_KIND_SHUTDOWN:
-                /* With the interface we are currently using,
-                 * APE does not track driver state.  Wiping
-                 * out the HOST SEGMENT SIGNATURE forces
-                 * the APE to assume OS absent status.
-                 */
-                tg3_ape_write32(tp, TG3_APE_HOST_SEG_SIG, 0x0);
-
                 if (device_may_wakeup(&tp->pdev->dev) &&
                     tg3_flag(tp, WOL_ENABLE)) {
                         tg3_ape_write32(tp, TG3_APE_HOST_WOL_SPEED,
@@ -990,6 +984,18 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
         tg3_ape_send_event(tp, event);
 }
 
+static void tg3_send_ape_heartbeat(struct tg3 *tp,
+                                   unsigned long interval)
+{
+        /* Check if hb interval has exceeded */
+        if (!tg3_flag(tp, ENABLE_APE) ||
+            time_before(jiffies, tp->ape_hb_jiffies + interval))
+                return;
+
+        tg3_ape_write32(tp, TG3_APE_HOST_HEARTBEAT_COUNT, tp->ape_hb++);
+        tp->ape_hb_jiffies = jiffies;
+}
+
 static void tg3_disable_ints(struct tg3 *tp)
 {
         int i;
@@ -7262,6 +7268,7 @@ static int tg3_poll_msix(struct napi_struct *napi, int budget)
                 }
         }
 
+        tg3_send_ape_heartbeat(tp, TG3_APE_HB_INTERVAL << 1);
         return work_done;
 
 tx_recovery:
@@ -7344,6 +7351,7 @@ static int tg3_poll(struct napi_struct *napi, int budget)
                 }
         }
 
+        tg3_send_ape_heartbeat(tp, TG3_APE_HB_INTERVAL << 1);
         return work_done;
 
 tx_recovery:
@@ -10732,7 +10740,7 @@ static int tg3_reset_hw(struct tg3 *tp, bool reset_phy)
         if (tg3_flag(tp, ENABLE_APE))
                 /* Write our heartbeat update interval to APE. */
                 tg3_ape_write32(tp, TG3_APE_HOST_HEARTBEAT_INT_MS,
-                                APE_HOST_HEARTBEAT_INT_DISABLE);
+                                APE_HOST_HEARTBEAT_INT_5SEC);
 
         tg3_write_sig_post_reset(tp, RESET_KIND_INIT);
 
@@ -11077,6 +11085,9 @@ static void tg3_timer(struct timer_list *t)
                 tp->asf_counter = tp->asf_multiplier;
         }
 
+        /* Update the APE heartbeat every 5 seconds.*/
+        tg3_send_ape_heartbeat(tp, TG3_APE_HB_INTERVAL);
+
         spin_unlock(&tp->lock);
 
 restart_timer:
@@ -16653,6 +16664,8 @@ static int tg3_get_invariants(struct tg3 *tp, const struct pci_device_id *ent)
                                        pci_state_reg);
 
                 tg3_ape_lock_init(tp);
+                tp->ape_hb_interval =
+                        msecs_to_jiffies(APE_HOST_HEARTBEAT_INT_5SEC);
         }
 
         /* Set up tp->grc_local_ctrl before calling
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index 47f51cc0566d..1d61aa3efda1 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -2508,6 +2508,7 @@
 #define TG3_APE_LOCK_PHY3               5
 #define TG3_APE_LOCK_GPIO               7
 
+#define TG3_APE_HB_INTERVAL             (tp->ape_hb_interval)
 #define TG3_EEPROM_SB_F1R2_MBA_OFF      0x10
 
 
@@ -3423,6 +3424,10 @@ struct tg3 {
         struct device                   *hwmon_dev;
         bool                            link_up;
         bool                            pcierr_recovery;
+
+        u32                             ape_hb;
+        unsigned long                   ape_hb_interval;
+        unsigned long                   ape_hb_jiffies;
 };
 
 /* Accessor macros for chip and asic attributes
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index b68cde9f17d2..7d9c5ffbd041 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -67,11 +67,6 @@ module_param(cpi_alg, int, S_IRUGO);
 MODULE_PARM_DESC(cpi_alg,
                  "PFC algorithm (0=none, 1=VLAN, 2=VLAN16, 3=IP Diffserv)");
 
-struct nicvf_xdp_tx {
-        u64 dma_addr;
-        u8  qidx;
-};
-
 static inline u8 nicvf_netdev_qidx(struct nicvf *nic, u8 qidx)
 {
         if (nic->sqs_mode)
@@ -507,29 +502,14 @@ static int nicvf_init_resources(struct nicvf *nic)
         return 0;
 }
 
-static void nicvf_unmap_page(struct nicvf *nic, struct page *page, u64 dma_addr)
-{
-        /* Check if it's a recycled page, if not unmap the DMA mapping.
-         * Recycled page holds an extra reference.
-         */
-        if (page_ref_count(page) == 1) {
-                dma_addr &= PAGE_MASK;
-                dma_unmap_page_attrs(&nic->pdev->dev, dma_addr,
-                                     RCV_FRAG_LEN + XDP_HEADROOM,
-                                     DMA_FROM_DEVICE,
-                                     DMA_ATTR_SKIP_CPU_SYNC);
-        }
-}
-
 static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
                                 struct cqe_rx_t *cqe_rx, struct snd_queue *sq,
                                 struct rcv_queue *rq, struct sk_buff **skb)
 {
         struct xdp_buff xdp;
         struct page *page;
-        struct nicvf_xdp_tx *xdp_tx = NULL;
         u32 action;
-        u16 len, err, offset = 0;
+        u16 len, offset = 0;
         u64 dma_addr, cpu_addr;
         void *orig_data;
 
@@ -543,7 +523,7 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
         cpu_addr = (u64)phys_to_virt(cpu_addr);
         page = virt_to_page((void *)cpu_addr);
 
-        xdp.data_hard_start = page_address(page) + RCV_BUF_HEADROOM;
+        xdp.data_hard_start = page_address(page);
         xdp.data = (void *)cpu_addr;
         xdp_set_data_meta_invalid(&xdp);
         xdp.data_end = xdp.data + len;
@@ -563,7 +543,18 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
 
         switch (action) {
         case XDP_PASS:
-                nicvf_unmap_page(nic, page, dma_addr);
+                /* Check if it's a recycled page, if not
+                 * unmap the DMA mapping.
+                 *
+                 * Recycled page holds an extra reference.
+                 */
+                if (page_ref_count(page) == 1) {
+                        dma_addr &= PAGE_MASK;
+                        dma_unmap_page_attrs(&nic->pdev->dev, dma_addr,
+                                             RCV_FRAG_LEN + XDP_PACKET_HEADROOM,
+                                             DMA_FROM_DEVICE,
+                                             DMA_ATTR_SKIP_CPU_SYNC);
+                }
 
                 /* Build SKB and pass on packet to network stack */
                 *skb = build_skb(xdp.data,
@@ -576,20 +567,6 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
         case XDP_TX:
                 nicvf_xdp_sq_append_pkt(nic, sq, (u64)xdp.data, dma_addr, len);
                 return true;
-        case XDP_REDIRECT:
-                /* Save DMA address for use while transmitting */
-                xdp_tx = (struct nicvf_xdp_tx *)page_address(page);
-                xdp_tx->dma_addr = dma_addr;
-                xdp_tx->qidx = nicvf_netdev_qidx(nic, cqe_rx->rq_idx);
-
-                err = xdp_do_redirect(nic->pnicvf->netdev, &xdp, prog);
-                if (!err)
-                        return true;
-
-                /* Free the page on error */
-                nicvf_unmap_page(nic, page, dma_addr);
-                put_page(page);
-                break;
         default:
                 bpf_warn_invalid_xdp_action(action);
                 /* fall through */
@@ -597,7 +574,18 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
                 trace_xdp_exception(nic->netdev, prog, action);
                 /* fall through */
         case XDP_DROP:
-                nicvf_unmap_page(nic, page, dma_addr);
+                /* Check if it's a recycled page, if not
+                 * unmap the DMA mapping.
+                 *
+                 * Recycled page holds an extra reference.
+                 */
+                if (page_ref_count(page) == 1) {
+                        dma_addr &= PAGE_MASK;
+                        dma_unmap_page_attrs(&nic->pdev->dev, dma_addr,
+                                             RCV_FRAG_LEN + XDP_PACKET_HEADROOM,
+                                             DMA_FROM_DEVICE,
+                                             DMA_ATTR_SKIP_CPU_SYNC);
+                }
                 put_page(page);
                 return true;
         }
@@ -1864,50 +1852,6 @@ static int nicvf_xdp(struct net_device *netdev, struct netdev_bpf *xdp)
         }
 }
 
-static int nicvf_xdp_xmit(struct net_device *netdev, struct xdp_buff *xdp)
-{
-        struct nicvf *nic = netdev_priv(netdev);
-        struct nicvf *snic = nic;
-        struct nicvf_xdp_tx *xdp_tx;
-        struct snd_queue *sq;
-        struct page *page;
-        int err, qidx;
-
-        if (!netif_running(netdev) || !nic->xdp_prog)
-                return -EINVAL;
-
-        page = virt_to_page(xdp->data);
-        xdp_tx = (struct nicvf_xdp_tx *)page_address(page);
-        qidx = xdp_tx->qidx;
-
-        if (xdp_tx->qidx >= nic->xdp_tx_queues)
-                return -EINVAL;
-
-        /* Get secondary Qset's info */
-        if (xdp_tx->qidx >= MAX_SND_QUEUES_PER_QS) {
-                qidx = xdp_tx->qidx / MAX_SND_QUEUES_PER_QS;
-                snic = (struct nicvf *)nic->snicvf[qidx - 1];
-                if (!snic)
-                        return -EINVAL;
-                qidx = xdp_tx->qidx % MAX_SND_QUEUES_PER_QS;
-        }
-
-        sq = &snic->qs->sq[qidx];
-        err = nicvf_xdp_sq_append_pkt(snic, sq, (u64)xdp->data,
-                                      xdp_tx->dma_addr,
-                                      xdp->data_end - xdp->data);
-        if (err)
-                return -ENOMEM;
-
-        nicvf_xdp_sq_doorbell(snic, sq, qidx);
-        return 0;
-}
-
-static void nicvf_xdp_flush(struct net_device *dev)
-{
-        return;
-}
-
 static int nicvf_config_hwtstamp(struct net_device *netdev, struct ifreq *ifr)
 {
         struct hwtstamp_config config;
@@ -1986,8 +1930,6 @@ static const struct net_device_ops nicvf_netdev_ops = {
         .ndo_fix_features       = nicvf_fix_features,
         .ndo_set_features       = nicvf_set_features,
         .ndo_bpf                = nicvf_xdp,
-        .ndo_xdp_xmit           = nicvf_xdp_xmit,
-        .ndo_xdp_flush          = nicvf_xdp_flush,
         .ndo_do_ioctl           = nicvf_ioctl,
 };
 
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 3eae9ff9b53a..d42704d07484 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -204,7 +204,7 @@ static inline int nicvf_alloc_rcv_buffer(struct nicvf *nic, struct rbdr *rbdr,
 
         /* Reserve space for header modifications by BPF program */
         if (rbdr->is_xdp)
-                buf_len += XDP_HEADROOM;
+                buf_len += XDP_PACKET_HEADROOM;
 
         /* Check if it's recycled */
         if (pgcache)
@@ -224,9 +224,8 @@ ret:
                         nic->rb_page = NULL;
                         return -ENOMEM;
                 }
-
                 if (pgcache)
-                        pgcache->dma_addr = *rbuf + XDP_HEADROOM;
+                        pgcache->dma_addr = *rbuf + XDP_PACKET_HEADROOM;
                 nic->rb_page_offset += buf_len;
         }
 
@@ -1244,7 +1243,7 @@ int nicvf_xdp_sq_append_pkt(struct nicvf *nic, struct snd_queue *sq,
         int qentry;
 
         if (subdesc_cnt > sq->xdp_free_cnt)
-                return -1;
+                return 0;
 
         qentry = nicvf_get_sq_desc(sq, subdesc_cnt);
 
@@ -1255,7 +1254,7 @@ int nicvf_xdp_sq_append_pkt(struct nicvf *nic, struct snd_queue *sq,
 
         sq->xdp_desc_cnt += subdesc_cnt;
 
-        return 0;
+        return 1;
 }
 
 /* Calculate no of SQ subdescriptors needed to transmit all
@@ -1656,7 +1655,7 @@ static void nicvf_unmap_rcv_buffer(struct nicvf *nic, u64 dma_addr,
                 if (page_ref_count(page) != 1)
                         return;
 
-                len += XDP_HEADROOM;
+                len += XDP_PACKET_HEADROOM;
                 /* Receive buffers in XDP mode are mapped from page start */
                 dma_addr &= PAGE_MASK;
         }
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
index ce1eed7a6d63..5e9a03cf1b4d 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
@@ -11,7 +11,6 @@
 
 #include <linux/netdevice.h>
 #include <linux/iommu.h>
-#include <linux/bpf.h>
 #include <net/xdp.h>
 #include "q_struct.h"
 
@@ -94,9 +93,6 @@
 #define RCV_FRAG_LEN     (SKB_DATA_ALIGN(DMA_BUFFER_LEN + NET_SKB_PAD) + \
                          SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 
-#define RCV_BUF_HEADROOM        128 /* To store dma address for XDP redirect */
-#define XDP_HEADROOM            (XDP_PACKET_HEADROOM + RCV_BUF_HEADROOM)
-
 #define MAX_CQES_FOR_TX         ((SND_QUEUE_LEN / MIN_SQ_DESC_PER_PKT_XMIT) * \
                                  MAX_CQE_PER_PKT_XMIT)
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
index 557fd8bfd54e..00a1d2d13169 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
@@ -472,7 +472,7 @@ int cudbg_collect_cim_la(struct cudbg_init *pdbg_init,
 
         if (is_t6(padap->params.chip)) {
                 size = padap->params.cim_la_size / 10 + 1;
-                size *= 11 * sizeof(u32);
+                size *= 10 * sizeof(u32);
         } else {
                 size = padap->params.cim_la_size / 8;
                 size *= 8 * sizeof(u32);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c
index 30485f9a598f..143686c60234 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c
@@ -102,7 +102,7 @@ static u32 cxgb4_get_entity_length(struct adapter *adap, u32 entity)
         case CUDBG_CIM_LA:
                 if (is_t6(adap->params.chip)) {
                         len = adap->params.cim_la_size / 10 + 1;
-                        len *= 11 * sizeof(u32);
+                        len *= 10 * sizeof(u32);
                 } else {
                         len = adap->params.cim_la_size / 8;
                         len *= 8 * sizeof(u32);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 56bc626ef006..7b452e85de2a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4982,9 +4982,10 @@ static int cxgb4_iov_configure(struct pci_dev *pdev, int num_vfs)
 
         pcie_fw = readl(adap->regs + PCIE_FW_A);
         /* Check if cxgb4 is the MASTER and fw is initialized */
-        if (!(pcie_fw & PCIE_FW_INIT_F) ||
+        if (num_vfs &&
+            (!(pcie_fw & PCIE_FW_INIT_F) ||
             !(pcie_fw & PCIE_FW_MASTER_VLD_F) ||
-            PCIE_FW_MASTER_G(pcie_fw) != CXGB4_UNIFIED_PF) {
+            PCIE_FW_MASTER_G(pcie_fw) != CXGB4_UNIFIED_PF)) {
                 dev_warn(&pdev->dev,
                          "cxgb4 driver needs to be MASTER to support SRIOV\n");
                 return -EOPNOTSUPP;
@@ -5599,24 +5600,24 @@ static void remove_one(struct pci_dev *pdev)
 #if IS_ENABLED(CONFIG_IPV6)
                 t4_cleanup_clip_tbl(adapter);
 #endif
-                iounmap(adapter->regs);
                 if (!is_t4(adapter->params.chip))
                         iounmap(adapter->bar2);
-                pci_disable_pcie_error_reporting(pdev);
-                if ((adapter->flags & DEV_ENABLED)) {
-                        pci_disable_device(pdev);
-                        adapter->flags &= ~DEV_ENABLED;
-                }
-                pci_release_regions(pdev);
-                kfree(adapter->mbox_log);
-                synchronize_rcu();
-                kfree(adapter);
         }
 #ifdef CONFIG_PCI_IOV
         else {
                 cxgb4_iov_configure(adapter->pdev, 0);
         }
 #endif
+        iounmap(adapter->regs);
+        pci_disable_pcie_error_reporting(pdev);
+        if ((adapter->flags & DEV_ENABLED)) {
+                pci_disable_device(pdev);
+                adapter->flags &= ~DEV_ENABLED;
+        }
+        pci_release_regions(pdev);
+        kfree(adapter->mbox_log);
+        synchronize_rcu();
+        kfree(adapter);
 }
 
 /* "Shutdown" quiesces the device, stopping Ingress Packet and Interrupt
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 047609ef0515..920bccd6bc40 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -2637,7 +2637,6 @@ void t4_get_regs(struct adapter *adap, void *buf, size_t buf_size)
 }
 
 #define EEPROM_STAT_ADDR   0x7bfc
-#define VPD_SIZE           0x800
 #define VPD_BASE           0x400
 #define VPD_BASE_OLD       0
 #define VPD_LEN            1024
@@ -2704,15 +2703,6 @@ int t4_get_raw_vpd_params(struct adapter *adapter, struct vpd_params *p)
         if (!vpd)
                 return -ENOMEM;
 
-        /* We have two VPD data structures stored in the adapter VPD area.
-         * By default, Linux calculates the size of the VPD area by traversing
-         * the first VPD area at offset 0x0, so we need to tell the OS what
-         * our real VPD size is.
-         */
-        ret = pci_set_vpd_size(adapter->pdev, VPD_SIZE);
-        if (ret < 0)
-                goto out;
-
         /* Card information normally starts at VPD_BASE but early cards had
          * it at 0.
          */
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 27447260215d..1495cb99f924 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -791,6 +791,18 @@ static int ibmvnic_login(struct net_device *netdev)
         return 0;
 }
 
+static void release_login_buffer(struct ibmvnic_adapter *adapter)
+{
+        kfree(adapter->login_buf);
+        adapter->login_buf = NULL;
+}
+
+static void release_login_rsp_buffer(struct ibmvnic_adapter *adapter)
+{
+        kfree(adapter->login_rsp_buf);
+        adapter->login_rsp_buf = NULL;
+}
+
 static void release_resources(struct ibmvnic_adapter *adapter)
 {
         int i;
@@ -813,6 +825,10 @@ static void release_resources(struct ibmvnic_adapter *adapter)
                         }
                 }
         }
+        kfree(adapter->napi);
+        adapter->napi = NULL;
+
+        release_login_rsp_buffer(adapter);
 }
 
 static int set_link_state(struct ibmvnic_adapter *adapter, u8 link_state)
@@ -1057,6 +1073,35 @@ static int ibmvnic_open(struct net_device *netdev)
         return rc;
 }
 
+static void clean_rx_pools(struct ibmvnic_adapter *adapter)
+{
+        struct ibmvnic_rx_pool *rx_pool;
+        u64 rx_entries;
+        int rx_scrqs;
+        int i, j;
+
+        if (!adapter->rx_pool)
+                return;
+
+        rx_scrqs = be32_to_cpu(adapter->login_rsp_buf->num_rxadd_subcrqs);
+        rx_entries = adapter->req_rx_add_entries_per_subcrq;
+
+        /* Free any remaining skbs in the rx buffer pools */
+        for (i = 0; i < rx_scrqs; i++) {
+                rx_pool = &adapter->rx_pool[i];
+                if (!rx_pool)
+                        continue;
+
+                netdev_dbg(adapter->netdev, "Cleaning rx_pool[%d]\n", i);
+                for (j = 0; j < rx_entries; j++) {
+                        if (rx_pool->rx_buff[j].skb) {
+                                dev_kfree_skb_any(rx_pool->rx_buff[j].skb);
+                                rx_pool->rx_buff[j].skb = NULL;
+                        }
+                }
+        }
+}
+
 static void clean_tx_pools(struct ibmvnic_adapter *adapter)
 {
         struct ibmvnic_tx_pool *tx_pool;
@@ -1134,7 +1179,7 @@ static int __ibmvnic_close(struct net_device *netdev)
                         }
                 }
         }
-
+        clean_rx_pools(adapter);
         clean_tx_pools(adapter);
         adapter->state = VNIC_CLOSED;
         return rc;
@@ -1670,8 +1715,6 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                 return 0;
         }
 
-        netif_carrier_on(netdev);
-
         /* kick napi */
         for (i = 0; i < adapter->req_rx_queues; i++)
                 napi_schedule(&adapter->napi[i]);
@@ -1679,6 +1722,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
         if (adapter->reset_reason != VNIC_RESET_FAILOVER)
                 netdev_notify_peers(netdev);
 
+        netif_carrier_on(netdev);
+
         return 0;
 }
 
@@ -1853,6 +1898,12 @@ restart_poll:
                                    be16_to_cpu(next->rx_comp.rc));
                         /* free the entry */
                         next->rx_comp.first = 0;
+                        dev_kfree_skb_any(rx_buff->skb);
+                        remove_buff_from_pool(adapter, rx_buff);
+                        continue;
+                } else if (!rx_buff->skb) {
+                        /* free the entry */
+                        next->rx_comp.first = 0;
                         remove_buff_from_pool(adapter, rx_buff);
                         continue;
                 }
@@ -3013,6 +3064,7 @@ static void send_login(struct ibmvnic_adapter *adapter)
         struct vnic_login_client_data *vlcd;
         int i;
 
+        release_login_rsp_buffer(adapter);
         client_data_len = vnic_client_data_len(adapter);
 
         buffer_size =
@@ -3708,6 +3760,7 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq,
 
         dma_unmap_single(dev, adapter->login_buf_token, adapter->login_buf_sz,
                          DMA_BIDIRECTIONAL);
+        release_login_buffer(adapter);
         dma_unmap_single(dev, adapter->login_rsp_buf_token,
                          adapter->login_rsp_buf_sz, DMA_BIDIRECTIONAL);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.c
index 0be4575b58a2..fd509160c8f6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.c
@@ -96,10 +96,10 @@ static void print_lyr_2_4_hdrs(struct trace_seq *p,
                                           "%pI4");
                 } else if (ethertype.v == ETH_P_IPV6) {
                         static const struct in6_addr full_ones = {
-                                .in6_u.u6_addr32 = {htonl(0xffffffff),
-                                                    htonl(0xffffffff),
-                                                    htonl(0xffffffff),
-                                                    htonl(0xffffffff)},
+                                .in6_u.u6_addr32 = {__constant_htonl(0xffffffff),
+                                                    __constant_htonl(0xffffffff),
+                                                    __constant_htonl(0xffffffff),
+                                                    __constant_htonl(0xffffffff)},
                         };
                         DECLARE_MASK_VAL(struct in6_addr, src_ipv6);
                         DECLARE_MASK_VAL(struct in6_addr, dst_ipv6);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 47bab842c5ee..da94c8cba5ee 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -1768,13 +1768,16 @@ static void mlx5e_build_rq_param(struct mlx5e_priv *priv,
         param->wq.linear = 1;
 }
 
-static void mlx5e_build_drop_rq_param(struct mlx5e_rq_param *param)
+static void mlx5e_build_drop_rq_param(struct mlx5_core_dev *mdev,
+                                      struct mlx5e_rq_param *param)
 {
         void *rqc = param->rqc;
         void *wq = MLX5_ADDR_OF(rqc, rqc, wq);
 
         MLX5_SET(wq, wq, wq_type, MLX5_WQ_TYPE_LINKED_LIST);
         MLX5_SET(wq, wq, log_wq_stride,    ilog2(sizeof(struct mlx5e_rx_wqe)));
+
+        param->wq.buf_numa_node = dev_to_node(&mdev->pdev->dev);
 }
 
 static void mlx5e_build_sq_param_common(struct mlx5e_priv *priv,
@@ -2634,6 +2637,9 @@ static int mlx5e_alloc_drop_cq(struct mlx5_core_dev *mdev,
                                struct mlx5e_cq *cq,
                                struct mlx5e_cq_param *param)
 {
+        param->wq.buf_numa_node = dev_to_node(&mdev->pdev->dev);
+        param->wq.db_numa_node  = dev_to_node(&mdev->pdev->dev);
+
         return mlx5e_alloc_cq_common(mdev, param, cq);
 }
 
@@ -2645,7 +2651,7 @@ static int mlx5e_open_drop_rq(struct mlx5_core_dev *mdev,
         struct mlx5e_cq *cq = &drop_rq->cq;
         int err;
 
-        mlx5e_build_drop_rq_param(&rq_param);
+        mlx5e_build_drop_rq_param(mdev, &rq_param);
 
         err = mlx5e_alloc_drop_cq(mdev, cq, &cq_param);
         if (err)
@@ -2994,8 +3000,8 @@ static int mlx5e_setup_tc_block(struct net_device *dev,
 }
 #endif
 
-int mlx5e_setup_tc(struct net_device *dev, enum tc_setup_type type,
-                   void *type_data)
+static int mlx5e_setup_tc(struct net_device *dev, enum tc_setup_type type,
+                          void *type_data)
 {
         switch (type) {
 #ifdef CONFIG_MLX5_ESWITCH
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 0d4bb0688faa..e5c3ab46a24a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -36,6 +36,7 @@
 #include <linux/tcp.h>
 #include <linux/bpf_trace.h>
 #include <net/busy_poll.h>
+#include <net/ip6_checksum.h>
 #include "en.h"
 #include "en_tc.h"
 #include "eswitch.h"
@@ -546,20 +547,33 @@ bool mlx5e_post_rx_mpwqes(struct mlx5e_rq *rq)
         return true;
 }
 
+static void mlx5e_lro_update_tcp_hdr(struct mlx5_cqe64 *cqe, struct tcphdr *tcp)
+{
+        u8 l4_hdr_type = get_cqe_l4_hdr_type(cqe);
+        u8 tcp_ack     = (l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_NO_DATA) ||
+                         (l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_AND_DATA);
+
+        tcp->check                      = 0;
+        tcp->psh                        = get_cqe_lro_tcppsh(cqe);
+
+        if (tcp_ack) {
+                tcp->ack                = 1;
+                tcp->ack_seq            = cqe->lro_ack_seq_num;
+                tcp->window             = cqe->lro_tcp_win;
+        }
+}
+
 static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe,
                                  u32 cqe_bcnt)
 {
         struct ethhdr   *eth = (struct ethhdr *)(skb->data);
         struct tcphdr   *tcp;
         int network_depth = 0;
+        __wsum check;
         __be16 proto;
         u16 tot_len;
         void *ip_p;
 
-        u8 l4_hdr_type = get_cqe_l4_hdr_type(cqe);
-        u8 tcp_ack = (l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_NO_DATA) ||
-                (l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_AND_DATA);
-
         proto = __vlan_get_protocol(skb, eth->h_proto, &network_depth);
 
         tot_len = cqe_bcnt - network_depth;
@@ -576,23 +590,30 @@ static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe,
                 ipv4->check             = 0;
                 ipv4->check             = ip_fast_csum((unsigned char *)ipv4,
                                                        ipv4->ihl);
+
+                mlx5e_lro_update_tcp_hdr(cqe, tcp);
+                check = csum_partial(tcp, tcp->doff * 4,
+                                     csum_unfold((__force __sum16)cqe->check_sum));
+                /* Almost done, don't forget the pseudo header */
+                tcp->check = csum_tcpudp_magic(ipv4->saddr, ipv4->daddr,
+                                               tot_len - sizeof(struct iphdr),
+                                               IPPROTO_TCP, check);
         } else {
+                u16 payload_len = tot_len - sizeof(struct ipv6hdr);
                 struct ipv6hdr *ipv6 = ip_p;
 
                 tcp = ip_p + sizeof(struct ipv6hdr);
                 skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
 
                 ipv6->hop_limit         = cqe->lro_min_ttl;
-                ipv6->payload_len       = cpu_to_be16(tot_len -
-                                                      sizeof(struct ipv6hdr));
-        }
-
-        tcp->psh = get_cqe_lro_tcppsh(cqe);
-
-        if (tcp_ack) {
-                tcp->ack                = 1;
-                tcp->ack_seq            = cqe->lro_ack_seq_num;
-                tcp->window             = cqe->lro_tcp_win;
+                ipv6->payload_len       = cpu_to_be16(payload_len);
+
+                mlx5e_lro_update_tcp_hdr(cqe, tcp);
+                check = csum_partial(tcp, tcp->doff * 4,
+                                     csum_unfold((__force __sum16)cqe->check_sum));
+                /* Almost done, don't forget the pseudo header */
+                tcp->check = csum_ipv6_magic(&ipv6->saddr, &ipv6->daddr, payload_len,
+                                             IPPROTO_TCP, check);
         }
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
index 5a4608281f38..707976482c09 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
@@ -216,7 +216,8 @@ mlx5e_test_loopback_validate(struct sk_buff *skb,
         if (iph->protocol != IPPROTO_UDP)
                 goto out;
 
-        udph = udp_hdr(skb);
+        /* Don't assume skb_transport_header() was set */
+        udph = (struct udphdr *)((u8 *)iph + 4 * iph->ihl);
         if (udph->dest != htons(9))
                 goto out;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index fd98b0dc610f..fa86a1466718 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -2529,7 +2529,8 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                         if (tcf_vlan_action(a) == TCA_VLAN_ACT_POP) {
                                 attr->action |= MLX5_FLOW_CONTEXT_ACTION_VLAN_POP;
                         } else if (tcf_vlan_action(a) == TCA_VLAN_ACT_PUSH) {
-                                if (tcf_vlan_push_proto(a) != htons(ETH_P_8021Q))
+                                if (tcf_vlan_push_proto(a) != htons(ETH_P_8021Q) ||
+                                    tcf_vlan_push_prio(a))
                                         return -EOPNOTSUPP;
 
                                 attr->action |= MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index 569b42a01026..11b4f1089d1c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -176,7 +176,7 @@ static inline u16 mlx5e_calc_min_inline(enum mlx5_inline_modes mode,
         default:
                 hlen = mlx5e_skb_l2_header_offset(skb);
         }
-        return min_t(u16, hlen, skb->len);
+        return min_t(u16, hlen, skb_headlen(skb));
 }
 
 static inline void mlx5e_tx_skb_pull_inline(unsigned char **skb_data,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index 5ecf2cddc16d..c2b1d7d351fc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1529,6 +1529,10 @@ static void esw_enable_vport(struct mlx5_eswitch *esw, int vport_num,
 
         esw_debug(esw->dev, "Enabling VPORT(%d)\n", vport_num);
 
+        /* Create steering drop counters for ingress and egress ACLs */
+        if (vport_num && esw->mode == SRIOV_LEGACY)
+                esw_vport_create_drop_counters(vport);
+
         /* Restore old vport configuration */
         esw_apply_vport_conf(esw, vport);
 
@@ -1545,10 +1549,6 @@ static void esw_enable_vport(struct mlx5_eswitch *esw, int vport_num,
         if (!vport_num)
                 vport->info.trusted = true;
 
-        /* create steering drop counters for ingress and egress ACLs */
-        if (vport_num && esw->mode == SRIOV_LEGACY)
-                esw_vport_create_drop_counters(vport);
-
         esw_vport_change_handle_locked(vport);
 
         esw->enabled_vports++;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index c025c98700e4..31fc2cfac3b3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -1429,7 +1429,8 @@ static bool check_conflicting_actions(u32 action1, u32 action2)
 
         if (xored_actions & (MLX5_FLOW_CONTEXT_ACTION_DROP  |
                              MLX5_FLOW_CONTEXT_ACTION_ENCAP |
-                             MLX5_FLOW_CONTEXT_ACTION_DECAP))
+                             MLX5_FLOW_CONTEXT_ACTION_DECAP |
+                             MLX5_FLOW_CONTEXT_ACTION_MOD_HDR))
                 return true;
 
         return false;
@@ -1758,8 +1759,11 @@ search_again_locked:
 
         /* Collect all fgs which has a matching match_criteria */
         err = build_match_list(&match_head, ft, spec);
-        if (err)
+        if (err) {
+                if (take_write)
+                        up_write_ref_node(&ft->node);
                 return ERR_PTR(err);
+        }
 
         if (!take_write)
                 up_read_ref_node(&ft->node);
@@ -1768,8 +1772,11 @@ search_again_locked:
                                       dest_num, version);
         free_match_list(&match_head);
         if (!IS_ERR(rule) ||
-            (PTR_ERR(rule) != -ENOENT && PTR_ERR(rule) != -EAGAIN))
+            (PTR_ERR(rule) != -ENOENT && PTR_ERR(rule) != -EAGAIN)) {
+                if (take_write)
+                        up_write_ref_node(&ft->node);
                 return rule;
+        }
 
         if (!take_write) {
                 nested_down_write_ref_node(&ft->node, FS_LOCK_GRANDPARENT);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
index e159243e0fcf..857035583ccd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
@@ -34,6 +34,7 @@
 #include <linux/highmem.h>
 #include <rdma/mlx5-abi.h>
 #include "en.h"
+#include "clock.h"
 
 enum {
         MLX5_CYCLES_SHIFT       = 23
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 2ef641c91c26..ae391e4b7070 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -551,7 +551,7 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
                 MLX5_SET(cmd_hca_cap,
                          set_hca_cap,
                          cache_line_128byte,
-                         cache_line_size() == 128 ? 1 : 0);
+                         cache_line_size() >= 128 ? 1 : 0);
 
         if (MLX5_CAP_GEN_MAX(dev, dct))
                 MLX5_SET(cmd_hca_cap, set_hca_cap, dct, 1);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index dcc6305f7c22..f7948e983637 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -3794,6 +3794,9 @@ mlxsw_sp_fib4_entry_offload_unset(struct mlxsw_sp_fib_entry *fib_entry)
         struct mlxsw_sp_nexthop_group *nh_grp = fib_entry->nh_group;
         int i;
 
+        if (!list_is_singular(&nh_grp->fib_list))
+                return;
+
         for (i = 0; i < nh_grp->count; i++) {
                 struct mlxsw_sp_nexthop *nh = &nh_grp->nexthops[i];
 
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index 7e7704daf5f1..c4949183eef3 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -43,12 +43,6 @@
 
 /* Local Definitions and Declarations */
 
-struct rmnet_walk_data {
-        struct net_device *real_dev;
-        struct list_head *head;
-        struct rmnet_port *port;
-};
-
 static int rmnet_is_real_dev_registered(const struct net_device *real_dev)
 {
         return rcu_access_pointer(real_dev->rx_handler) == rmnet_rx_handler;
@@ -112,17 +106,14 @@ static int rmnet_register_real_device(struct net_device *real_dev)
 static void rmnet_unregister_bridge(struct net_device *dev,
                                     struct rmnet_port *port)
 {
-        struct net_device *rmnet_dev, *bridge_dev;
         struct rmnet_port *bridge_port;
+        struct net_device *bridge_dev;
 
         if (port->rmnet_mode != RMNET_EPMODE_BRIDGE)
                 return;
 
         /* bridge slave handling */
         if (!port->nr_rmnet_devs) {
-                rmnet_dev = netdev_master_upper_dev_get_rcu(dev);
-                netdev_upper_dev_unlink(dev, rmnet_dev);
-
                 bridge_dev = port->bridge_ep;
 
                 bridge_port = rmnet_get_port_rtnl(bridge_dev);
@@ -132,9 +123,6 @@ static void rmnet_unregister_bridge(struct net_device *dev,
                 bridge_dev = port->bridge_ep;
 
                 bridge_port = rmnet_get_port_rtnl(bridge_dev);
-                rmnet_dev = netdev_master_upper_dev_get_rcu(bridge_dev);
-                netdev_upper_dev_unlink(bridge_dev, rmnet_dev);
-
                 rmnet_unregister_real_device(bridge_dev, bridge_port);
         }
 }
@@ -173,10 +161,6 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev,
         if (err)
                 goto err1;
 
-        err = netdev_master_upper_dev_link(dev, real_dev, NULL, NULL, extack);
-        if (err)
-                goto err2;
-
         port->rmnet_mode = mode;
 
         hlist_add_head_rcu(&ep->hlnode, &port->muxed_ep[mux_id]);
@@ -193,8 +177,6 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev,
 
         return 0;
 
-err2:
-        rmnet_vnd_dellink(mux_id, port, ep);
 err1:
         rmnet_unregister_real_device(real_dev, port);
 err0:
@@ -204,14 +186,13 @@ err0:
 
 static void rmnet_dellink(struct net_device *dev, struct list_head *head)
 {
+        struct rmnet_priv *priv = netdev_priv(dev);
         struct net_device *real_dev;
         struct rmnet_endpoint *ep;
         struct rmnet_port *port;
         u8 mux_id;
 
-        rcu_read_lock();
-        real_dev = netdev_master_upper_dev_get_rcu(dev);
-        rcu_read_unlock();
+        real_dev = priv->real_dev;
 
         if (!real_dev || !rmnet_is_real_dev_registered(real_dev))
                 return;
@@ -219,7 +200,6 @@ static void rmnet_dellink(struct net_device *dev, struct list_head *head)
         port = rmnet_get_port_rtnl(real_dev);
 
         mux_id = rmnet_vnd_get_mux(dev);
-        netdev_upper_dev_unlink(dev, real_dev);
 
         ep = rmnet_get_endpoint(port, mux_id);
         if (ep) {
@@ -233,30 +213,13 @@ static void rmnet_dellink(struct net_device *dev, struct list_head *head)
         unregister_netdevice_queue(dev, head);
 }
 
-static int rmnet_dev_walk_unreg(struct net_device *rmnet_dev, void *data)
-{
-        struct rmnet_walk_data *d = data;
-        struct rmnet_endpoint *ep;
-        u8 mux_id;
-
-        mux_id = rmnet_vnd_get_mux(rmnet_dev);
-        ep = rmnet_get_endpoint(d->port, mux_id);
-        if (ep) {
-                hlist_del_init_rcu(&ep->hlnode);
-                rmnet_vnd_dellink(mux_id, d->port, ep);
-                kfree(ep);
-        }
-        netdev_upper_dev_unlink(rmnet_dev, d->real_dev);
-        unregister_netdevice_queue(rmnet_dev, d->head);
-
-        return 0;
-}
-
 static void rmnet_force_unassociate_device(struct net_device *dev)
 {
         struct net_device *real_dev = dev;
-        struct rmnet_walk_data d;
+        struct hlist_node *tmp_ep;
+        struct rmnet_endpoint *ep;
         struct rmnet_port *port;
+        unsigned long bkt_ep;
         LIST_HEAD(list);
 
         if (!rmnet_is_real_dev_registered(real_dev))
@@ -264,16 +227,19 @@ static void rmnet_force_unassociate_device(struct net_device *dev)
 
         ASSERT_RTNL();
 
-        d.real_dev = real_dev;
-        d.head = &list;
-
         port = rmnet_get_port_rtnl(dev);
-        d.port = port;
 
         rcu_read_lock();
         rmnet_unregister_bridge(dev, port);
 
-        netdev_walk_all_lower_dev_rcu(real_dev, rmnet_dev_walk_unreg, &d);
+        hash_for_each_safe(port->muxed_ep, bkt_ep, tmp_ep, ep, hlnode) {
+                unregister_netdevice_queue(ep->egress_dev, &list);
+                rmnet_vnd_dellink(ep->mux_id, port, ep);
+
+                hlist_del_init_rcu(&ep->hlnode);
+                kfree(ep);
+        }
+
         rcu_read_unlock();
         unregister_netdevice_many(&list);
 
@@ -422,11 +388,6 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
         if (err)
                 return -EBUSY;
 
-        err = netdev_master_upper_dev_link(slave_dev, rmnet_dev, NULL, NULL,
-                                           extack);
-        if (err)
-                return -EINVAL;
-
         slave_port = rmnet_get_port(slave_dev);
         slave_port->rmnet_mode = RMNET_EPMODE_BRIDGE;
         slave_port->bridge_ep = real_dev;
@@ -449,7 +410,6 @@ int rmnet_del_bridge(struct net_device *rmnet_dev,
         port->rmnet_mode = RMNET_EPMODE_VND;
         port->bridge_ep = NULL;
 
-        netdev_upper_dev_unlink(slave_dev, rmnet_dev);
         slave_port = rmnet_get_port(slave_dev);
         rmnet_unregister_real_device(slave_dev, slave_port);
 
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
index 6bc328fb88e1..b0dbca070c00 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
@@ -38,6 +38,11 @@ static u8 rmnet_map_do_flow_control(struct sk_buff *skb,
         }
 
         ep = rmnet_get_endpoint(port, mux_id);
+        if (!ep) {
+                kfree_skb(skb);
+                return RX_HANDLER_CONSUMED;
+        }
+
         vnd = ep->egress_dev;
 
         ip_family = cmd->flow_control.ip_family;
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
index 570a227acdd8..346d310914df 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
@@ -121,7 +121,7 @@ static void rmnet_get_stats64(struct net_device *dev,
         memset(&total_stats, 0, sizeof(struct rmnet_vnd_stats));
 
         for_each_possible_cpu(cpu) {
-                pcpu_ptr = this_cpu_ptr(priv->pcpu_stats);
+                pcpu_ptr = per_cpu_ptr(priv->pcpu_stats, cpu);
 
                 do {
                         start = u64_stats_fetch_begin_irq(&pcpu_ptr->syncp);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 81e6cc951e7f..b52258c327d2 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1489,27 +1489,23 @@ static struct sk_buff *tun_napi_alloc_frags(struct tun_file *tfile,
         skb->truesize += skb->data_len;
 
         for (i = 1; i < it->nr_segs; i++) {
+                struct page_frag *pfrag = &current->task_frag;
                 size_t fragsz = it->iov[i].iov_len;
-                unsigned long offset;
-                struct page *page;
-                void *data;
 
                 if (fragsz == 0 || fragsz > PAGE_SIZE) {
                         err = -EINVAL;
                         goto free;
                 }
 
-                local_bh_disable();
-                data = napi_alloc_frag(fragsz);
-                local_bh_enable();
-                if (!data) {
+                if (!skb_page_frag_refill(fragsz, pfrag, GFP_KERNEL)) {
                         err = -ENOMEM;
                         goto free;
                 }
 
-                page = virt_to_head_page(data);
-                offset = data - page_address(page);
-                skb_fill_page_desc(skb, i - 1, page, offset, fragsz);
+                skb_fill_page_desc(skb, i - 1, pfrag->page,
+                                   pfrag->offset, fragsz);
+                page_ref_inc(pfrag->page);
+                pfrag->offset += fragsz;
         }
 
         return skb;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 626c27352ae2..9bb9e562b893 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -443,12 +443,8 @@ static bool __virtnet_xdp_xmit(struct virtnet_info *vi,
         sg_init_one(sq->sg, xdp->data, xdp->data_end - xdp->data);
 
         err = virtqueue_add_outbuf(sq->vq, sq->sg, 1, xdp->data, GFP_ATOMIC);
-        if (unlikely(err)) {
-                struct page *page = virt_to_head_page(xdp->data);
-
-                put_page(page);
-                return false;
-        }
+        if (unlikely(err))
+                return false; /* Caller handle free/refcnt */
 
         return true;
 }
@@ -456,8 +452,18 @@ static bool __virtnet_xdp_xmit(struct virtnet_info *vi,
 static int virtnet_xdp_xmit(struct net_device *dev, struct xdp_buff *xdp)
 {
         struct virtnet_info *vi = netdev_priv(dev);
-        bool sent = __virtnet_xdp_xmit(vi, xdp);
+        struct receive_queue *rq = vi->rq;
+        struct bpf_prog *xdp_prog;
+        bool sent;
 
+        /* Only allow ndo_xdp_xmit if XDP is loaded on dev, as this
+         * indicate XDP resources have been successfully allocated.
+         */
+        xdp_prog = rcu_dereference(rq->xdp_prog);
+        if (!xdp_prog)
+                return -ENXIO;
+
+        sent = __virtnet_xdp_xmit(vi, xdp);
         if (!sent)
                 return -ENOSPC;
         return 0;
@@ -546,8 +552,11 @@ static struct sk_buff *receive_small(struct net_device *dev,
         unsigned int buflen = SKB_DATA_ALIGN(GOOD_PACKET_LEN + headroom) +
                               SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
         struct page *page = virt_to_head_page(buf);
-        unsigned int delta = 0, err;
+        unsigned int delta = 0;
         struct page *xdp_page;
+        bool sent;
+        int err;
+
         len -= vi->hdr_len;
 
         rcu_read_lock();
@@ -558,7 +567,7 @@ static struct sk_buff *receive_small(struct net_device *dev,
                 void *orig_data;
                 u32 act;
 
-                if (unlikely(hdr->hdr.gso_type || hdr->hdr.flags))
+                if (unlikely(hdr->hdr.gso_type))
                         goto err_xdp;
 
                 if (unlikely(xdp_headroom < virtnet_get_headroom(vi))) {
@@ -596,16 +605,19 @@ static struct sk_buff *receive_small(struct net_device *dev,
                         delta = orig_data - xdp.data;
                         break;
                 case XDP_TX:
-                        if (unlikely(!__virtnet_xdp_xmit(vi, &xdp)))
+                        sent = __virtnet_xdp_xmit(vi, &xdp);
+                        if (unlikely(!sent)) {
                                 trace_xdp_exception(vi->dev, xdp_prog, act);
-                        else
-                                *xdp_xmit = true;
+                                goto err_xdp;
+                        }
+                        *xdp_xmit = true;
                         rcu_read_unlock();
                         goto xdp_xmit;
                 case XDP_REDIRECT:
                         err = xdp_do_redirect(dev, &xdp, xdp_prog);
-                        if (!err)
-                                *xdp_xmit = true;
+                        if (err)
+                                goto err_xdp;
+                        *xdp_xmit = true;
                         rcu_read_unlock();
                         goto xdp_xmit;
                 default:
@@ -677,7 +689,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
         struct bpf_prog *xdp_prog;
         unsigned int truesize;
         unsigned int headroom = mergeable_ctx_to_headroom(ctx);
-        int err;
+        bool sent;
 
         head_skb = NULL;
 
@@ -746,20 +758,18 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
                         }
                         break;
                 case XDP_TX:
-                        if (unlikely(!__virtnet_xdp_xmit(vi, &xdp)))
+                        sent = __virtnet_xdp_xmit(vi, &xdp);
+                        if (unlikely(!sent)) {
                                 trace_xdp_exception(vi->dev, xdp_prog, act);
-                        else
-                                *xdp_xmit = true;
+                                if (unlikely(xdp_page != page))
+                                        put_page(xdp_page);
+                                goto err_xdp;
+                        }
+                        *xdp_xmit = true;
                         if (unlikely(xdp_page != page))
                                 goto err_xdp;
                         rcu_read_unlock();
                         goto xdp_xmit;
-                case XDP_REDIRECT:
-                        err = xdp_do_redirect(dev, &xdp, xdp_prog);
-                        if (!err)
-                                *xdp_xmit = true;
-                        rcu_read_unlock();
-                        goto xdp_xmit;
                 default:
                         bpf_warn_invalid_xdp_action(act);
                 case XDP_ABORTED:
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index f431c32774f3..0fe7ea35c221 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -120,8 +120,12 @@ int nvme_reset_ctrl_sync(struct nvme_ctrl *ctrl)
         int ret;
 
         ret = nvme_reset_ctrl(ctrl);
-        if (!ret)
+        if (!ret) {
                 flush_work(&ctrl->reset_work);
+                if (ctrl->state != NVME_CTRL_LIVE)
+                        ret = -ENETRESET;
+        }
+
         return ret;
 }
 EXPORT_SYMBOL_GPL(nvme_reset_ctrl_sync);
@@ -265,7 +269,7 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
         switch (new_state) {
         case NVME_CTRL_ADMIN_ONLY:
                 switch (old_state) {
-                case NVME_CTRL_RECONNECTING:
+                case NVME_CTRL_CONNECTING:
                         changed = true;
                         /* FALLTHRU */
                 default:
@@ -276,7 +280,7 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
                 switch (old_state) {
                 case NVME_CTRL_NEW:
                 case NVME_CTRL_RESETTING:
-                case NVME_CTRL_RECONNECTING:
+                case NVME_CTRL_CONNECTING:
                         changed = true;
                         /* FALLTHRU */
                 default:
@@ -294,9 +298,9 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
                         break;
                 }
                 break;
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 switch (old_state) {
-                case NVME_CTRL_LIVE:
+                case NVME_CTRL_NEW:
                 case NVME_CTRL_RESETTING:
                         changed = true;
                         /* FALLTHRU */
@@ -309,7 +313,7 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
                 case NVME_CTRL_LIVE:
                 case NVME_CTRL_ADMIN_ONLY:
                 case NVME_CTRL_RESETTING:
-                case NVME_CTRL_RECONNECTING:
+                case NVME_CTRL_CONNECTING:
                         changed = true;
                         /* FALLTHRU */
                 default:
@@ -518,9 +522,11 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
                 u64 slba = nvme_block_nr(ns, bio->bi_iter.bi_sector);
                 u32 nlb = bio->bi_iter.bi_size >> ns->lba_shift;
 
-                range[n].cattr = cpu_to_le32(0);
-                range[n].nlb = cpu_to_le32(nlb);
-                range[n].slba = cpu_to_le64(slba);
+                if (n < segments) {
+                        range[n].cattr = cpu_to_le32(0);
+                        range[n].nlb = cpu_to_le32(nlb);
+                        range[n].slba = cpu_to_le64(slba);
+                }
                 n++;
         }
 
@@ -794,13 +800,9 @@ static void nvme_keep_alive_end_io(struct request *rq, blk_status_t status)
 
 static int nvme_keep_alive(struct nvme_ctrl *ctrl)
 {
-        struct nvme_command c;
         struct request *rq;
 
-        memset(&c, 0, sizeof(c));
-        c.common.opcode = nvme_admin_keep_alive;
-
-        rq = nvme_alloc_request(ctrl->admin_q, &c, BLK_MQ_REQ_RESERVED,
+        rq = nvme_alloc_request(ctrl->admin_q, &ctrl->ka_cmd, BLK_MQ_REQ_RESERVED,
                         NVME_QID_ANY);
         if (IS_ERR(rq))
                 return PTR_ERR(rq);
@@ -832,6 +834,8 @@ void nvme_start_keep_alive(struct nvme_ctrl *ctrl)
                 return;
 
         INIT_DELAYED_WORK(&ctrl->ka_work, nvme_keep_alive_work);
+        memset(&ctrl->ka_cmd, 0, sizeof(ctrl->ka_cmd));
+        ctrl->ka_cmd.common.opcode = nvme_admin_keep_alive;
         schedule_delayed_work(&ctrl->ka_work, ctrl->kato * HZ);
 }
 EXPORT_SYMBOL_GPL(nvme_start_keep_alive);
@@ -1117,14 +1121,19 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
 
 static void nvme_update_formats(struct nvme_ctrl *ctrl)
 {
-        struct nvme_ns *ns;
+        struct nvme_ns *ns, *next;
+        LIST_HEAD(rm_list);
 
         mutex_lock(&ctrl->namespaces_mutex);
         list_for_each_entry(ns, &ctrl->namespaces, list) {
-                if (ns->disk && nvme_revalidate_disk(ns->disk))
-                        nvme_ns_remove(ns);
+                if (ns->disk && nvme_revalidate_disk(ns->disk)) {
+                        list_move_tail(&ns->list, &rm_list);
+                }
         }
         mutex_unlock(&ctrl->namespaces_mutex);
+
+        list_for_each_entry_safe(ns, next, &rm_list, list)
+                nvme_ns_remove(ns);
 }
 
 static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
@@ -2687,7 +2696,7 @@ static ssize_t nvme_sysfs_show_state(struct device *dev,
                 [NVME_CTRL_LIVE]        = "live",
                 [NVME_CTRL_ADMIN_ONLY]  = "only-admin",
                 [NVME_CTRL_RESETTING]   = "resetting",
-                [NVME_CTRL_RECONNECTING]= "reconnecting",
+                [NVME_CTRL_CONNECTING]  = "connecting",
                 [NVME_CTRL_DELETING]    = "deleting",
                 [NVME_CTRL_DEAD]        = "dead",
         };
diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h
index 25b19f722f5b..a3145d90c1d2 100644
--- a/drivers/nvme/host/fabrics.h
+++ b/drivers/nvme/host/fabrics.h
@@ -171,13 +171,14 @@ static inline blk_status_t nvmf_check_init_req(struct nvme_ctrl *ctrl,
             cmd->common.opcode != nvme_fabrics_command ||
             cmd->fabrics.fctype != nvme_fabrics_type_connect) {
                 /*
-                 * Reconnecting state means transport disruption, which can take
-                 * a long time and even might fail permanently, fail fast to
-                 * give upper layers a chance to failover.
+                 * Connecting state means transport disruption or initial
+                 * establishment, which can take a long time and even might
+                 * fail permanently, fail fast to give upper layers a chance
+                 * to failover.
                  * Deleting state means that the ctrl will never accept commands
                  * again, fail it permanently.
                  */
-                if (ctrl->state == NVME_CTRL_RECONNECTING ||
+                if (ctrl->state == NVME_CTRL_CONNECTING ||
                     ctrl->state == NVME_CTRL_DELETING) {
                         nvme_req(rq)->status = NVME_SC_ABORT_REQ;
                         return BLK_STS_IOERR;
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index b856d7c919d2..7f51f8414b97 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -55,9 +55,7 @@ struct nvme_fc_queue {
 
 enum nvme_fcop_flags {
         FCOP_FLAGS_TERMIO       = (1 << 0),
-        FCOP_FLAGS_RELEASED     = (1 << 1),
-        FCOP_FLAGS_COMPLETE     = (1 << 2),
-        FCOP_FLAGS_AEN          = (1 << 3),
+        FCOP_FLAGS_AEN          = (1 << 1),
 };
 
 struct nvmefc_ls_req_op {
@@ -532,7 +530,7 @@ nvme_fc_resume_controller(struct nvme_fc_ctrl *ctrl)
 {
         switch (ctrl->ctrl.state) {
         case NVME_CTRL_NEW:
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 /*
                  * As all reconnects were suppressed, schedule a
                  * connect.
@@ -777,7 +775,7 @@ nvme_fc_ctrl_connectivity_loss(struct nvme_fc_ctrl *ctrl)
                 }
                 break;
 
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 /*
                  * The association has already been terminated and the
                  * controller is attempting reconnects.  No need to do anything
@@ -1470,7 +1468,6 @@ nvme_fc_xmt_disconnect_assoc(struct nvme_fc_ctrl *ctrl)
 
 /* *********************** NVME Ctrl Routines **************************** */
 
-static void __nvme_fc_final_op_cleanup(struct request *rq);
 static void nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg);
 
 static int
@@ -1512,13 +1509,19 @@ nvme_fc_exit_request(struct blk_mq_tag_set *set, struct request *rq,
 static int
 __nvme_fc_abort_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_fcp_op *op)
 {
-        int state;
+        unsigned long flags;
+        int opstate;
+
+        spin_lock_irqsave(&ctrl->lock, flags);
+        opstate = atomic_xchg(&op->state, FCPOP_STATE_ABORTED);
+        if (opstate != FCPOP_STATE_ACTIVE)
+                atomic_set(&op->state, opstate);
+        else if (ctrl->flags & FCCTRL_TERMIO)
+                ctrl->iocnt++;
+        spin_unlock_irqrestore(&ctrl->lock, flags);
 
-        state = atomic_xchg(&op->state, FCPOP_STATE_ABORTED);
-        if (state != FCPOP_STATE_ACTIVE) {
-                atomic_set(&op->state, state);
+        if (opstate != FCPOP_STATE_ACTIVE)
                 return -ECANCELED;
-        }
 
         ctrl->lport->ops->fcp_abort(&ctrl->lport->localport,
                                         &ctrl->rport->remoteport,
@@ -1532,60 +1535,26 @@ static void
 nvme_fc_abort_aen_ops(struct nvme_fc_ctrl *ctrl)
 {
         struct nvme_fc_fcp_op *aen_op = ctrl->aen_ops;
-        unsigned long flags;
-        int i, ret;
-
-        for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++) {
-                if (atomic_read(&aen_op->state) != FCPOP_STATE_ACTIVE)
-                        continue;
-
-                spin_lock_irqsave(&ctrl->lock, flags);
-                if (ctrl->flags & FCCTRL_TERMIO) {
-                        ctrl->iocnt++;
-                        aen_op->flags |= FCOP_FLAGS_TERMIO;
-                }
-                spin_unlock_irqrestore(&ctrl->lock, flags);
-
-                ret = __nvme_fc_abort_op(ctrl, aen_op);
-                if (ret) {
-                        /*
-                         * if __nvme_fc_abort_op failed the io wasn't
-                         * active. Thus this call path is running in
-                         * parallel to the io complete. Treat as non-error.
-                         */
+        int i;
 
-                        /* back out the flags/counters */
-                        spin_lock_irqsave(&ctrl->lock, flags);
-                        if (ctrl->flags & FCCTRL_TERMIO)
-                                ctrl->iocnt--;
-                        aen_op->flags &= ~FCOP_FLAGS_TERMIO;
-                        spin_unlock_irqrestore(&ctrl->lock, flags);
-                        return;
-                }
-        }
+        for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++)
+                __nvme_fc_abort_op(ctrl, aen_op);
 }
 
-static inline int
+static inline void
 __nvme_fc_fcpop_chk_teardowns(struct nvme_fc_ctrl *ctrl,
-                struct nvme_fc_fcp_op *op)
+                struct nvme_fc_fcp_op *op, int opstate)
 {
         unsigned long flags;
-        bool complete_rq = false;
 
-        spin_lock_irqsave(&ctrl->lock, flags);
-        if (unlikely(op->flags & FCOP_FLAGS_TERMIO)) {
+        if (opstate == FCPOP_STATE_ABORTED) {
+                spin_lock_irqsave(&ctrl->lock, flags);
                 if (ctrl->flags & FCCTRL_TERMIO) {
                         if (!--ctrl->iocnt)
                                 wake_up(&ctrl->ioabort_wait);
                 }
+                spin_unlock_irqrestore(&ctrl->lock, flags);
         }
-        if (op->flags & FCOP_FLAGS_RELEASED)
-                complete_rq = true;
-        else
-                op->flags |= FCOP_FLAGS_COMPLETE;
-        spin_unlock_irqrestore(&ctrl->lock, flags);
-
-        return complete_rq;
 }
 
 static void
@@ -1601,6 +1570,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
         __le16 status = cpu_to_le16(NVME_SC_SUCCESS << 1);
         union nvme_result result;
         bool terminate_assoc = true;
+        int opstate;
 
         /*
          * WARNING:
@@ -1639,11 +1609,12 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
          * association to be terminated.
          */
 
+        opstate = atomic_xchg(&op->state, FCPOP_STATE_COMPLETE);
+
         fc_dma_sync_single_for_cpu(ctrl->lport->dev, op->fcp_req.rspdma,
                                 sizeof(op->rsp_iu), DMA_FROM_DEVICE);
 
-        if (atomic_read(&op->state) == FCPOP_STATE_ABORTED ||
-                        op->flags & FCOP_FLAGS_TERMIO)
+        if (opstate == FCPOP_STATE_ABORTED)
                 status = cpu_to_le16(NVME_SC_ABORT_REQ << 1);
         else if (freq->status)
                 status = cpu_to_le16(NVME_SC_INTERNAL << 1);
@@ -1708,7 +1679,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
 done:
         if (op->flags & FCOP_FLAGS_AEN) {
                 nvme_complete_async_event(&queue->ctrl->ctrl, status, &result);
-                __nvme_fc_fcpop_chk_teardowns(ctrl, op);
+                __nvme_fc_fcpop_chk_teardowns(ctrl, op, opstate);
                 atomic_set(&op->state, FCPOP_STATE_IDLE);
                 op->flags = FCOP_FLAGS_AEN;     /* clear other flags */
                 nvme_fc_ctrl_put(ctrl);
@@ -1722,13 +1693,11 @@ done:
         if (status &&
             (blk_queue_dying(rq->q) ||
              ctrl->ctrl.state == NVME_CTRL_NEW ||
-             ctrl->ctrl.state == NVME_CTRL_RECONNECTING))
+             ctrl->ctrl.state == NVME_CTRL_CONNECTING))
                 status |= cpu_to_le16(NVME_SC_DNR << 1);
 
-        if (__nvme_fc_fcpop_chk_teardowns(ctrl, op))
-                __nvme_fc_final_op_cleanup(rq);
-        else
-                nvme_end_request(rq, status, result);
+        __nvme_fc_fcpop_chk_teardowns(ctrl, op, opstate);
+        nvme_end_request(rq, status, result);
 
 check_error:
         if (terminate_assoc)
@@ -2415,46 +2384,16 @@ nvme_fc_submit_async_event(struct nvme_ctrl *arg)
 }
 
 static void
-__nvme_fc_final_op_cleanup(struct request *rq)
+nvme_fc_complete_rq(struct request *rq)
 {
         struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(rq);
         struct nvme_fc_ctrl *ctrl = op->ctrl;
 
         atomic_set(&op->state, FCPOP_STATE_IDLE);
-        op->flags &= ~(FCOP_FLAGS_TERMIO | FCOP_FLAGS_RELEASED |
-                        FCOP_FLAGS_COMPLETE);
 
         nvme_fc_unmap_data(ctrl, rq, op);
         nvme_complete_rq(rq);
         nvme_fc_ctrl_put(ctrl);
-
-}
-
-static void
-nvme_fc_complete_rq(struct request *rq)
-{
-        struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(rq);
-        struct nvme_fc_ctrl *ctrl = op->ctrl;
-        unsigned long flags;
-        bool completed = false;
-
-        /*
-         * the core layer, on controller resets after calling
-         * nvme_shutdown_ctrl(), calls complete_rq without our
-         * calling blk_mq_complete_request(), thus there may still
-         * be live i/o outstanding with the LLDD. Means transport has
-         * to track complete calls vs fcpio_done calls to know what
-         * path to take on completes and dones.
-         */
-        spin_lock_irqsave(&ctrl->lock, flags);
-        if (op->flags & FCOP_FLAGS_COMPLETE)
-                completed = true;
-        else
-                op->flags |= FCOP_FLAGS_RELEASED;
-        spin_unlock_irqrestore(&ctrl->lock, flags);
-
-        if (completed)
-                __nvme_fc_final_op_cleanup(rq);
 }
 
 /*
@@ -2476,35 +2415,11 @@ nvme_fc_terminate_exchange(struct request *req, void *data, bool reserved)
         struct nvme_ctrl *nctrl = data;
         struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
         struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(req);
-        unsigned long flags;
-        int status;
 
         if (!blk_mq_request_started(req))
                 return;
 
-        spin_lock_irqsave(&ctrl->lock, flags);
-        if (ctrl->flags & FCCTRL_TERMIO) {
-                ctrl->iocnt++;
-                op->flags |= FCOP_FLAGS_TERMIO;
-        }
-        spin_unlock_irqrestore(&ctrl->lock, flags);
-
-        status = __nvme_fc_abort_op(ctrl, op);
-        if (status) {
-                /*
-                 * if __nvme_fc_abort_op failed the io wasn't
-                 * active. Thus this call path is running in
-                 * parallel to the io complete. Treat as non-error.
-                 */
-
-                /* back out the flags/counters */
-                spin_lock_irqsave(&ctrl->lock, flags);
-                if (ctrl->flags & FCCTRL_TERMIO)
-                        ctrl->iocnt--;
-                op->flags &= ~FCOP_FLAGS_TERMIO;
-                spin_unlock_irqrestore(&ctrl->lock, flags);
-                return;
-        }
+        __nvme_fc_abort_op(ctrl, op);
 }
 
 
@@ -2943,7 +2858,7 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
         unsigned long recon_delay = ctrl->ctrl.opts->reconnect_delay * HZ;
         bool recon = true;
 
-        if (ctrl->ctrl.state != NVME_CTRL_RECONNECTING)
+        if (ctrl->ctrl.state != NVME_CTRL_CONNECTING)
                 return;
 
         if (portptr->port_state == FC_OBJSTATE_ONLINE)
@@ -2991,10 +2906,10 @@ nvme_fc_reset_ctrl_work(struct work_struct *work)
         /* will block will waiting for io to terminate */
         nvme_fc_delete_association(ctrl);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
                 dev_err(ctrl->ctrl.device,
                         "NVME-FC{%d}: error_recovery: Couldn't change state "
-                        "to RECONNECTING\n", ctrl->cnum);
+                        "to CONNECTING\n", ctrl->cnum);
                 return;
         }
 
@@ -3195,7 +3110,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
          * transport errors (frame drop, LS failure) inherently must kill
          * the association. The transport is coded so that any command used
          * to create the association (prior to a LIVE state transition
-         * while NEW or RECONNECTING) will fail if it completes in error or
+         * while NEW or CONNECTING) will fail if it completes in error or
          * times out.
          *
          * As such: as the connect request was mostly likely due to a
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 8e4550fa08f8..0521e4707d1c 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -123,7 +123,7 @@ enum nvme_ctrl_state {
         NVME_CTRL_LIVE,
         NVME_CTRL_ADMIN_ONLY,    /* Only admin queue live */
         NVME_CTRL_RESETTING,
-        NVME_CTRL_RECONNECTING,
+        NVME_CTRL_CONNECTING,
         NVME_CTRL_DELETING,
         NVME_CTRL_DEAD,
 };
@@ -183,6 +183,7 @@ struct nvme_ctrl {
         struct work_struct scan_work;
         struct work_struct async_event_work;
         struct delayed_work ka_work;
+        struct nvme_command ka_cmd;
         struct work_struct fw_act_work;
 
         /* Power saving configuration */
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 6fe7af00a1f4..73036d2fbbd5 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1141,7 +1141,7 @@ static bool nvme_should_reset(struct nvme_dev *dev, u32 csts)
         /* If there is a reset/reinit ongoing, we shouldn't reset again. */
         switch (dev->ctrl.state) {
         case NVME_CTRL_RESETTING:
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 return false;
         default:
                 break;
@@ -1215,13 +1215,17 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
          * cancellation error. All outstanding requests are completed on
          * shutdown, so we return BLK_EH_HANDLED.
          */
-        if (dev->ctrl.state == NVME_CTRL_RESETTING) {
+        switch (dev->ctrl.state) {
+        case NVME_CTRL_CONNECTING:
+        case NVME_CTRL_RESETTING:
                 dev_warn(dev->ctrl.device,
                          "I/O %d QID %d timeout, disable controller\n",
                          req->tag, nvmeq->qid);
                 nvme_dev_disable(dev, false);
                 nvme_req(req)->flags |= NVME_REQ_CANCELLED;
                 return BLK_EH_HANDLED;
+        default:
+                break;
         }
 
         /*
@@ -1364,18 +1368,14 @@ static int nvme_cmb_qdepth(struct nvme_dev *dev, int nr_io_queues,
 static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq,
                                 int qid, int depth)
 {
-        if (qid && dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS)) {
-                unsigned offset = (qid - 1) * roundup(SQ_SIZE(depth),
-                                                      dev->ctrl.page_size);
-                nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset;
-                nvmeq->sq_cmds_io = dev->cmb + offset;
-        } else {
-                nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
-                                        &nvmeq->sq_dma_addr, GFP_KERNEL);
-                if (!nvmeq->sq_cmds)
-                        return -ENOMEM;
-        }
+        /* CMB SQEs will be mapped before creation */
+        if (qid && dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS))
+                return 0;
 
+        nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
+                                            &nvmeq->sq_dma_addr, GFP_KERNEL);
+        if (!nvmeq->sq_cmds)
+                return -ENOMEM;
         return 0;
 }
 
@@ -1449,6 +1449,13 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
         struct nvme_dev *dev = nvmeq->dev;
         int result;
 
+        if (dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS)) {
+                unsigned offset = (qid - 1) * roundup(SQ_SIZE(nvmeq->q_depth),
+                                                      dev->ctrl.page_size);
+                nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset;
+                nvmeq->sq_cmds_io = dev->cmb + offset;
+        }
+
         nvmeq->cq_vector = qid - 1;
         result = adapter_alloc_cq(dev, qid, nvmeq);
         if (result < 0)
@@ -2288,12 +2295,12 @@ static void nvme_reset_work(struct work_struct *work)
                 nvme_dev_disable(dev, false);
 
         /*
-         * Introduce RECONNECTING state from nvme-fc/rdma transports to mark the
+         * Introduce CONNECTING state from nvme-fc/rdma transports to mark the
          * initializing procedure here.
          */
-        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_CONNECTING)) {
                 dev_warn(dev->ctrl.device,
-                        "failed to mark controller RECONNECTING\n");
+                        "failed to mark controller CONNECTING\n");
                 goto out;
         }
 
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 2bc059f7d73c..3a51ed50eff2 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -887,7 +887,7 @@ free_ctrl:
 static void nvme_rdma_reconnect_or_remove(struct nvme_rdma_ctrl *ctrl)
 {
         /* If we are resetting/deleting then do nothing */
-        if (ctrl->ctrl.state != NVME_CTRL_RECONNECTING) {
+        if (ctrl->ctrl.state != NVME_CTRL_CONNECTING) {
                 WARN_ON_ONCE(ctrl->ctrl.state == NVME_CTRL_NEW ||
                         ctrl->ctrl.state == NVME_CTRL_LIVE);
                 return;
@@ -973,7 +973,7 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
         blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
         nvme_start_queues(&ctrl->ctrl);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
                 /* state change failure should never happen */
                 WARN_ON_ONCE(1);
                 return;
@@ -1756,7 +1756,7 @@ static void nvme_rdma_reset_ctrl_work(struct work_struct *work)
         nvme_stop_ctrl(&ctrl->ctrl);
         nvme_rdma_shutdown_ctrl(ctrl, false);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
                 /* state change failure should never happen */
                 WARN_ON_ONCE(1);
                 return;
@@ -1784,11 +1784,8 @@ static void nvme_rdma_reset_ctrl_work(struct work_struct *work)
         return;
 
 out_fail:
-        dev_warn(ctrl->ctrl.device, "Removing after reset failure\n");
-        nvme_remove_namespaces(&ctrl->ctrl);
-        nvme_rdma_shutdown_ctrl(ctrl, true);
-        nvme_uninit_ctrl(&ctrl->ctrl);
-        nvme_put_ctrl(&ctrl->ctrl);
+        ++ctrl->ctrl.nr_reconnects;
+        nvme_rdma_reconnect_or_remove(ctrl);
 }
 
 static const struct nvme_ctrl_ops nvme_rdma_ctrl_ops = {
@@ -1942,6 +1939,9 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
         if (!ctrl->queues)
                 goto out_uninit_ctrl;
 
+        changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING);
+        WARN_ON_ONCE(!changed);
+
         ret = nvme_rdma_configure_admin_queue(ctrl, true);
         if (ret)
                 goto out_kfree_queues;
diff --git a/drivers/nvme/target/io-cmd.c b/drivers/nvme/target/io-cmd.c
index 0a4372a016f2..28bbdff4a88b 100644
--- a/drivers/nvme/target/io-cmd.c
+++ b/drivers/nvme/target/io-cmd.c
@@ -105,10 +105,13 @@ static void nvmet_execute_flush(struct nvmet_req *req)
 static u16 nvmet_discard_range(struct nvmet_ns *ns,
                 struct nvme_dsm_range *range, struct bio **bio)
 {
-        if (__blkdev_issue_discard(ns->bdev,
+        int ret;
+
+        ret = __blkdev_issue_discard(ns->bdev,
                         le64_to_cpu(range->slba) << (ns->blksize_shift - 9),
                         le32_to_cpu(range->nlb) << (ns->blksize_shift - 9),
-                        GFP_KERNEL, 0, bio))
+                        GFP_KERNEL, 0, bio);
+        if (ret && ret != -EOPNOTSUPP)
                 return NVME_SC_INTERNAL | NVME_SC_DNR;
         return 0;
 }
diff --git a/drivers/of/property.c b/drivers/of/property.c
index 36ed84e26d9c..f46828e3b082 100644
--- a/drivers/of/property.c
+++ b/drivers/of/property.c
@@ -977,11 +977,11 @@ static int of_fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,
         return 0;
 }
 
-static void *
+static const void *
 of_fwnode_device_get_match_data(const struct fwnode_handle *fwnode,
                                 const struct device *dev)
 {
-        return (void *)of_device_get_match_data(dev);
+        return of_device_get_match_data(dev);
 }
 
 const struct fwnode_operations of_fwnode_ops = {
diff --git a/drivers/opp/cpu.c b/drivers/opp/cpu.c
index 2d87bc1adf38..0c0910709435 100644
--- a/drivers/opp/cpu.c
+++ b/drivers/opp/cpu.c
@@ -55,7 +55,7 @@ int dev_pm_opp_init_cpufreq_table(struct device *dev,
         if (max_opps <= 0)
                 return max_opps ? max_opps : -ENODATA;
 
-        freq_table = kcalloc((max_opps + 1), sizeof(*freq_table), GFP_ATOMIC);
+        freq_table = kcalloc((max_opps + 1), sizeof(*freq_table), GFP_KERNEL);
         if (!freq_table)
                 return -ENOMEM;
 
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index fc734014206f..8b14bd326d4a 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3419,22 +3419,29 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PORT_RIDGE,
 
 static void quirk_chelsio_extend_vpd(struct pci_dev *dev)
 {
-        pci_set_vpd_size(dev, 8192);
-}
-
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x20, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x21, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x22, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x23, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x24, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x25, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x26, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x30, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x31, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x32, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x35, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x36, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x37, quirk_chelsio_extend_vpd);
+        int chip = (dev->device & 0xf000) >> 12;
+        int func = (dev->device & 0x0f00) >>  8;
+        int prod = (dev->device & 0x00ff) >>  0;
+
+        /*
+         * If this is a T3-based adapter, there's a 1KB VPD area at offset
+         * 0xc00 which contains the preferred VPD values.  If this is a T4 or
+         * later based adapter, the special VPD is at offset 0x400 for the
+         * Physical Functions (the SR-IOV Virtual Functions have no VPD
+         * Capabilities).  The PCI VPD Access core routines will normally
+         * compute the size of the VPD by parsing the VPD Data Structure at
+         * offset 0x000.  This will result in silent failures when attempting
+         * to accesses these other VPD areas which are beyond those computed
+         * limits.
+         */
+        if (chip == 0x0 && prod >= 0x20)
+                pci_set_vpd_size(dev, 8192);
+        else if (chip >= 0x4 && func < 0x8)
+                pci_set_vpd_size(dev, 2048);
+}
+
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, PCI_ANY_ID,
+                        quirk_chelsio_extend_vpd);
 
 #ifdef CONFIG_ACPI
 /*
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index 2a68f59d2228..c52c6723374b 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -127,24 +127,6 @@ static const struct dmi_system_id dell_device_table[] __initconst = {
                 },
         },
         {
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_CHASSIS_TYPE, "30"), /*Tablet*/
-                },
-        },
-        {
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /*Convertible*/
-                },
-        },
-        {
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_CHASSIS_TYPE, "32"), /*Detachable*/
-                },
-        },
-        {
                 .ident = "Dell Computer Corporation",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
@@ -1279,7 +1261,7 @@ static int kbd_get_state(struct kbd_state *state)
         struct calling_interface_buffer buffer;
         int ret;
 
-        dell_fill_request(&buffer, 0, 0, 0, 0);
+        dell_fill_request(&buffer, 0x1, 0, 0, 0);
         ret = dell_send_request(&buffer,
                                 CLASS_KBD_BACKLIGHT, SELECT_KBD_BACKLIGHT);
         if (ret)
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 5b6f18b18801..535199c9e6bc 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -113,7 +113,7 @@ MODULE_PARM_DESC(no_bt_rfkill, "No rfkill for bluetooth.");
 /*
  * ACPI Helpers
  */
-#define IDEAPAD_EC_TIMEOUT (100) /* in ms */
+#define IDEAPAD_EC_TIMEOUT (200) /* in ms */
 
 static int read_method_int(acpi_handle handle, const char *method, int *val)
 {
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index daa68acbc900..c0c8945603cb 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -933,7 +933,7 @@ static int wmi_dev_probe(struct device *dev)
                         goto probe_failure;
                 }
 
-                buf = kmalloc(strlen(wdriver->driver.name) + 4, GFP_KERNEL);
+                buf = kmalloc(strlen(wdriver->driver.name) + 5, GFP_KERNEL);
                 if (!buf) {
                         ret = -ENOMEM;
                         goto probe_string_failure;
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index ba2e0856d22c..8f5c1d7f751a 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -1297,6 +1297,9 @@ static int virtio_ccw_cio_notify(struct ccw_device *cdev, int event)
                 vcdev->device_lost = true;
                 rc = NOTIFY_DONE;
                 break;
+        case CIO_OPER:
+                rc = NOTIFY_OK;
+                break;
         default:
                 rc = NOTIFY_DONE;
                 break;
@@ -1309,6 +1312,27 @@ static struct ccw_device_id virtio_ids[] = {
         {},
 };
 
+#ifdef CONFIG_PM_SLEEP
+static int virtio_ccw_freeze(struct ccw_device *cdev)
+{
+        struct virtio_ccw_device *vcdev = dev_get_drvdata(&cdev->dev);
+
+        return virtio_device_freeze(&vcdev->vdev);
+}
+
+static int virtio_ccw_restore(struct ccw_device *cdev)
+{
+        struct virtio_ccw_device *vcdev = dev_get_drvdata(&cdev->dev);
+        int ret;
+
+        ret = virtio_ccw_set_transport_rev(vcdev);
+        if (ret)
+                return ret;
+
+        return virtio_device_restore(&vcdev->vdev);
+}
+#endif
+
 static struct ccw_driver virtio_ccw_driver = {
         .driver = {
                 .owner = THIS_MODULE,
@@ -1321,6 +1345,11 @@ static struct ccw_driver virtio_ccw_driver = {
         .set_online = virtio_ccw_online,
         .notify = virtio_ccw_cio_notify,
         .int_class = IRQIO_VIR,
+#ifdef CONFIG_PM_SLEEP
+        .freeze = virtio_ccw_freeze,
+        .thaw = virtio_ccw_restore,
+        .restore = virtio_ccw_restore,
+#endif
 };
 
 static int __init pure_hex(char **cp, unsigned int *val, int min_digit,
diff --git a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
index 5064d5ddf581..fc2013aade51 100644
--- a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
+++ b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
@@ -73,6 +73,8 @@ static int __init its_fsl_mc_msi_init(void)
 
         for (np = of_find_matching_node(NULL, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller"))
                         continue;
 
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index f699abab1787..148f3ee70286 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -19,6 +19,12 @@ config USB_EHCI_BIG_ENDIAN_MMIO
 config USB_EHCI_BIG_ENDIAN_DESC
         bool
 
+config USB_UHCI_BIG_ENDIAN_MMIO
+        bool
+
+config USB_UHCI_BIG_ENDIAN_DESC
+        bool
+
 menuconfig USB_SUPPORT
         bool "USB support"
         depends on HAS_IOMEM
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 6150bed7cfa8..4fcfb3084b36 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -633,14 +633,6 @@ config USB_UHCI_ASPEED
        bool
        default y if ARCH_ASPEED
 
-config USB_UHCI_BIG_ENDIAN_MMIO
-        bool
-        default y if SPARC_LEON
-
-config USB_UHCI_BIG_ENDIAN_DESC
-        bool
-        default y if SPARC_LEON
-
 config USB_FHCI_HCD
         tristate "Freescale QE USB Host Controller support"
         depends on OF_GPIO && QE_GPIO && QUICC_ENGINE
diff --git a/drivers/video/fbdev/geode/video_gx.c b/drivers/video/fbdev/geode/video_gx.c
index 6082f653c68a..67773e8bbb95 100644
--- a/drivers/video/fbdev/geode/video_gx.c
+++ b/drivers/video/fbdev/geode/video_gx.c
@@ -127,7 +127,7 @@ void gx_set_dclk_frequency(struct fb_info *info)
         int timeout = 1000;
 
         /* Rev. 1 Geode GXs use a 14 MHz reference clock instead of 48 MHz. */
-        if (cpu_data(0).x86_mask == 1) {
+        if (cpu_data(0).x86_stepping == 1) {
                 pll_table = gx_pll_table_14MHz;
                 pll_table_len = ARRAY_SIZE(gx_pll_table_14MHz);
         } else {
diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
index 753d9cb437d0..aedbee3b2838 100644
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@ -60,6 +60,7 @@ struct sock_mapping {
         bool active_socket;
         struct list_head list;
         struct socket *sock;
+        atomic_t refcount;
         union {
                 struct {
                         int irq;
@@ -93,6 +94,32 @@ struct sock_mapping {
         };
 };
 
+static inline struct sock_mapping *pvcalls_enter_sock(struct socket *sock)
+{
+        struct sock_mapping *map;
+
+        if (!pvcalls_front_dev ||
+                dev_get_drvdata(&pvcalls_front_dev->dev) == NULL)
+                return ERR_PTR(-ENOTCONN);
+
+        map = (struct sock_mapping *)sock->sk->sk_send_head;
+        if (map == NULL)
+                return ERR_PTR(-ENOTSOCK);
+
+        pvcalls_enter();
+        atomic_inc(&map->refcount);
+        return map;
+}
+
+static inline void pvcalls_exit_sock(struct socket *sock)
+{
+        struct sock_mapping *map;
+
+        map = (struct sock_mapping *)sock->sk->sk_send_head;
+        atomic_dec(&map->refcount);
+        pvcalls_exit();
+}
+
 static inline int get_request(struct pvcalls_bedata *bedata, int *req_id)
 {
         *req_id = bedata->ring.req_prod_pvt & (RING_SIZE(&bedata->ring) - 1);
@@ -369,31 +396,23 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
         if (addr->sa_family != AF_INET || sock->type != SOCK_STREAM)
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
 
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *)sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         spin_lock(&bedata->socket_lock);
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         ret = create_active(map, &evtchn);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
 
@@ -423,7 +442,7 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
         smp_rmb();
         ret = bedata->rsp[req_id].ret;
         bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -488,23 +507,15 @@ int pvcalls_front_sendmsg(struct socket *sock, struct msghdr *msg,
         if (flags & (MSG_CONFIRM|MSG_DONTROUTE|MSG_EOR|MSG_OOB))
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         mutex_lock(&map->active.out_mutex);
         if ((flags & MSG_DONTWAIT) && !pvcalls_front_write_todo(map)) {
                 mutex_unlock(&map->active.out_mutex);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EAGAIN;
         }
         if (len > INT_MAX)
@@ -526,7 +537,7 @@ again:
                 tot_sent = sent;
 
         mutex_unlock(&map->active.out_mutex);
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return tot_sent;
 }
 
@@ -591,19 +602,11 @@ int pvcalls_front_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
         if (flags & (MSG_CMSG_CLOEXEC|MSG_ERRQUEUE|MSG_OOB|MSG_TRUNC))
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         mutex_lock(&map->active.in_mutex);
         if (len > XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER))
                 len = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
@@ -623,7 +626,7 @@ int pvcalls_front_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                 ret = 0;
 
         mutex_unlock(&map->active.in_mutex);
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -637,24 +640,16 @@ int pvcalls_front_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
         if (addr->sa_family != AF_INET || sock->type != SOCK_STREAM)
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (map == NULL) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         spin_lock(&bedata->socket_lock);
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         req = RING_GET_REQUEST(&bedata->ring, req_id);
@@ -684,7 +679,7 @@ int pvcalls_front_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
         bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
 
         map->passive.status = PVCALLS_STATUS_BIND;
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return 0;
 }
 
@@ -695,21 +690,13 @@ int pvcalls_front_listen(struct socket *sock, int backlog)
         struct xen_pvcalls_request *req;
         int notify, req_id, ret;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         if (map->passive.status != PVCALLS_STATUS_BIND) {
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EOPNOTSUPP;
         }
 
@@ -717,7 +704,7 @@ int pvcalls_front_listen(struct socket *sock, int backlog)
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         req = RING_GET_REQUEST(&bedata->ring, req_id);
@@ -741,7 +728,7 @@ int pvcalls_front_listen(struct socket *sock, int backlog)
         bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
 
         map->passive.status = PVCALLS_STATUS_LISTEN;
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -753,21 +740,13 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
         struct xen_pvcalls_request *req;
         int notify, req_id, ret, evtchn, nonblock;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         if (map->passive.status != PVCALLS_STATUS_LISTEN) {
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EINVAL;
         }
 
@@ -785,13 +764,13 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                         goto received;
                 }
                 if (nonblock) {
-                        pvcalls_exit();
+                        pvcalls_exit_sock(sock);
                         return -EAGAIN;
                 }
                 if (wait_event_interruptible(map->passive.inflight_accept_req,
                         !test_and_set_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                                           (void *)&map->passive.flags))) {
-                        pvcalls_exit();
+                        pvcalls_exit_sock(sock);
                         return -EINTR;
                 }
         }
@@ -802,7 +781,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         map2 = kzalloc(sizeof(*map2), GFP_ATOMIC);
@@ -810,7 +789,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -ENOMEM;
         }
         ret = create_active(map2, &evtchn);
@@ -819,7 +798,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         list_add_tail(&map2->list, &bedata->socket_mappings);
@@ -841,13 +820,13 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
         /* We could check if we have received a response before returning. */
         if (nonblock) {
                 WRITE_ONCE(map->passive.inflight_req_id, req_id);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EAGAIN;
         }
 
         if (wait_event_interruptible(bedata->inflight_req,
                 READ_ONCE(bedata->rsp[req_id].req_id) == req_id)) {
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EINTR;
         }
         /* read req_id, then the content */
@@ -862,7 +841,7 @@ received:
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 pvcalls_front_free_map(bedata, map2);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -ENOMEM;
         }
         newsock->sk->sk_send_head = (void *)map2;
@@ -874,7 +853,7 @@ received:
         clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, (void *)&map->passive.flags);
         wake_up(&map->passive.inflight_accept_req);
 
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -965,23 +944,16 @@ __poll_t pvcalls_front_poll(struct file *file, struct socket *sock,
         struct sock_mapping *map;
         __poll_t ret;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
                 return EPOLLNVAL;
-        }
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return EPOLLNVAL;
-        }
         if (map->active_socket)
                 ret = pvcalls_front_poll_active(file, bedata, map, wait);
         else
                 ret = pvcalls_front_poll_passive(file, bedata, map, wait);
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -995,25 +967,20 @@ int pvcalls_front_release(struct socket *sock)
         if (sock->sk == NULL)
                 return 0;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -EIO;
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map)) {
+                if (PTR_ERR(map) == -ENOTCONN)
+                        return -EIO;
+                else
+                        return 0;
         }
-
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (map == NULL) {
-                pvcalls_exit();
-                return 0;
-        }
-
         spin_lock(&bedata->socket_lock);
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         sock->sk->sk_send_head = NULL;
@@ -1043,14 +1010,20 @@ int pvcalls_front_release(struct socket *sock)
                 /*
                  * We need to make sure that sendmsg/recvmsg on this socket have
                  * not started before we've cleared sk_send_head here. The
-                 * easiest (though not optimal) way to guarantee this is to see
-                 * that no pvcall (other than us) is in progress.
+                 * easiest way to guarantee this is to see that no pvcalls
+                 * (other than us) is in progress on this socket.
                  */
-                while (atomic_read(&pvcalls_refcount) > 1)
+                while (atomic_read(&map->refcount) > 1)
                         cpu_relax();
 
                 pvcalls_front_free_map(bedata, map);
         } else {
+                wake_up(&bedata->inflight_req);
+                wake_up(&map->passive.inflight_accept_req);
+
+                while (atomic_read(&map->refcount) > 1)
+                        cpu_relax();
+
                 spin_lock(&bedata->socket_lock);
                 list_del(&map->list);
                 spin_unlock(&bedata->socket_lock);
diff --git a/drivers/xen/xenbus/xenbus.h b/drivers/xen/xenbus/xenbus.h
index 149c5e7efc89..092981171df1 100644
--- a/drivers/xen/xenbus/xenbus.h
+++ b/drivers/xen/xenbus/xenbus.h
@@ -76,6 +76,7 @@ struct xb_req_data {
         struct list_head list;
         wait_queue_head_t wq;
         struct xsd_sockmsg msg;
+        uint32_t caller_req_id;
         enum xsd_sockmsg_type type;
         char *body;
         const struct kvec *vec;
diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c
index 5b081a01779d..d239fc3c5e3d 100644
--- a/drivers/xen/xenbus/xenbus_comms.c
+++ b/drivers/xen/xenbus/xenbus_comms.c
@@ -309,6 +309,7 @@ static int process_msg(void)
                         goto out;
 
                 if (req->state == xb_req_state_wait_reply) {
+                        req->msg.req_id = req->caller_req_id;
                         req->msg.type = state.msg.type;
                         req->msg.len = state.msg.len;
                         req->body = state.body;
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index 3e59590c7254..3f3b29398ab8 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -227,6 +227,8 @@ static void xs_send(struct xb_req_data *req, struct xsd_sockmsg *msg)
         req->state = xb_req_state_queued;
         init_waitqueue_head(&req->wq);
 
+        /* Save the caller req_id and restore it later in the reply */
+        req->caller_req_id = req->msg.req_id;
         req->msg.req_id = xs_request_enter(req);
 
         mutex_lock(&xb_write_mutex);
@@ -310,6 +312,7 @@ static void *xs_talkv(struct xenbus_transaction t,
         req->num_vecs = num_vecs;
         req->cb = xs_wake_up;
 
+        msg.req_id = 0;
         msg.tx_id = t.id;
         msg.type = type;
         msg.len = 0;
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index e4054e533f6d..f94b2d8c744a 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1264,7 +1264,16 @@ again:
         while (node) {
                 ref = rb_entry(node, struct prelim_ref, rbnode);
                 node = rb_next(&ref->rbnode);
-                WARN_ON(ref->count < 0);
+                /*
+                 * ref->count < 0 can happen here if there are delayed
+                 * refs with a node->action of BTRFS_DROP_DELAYED_REF.
+                 * prelim_ref_insert() relies on this when merging
+                 * identical refs to keep the overall count correct.
+                 * prelim_ref_insert() will merge only those refs
+                 * which compare identically.  Any refs having
+                 * e.g. different offsets would not be merged,
+                 * and would retain their original ref->count < 0.
+                 */
                 if (roots && ref->count && ref->root_id && ref->parent == 0) {
                         if (sc && sc->root_objectid &&
                             ref->root_id != sc->root_objectid) {
diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
index a1a40cf382e3..7ab5e0128f0c 100644
--- a/fs/btrfs/delayed-ref.c
+++ b/fs/btrfs/delayed-ref.c
@@ -821,7 +821,8 @@ int btrfs_add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
         spin_unlock(&delayed_refs->lock);
 
         if (qrecord_inserted)
-                return btrfs_qgroup_trace_extent_post(fs_info, record);
+                btrfs_qgroup_trace_extent_post(fs_info, record);
+
         return 0;
 
 free_head_ref:
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 05751a677da4..c1618ab9fecf 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2147,6 +2147,10 @@ int btrfs_discard_extent(struct btrfs_fs_info *fs_info, u64 bytenr,
                         u64 bytes;
                         struct request_queue *req_q;
 
+                        if (!stripe->dev->bdev) {
+                                ASSERT(btrfs_test_opt(fs_info, DEGRADED));
+                                continue;
+                        }
                         req_q = bdev_get_queue(stripe->dev->bdev);
                         if (!blk_queue_discard(req_q))
                                 continue;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 53ca025655fc..a79299a89b7d 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1335,8 +1335,11 @@ next_slot:
                 leaf = path->nodes[0];
                 if (path->slots[0] >= btrfs_header_nritems(leaf)) {
                         ret = btrfs_next_leaf(root, path);
-                        if (ret < 0)
+                        if (ret < 0) {
+                                if (cow_start != (u64)-1)
+                                        cur_offset = cow_start;
                                 goto error;
+                        }
                         if (ret > 0)
                                 break;
                         leaf = path->nodes[0];
@@ -3385,6 +3388,11 @@ int btrfs_orphan_add(struct btrfs_trans_handle *trans,
                 ret = btrfs_orphan_reserve_metadata(trans, inode);
                 ASSERT(!ret);
                 if (ret) {
+                        /*
+                         * dec doesn't need spin_lock as ->orphan_block_rsv
+                         * would be released only if ->orphan_inodes is
+                         * zero.
+                         */
                         atomic_dec(&root->orphan_inodes);
                         clear_bit(BTRFS_INODE_ORPHAN_META_RESERVED,
                                   &inode->runtime_flags);
@@ -3399,12 +3407,17 @@ int btrfs_orphan_add(struct btrfs_trans_handle *trans,
         if (insert >= 1) {
                 ret = btrfs_insert_orphan_item(trans, root, btrfs_ino(inode));
                 if (ret) {
-                        atomic_dec(&root->orphan_inodes);
                         if (reserve) {
                                 clear_bit(BTRFS_INODE_ORPHAN_META_RESERVED,
                                           &inode->runtime_flags);
                                 btrfs_orphan_release_metadata(inode);
                         }
+                        /*
+                         * btrfs_orphan_commit_root may race with us and set
+                         * ->orphan_block_rsv to zero, in order to avoid that,
+                         * decrease ->orphan_inodes after everything is done.
+                         */
+                        atomic_dec(&root->orphan_inodes);
                         if (ret != -EEXIST) {
                                 clear_bit(BTRFS_INODE_HAS_ORPHAN_ITEM,
                                           &inode->runtime_flags);
@@ -3436,28 +3449,26 @@ static int btrfs_orphan_del(struct btrfs_trans_handle *trans,
 {
         struct btrfs_root *root = inode->root;
         int delete_item = 0;
-        int release_rsv = 0;
         int ret = 0;
 
-        spin_lock(&root->orphan_lock);
         if (test_and_clear_bit(BTRFS_INODE_HAS_ORPHAN_ITEM,
                                &inode->runtime_flags))
                 delete_item = 1;
 
+        if (delete_item && trans)
+                ret = btrfs_del_orphan_item(trans, root, btrfs_ino(inode));
+
         if (test_and_clear_bit(BTRFS_INODE_ORPHAN_META_RESERVED,
                                &inode->runtime_flags))
-                release_rsv = 1;
-        spin_unlock(&root->orphan_lock);
+                btrfs_orphan_release_metadata(inode);
 
-        if (delete_item) {
+        /*
+         * btrfs_orphan_commit_root may race with us and set ->orphan_block_rsv
+         * to zero, in order to avoid that, decrease ->orphan_inodes after
+         * everything is done.
+         */
+        if (delete_item)
                 atomic_dec(&root->orphan_inodes);
-                if (trans)
-                        ret = btrfs_del_orphan_item(trans, root,
-                                                    btrfs_ino(inode));
-        }
-
-        if (release_rsv)
-                btrfs_orphan_release_metadata(inode);
 
         return ret;
 }
@@ -5281,7 +5292,7 @@ void btrfs_evict_inode(struct inode *inode)
         trace_btrfs_inode_evict(inode);
 
         if (!root) {
-                kmem_cache_free(btrfs_inode_cachep, BTRFS_I(inode));
+                clear_inode(inode);
                 return;
         }
 
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 9e61dd624f7b..aa259d6986e1 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1442,8 +1442,13 @@ int btrfs_qgroup_trace_extent_post(struct btrfs_fs_info *fs_info,
         int ret;
 
         ret = btrfs_find_all_roots(NULL, fs_info, bytenr, 0, &old_root, false);
-        if (ret < 0)
-                return ret;
+        if (ret < 0) {
+                fs_info->qgroup_flags |= BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT;
+                btrfs_warn(fs_info,
+"error accounting new delayed refs extent (err code: %d), quota inconsistent",
+                        ret);
+                return 0;
+        }
 
         /*
          * Here we don't need to get the lock of
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index afadaadab18e..4fd19b4d6675 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -29,6 +29,7 @@
 #include "hash.h"
 #include "compression.h"
 #include "qgroup.h"
+#include "inode-map.h"
 
 /* magic values for the inode_only field in btrfs_log_inode:
  *
@@ -2472,6 +2473,9 @@ static noinline int walk_down_log_tree(struct btrfs_trans_handle *trans,
                                         clean_tree_block(fs_info, next);
                                         btrfs_wait_tree_block_writeback(next);
                                         btrfs_tree_unlock(next);
+                                } else {
+                                        if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags))
+                                                clear_extent_buffer_dirty(next);
                                 }
 
                                 WARN_ON(root_owner !=
@@ -2552,6 +2556,9 @@ static noinline int walk_up_log_tree(struct btrfs_trans_handle *trans,
                                         clean_tree_block(fs_info, next);
                                         btrfs_wait_tree_block_writeback(next);
                                         btrfs_tree_unlock(next);
+                                } else {
+                                        if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags))
+                                                clear_extent_buffer_dirty(next);
                                 }
 
                                 WARN_ON(root_owner != BTRFS_TREE_LOG_OBJECTID);
@@ -2630,6 +2637,9 @@ static int walk_log_tree(struct btrfs_trans_handle *trans,
                                 clean_tree_block(fs_info, next);
                                 btrfs_wait_tree_block_writeback(next);
                                 btrfs_tree_unlock(next);
+                        } else {
+                                if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags))
+                                        clear_extent_buffer_dirty(next);
                         }
 
                         WARN_ON(log->root_key.objectid !=
@@ -3018,13 +3028,14 @@ static void free_log_tree(struct btrfs_trans_handle *trans,
 
         while (1) {
                 ret = find_first_extent_bit(&log->dirty_log_pages,
-                                0, &start, &end, EXTENT_DIRTY | EXTENT_NEW,
+                                0, &start, &end,
+                                EXTENT_DIRTY | EXTENT_NEW | EXTENT_NEED_WAIT,
                                 NULL);
                 if (ret)
                         break;
 
                 clear_extent_bits(&log->dirty_log_pages, start, end,
-                                  EXTENT_DIRTY | EXTENT_NEW);
+                                  EXTENT_DIRTY | EXTENT_NEW | EXTENT_NEED_WAIT);
         }
 
         /*
@@ -5677,6 +5688,23 @@ again:
                                                       path);
                 }
 
+                if (!ret && wc.stage == LOG_WALK_REPLAY_ALL) {
+                        struct btrfs_root *root = wc.replay_dest;
+
+                        btrfs_release_path(path);
+
+                        /*
+                         * We have just replayed everything, and the highest
+                         * objectid of fs roots probably has changed in case
+                         * some inode_item's got replayed.
+                         *
+                         * root->objectid_mutex is not acquired as log replay
+                         * could only happen during mount.
+                         */
+                        ret = btrfs_find_highest_objectid(root,
+                                                  &root->highest_objectid);
+                }
+
                 key.offset = found_key.offset - 1;
                 wc.replay_dest->log_root = NULL;
                 free_extent_buffer(log->node);
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index b5036bd69e6a..2ceb924ca0d6 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -645,6 +645,7 @@ static void btrfs_free_stale_devices(const char *path,
                                 btrfs_sysfs_remove_fsid(fs_devs);
                                 list_del(&fs_devs->list);
                                 free_fs_devices(fs_devs);
+                                break;
                         } else {
                                 fs_devs->num_devices--;
                                 list_del(&dev->dev_list);
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 86863792f36a..86d6a4435c87 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -716,7 +716,7 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
         __be64 *ptr;
         sector_t lblock;
         sector_t lend;
-        int ret;
+        int ret = 0;
         int eob;
         unsigned int len;
         struct buffer_head *bh;
@@ -728,12 +728,14 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
                 goto out;
         }
 
-        if ((flags & IOMAP_REPORT) && gfs2_is_stuffed(ip)) {
-                gfs2_stuffed_iomap(inode, iomap);
-                if (pos >= iomap->length)
-                        return -ENOENT;
-                ret = 0;
-                goto out;
+        if (gfs2_is_stuffed(ip)) {
+                if (flags & IOMAP_REPORT) {
+                        gfs2_stuffed_iomap(inode, iomap);
+                        if (pos >= iomap->length)
+                                ret = -ENOENT;
+                        goto out;
+                }
+                BUG_ON(!(flags & IOMAP_WRITE));
         }
 
         lblock = pos >> inode->i_blkbits;
@@ -744,7 +746,7 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
         iomap->type = IOMAP_HOLE;
         iomap->length = (u64)(lend - lblock) << inode->i_blkbits;
         iomap->flags = IOMAP_F_MERGED;
-        bmap_lock(ip, 0);
+        bmap_lock(ip, flags & IOMAP_WRITE);
 
         /*
          * Directory data blocks have a struct gfs2_meta_header header, so the
@@ -787,27 +789,28 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
                 iomap->flags |= IOMAP_F_BOUNDARY;
         iomap->length = (u64)len << inode->i_blkbits;
 
-        ret = 0;
-
 out_release:
         release_metapath(&mp);
-        bmap_unlock(ip, 0);
+        bmap_unlock(ip, flags & IOMAP_WRITE);
 out:
         trace_gfs2_iomap_end(ip, iomap, ret);
         return ret;
 
 do_alloc:
-        if (!(flags & IOMAP_WRITE)) {
-                if (pos >= i_size_read(inode)) {
+        if (flags & IOMAP_WRITE) {
+                ret = gfs2_iomap_alloc(inode, iomap, flags, &mp);
+        } else if (flags & IOMAP_REPORT) {
+                loff_t size = i_size_read(inode);
+                if (pos >= size)
                         ret = -ENOENT;
-                        goto out_release;
-                }
-                ret = 0;
-                iomap->length = hole_size(inode, lblock, &mp);
-                goto out_release;
+                else if (height <= ip->i_height)
+                        iomap->length = hole_size(inode, lblock, &mp);
+                else
+                        iomap->length = size - pos;
+        } else {
+                if (height <= ip->i_height)
+                        iomap->length = hole_size(inode, lblock, &mp);
         }
-
-        ret = gfs2_iomap_alloc(inode, iomap, flags, &mp);
         goto out_release;
 }
 
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index e8a93bc8285d..d1e82761de81 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -510,6 +510,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
                         /* we have to zero-fill user buffer even if no read */
                         if (copy_to_user(buffer, buf, tsz))
                                 return -EFAULT;
+                } else if (m->type == KCORE_USER) {
+                        /* User page is handled prior to normal kernel page: */
+                        if (copy_to_user(buffer, (char *)start, tsz))
+                                return -EFAULT;
                 } else {
                         if (kern_addr_valid(start)) {
                                 /*
diff --git a/include/asm-generic/bitops/lock.h b/include/asm-generic/bitops/lock.h
index bc397573c43a..67ab280ad134 100644
--- a/include/asm-generic/bitops/lock.h
+++ b/include/asm-generic/bitops/lock.h
@@ -7,7 +7,8 @@
  * @nr: Bit to set
  * @addr: Address to count from
  *
- * This operation is atomic and provides acquire barrier semantics.
+ * This operation is atomic and provides acquire barrier semantics if
+ * the returned value is 0.
  * It can be used to implement bit locks.
  */
 #define test_and_set_bit_lock(nr, addr) test_and_set_bit(nr, addr)
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 64e10746f282..968173ec2726 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -587,7 +587,7 @@ extern int acpi_nvs_for_each_region(int (*func)(__u64, __u64, void *),
 const struct acpi_device_id *acpi_match_device(const struct acpi_device_id *ids,
                                                const struct device *dev);
 
-void *acpi_get_match_data(const struct device *dev);
+const void *acpi_device_get_match_data(const struct device *dev);
 extern bool acpi_driver_match_device(struct device *dev,
                                      const struct device_driver *drv);
 int acpi_device_uevent_modalias(struct device *, struct kobj_uevent_env *);
@@ -766,7 +766,7 @@ static inline const struct acpi_device_id *acpi_match_device(
         return NULL;
 }
 
-static inline void *acpi_get_match_data(const struct device *dev)
+static inline const void *acpi_device_get_match_data(const struct device *dev)
 {
         return NULL;
 }
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 4f3df807cf8f..ed63f3b69c12 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -49,7 +49,7 @@ struct blk_stat_callback;
 #define BLKDEV_MIN_RQ   4
 #define BLKDEV_MAX_RQ   128     /* Default maximum */
 
-/* Must be consisitent with blk_mq_poll_stats_bkt() */
+/* Must be consistent with blk_mq_poll_stats_bkt() */
 #define BLK_MQ_POLL_STATS_BKTS 16
 
 /*
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 631354acfa72..73bc63e0a1c4 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -167,8 +167,6 @@
 
 #if GCC_VERSION >= 40100
 # define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
-
-#define __nostackprotector      __attribute__((__optimize__("no-stack-protector")))
 #endif
 
 #if GCC_VERSION >= 40300
@@ -196,6 +194,11 @@
 #endif /* __CHECKER__ */
 #endif /* GCC_VERSION >= 40300 */
 
+#if GCC_VERSION >= 40400
+#define __optimize(level)       __attribute__((__optimize__(level)))
+#define __nostackprotector      __optimize("no-stack-protector")
+#endif /* GCC_VERSION >= 40400 */
+
 #if GCC_VERSION >= 40500
 
 #ifndef __CHECKER__
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index c2cc57a2f508..e835fc0423ec 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -277,6 +277,10 @@ unsigned long read_word_at_a_time(const void *addr)
 
 #endif /* __ASSEMBLY__ */
 
+#ifndef __optimize
+# define __optimize(level)
+#endif
+
 /* Compile time object size, -1 for unknown */
 #ifndef __compiletime_object_size
 # define __compiletime_object_size(obj) -1
diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
index 871f9e21810c..0b3fc229086c 100644
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -225,7 +225,7 @@ static inline void cpuidle_coupled_parallel_barrier(struct cpuidle_device *dev,
 }
 #endif
 
-#ifdef CONFIG_ARCH_HAS_CPU_RELAX
+#if defined(CONFIG_CPU_IDLE) && defined(CONFIG_ARCH_HAS_CPU_RELAX)
 void cpuidle_poll_state_init(struct cpuidle_driver *drv);
 #else
 static inline void cpuidle_poll_state_init(struct cpuidle_driver *drv) {}
diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
index d4a2a7dcd72d..bf53d893ad02 100644
--- a/include/linux/cpumask.h
+++ b/include/linux/cpumask.h
@@ -170,6 +170,8 @@ static inline unsigned int cpumask_local_spread(unsigned int i, int node)
         for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask)
 #define for_each_cpu_not(cpu, mask)             \
         for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask)
+#define for_each_cpu_wrap(cpu, mask, start)     \
+        for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)(start))
 #define for_each_cpu_and(cpu, mask, and)        \
         for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)and)
 #else
diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
index 34fe8463d10e..eb9eab4ecd6d 100644
--- a/include/linux/dma-mapping.h
+++ b/include/linux/dma-mapping.h
@@ -578,7 +578,7 @@ static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
 
 /*
  * This is a hack for the legacy x86 forbid_dac and iommu_sac_force. Please
- * don't use this is new code.
+ * don't use this in new code.
  */
 #ifndef arch_dma_supported
 #define arch_dma_supported(dev, mask)   (1)
diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h
index 4fa1a489efe4..4fe8f289b3f6 100644
--- a/include/linux/fwnode.h
+++ b/include/linux/fwnode.h
@@ -73,8 +73,8 @@ struct fwnode_operations {
         struct fwnode_handle *(*get)(struct fwnode_handle *fwnode);
         void (*put)(struct fwnode_handle *fwnode);
         bool (*device_is_available)(const struct fwnode_handle *fwnode);
-        void *(*device_get_match_data)(const struct fwnode_handle *fwnode,
-                                       const struct device *dev);
+        const void *(*device_get_match_data)(const struct fwnode_handle *fwnode,
+                                             const struct device *dev);
         bool (*property_present)(const struct fwnode_handle *fwnode,
                                  const char *propname);
         int (*property_read_int_array)(const struct fwnode_handle *fwnode,
diff --git a/include/linux/kcore.h b/include/linux/kcore.h
index 7ff25a808fef..80db19d3a505 100644
--- a/include/linux/kcore.h
+++ b/include/linux/kcore.h
@@ -10,6 +10,7 @@ enum kcore_type {
         KCORE_VMALLOC,
         KCORE_RAM,
         KCORE_VMEMMAP,
+        KCORE_USER,
         KCORE_OTHER,
 };
 
diff --git a/include/linux/mm_inline.h b/include/linux/mm_inline.h
index c30b32e3c862..10191c28fc04 100644
--- a/include/linux/mm_inline.h
+++ b/include/linux/mm_inline.h
@@ -127,10 +127,4 @@ static __always_inline enum lru_list page_lru(struct page *page)
 
 #define lru_to_page(head) (list_entry((head)->prev, struct page, lru))
 
-#ifdef arch_unmap_kpfn
-extern void arch_unmap_kpfn(unsigned long pfn);
-#else
-static __always_inline void arch_unmap_kpfn(unsigned long pfn) { }
-#endif
-
 #endif
diff --git a/include/linux/nospec.h b/include/linux/nospec.h
index b99bced39ac2..fbc98e2c8228 100644
--- a/include/linux/nospec.h
+++ b/include/linux/nospec.h
@@ -20,20 +20,6 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
                                                     unsigned long size)
 {
         /*
-         * Warn developers about inappropriate array_index_nospec() usage.
-         *
-         * Even if the CPU speculates past the WARN_ONCE branch, the
-         * sign bit of @index is taken into account when generating the
-         * mask.
-         *
-         * This warning is compiled out when the compiler can infer that
-         * @index and @size are less than LONG_MAX.
-         */
-        if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX,
-                        "array_index_nospec() limited to range of [0, LONG_MAX]\n"))
-                return 0;
-
-        /*
          * Always calculate and emit the mask even if the compiler
          * thinks the mask is not needed. The compiler does not take
          * into account the value of @index under speculation.
@@ -44,6 +30,26 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 #endif
 
 /*
+ * Warn developers about inappropriate array_index_nospec() usage.
+ *
+ * Even if the CPU speculates past the WARN_ONCE branch, the
+ * sign bit of @index is taken into account when generating the
+ * mask.
+ *
+ * This warning is compiled out when the compiler can infer that
+ * @index and @size are less than LONG_MAX.
+ */
+#define array_index_mask_nospec_check(index, size)                              \
+({                                                                              \
+        if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX,                      \
+            "array_index_nospec() limited to range of [0, LONG_MAX]\n"))        \
+                _mask = 0;                                                      \
+        else                                                                    \
+                _mask = array_index_mask_nospec(index, size);                   \
+        _mask;                                                                  \
+})
+
+/*
  * array_index_nospec - sanitize an array index after a bounds check
  *
  * For a code sequence like:
@@ -61,7 +67,7 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 ({                                                                      \
         typeof(index) _i = (index);                                     \
         typeof(size) _s = (size);                                       \
-        unsigned long _mask = array_index_mask_nospec(_i, _s);          \
+        unsigned long _mask = array_index_mask_nospec_check(_i, _s);    \
                                                                         \
         BUILD_BUG_ON(sizeof(_i) > sizeof(long));                        \
         BUILD_BUG_ON(sizeof(_s) > sizeof(long));                        \
diff --git a/include/linux/property.h b/include/linux/property.h
index 769d372c1edf..2eea4b310fc2 100644
--- a/include/linux/property.h
+++ b/include/linux/property.h
@@ -283,7 +283,7 @@ bool device_dma_supported(struct device *dev);
 
 enum dev_dma_attr device_get_dma_attr(struct device *dev);
 
-void *device_get_match_data(struct device *dev);
+const void *device_get_match_data(struct device *dev);
 
 int device_get_phy_mode(struct device *dev);
 
diff --git a/include/linux/semaphore.h b/include/linux/semaphore.h
index dc368b8ce215..11c86fbfeb98 100644
--- a/include/linux/semaphore.h
+++ b/include/linux/semaphore.h
@@ -4,7 +4,7 @@
  *
  * Distributed under the terms of the GNU GPL, version 2
  *
- * Please see kernel/semaphore.c for documentation of these functions
+ * Please see kernel/locking/semaphore.c for documentation of these functions
  */
 #ifndef __LINUX_SEMAPHORE_H
 #define __LINUX_SEMAPHORE_H
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 5ebc0f869720..c1e66bdcf583 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3646,7 +3646,7 @@ static inline bool __skb_checksum_validate_needed(struct sk_buff *skb,
         return true;
 }
 
-/* For small packets <= CHECKSUM_BREAK peform checksum complete directly
+/* For small packets <= CHECKSUM_BREAK perform checksum complete directly
  * in checksum_init.
  */
 #define CHECKSUM_BREAK 76
diff --git a/include/net/udplite.h b/include/net/udplite.h
index 81bdbf97319b..9185e45b997f 100644
--- a/include/net/udplite.h
+++ b/include/net/udplite.h
@@ -64,6 +64,7 @@ static inline int udplite_checksum_init(struct sk_buff *skb, struct udphdr *uh)
                 UDP_SKB_CB(skb)->cscov = cscov;
                 if (skb->ip_summed == CHECKSUM_COMPLETE)
                         skb->ip_summed = CHECKSUM_NONE;
+                skb->csum_valid = 0;
         }
 
         return 0;
diff --git a/include/sound/ac97/regs.h b/include/sound/ac97/regs.h
index 4bb86d379bd5..9a4fa0c3264a 100644
--- a/include/sound/ac97/regs.h
+++ b/include/sound/ac97/regs.h
@@ -31,7 +31,7 @@
 #define AC97_HEADPHONE          0x04    /* Headphone Volume (optional) */
 #define AC97_MASTER_MONO        0x06    /* Master Volume Mono (optional) */
 #define AC97_MASTER_TONE        0x08    /* Master Tone (Bass & Treble) (optional) */
-#define AC97_PC_BEEP            0x0a    /* PC Beep Volume (optinal) */
+#define AC97_PC_BEEP            0x0a    /* PC Beep Volume (optional) */
 #define AC97_PHONE              0x0c    /* Phone Volume (optional) */
 #define AC97_MIC                0x0e    /* MIC Volume */
 #define AC97_LINE               0x10    /* Line In Volume */
diff --git a/include/trace/events/xen.h b/include/trace/events/xen.h
index b8adf05c534e..7dd8f34c37df 100644
--- a/include/trace/events/xen.h
+++ b/include/trace/events/xen.h
@@ -368,7 +368,7 @@ TRACE_EVENT(xen_mmu_flush_tlb,
             TP_printk("%s", "")
         );
 
-TRACE_EVENT(xen_mmu_flush_tlb_single,
+TRACE_EVENT(xen_mmu_flush_tlb_one_user,
             TP_PROTO(unsigned long addr),
             TP_ARGS(addr),
             TP_STRUCT__entry(
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index e6a9c36470ee..82b8b18ee1eb 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1726,25 +1726,14 @@ static int irq_domain_debug_show(struct seq_file *m, void *p)
         irq_domain_debug_show_one(m, d, 0);
         return 0;
 }
-
-static int irq_domain_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, irq_domain_debug_show, inode->i_private);
-}
-
-static const struct file_operations dfs_domain_ops = {
-        .open           = irq_domain_debug_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-};
+DEFINE_SHOW_ATTRIBUTE(irq_domain_debug);
 
 static void debugfs_add_domain_dir(struct irq_domain *d)
 {
         if (!d->name || !domain_dir || d->debugfs_file)
                 return;
         d->debugfs_file = debugfs_create_file(d->name, 0444, domain_dir, d,
-                                              &dfs_domain_ops);
+                                              &irq_domain_debug_fops);
 }
 
 static void debugfs_remove_domain_dir(struct irq_domain *d)
@@ -1760,7 +1749,8 @@ void __init irq_domain_debugfs_init(struct dentry *root)
         if (!domain_dir)
                 return;
 
-        debugfs_create_file("default", 0444, domain_dir, NULL, &dfs_domain_ops);
+        debugfs_create_file("default", 0444, domain_dir, NULL,
+                            &irq_domain_debug_fops);
         mutex_lock(&irq_domain_mutex);
         list_for_each_entry(d, &irq_domain_list, link)
                 debugfs_add_domain_dir(d);
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index da2ccf142358..102160ff5c66 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -978,67 +978,90 @@ static int prepare_kprobe(struct kprobe *p)
 }
 
 /* Caller must lock kprobe_mutex */
-static void arm_kprobe_ftrace(struct kprobe *p)
+static int arm_kprobe_ftrace(struct kprobe *p)
 {
-        int ret;
+        int ret = 0;
 
         ret = ftrace_set_filter_ip(&kprobe_ftrace_ops,
                                    (unsigned long)p->addr, 0, 0);
-        WARN(ret < 0, "Failed to arm kprobe-ftrace at %p (%d)\n", p->addr, ret);
-        kprobe_ftrace_enabled++;
-        if (kprobe_ftrace_enabled == 1) {
+        if (ret) {
+                pr_debug("Failed to arm kprobe-ftrace at %p (%d)\n", p->addr, ret);
+                return ret;
+        }
+
+        if (kprobe_ftrace_enabled == 0) {
                 ret = register_ftrace_function(&kprobe_ftrace_ops);
-                WARN(ret < 0, "Failed to init kprobe-ftrace (%d)\n", ret);
+                if (ret) {
+                        pr_debug("Failed to init kprobe-ftrace (%d)\n", ret);
+                        goto err_ftrace;
+                }
         }
+
+        kprobe_ftrace_enabled++;
+        return ret;
+
+err_ftrace:
+        /*
+         * Note: Since kprobe_ftrace_ops has IPMODIFY set, and ftrace requires a
+         * non-empty filter_hash for IPMODIFY ops, we're safe from an accidental
+         * empty filter_hash which would undesirably trace all functions.
+         */
+        ftrace_set_filter_ip(&kprobe_ftrace_ops, (unsigned long)p->addr, 1, 0);
+        return ret;
 }
 
 /* Caller must lock kprobe_mutex */
-static void disarm_kprobe_ftrace(struct kprobe *p)
+static int disarm_kprobe_ftrace(struct kprobe *p)
 {
-        int ret;
+        int ret = 0;
 
-        kprobe_ftrace_enabled--;
-        if (kprobe_ftrace_enabled == 0) {
+        if (kprobe_ftrace_enabled == 1) {
                 ret = unregister_ftrace_function(&kprobe_ftrace_ops);
-                WARN(ret < 0, "Failed to init kprobe-ftrace (%d)\n", ret);
+                if (WARN(ret < 0, "Failed to unregister kprobe-ftrace (%d)\n", ret))
+                        return ret;
         }
+
+        kprobe_ftrace_enabled--;
+
         ret = ftrace_set_filter_ip(&kprobe_ftrace_ops,
                            (unsigned long)p->addr, 1, 0);
         WARN(ret < 0, "Failed to disarm kprobe-ftrace at %p (%d)\n", p->addr, ret);
+        return ret;
 }
 #else   /* !CONFIG_KPROBES_ON_FTRACE */
 #define prepare_kprobe(p)       arch_prepare_kprobe(p)
-#define arm_kprobe_ftrace(p)    do {} while (0)
-#define disarm_kprobe_ftrace(p) do {} while (0)
+#define arm_kprobe_ftrace(p)    (-ENODEV)
+#define disarm_kprobe_ftrace(p) (-ENODEV)
 #endif
 
 /* Arm a kprobe with text_mutex */
-static void arm_kprobe(struct kprobe *kp)
+static int arm_kprobe(struct kprobe *kp)
 {
-        if (unlikely(kprobe_ftrace(kp))) {
-                arm_kprobe_ftrace(kp);
-                return;
-        }
+        if (unlikely(kprobe_ftrace(kp)))
+                return arm_kprobe_ftrace(kp);
+
         cpus_read_lock();
         mutex_lock(&text_mutex);
         __arm_kprobe(kp);
         mutex_unlock(&text_mutex);
         cpus_read_unlock();
+
+        return 0;
 }
 
 /* Disarm a kprobe with text_mutex */
-static void disarm_kprobe(struct kprobe *kp, bool reopt)
+static int disarm_kprobe(struct kprobe *kp, bool reopt)
 {
-        if (unlikely(kprobe_ftrace(kp))) {
-                disarm_kprobe_ftrace(kp);
-                return;
-        }
+        if (unlikely(kprobe_ftrace(kp)))
+                return disarm_kprobe_ftrace(kp);
 
         cpus_read_lock();
         mutex_lock(&text_mutex);
         __disarm_kprobe(kp, reopt);
         mutex_unlock(&text_mutex);
         cpus_read_unlock();
+
+        return 0;
 }
 
 /*
@@ -1362,9 +1385,15 @@ out:
 
         if (ret == 0 && kprobe_disabled(ap) && !kprobe_disabled(p)) {
                 ap->flags &= ~KPROBE_FLAG_DISABLED;
-                if (!kprobes_all_disarmed)
+                if (!kprobes_all_disarmed) {
                         /* Arm the breakpoint again. */
-                        arm_kprobe(ap);
+                        ret = arm_kprobe(ap);
+                        if (ret) {
+                                ap->flags |= KPROBE_FLAG_DISABLED;
+                                list_del_rcu(&p->list);
+                                synchronize_sched();
+                        }
+                }
         }
         return ret;
 }
@@ -1573,8 +1602,14 @@ int register_kprobe(struct kprobe *p)
         hlist_add_head_rcu(&p->hlist,
                        &kprobe_table[hash_ptr(p->addr, KPROBE_HASH_BITS)]);
 
-        if (!kprobes_all_disarmed && !kprobe_disabled(p))
-                arm_kprobe(p);
+        if (!kprobes_all_disarmed && !kprobe_disabled(p)) {
+                ret = arm_kprobe(p);
+                if (ret) {
+                        hlist_del_rcu(&p->hlist);
+                        synchronize_sched();
+                        goto out;
+                }
+        }
 
         /* Try to optimize kprobe */
         try_to_optimize_kprobe(p);
@@ -1608,11 +1643,12 @@ static int aggr_kprobe_disabled(struct kprobe *ap)
 static struct kprobe *__disable_kprobe(struct kprobe *p)
 {
         struct kprobe *orig_p;
+        int ret;
 
         /* Get an original kprobe for return */
         orig_p = __get_valid_kprobe(p);
         if (unlikely(orig_p == NULL))
-                return NULL;
+                return ERR_PTR(-EINVAL);
 
         if (!kprobe_disabled(p)) {
                 /* Disable probe if it is a child probe */
@@ -1626,8 +1662,13 @@ static struct kprobe *__disable_kprobe(struct kprobe *p)
                          * should have already been disarmed, so
                          * skip unneed disarming process.
                          */
-                        if (!kprobes_all_disarmed)
-                                disarm_kprobe(orig_p, true);
+                        if (!kprobes_all_disarmed) {
+                                ret = disarm_kprobe(orig_p, true);
+                                if (ret) {
+                                        p->flags &= ~KPROBE_FLAG_DISABLED;
+                                        return ERR_PTR(ret);
+                                }
+                        }
                         orig_p->flags |= KPROBE_FLAG_DISABLED;
                 }
         }
@@ -1644,8 +1685,8 @@ static int __unregister_kprobe_top(struct kprobe *p)
 
         /* Disable kprobe. This will disarm it if needed. */
         ap = __disable_kprobe(p);
-        if (ap == NULL)
-                return -EINVAL;
+        if (IS_ERR(ap))
+                return PTR_ERR(ap);
 
         if (ap == p)
                 /*
@@ -2078,12 +2119,14 @@ static void kill_kprobe(struct kprobe *p)
 int disable_kprobe(struct kprobe *kp)
 {
         int ret = 0;
+        struct kprobe *p;
 
         mutex_lock(&kprobe_mutex);
 
         /* Disable this kprobe */
-        if (__disable_kprobe(kp) == NULL)
-                ret = -EINVAL;
+        p = __disable_kprobe(kp);
+        if (IS_ERR(p))
+                ret = PTR_ERR(p);
 
         mutex_unlock(&kprobe_mutex);
         return ret;
@@ -2116,7 +2159,9 @@ int enable_kprobe(struct kprobe *kp)
 
         if (!kprobes_all_disarmed && kprobe_disabled(p)) {
                 p->flags &= ~KPROBE_FLAG_DISABLED;
-                arm_kprobe(p);
+                ret = arm_kprobe(p);
+                if (ret)
+                        p->flags |= KPROBE_FLAG_DISABLED;
         }
 out:
         mutex_unlock(&kprobe_mutex);
@@ -2407,11 +2452,12 @@ static const struct file_operations debugfs_kprobe_blacklist_ops = {
         .release        = seq_release,
 };
 
-static void arm_all_kprobes(void)
+static int arm_all_kprobes(void)
 {
         struct hlist_head *head;
         struct kprobe *p;
-        unsigned int i;
+        unsigned int i, total = 0, errors = 0;
+        int err, ret = 0;
 
         mutex_lock(&kprobe_mutex);
 
@@ -2428,46 +2474,74 @@ static void arm_all_kprobes(void)
         /* Arming kprobes doesn't optimize kprobe itself */
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
-                hlist_for_each_entry_rcu(p, head, hlist)
-                        if (!kprobe_disabled(p))
-                                arm_kprobe(p);
+                /* Arm all kprobes on a best-effort basis */
+                hlist_for_each_entry_rcu(p, head, hlist) {
+                        if (!kprobe_disabled(p)) {
+                                err = arm_kprobe(p);
+                                if (err)  {
+                                        errors++;
+                                        ret = err;
+                                }
+                                total++;
+                        }
+                }
         }
 
-        printk(KERN_INFO "Kprobes globally enabled\n");
+        if (errors)
+                pr_warn("Kprobes globally enabled, but failed to arm %d out of %d probes\n",
+                        errors, total);
+        else
+                pr_info("Kprobes globally enabled\n");
 
 already_enabled:
         mutex_unlock(&kprobe_mutex);
-        return;
+        return ret;
 }
 
-static void disarm_all_kprobes(void)
+static int disarm_all_kprobes(void)
 {
         struct hlist_head *head;
         struct kprobe *p;
-        unsigned int i;
+        unsigned int i, total = 0, errors = 0;
+        int err, ret = 0;
 
         mutex_lock(&kprobe_mutex);
 
         /* If kprobes are already disarmed, just return */
         if (kprobes_all_disarmed) {
                 mutex_unlock(&kprobe_mutex);
-                return;
+                return 0;
         }
 
         kprobes_all_disarmed = true;
-        printk(KERN_INFO "Kprobes globally disabled\n");
 
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
+                /* Disarm all kprobes on a best-effort basis */
                 hlist_for_each_entry_rcu(p, head, hlist) {
-                        if (!arch_trampoline_kprobe(p) && !kprobe_disabled(p))
-                                disarm_kprobe(p, false);
+                        if (!arch_trampoline_kprobe(p) && !kprobe_disabled(p)) {
+                                err = disarm_kprobe(p, false);
+                                if (err) {
+                                        errors++;
+                                        ret = err;
+                                }
+                                total++;
+                        }
                 }
         }
+
+        if (errors)
+                pr_warn("Kprobes globally disabled, but failed to disarm %d out of %d probes\n",
+                        errors, total);
+        else
+                pr_info("Kprobes globally disabled\n");
+
         mutex_unlock(&kprobe_mutex);
 
         /* Wait for disarming all kprobes by optimizer */
         wait_for_kprobe_optimizer();
+
+        return ret;
 }
 
 /*
@@ -2494,6 +2568,7 @@ static ssize_t write_enabled_file_bool(struct file *file,
 {
         char buf[32];
         size_t buf_size;
+        int ret = 0;
 
         buf_size = min(count, (sizeof(buf)-1));
         if (copy_from_user(buf, user_buf, buf_size))
@@ -2504,17 +2579,20 @@ static ssize_t write_enabled_file_bool(struct file *file,
         case 'y':
         case 'Y':
         case '1':
-                arm_all_kprobes();
+                ret = arm_all_kprobes();
                 break;
         case 'n':
         case 'N':
         case '0':
-                disarm_all_kprobes();
+                ret = disarm_all_kprobes();
                 break;
         default:
                 return -EINVAL;
         }
 
+        if (ret)
+                return ret;
+
         return count;
 }
 
diff --git a/kernel/locking/qspinlock.c b/kernel/locking/qspinlock.c
index 38ece035039e..d880296245c5 100644
--- a/kernel/locking/qspinlock.c
+++ b/kernel/locking/qspinlock.c
@@ -379,6 +379,14 @@ queue:
         tail = encode_tail(smp_processor_id(), idx);
 
         node += idx;
+
+        /*
+         * Ensure that we increment the head node->count before initialising
+         * the actual node. If the compiler is kind enough to reorder these
+         * stores, then an IRQ could overwrite our assignments.
+         */
+        barrier();
+
         node->locked = 0;
         node->next = NULL;
         pv_init_node(node);
@@ -408,14 +416,15 @@ queue:
          */
         if (old & _Q_TAIL_MASK) {
                 prev = decode_tail(old);
+
                 /*
-                 * The above xchg_tail() is also a load of @lock which
-                 * generates, through decode_tail(), a pointer.  The address
-                 * dependency matches the RELEASE of xchg_tail() such that
-                 * the subsequent access to @prev happens after.
+                 * We must ensure that the stores to @node are observed before
+                 * the write to prev->next. The address dependency from
+                 * xchg_tail is not sufficient to ensure this because the read
+                 * component of xchg_tail is unordered with respect to the
+                 * initialisation of @node.
                  */
-
-                WRITE_ONCE(prev->next, node);
+                smp_store_release(&prev->next, node);
 
                 pv_wait_node(node, prev);
                 arch_mcs_spin_lock_contended(&node->locked);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index bf724c1952ea..e7c535eee0a6 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2601,19 +2601,31 @@ static inline void finish_task(struct task_struct *prev)
 #endif
 }
 
-static inline void finish_lock_switch(struct rq *rq)
+static inline void
+prepare_lock_switch(struct rq *rq, struct task_struct *next, struct rq_flags *rf)
 {
+        /*
+         * Since the runqueue lock will be released by the next
+         * task (which is an invalid locking op but in the case
+         * of the scheduler it's an obvious special-case), so we
+         * do an early lockdep release here:
+         */
+        rq_unpin_lock(rq, rf);
+        spin_release(&rq->lock.dep_map, 1, _THIS_IP_);
 #ifdef CONFIG_DEBUG_SPINLOCK
         /* this is a valid case when another task releases the spinlock */
-        rq->lock.owner = current;
+        rq->lock.owner = next;
 #endif
+}
+
+static inline void finish_lock_switch(struct rq *rq)
+{
         /*
          * If we are tracking spinlock dependencies then we have to
          * fix up the runqueue lock - which gets 'carried over' from
          * prev into current:
          */
         spin_acquire(&rq->lock.dep_map, 0, 0, _THIS_IP_);
-
         raw_spin_unlock_irq(&rq->lock);
 }
 
@@ -2844,14 +2856,7 @@ context_switch(struct rq *rq, struct task_struct *prev,
 
         rq->clock_update_flags &= ~(RQCF_ACT_SKIP|RQCF_REQ_SKIP);
 
-        /*
-         * Since the runqueue lock will be released by the next
-         * task (which is an invalid locking op but in the case
-         * of the scheduler it's an obvious special-case), so we
-         * do an early lockdep release here:
-         */
-        rq_unpin_lock(rq, rf);
-        spin_release(&rq->lock.dep_map, 1, _THIS_IP_);
+        prepare_lock_switch(rq, next, rf);
 
         /* Here we just switch the register state and the stack. */
         switch_to(prev, next, prev);
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index dd062a1c8cf0..7936f548e071 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -19,8 +19,6 @@
 
 #include "sched.h"
 
-#define SUGOV_KTHREAD_PRIORITY  50
-
 struct sugov_tunables {
         struct gov_attr_set attr_set;
         unsigned int rate_limit_us;
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 9bb0e0c412ec..9df09782025c 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -1153,6 +1153,7 @@ static void update_curr_dl(struct rq *rq)
         struct sched_dl_entity *dl_se = &curr->dl;
         u64 delta_exec, scaled_delta_exec;
         int cpu = cpu_of(rq);
+        u64 now;
 
         if (!dl_task(curr) || !on_dl_rq(dl_se))
                 return;
@@ -1165,7 +1166,8 @@ static void update_curr_dl(struct rq *rq)
          * natural solution, but the full ramifications of this
          * approach need further study.
          */
-        delta_exec = rq_clock_task(rq) - curr->se.exec_start;
+        now = rq_clock_task(rq);
+        delta_exec = now - curr->se.exec_start;
         if (unlikely((s64)delta_exec <= 0)) {
                 if (unlikely(dl_se->dl_yielded))
                         goto throttle;
@@ -1178,7 +1180,7 @@ static void update_curr_dl(struct rq *rq)
         curr->se.sum_exec_runtime += delta_exec;
         account_group_exec_runtime(curr, delta_exec);
 
-        curr->se.exec_start = rq_clock_task(rq);
+        curr->se.exec_start = now;
         cgroup_account_cputime(curr, delta_exec);
 
         sched_rt_avg_update(rq, delta_exec);
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 663b2355a3aa..aad49451584e 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -950,12 +950,13 @@ static void update_curr_rt(struct rq *rq)
 {
         struct task_struct *curr = rq->curr;
         struct sched_rt_entity *rt_se = &curr->rt;
-        u64 now = rq_clock_task(rq);
         u64 delta_exec;
+        u64 now;
 
         if (curr->sched_class != &rt_sched_class)
                 return;
 
+        now = rq_clock_task(rq);
         delta_exec = now - curr->se.exec_start;
         if (unlikely((s64)delta_exec <= 0))
                 return;
diff --git a/lib/dma-direct.c b/lib/dma-direct.c
index 40b1f92f2214..c9e8e21cb334 100644
--- a/lib/dma-direct.c
+++ b/lib/dma-direct.c
@@ -84,6 +84,10 @@ again:
         return page_address(page);
 }
 
+/*
+ * NOTE: this function must never look at the dma_addr argument, because we want
+ * to be able to use it as a helper for iommu implementations as well.
+ */
 void dma_direct_free(struct device *dev, size_t size, void *cpu_addr,
                 dma_addr_t dma_addr, unsigned long attrs)
 {
@@ -152,5 +156,6 @@ const struct dma_map_ops dma_direct_ops = {
         .map_sg                 = dma_direct_map_sg,
         .dma_supported          = dma_direct_supported,
         .mapping_error          = dma_direct_mapping_error,
+        .is_phys                = 1,
 };
 EXPORT_SYMBOL(dma_direct_ops);
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 4b80ccee4535..8291b75f42c8 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1139,8 +1139,6 @@ int memory_failure(unsigned long pfn, int flags)
                 return 0;
         }
 
-        arch_unmap_kpfn(pfn);
-
         orig_head = hpage = compound_head(p);
         num_poisoned_pages_inc();
 
diff --git a/mm/memory.c b/mm/memory.c
index dd8de96f5547..5fcfc24904d1 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -80,7 +80,7 @@
 
 #include "internal.h"
 
-#ifdef LAST_CPUPID_NOT_IN_PAGE_FLAGS
+#if defined(LAST_CPUPID_NOT_IN_PAGE_FLAGS) && !defined(CONFIG_COMPILE_TEST)
 #warning Unfortunate NUMA and NUMA Balancing config, growing page-frame for last_cpupid.
 #endif
 
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index f3a4efcf1456..3aa5a93ad107 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -160,7 +160,8 @@ static void req_done(struct virtqueue *vq)
                 spin_unlock_irqrestore(&chan->lock, flags);
                 /* Wakeup if anyone waiting for VirtIO ring space. */
                 wake_up(chan->vc_wq);
-                p9_client_cb(chan->client, req, REQ_STATUS_RCVD);
+                if (len)
+                        p9_client_cb(chan->client, req, REQ_STATUS_RCVD);
         }
 }
 
diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c
index 279527f8b1fe..ce7152a12bd8 100644
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -187,17 +187,17 @@ static int ebt_among_mt_check(const struct xt_mtchk_param *par)
         expected_length += ebt_mac_wormhash_size(wh_src);
 
         if (em->match_size != EBT_ALIGN(expected_length)) {
-                pr_info("wrong size: %d against expected %d, rounded to %zd\n",
-                        em->match_size, expected_length,
-                        EBT_ALIGN(expected_length));
+                pr_err_ratelimited("wrong size: %d against expected %d, rounded to %zd\n",
+                                   em->match_size, expected_length,
+                                   EBT_ALIGN(expected_length));
                 return -EINVAL;
         }
         if (wh_dst && (err = ebt_mac_wormhash_check_integrity(wh_dst))) {
-                pr_info("dst integrity fail: %x\n", -err);
+                pr_err_ratelimited("dst integrity fail: %x\n", -err);
                 return -EINVAL;
         }
         if (wh_src && (err = ebt_mac_wormhash_check_integrity(wh_src))) {
-                pr_info("src integrity fail: %x\n", -err);
+                pr_err_ratelimited("src integrity fail: %x\n", -err);
                 return -EINVAL;
         }
         return 0;
diff --git a/net/bridge/netfilter/ebt_limit.c b/net/bridge/netfilter/ebt_limit.c
index 61a9f1be1263..165b9d678cf1 100644
--- a/net/bridge/netfilter/ebt_limit.c
+++ b/net/bridge/netfilter/ebt_limit.c
@@ -72,8 +72,8 @@ static int ebt_limit_mt_check(const struct xt_mtchk_param *par)
         /* Check for overflow. */
         if (info->burst == 0 ||
             user2credits(info->avg * info->burst) < user2credits(info->avg)) {
-                pr_info("overflow, try lower: %u/%u\n",
-                        info->avg, info->burst);
+                pr_info_ratelimited("overflow, try lower: %u/%u\n",
+                                    info->avg, info->burst);
                 return -EINVAL;
         }
 
diff --git a/net/core/dev.c b/net/core/dev.c
index dda9d7b9a840..d4362befe7e2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2382,8 +2382,11 @@ EXPORT_SYMBOL(netdev_set_num_tc);
  */
 int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
 {
+        bool disabling;
         int rc;
 
+        disabling = txq < dev->real_num_tx_queues;
+
         if (txq < 1 || txq > dev->num_tx_queues)
                 return -EINVAL;
 
@@ -2399,15 +2402,19 @@ int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
                 if (dev->num_tc)
                         netif_setup_tc(dev, txq);
 
-                if (txq < dev->real_num_tx_queues) {
+                dev->real_num_tx_queues = txq;
+
+                if (disabling) {
+                        synchronize_net();
                         qdisc_reset_all_tx_gt(dev, txq);
 #ifdef CONFIG_XPS
                         netif_reset_xps_queues_gt(dev, txq);
 #endif
                 }
+        } else {
+                dev->real_num_tx_queues = txq;
         }
 
-        dev->real_num_tx_queues = txq;
         return 0;
 }
 EXPORT_SYMBOL(netif_set_real_num_tx_queues);
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 91dd09f79808..791aff68af88 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1338,6 +1338,12 @@ static int dn_setsockopt(struct socket *sock, int level, int optname, char __use
         lock_sock(sk);
         err = __dn_setsockopt(sock, level, optname, optval, optlen, 0);
         release_sock(sk);
+#ifdef CONFIG_NETFILTER
+        /* we need to exclude all possible ENOPROTOOPTs except default case */
+        if (err == -ENOPROTOOPT && optname != DSO_LINKINFO &&
+            optname != DSO_STREAM && optname != DSO_SEQPACKET)
+                err = nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
+#endif
 
         return err;
 }
@@ -1445,15 +1451,6 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us
                 dn_nsp_send_disc(sk, 0x38, 0, sk->sk_allocation);
                 break;
 
-        default:
-#ifdef CONFIG_NETFILTER
-                return nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
-#endif
-        case DSO_LINKINFO:
-        case DSO_STREAM:
-        case DSO_SEQPACKET:
-                return -ENOPROTOOPT;
-
         case DSO_MAXWINDOW:
                 if (optlen != sizeof(unsigned long))
                         return -EINVAL;
@@ -1501,6 +1498,12 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us
                         return -EINVAL;
                 scp->info_loc = u.info;
                 break;
+
+        case DSO_LINKINFO:
+        case DSO_STREAM:
+        case DSO_SEQPACKET:
+        default:
+                return -ENOPROTOOPT;
         }
 
         return 0;
@@ -1514,6 +1517,20 @@ static int dn_getsockopt(struct socket *sock, int level, int optname, char __use
         lock_sock(sk);
         err = __dn_getsockopt(sock, level, optname, optval, optlen, 0);
         release_sock(sk);
+#ifdef CONFIG_NETFILTER
+        if (err == -ENOPROTOOPT && optname != DSO_STREAM &&
+            optname != DSO_SEQPACKET && optname != DSO_CONACCEPT &&
+            optname != DSO_CONREJECT) {
+                int len;
+
+                if (get_user(len, optlen))
+                        return -EFAULT;
+
+                err = nf_getsockopt(sk, PF_DECnet, optname, optval, &len);
+                if (err >= 0)
+                        err = put_user(len, optlen);
+        }
+#endif
 
         return err;
 }
@@ -1579,26 +1596,6 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
                 r_data = &link;
                 break;
 
-        default:
-#ifdef CONFIG_NETFILTER
-        {
-                int ret, len;
-
-                if (get_user(len, optlen))
-                        return -EFAULT;
-
-                ret = nf_getsockopt(sk, PF_DECnet, optname, optval, &len);
-                if (ret >= 0)
-                        ret = put_user(len, optlen);
-                return ret;
-        }
-#endif
-        case DSO_STREAM:
-        case DSO_SEQPACKET:
-        case DSO_CONACCEPT:
-        case DSO_CONREJECT:
-                return -ENOPROTOOPT;
-
         case DSO_MAXWINDOW:
                 if (r_len > sizeof(unsigned long))
                         r_len = sizeof(unsigned long);
@@ -1630,6 +1627,13 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
                         r_len = sizeof(unsigned char);
                 r_data = &scp->info_rem;
                 break;
+
+        case DSO_STREAM:
+        case DSO_SEQPACKET:
+        case DSO_CONACCEPT:
+        case DSO_CONREJECT:
+        default:
+                return -ENOPROTOOPT;
         }
 
         if (r_data) {
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index c586597da20d..7d36a950d961 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -646,6 +646,11 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi,
                                             fi->fib_nh, cfg, extack))
                                 return 1;
                 }
+#ifdef CONFIG_IP_ROUTE_CLASSID
+                if (cfg->fc_flow &&
+                    cfg->fc_flow != fi->fib_nh->nh_tclassid)
+                        return 1;
+#endif
                 if ((!cfg->fc_oif || cfg->fc_oif == fi->fib_nh->nh_oif) &&
                     (!cfg->fc_gw  || cfg->fc_gw == fi->fib_nh->nh_gw))
                         return 0;
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 008be04ac1cc..9c41a0cef1a5 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1567,10 +1567,7 @@ int ip_getsockopt(struct sock *sk, int level,
                 if (get_user(len, optlen))
                         return -EFAULT;
 
-                lock_sock(sk);
-                err = nf_getsockopt(sk, PF_INET, optname, optval,
-                                &len);
-                release_sock(sk);
+                err = nf_getsockopt(sk, PF_INET, optname, optval, &len);
                 if (err >= 0)
                         err = put_user(len, optlen);
                 return err;
@@ -1602,9 +1599,7 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
                 if (get_user(len, optlen))
                         return -EFAULT;
 
-                lock_sock(sk);
                 err = compat_nf_getsockopt(sk, PF_INET, optname, optval, &len);
-                release_sock(sk);
                 if (err >= 0)
                         err = put_user(len, optlen);
                 return err;
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 4ffe302f9b82..e3e420f3ba7b 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -252,6 +252,10 @@ unsigned int arpt_do_table(struct sk_buff *skb,
                         }
                         if (table_base + v
                             != arpt_next_entry(e)) {
+                                if (unlikely(stackidx >= private->stacksize)) {
+                                        verdict = NF_DROP;
+                                        break;
+                                }
                                 jumpstack[stackidx++] = e;
                         }
 
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 9a71f3149507..e38395a8dcf2 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -330,8 +330,13 @@ ipt_do_table(struct sk_buff *skb,
                                 continue;
                         }
                         if (table_base + v != ipt_next_entry(e) &&
-                            !(e->ip.flags & IPT_F_GOTO))
+                            !(e->ip.flags & IPT_F_GOTO)) {
+                                if (unlikely(stackidx >= private->stacksize)) {
+                                        verdict = NF_DROP;
+                                        break;
+                                }
                                 jumpstack[stackidx++] = e;
+                        }
 
                         e = get_entry(table_base, v);
                         continue;
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 3a84a60f6b39..4b02ab39ebc5 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -107,12 +107,6 @@ clusterip_config_entry_put(struct net *net, struct clusterip_config *c)
 
         local_bh_disable();
         if (refcount_dec_and_lock(&c->entries, &cn->lock)) {
-                list_del_rcu(&c->list);
-                spin_unlock(&cn->lock);
-                local_bh_enable();
-
-                unregister_netdevice_notifier(&c->notifier);
-
                 /* In case anyone still accesses the file, the open/close
                  * functions are also incrementing the refcount on their own,
                  * so it's safe to remove the entry even if it's in use. */
@@ -120,6 +114,12 @@ clusterip_config_entry_put(struct net *net, struct clusterip_config *c)
                 if (cn->procdir)
                         proc_remove(c->pde);
 #endif
+                list_del_rcu(&c->list);
+                spin_unlock(&cn->lock);
+                local_bh_enable();
+
+                unregister_netdevice_notifier(&c->notifier);
+
                 return;
         }
         local_bh_enable();
@@ -154,8 +154,12 @@ clusterip_config_find_get(struct net *net, __be32 clusterip, int entry)
 #endif
                 if (unlikely(!refcount_inc_not_zero(&c->refcount)))
                         c = NULL;
-                else if (entry)
-                        refcount_inc(&c->entries);
+                else if (entry) {
+                        if (unlikely(!refcount_inc_not_zero(&c->entries))) {
+                                clusterip_config_put(c);
+                                c = NULL;
+                        }
+                }
         }
         rcu_read_unlock_bh();
 
diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
index 270765236f5e..aaaf9a81fbc9 100644
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ b/net/ipv4/netfilter/ipt_ECN.c
@@ -98,17 +98,15 @@ static int ecn_tg_check(const struct xt_tgchk_param *par)
         const struct ipt_ECN_info *einfo = par->targinfo;
         const struct ipt_entry *e = par->entryinfo;
 
-        if (einfo->operation & IPT_ECN_OP_MASK) {
-                pr_info("unsupported ECN operation %x\n", einfo->operation);
+        if (einfo->operation & IPT_ECN_OP_MASK)
                 return -EINVAL;
-        }
-        if (einfo->ip_ect & ~IPT_ECN_IP_MASK) {
-                pr_info("new ECT codepoint %x out of mask\n", einfo->ip_ect);
+
+        if (einfo->ip_ect & ~IPT_ECN_IP_MASK)
                 return -EINVAL;
-        }
+
         if ((einfo->operation & (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR)) &&
             (e->ip.proto != IPPROTO_TCP || (e->ip.invflags & XT_INV_PROTO))) {
-                pr_info("cannot use TCP operations on a non-tcp rule\n");
+                pr_info_ratelimited("cannot use operation on non-tcp rule\n");
                 return -EINVAL;
         }
         return 0;
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index 8bd0d7b26632..e8bed3390e58 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -74,13 +74,13 @@ static int reject_tg_check(const struct xt_tgchk_param *par)
         const struct ipt_entry *e = par->entryinfo;
 
         if (rejinfo->with == IPT_ICMP_ECHOREPLY) {
-                pr_info("ECHOREPLY no longer supported.\n");
+                pr_info_ratelimited("ECHOREPLY no longer supported.\n");
                 return -EINVAL;
         } else if (rejinfo->with == IPT_TCP_RESET) {
                 /* Must specify that it's a TCP packet */
                 if (e->ip.proto != IPPROTO_TCP ||
                     (e->ip.invflags & XT_INV_PROTO)) {
-                        pr_info("TCP_RESET invalid for non-tcp\n");
+                        pr_info_ratelimited("TCP_RESET invalid for non-tcp\n");
                         return -EINVAL;
                 }
         }
diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
index 37fb9552e858..fd01f13c896a 100644
--- a/net/ipv4/netfilter/ipt_rpfilter.c
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -105,14 +105,14 @@ static int rpfilter_check(const struct xt_mtchk_param *par)
         const struct xt_rpfilter_info *info = par->matchinfo;
         unsigned int options = ~XT_RPFILTER_OPTION_MASK;
         if (info->flags & options) {
-                pr_info("unknown options encountered");
+                pr_info_ratelimited("unknown options\n");
                 return -EINVAL;
         }
 
         if (strcmp(par->table, "mangle") != 0 &&
             strcmp(par->table, "raw") != 0) {
-                pr_info("match only valid in the \'raw\' "
-                        "or \'mangle\' tables, not \'%s\'.\n", par->table);
+                pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n",
+                                    par->table);
                 return -EINVAL;
         }
 
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index bfaefe560b5c..e5ef7c38c934 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2024,6 +2024,11 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
                 err = udplite_checksum_init(skb, uh);
                 if (err)
                         return err;
+
+                if (UDP_SKB_CB(skb)->partial_cov) {
+                        skb->csum = inet_compute_pseudo(skb, proto);
+                        return 0;
+                }
         }
 
         /* Note, we are only interested in != 0 or == 0, thus the
diff --git a/net/ipv6/ip6_checksum.c b/net/ipv6/ip6_checksum.c
index ec43d18b5ff9..547515e8450a 100644
--- a/net/ipv6/ip6_checksum.c
+++ b/net/ipv6/ip6_checksum.c
@@ -73,6 +73,11 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto)
                 err = udplite_checksum_init(skb, uh);
                 if (err)
                         return err;
+
+                if (UDP_SKB_CB(skb)->partial_cov) {
+                        skb->csum = ip6_compute_pseudo(skb, proto);
+                        return 0;
+                }
         }
 
         /* To support RFC 6936 (allow zero checksum in UDP/IPV6 for tunnels)
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index d78d41fc4b1a..24535169663d 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -1367,10 +1367,7 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname,
                 if (get_user(len, optlen))
                         return -EFAULT;
 
-                lock_sock(sk);
-                err = nf_getsockopt(sk, PF_INET6, optname, optval,
-                                &len);
-                release_sock(sk);
+                err = nf_getsockopt(sk, PF_INET6, optname, optval, &len);
                 if (err >= 0)
                         err = put_user(len, optlen);
         }
@@ -1409,10 +1406,7 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname,
                 if (get_user(len, optlen))
                         return -EFAULT;
 
-                lock_sock(sk);
-                err = compat_nf_getsockopt(sk, PF_INET6,
-                                           optname, optval, &len);
-                release_sock(sk);
+                err = compat_nf_getsockopt(sk, PF_INET6, optname, optval, &len);
                 if (err >= 0)
                         err = put_user(len, optlen);
         }
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index af4c917e0836..62358b93bbac 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -352,6 +352,10 @@ ip6t_do_table(struct sk_buff *skb,
                         }
                         if (table_base + v != ip6t_next_entry(e) &&
                             !(e->ipv6.flags & IP6T_F_GOTO)) {
+                                if (unlikely(stackidx >= private->stacksize)) {
+                                        verdict = NF_DROP;
+                                        break;
+                                }
                                 jumpstack[stackidx++] = e;
                         }
 
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index fa51a205918d..38dea8ff680f 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -85,14 +85,14 @@ static int reject_tg6_check(const struct xt_tgchk_param *par)
         const struct ip6t_entry *e = par->entryinfo;
 
         if (rejinfo->with == IP6T_ICMP6_ECHOREPLY) {
-                pr_info("ECHOREPLY is not supported.\n");
+                pr_info_ratelimited("ECHOREPLY is not supported\n");
                 return -EINVAL;
         } else if (rejinfo->with == IP6T_TCP_RESET) {
                 /* Must specify that it's a TCP packet */
                 if (!(e->ipv6.flags & IP6T_F_PROTO) ||
                     e->ipv6.proto != IPPROTO_TCP ||
                     (e->ipv6.invflags & XT_INV_PROTO)) {
-                        pr_info("TCP_RESET illegal for non-tcp\n");
+                        pr_info_ratelimited("TCP_RESET illegal for non-tcp\n");
                         return -EINVAL;
                 }
         }
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index b12e61b7b16c..94deb69bbbda 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -103,14 +103,14 @@ static int rpfilter_check(const struct xt_mtchk_param *par)
         unsigned int options = ~XT_RPFILTER_OPTION_MASK;
 
         if (info->flags & options) {
-                pr_info("unknown options encountered");
+                pr_info_ratelimited("unknown options\n");
                 return -EINVAL;
         }
 
         if (strcmp(par->table, "mangle") != 0 &&
             strcmp(par->table, "raw") != 0) {
-                pr_info("match only valid in the \'raw\' "
-                        "or \'mangle\' tables, not \'%s\'.\n", par->table);
+                pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n",
+                                    par->table);
                 return -EINVAL;
         }
 
diff --git a/net/ipv6/netfilter/ip6t_srh.c b/net/ipv6/netfilter/ip6t_srh.c
index 9642164107ce..33719d5560c8 100644
--- a/net/ipv6/netfilter/ip6t_srh.c
+++ b/net/ipv6/netfilter/ip6t_srh.c
@@ -122,12 +122,14 @@ static int srh_mt6_check(const struct xt_mtchk_param *par)
         const struct ip6t_srh *srhinfo = par->matchinfo;
 
         if (srhinfo->mt_flags & ~IP6T_SRH_MASK) {
-                pr_err("unknown srh match flags  %X\n", srhinfo->mt_flags);
+                pr_info_ratelimited("unknown srh match flags  %X\n",
+                                    srhinfo->mt_flags);
                 return -EINVAL;
         }
 
         if (srhinfo->mt_invflags & ~IP6T_SRH_INV_MASK) {
-                pr_err("unknown srh invflags %X\n", srhinfo->mt_invflags);
+                pr_info_ratelimited("unknown srh invflags %X\n",
+                                    srhinfo->mt_invflags);
                 return -EINVAL;
         }
 
diff --git a/net/netfilter/nf_nat_proto_common.c b/net/netfilter/nf_nat_proto_common.c
index fbce552a796e..7d7466dbf663 100644
--- a/net/netfilter/nf_nat_proto_common.c
+++ b/net/netfilter/nf_nat_proto_common.c
@@ -41,7 +41,7 @@ void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto,
                                  const struct nf_conn *ct,
                                  u16 *rover)
 {
-        unsigned int range_size, min, i;
+        unsigned int range_size, min, max, i;
         __be16 *portptr;
         u_int16_t off;
 
@@ -71,7 +71,10 @@ void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto,
                 }
         } else {
                 min = ntohs(range->min_proto.all);
-                range_size = ntohs(range->max_proto.all) - min + 1;
+                max = ntohs(range->max_proto.all);
+                if (unlikely(max < min))
+                        swap(max, min);
+                range_size = max - min + 1;
         }
 
         if (range->flags & NF_NAT_RANGE_PROTO_RANDOM) {
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 2f685ee1f9c8..fa1655aff8d3 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -434,36 +434,35 @@ int xt_check_match(struct xt_mtchk_param *par,
                  * ebt_among is exempt from centralized matchsize checking
                  * because it uses a dynamic-size data set.
                  */
-                pr_err("%s_tables: %s.%u match: invalid size "
-                       "%u (kernel) != (user) %u\n",
-                       xt_prefix[par->family], par->match->name,
-                       par->match->revision,
-                       XT_ALIGN(par->match->matchsize), size);
+                pr_err_ratelimited("%s_tables: %s.%u match: invalid size %u (kernel) != (user) %u\n",
+                                   xt_prefix[par->family], par->match->name,
+                                   par->match->revision,
+                                   XT_ALIGN(par->match->matchsize), size);
                 return -EINVAL;
         }
         if (par->match->table != NULL &&
             strcmp(par->match->table, par->table) != 0) {
-                pr_err("%s_tables: %s match: only valid in %s table, not %s\n",
-                       xt_prefix[par->family], par->match->name,
-                       par->match->table, par->table);
+                pr_info_ratelimited("%s_tables: %s match: only valid in %s table, not %s\n",
+                                    xt_prefix[par->family], par->match->name,
+                                    par->match->table, par->table);
                 return -EINVAL;
         }
         if (par->match->hooks && (par->hook_mask & ~par->match->hooks) != 0) {
                 char used[64], allow[64];
 
-                pr_err("%s_tables: %s match: used from hooks %s, but only "
-                       "valid from %s\n",
-                       xt_prefix[par->family], par->match->name,
-                       textify_hooks(used, sizeof(used), par->hook_mask,
-                                     par->family),
-                       textify_hooks(allow, sizeof(allow), par->match->hooks,
-                                     par->family));
+                pr_info_ratelimited("%s_tables: %s match: used from hooks %s, but only valid from %s\n",
+                                    xt_prefix[par->family], par->match->name,
+                                    textify_hooks(used, sizeof(used),
+                                                  par->hook_mask, par->family),
+                                    textify_hooks(allow, sizeof(allow),
+                                                  par->match->hooks,
+                                                  par->family));
                 return -EINVAL;
         }
         if (par->match->proto && (par->match->proto != proto || inv_proto)) {
-                pr_err("%s_tables: %s match: only valid for protocol %u\n",
-                       xt_prefix[par->family], par->match->name,
-                       par->match->proto);
+                pr_info_ratelimited("%s_tables: %s match: only valid for protocol %u\n",
+                                    xt_prefix[par->family], par->match->name,
+                                    par->match->proto);
                 return -EINVAL;
         }
         if (par->match->checkentry != NULL) {
@@ -814,36 +813,35 @@ int xt_check_target(struct xt_tgchk_param *par,
         int ret;
 
         if (XT_ALIGN(par->target->targetsize) != size) {
-                pr_err("%s_tables: %s.%u target: invalid size "
-                       "%u (kernel) != (user) %u\n",
-                       xt_prefix[par->family], par->target->name,
-                       par->target->revision,
-                       XT_ALIGN(par->target->targetsize), size);
+                pr_err_ratelimited("%s_tables: %s.%u target: invalid size %u (kernel) != (user) %u\n",
+                                   xt_prefix[par->family], par->target->name,
+                                   par->target->revision,
+                                   XT_ALIGN(par->target->targetsize), size);
                 return -EINVAL;
         }
         if (par->target->table != NULL &&
             strcmp(par->target->table, par->table) != 0) {
-                pr_err("%s_tables: %s target: only valid in %s table, not %s\n",
-                       xt_prefix[par->family], par->target->name,
-                       par->target->table, par->table);
+                pr_info_ratelimited("%s_tables: %s target: only valid in %s table, not %s\n",
+                                    xt_prefix[par->family], par->target->name,
+                                    par->target->table, par->table);
                 return -EINVAL;
         }
         if (par->target->hooks && (par->hook_mask & ~par->target->hooks) != 0) {
                 char used[64], allow[64];
 
-                pr_err("%s_tables: %s target: used from hooks %s, but only "
-                       "usable from %s\n",
-                       xt_prefix[par->family], par->target->name,
-                       textify_hooks(used, sizeof(used), par->hook_mask,
-                                     par->family),
-                       textify_hooks(allow, sizeof(allow), par->target->hooks,
-                                     par->family));
+                pr_info_ratelimited("%s_tables: %s target: used from hooks %s, but only usable from %s\n",
+                                    xt_prefix[par->family], par->target->name,
+                                    textify_hooks(used, sizeof(used),
+                                                  par->hook_mask, par->family),
+                                    textify_hooks(allow, sizeof(allow),
+                                                  par->target->hooks,
+                                                  par->family));
                 return -EINVAL;
         }
         if (par->target->proto && (par->target->proto != proto || inv_proto)) {
-                pr_err("%s_tables: %s target: only valid for protocol %u\n",
-                       xt_prefix[par->family], par->target->name,
-                       par->target->proto);
+                pr_info_ratelimited("%s_tables: %s target: only valid for protocol %u\n",
+                                    xt_prefix[par->family], par->target->name,
+                                    par->target->proto);
                 return -EINVAL;
         }
         if (par->target->checkentry != NULL) {
@@ -1004,10 +1002,6 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
         if (sz < sizeof(*info))
                 return NULL;
 
-        /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
-        if ((size >> PAGE_SHIFT) + 2 > totalram_pages)
-                return NULL;
-
         /* __GFP_NORETRY is not fully supported by kvmalloc but it should
          * work reasonably well if sz is too large and bail out rather
          * than shoot all processes down before realizing there is nothing
diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c
index c502419d6306..f368ee6741db 100644
--- a/net/netfilter/xt_AUDIT.c
+++ b/net/netfilter/xt_AUDIT.c
@@ -120,8 +120,8 @@ static int audit_tg_check(const struct xt_tgchk_param *par)
         const struct xt_audit_info *info = par->targinfo;
 
         if (info->type > XT_AUDIT_TYPE_MAX) {
-                pr_info("Audit type out of range (valid range: 0..%hhu)\n",
-                        XT_AUDIT_TYPE_MAX);
+                pr_info_ratelimited("Audit type out of range (valid range: 0..%hhu)\n",
+                                    XT_AUDIT_TYPE_MAX);
                 return -ERANGE;
         }
 
diff --git a/net/netfilter/xt_CHECKSUM.c b/net/netfilter/xt_CHECKSUM.c
index 0f642ef8cd26..9f4151ec3e06 100644
--- a/net/netfilter/xt_CHECKSUM.c
+++ b/net/netfilter/xt_CHECKSUM.c
@@ -36,13 +36,13 @@ static int checksum_tg_check(const struct xt_tgchk_param *par)
         const struct xt_CHECKSUM_info *einfo = par->targinfo;
 
         if (einfo->operation & ~XT_CHECKSUM_OP_FILL) {
-                pr_info("unsupported CHECKSUM operation %x\n", einfo->operation);
+                pr_info_ratelimited("unsupported CHECKSUM operation %x\n",
+                                    einfo->operation);
                 return -EINVAL;
         }
-        if (!einfo->operation) {
-                pr_info("no CHECKSUM operation enabled\n");
+        if (!einfo->operation)
                 return -EINVAL;
-        }
+
         return 0;
 }
 
diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c
index da56c06a443c..f3f1caac949b 100644
--- a/net/netfilter/xt_CONNSECMARK.c
+++ b/net/netfilter/xt_CONNSECMARK.c
@@ -91,8 +91,8 @@ static int connsecmark_tg_check(const struct xt_tgchk_param *par)
 
         if (strcmp(par->table, "mangle") != 0 &&
             strcmp(par->table, "security") != 0) {
-                pr_info("target only valid in the \'mangle\' "
-                        "or \'security\' tables, not \'%s\'.\n", par->table);
+                pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n",
+                                    par->table);
                 return -EINVAL;
         }
 
@@ -102,14 +102,14 @@ static int connsecmark_tg_check(const struct xt_tgchk_param *par)
                 break;
 
         default:
-                pr_info("invalid mode: %hu\n", info->mode);
+                pr_info_ratelimited("invalid mode: %hu\n", info->mode);
                 return -EINVAL;
         }
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0)
-                pr_info("cannot load conntrack support for proto=%u\n",
-                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
         return ret;
 }
 
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 5a152e2acfd5..8790190c6feb 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -82,15 +82,14 @@ xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
 
         proto = xt_ct_find_proto(par);
         if (!proto) {
-                pr_info("You must specify a L4 protocol, and not use "
-                        "inversions on it.\n");
+                pr_info_ratelimited("You must specify a L4 protocol and not use inversions on it\n");
                 return -ENOENT;
         }
 
         helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
                                                     proto);
         if (helper == NULL) {
-                pr_info("No such helper \"%s\"\n", helper_name);
+                pr_info_ratelimited("No such helper \"%s\"\n", helper_name);
                 return -ENOENT;
         }
 
@@ -124,6 +123,7 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
         const struct nf_conntrack_l4proto *l4proto;
         struct ctnl_timeout *timeout;
         struct nf_conn_timeout *timeout_ext;
+        const char *errmsg = NULL;
         int ret = 0;
         u8 proto;
 
@@ -131,29 +131,29 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
         timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
         if (timeout_find_get == NULL) {
                 ret = -ENOENT;
-                pr_info("Timeout policy base is empty\n");
+                errmsg = "Timeout policy base is empty";
                 goto out;
         }
 
         proto = xt_ct_find_proto(par);
         if (!proto) {
                 ret = -EINVAL;
-                pr_info("You must specify a L4 protocol, and not use "
-                        "inversions on it.\n");
+                errmsg = "You must specify a L4 protocol and not use inversions on it";
                 goto out;
         }
 
         timeout = timeout_find_get(par->net, timeout_name);
         if (timeout == NULL) {
                 ret = -ENOENT;
-                pr_info("No such timeout policy \"%s\"\n", timeout_name);
+                pr_info_ratelimited("No such timeout policy \"%s\"\n",
+                                    timeout_name);
                 goto out;
         }
 
         if (timeout->l3num != par->family) {
                 ret = -EINVAL;
-                pr_info("Timeout policy `%s' can only be used by L3 protocol "
-                        "number %d\n", timeout_name, timeout->l3num);
+                pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
+                                    timeout_name, 3, timeout->l3num);
                 goto err_put_timeout;
         }
         /* Make sure the timeout policy matches any existing protocol tracker,
@@ -162,9 +162,8 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
         l4proto = __nf_ct_l4proto_find(par->family, proto);
         if (timeout->l4proto->l4proto != l4proto->l4proto) {
                 ret = -EINVAL;
-                pr_info("Timeout policy `%s' can only be used by L4 protocol "
-                        "number %d\n",
-                        timeout_name, timeout->l4proto->l4proto);
+                pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
+                                    timeout_name, 4, timeout->l4proto->l4proto);
                 goto err_put_timeout;
         }
         timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
@@ -180,6 +179,8 @@ err_put_timeout:
         __xt_ct_tg_timeout_put(timeout);
 out:
         rcu_read_unlock();
+        if (errmsg)
+                pr_info_ratelimited("%s\n", errmsg);
         return ret;
 #else
         return -EOPNOTSUPP;
diff --git a/net/netfilter/xt_DSCP.c b/net/netfilter/xt_DSCP.c
index 3f83d38c4e5b..098ed851b7a7 100644
--- a/net/netfilter/xt_DSCP.c
+++ b/net/netfilter/xt_DSCP.c
@@ -66,10 +66,8 @@ static int dscp_tg_check(const struct xt_tgchk_param *par)
 {
         const struct xt_DSCP_info *info = par->targinfo;
 
-        if (info->dscp > XT_DSCP_MAX) {
-                pr_info("dscp %x out of range\n", info->dscp);
+        if (info->dscp > XT_DSCP_MAX)
                 return -EDOM;
-        }
         return 0;
 }
 
diff --git a/net/netfilter/xt_HL.c b/net/netfilter/xt_HL.c
index 1535e87ed9bd..4653b071bed4 100644
--- a/net/netfilter/xt_HL.c
+++ b/net/netfilter/xt_HL.c
@@ -105,10 +105,8 @@ static int ttl_tg_check(const struct xt_tgchk_param *par)
 {
         const struct ipt_TTL_info *info = par->targinfo;
 
-        if (info->mode > IPT_TTL_MAXMODE) {
-                pr_info("TTL: invalid or unknown mode %u\n", info->mode);
+        if (info->mode > IPT_TTL_MAXMODE)
                 return -EINVAL;
-        }
         if (info->mode != IPT_TTL_SET && info->ttl == 0)
                 return -EINVAL;
         return 0;
@@ -118,15 +116,10 @@ static int hl_tg6_check(const struct xt_tgchk_param *par)
 {
         const struct ip6t_HL_info *info = par->targinfo;
 
-        if (info->mode > IP6T_HL_MAXMODE) {
-                pr_info("invalid or unknown mode %u\n", info->mode);
+        if (info->mode > IP6T_HL_MAXMODE)
                 return -EINVAL;
-        }
-        if (info->mode != IP6T_HL_SET && info->hop_limit == 0) {
-                pr_info("increment/decrement does not "
-                        "make sense with value 0\n");
+        if (info->mode != IP6T_HL_SET && info->hop_limit == 0)
                 return -EINVAL;
-        }
         return 0;
 }
 
diff --git a/net/netfilter/xt_HMARK.c b/net/netfilter/xt_HMARK.c
index 60e6dbe12460..9c75f419cd80 100644
--- a/net/netfilter/xt_HMARK.c
+++ b/net/netfilter/xt_HMARK.c
@@ -9,6 +9,8 @@
  * the Free Software Foundation.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/icmp.h>
@@ -312,29 +314,30 @@ hmark_tg_v4(struct sk_buff *skb, const struct xt_action_param *par)
 static int hmark_tg_check(const struct xt_tgchk_param *par)
 {
         const struct xt_hmark_info *info = par->targinfo;
+        const char *errmsg = "proto mask must be zero with L3 mode";
 
-        if (!info->hmodulus) {
-                pr_info("xt_HMARK: hash modulus can't be zero\n");
+        if (!info->hmodulus)
                 return -EINVAL;
-        }
+
         if (info->proto_mask &&
-            (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))) {
-                pr_info("xt_HMARK: proto mask must be zero with L3 mode\n");
-                return -EINVAL;
-        }
+            (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3)))
+                goto err;
+
         if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPI_MASK) &&
             (info->flags & (XT_HMARK_FLAG(XT_HMARK_SPORT_MASK) |
-                             XT_HMARK_FLAG(XT_HMARK_DPORT_MASK)))) {
-                pr_info("xt_HMARK: spi-mask and port-mask can't be combined\n");
+                             XT_HMARK_FLAG(XT_HMARK_DPORT_MASK))))
                 return -EINVAL;
-        }
+
         if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPI) &&
             (info->flags & (XT_HMARK_FLAG(XT_HMARK_SPORT) |
                              XT_HMARK_FLAG(XT_HMARK_DPORT)))) {
-                pr_info("xt_HMARK: spi-set and port-set can't be combined\n");
-                return -EINVAL;
+                errmsg = "spi-set and port-set can't be combined";
+                goto err;
         }
         return 0;
+err:
+        pr_info_ratelimited("%s\n", errmsg);
+        return -EINVAL;
 }
 
 static struct xt_target hmark_tg_reg[] __read_mostly = {
diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index 6c2482b709b1..1ac6600bfafd 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -146,11 +146,11 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)
         timer_setup(&info->timer->timer, idletimer_tg_expired, 0);
         info->timer->refcnt = 1;
 
+        INIT_WORK(&info->timer->work, idletimer_tg_work);
+
         mod_timer(&info->timer->timer,
                   msecs_to_jiffies(info->timeout * 1000) + jiffies);
 
-        INIT_WORK(&info->timer->work, idletimer_tg_work);
-
         return 0;
 
 out_free_attr:
@@ -191,7 +191,10 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par)
                 pr_debug("timeout value is zero\n");
                 return -EINVAL;
         }
-
+        if (info->timeout >= INT_MAX / 1000) {
+                pr_debug("timeout value is too big\n");
+                return -EINVAL;
+        }
         if (info->label[0] == '\0' ||
             strnlen(info->label,
                     MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) {
diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c
index 1dcad893df78..19846445504d 100644
--- a/net/netfilter/xt_LED.c
+++ b/net/netfilter/xt_LED.c
@@ -111,10 +111,8 @@ static int led_tg_check(const struct xt_tgchk_param *par)
         struct xt_led_info_internal *ledinternal;
         int err;
 
-        if (ledinfo->id[0] == '\0') {
-                pr_info("No 'id' parameter given.\n");
+        if (ledinfo->id[0] == '\0')
                 return -EINVAL;
-        }
 
         mutex_lock(&xt_led_mutex);
 
@@ -138,13 +136,14 @@ static int led_tg_check(const struct xt_tgchk_param *par)
 
         err = led_trigger_register(&ledinternal->netfilter_led_trigger);
         if (err) {
-                pr_err("Trigger name is already in use.\n");
+                pr_info_ratelimited("Trigger name is already in use.\n");
                 goto exit_alloc;
         }
 
-        /* See if we need to set up a timer */
-        if (ledinfo->delay > 0)
-                timer_setup(&ledinternal->timer, led_timeout_callback, 0);
+        /* Since the letinternal timer can be shared between multiple targets,
+         * always set it up, even if the current target does not need it
+         */
+        timer_setup(&ledinternal->timer, led_timeout_callback, 0);
 
         list_add_tail(&ledinternal->list, &xt_led_triggers);
 
@@ -181,8 +180,7 @@ static void led_tg_destroy(const struct xt_tgdtor_param *par)
 
         list_del(&ledinternal->list);
 
-        if (ledinfo->delay > 0)
-                del_timer_sync(&ledinternal->timer);
+        del_timer_sync(&ledinternal->timer);
 
         led_trigger_unregister(&ledinternal->netfilter_led_trigger);
 
diff --git a/net/netfilter/xt_NFQUEUE.c b/net/netfilter/xt_NFQUEUE.c
index a360b99a958a..a9aca80a32ae 100644
--- a/net/netfilter/xt_NFQUEUE.c
+++ b/net/netfilter/xt_NFQUEUE.c
@@ -8,6 +8,8 @@
  *
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/skbuff.h>
 
@@ -67,13 +69,13 @@ static int nfqueue_tg_check(const struct xt_tgchk_param *par)
         init_hashrandom(&jhash_initval);
 
         if (info->queues_total == 0) {
-                pr_err("NFQUEUE: number of total queues is 0\n");
+                pr_info_ratelimited("number of total queues is 0\n");
                 return -EINVAL;
         }
         maxid = info->queues_total - 1 + info->queuenum;
         if (maxid > 0xffff) {
-                pr_err("NFQUEUE: number of queues (%u) out of range (got %u)\n",
-                       info->queues_total, maxid);
+                pr_info_ratelimited("number of queues (%u) out of range (got %u)\n",
+                                    info->queues_total, maxid);
                 return -ERANGE;
         }
         if (par->target->revision == 2 && info->flags > 1)
diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
index 9faf5e050b79..4ad5fe27e08b 100644
--- a/net/netfilter/xt_SECMARK.c
+++ b/net/netfilter/xt_SECMARK.c
@@ -60,18 +60,20 @@ static int checkentry_lsm(struct xt_secmark_target_info *info)
                                        &info->secid);
         if (err) {
                 if (err == -EINVAL)
-                        pr_info("invalid security context \'%s\'\n", info->secctx);
+                        pr_info_ratelimited("invalid security context \'%s\'\n",
+                                            info->secctx);
                 return err;
         }
 
         if (!info->secid) {
-                pr_info("unable to map security context \'%s\'\n", info->secctx);
+                pr_info_ratelimited("unable to map security context \'%s\'\n",
+                                    info->secctx);
                 return -ENOENT;
         }
 
         err = security_secmark_relabel_packet(info->secid);
         if (err) {
-                pr_info("unable to obtain relabeling permission\n");
+                pr_info_ratelimited("unable to obtain relabeling permission\n");
                 return err;
         }
 
@@ -86,14 +88,14 @@ static int secmark_tg_check(const struct xt_tgchk_param *par)
 
         if (strcmp(par->table, "mangle") != 0 &&
             strcmp(par->table, "security") != 0) {
-                pr_info("target only valid in the \'mangle\' "
-                        "or \'security\' tables, not \'%s\'.\n", par->table);
+                pr_info_ratelimited("only valid in \'mangle\' or \'security\' table, not \'%s\'\n",
+                                    par->table);
                 return -EINVAL;
         }
 
         if (mode && mode != info->mode) {
-                pr_info("mode already set to %hu cannot mix with "
-                        "rules for mode %hu\n", mode, info->mode);
+                pr_info_ratelimited("mode already set to %hu cannot mix with rules for mode %hu\n",
+                                    mode, info->mode);
                 return -EINVAL;
         }
 
@@ -101,7 +103,7 @@ static int secmark_tg_check(const struct xt_tgchk_param *par)
         case SECMARK_MODE_SEL:
                 break;
         default:
-                pr_info("invalid mode: %hu\n", info->mode);
+                pr_info_ratelimited("invalid mode: %hu\n", info->mode);
                 return -EINVAL;
         }
 
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 99bb8e410f22..98efb202f8b4 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -273,8 +273,7 @@ static int tcpmss_tg4_check(const struct xt_tgchk_param *par)
             (par->hook_mask & ~((1 << NF_INET_FORWARD) |
                            (1 << NF_INET_LOCAL_OUT) |
                            (1 << NF_INET_POST_ROUTING))) != 0) {
-                pr_info("path-MTU clamping only supported in "
-                        "FORWARD, OUTPUT and POSTROUTING hooks\n");
+                pr_info_ratelimited("path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks\n");
                 return -EINVAL;
         }
         if (par->nft_compat)
@@ -283,7 +282,7 @@ static int tcpmss_tg4_check(const struct xt_tgchk_param *par)
         xt_ematch_foreach(ematch, e)
                 if (find_syn_match(ematch))
                         return 0;
-        pr_info("Only works on TCP SYN packets\n");
+        pr_info_ratelimited("Only works on TCP SYN packets\n");
         return -EINVAL;
 }
 
@@ -298,8 +297,7 @@ static int tcpmss_tg6_check(const struct xt_tgchk_param *par)
             (par->hook_mask & ~((1 << NF_INET_FORWARD) |
                            (1 << NF_INET_LOCAL_OUT) |
                            (1 << NF_INET_POST_ROUTING))) != 0) {
-                pr_info("path-MTU clamping only supported in "
-                        "FORWARD, OUTPUT and POSTROUTING hooks\n");
+                pr_info_ratelimited("path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks\n");
                 return -EINVAL;
         }
         if (par->nft_compat)
@@ -308,7 +306,7 @@ static int tcpmss_tg6_check(const struct xt_tgchk_param *par)
         xt_ematch_foreach(ematch, e)
                 if (find_syn_match(ematch))
                         return 0;
-        pr_info("Only works on TCP SYN packets\n");
+        pr_info_ratelimited("Only works on TCP SYN packets\n");
         return -EINVAL;
 }
 #endif
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index 17d7705e3bd4..8c89323c06af 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -540,8 +540,7 @@ static int tproxy_tg6_check(const struct xt_tgchk_param *par)
             !(i->invflags & IP6T_INV_PROTO))
                 return 0;
 
-        pr_info("Can be used only in combination with "
-                "either -p tcp or -p udp\n");
+        pr_info_ratelimited("Can be used only with -p tcp or -p udp\n");
         return -EINVAL;
 }
 #endif
@@ -559,8 +558,7 @@ static int tproxy_tg4_check(const struct xt_tgchk_param *par)
             && !(i->invflags & IPT_INV_PROTO))
                 return 0;
 
-        pr_info("Can be used only in combination with "
-                "either -p tcp or -p udp\n");
+        pr_info_ratelimited("Can be used only with -p tcp or -p udp\n");
         return -EINVAL;
 }
 
diff --git a/net/netfilter/xt_addrtype.c b/net/netfilter/xt_addrtype.c
index 911a7c0da504..89e281b3bfc2 100644
--- a/net/netfilter/xt_addrtype.c
+++ b/net/netfilter/xt_addrtype.c
@@ -164,48 +164,47 @@ addrtype_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
 
 static int addrtype_mt_checkentry_v1(const struct xt_mtchk_param *par)
 {
+        const char *errmsg = "both incoming and outgoing interface limitation cannot be selected";
         struct xt_addrtype_info_v1 *info = par->matchinfo;
 
         if (info->flags & XT_ADDRTYPE_LIMIT_IFACE_IN &&
-            info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT) {
-                pr_info("both incoming and outgoing "
-                        "interface limitation cannot be selected\n");
-                return -EINVAL;
-        }
+            info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT)
+                goto err;
 
         if (par->hook_mask & ((1 << NF_INET_PRE_ROUTING) |
             (1 << NF_INET_LOCAL_IN)) &&
             info->flags & XT_ADDRTYPE_LIMIT_IFACE_OUT) {
-                pr_info("output interface limitation "
-                        "not valid in PREROUTING and INPUT\n");
-                return -EINVAL;
+                errmsg = "output interface limitation not valid in PREROUTING and INPUT";
+                goto err;
         }
 
         if (par->hook_mask & ((1 << NF_INET_POST_ROUTING) |
             (1 << NF_INET_LOCAL_OUT)) &&
             info->flags & XT_ADDRTYPE_LIMIT_IFACE_IN) {
-                pr_info("input interface limitation "
-                        "not valid in POSTROUTING and OUTPUT\n");
-                return -EINVAL;
+                errmsg = "input interface limitation not valid in POSTROUTING and OUTPUT";
+                goto err;
         }
 
 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
         if (par->family == NFPROTO_IPV6) {
                 if ((info->source | info->dest) & XT_ADDRTYPE_BLACKHOLE) {
-                        pr_err("ipv6 BLACKHOLE matching not supported\n");
-                        return -EINVAL;
+                        errmsg = "ipv6 BLACKHOLE matching not supported";
+                        goto err;
                 }
                 if ((info->source | info->dest) >= XT_ADDRTYPE_PROHIBIT) {
-                        pr_err("ipv6 PROHIBIT (THROW, NAT ..) matching not supported\n");
-                        return -EINVAL;
+                        errmsg = "ipv6 PROHIBIT (THROW, NAT ..) matching not supported";
+                        goto err;
                 }
                 if ((info->source | info->dest) & XT_ADDRTYPE_BROADCAST) {
-                        pr_err("ipv6 does not support BROADCAST matching\n");
-                        return -EINVAL;
+                        errmsg = "ipv6 does not support BROADCAST matching";
+                        goto err;
                 }
         }
 #endif
         return 0;
+err:
+        pr_info_ratelimited("%s\n", errmsg);
+        return -EINVAL;
 }
 
 static struct xt_match addrtype_mt_reg[] __read_mostly = {
diff --git a/net/netfilter/xt_bpf.c b/net/netfilter/xt_bpf.c
index 06b090d8e901..a2cf8a6236d6 100644
--- a/net/netfilter/xt_bpf.c
+++ b/net/netfilter/xt_bpf.c
@@ -7,6 +7,8 @@
  * published by the Free Software Foundation.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/syscalls.h>
 #include <linux/skbuff.h>
@@ -34,7 +36,7 @@ static int __bpf_mt_check_bytecode(struct sock_filter *insns, __u16 len,
         program.filter = insns;
 
         if (bpf_prog_create(ret, &program)) {
-                pr_info("bpf: check failed: parse error\n");
+                pr_info_ratelimited("check failed: parse error\n");
                 return -EINVAL;
         }
 
diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
index 891f4e7e8ea7..7df2dece57d3 100644
--- a/net/netfilter/xt_cgroup.c
+++ b/net/netfilter/xt_cgroup.c
@@ -12,6 +12,8 @@
  * published by the Free Software Foundation.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/skbuff.h>
 #include <linux/module.h>
 #include <linux/netfilter/x_tables.h>
@@ -48,7 +50,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
         }
 
         if (info->has_path && info->has_classid) {
-                pr_info("xt_cgroup: both path and classid specified\n");
+                pr_info_ratelimited("path and classid specified\n");
                 return -EINVAL;
         }
 
@@ -56,8 +58,8 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
         if (info->has_path) {
                 cgrp = cgroup_get_from_path(info->path);
                 if (IS_ERR(cgrp)) {
-                        pr_info("xt_cgroup: invalid path, errno=%ld\n",
-                                PTR_ERR(cgrp));
+                        pr_info_ratelimited("invalid path, errno=%ld\n",
+                                            PTR_ERR(cgrp));
                         return -EINVAL;
                 }
                 info->priv = cgrp;
diff --git a/net/netfilter/xt_cluster.c b/net/netfilter/xt_cluster.c
index 57ef175dfbfa..0068688995c8 100644
--- a/net/netfilter/xt_cluster.c
+++ b/net/netfilter/xt_cluster.c
@@ -135,14 +135,12 @@ static int xt_cluster_mt_checkentry(const struct xt_mtchk_param *par)
         struct xt_cluster_match_info *info = par->matchinfo;
 
         if (info->total_nodes > XT_CLUSTER_NODES_MAX) {
-                pr_info("you have exceeded the maximum "
-                        "number of cluster nodes (%u > %u)\n",
-                        info->total_nodes, XT_CLUSTER_NODES_MAX);
+                pr_info_ratelimited("you have exceeded the maximum number of cluster nodes (%u > %u)\n",
+                                    info->total_nodes, XT_CLUSTER_NODES_MAX);
                 return -EINVAL;
         }
         if (info->node_mask >= (1ULL << info->total_nodes)) {
-                pr_info("this node mask cannot be "
-                        "higher than the total number of nodes\n");
+                pr_info_ratelimited("node mask cannot exceed total number of nodes\n");
                 return -EDOM;
         }
         return 0;
diff --git a/net/netfilter/xt_connbytes.c b/net/netfilter/xt_connbytes.c
index cad0b7b5eb35..93cb018c3055 100644
--- a/net/netfilter/xt_connbytes.c
+++ b/net/netfilter/xt_connbytes.c
@@ -112,8 +112,8 @@ static int connbytes_mt_check(const struct xt_mtchk_param *par)
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0)
-                pr_info("cannot load conntrack support for proto=%u\n",
-                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
 
         /*
          * This filter cannot function correctly unless connection tracking
diff --git a/net/netfilter/xt_connlabel.c b/net/netfilter/xt_connlabel.c
index 23372879e6e3..4fa4efd24353 100644
--- a/net/netfilter/xt_connlabel.c
+++ b/net/netfilter/xt_connlabel.c
@@ -57,14 +57,15 @@ static int connlabel_mt_check(const struct xt_mtchk_param *par)
         int ret;
 
         if (info->options & ~options) {
-                pr_err("Unknown options in mask %x\n", info->options);
+                pr_info_ratelimited("Unknown options in mask %x\n",
+                                    info->options);
                 return -EINVAL;
         }
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0) {
-                pr_info("cannot load conntrack support for proto=%u\n",
-                                                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
                 return ret;
         }
 
diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index ec377cc6a369..809639ce6f5a 100644
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -79,8 +79,8 @@ static int connmark_tg_check(const struct xt_tgchk_param *par)
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0)
-                pr_info("cannot load conntrack support for proto=%u\n",
-                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
         return ret;
 }
 
@@ -109,8 +109,8 @@ static int connmark_mt_check(const struct xt_mtchk_param *par)
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0)
-                pr_info("cannot load conntrack support for proto=%u\n",
-                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
         return ret;
 }
 
diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.c
index 39cf1d019240..df80fe7d391c 100644
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -272,8 +272,8 @@ static int conntrack_mt_check(const struct xt_mtchk_param *par)
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0)
-                pr_info("cannot load conntrack support for proto=%u\n",
-                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
         return ret;
 }
 
diff --git a/net/netfilter/xt_dscp.c b/net/netfilter/xt_dscp.c
index 236ac8008909..a4c2b862f820 100644
--- a/net/netfilter/xt_dscp.c
+++ b/net/netfilter/xt_dscp.c
@@ -46,10 +46,8 @@ static int dscp_mt_check(const struct xt_mtchk_param *par)
 {
         const struct xt_dscp_info *info = par->matchinfo;
 
-        if (info->dscp > XT_DSCP_MAX) {
-                pr_info("dscp %x out of range\n", info->dscp);
+        if (info->dscp > XT_DSCP_MAX)
                 return -EDOM;
-        }
 
         return 0;
 }
diff --git a/net/netfilter/xt_ecn.c b/net/netfilter/xt_ecn.c
index 3c831a8efebc..c7ad4afa5fb8 100644
--- a/net/netfilter/xt_ecn.c
+++ b/net/netfilter/xt_ecn.c
@@ -97,7 +97,7 @@ static int ecn_mt_check4(const struct xt_mtchk_param *par)
 
         if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
             (ip->proto != IPPROTO_TCP || ip->invflags & IPT_INV_PROTO)) {
-                pr_info("cannot match TCP bits in rule for non-tcp packets\n");
+                pr_info_ratelimited("cannot match TCP bits for non-tcp packets\n");
                 return -EINVAL;
         }
 
@@ -139,7 +139,7 @@ static int ecn_mt_check6(const struct xt_mtchk_param *par)
 
         if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
             (ip->proto != IPPROTO_TCP || ip->invflags & IP6T_INV_PROTO)) {
-                pr_info("cannot match TCP bits in rule for non-tcp packets\n");
+                pr_info_ratelimited("cannot match TCP bits for non-tcp packets\n");
                 return -EINVAL;
         }
 
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index ca6847403ca2..66f5aca62a08 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -523,7 +523,8 @@ static u64 user2rate(u64 user)
         if (user != 0) {
                 return div64_u64(XT_HASHLIMIT_SCALE_v2, user);
         } else {
-                pr_warn("invalid rate from userspace: %llu\n", user);
+                pr_info_ratelimited("invalid rate from userspace: %llu\n",
+                                    user);
                 return 0;
         }
 }
@@ -774,7 +775,7 @@ hashlimit_mt_common(const struct sk_buff *skb, struct xt_action_param *par,
                 if (!dh->rateinfo.prev_window &&
                     (dh->rateinfo.current_rate <= dh->rateinfo.burst)) {
                         spin_unlock(&dh->lock);
-                        rcu_read_unlock_bh();
+                        local_bh_enable();
                         return !(cfg->mode & XT_HASHLIMIT_INVERT);
                 } else {
                         goto overlimit;
@@ -865,33 +866,34 @@ static int hashlimit_mt_check_common(const struct xt_mtchk_param *par,
         }
 
         if (cfg->mode & ~XT_HASHLIMIT_ALL) {
-                pr_info("Unknown mode mask %X, kernel too old?\n",
-                                                cfg->mode);
+                pr_info_ratelimited("Unknown mode mask %X, kernel too old?\n",
+                                    cfg->mode);
                 return -EINVAL;
         }
 
         /* Check for overflow. */
         if (revision >= 3 && cfg->mode & XT_HASHLIMIT_RATE_MATCH) {
                 if (cfg->avg == 0 || cfg->avg > U32_MAX) {
-                        pr_info("hashlimit invalid rate\n");
+                        pr_info_ratelimited("invalid rate\n");
                         return -ERANGE;
                 }
 
                 if (cfg->interval == 0) {
-                        pr_info("hashlimit invalid interval\n");
+                        pr_info_ratelimited("invalid interval\n");
                         return -EINVAL;
                 }
         } else if (cfg->mode & XT_HASHLIMIT_BYTES) {
                 if (user2credits_byte(cfg->avg) == 0) {
-                        pr_info("overflow, rate too high: %llu\n", cfg->avg);
+                        pr_info_ratelimited("overflow, rate too high: %llu\n",
+                                            cfg->avg);
                         return -EINVAL;
                 }
         } else if (cfg->burst == 0 ||
-                    user2credits(cfg->avg * cfg->burst, revision) <
-                    user2credits(cfg->avg, revision)) {
-                        pr_info("overflow, try lower: %llu/%llu\n",
-                                cfg->avg, cfg->burst);
-                        return -ERANGE;
+                   user2credits(cfg->avg * cfg->burst, revision) <
+                   user2credits(cfg->avg, revision)) {
+                pr_info_ratelimited("overflow, try lower: %llu/%llu\n",
+                                    cfg->avg, cfg->burst);
+                return -ERANGE;
         }
 
         mutex_lock(&hashlimit_mutex);
diff --git a/net/netfilter/xt_helper.c b/net/netfilter/xt_helper.c
index 38a78151c0e9..fd077aeaaed9 100644
--- a/net/netfilter/xt_helper.c
+++ b/net/netfilter/xt_helper.c
@@ -61,8 +61,8 @@ static int helper_mt_check(const struct xt_mtchk_param *par)
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0) {
-                pr_info("cannot load conntrack support for proto=%u\n",
-                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
                 return ret;
         }
         info->name[sizeof(info->name) - 1] = '\0';
diff --git a/net/netfilter/xt_ipcomp.c b/net/netfilter/xt_ipcomp.c
index 7ca64a50db04..57f1df575701 100644
--- a/net/netfilter/xt_ipcomp.c
+++ b/net/netfilter/xt_ipcomp.c
@@ -72,7 +72,7 @@ static int comp_mt_check(const struct xt_mtchk_param *par)
 
         /* Must specify no unknown invflags */
         if (compinfo->invflags & ~XT_IPCOMP_INV_MASK) {
-                pr_err("unknown flags %X\n", compinfo->invflags);
+                pr_info_ratelimited("unknown flags %X\n", compinfo->invflags);
                 return -EINVAL;
         }
         return 0;
diff --git a/net/netfilter/xt_ipvs.c b/net/netfilter/xt_ipvs.c
index 42540d26c2b8..1d950a6100af 100644
--- a/net/netfilter/xt_ipvs.c
+++ b/net/netfilter/xt_ipvs.c
@@ -158,7 +158,8 @@ static int ipvs_mt_check(const struct xt_mtchk_param *par)
             && par->family != NFPROTO_IPV6
 #endif
                 ) {
-                pr_info("protocol family %u not supported\n", par->family);
+                pr_info_ratelimited("protocol family %u not supported\n",
+                                    par->family);
                 return -EINVAL;
         }
 
diff --git a/net/netfilter/xt_l2tp.c b/net/netfilter/xt_l2tp.c
index 8aee572771f2..c43482bf48e6 100644
--- a/net/netfilter/xt_l2tp.c
+++ b/net/netfilter/xt_l2tp.c
@@ -216,7 +216,7 @@ static int l2tp_mt_check(const struct xt_mtchk_param *par)
         /* Check for invalid flags */
         if (info->flags & ~(XT_L2TP_TID | XT_L2TP_SID | XT_L2TP_VERSION |
                             XT_L2TP_TYPE)) {
-                pr_info("unknown flags: %x\n", info->flags);
+                pr_info_ratelimited("unknown flags: %x\n", info->flags);
                 return -EINVAL;
         }
 
@@ -225,7 +225,8 @@ static int l2tp_mt_check(const struct xt_mtchk_param *par)
             (!(info->flags & XT_L2TP_SID)) &&
             ((!(info->flags & XT_L2TP_TYPE)) ||
              (info->type != XT_L2TP_TYPE_CONTROL))) {
-                pr_info("invalid flags combination: %x\n", info->flags);
+                pr_info_ratelimited("invalid flags combination: %x\n",
+                                    info->flags);
                 return -EINVAL;
         }
 
@@ -234,19 +235,22 @@ static int l2tp_mt_check(const struct xt_mtchk_param *par)
          */
         if (info->flags & XT_L2TP_VERSION) {
                 if ((info->version < 2) || (info->version > 3)) {
-                        pr_info("wrong L2TP version: %u\n", info->version);
+                        pr_info_ratelimited("wrong L2TP version: %u\n",
+                                            info->version);
                         return -EINVAL;
                 }
 
                 if (info->version == 2) {
                         if ((info->flags & XT_L2TP_TID) &&
                             (info->tid > 0xffff)) {
-                                pr_info("v2 tid > 0xffff: %u\n", info->tid);
+                                pr_info_ratelimited("v2 tid > 0xffff: %u\n",
+                                                    info->tid);
                                 return -EINVAL;
                         }
                         if ((info->flags & XT_L2TP_SID) &&
                             (info->sid > 0xffff)) {
-                                pr_info("v2 sid > 0xffff: %u\n", info->sid);
+                                pr_info_ratelimited("v2 sid > 0xffff: %u\n",
+                                                    info->sid);
                                 return -EINVAL;
                         }
                 }
@@ -268,13 +272,13 @@ static int l2tp_mt_check4(const struct xt_mtchk_param *par)
 
         if ((ip->proto != IPPROTO_UDP) &&
             (ip->proto != IPPROTO_L2TP)) {
-                pr_info("missing protocol rule (udp|l2tpip)\n");
+                pr_info_ratelimited("missing protocol rule (udp|l2tpip)\n");
                 return -EINVAL;
         }
 
         if ((ip->proto == IPPROTO_L2TP) &&
             (info->version == 2)) {
-                pr_info("v2 doesn't support IP mode\n");
+                pr_info_ratelimited("v2 doesn't support IP mode\n");
                 return -EINVAL;
         }
 
@@ -295,13 +299,13 @@ static int l2tp_mt_check6(const struct xt_mtchk_param *par)
 
         if ((ip->proto != IPPROTO_UDP) &&
             (ip->proto != IPPROTO_L2TP)) {
-                pr_info("missing protocol rule (udp|l2tpip)\n");
+                pr_info_ratelimited("missing protocol rule (udp|l2tpip)\n");
                 return -EINVAL;
         }
 
         if ((ip->proto == IPPROTO_L2TP) &&
             (info->version == 2)) {
-                pr_info("v2 doesn't support IP mode\n");
+                pr_info_ratelimited("v2 doesn't support IP mode\n");
                 return -EINVAL;
         }
 
diff --git a/net/netfilter/xt_limit.c b/net/netfilter/xt_limit.c
index 61403b77361c..55d18cd67635 100644
--- a/net/netfilter/xt_limit.c
+++ b/net/netfilter/xt_limit.c
@@ -106,8 +106,8 @@ static int limit_mt_check(const struct xt_mtchk_param *par)
         /* Check for overflow. */
         if (r->burst == 0
             || user2credits(r->avg * r->burst) < user2credits(r->avg)) {
-                pr_info("Overflow, try lower: %u/%u\n",
-                        r->avg, r->burst);
+                pr_info_ratelimited("Overflow, try lower: %u/%u\n",
+                                    r->avg, r->burst);
                 return -ERANGE;
         }
 
diff --git a/net/netfilter/xt_nat.c b/net/netfilter/xt_nat.c
index 0fd14d1eb09d..bdb689cdc829 100644
--- a/net/netfilter/xt_nat.c
+++ b/net/netfilter/xt_nat.c
@@ -8,6 +8,8 @@
  * published by the Free Software Foundation.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/netfilter.h>
@@ -19,8 +21,7 @@ static int xt_nat_checkentry_v0(const struct xt_tgchk_param *par)
         const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
         if (mr->rangesize != 1) {
-                pr_info("%s: multiple ranges no longer supported\n",
-                        par->target->name);
+                pr_info_ratelimited("multiple ranges no longer supported\n");
                 return -EINVAL;
         }
         return nf_ct_netns_get(par->net, par->family);
diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c
index 6f92d25590a8..c8674deed4eb 100644
--- a/net/netfilter/xt_nfacct.c
+++ b/net/netfilter/xt_nfacct.c
@@ -6,6 +6,8 @@
  * it under the terms of the GNU General Public License version 2 (or any
  * later at your option) as published by the Free Software Foundation.
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/skbuff.h>
 
@@ -39,8 +41,8 @@ nfacct_mt_checkentry(const struct xt_mtchk_param *par)
 
         nfacct = nfnl_acct_find_get(par->net, info->name);
         if (nfacct == NULL) {
-                pr_info("xt_nfacct: accounting object with name `%s' "
-                        "does not exists\n", info->name);
+                pr_info_ratelimited("accounting object `%s' does not exists\n",
+                                    info->name);
                 return -ENOENT;
         }
         info->nfacct = nfacct;
diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index bb33598e4530..9d6d67b953ac 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -107,9 +107,7 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
              info->invert & XT_PHYSDEV_OP_BRIDGED) &&
             par->hook_mask & ((1 << NF_INET_LOCAL_OUT) |
             (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) {
-                pr_info("using --physdev-out and --physdev-is-out are only "
-                        "supported in the FORWARD and POSTROUTING chains with "
-                        "bridged traffic.\n");
+                pr_info_ratelimited("--physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic\n");
                 if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
                         return -EINVAL;
         }
diff --git a/net/netfilter/xt_policy.c b/net/netfilter/xt_policy.c
index 5639fb03bdd9..13f8ccf946d6 100644
--- a/net/netfilter/xt_policy.c
+++ b/net/netfilter/xt_policy.c
@@ -132,26 +132,29 @@ policy_mt(const struct sk_buff *skb, struct xt_action_param *par)
 static int policy_mt_check(const struct xt_mtchk_param *par)
 {
         const struct xt_policy_info *info = par->matchinfo;
+        const char *errmsg = "neither incoming nor outgoing policy selected";
+
+        if (!(info->flags & (XT_POLICY_MATCH_IN|XT_POLICY_MATCH_OUT)))
+                goto err;
 
-        if (!(info->flags & (XT_POLICY_MATCH_IN|XT_POLICY_MATCH_OUT))) {
-                pr_info("neither incoming nor outgoing policy selected\n");
-                return -EINVAL;
-        }
         if (par->hook_mask & ((1 << NF_INET_PRE_ROUTING) |
             (1 << NF_INET_LOCAL_IN)) && info->flags & XT_POLICY_MATCH_OUT) {
-                pr_info("output policy not valid in PREROUTING and INPUT\n");
-                return -EINVAL;
+                errmsg = "output policy not valid in PREROUTING and INPUT";
+                goto err;
         }
         if (par->hook_mask & ((1 << NF_INET_POST_ROUTING) |
             (1 << NF_INET_LOCAL_OUT)) && info->flags & XT_POLICY_MATCH_IN) {
-                pr_info("input policy not valid in POSTROUTING and OUTPUT\n");
-                return -EINVAL;
+                errmsg = "input policy not valid in POSTROUTING and OUTPUT";
+                goto err;
         }
         if (info->len > XT_POLICY_MAX_ELEM) {
-                pr_info("too many policy elements\n");
-                return -EINVAL;
+                errmsg = "too many policy elements";
+                goto err;
         }
         return 0;
+err:
+        pr_info_ratelimited("%s\n", errmsg);
+        return -EINVAL;
 }
 
 static struct xt_match policy_mt_reg[] __read_mostly = {
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 245fa350a7a8..6d232d18faff 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -342,8 +342,8 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
         net_get_random_once(&hash_rnd, sizeof(hash_rnd));
 
         if (info->check_set & ~XT_RECENT_VALID_FLAGS) {
-                pr_info("Unsupported user space flags (%08x)\n",
-                        info->check_set);
+                pr_info_ratelimited("Unsupported userspace flags (%08x)\n",
+                                    info->check_set);
                 return -EINVAL;
         }
         if (hweight8(info->check_set &
@@ -357,8 +357,8 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
         if ((info->check_set & XT_RECENT_REAP) && !info->seconds)
                 return -EINVAL;
         if (info->hit_count >= XT_RECENT_MAX_NSTAMPS) {
-                pr_info("hitcount (%u) is larger than allowed maximum (%u)\n",
-                        info->hit_count, XT_RECENT_MAX_NSTAMPS - 1);
+                pr_info_ratelimited("hitcount (%u) is larger than allowed maximum (%u)\n",
+                                    info->hit_count, XT_RECENT_MAX_NSTAMPS - 1);
                 return -EINVAL;
         }
         if (info->name[0] == '\0' ||
@@ -587,7 +587,7 @@ recent_mt_proc_write(struct file *file, const char __user *input,
                 add = true;
                 break;
         default:
-                pr_info("Need \"+ip\", \"-ip\" or \"/\"\n");
+                pr_info_ratelimited("Need \"+ip\", \"-ip\" or \"/\"\n");
                 return -EINVAL;
         }
 
@@ -601,10 +601,8 @@ recent_mt_proc_write(struct file *file, const char __user *input,
                 succ   = in4_pton(c, size, (void *)&addr, '\n', NULL);
         }
 
-        if (!succ) {
-                pr_info("illegal address written to procfs\n");
+        if (!succ)
                 return -EINVAL;
-        }
 
         spin_lock_bh(&recent_lock);
         e = recent_entry_lookup(t, &addr, family, 0);
diff --git a/net/netfilter/xt_set.c b/net/netfilter/xt_set.c
index 16b6b11ee83f..6f4c5217d835 100644
--- a/net/netfilter/xt_set.c
+++ b/net/netfilter/xt_set.c
@@ -92,12 +92,12 @@ set_match_v0_checkentry(const struct xt_mtchk_param *par)
         index = ip_set_nfnl_get_byindex(par->net, info->match_set.index);
 
         if (index == IPSET_INVALID_ID) {
-                pr_warn("Cannot find set identified by id %u to match\n",
-                        info->match_set.index);
+                pr_info_ratelimited("Cannot find set identified by id %u to match\n",
+                                    info->match_set.index);
                 return -ENOENT;
         }
         if (info->match_set.u.flags[IPSET_DIM_MAX - 1] != 0) {
-                pr_warn("Protocol error: set match dimension is over the limit!\n");
+                pr_info_ratelimited("set match dimension is over the limit!\n");
                 ip_set_nfnl_put(par->net, info->match_set.index);
                 return -ERANGE;
         }
@@ -143,12 +143,12 @@ set_match_v1_checkentry(const struct xt_mtchk_param *par)
         index = ip_set_nfnl_get_byindex(par->net, info->match_set.index);
 
         if (index == IPSET_INVALID_ID) {
-                pr_warn("Cannot find set identified by id %u to match\n",
-                        info->match_set.index);
+                pr_info_ratelimited("Cannot find set identified by id %u to match\n",
+                                    info->match_set.index);
                 return -ENOENT;
         }
         if (info->match_set.dim > IPSET_DIM_MAX) {
-                pr_warn("Protocol error: set match dimension is over the limit!\n");
+                pr_info_ratelimited("set match dimension is over the limit!\n");
                 ip_set_nfnl_put(par->net, info->match_set.index);
                 return -ERANGE;
         }
@@ -241,8 +241,8 @@ set_target_v0_checkentry(const struct xt_tgchk_param *par)
         if (info->add_set.index != IPSET_INVALID_ID) {
                 index = ip_set_nfnl_get_byindex(par->net, info->add_set.index);
                 if (index == IPSET_INVALID_ID) {
-                        pr_warn("Cannot find add_set index %u as target\n",
-                                info->add_set.index);
+                        pr_info_ratelimited("Cannot find add_set index %u as target\n",
+                                            info->add_set.index);
                         return -ENOENT;
                 }
         }
@@ -250,8 +250,8 @@ set_target_v0_checkentry(const struct xt_tgchk_param *par)
         if (info->del_set.index != IPSET_INVALID_ID) {
                 index = ip_set_nfnl_get_byindex(par->net, info->del_set.index);
                 if (index == IPSET_INVALID_ID) {
-                        pr_warn("Cannot find del_set index %u as target\n",
-                                info->del_set.index);
+                        pr_info_ratelimited("Cannot find del_set index %u as target\n",
+                                            info->del_set.index);
                         if (info->add_set.index != IPSET_INVALID_ID)
                                 ip_set_nfnl_put(par->net, info->add_set.index);
                         return -ENOENT;
@@ -259,7 +259,7 @@ set_target_v0_checkentry(const struct xt_tgchk_param *par)
         }
         if (info->add_set.u.flags[IPSET_DIM_MAX - 1] != 0 ||
             info->del_set.u.flags[IPSET_DIM_MAX - 1] != 0) {
-                pr_warn("Protocol error: SET target dimension is over the limit!\n");
+                pr_info_ratelimited("SET target dimension over the limit!\n");
                 if (info->add_set.index != IPSET_INVALID_ID)
                         ip_set_nfnl_put(par->net, info->add_set.index);
                 if (info->del_set.index != IPSET_INVALID_ID)
@@ -316,8 +316,8 @@ set_target_v1_checkentry(const struct xt_tgchk_param *par)
         if (info->add_set.index != IPSET_INVALID_ID) {
                 index = ip_set_nfnl_get_byindex(par->net, info->add_set.index);
                 if (index == IPSET_INVALID_ID) {
-                        pr_warn("Cannot find add_set index %u as target\n",
-                                info->add_set.index);
+                        pr_info_ratelimited("Cannot find add_set index %u as target\n",
+                                            info->add_set.index);
                         return -ENOENT;
                 }
         }
@@ -325,8 +325,8 @@ set_target_v1_checkentry(const struct xt_tgchk_param *par)
         if (info->del_set.index != IPSET_INVALID_ID) {
                 index = ip_set_nfnl_get_byindex(par->net, info->del_set.index);
                 if (index == IPSET_INVALID_ID) {
-                        pr_warn("Cannot find del_set index %u as target\n",
-                                info->del_set.index);
+                        pr_info_ratelimited("Cannot find del_set index %u as target\n",
+                                            info->del_set.index);
                         if (info->add_set.index != IPSET_INVALID_ID)
                                 ip_set_nfnl_put(par->net, info->add_set.index);
                         return -ENOENT;
@@ -334,7 +334,7 @@ set_target_v1_checkentry(const struct xt_tgchk_param *par)
         }
         if (info->add_set.dim > IPSET_DIM_MAX ||
             info->del_set.dim > IPSET_DIM_MAX) {
-                pr_warn("Protocol error: SET target dimension is over the limit!\n");
+                pr_info_ratelimited("SET target dimension over the limit!\n");
                 if (info->add_set.index != IPSET_INVALID_ID)
                         ip_set_nfnl_put(par->net, info->add_set.index);
                 if (info->del_set.index != IPSET_INVALID_ID)
@@ -444,8 +444,8 @@ set_target_v3_checkentry(const struct xt_tgchk_param *par)
                 index = ip_set_nfnl_get_byindex(par->net,
                                                 info->add_set.index);
                 if (index == IPSET_INVALID_ID) {
-                        pr_warn("Cannot find add_set index %u as target\n",
-                                info->add_set.index);
+                        pr_info_ratelimited("Cannot find add_set index %u as target\n",
+                                            info->add_set.index);
                         return -ENOENT;
                 }
         }
@@ -454,8 +454,8 @@ set_target_v3_checkentry(const struct xt_tgchk_param *par)
                 index = ip_set_nfnl_get_byindex(par->net,
                                                 info->del_set.index);
                 if (index == IPSET_INVALID_ID) {
-                        pr_warn("Cannot find del_set index %u as target\n",
-                                info->del_set.index);
+                        pr_info_ratelimited("Cannot find del_set index %u as target\n",
+                                            info->del_set.index);
                         if (info->add_set.index != IPSET_INVALID_ID)
                                 ip_set_nfnl_put(par->net,
                                                 info->add_set.index);
@@ -465,7 +465,7 @@ set_target_v3_checkentry(const struct xt_tgchk_param *par)
 
         if (info->map_set.index != IPSET_INVALID_ID) {
                 if (strncmp(par->table, "mangle", 7)) {
-                        pr_warn("--map-set only usable from mangle table\n");
+                        pr_info_ratelimited("--map-set only usable from mangle table\n");
                         return -EINVAL;
                 }
                 if (((info->flags & IPSET_FLAG_MAP_SKBPRIO) |
@@ -473,14 +473,14 @@ set_target_v3_checkentry(const struct xt_tgchk_param *par)
                      !(par->hook_mask & (1 << NF_INET_FORWARD |
                                          1 << NF_INET_LOCAL_OUT |
                                          1 << NF_INET_POST_ROUTING))) {
-                        pr_warn("mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains\n");
+                        pr_info_ratelimited("mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains\n");
                         return -EINVAL;
                 }
                 index = ip_set_nfnl_get_byindex(par->net,
                                                 info->map_set.index);
                 if (index == IPSET_INVALID_ID) {
-                        pr_warn("Cannot find map_set index %u as target\n",
-                                info->map_set.index);
+                        pr_info_ratelimited("Cannot find map_set index %u as target\n",
+                                            info->map_set.index);
                         if (info->add_set.index != IPSET_INVALID_ID)
                                 ip_set_nfnl_put(par->net,
                                                 info->add_set.index);
@@ -494,7 +494,7 @@ set_target_v3_checkentry(const struct xt_tgchk_param *par)
         if (info->add_set.dim > IPSET_DIM_MAX ||
             info->del_set.dim > IPSET_DIM_MAX ||
             info->map_set.dim > IPSET_DIM_MAX) {
-                pr_warn("Protocol error: SET target dimension is over the limit!\n");
+                pr_info_ratelimited("SET target dimension over the limit!\n");
                 if (info->add_set.index != IPSET_INVALID_ID)
                         ip_set_nfnl_put(par->net, info->add_set.index);
                 if (info->del_set.index != IPSET_INVALID_ID)
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 575d2153e3b8..2ac7f674d19b 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -171,7 +171,8 @@ static int socket_mt_v1_check(const struct xt_mtchk_param *par)
                 return err;
 
         if (info->flags & ~XT_SOCKET_FLAGS_V1) {
-                pr_info("unknown flags 0x%x\n", info->flags & ~XT_SOCKET_FLAGS_V1);
+                pr_info_ratelimited("unknown flags 0x%x\n",
+                                    info->flags & ~XT_SOCKET_FLAGS_V1);
                 return -EINVAL;
         }
         return 0;
@@ -187,7 +188,8 @@ static int socket_mt_v2_check(const struct xt_mtchk_param *par)
                 return err;
 
         if (info->flags & ~XT_SOCKET_FLAGS_V2) {
-                pr_info("unknown flags 0x%x\n", info->flags & ~XT_SOCKET_FLAGS_V2);
+                pr_info_ratelimited("unknown flags 0x%x\n",
+                                    info->flags & ~XT_SOCKET_FLAGS_V2);
                 return -EINVAL;
         }
         return 0;
@@ -203,8 +205,8 @@ static int socket_mt_v3_check(const struct xt_mtchk_param *par)
         if (err)
                 return err;
         if (info->flags & ~XT_SOCKET_FLAGS_V3) {
-                pr_info("unknown flags 0x%x\n",
-                        info->flags & ~XT_SOCKET_FLAGS_V3);
+                pr_info_ratelimited("unknown flags 0x%x\n",
+                                    info->flags & ~XT_SOCKET_FLAGS_V3);
                 return -EINVAL;
         }
         return 0;
diff --git a/net/netfilter/xt_state.c b/net/netfilter/xt_state.c
index 5fbd79194d21..0b41c0befe3c 100644
--- a/net/netfilter/xt_state.c
+++ b/net/netfilter/xt_state.c
@@ -44,8 +44,8 @@ static int state_mt_check(const struct xt_mtchk_param *par)
 
         ret = nf_ct_netns_get(par->net, par->family);
         if (ret < 0)
-                pr_info("cannot load conntrack support for proto=%u\n",
-                        par->family);
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
         return ret;
 }
 
diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
index 1b01eec1fbda..0160f505e337 100644
--- a/net/netfilter/xt_time.c
+++ b/net/netfilter/xt_time.c
@@ -235,13 +235,13 @@ static int time_mt_check(const struct xt_mtchk_param *par)
 
         if (info->daytime_start > XT_TIME_MAX_DAYTIME ||
             info->daytime_stop > XT_TIME_MAX_DAYTIME) {
-                pr_info("invalid argument - start or "
-                        "stop time greater than 23:59:59\n");
+                pr_info_ratelimited("invalid argument - start or stop time greater than 23:59:59\n");
                 return -EDOM;
         }
 
         if (info->flags & ~XT_TIME_ALL_FLAGS) {
-                pr_info("unknown flags 0x%x\n", info->flags & ~XT_TIME_ALL_FLAGS);
+                pr_info_ratelimited("unknown flags 0x%x\n",
+                                    info->flags & ~XT_TIME_ALL_FLAGS);
                 return -EINVAL;
         }
 
diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
index 367d8c027101..2ceefa183cee 100644
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -149,6 +149,10 @@ struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri,
 
         pr_debug("uri: %s, len: %zu\n", uri, uri_len);
 
+        /* sdreq->tlv_len is u8, takes uri_len, + 3 for header, + 1 for NULL */
+        if (WARN_ON_ONCE(uri_len > U8_MAX - 4))
+                return NULL;
+
         sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
         if (sdreq == NULL)
                 return NULL;
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index c0b83dc9d993..f018eafc2a0d 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -61,7 +61,8 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
 };
 
 static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = {
-        [NFC_SDP_ATTR_URI] = { .type = NLA_STRING },
+        [NFC_SDP_ATTR_URI] = { .type = NLA_STRING,
+                               .len = U8_MAX - 4 },
         [NFC_SDP_ATTR_SAP] = { .type = NLA_U8 },
 };
 
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index cc21e8db25b0..9d45d8b56744 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -517,9 +517,10 @@ try_again:
                         ret = put_cmsg(msg, SOL_RXRPC, RXRPC_USER_CALL_ID,
                                        sizeof(unsigned int), &id32);
                 } else {
+                        unsigned long idl = call->user_call_ID;
+
                         ret = put_cmsg(msg, SOL_RXRPC, RXRPC_USER_CALL_ID,
-                                       sizeof(unsigned long),
-                                       &call->user_call_ID);
+                                       sizeof(unsigned long), &idl);
                 }
                 if (ret < 0)
                         goto error_unlock_call;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index a7dc7271042a..247b7cc20c13 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -1397,13 +1397,18 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
                     nla_get_u32(tca[TCA_CHAIN]) != chain->index)
                         continue;
                 if (!tcf_chain_dump(chain, q, parent, skb, cb,
-                                    index_start, &index))
+                                    index_start, &index)) {
+                        err = -EMSGSIZE;
                         break;
+                }
         }
 
         cb->args[0] = index;
 
 out:
+        /* If we did no progress, the error (EMSGSIZE) is real */
+        if (skb->len == 0 && err)
+                return err;
         return skb->len;
 }
 
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index cedf672487f9..f799043abec9 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -6,7 +6,7 @@
  *
  * This file is part of the SCTP kernel implementation
  *
- * These functions manipulate sctp tsn mapping array.
+ * This file contains sctp stream maniuplation primitives and helpers.
  *
  * This SCTP implementation is free software;
  * you can redistribute it and/or modify it under the terms of
diff --git a/net/sctp/stream_interleave.c b/net/sctp/stream_interleave.c
index 86c26ec42979..d3764c181299 100644
--- a/net/sctp/stream_interleave.c
+++ b/net/sctp/stream_interleave.c
@@ -3,7 +3,8 @@
  *
  * This file is part of the SCTP kernel implementation
  *
- * These functions manipulate sctp stream queue/scheduling.
+ * These functions implement sctp stream message interleaving, mostly
+ * including I-DATA and I-FORWARD-TSN chunks process.
  *
  * This SCTP implementation is free software;
  * you can redistribute it and/or modify it under the terms of
@@ -967,9 +968,8 @@ static void sctp_renege_events(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
                                                        needed);
         }
 
-        if (chunk && freed >= needed)
-                if (sctp_ulpevent_idata(ulpq, chunk, gfp) <= 0)
-                        sctp_intl_start_pd(ulpq, gfp);
+        if (freed >= needed && sctp_ulpevent_idata(ulpq, chunk, gfp) <= 0)
+                sctp_intl_start_pd(ulpq, gfp);
 
         sk_mem_reclaim(asoc->base.sk);
 }
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index c8001471da6c..3e3dce3d4c63 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -813,7 +813,7 @@ err_out:
         return err;
 }
 
-int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         char *name;
@@ -835,20 +835,27 @@ int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
 
         name = nla_data(attrs[TIPC_NLA_BEARER_NAME]);
 
-        rtnl_lock();
         bearer = tipc_bearer_find(net, name);
-        if (!bearer) {
-                rtnl_unlock();
+        if (!bearer)
                 return -EINVAL;
-        }
 
         bearer_disable(net, bearer);
-        rtnl_unlock();
 
         return 0;
 }
 
-int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
+int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_bearer_disable(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
+
+int __tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         char *bearer;
@@ -890,15 +897,18 @@ int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
                         prio = nla_get_u32(props[TIPC_NLA_PROP_PRIO]);
         }
 
+        return tipc_enable_bearer(net, bearer, domain, prio, attrs);
+}
+
+int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
         rtnl_lock();
-        err = tipc_enable_bearer(net, bearer, domain, prio, attrs);
-        if (err) {
-                rtnl_unlock();
-                return err;
-        }
+        err = __tipc_nl_bearer_enable(skb, info);
         rtnl_unlock();
 
-        return 0;
+        return err;
 }
 
 int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info)
@@ -944,7 +954,7 @@ int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info)
         return 0;
 }
 
-int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         char *name;
@@ -965,22 +975,17 @@ int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
         name = nla_data(attrs[TIPC_NLA_BEARER_NAME]);
 
-        rtnl_lock();
         b = tipc_bearer_find(net, name);
-        if (!b) {
-                rtnl_unlock();
+        if (!b)
                 return -EINVAL;
-        }
 
         if (attrs[TIPC_NLA_BEARER_PROP]) {
                 struct nlattr *props[TIPC_NLA_PROP_MAX + 1];
 
                 err = tipc_nl_parse_link_prop(attrs[TIPC_NLA_BEARER_PROP],
                                               props);
-                if (err) {
-                        rtnl_unlock();
+                if (err)
                         return err;
-                }
 
                 if (props[TIPC_NLA_PROP_TOL])
                         b->tolerance = nla_get_u32(props[TIPC_NLA_PROP_TOL]);
@@ -989,11 +994,21 @@ int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
                 if (props[TIPC_NLA_PROP_WIN])
                         b->window = nla_get_u32(props[TIPC_NLA_PROP_WIN]);
         }
-        rtnl_unlock();
 
         return 0;
 }
 
+int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_bearer_set(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
+
 static int __tipc_nl_add_media(struct tipc_nl_msg *msg,
                                struct tipc_media *media, int nlflags)
 {
@@ -1115,7 +1130,7 @@ err_out:
         return err;
 }
 
-int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         char *name;
@@ -1133,22 +1148,17 @@ int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
         name = nla_data(attrs[TIPC_NLA_MEDIA_NAME]);
 
-        rtnl_lock();
         m = tipc_media_find(name);
-        if (!m) {
-                rtnl_unlock();
+        if (!m)
                 return -EINVAL;
-        }
 
         if (attrs[TIPC_NLA_MEDIA_PROP]) {
                 struct nlattr *props[TIPC_NLA_PROP_MAX + 1];
 
                 err = tipc_nl_parse_link_prop(attrs[TIPC_NLA_MEDIA_PROP],
                                               props);
-                if (err) {
-                        rtnl_unlock();
+                if (err)
                         return err;
-                }
 
                 if (props[TIPC_NLA_PROP_TOL])
                         m->tolerance = nla_get_u32(props[TIPC_NLA_PROP_TOL]);
@@ -1157,7 +1167,17 @@ int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
                 if (props[TIPC_NLA_PROP_WIN])
                         m->window = nla_get_u32(props[TIPC_NLA_PROP_WIN]);
         }
-        rtnl_unlock();
 
         return 0;
 }
+
+int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_media_set(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index 42d6eeeb646d..a53613d95bc9 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -188,15 +188,19 @@ extern struct tipc_media udp_media_info;
 #endif
 
 int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_bearer_get(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info);
 
 int tipc_nl_media_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_media_get(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info);
 
 int tipc_media_set_priority(const char *name, u32 new_value);
 int tipc_media_set_window(const char *name, u32 new_value);
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 719c5924b638..1a2fde0d6f61 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -200,7 +200,7 @@ out:
         return skb->len;
 }
 
-int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
 {
         struct net *net = sock_net(skb->sk);
         struct tipc_net *tn = net_generic(net, tipc_net_id);
@@ -241,10 +241,19 @@ int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
                 if (!tipc_addr_node_valid(addr))
                         return -EINVAL;
 
-                rtnl_lock();
                 tipc_net_start(net, addr);
-                rtnl_unlock();
         }
 
         return 0;
 }
+
+int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_net_set(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
diff --git a/net/tipc/net.h b/net/tipc/net.h
index c7c254902873..c0306aa2374b 100644
--- a/net/tipc/net.h
+++ b/net/tipc/net.h
@@ -47,5 +47,6 @@ void tipc_net_stop(struct net *net);
 
 int tipc_nl_net_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info);
 
 #endif
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index e48f0b2c01b9..4492cda45566 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -285,10 +285,6 @@ static int __tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
         if (!trans_buf)
                 return -ENOMEM;
 
-        err = (*cmd->transcode)(cmd, trans_buf, msg);
-        if (err)
-                goto trans_out;
-
         attrbuf = kmalloc((tipc_genl_family.maxattr + 1) *
                         sizeof(struct nlattr *), GFP_KERNEL);
         if (!attrbuf) {
@@ -296,27 +292,34 @@ static int __tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
                 goto trans_out;
         }
 
-        err = nla_parse(attrbuf, tipc_genl_family.maxattr,
-                        (const struct nlattr *)trans_buf->data,
-                        trans_buf->len, NULL, NULL);
-        if (err)
-                goto parse_out;
-
         doit_buf = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
         if (!doit_buf) {
                 err = -ENOMEM;
-                goto parse_out;
+                goto attrbuf_out;
         }
 
-        doit_buf->sk = msg->dst_sk;
-
         memset(&info, 0, sizeof(info));
         info.attrs = attrbuf;
 
+        rtnl_lock();
+        err = (*cmd->transcode)(cmd, trans_buf, msg);
+        if (err)
+                goto doit_out;
+
+        err = nla_parse(attrbuf, tipc_genl_family.maxattr,
+                        (const struct nlattr *)trans_buf->data,
+                        trans_buf->len, NULL, NULL);
+        if (err)
+                goto doit_out;
+
+        doit_buf->sk = msg->dst_sk;
+
         err = (*cmd->doit)(doit_buf, &info);
+doit_out:
+        rtnl_unlock();
 
         kfree_skb(doit_buf);
-parse_out:
+attrbuf_out:
         kfree(attrbuf);
 trans_out:
         kfree_skb(trans_buf);
@@ -722,13 +725,13 @@ static int tipc_nl_compat_link_set(struct tipc_nl_compat_cmd_doit *cmd,
 
         media = tipc_media_find(lc->name);
         if (media) {
-                cmd->doit = &tipc_nl_media_set;
+                cmd->doit = &__tipc_nl_media_set;
                 return tipc_nl_compat_media_set(skb, msg);
         }
 
         bearer = tipc_bearer_find(msg->net, lc->name);
         if (bearer) {
-                cmd->doit = &tipc_nl_bearer_set;
+                cmd->doit = &__tipc_nl_bearer_set;
                 return tipc_nl_compat_bearer_set(skb, msg);
         }
 
@@ -1089,12 +1092,12 @@ static int tipc_nl_compat_handle(struct tipc_nl_compat_msg *msg)
                 return tipc_nl_compat_dumpit(&dump, msg);
         case TIPC_CMD_ENABLE_BEARER:
                 msg->req_type = TIPC_TLV_BEARER_CONFIG;
-                doit.doit = tipc_nl_bearer_enable;
+                doit.doit = __tipc_nl_bearer_enable;
                 doit.transcode = tipc_nl_compat_bearer_enable;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_DISABLE_BEARER:
                 msg->req_type = TIPC_TLV_BEARER_NAME;
-                doit.doit = tipc_nl_bearer_disable;
+                doit.doit = __tipc_nl_bearer_disable;
                 doit.transcode = tipc_nl_compat_bearer_disable;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_SHOW_LINK_STATS:
@@ -1148,12 +1151,12 @@ static int tipc_nl_compat_handle(struct tipc_nl_compat_msg *msg)
                 return tipc_nl_compat_dumpit(&dump, msg);
         case TIPC_CMD_SET_NODE_ADDR:
                 msg->req_type = TIPC_TLV_NET_ADDR;
-                doit.doit = tipc_nl_net_set;
+                doit.doit = __tipc_nl_net_set;
                 doit.transcode = tipc_nl_compat_net_set;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_SET_NETID:
                 msg->req_type = TIPC_TLV_UNSIGNED;
-                doit.doit = tipc_nl_net_set;
+                doit.doit = __tipc_nl_net_set;
                 doit.transcode = tipc_nl_compat_net_set;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_GET_NETID:
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index b0d5fcea47e7..e9b4b53ab53e 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -308,8 +308,11 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
                         goto out;
                 }
                 lock_sock(sk);
-                memcpy(crypto_info_aes_gcm_128->iv, ctx->iv,
+                memcpy(crypto_info_aes_gcm_128->iv,
+                       ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
                        TLS_CIPHER_AES_GCM_128_IV_SIZE);
+                memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->rec_seq,
+                       TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
                 release_sock(sk);
                 if (copy_to_user(optval,
                                  crypto_info_aes_gcm_128,
@@ -375,7 +378,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
         rc = copy_from_user(crypto_info, optval, sizeof(*crypto_info));
         if (rc) {
                 rc = -EFAULT;
-                goto out;
+                goto err_crypto_info;
         }
 
         /* check version */
diff --git a/sound/ac97/Kconfig b/sound/ac97/Kconfig
index f8a64e15e5bf..baa5f8ef89d2 100644
--- a/sound/ac97/Kconfig
+++ b/sound/ac97/Kconfig
@@ -5,7 +5,6 @@
 
 config AC97_BUS_NEW
         tristate
-        select AC97
         help
           This is the new AC97 bus type, successor of AC97_BUS. The ported
           drivers which benefit from the AC97 automatic probing should "select"
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 60db32785f62..04d4db44fae5 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1003,7 +1003,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
 {
         struct snd_seq_client *client = file->private_data;
         int written = 0, len;
-        int err = -EINVAL;
+        int err;
         struct snd_seq_event event;
 
         if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT))
@@ -1018,11 +1018,15 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
 
         /* allocate the pool now if the pool is not allocated yet */ 
         if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
-                if (snd_seq_pool_init(client->pool) < 0)
+                mutex_lock(&client->ioctl_mutex);
+                err = snd_seq_pool_init(client->pool);
+                mutex_unlock(&client->ioctl_mutex);
+                if (err < 0)
                         return -ENOMEM;
         }
 
         /* only process whole events */
+        err = -EINVAL;
         while (count >= sizeof(struct snd_seq_event)) {
                 /* Read in the event header from the user */
                 len = sizeof(event);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 23475888192b..ce28f7ce64e6 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3465,6 +3465,19 @@ static void alc269_fixup_pincfg_no_hp_to_lineout(struct hda_codec *codec,
                 spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
 }
 
+static void alc269_fixup_pincfg_U7x7_headset_mic(struct hda_codec *codec,
+                                                 const struct hda_fixup *fix,
+                                                 int action)
+{
+        unsigned int cfg_headphone = snd_hda_codec_get_pincfg(codec, 0x21);
+        unsigned int cfg_headset_mic = snd_hda_codec_get_pincfg(codec, 0x19);
+
+        if (cfg_headphone && cfg_headset_mic == 0x411111f0)
+                snd_hda_codec_set_pincfg(codec, 0x19,
+                        (cfg_headphone & ~AC_DEFCFG_DEVICE) |
+                        (AC_JACK_MIC_IN << AC_DEFCFG_DEVICE_SHIFT));
+}
+
 static void alc269_fixup_hweq(struct hda_codec *codec,
                                const struct hda_fixup *fix, int action)
 {
@@ -4972,6 +4985,28 @@ static void alc_fixup_tpt440_dock(struct hda_codec *codec,
         }
 }
 
+static void alc_fixup_tpt470_dock(struct hda_codec *codec,
+                                  const struct hda_fixup *fix, int action)
+{
+        static const struct hda_pintbl pincfgs[] = {
+                { 0x17, 0x21211010 }, /* dock headphone */
+                { 0x19, 0x21a11010 }, /* dock mic */
+                { }
+        };
+        struct alc_spec *spec = codec->spec;
+
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
+                /* Enable DOCK device */
+                snd_hda_codec_write(codec, 0x17, 0,
+                            AC_VERB_SET_CONFIG_DEFAULT_BYTES_3, 0);
+                /* Enable DOCK device */
+                snd_hda_codec_write(codec, 0x19, 0,
+                            AC_VERB_SET_CONFIG_DEFAULT_BYTES_3, 0);
+                snd_hda_apply_pincfgs(codec, pincfgs);
+        }
+}
+
 static void alc_shutup_dell_xps13(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
@@ -5351,6 +5386,7 @@ enum {
         ALC269_FIXUP_LIFEBOOK_EXTMIC,
         ALC269_FIXUP_LIFEBOOK_HP_PIN,
         ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT,
+        ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC,
         ALC269_FIXUP_AMIC,
         ALC269_FIXUP_DMIC,
         ALC269VB_FIXUP_AMIC,
@@ -5446,6 +5482,7 @@ enum {
         ALC700_FIXUP_INTEL_REFERENCE,
         ALC274_FIXUP_DELL_BIND_DACS,
         ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
+        ALC298_FIXUP_TPT470_DOCK,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -5556,6 +5593,10 @@ static const struct hda_fixup alc269_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
         },
+        [ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc269_fixup_pincfg_U7x7_headset_mic,
+        },
         [ALC269_FIXUP_AMIC] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
@@ -6271,6 +6312,12 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC274_FIXUP_DELL_BIND_DACS
         },
+        [ALC298_FIXUP_TPT470_DOCK] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_tpt470_dock,
+                .chained = true,
+                .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6321,6 +6368,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
         SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
         SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+        SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+        SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
         SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
@@ -6422,6 +6471,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT),
         SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
         SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
+        SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),
         SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
         SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
         SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
@@ -6450,8 +6500,16 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x2218, "Thinkpad X1 Carbon 2nd", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x222d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x222e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2231, "Thinkpad T560", ALC292_FIXUP_TPT460),
         SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460),
+        SND_PCI_QUIRK(0x17aa, 0x2245, "Thinkpad T470", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x2246, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x2247, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x224b, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
@@ -6472,7 +6530,12 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x5050, "Thinkpad T560p", ALC292_FIXUP_TPT460),
         SND_PCI_QUIRK(0x17aa, 0x5051, "Thinkpad L460", ALC292_FIXUP_TPT460),
         SND_PCI_QUIRK(0x17aa, 0x5053, "Thinkpad T460", ALC292_FIXUP_TPT460),
+        SND_PCI_QUIRK(0x17aa, 0x505d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x505f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x5062, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x17aa, 0x511e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
         SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
         SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
@@ -6735,6 +6798,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x14, 0x90170110},
                 {0x21, 0x02211020}),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60130},
+                {0x14, 0x90170110},
+                {0x14, 0x01011020},
+                {0x21, 0x0221101f}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC256_STANDARD_PINS),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC,
                 {0x14, 0x90170110},
@@ -6803,6 +6871,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x12, 0x90a60120},
                 {0x14, 0x90170110},
                 {0x21, 0x0321101f}),
+        SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0xb7a60130},
+                {0x14, 0x90170110},
+                {0x21, 0x04211020}),
         SND_HDA_PIN_QUIRK(0x10ec0290, 0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1,
                 ALC290_STANDARD_PINS,
                 {0x15, 0x04211040},
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 9afb8ab524c7..06b22624ab7a 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -347,17 +347,20 @@ static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request,
                             int validx, int *value_ret)
 {
         struct snd_usb_audio *chip = cval->head.mixer->chip;
-        unsigned char buf[4 + 3 * sizeof(__u32)]; /* enough space for one range */
+        /* enough space for one range */
+        unsigned char buf[sizeof(__u16) + 3 * sizeof(__u32)];
         unsigned char *val;
-        int idx = 0, ret, size;
+        int idx = 0, ret, val_size, size;
         __u8 bRequest;
 
+        val_size = uac2_ctl_value_size(cval->val_type);
+
         if (request == UAC_GET_CUR) {
                 bRequest = UAC2_CS_CUR;
-                size = uac2_ctl_value_size(cval->val_type);
+                size = val_size;
         } else {
                 bRequest = UAC2_CS_RANGE;
-                size = sizeof(buf);
+                size = sizeof(__u16) + 3 * val_size;
         }
 
         memset(buf, 0, sizeof(buf));
@@ -390,16 +393,17 @@ error:
                 val = buf + sizeof(__u16);
                 break;
         case UAC_GET_MAX:
-                val = buf + sizeof(__u16) * 2;
+                val = buf + sizeof(__u16) + val_size;
                 break;
         case UAC_GET_RES:
-                val = buf + sizeof(__u16) * 3;
+                val = buf + sizeof(__u16) + val_size * 2;
                 break;
         default:
                 return -EINVAL;
         }
 
-        *value_ret = convert_signed_value(cval, snd_usb_combine_bytes(val, sizeof(__u16)));
+        *value_ret = convert_signed_value(cval,
+                                          snd_usb_combine_bytes(val, val_size));
 
         return 0;
 }
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index b9c9a19f9588..3cbfae6604f9 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -357,6 +357,15 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
 
                 alts = &iface->altsetting[1];
                 goto add_sync_ep;
+        case USB_ID(0x1397, 0x0002):
+                ep = 0x81;
+                iface = usb_ifnum_to_if(dev, 1);
+
+                if (!iface || iface->num_altsetting == 0)
+                        return -EINVAL;
+
+                alts = &iface->altsetting[1];
+                goto add_sync_ep;
 
         }
         if (attr == USB_ENDPOINT_SYNC_ASYNC &&
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index a66ef5777887..ea8f3de92fa4 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1363,8 +1363,11 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
                         return SNDRV_PCM_FMTBIT_DSD_U32_BE;
                 break;
 
-        /* Amanero Combo384 USB interface with native DSD support */
-        case USB_ID(0x16d0, 0x071a):
+        /* Amanero Combo384 USB based DACs with native DSD support */
+        case USB_ID(0x16d0, 0x071a):  /* Amanero - Combo384 */
+        case USB_ID(0x2ab6, 0x0004):  /* T+A DAC8DSD-V2.0, MP1000E-V2.0, MP2000R-V2.0, MP2500R-V2.0, MP3100HV-V2.0 */
+        case USB_ID(0x2ab6, 0x0005):  /* T+A USB HD Audio 1 */
+        case USB_ID(0x2ab6, 0x0006):  /* T+A USB HD Audio 2 */
                 if (fp->altsetting == 2) {
                         switch (le16_to_cpu(chip->dev->descriptor.bcdDevice)) {
                         case 0x199:
diff --git a/tools/arch/powerpc/include/uapi/asm/kvm.h b/tools/arch/powerpc/include/uapi/asm/kvm.h
index 637b7263cb86..833ed9a16adf 100644
--- a/tools/arch/powerpc/include/uapi/asm/kvm.h
+++ b/tools/arch/powerpc/include/uapi/asm/kvm.h
@@ -632,6 +632,8 @@ struct kvm_ppc_cpu_char {
 #define KVM_REG_PPC_TIDR        (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbc)
 #define KVM_REG_PPC_PSSCR       (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbd)
 
+#define KVM_REG_PPC_DEC_EXPIRY  (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbe)
+
 /* Transactional Memory checkpointed state:
  * This is all GPRs, all VSX regs and a subset of SPRs
  */
diff --git a/tools/arch/s390/include/uapi/asm/unistd.h b/tools/arch/s390/include/uapi/asm/unistd.h
deleted file mode 100644
index 725120939051..000000000000
--- a/tools/arch/s390/include/uapi/asm/unistd.h
+++ /dev/null
@@ -1,412 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/*
- *  S390 version
- *
- *  Derived from "include/asm-i386/unistd.h"
- */
-
-#ifndef _UAPI_ASM_S390_UNISTD_H_
-#define _UAPI_ASM_S390_UNISTD_H_
-
-/*
- * This file contains the system call numbers.
- */
-
-#define __NR_exit                 1
-#define __NR_fork                 2
-#define __NR_read                 3
-#define __NR_write                4
-#define __NR_open                 5
-#define __NR_close                6
-#define __NR_restart_syscall      7
-#define __NR_creat                8
-#define __NR_link                 9
-#define __NR_unlink              10
-#define __NR_execve              11
-#define __NR_chdir               12
-#define __NR_mknod               14
-#define __NR_chmod               15
-#define __NR_lseek               19
-#define __NR_getpid              20
-#define __NR_mount               21
-#define __NR_umount              22
-#define __NR_ptrace              26
-#define __NR_alarm               27
-#define __NR_pause               29
-#define __NR_utime               30
-#define __NR_access              33
-#define __NR_nice                34
-#define __NR_sync                36
-#define __NR_kill                37
-#define __NR_rename              38
-#define __NR_mkdir               39
-#define __NR_rmdir               40
-#define __NR_dup                 41
-#define __NR_pipe                42
-#define __NR_times               43
-#define __NR_brk                 45
-#define __NR_signal              48
-#define __NR_acct                51
-#define __NR_umount2             52
-#define __NR_ioctl               54
-#define __NR_fcntl               55
-#define __NR_setpgid             57
-#define __NR_umask               60
-#define __NR_chroot              61
-#define __NR_ustat               62
-#define __NR_dup2                63
-#define __NR_getppid             64
-#define __NR_getpgrp             65
-#define __NR_setsid              66
-#define __NR_sigaction           67
-#define __NR_sigsuspend          72
-#define __NR_sigpending          73
-#define __NR_sethostname         74
-#define __NR_setrlimit           75
-#define __NR_getrusage           77
-#define __NR_gettimeofday        78
-#define __NR_settimeofday        79
-#define __NR_symlink             83
-#define __NR_readlink            85
-#define __NR_uselib              86
-#define __NR_swapon              87
-#define __NR_reboot              88
-#define __NR_readdir             89
-#define __NR_mmap                90
-#define __NR_munmap              91
-#define __NR_truncate            92
-#define __NR_ftruncate           93
-#define __NR_fchmod              94
-#define __NR_getpriority         96
-#define __NR_setpriority         97
-#define __NR_statfs              99
-#define __NR_fstatfs            100
-#define __NR_socketcall         102
-#define __NR_syslog             103
-#define __NR_setitimer          104
-#define __NR_getitimer          105
-#define __NR_stat               106
-#define __NR_lstat              107
-#define __NR_fstat              108
-#define __NR_lookup_dcookie     110
-#define __NR_vhangup            111
-#define __NR_idle               112
-#define __NR_wait4              114
-#define __NR_swapoff            115
-#define __NR_sysinfo            116
-#define __NR_ipc                117
-#define __NR_fsync              118
-#define __NR_sigreturn          119
-#define __NR_clone              120
-#define __NR_setdomainname      121
-#define __NR_uname              122
-#define __NR_adjtimex           124
-#define __NR_mprotect           125
-#define __NR_sigprocmask        126
-#define __NR_create_module      127
-#define __NR_init_module        128
-#define __NR_delete_module      129
-#define __NR_get_kernel_syms    130
-#define __NR_quotactl           131
-#define __NR_getpgid            132
-#define __NR_fchdir             133
-#define __NR_bdflush            134
-#define __NR_sysfs              135
-#define __NR_personality        136
-#define __NR_afs_syscall        137 /* Syscall for Andrew File System */
-#define __NR_getdents           141
-#define __NR_flock              143
-#define __NR_msync              144
-#define __NR_readv              145
-#define __NR_writev             146
-#define __NR_getsid             147
-#define __NR_fdatasync          148
-#define __NR__sysctl            149
-#define __NR_mlock              150
-#define __NR_munlock            151
-#define __NR_mlockall           152
-#define __NR_munlockall         153
-#define __NR_sched_setparam             154
-#define __NR_sched_getparam             155
-#define __NR_sched_setscheduler         156
-#define __NR_sched_getscheduler         157
-#define __NR_sched_yield                158
-#define __NR_sched_get_priority_max     159
-#define __NR_sched_get_priority_min     160
-#define __NR_sched_rr_get_interval      161
-#define __NR_nanosleep          162
-#define __NR_mremap             163
-#define __NR_query_module       167
-#define __NR_poll               168
-#define __NR_nfsservctl         169
-#define __NR_prctl              172
-#define __NR_rt_sigreturn       173
-#define __NR_rt_sigaction       174
-#define __NR_rt_sigprocmask     175
-#define __NR_rt_sigpending      176
-#define __NR_rt_sigtimedwait    177
-#define __NR_rt_sigqueueinfo    178
-#define __NR_rt_sigsuspend      179
-#define __NR_pread64            180
-#define __NR_pwrite64           181
-#define __NR_getcwd             183
-#define __NR_capget             184
-#define __NR_capset             185
-#define __NR_sigaltstack        186
-#define __NR_sendfile           187
-#define __NR_getpmsg            188
-#define __NR_putpmsg            189
-#define __NR_vfork              190
-#define __NR_pivot_root         217
-#define __NR_mincore            218
-#define __NR_madvise            219
-#define __NR_getdents64         220
-#define __NR_readahead          222
-#define __NR_setxattr           224
-#define __NR_lsetxattr          225
-#define __NR_fsetxattr          226
-#define __NR_getxattr           227
-#define __NR_lgetxattr          228
-#define __NR_fgetxattr          229
-#define __NR_listxattr          230
-#define __NR_llistxattr         231
-#define __NR_flistxattr         232
-#define __NR_removexattr        233
-#define __NR_lremovexattr       234
-#define __NR_fremovexattr       235
-#define __NR_gettid             236
-#define __NR_tkill              237
-#define __NR_futex              238
-#define __NR_sched_setaffinity  239
-#define __NR_sched_getaffinity  240
-#define __NR_tgkill             241
-/* Number 242 is reserved for tux */
-#define __NR_io_setup           243
-#define __NR_io_destroy         244
-#define __NR_io_getevents       245
-#define __NR_io_submit          246
-#define __NR_io_cancel          247
-#define __NR_exit_group         248
-#define __NR_epoll_create       249
-#define __NR_epoll_ctl          250
-#define __NR_epoll_wait         251
-#define __NR_set_tid_address    252
-#define __NR_fadvise64          253
-#define __NR_timer_create       254
-#define __NR_timer_settime      255
-#define __NR_timer_gettime      256
-#define __NR_timer_getoverrun   257
-#define __NR_timer_delete       258
-#define __NR_clock_settime      259
-#define __NR_clock_gettime      260
-#define __NR_clock_getres       261
-#define __NR_clock_nanosleep    262
-/* Number 263 is reserved for vserver */
-#define __NR_statfs64           265
-#define __NR_fstatfs64          266
-#define __NR_remap_file_pages   267
-#define __NR_mbind              268
-#define __NR_get_mempolicy      269
-#define __NR_set_mempolicy      270
-#define __NR_mq_open            271
-#define __NR_mq_unlink          272
-#define __NR_mq_timedsend       273
-#define __NR_mq_timedreceive    274
-#define __NR_mq_notify          275
-#define __NR_mq_getsetattr      276
-#define __NR_kexec_load         277
-#define __NR_add_key            278
-#define __NR_request_key        279
-#define __NR_keyctl             280
-#define __NR_waitid             281
-#define __NR_ioprio_set         282
-#define __NR_ioprio_get         283
-#define __NR_inotify_init       284
-#define __NR_inotify_add_watch  285
-#define __NR_inotify_rm_watch   286
-#define __NR_migrate_pages      287
-#define __NR_openat             288
-#define __NR_mkdirat            289
-#define __NR_mknodat            290
-#define __NR_fchownat           291
-#define __NR_futimesat          292
-#define __NR_unlinkat           294
-#define __NR_renameat           295
-#define __NR_linkat             296
-#define __NR_symlinkat          297
-#define __NR_readlinkat         298
-#define __NR_fchmodat           299
-#define __NR_faccessat          300
-#define __NR_pselect6           301
-#define __NR_ppoll              302
-#define __NR_unshare            303
-#define __NR_set_robust_list    304
-#define __NR_get_robust_list    305
-#define __NR_splice             306
-#define __NR_sync_file_range    307
-#define __NR_tee                308
-#define __NR_vmsplice           309
-#define __NR_move_pages         310
-#define __NR_getcpu             311
-#define __NR_epoll_pwait        312
-#define __NR_utimes             313
-#define __NR_fallocate          314
-#define __NR_utimensat          315
-#define __NR_signalfd           316
-#define __NR_timerfd            317
-#define __NR_eventfd            318
-#define __NR_timerfd_create     319
-#define __NR_timerfd_settime    320
-#define __NR_timerfd_gettime    321
-#define __NR_signalfd4          322
-#define __NR_eventfd2           323
-#define __NR_inotify_init1      324
-#define __NR_pipe2              325
-#define __NR_dup3               326
-#define __NR_epoll_create1      327
-#define __NR_preadv             328
-#define __NR_pwritev            329
-#define __NR_rt_tgsigqueueinfo  330
-#define __NR_perf_event_open    331
-#define __NR_fanotify_init      332
-#define __NR_fanotify_mark      333
-#define __NR_prlimit64          334
-#define __NR_name_to_handle_at  335
-#define __NR_open_by_handle_at  336
-#define __NR_clock_adjtime      337
-#define __NR_syncfs             338
-#define __NR_setns              339
-#define __NR_process_vm_readv   340
-#define __NR_process_vm_writev  341
-#define __NR_s390_runtime_instr 342
-#define __NR_kcmp               343
-#define __NR_finit_module       344
-#define __NR_sched_setattr      345
-#define __NR_sched_getattr      346
-#define __NR_renameat2          347
-#define __NR_seccomp            348
-#define __NR_getrandom          349
-#define __NR_memfd_create       350
-#define __NR_bpf                351
-#define __NR_s390_pci_mmio_write        352
-#define __NR_s390_pci_mmio_read         353
-#define __NR_execveat           354
-#define __NR_userfaultfd        355
-#define __NR_membarrier         356
-#define __NR_recvmmsg           357
-#define __NR_sendmmsg           358
-#define __NR_socket             359
-#define __NR_socketpair         360
-#define __NR_bind               361
-#define __NR_connect            362
-#define __NR_listen             363
-#define __NR_accept4            364
-#define __NR_getsockopt         365
-#define __NR_setsockopt         366
-#define __NR_getsockname        367
-#define __NR_getpeername        368
-#define __NR_sendto             369
-#define __NR_sendmsg            370
-#define __NR_recvfrom           371
-#define __NR_recvmsg            372
-#define __NR_shutdown           373
-#define __NR_mlock2             374
-#define __NR_copy_file_range    375
-#define __NR_preadv2            376
-#define __NR_pwritev2           377
-#define __NR_s390_guarded_storage       378
-#define __NR_statx              379
-#define __NR_s390_sthyi         380
-#define NR_syscalls 381
-
-/* 
- * There are some system calls that are not present on 64 bit, some
- * have a different name although they do the same (e.g. __NR_chown32
- * is __NR_chown on 64 bit).
- */
-#ifndef __s390x__
-
-#define __NR_time                13
-#define __NR_lchown              16
-#define __NR_setuid              23
-#define __NR_getuid              24
-#define __NR_stime               25
-#define __NR_setgid              46
-#define __NR_getgid              47
-#define __NR_geteuid             49
-#define __NR_getegid             50
-#define __NR_setreuid            70
-#define __NR_setregid            71
-#define __NR_getrlimit           76
-#define __NR_getgroups           80
-#define __NR_setgroups           81
-#define __NR_fchown              95
-#define __NR_ioperm             101
-#define __NR_setfsuid           138
-#define __NR_setfsgid           139
-#define __NR__llseek            140
-#define __NR__newselect         142
-#define __NR_setresuid          164
-#define __NR_getresuid          165
-#define __NR_setresgid          170
-#define __NR_getresgid          171
-#define __NR_chown              182
-#define __NR_ugetrlimit         191     /* SuS compliant getrlimit */
-#define __NR_mmap2              192
-#define __NR_truncate64         193
-#define __NR_ftruncate64        194
-#define __NR_stat64             195
-#define __NR_lstat64            196
-#define __NR_fstat64            197
-#define __NR_lchown32           198
-#define __NR_getuid32           199
-#define __NR_getgid32           200
-#define __NR_geteuid32          201
-#define __NR_getegid32          202
-#define __NR_setreuid32         203
-#define __NR_setregid32         204
-#define __NR_getgroups32        205
-#define __NR_setgroups32        206
-#define __NR_fchown32           207
-#define __NR_setresuid32        208
-#define __NR_getresuid32        209
-#define __NR_setresgid32        210
-#define __NR_getresgid32        211
-#define __NR_chown32            212
-#define __NR_setuid32           213
-#define __NR_setgid32           214
-#define __NR_setfsuid32         215
-#define __NR_setfsgid32         216
-#define __NR_fcntl64            221
-#define __NR_sendfile64         223
-#define __NR_fadvise64_64       264
-#define __NR_fstatat64          293
-
-#else
-
-#define __NR_select             142
-#define __NR_getrlimit          191     /* SuS compliant getrlimit */
-#define __NR_lchown             198
-#define __NR_getuid             199
-#define __NR_getgid             200
-#define __NR_geteuid            201
-#define __NR_getegid            202
-#define __NR_setreuid           203
-#define __NR_setregid           204
-#define __NR_getgroups          205
-#define __NR_setgroups          206
-#define __NR_fchown             207
-#define __NR_setresuid          208
-#define __NR_getresuid          209
-#define __NR_setresgid          210
-#define __NR_getresgid          211
-#define __NR_chown              212
-#define __NR_setuid             213
-#define __NR_setgid             214
-#define __NR_setfsuid           215
-#define __NR_setfsgid           216
-#define __NR_newfstatat         293
-
-#endif
-
-#endif /* _UAPI_ASM_S390_UNISTD_H_ */
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 1d9199e1c2ad..0dfe4d3f74e2 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -210,6 +210,7 @@
 
 #define X86_FEATURE_MBA                 ( 7*32+18) /* Memory Bandwidth Allocation */
 #define X86_FEATURE_RSB_CTXSW           ( 7*32+19) /* "" Fill RSB on context switches */
+#define X86_FEATURE_SEV                 ( 7*32+20) /* AMD Secure Encrypted Virtualization */
 
 #define X86_FEATURE_USE_IBPB            ( 7*32+21) /* "" Indirect Branch Prediction Barrier enabled */
 
diff --git a/tools/include/uapi/drm/i915_drm.h b/tools/include/uapi/drm/i915_drm.h
index ac3c6503ca27..536ee4febd74 100644
--- a/tools/include/uapi/drm/i915_drm.h
+++ b/tools/include/uapi/drm/i915_drm.h
@@ -86,6 +86,62 @@ enum i915_mocs_table_index {
         I915_MOCS_CACHED,
 };
 
+/*
+ * Different engines serve different roles, and there may be more than one
+ * engine serving each role. enum drm_i915_gem_engine_class provides a
+ * classification of the role of the engine, which may be used when requesting
+ * operations to be performed on a certain subset of engines, or for providing
+ * information about that group.
+ */
+enum drm_i915_gem_engine_class {
+        I915_ENGINE_CLASS_RENDER        = 0,
+        I915_ENGINE_CLASS_COPY          = 1,
+        I915_ENGINE_CLASS_VIDEO         = 2,
+        I915_ENGINE_CLASS_VIDEO_ENHANCE = 3,
+
+        I915_ENGINE_CLASS_INVALID       = -1
+};
+
+/**
+ * DOC: perf_events exposed by i915 through /sys/bus/event_sources/drivers/i915
+ *
+ */
+
+enum drm_i915_pmu_engine_sample {
+        I915_SAMPLE_BUSY = 0,
+        I915_SAMPLE_WAIT = 1,
+        I915_SAMPLE_SEMA = 2
+};
+
+#define I915_PMU_SAMPLE_BITS (4)
+#define I915_PMU_SAMPLE_MASK (0xf)
+#define I915_PMU_SAMPLE_INSTANCE_BITS (8)
+#define I915_PMU_CLASS_SHIFT \
+        (I915_PMU_SAMPLE_BITS + I915_PMU_SAMPLE_INSTANCE_BITS)
+
+#define __I915_PMU_ENGINE(class, instance, sample) \
+        ((class) << I915_PMU_CLASS_SHIFT | \
+        (instance) << I915_PMU_SAMPLE_BITS | \
+        (sample))
+
+#define I915_PMU_ENGINE_BUSY(class, instance) \
+        __I915_PMU_ENGINE(class, instance, I915_SAMPLE_BUSY)
+
+#define I915_PMU_ENGINE_WAIT(class, instance) \
+        __I915_PMU_ENGINE(class, instance, I915_SAMPLE_WAIT)
+
+#define I915_PMU_ENGINE_SEMA(class, instance) \
+        __I915_PMU_ENGINE(class, instance, I915_SAMPLE_SEMA)
+
+#define __I915_PMU_OTHER(x) (__I915_PMU_ENGINE(0xff, 0xff, 0xf) + 1 + (x))
+
+#define I915_PMU_ACTUAL_FREQUENCY       __I915_PMU_OTHER(0)
+#define I915_PMU_REQUESTED_FREQUENCY    __I915_PMU_OTHER(1)
+#define I915_PMU_INTERRUPTS             __I915_PMU_OTHER(2)
+#define I915_PMU_RC6_RESIDENCY          __I915_PMU_OTHER(3)
+
+#define I915_PMU_LAST I915_PMU_RC6_RESIDENCY
+
 /* Each region is a minimum of 16k, and there are at most 255 of them.
  */
 #define I915_NR_TEX_REGIONS 255 /* table size 2k - maximum due to use
@@ -450,6 +506,27 @@ typedef struct drm_i915_irq_wait {
  */
 #define I915_PARAM_HAS_EXEC_FENCE_ARRAY  49
 
+/*
+ * Query whether every context (both per-file default and user created) is
+ * isolated (insofar as HW supports). If this parameter is not true, then
+ * freshly created contexts may inherit values from an existing context,
+ * rather than default HW values. If true, it also ensures (insofar as HW
+ * supports) that all state set by this context will not leak to any other
+ * context.
+ *
+ * As not every engine across every gen support contexts, the returned
+ * value reports the support of context isolation for individual engines by
+ * returning a bitmask of each engine class set to true if that class supports
+ * isolation.
+ */
+#define I915_PARAM_HAS_CONTEXT_ISOLATION 50
+
+/* Frequency of the command streamer timestamps given by the *_TIMESTAMP
+ * registers. This used to be fixed per platform but from CNL onwards, this
+ * might vary depending on the parts.
+ */
+#define I915_PARAM_CS_TIMESTAMP_FREQUENCY 51
+
 typedef struct drm_i915_getparam {
         __s32 param;
         /*
diff --git a/tools/include/uapi/linux/if_link.h b/tools/include/uapi/linux/if_link.h
index 8616131e2c61..6d9447700e18 100644
--- a/tools/include/uapi/linux/if_link.h
+++ b/tools/include/uapi/linux/if_link.h
@@ -163,6 +163,7 @@ enum {
         IFLA_IF_NETNSID,
         IFLA_CARRIER_UP_COUNT,
         IFLA_CARRIER_DOWN_COUNT,
+        IFLA_NEW_IFINDEX,
         __IFLA_MAX
 };
 
diff --git a/tools/include/uapi/linux/kvm.h b/tools/include/uapi/linux/kvm.h
index 8fb90a0819c3..0fb5ef939732 100644
--- a/tools/include/uapi/linux/kvm.h
+++ b/tools/include/uapi/linux/kvm.h
@@ -1362,6 +1362,96 @@ struct kvm_s390_ucas_mapping {
 /* Available with KVM_CAP_S390_CMMA_MIGRATION */
 #define KVM_S390_GET_CMMA_BITS      _IOWR(KVMIO, 0xb8, struct kvm_s390_cmma_log)
 #define KVM_S390_SET_CMMA_BITS      _IOW(KVMIO, 0xb9, struct kvm_s390_cmma_log)
+/* Memory Encryption Commands */
+#define KVM_MEMORY_ENCRYPT_OP      _IOWR(KVMIO, 0xba, unsigned long)
+
+struct kvm_enc_region {
+        __u64 addr;
+        __u64 size;
+};
+
+#define KVM_MEMORY_ENCRYPT_REG_REGION    _IOR(KVMIO, 0xbb, struct kvm_enc_region)
+#define KVM_MEMORY_ENCRYPT_UNREG_REGION  _IOR(KVMIO, 0xbc, struct kvm_enc_region)
+
+/* Secure Encrypted Virtualization command */
+enum sev_cmd_id {
+        /* Guest initialization commands */
+        KVM_SEV_INIT = 0,
+        KVM_SEV_ES_INIT,
+        /* Guest launch commands */
+        KVM_SEV_LAUNCH_START,
+        KVM_SEV_LAUNCH_UPDATE_DATA,
+        KVM_SEV_LAUNCH_UPDATE_VMSA,
+        KVM_SEV_LAUNCH_SECRET,
+        KVM_SEV_LAUNCH_MEASURE,
+        KVM_SEV_LAUNCH_FINISH,
+        /* Guest migration commands (outgoing) */
+        KVM_SEV_SEND_START,
+        KVM_SEV_SEND_UPDATE_DATA,
+        KVM_SEV_SEND_UPDATE_VMSA,
+        KVM_SEV_SEND_FINISH,
+        /* Guest migration commands (incoming) */
+        KVM_SEV_RECEIVE_START,
+        KVM_SEV_RECEIVE_UPDATE_DATA,
+        KVM_SEV_RECEIVE_UPDATE_VMSA,
+        KVM_SEV_RECEIVE_FINISH,
+        /* Guest status and debug commands */
+        KVM_SEV_GUEST_STATUS,
+        KVM_SEV_DBG_DECRYPT,
+        KVM_SEV_DBG_ENCRYPT,
+        /* Guest certificates commands */
+        KVM_SEV_CERT_EXPORT,
+
+        KVM_SEV_NR_MAX,
+};
+
+struct kvm_sev_cmd {
+        __u32 id;
+        __u64 data;
+        __u32 error;
+        __u32 sev_fd;
+};
+
+struct kvm_sev_launch_start {
+        __u32 handle;
+        __u32 policy;
+        __u64 dh_uaddr;
+        __u32 dh_len;
+        __u64 session_uaddr;
+        __u32 session_len;
+};
+
+struct kvm_sev_launch_update_data {
+        __u64 uaddr;
+        __u32 len;
+};
+
+
+struct kvm_sev_launch_secret {
+        __u64 hdr_uaddr;
+        __u32 hdr_len;
+        __u64 guest_uaddr;
+        __u32 guest_len;
+        __u64 trans_uaddr;
+        __u32 trans_len;
+};
+
+struct kvm_sev_launch_measure {
+        __u64 uaddr;
+        __u32 len;
+};
+
+struct kvm_sev_guest_status {
+        __u32 handle;
+        __u32 policy;
+        __u32 state;
+};
+
+struct kvm_sev_dbg {
+        __u64 src_uaddr;
+        __u64 dst_uaddr;
+        __u32 len;
+};
 
 #define KVM_DEV_ASSIGN_ENABLE_IOMMU     (1 << 0)
 #define KVM_DEV_ASSIGN_PCI_2_3          (1 << 1)
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index b00b1896547e..a8cb69a26576 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -852,8 +852,14 @@ static int add_switch_table(struct objtool_file *file, struct symbol *func,
  *    This is a fairly uncommon pattern which is new for GCC 6.  As of this
  *    writing, there are 11 occurrences of it in the allmodconfig kernel.
  *
+ *    As of GCC 7 there are quite a few more of these and the 'in between' code
+ *    is significant. Esp. with KASAN enabled some of the code between the mov
+ *    and jmpq uses .rodata itself, which can confuse things.
+ *
  *    TODO: Once we have DWARF CFI and smarter instruction decoding logic,
  *    ensure the same register is used in the mov and jump instructions.
+ *
+ *    NOTE: RETPOLINE made it harder still to decode dynamic jumps.
  */
 static struct rela *find_switch_table(struct objtool_file *file,
                                       struct symbol *func,
@@ -875,12 +881,25 @@ static struct rela *find_switch_table(struct objtool_file *file,
                                                 text_rela->addend + 4);
                 if (!rodata_rela)
                         return NULL;
+
                 file->ignore_unreachables = true;
                 return rodata_rela;
         }
 
         /* case 3 */
-        func_for_each_insn_continue_reverse(file, func, insn) {
+        /*
+         * Backward search using the @first_jump_src links, these help avoid
+         * much of the 'in between' code. Which avoids us getting confused by
+         * it.
+         */
+        for (insn = list_prev_entry(insn, list);
+
+             &insn->list != &file->insn_list &&
+             insn->sec == func->sec &&
+             insn->offset >= func->offset;
+
+             insn = insn->first_jump_src ?: list_prev_entry(insn, list)) {
+
                 if (insn->type == INSN_JUMP_DYNAMIC)
                         break;
 
@@ -910,14 +929,32 @@ static struct rela *find_switch_table(struct objtool_file *file,
         return NULL;
 }
 
+
 static int add_func_switch_tables(struct objtool_file *file,
                                   struct symbol *func)
 {
-        struct instruction *insn, *prev_jump = NULL;
+        struct instruction *insn, *last = NULL, *prev_jump = NULL;
         struct rela *rela, *prev_rela = NULL;
         int ret;
 
         func_for_each_insn(file, func, insn) {
+                if (!last)
+                        last = insn;
+
+                /*
+                 * Store back-pointers for unconditional forward jumps such
+                 * that find_switch_table() can back-track using those and
+                 * avoid some potentially confusing code.
+                 */
+                if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest &&
+                    insn->offset > last->offset &&
+                    insn->jump_dest->offset > insn->offset &&
+                    !insn->jump_dest->first_jump_src) {
+
+                        insn->jump_dest->first_jump_src = insn;
+                        last = insn->jump_dest;
+                }
+
                 if (insn->type != INSN_JUMP_DYNAMIC)
                         continue;
 
@@ -1899,13 +1936,19 @@ static bool ignore_unreachable_insn(struct instruction *insn)
                 if (is_kasan_insn(insn) || is_ubsan_insn(insn))
                         return true;
 
-                if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest) {
-                        insn = insn->jump_dest;
-                        continue;
+                if (insn->type == INSN_JUMP_UNCONDITIONAL) {
+                        if (insn->jump_dest &&
+                            insn->jump_dest->func == insn->func) {
+                                insn = insn->jump_dest;
+                                continue;
+                        }
+
+                        break;
                 }
 
                 if (insn->offset + insn->len >= insn->func->offset + insn->func->len)
                         break;
+
                 insn = list_next_entry(insn, list);
         }
 
diff --git a/tools/objtool/check.h b/tools/objtool/check.h
index dbadb304a410..23a1d065cae1 100644
--- a/tools/objtool/check.h
+++ b/tools/objtool/check.h
@@ -47,6 +47,7 @@ struct instruction {
         bool alt_group, visited, dead_end, ignore, hint, save, restore, ignore_alts;
         struct symbol *call_dest;
         struct instruction *jump_dest;
+        struct instruction *first_jump_src;
         struct list_head alts;
         struct symbol *func;
         struct stack_op stack_op;
diff --git a/tools/perf/Documentation/perf-data.txt b/tools/perf/Documentation/perf-data.txt
index f0796a47dfa3..90bb4aabe4f8 100644
--- a/tools/perf/Documentation/perf-data.txt
+++ b/tools/perf/Documentation/perf-data.txt
@@ -30,6 +30,10 @@ OPTIONS for 'convert'
 -i::
         Specify input perf data file path.
 
+-f::
+--force::
+        Don't complain, do it.
+
 -v::
 --verbose::
         Be more verbose (show counter open errors, etc).
diff --git a/tools/perf/arch/s390/Makefile b/tools/perf/arch/s390/Makefile
index 48228de415d0..dfa6e3103437 100644
--- a/tools/perf/arch/s390/Makefile
+++ b/tools/perf/arch/s390/Makefile
@@ -10,15 +10,19 @@ PERF_HAVE_ARCH_REGS_QUERY_REGISTER_OFFSET := 1
 
 out    := $(OUTPUT)arch/s390/include/generated/asm
 header := $(out)/syscalls_64.c
-sysdef := $(srctree)/tools/arch/s390/include/uapi/asm/unistd.h
-sysprf := $(srctree)/tools/perf/arch/s390/entry/syscalls/
+syskrn := $(srctree)/arch/s390/kernel/syscalls/syscall.tbl
+sysprf := $(srctree)/tools/perf/arch/s390/entry/syscalls
+sysdef := $(sysprf)/syscall.tbl
 systbl := $(sysprf)/mksyscalltbl
 
 # Create output directory if not already present
 _dummy := $(shell [ -d '$(out)' ] || mkdir -p '$(out)')
 
 $(header): $(sysdef) $(systbl)
-        $(Q)$(SHELL) '$(systbl)' '$(CC)' $(sysdef) > $@
+        @(test -d ../../kernel -a -d ../../tools -a -d ../perf && ( \
+        (diff -B $(sysdef) $(syskrn) >/dev/null) \
+        || echo "Warning: Kernel ABI header at '$(sysdef)' differs from latest version at '$(syskrn)'" >&2 )) || true
+        $(Q)$(SHELL) '$(systbl)' $(sysdef) > $@
 
 clean::
         $(call QUIET_CLEAN, s390) $(RM) $(header)
diff --git a/tools/perf/arch/s390/entry/syscalls/mksyscalltbl b/tools/perf/arch/s390/entry/syscalls/mksyscalltbl
index 7fa0d0abd419..72ecbb676370 100755
--- a/tools/perf/arch/s390/entry/syscalls/mksyscalltbl
+++ b/tools/perf/arch/s390/entry/syscalls/mksyscalltbl
@@ -3,25 +3,23 @@
 #
 # Generate system call table for perf
 #
-#
-# Copyright IBM Corp. 2017
+# Copyright IBM Corp. 2017, 2018
 # Author(s):  Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
 #
 
-gcc=$1
-input=$2
+SYSCALL_TBL=$1
 
-if ! test -r $input; then
+if ! test -r $SYSCALL_TBL; then
         echo "Could not read input file" >&2
         exit 1
 fi
 
 create_table()
 {
-        local max_nr
+        local max_nr nr abi sc discard
 
         echo 'static const char *syscalltbl_s390_64[] = {'
-        while read sc nr; do
+        while read nr abi sc discard; do
                 printf '\t[%d] = "%s",\n' $nr $sc
                 max_nr=$nr
         done
@@ -29,8 +27,6 @@ create_table()
         echo "#define SYSCALLTBL_S390_64_MAX_ID $max_nr"
 }
 
-
-$gcc -m64 -E -dM -x c  $input          \
-        |sed -ne 's/^#define __NR_//p' \
-        |sort -t' ' -k2 -nu            \
+grep -E "^[[:digit:]]+[[:space:]]+(common|64)" $SYSCALL_TBL     \
+        |sort -k1 -n                                    \
         |create_table
diff --git a/tools/perf/arch/s390/entry/syscalls/syscall.tbl b/tools/perf/arch/s390/entry/syscalls/syscall.tbl
new file mode 100644
index 000000000000..b38d48464368
--- /dev/null
+++ b/tools/perf/arch/s390/entry/syscalls/syscall.tbl
@@ -0,0 +1,390 @@
+# SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
+#
+# System call table for s390
+#
+# Format:
+#
+# <nr> <abi> <syscall> <entry-64bit> <compat-entry>
+#
+# where <abi> can be common, 64, or 32
+
+1    common     exit                    sys_exit                        sys_exit
+2    common     fork                    sys_fork                        sys_fork
+3    common     read                    sys_read                        compat_sys_s390_read
+4    common     write                   sys_write                       compat_sys_s390_write
+5    common     open                    sys_open                        compat_sys_open
+6    common     close                   sys_close                       sys_close
+7    common     restart_syscall         sys_restart_syscall             sys_restart_syscall
+8    common     creat                   sys_creat                       compat_sys_creat
+9    common     link                    sys_link                        compat_sys_link
+10   common     unlink                  sys_unlink                      compat_sys_unlink
+11   common     execve                  sys_execve                      compat_sys_execve
+12   common     chdir                   sys_chdir                       compat_sys_chdir
+13   32         time                    -                               compat_sys_time
+14   common     mknod                   sys_mknod                       compat_sys_mknod
+15   common     chmod                   sys_chmod                       compat_sys_chmod
+16   32         lchown                  -                               compat_sys_s390_lchown16
+19   common     lseek                   sys_lseek                       compat_sys_lseek
+20   common     getpid                  sys_getpid                      sys_getpid
+21   common     mount                   sys_mount                       compat_sys_mount
+22   common     umount                  sys_oldumount                   compat_sys_oldumount
+23   32         setuid                  -                               compat_sys_s390_setuid16
+24   32         getuid                  -                               compat_sys_s390_getuid16
+25   32         stime                   -                               compat_sys_stime
+26   common     ptrace                  sys_ptrace                      compat_sys_ptrace
+27   common     alarm                   sys_alarm                       sys_alarm
+29   common     pause                   sys_pause                       sys_pause
+30   common     utime                   sys_utime                       compat_sys_utime
+33   common     access                  sys_access                      compat_sys_access
+34   common     nice                    sys_nice                        sys_nice
+36   common     sync                    sys_sync                        sys_sync
+37   common     kill                    sys_kill                        sys_kill
+38   common     rename                  sys_rename                      compat_sys_rename
+39   common     mkdir                   sys_mkdir                       compat_sys_mkdir
+40   common     rmdir                   sys_rmdir                       compat_sys_rmdir
+41   common     dup                     sys_dup                         sys_dup
+42   common     pipe                    sys_pipe                        compat_sys_pipe
+43   common     times                   sys_times                       compat_sys_times
+45   common     brk                     sys_brk                         compat_sys_brk
+46   32         setgid                  -                               compat_sys_s390_setgid16
+47   32         getgid                  -                               compat_sys_s390_getgid16
+48   common     signal                  sys_signal                      compat_sys_signal
+49   32         geteuid                 -                               compat_sys_s390_geteuid16
+50   32         getegid                 -                               compat_sys_s390_getegid16
+51   common     acct                    sys_acct                        compat_sys_acct
+52   common     umount2                 sys_umount                      compat_sys_umount
+54   common     ioctl                   sys_ioctl                       compat_sys_ioctl
+55   common     fcntl                   sys_fcntl                       compat_sys_fcntl
+57   common     setpgid                 sys_setpgid                     sys_setpgid
+60   common     umask                   sys_umask                       sys_umask
+61   common     chroot                  sys_chroot                      compat_sys_chroot
+62   common     ustat                   sys_ustat                       compat_sys_ustat
+63   common     dup2                    sys_dup2                        sys_dup2
+64   common     getppid                 sys_getppid                     sys_getppid
+65   common     getpgrp                 sys_getpgrp                     sys_getpgrp
+66   common     setsid                  sys_setsid                      sys_setsid
+67   common     sigaction               sys_sigaction                   compat_sys_sigaction
+70   32         setreuid                -                               compat_sys_s390_setreuid16
+71   32         setregid                -                               compat_sys_s390_setregid16
+72   common     sigsuspend              sys_sigsuspend                  compat_sys_sigsuspend
+73   common     sigpending              sys_sigpending                  compat_sys_sigpending
+74   common     sethostname             sys_sethostname                 compat_sys_sethostname
+75   common     setrlimit               sys_setrlimit                   compat_sys_setrlimit
+76   32         getrlimit               -                               compat_sys_old_getrlimit
+77   common     getrusage               sys_getrusage                   compat_sys_getrusage
+78   common     gettimeofday            sys_gettimeofday                compat_sys_gettimeofday
+79   common     settimeofday            sys_settimeofday                compat_sys_settimeofday
+80   32         getgroups               -                               compat_sys_s390_getgroups16
+81   32         setgroups               -                               compat_sys_s390_setgroups16
+83   common     symlink                 sys_symlink                     compat_sys_symlink
+85   common     readlink                sys_readlink                    compat_sys_readlink
+86   common     uselib                  sys_uselib                      compat_sys_uselib
+87   common     swapon                  sys_swapon                      compat_sys_swapon
+88   common     reboot                  sys_reboot                      compat_sys_reboot
+89   common     readdir                 -                               compat_sys_old_readdir
+90   common     mmap                    sys_old_mmap                    compat_sys_s390_old_mmap
+91   common     munmap                  sys_munmap                      compat_sys_munmap
+92   common     truncate                sys_truncate                    compat_sys_truncate
+93   common     ftruncate               sys_ftruncate                   compat_sys_ftruncate
+94   common     fchmod                  sys_fchmod                      sys_fchmod
+95   32         fchown                  -                               compat_sys_s390_fchown16
+96   common     getpriority             sys_getpriority                 sys_getpriority
+97   common     setpriority             sys_setpriority                 sys_setpriority
+99   common     statfs                  sys_statfs                      compat_sys_statfs
+100  common     fstatfs                 sys_fstatfs                     compat_sys_fstatfs
+101  32         ioperm                  -                               -
+102  common     socketcall              sys_socketcall                  compat_sys_socketcall
+103  common     syslog                  sys_syslog                      compat_sys_syslog
+104  common     setitimer               sys_setitimer                   compat_sys_setitimer
+105  common     getitimer               sys_getitimer                   compat_sys_getitimer
+106  common     stat                    sys_newstat                     compat_sys_newstat
+107  common     lstat                   sys_newlstat                    compat_sys_newlstat
+108  common     fstat                   sys_newfstat                    compat_sys_newfstat
+110  common     lookup_dcookie          sys_lookup_dcookie              compat_sys_lookup_dcookie
+111  common     vhangup                 sys_vhangup                     sys_vhangup
+112  common     idle                    -                               -
+114  common     wait4                   sys_wait4                       compat_sys_wait4
+115  common     swapoff                 sys_swapoff                     compat_sys_swapoff
+116  common     sysinfo                 sys_sysinfo                     compat_sys_sysinfo
+117  common     ipc                     sys_s390_ipc                    compat_sys_s390_ipc
+118  common     fsync                   sys_fsync                       sys_fsync
+119  common     sigreturn               sys_sigreturn                   compat_sys_sigreturn
+120  common     clone                   sys_clone                       compat_sys_clone
+121  common     setdomainname           sys_setdomainname               compat_sys_setdomainname
+122  common     uname                   sys_newuname                    compat_sys_newuname
+124  common     adjtimex                sys_adjtimex                    compat_sys_adjtimex
+125  common     mprotect                sys_mprotect                    compat_sys_mprotect
+126  common     sigprocmask             sys_sigprocmask                 compat_sys_sigprocmask
+127  common     create_module           -                               -
+128  common     init_module             sys_init_module                 compat_sys_init_module
+129  common     delete_module           sys_delete_module               compat_sys_delete_module
+130  common     get_kernel_syms         -                               -
+131  common     quotactl                sys_quotactl                    compat_sys_quotactl
+132  common     getpgid                 sys_getpgid                     sys_getpgid
+133  common     fchdir                  sys_fchdir                      sys_fchdir
+134  common     bdflush                 sys_bdflush                     compat_sys_bdflush
+135  common     sysfs                   sys_sysfs                       compat_sys_sysfs
+136  common     personality             sys_s390_personality            sys_s390_personality
+137  common     afs_syscall             -                               -
+138  32         setfsuid                -                               compat_sys_s390_setfsuid16
+139  32         setfsgid                -                               compat_sys_s390_setfsgid16
+140  32         _llseek                 -                               compat_sys_llseek
+141  common     getdents                sys_getdents                    compat_sys_getdents
+142  32         _newselect              -                               compat_sys_select
+142  64         select                  sys_select                      -
+143  common     flock                   sys_flock                       sys_flock
+144  common     msync                   sys_msync                       compat_sys_msync
+145  common     readv                   sys_readv                       compat_sys_readv
+146  common     writev                  sys_writev                      compat_sys_writev
+147  common     getsid                  sys_getsid                      sys_getsid
+148  common     fdatasync               sys_fdatasync                   sys_fdatasync
+149  common     _sysctl                 sys_sysctl                      compat_sys_sysctl
+150  common     mlock                   sys_mlock                       compat_sys_mlock
+151  common     munlock                 sys_munlock                     compat_sys_munlock
+152  common     mlockall                sys_mlockall                    sys_mlockall
+153  common     munlockall              sys_munlockall                  sys_munlockall
+154  common     sched_setparam          sys_sched_setparam              compat_sys_sched_setparam
+155  common     sched_getparam          sys_sched_getparam              compat_sys_sched_getparam
+156  common     sched_setscheduler      sys_sched_setscheduler          compat_sys_sched_setscheduler
+157  common     sched_getscheduler      sys_sched_getscheduler          sys_sched_getscheduler
+158  common     sched_yield             sys_sched_yield                 sys_sched_yield
+159  common     sched_get_priority_max  sys_sched_get_priority_max      sys_sched_get_priority_max
+160  common     sched_get_priority_min  sys_sched_get_priority_min      sys_sched_get_priority_min
+161  common     sched_rr_get_interval   sys_sched_rr_get_interval       compat_sys_sched_rr_get_interval
+162  common     nanosleep               sys_nanosleep                   compat_sys_nanosleep
+163  common     mremap                  sys_mremap                      compat_sys_mremap
+164  32         setresuid               -                               compat_sys_s390_setresuid16
+165  32         getresuid               -                               compat_sys_s390_getresuid16
+167  common     query_module            -                               -
+168  common     poll                    sys_poll                        compat_sys_poll
+169  common     nfsservctl              -                               -
+170  32         setresgid               -                               compat_sys_s390_setresgid16
+171  32         getresgid               -                               compat_sys_s390_getresgid16
+172  common     prctl                   sys_prctl                       compat_sys_prctl
+173  common     rt_sigreturn            sys_rt_sigreturn                compat_sys_rt_sigreturn
+174  common     rt_sigaction            sys_rt_sigaction                compat_sys_rt_sigaction
+175  common     rt_sigprocmask          sys_rt_sigprocmask              compat_sys_rt_sigprocmask
+176  common     rt_sigpending           sys_rt_sigpending               compat_sys_rt_sigpending
+177  common     rt_sigtimedwait         sys_rt_sigtimedwait             compat_sys_rt_sigtimedwait
+178  common     rt_sigqueueinfo         sys_rt_sigqueueinfo             compat_sys_rt_sigqueueinfo
+179  common     rt_sigsuspend           sys_rt_sigsuspend               compat_sys_rt_sigsuspend
+180  common     pread64                 sys_pread64                     compat_sys_s390_pread64
+181  common     pwrite64                sys_pwrite64                    compat_sys_s390_pwrite64
+182  32         chown                   -                               compat_sys_s390_chown16
+183  common     getcwd                  sys_getcwd                      compat_sys_getcwd
+184  common     capget                  sys_capget                      compat_sys_capget
+185  common     capset                  sys_capset                      compat_sys_capset
+186  common     sigaltstack             sys_sigaltstack                 compat_sys_sigaltstack
+187  common     sendfile                sys_sendfile64                  compat_sys_sendfile
+188  common     getpmsg                 -                               -
+189  common     putpmsg                 -                               -
+190  common     vfork                   sys_vfork                       sys_vfork
+191  32         ugetrlimit              -                               compat_sys_getrlimit
+191  64         getrlimit               sys_getrlimit                   -
+192  32         mmap2                   -                               compat_sys_s390_mmap2
+193  32         truncate64              -                               compat_sys_s390_truncate64
+194  32         ftruncate64             -                               compat_sys_s390_ftruncate64
+195  32         stat64                  -                               compat_sys_s390_stat64
+196  32         lstat64                 -                               compat_sys_s390_lstat64
+197  32         fstat64                 -                               compat_sys_s390_fstat64
+198  32         lchown32                -                               compat_sys_lchown
+198  64         lchown                  sys_lchown                      -
+199  32         getuid32                -                               sys_getuid
+199  64         getuid                  sys_getuid                      -
+200  32         getgid32                -                               sys_getgid
+200  64         getgid                  sys_getgid                      -
+201  32         geteuid32               -                               sys_geteuid
+201  64         geteuid                 sys_geteuid                     -
+202  32         getegid32               -                               sys_getegid
+202  64         getegid                 sys_getegid                     -
+203  32         setreuid32              -                               sys_setreuid
+203  64         setreuid                sys_setreuid                    -
+204  32         setregid32              -                               sys_setregid
+204  64         setregid                sys_setregid                    -
+205  32         getgroups32             -                               compat_sys_getgroups
+205  64         getgroups               sys_getgroups                   -
+206  32         setgroups32             -                               compat_sys_setgroups
+206  64         setgroups               sys_setgroups                   -
+207  32         fchown32                -                               sys_fchown
+207  64         fchown                  sys_fchown                      -
+208  32         setresuid32             -                               sys_setresuid
+208  64         setresuid               sys_setresuid                   -
+209  32         getresuid32             -                               compat_sys_getresuid
+209  64         getresuid               sys_getresuid                   -
+210  32         setresgid32             -                               sys_setresgid
+210  64         setresgid               sys_setresgid                   -
+211  32         getresgid32             -                               compat_sys_getresgid
+211  64         getresgid               sys_getresgid                   -
+212  32         chown32                 -                               compat_sys_chown
+212  64         chown                   sys_chown                       -
+213  32         setuid32                -                               sys_setuid
+213  64         setuid                  sys_setuid                      -
+214  32         setgid32                -                               sys_setgid
+214  64         setgid                  sys_setgid                      -
+215  32         setfsuid32              -                               sys_setfsuid
+215  64         setfsuid                sys_setfsuid                    -
+216  32         setfsgid32              -                               sys_setfsgid
+216  64         setfsgid                sys_setfsgid                    -
+217  common     pivot_root              sys_pivot_root                  compat_sys_pivot_root
+218  common     mincore                 sys_mincore                     compat_sys_mincore
+219  common     madvise                 sys_madvise                     compat_sys_madvise
+220  common     getdents64              sys_getdents64                  compat_sys_getdents64
+221  32         fcntl64                 -                               compat_sys_fcntl64
+222  common     readahead               sys_readahead                   compat_sys_s390_readahead
+223  32         sendfile64              -                               compat_sys_sendfile64
+224  common     setxattr                sys_setxattr                    compat_sys_setxattr
+225  common     lsetxattr               sys_lsetxattr                   compat_sys_lsetxattr
+226  common     fsetxattr               sys_fsetxattr                   compat_sys_fsetxattr
+227  common     getxattr                sys_getxattr                    compat_sys_getxattr
+228  common     lgetxattr               sys_lgetxattr                   compat_sys_lgetxattr
+229  common     fgetxattr               sys_fgetxattr                   compat_sys_fgetxattr
+230  common     listxattr               sys_listxattr                   compat_sys_listxattr
+231  common     llistxattr              sys_llistxattr                  compat_sys_llistxattr
+232  common     flistxattr              sys_flistxattr                  compat_sys_flistxattr
+233  common     removexattr             sys_removexattr                 compat_sys_removexattr
+234  common     lremovexattr            sys_lremovexattr                compat_sys_lremovexattr
+235  common     fremovexattr            sys_fremovexattr                compat_sys_fremovexattr
+236  common     gettid                  sys_gettid                      sys_gettid
+237  common     tkill                   sys_tkill                       sys_tkill
+238  common     futex                   sys_futex                       compat_sys_futex
+239  common     sched_setaffinity       sys_sched_setaffinity           compat_sys_sched_setaffinity
+240  common     sched_getaffinity       sys_sched_getaffinity           compat_sys_sched_getaffinity
+241  common     tgkill                  sys_tgkill                      sys_tgkill
+243  common     io_setup                sys_io_setup                    compat_sys_io_setup
+244  common     io_destroy              sys_io_destroy                  compat_sys_io_destroy
+245  common     io_getevents            sys_io_getevents                compat_sys_io_getevents
+246  common     io_submit               sys_io_submit                   compat_sys_io_submit
+247  common     io_cancel               sys_io_cancel                   compat_sys_io_cancel
+248  common     exit_group              sys_exit_group                  sys_exit_group
+249  common     epoll_create            sys_epoll_create                sys_epoll_create
+250  common     epoll_ctl               sys_epoll_ctl                   compat_sys_epoll_ctl
+251  common     epoll_wait              sys_epoll_wait                  compat_sys_epoll_wait
+252  common     set_tid_address         sys_set_tid_address             compat_sys_set_tid_address
+253  common     fadvise64               sys_fadvise64_64                compat_sys_s390_fadvise64
+254  common     timer_create            sys_timer_create                compat_sys_timer_create
+255  common     timer_settime           sys_timer_settime               compat_sys_timer_settime
+256  common     timer_gettime           sys_timer_gettime               compat_sys_timer_gettime
+257  common     timer_getoverrun        sys_timer_getoverrun            sys_timer_getoverrun
+258  common     timer_delete            sys_timer_delete                sys_timer_delete
+259  common     clock_settime           sys_clock_settime               compat_sys_clock_settime
+260  common     clock_gettime           sys_clock_gettime               compat_sys_clock_gettime
+261  common     clock_getres            sys_clock_getres                compat_sys_clock_getres
+262  common     clock_nanosleep         sys_clock_nanosleep             compat_sys_clock_nanosleep
+264  32         fadvise64_64            -                               compat_sys_s390_fadvise64_64
+265  common     statfs64                sys_statfs64                    compat_sys_statfs64
+266  common     fstatfs64               sys_fstatfs64                   compat_sys_fstatfs64
+267  common     remap_file_pages        sys_remap_file_pages            compat_sys_remap_file_pages
+268  common     mbind                   sys_mbind                       compat_sys_mbind
+269  common     get_mempolicy           sys_get_mempolicy               compat_sys_get_mempolicy
+270  common     set_mempolicy           sys_set_mempolicy               compat_sys_set_mempolicy
+271  common     mq_open                 sys_mq_open                     compat_sys_mq_open
+272  common     mq_unlink               sys_mq_unlink                   compat_sys_mq_unlink
+273  common     mq_timedsend            sys_mq_timedsend                compat_sys_mq_timedsend
+274  common     mq_timedreceive         sys_mq_timedreceive             compat_sys_mq_timedreceive
+275  common     mq_notify               sys_mq_notify                   compat_sys_mq_notify
+276  common     mq_getsetattr           sys_mq_getsetattr               compat_sys_mq_getsetattr
+277  common     kexec_load              sys_kexec_load                  compat_sys_kexec_load
+278  common     add_key                 sys_add_key                     compat_sys_add_key
+279  common     request_key             sys_request_key                 compat_sys_request_key
+280  common     keyctl                  sys_keyctl                      compat_sys_keyctl
+281  common     waitid                  sys_waitid                      compat_sys_waitid
+282  common     ioprio_set              sys_ioprio_set                  sys_ioprio_set
+283  common     ioprio_get              sys_ioprio_get                  sys_ioprio_get
+284  common     inotify_init            sys_inotify_init                sys_inotify_init
+285  common     inotify_add_watch       sys_inotify_add_watch           compat_sys_inotify_add_watch
+286  common     inotify_rm_watch        sys_inotify_rm_watch            sys_inotify_rm_watch
+287  common     migrate_pages           sys_migrate_pages               compat_sys_migrate_pages
+288  common     openat                  sys_openat                      compat_sys_openat
+289  common     mkdirat                 sys_mkdirat                     compat_sys_mkdirat
+290  common     mknodat                 sys_mknodat                     compat_sys_mknodat
+291  common     fchownat                sys_fchownat                    compat_sys_fchownat
+292  common     futimesat               sys_futimesat                   compat_sys_futimesat
+293  32         fstatat64               -                               compat_sys_s390_fstatat64
+293  64         newfstatat              sys_newfstatat                  -
+294  common     unlinkat                sys_unlinkat                    compat_sys_unlinkat
+295  common     renameat                sys_renameat                    compat_sys_renameat
+296  common     linkat                  sys_linkat                      compat_sys_linkat
+297  common     symlinkat               sys_symlinkat                   compat_sys_symlinkat
+298  common     readlinkat              sys_readlinkat                  compat_sys_readlinkat
+299  common     fchmodat                sys_fchmodat                    compat_sys_fchmodat
+300  common     faccessat               sys_faccessat                   compat_sys_faccessat
+301  common     pselect6                sys_pselect6                    compat_sys_pselect6
+302  common     ppoll                   sys_ppoll                       compat_sys_ppoll
+303  common     unshare                 sys_unshare                     compat_sys_unshare
+304  common     set_robust_list         sys_set_robust_list             compat_sys_set_robust_list
+305  common     get_robust_list         sys_get_robust_list             compat_sys_get_robust_list
+306  common     splice                  sys_splice                      compat_sys_splice
+307  common     sync_file_range         sys_sync_file_range             compat_sys_s390_sync_file_range
+308  common     tee                     sys_tee                         compat_sys_tee
+309  common     vmsplice                sys_vmsplice                    compat_sys_vmsplice
+310  common     move_pages              sys_move_pages                  compat_sys_move_pages
+311  common     getcpu                  sys_getcpu                      compat_sys_getcpu
+312  common     epoll_pwait             sys_epoll_pwait                 compat_sys_epoll_pwait
+313  common     utimes                  sys_utimes                      compat_sys_utimes
+314  common     fallocate               sys_fallocate                   compat_sys_s390_fallocate
+315  common     utimensat               sys_utimensat                   compat_sys_utimensat
+316  common     signalfd                sys_signalfd                    compat_sys_signalfd
+317  common     timerfd                 -                               -
+318  common     eventfd                 sys_eventfd                     sys_eventfd
+319  common     timerfd_create          sys_timerfd_create              sys_timerfd_create
+320  common     timerfd_settime         sys_timerfd_settime             compat_sys_timerfd_settime
+321  common     timerfd_gettime         sys_timerfd_gettime             compat_sys_timerfd_gettime
+322  common     signalfd4               sys_signalfd4                   compat_sys_signalfd4
+323  common     eventfd2                sys_eventfd2                    sys_eventfd2
+324  common     inotify_init1           sys_inotify_init1               sys_inotify_init1
+325  common     pipe2                   sys_pipe2                       compat_sys_pipe2
+326  common     dup3                    sys_dup3                        sys_dup3
+327  common     epoll_create1           sys_epoll_create1               sys_epoll_create1
+328  common     preadv                  sys_preadv                      compat_sys_preadv
+329  common     pwritev                 sys_pwritev                     compat_sys_pwritev
+330  common     rt_tgsigqueueinfo       sys_rt_tgsigqueueinfo           compat_sys_rt_tgsigqueueinfo
+331  common     perf_event_open         sys_perf_event_open             compat_sys_perf_event_open
+332  common     fanotify_init           sys_fanotify_init               sys_fanotify_init
+333  common     fanotify_mark           sys_fanotify_mark               compat_sys_fanotify_mark
+334  common     prlimit64               sys_prlimit64                   compat_sys_prlimit64
+335  common     name_to_handle_at       sys_name_to_handle_at           compat_sys_name_to_handle_at
+336  common     open_by_handle_at       sys_open_by_handle_at           compat_sys_open_by_handle_at
+337  common     clock_adjtime           sys_clock_adjtime               compat_sys_clock_adjtime
+338  common     syncfs                  sys_syncfs                      sys_syncfs
+339  common     setns                   sys_setns                       sys_setns
+340  common     process_vm_readv        sys_process_vm_readv            compat_sys_process_vm_readv
+341  common     process_vm_writev       sys_process_vm_writev           compat_sys_process_vm_writev
+342  common     s390_runtime_instr      sys_s390_runtime_instr          sys_s390_runtime_instr
+343  common     kcmp                    sys_kcmp                        compat_sys_kcmp
+344  common     finit_module            sys_finit_module                compat_sys_finit_module
+345  common     sched_setattr           sys_sched_setattr               compat_sys_sched_setattr
+346  common     sched_getattr           sys_sched_getattr               compat_sys_sched_getattr
+347  common     renameat2               sys_renameat2                   compat_sys_renameat2
+348  common     seccomp                 sys_seccomp                     compat_sys_seccomp
+349  common     getrandom               sys_getrandom                   compat_sys_getrandom
+350  common     memfd_create            sys_memfd_create                compat_sys_memfd_create
+351  common     bpf                     sys_bpf                         compat_sys_bpf
+352  common     s390_pci_mmio_write     sys_s390_pci_mmio_write         compat_sys_s390_pci_mmio_write
+353  common     s390_pci_mmio_read      sys_s390_pci_mmio_read          compat_sys_s390_pci_mmio_read
+354  common     execveat                sys_execveat                    compat_sys_execveat
+355  common     userfaultfd             sys_userfaultfd                 sys_userfaultfd
+356  common     membarrier              sys_membarrier                  sys_membarrier
+357  common     recvmmsg                sys_recvmmsg                    compat_sys_recvmmsg
+358  common     sendmmsg                sys_sendmmsg                    compat_sys_sendmmsg
+359  common     socket                  sys_socket                      sys_socket
+360  common     socketpair              sys_socketpair                  compat_sys_socketpair
+361  common     bind                    sys_bind                        compat_sys_bind
+362  common     connect                 sys_connect                     compat_sys_connect
+363  common     listen                  sys_listen                      sys_listen
+364  common     accept4                 sys_accept4                     compat_sys_accept4
+365  common     getsockopt              sys_getsockopt                  compat_sys_getsockopt
+366  common     setsockopt              sys_setsockopt                  compat_sys_setsockopt
+367  common     getsockname             sys_getsockname                 compat_sys_getsockname
+368  common     getpeername             sys_getpeername                 compat_sys_getpeername
+369  common     sendto                  sys_sendto                      compat_sys_sendto
+370  common     sendmsg                 sys_sendmsg                     compat_sys_sendmsg
+371  common     recvfrom                sys_recvfrom                    compat_sys_recvfrom
+372  common     recvmsg                 sys_recvmsg                     compat_sys_recvmsg
+373  common     shutdown                sys_shutdown                    sys_shutdown
+374  common     mlock2                  sys_mlock2                      compat_sys_mlock2
+375  common     copy_file_range         sys_copy_file_range             compat_sys_copy_file_range
+376  common     preadv2                 sys_preadv2                     compat_sys_preadv2
+377  common     pwritev2                sys_pwritev2                    compat_sys_pwritev2
+378  common     s390_guarded_storage    sys_s390_guarded_storage        compat_sys_s390_guarded_storage
+379  common     statx                   sys_statx                       compat_sys_statx
+380  common     s390_sthyi              sys_s390_sthyi                  compat_sys_s390_sthyi
diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
index c0815a37fdb5..539c3d460158 100644
--- a/tools/perf/builtin-c2c.c
+++ b/tools/perf/builtin-c2c.c
@@ -2245,7 +2245,7 @@ static int perf_c2c__browse_cacheline(struct hist_entry *he)
         c2c_browser__update_nr_entries(browser);
 
         while (1) {
-                key = hist_browser__run(browser, "? - help");
+                key = hist_browser__run(browser, "? - help", true);
 
                 switch (key) {
                 case 's':
@@ -2314,7 +2314,7 @@ static int perf_c2c__hists_browse(struct hists *hists)
         c2c_browser__update_nr_entries(browser);
 
         while (1) {
-                key = hist_browser__run(browser, "? - help");
+                key = hist_browser__run(browser, "? - help", true);
 
                 switch (key) {
                 case 'q':
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 42a52dcc41cd..4ad5dc649716 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -530,7 +530,8 @@ static int report__browse_hists(struct report *rep)
         case 1:
                 ret = perf_evlist__tui_browse_hists(evlist, help, NULL,
                                                     rep->min_percent,
-                                                    &session->header.env);
+                                                    &session->header.env,
+                                                    true);
                 /*
                  * Usually "ret" is the last pressed key, and we only
                  * care if the key notifies us to switch data file.
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index c6ccda52117d..b7c823ba8374 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -283,8 +283,9 @@ static void perf_top__print_sym_table(struct perf_top *top)
 
         printf("%-*.*s\n", win_width, win_width, graph_dotted_line);
 
-        if (hists->stats.nr_lost_warned !=
-            hists->stats.nr_events[PERF_RECORD_LOST]) {
+        if (!top->record_opts.overwrite &&
+            (hists->stats.nr_lost_warned !=
+            hists->stats.nr_events[PERF_RECORD_LOST])) {
                 hists->stats.nr_lost_warned =
                               hists->stats.nr_events[PERF_RECORD_LOST];
                 color_fprintf(stdout, PERF_COLOR_RED,
@@ -611,7 +612,8 @@ static void *display_thread_tui(void *arg)
 
         perf_evlist__tui_browse_hists(top->evlist, help, &hbt,
                                       top->min_percent,
-                                      &top->session->header.env);
+                                      &top->session->header.env,
+                                      !top->record_opts.overwrite);
 
         done = 1;
         return NULL;
@@ -807,15 +809,23 @@ static void perf_event__process_sample(struct perf_tool *tool,
 
 static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
 {
+        struct record_opts *opts = &top->record_opts;
+        struct perf_evlist *evlist = top->evlist;
         struct perf_sample sample;
         struct perf_evsel *evsel;
+        struct perf_mmap *md;
         struct perf_session *session = top->session;
         union perf_event *event;
         struct machine *machine;
+        u64 end, start;
         int ret;
 
-        while ((event = perf_evlist__mmap_read(top->evlist, idx)) != NULL) {
-                ret = perf_evlist__parse_sample(top->evlist, event, &sample);
+        md = opts->overwrite ? &evlist->overwrite_mmap[idx] : &evlist->mmap[idx];
+        if (perf_mmap__read_init(md, opts->overwrite, &start, &end) < 0)
+                return;
+
+        while ((event = perf_mmap__read_event(md, opts->overwrite, &start, end)) != NULL) {
+                ret = perf_evlist__parse_sample(evlist, event, &sample);
                 if (ret) {
                         pr_err("Can't parse sample, err = %d\n", ret);
                         goto next_event;
@@ -869,16 +879,120 @@ static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
                 } else
                         ++session->evlist->stats.nr_unknown_events;
 next_event:
-                perf_evlist__mmap_consume(top->evlist, idx);
+                perf_mmap__consume(md, opts->overwrite);
         }
+
+        perf_mmap__read_done(md);
 }
 
 static void perf_top__mmap_read(struct perf_top *top)
 {
+        bool overwrite = top->record_opts.overwrite;
+        struct perf_evlist *evlist = top->evlist;
+        unsigned long long start, end;
         int i;
 
+        start = rdclock();
+        if (overwrite)
+                perf_evlist__toggle_bkw_mmap(evlist, BKW_MMAP_DATA_PENDING);
+
         for (i = 0; i < top->evlist->nr_mmaps; i++)
                 perf_top__mmap_read_idx(top, i);
+
+        if (overwrite) {
+                perf_evlist__toggle_bkw_mmap(evlist, BKW_MMAP_EMPTY);
+                perf_evlist__toggle_bkw_mmap(evlist, BKW_MMAP_RUNNING);
+        }
+        end = rdclock();
+
+        if ((end - start) > (unsigned long long)top->delay_secs * NSEC_PER_SEC)
+                ui__warning("Too slow to read ring buffer.\n"
+                            "Please try increasing the period (-c) or\n"
+                            "decreasing the freq (-F) or\n"
+                            "limiting the number of CPUs (-C)\n");
+}
+
+/*
+ * Check per-event overwrite term.
+ * perf top should support consistent term for all events.
+ * - All events don't have per-event term
+ *   E.g. "cpu/cpu-cycles/,cpu/instructions/"
+ *   Nothing change, return 0.
+ * - All events have same per-event term
+ *   E.g. "cpu/cpu-cycles,no-overwrite/,cpu/instructions,no-overwrite/
+ *   Using the per-event setting to replace the opts->overwrite if
+ *   they are different, then return 0.
+ * - Events have different per-event term
+ *   E.g. "cpu/cpu-cycles,overwrite/,cpu/instructions,no-overwrite/"
+ *   Return -1
+ * - Some of the event set per-event term, but some not.
+ *   E.g. "cpu/cpu-cycles/,cpu/instructions,no-overwrite/"
+ *   Return -1
+ */
+static int perf_top__overwrite_check(struct perf_top *top)
+{
+        struct record_opts *opts = &top->record_opts;
+        struct perf_evlist *evlist = top->evlist;
+        struct perf_evsel_config_term *term;
+        struct list_head *config_terms;
+        struct perf_evsel *evsel;
+        int set, overwrite = -1;
+
+        evlist__for_each_entry(evlist, evsel) {
+                set = -1;
+                config_terms = &evsel->config_terms;
+                list_for_each_entry(term, config_terms, list) {
+                        if (term->type == PERF_EVSEL__CONFIG_TERM_OVERWRITE)
+                                set = term->val.overwrite ? 1 : 0;
+                }
+
+                /* no term for current and previous event (likely) */
+                if ((overwrite < 0) && (set < 0))
+                        continue;
+
+                /* has term for both current and previous event, compare */
+                if ((overwrite >= 0) && (set >= 0) && (overwrite != set))
+                        return -1;
+
+                /* no term for current event but has term for previous one */
+                if ((overwrite >= 0) && (set < 0))
+                        return -1;
+
+                /* has term for current event */
+                if ((overwrite < 0) && (set >= 0)) {
+                        /* if it's first event, set overwrite */
+                        if (evsel == perf_evlist__first(evlist))
+                                overwrite = set;
+                        else
+                                return -1;
+                }
+        }
+
+        if ((overwrite >= 0) && (opts->overwrite != overwrite))
+                opts->overwrite = overwrite;
+
+        return 0;
+}
+
+static int perf_top_overwrite_fallback(struct perf_top *top,
+                                       struct perf_evsel *evsel)
+{
+        struct record_opts *opts = &top->record_opts;
+        struct perf_evlist *evlist = top->evlist;
+        struct perf_evsel *counter;
+
+        if (!opts->overwrite)
+                return 0;
+
+        /* only fall back when first event fails */
+        if (evsel != perf_evlist__first(evlist))
+                return 0;
+
+        evlist__for_each_entry(evlist, counter)
+                counter->attr.write_backward = false;
+        opts->overwrite = false;
+        ui__warning("fall back to non-overwrite mode\n");
+        return 1;
 }
 
 static int perf_top__start_counters(struct perf_top *top)
@@ -888,12 +1002,33 @@ static int perf_top__start_counters(struct perf_top *top)
         struct perf_evlist *evlist = top->evlist;
         struct record_opts *opts = &top->record_opts;
 
+        if (perf_top__overwrite_check(top)) {
+                ui__error("perf top only support consistent per-event "
+                          "overwrite setting for all events\n");
+                goto out_err;
+        }
+
         perf_evlist__config(evlist, opts, &callchain_param);
 
         evlist__for_each_entry(evlist, counter) {
 try_again:
                 if (perf_evsel__open(counter, top->evlist->cpus,
                                      top->evlist->threads) < 0) {
+
+                        /*
+                         * Specially handle overwrite fall back.
+                         * Because perf top is the only tool which has
+                         * overwrite mode by default, support
+                         * both overwrite and non-overwrite mode, and
+                         * require consistent mode for all events.
+                         *
+                         * May move it to generic code with more tools
+                         * have similar attribute.
+                         */
+                        if (perf_missing_features.write_backward &&
+                            perf_top_overwrite_fallback(top, counter))
+                                goto try_again;
+
                         if (perf_evsel__fallback(counter, errno, msg, sizeof(msg))) {
                                 if (verbose > 0)
                                         ui__warning("%s\n", msg);
@@ -1033,7 +1168,7 @@ static int __cmd_top(struct perf_top *top)
 
                 perf_top__mmap_read(top);
 
-                if (hits == top->samples)
+                if (opts->overwrite || (hits == top->samples))
                         ret = perf_evlist__poll(top->evlist, 100);
 
                 if (resize) {
@@ -1127,6 +1262,7 @@ int cmd_top(int argc, const char **argv)
                                 .uses_mmap   = true,
                         },
                         .proc_map_timeout    = 500,
+                        .overwrite      = 1,
                 },
                 .max_stack           = sysctl_perf_event_max_stack,
                 .sym_pcnt_filter     = 5,
diff --git a/tools/perf/check-headers.sh b/tools/perf/check-headers.sh
index 51abdb0a4047..790ec25919a0 100755
--- a/tools/perf/check-headers.sh
+++ b/tools/perf/check-headers.sh
@@ -33,7 +33,6 @@ arch/s390/include/uapi/asm/kvm.h
 arch/s390/include/uapi/asm/kvm_perf.h
 arch/s390/include/uapi/asm/ptrace.h
 arch/s390/include/uapi/asm/sie.h
-arch/s390/include/uapi/asm/unistd.h
 arch/arm/include/uapi/asm/kvm.h
 arch/arm64/include/uapi/asm/kvm.h
 arch/alpha/include/uapi/asm/errno.h
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/branch.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/branch.json
new file mode 100644
index 000000000000..3b6208763e50
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/branch.json
@@ -0,0 +1,27 @@
+[
+  {,
+    "EventCode": "0x7A",
+    "EventName": "BR_INDIRECT_SPEC",
+    "BriefDescription": "Branch speculatively executed - Indirect branch"
+  },
+  {,
+    "EventCode": "0xC9",
+    "EventName": "BR_COND",
+    "BriefDescription": "Conditional branch executed"
+  },
+  {,
+    "EventCode": "0xCA",
+    "EventName": "BR_INDIRECT_MISPRED",
+    "BriefDescription": "Indirect branch mispredicted"
+  },
+  {,
+    "EventCode": "0xCB",
+    "EventName": "BR_INDIRECT_MISPRED_ADDR",
+    "BriefDescription": "Indirect branch mispredicted because of address miscompare"
+  },
+  {,
+    "EventCode": "0xCC",
+    "EventName": "BR_COND_MISPRED",
+    "BriefDescription": "Conditional branch mispredicted"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/bus.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/bus.json
new file mode 100644
index 000000000000..480d9f7460ab
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/bus.json
@@ -0,0 +1,22 @@
+[
+  {,
+    "EventCode": "0x60",
+    "EventName": "BUS_ACCESS_LD",
+    "BriefDescription": "Bus access - Read"
+  },
+  {,
+    "EventCode": "0x61",
+    "EventName": "BUS_ACCESS_ST",
+    "BriefDescription": "Bus access - Write"
+  },
+  {,
+    "EventCode": "0xC0",
+    "EventName": "EXT_MEM_REQ",
+    "BriefDescription": "External memory request"
+  },
+  {,
+    "EventCode": "0xC1",
+    "EventName": "EXT_MEM_REQ_NC",
+    "BriefDescription": "Non-cacheable external memory request"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/cache.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/cache.json
new file mode 100644
index 000000000000..11baad6344b9
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/cache.json
@@ -0,0 +1,27 @@
+[
+  {,
+    "EventCode": "0xC2",
+    "EventName": "PREFETCH_LINEFILL",
+    "BriefDescription": "Linefill because of prefetch"
+  },
+  {,
+    "EventCode": "0xC3",
+    "EventName": "PREFETCH_LINEFILL_DROP",
+    "BriefDescription": "Instruction Cache Throttle occurred"
+  },
+  {,
+    "EventCode": "0xC4",
+    "EventName": "READ_ALLOC_ENTER",
+    "BriefDescription": "Entering read allocate mode"
+  },
+  {,
+    "EventCode": "0xC5",
+    "EventName": "READ_ALLOC",
+    "BriefDescription": "Read allocate mode"
+  },
+  {,
+    "EventCode": "0xC8",
+    "EventName": "EXT_SNOOP",
+    "BriefDescription": "SCU Snooped data from another CPU for this CPU"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/memory.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/memory.json
new file mode 100644
index 000000000000..480d9f7460ab
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/memory.json
@@ -0,0 +1,22 @@
+[
+  {,
+    "EventCode": "0x60",
+    "EventName": "BUS_ACCESS_LD",
+    "BriefDescription": "Bus access - Read"
+  },
+  {,
+    "EventCode": "0x61",
+    "EventName": "BUS_ACCESS_ST",
+    "BriefDescription": "Bus access - Write"
+  },
+  {,
+    "EventCode": "0xC0",
+    "EventName": "EXT_MEM_REQ",
+    "BriefDescription": "External memory request"
+  },
+  {,
+    "EventCode": "0xC1",
+    "EventName": "EXT_MEM_REQ_NC",
+    "BriefDescription": "Non-cacheable external memory request"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/other.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/other.json
new file mode 100644
index 000000000000..73a22402d003
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/other.json
@@ -0,0 +1,32 @@
+[
+  {,
+    "EventCode": "0x86",
+    "EventName": "EXC_IRQ",
+    "BriefDescription": "Exception taken, IRQ"
+  },
+  {,
+    "EventCode": "0x87",
+    "EventName": "EXC_FIQ",
+    "BriefDescription": "Exception taken, FIQ"
+  },
+  {,
+    "EventCode": "0xC6",
+    "EventName": "PRE_DECODE_ERR",
+    "BriefDescription": "Pre-decode error"
+  },
+  {,
+    "EventCode": "0xD0",
+    "EventName": "L1I_CACHE_ERR",
+    "BriefDescription": "L1 Instruction Cache (data or tag) memory error"
+  },
+  {,
+    "EventCode": "0xD1",
+    "EventName": "L1D_CACHE_ERR",
+    "BriefDescription": "L1 Data Cache (data, tag or dirty) memory error, correctable or non-correctable"
+  },
+  {,
+    "EventCode": "0xD2",
+    "EventName": "TLB_ERR",
+    "BriefDescription": "TLB memory error"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/pipeline.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/pipeline.json
new file mode 100644
index 000000000000..3149fb90555a
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/pipeline.json
@@ -0,0 +1,52 @@
+[
+  {,
+    "EventCode": "0xC7",
+    "EventName": "STALL_SB_FULL",
+    "BriefDescription": "Data Write operation that stalls the pipeline because the store buffer is full"
+  },
+  {,
+    "EventCode": "0xE0",
+    "EventName": "OTHER_IQ_DEP_STALL",
+    "BriefDescription": "Cycles that the DPU IQ is empty and that is not because of a recent micro-TLB miss, instruction cache miss or pre-decode error"
+  },
+  {,
+    "EventCode": "0xE1",
+    "EventName": "IC_DEP_STALL",
+    "BriefDescription": "Cycles the DPU IQ is empty and there is an instruction cache miss being processed"
+  },
+  {,
+    "EventCode": "0xE2",
+    "EventName": "IUTLB_DEP_STALL",
+    "BriefDescription": "Cycles the DPU IQ is empty and there is an instruction micro-TLB miss being processed"
+  },
+  {,
+    "EventCode": "0xE3",
+    "EventName": "DECODE_DEP_STALL",
+    "BriefDescription": "Cycles the DPU IQ is empty and there is a pre-decode error being processed"
+  },
+  {,
+    "EventCode": "0xE4",
+    "EventName": "OTHER_INTERLOCK_STALL",
+    "BriefDescription": "Cycles there is an interlock other than  Advanced SIMD/Floating-point instructions or load/store instruction"
+  },
+  {,
+    "EventCode": "0xE5",
+    "EventName": "AGU_DEP_STALL",
+    "BriefDescription": "Cycles there is an interlock for a load/store instruction waiting for data to calculate the address in the AGU"
+  },
+  {,
+    "EventCode": "0xE6",
+    "EventName": "SIMD_DEP_STALL",
+    "BriefDescription": "Cycles there is an interlock for an Advanced SIMD/Floating-point operation."
+  },
+  {,
+    "EventCode": "0xE7",
+    "EventName": "LD_DEP_STALL",
+    "BriefDescription": "Cycles there is a stall in the Wr stage because of a load miss"
+  },
+  {,
+    "EventCode": "0xE8",
+    "EventName": "ST_DEP_STALL",
+    "BriefDescription": "Cycles there is a stall in the Wr stage because of a store"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/mapfile.csv b/tools/perf/pmu-events/arch/arm64/mapfile.csv
index 219d6756134e..e61c9ca6cf9e 100644
--- a/tools/perf/pmu-events/arch/arm64/mapfile.csv
+++ b/tools/perf/pmu-events/arch/arm64/mapfile.csv
@@ -13,3 +13,4 @@
 #
 #Family-model,Version,Filename,EventType
 0x00000000420f5160,v1,cavium,core
+0x00000000410fd03[[:xdigit:]],v1,cortex-a53,core
diff --git a/tools/perf/tests/backward-ring-buffer.c b/tools/perf/tests/backward-ring-buffer.c
index 4035d43523c3..e0b1b414d466 100644
--- a/tools/perf/tests/backward-ring-buffer.c
+++ b/tools/perf/tests/backward-ring-buffer.c
@@ -31,10 +31,12 @@ static int count_samples(struct perf_evlist *evlist, int *sample_count,
         int i;
 
         for (i = 0; i < evlist->nr_mmaps; i++) {
+                struct perf_mmap *map = &evlist->overwrite_mmap[i];
                 union perf_event *event;
+                u64 start, end;
 
-                perf_mmap__read_catchup(&evlist->overwrite_mmap[i]);
-                while ((event = perf_mmap__read_backward(&evlist->overwrite_mmap[i])) != NULL) {
+                perf_mmap__read_init(map, true, &start, &end);
+                while ((event = perf_mmap__read_event(map, true, &start, end)) != NULL) {
                         const u32 type = event->header.type;
 
                         switch (type) {
@@ -49,6 +51,7 @@ static int count_samples(struct perf_evlist *evlist, int *sample_count,
                                 return TEST_FAIL;
                         }
                 }
+                perf_mmap__read_done(map);
         }
         return TEST_OK;
 }
diff --git a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
index 8b3da21a08f1..c446c894b297 100755
--- a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
+++ b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
@@ -22,10 +22,23 @@ trace_libc_inet_pton_backtrace() {
         expected[4]="rtt min.*"
         expected[5]="[0-9]+\.[0-9]+[[:space:]]+probe_libc:inet_pton:\([[:xdigit:]]+\)"
         expected[6]=".*inet_pton[[:space:]]\($libc\)$"
-        expected[7]="getaddrinfo[[:space:]]\($libc\)$"
-        expected[8]=".*\(.*/bin/ping.*\)$"
-
-        perf trace --no-syscalls -e probe_libc:inet_pton/max-stack=3/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do
+        case "$(uname -m)" in
+        s390x)
+                eventattr='call-graph=dwarf'
+                expected[7]="gaih_inet[[:space:]]\(inlined\)$"
+                expected[8]="__GI_getaddrinfo[[:space:]]\(inlined\)$"
+                expected[9]="main[[:space:]]\(.*/bin/ping.*\)$"
+                expected[10]="__libc_start_main[[:space:]]\($libc\)$"
+                expected[11]="_start[[:space:]]\(.*/bin/ping.*\)$"
+                ;;
+        *)
+                eventattr='max-stack=3'
+                expected[7]="getaddrinfo[[:space:]]\($libc\)$"
+                expected[8]=".*\(.*/bin/ping.*\)$"
+                ;;
+        esac
+
+        perf trace --no-syscalls -e probe_libc:inet_pton/$eventattr/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do
                 echo $line
                 echo "$line" | egrep -q "${expected[$idx]}"
                 if [ $? -ne 0 ] ; then
@@ -33,7 +46,7 @@ trace_libc_inet_pton_backtrace() {
                         exit 1
                 fi
                 let idx+=1
-                [ $idx -eq 9 ] && break
+                [ -z "${expected[$idx]}" ] && break
         done
 }
 
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index 68146f4620a5..6495ee55d9c3 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -608,7 +608,8 @@ static int hist_browser__title(struct hist_browser *browser, char *bf, size_t si
         return browser->title ? browser->title(browser, bf, size) : 0;
 }
 
-int hist_browser__run(struct hist_browser *browser, const char *help)
+int hist_browser__run(struct hist_browser *browser, const char *help,
+                      bool warn_lost_event)
 {
         int key;
         char title[160];
@@ -638,8 +639,9 @@ int hist_browser__run(struct hist_browser *browser, const char *help)
                         nr_entries = hist_browser__nr_entries(browser);
                         ui_browser__update_nr_entries(&browser->b, nr_entries);
 
-                        if (browser->hists->stats.nr_lost_warned !=
-                            browser->hists->stats.nr_events[PERF_RECORD_LOST]) {
+                        if (warn_lost_event &&
+                            (browser->hists->stats.nr_lost_warned !=
+                            browser->hists->stats.nr_events[PERF_RECORD_LOST])) {
                                 browser->hists->stats.nr_lost_warned =
                                         browser->hists->stats.nr_events[PERF_RECORD_LOST];
                                 ui_browser__warn_lost_events(&browser->b);
@@ -2763,7 +2765,8 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                                     bool left_exits,
                                     struct hist_browser_timer *hbt,
                                     float min_pcnt,
-                                    struct perf_env *env)
+                                    struct perf_env *env,
+                                    bool warn_lost_event)
 {
         struct hists *hists = evsel__hists(evsel);
         struct hist_browser *browser = perf_evsel_browser__new(evsel, hbt, env);
@@ -2844,7 +2847,8 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
 
                 nr_options = 0;
 
-                key = hist_browser__run(browser, helpline);
+                key = hist_browser__run(browser, helpline,
+                                        warn_lost_event);
 
                 if (browser->he_selection != NULL) {
                         thread = hist_browser__selected_thread(browser);
@@ -3184,7 +3188,8 @@ static void perf_evsel_menu__write(struct ui_browser *browser,
 
 static int perf_evsel_menu__run(struct perf_evsel_menu *menu,
                                 int nr_events, const char *help,
-                                struct hist_browser_timer *hbt)
+                                struct hist_browser_timer *hbt,
+                                bool warn_lost_event)
 {
         struct perf_evlist *evlist = menu->b.priv;
         struct perf_evsel *pos;
@@ -3203,7 +3208,9 @@ static int perf_evsel_menu__run(struct perf_evsel_menu *menu,
                 case K_TIMER:
                         hbt->timer(hbt->arg);
 
-                        if (!menu->lost_events_warned && menu->lost_events) {
+                        if (!menu->lost_events_warned &&
+                            menu->lost_events &&
+                            warn_lost_event) {
                                 ui_browser__warn_lost_events(&menu->b);
                                 menu->lost_events_warned = true;
                         }
@@ -3224,7 +3231,8 @@ browse_hists:
                         key = perf_evsel__hists_browse(pos, nr_events, help,
                                                        true, hbt,
                                                        menu->min_pcnt,
-                                                       menu->env);
+                                                       menu->env,
+                                                       warn_lost_event);
                         ui_browser__show_title(&menu->b, title);
                         switch (key) {
                         case K_TAB:
@@ -3282,7 +3290,8 @@ static int __perf_evlist__tui_browse_hists(struct perf_evlist *evlist,
                                            int nr_entries, const char *help,
                                            struct hist_browser_timer *hbt,
                                            float min_pcnt,
-                                           struct perf_env *env)
+                                           struct perf_env *env,
+                                           bool warn_lost_event)
 {
         struct perf_evsel *pos;
         struct perf_evsel_menu menu = {
@@ -3309,13 +3318,15 @@ static int __perf_evlist__tui_browse_hists(struct perf_evlist *evlist,
                         menu.b.width = line_len;
         }
 
-        return perf_evsel_menu__run(&menu, nr_entries, help, hbt);
+        return perf_evsel_menu__run(&menu, nr_entries, help,
+                                    hbt, warn_lost_event);
 }
 
 int perf_evlist__tui_browse_hists(struct perf_evlist *evlist, const char *help,
                                   struct hist_browser_timer *hbt,
                                   float min_pcnt,
-                                  struct perf_env *env)
+                                  struct perf_env *env,
+                                  bool warn_lost_event)
 {
         int nr_entries = evlist->nr_entries;
 
@@ -3325,7 +3336,7 @@ single_entry:
 
                 return perf_evsel__hists_browse(first, nr_entries, help,
                                                 false, hbt, min_pcnt,
-                                                env);
+                                                env, warn_lost_event);
         }
 
         if (symbol_conf.event_group) {
@@ -3342,5 +3353,6 @@ single_entry:
         }
 
         return __perf_evlist__tui_browse_hists(evlist, nr_entries, help,
-                                               hbt, min_pcnt, env);
+                                               hbt, min_pcnt, env,
+                                               warn_lost_event);
 }
diff --git a/tools/perf/ui/browsers/hists.h b/tools/perf/ui/browsers/hists.h
index ba431777f559..9428bee076f2 100644
--- a/tools/perf/ui/browsers/hists.h
+++ b/tools/perf/ui/browsers/hists.h
@@ -28,7 +28,8 @@ struct hist_browser {
 
 struct hist_browser *hist_browser__new(struct hists *hists);
 void hist_browser__delete(struct hist_browser *browser);
-int hist_browser__run(struct hist_browser *browser, const char *help);
+int hist_browser__run(struct hist_browser *browser, const char *help,
+                      bool warn_lost_event);
 void hist_browser__init(struct hist_browser *browser,
                         struct hists *hists);
 #endif /* _PERF_UI_BROWSER_HISTS_H_ */
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index ac35cd214feb..e5fc14e53c05 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -715,28 +715,11 @@ union perf_event *perf_evlist__mmap_read_forward(struct perf_evlist *evlist, int
         return perf_mmap__read_forward(md);
 }
 
-union perf_event *perf_evlist__mmap_read_backward(struct perf_evlist *evlist, int idx)
-{
-        struct perf_mmap *md = &evlist->mmap[idx];
-
-        /*
-         * No need to check messup for backward ring buffer:
-         * We can always read arbitrary long data from a backward
-         * ring buffer unless we forget to pause it before reading.
-         */
-        return perf_mmap__read_backward(md);
-}
-
 union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx)
 {
         return perf_evlist__mmap_read_forward(evlist, idx);
 }
 
-void perf_evlist__mmap_read_catchup(struct perf_evlist *evlist, int idx)
-{
-        perf_mmap__read_catchup(&evlist->mmap[idx]);
-}
-
 void perf_evlist__mmap_consume(struct perf_evlist *evlist, int idx)
 {
         perf_mmap__consume(&evlist->mmap[idx], false);
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index 75f8e0ad5d76..336b838e6957 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -133,10 +133,6 @@ union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx);
 
 union perf_event *perf_evlist__mmap_read_forward(struct perf_evlist *evlist,
                                                  int idx);
-union perf_event *perf_evlist__mmap_read_backward(struct perf_evlist *evlist,
-                                                  int idx);
-void perf_evlist__mmap_read_catchup(struct perf_evlist *evlist, int idx);
-
 void perf_evlist__mmap_consume(struct perf_evlist *evlist, int idx);
 
 int perf_evlist__open(struct perf_evlist *evlist);
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index ff359c9ece2e..ef351688b797 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -41,17 +41,7 @@
 
 #include "sane_ctype.h"
 
-static struct {
-        bool sample_id_all;
-        bool exclude_guest;
-        bool mmap2;
-        bool cloexec;
-        bool clockid;
-        bool clockid_wrong;
-        bool lbr_flags;
-        bool write_backward;
-        bool group_read;
-} perf_missing_features;
+struct perf_missing_features perf_missing_features;
 
 static clockid_t clockid;
 
diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
index 846e41644525..a7487c6d1866 100644
--- a/tools/perf/util/evsel.h
+++ b/tools/perf/util/evsel.h
@@ -149,6 +149,20 @@ union u64_swap {
         u32 val32[2];
 };
 
+struct perf_missing_features {
+        bool sample_id_all;
+        bool exclude_guest;
+        bool mmap2;
+        bool cloexec;
+        bool clockid;
+        bool clockid_wrong;
+        bool lbr_flags;
+        bool write_backward;
+        bool group_read;
+};
+
+extern struct perf_missing_features perf_missing_features;
+
 struct cpu_map;
 struct target;
 struct thread_map;
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index f6630cb95eff..02721b579746 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -430,7 +430,8 @@ int hist_entry__tui_annotate(struct hist_entry *he, struct perf_evsel *evsel,
 int perf_evlist__tui_browse_hists(struct perf_evlist *evlist, const char *help,
                                   struct hist_browser_timer *hbt,
                                   float min_pcnt,
-                                  struct perf_env *env);
+                                  struct perf_env *env,
+                                  bool warn_lost_event);
 int script_browse(const char *script_opt);
 #else
 static inline
@@ -438,7 +439,8 @@ int perf_evlist__tui_browse_hists(struct perf_evlist *evlist __maybe_unused,
                                   const char *help __maybe_unused,
                                   struct hist_browser_timer *hbt __maybe_unused,
                                   float min_pcnt __maybe_unused,
-                                  struct perf_env *env __maybe_unused)
+                                  struct perf_env *env __maybe_unused,
+                                  bool warn_lost_event __maybe_unused)
 {
         return 0;
 }
diff --git a/tools/perf/util/mmap.c b/tools/perf/util/mmap.c
index 05076e683938..91531a7c8fbf 100644
--- a/tools/perf/util/mmap.c
+++ b/tools/perf/util/mmap.c
@@ -22,29 +22,27 @@ size_t perf_mmap__mmap_len(struct perf_mmap *map)
 
 /* When check_messup is true, 'end' must points to a good entry */
 static union perf_event *perf_mmap__read(struct perf_mmap *map,
-                                         u64 start, u64 end, u64 *prev)
+                                         u64 *startp, u64 end)
 {
         unsigned char *data = map->base + page_size;
         union perf_event *event = NULL;
-        int diff = end - start;
+        int diff = end - *startp;
 
         if (diff >= (int)sizeof(event->header)) {
                 size_t size;
 
-                event = (union perf_event *)&data[start & map->mask];
+                event = (union perf_event *)&data[*startp & map->mask];
                 size = event->header.size;
 
-                if (size < sizeof(event->header) || diff < (int)size) {
-                        event = NULL;
-                        goto broken_event;
-                }
+                if (size < sizeof(event->header) || diff < (int)size)
+                        return NULL;
 
                 /*
                  * Event straddles the mmap boundary -- header should always
                  * be inside due to u64 alignment of output.
                  */
-                if ((start & map->mask) + size != ((start + size) & map->mask)) {
-                        unsigned int offset = start;
+                if ((*startp & map->mask) + size != ((*startp + size) & map->mask)) {
+                        unsigned int offset = *startp;
                         unsigned int len = min(sizeof(*event), size), cpy;
                         void *dst = map->event_copy;
 
@@ -59,20 +57,19 @@ static union perf_event *perf_mmap__read(struct perf_mmap *map,
                         event = (union perf_event *)map->event_copy;
                 }
 
-                start += size;
+                *startp += size;
         }
 
-broken_event:
-        if (prev)
-                *prev = start;
-
         return event;
 }
 
+/*
+ * legacy interface for mmap read.
+ * Don't use it. Use perf_mmap__read_event().
+ */
 union perf_event *perf_mmap__read_forward(struct perf_mmap *map)
 {
         u64 head;
-        u64 old = map->prev;
 
         /*
          * Check if event was unmapped due to a POLLHUP/POLLERR.
@@ -82,13 +79,26 @@ union perf_event *perf_mmap__read_forward(struct perf_mmap *map)
 
         head = perf_mmap__read_head(map);
 
-        return perf_mmap__read(map, old, head, &map->prev);
+        return perf_mmap__read(map, &map->prev, head);
 }
 
-union perf_event *perf_mmap__read_backward(struct perf_mmap *map)
+/*
+ * Read event from ring buffer one by one.
+ * Return one event for each call.
+ *
+ * Usage:
+ * perf_mmap__read_init()
+ * while(event = perf_mmap__read_event()) {
+ *      //process the event
+ *      perf_mmap__consume()
+ * }
+ * perf_mmap__read_done()
+ */
+union perf_event *perf_mmap__read_event(struct perf_mmap *map,
+                                        bool overwrite,
+                                        u64 *startp, u64 end)
 {
-        u64 head, end;
-        u64 start = map->prev;
+        union perf_event *event;
 
         /*
          * Check if event was unmapped due to a POLLHUP/POLLERR.
@@ -96,40 +106,19 @@ union perf_event *perf_mmap__read_backward(struct perf_mmap *map)
         if (!refcount_read(&map->refcnt))
                 return NULL;
 
-        head = perf_mmap__read_head(map);
-        if (!head)
+        if (startp == NULL)
                 return NULL;
 
-        /*
-         * 'head' pointer starts from 0. Kernel minus sizeof(record) form
-         * it each time when kernel writes to it, so in fact 'head' is
-         * negative. 'end' pointer is made manually by adding the size of
-         * the ring buffer to 'head' pointer, means the validate data can
-         * read is the whole ring buffer. If 'end' is positive, the ring
-         * buffer has not fully filled, so we must adjust 'end' to 0.
-         *
-         * However, since both 'head' and 'end' is unsigned, we can't
-         * simply compare 'end' against 0. Here we compare '-head' and
-         * the size of the ring buffer, where -head is the number of bytes
-         * kernel write to the ring buffer.
-         */
-        if (-head < (u64)(map->mask + 1))
-                end = 0;
-        else
-                end = head + map->mask + 1;
-
-        return perf_mmap__read(map, start, end, &map->prev);
-}
+        /* non-overwirte doesn't pause the ringbuffer */
+        if (!overwrite)
+                end = perf_mmap__read_head(map);
 
-void perf_mmap__read_catchup(struct perf_mmap *map)
-{
-        u64 head;
+        event = perf_mmap__read(map, startp, end);
 
-        if (!refcount_read(&map->refcnt))
-                return;
+        if (!overwrite)
+                map->prev = *startp;
 
-        head = perf_mmap__read_head(map);
-        map->prev = head;
+        return event;
 }
 
 static bool perf_mmap__empty(struct perf_mmap *map)
@@ -267,41 +256,60 @@ static int overwrite_rb_find_range(void *buf, int mask, u64 head, u64 *start, u6
         return -1;
 }
 
-int perf_mmap__push(struct perf_mmap *md, bool overwrite,
-                    void *to, int push(void *to, void *buf, size_t size))
+/*
+ * Report the start and end of the available data in ringbuffer
+ */
+int perf_mmap__read_init(struct perf_mmap *md, bool overwrite,
+                         u64 *startp, u64 *endp)
 {
         u64 head = perf_mmap__read_head(md);
         u64 old = md->prev;
-        u64 end = head, start = old;
         unsigned char *data = md->base + page_size;
         unsigned long size;
-        void *buf;
-        int rc = 0;
 
-        start = overwrite ? head : old;
-        end = overwrite ? old : head;
+        *startp = overwrite ? head : old;
+        *endp = overwrite ? old : head;
 
-        if (start == end)
-                return 0;
+        if (*startp == *endp)
+                return -EAGAIN;
 
-        size = end - start;
+        size = *endp - *startp;
         if (size > (unsigned long)(md->mask) + 1) {
                 if (!overwrite) {
                         WARN_ONCE(1, "failed to keep up with mmap data. (warn only once)\n");
 
                         md->prev = head;
                         perf_mmap__consume(md, overwrite);
-                        return 0;
+                        return -EAGAIN;
                 }
 
                 /*
                  * Backward ring buffer is full. We still have a chance to read
                  * most of data from it.
                  */
-                if (overwrite_rb_find_range(data, md->mask, head, &start, &end))
-                        return -1;
+                if (overwrite_rb_find_range(data, md->mask, head, startp, endp))
+                        return -EINVAL;
         }
 
+        return 0;
+}
+
+int perf_mmap__push(struct perf_mmap *md, bool overwrite,
+                    void *to, int push(void *to, void *buf, size_t size))
+{
+        u64 head = perf_mmap__read_head(md);
+        u64 end, start;
+        unsigned char *data = md->base + page_size;
+        unsigned long size;
+        void *buf;
+        int rc = 0;
+
+        rc = perf_mmap__read_init(md, overwrite, &start, &end);
+        if (rc < 0)
+                return (rc == -EAGAIN) ? 0 : -1;
+
+        size = end - start;
+
         if ((start & md->mask) + size != (end & md->mask)) {
                 buf = &data[start & md->mask];
                 size = md->mask + 1 - (start & md->mask);
@@ -327,3 +335,14 @@ int perf_mmap__push(struct perf_mmap *md, bool overwrite,
 out:
         return rc;
 }
+
+/*
+ * Mandatory for overwrite mode
+ * The direction of overwrite mode is backward.
+ * The last perf_mmap__read() will set tail to map->prev.
+ * Need to correct the map->prev to head which is the end of next read.
+ */
+void perf_mmap__read_done(struct perf_mmap *map)
+{
+        map->prev = perf_mmap__read_head(map);
+}
diff --git a/tools/perf/util/mmap.h b/tools/perf/util/mmap.h
index e43d7b55a55f..ec7d3a24e276 100644
--- a/tools/perf/util/mmap.h
+++ b/tools/perf/util/mmap.h
@@ -65,8 +65,6 @@ void perf_mmap__put(struct perf_mmap *map);
 
 void perf_mmap__consume(struct perf_mmap *map, bool overwrite);
 
-void perf_mmap__read_catchup(struct perf_mmap *md);
-
 static inline u64 perf_mmap__read_head(struct perf_mmap *mm)
 {
         struct perf_event_mmap_page *pc = mm->base;
@@ -87,11 +85,17 @@ static inline void perf_mmap__write_tail(struct perf_mmap *md, u64 tail)
 }
 
 union perf_event *perf_mmap__read_forward(struct perf_mmap *map);
-union perf_event *perf_mmap__read_backward(struct perf_mmap *map);
+
+union perf_event *perf_mmap__read_event(struct perf_mmap *map,
+                                        bool overwrite,
+                                        u64 *startp, u64 end);
 
 int perf_mmap__push(struct perf_mmap *md, bool backward,
                     void *to, int push(void *to, void *buf, size_t size));
 
 size_t perf_mmap__mmap_len(struct perf_mmap *map);
 
+int perf_mmap__read_init(struct perf_mmap *md, bool overwrite,
+                         u64 *startp, u64 *endp);
+void perf_mmap__read_done(struct perf_mmap *map);
 #endif /*__PERF_MMAP_H */
diff --git a/tools/perf/util/util.c b/tools/perf/util/util.c
index 443892dabedb..1019bbc5dbd8 100644
--- a/tools/perf/util/util.c
+++ b/tools/perf/util/util.c
@@ -340,35 +340,15 @@ size_t hex_width(u64 v)
         return n;
 }
 
-static int hex(char ch)
-{
-        if ((ch >= '0') && (ch <= '9'))
-                return ch - '0';
-        if ((ch >= 'a') && (ch <= 'f'))
-                return ch - 'a' + 10;
-        if ((ch >= 'A') && (ch <= 'F'))
-                return ch - 'A' + 10;
-        return -1;
-}
-
 /*
  * While we find nice hex chars, build a long_val.
  * Return number of chars processed.
  */
 int hex2u64(const char *ptr, u64 *long_val)
 {
-        const char *p = ptr;
-        *long_val = 0;
-
-        while (*p) {
-                const int hex_val = hex(*p);
+        char *p;
 
-                if (hex_val < 0)
-                        break;
-
-                *long_val = (*long_val << 4) | hex_val;
-                p++;
-        }
+        *long_val = strtoull(ptr, &p, 16);
 
         return p - ptr;
 }
diff --git a/tools/testing/selftests/powerpc/alignment/alignment_handler.c b/tools/testing/selftests/powerpc/alignment/alignment_handler.c
index 39fd362415cf..0f2698f9fd6d 100644
--- a/tools/testing/selftests/powerpc/alignment/alignment_handler.c
+++ b/tools/testing/selftests/powerpc/alignment/alignment_handler.c
@@ -57,7 +57,7 @@ volatile int gotsig;
 
 void sighandler(int sig, siginfo_t *info, void *ctx)
 {
-        struct ucontext *ucp = ctx;
+        ucontext_t *ucp = ctx;
 
         if (!testing) {
                 signal(sig, SIG_DFL);
diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index 10ca46df1449..d744991c0f4f 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -5,16 +5,26 @@ include ../lib.mk
 
 .PHONY: all all_32 all_64 warn_32bit_failure clean
 
-TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt ptrace_syscall test_mremap_vdso \
-                        check_initial_reg_state sigreturn ldt_gdt iopl mpx-mini-test ioperm \
+UNAME_M := $(shell uname -m)
+CAN_BUILD_I386 := $(shell ./check_cc.sh $(CC) trivial_32bit_program.c -m32)
+CAN_BUILD_X86_64 := $(shell ./check_cc.sh $(CC) trivial_64bit_program.c)
+
+TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \
+                        check_initial_reg_state sigreturn iopl mpx-mini-test ioperm \
                         protection_keys test_vdso test_vsyscall
 TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault test_syscall_vdso unwind_vdso \
                         test_FCMOV test_FCOMI test_FISTTP \
                         vdso_restorer
-TARGETS_C_64BIT_ONLY := fsgsbase sysret_rip 5lvl
+TARGETS_C_64BIT_ONLY := fsgsbase sysret_rip
+# Some selftests require 32bit support enabled also on 64bit systems
+TARGETS_C_32BIT_NEEDED := ldt_gdt ptrace_syscall
 
-TARGETS_C_32BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_32BIT_ONLY)
+TARGETS_C_32BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_32BIT_ONLY) $(TARGETS_C_32BIT_NEEDED)
 TARGETS_C_64BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_64BIT_ONLY)
+ifeq ($(CAN_BUILD_I386)$(CAN_BUILD_X86_64),11)
+TARGETS_C_64BIT_ALL += $(TARGETS_C_32BIT_NEEDED)
+endif
+
 BINARIES_32 := $(TARGETS_C_32BIT_ALL:%=%_32)
 BINARIES_64 := $(TARGETS_C_64BIT_ALL:%=%_64)
 
@@ -23,10 +33,6 @@ BINARIES_64 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_64))
 
 CFLAGS := -O2 -g -std=gnu99 -pthread -Wall -no-pie
 
-UNAME_M := $(shell uname -m)
-CAN_BUILD_I386 := $(shell ./check_cc.sh $(CC) trivial_32bit_program.c -m32)
-CAN_BUILD_X86_64 := $(shell ./check_cc.sh $(CC) trivial_64bit_program.c)
-
 define gen-target-rule-32
 $(1) $(1)_32: $(OUTPUT)/$(1)_32
 .PHONY: $(1) $(1)_32
@@ -40,12 +46,14 @@ endef
 ifeq ($(CAN_BUILD_I386),1)
 all: all_32
 TEST_PROGS += $(BINARIES_32)
+EXTRA_CFLAGS += -DCAN_BUILD_32
 $(foreach t,$(TARGETS_C_32BIT_ALL),$(eval $(call gen-target-rule-32,$(t))))
 endif
 
 ifeq ($(CAN_BUILD_X86_64),1)
 all: all_64
 TEST_PROGS += $(BINARIES_64)
+EXTRA_CFLAGS += -DCAN_BUILD_64
 $(foreach t,$(TARGETS_C_64BIT_ALL),$(eval $(call gen-target-rule-64,$(t))))
 endif
 
diff --git a/tools/testing/selftests/x86/mpx-mini-test.c b/tools/testing/selftests/x86/mpx-mini-test.c
index ec0f6b45ce8b..9c0325e1ea68 100644
--- a/tools/testing/selftests/x86/mpx-mini-test.c
+++ b/tools/testing/selftests/x86/mpx-mini-test.c
@@ -315,11 +315,39 @@ static inline void *__si_bounds_upper(siginfo_t *si)
         return si->si_upper;
 }
 #else
+
+/*
+ * This deals with old version of _sigfault in some distros:
+ *
+
+old _sigfault:
+        struct {
+            void *si_addr;
+        } _sigfault;
+
+new _sigfault:
+        struct {
+                void __user *_addr;
+                int _trapno;
+                short _addr_lsb;
+                union {
+                        struct {
+                                void __user *_lower;
+                                void __user *_upper;
+                        } _addr_bnd;
+                        __u32 _pkey;
+                };
+        } _sigfault;
+ *
+ */
+
 static inline void **__si_bounds_hack(siginfo_t *si)
 {
         void *sigfault = &si->_sifields._sigfault;
         void *end_sigfault = sigfault + sizeof(si->_sifields._sigfault);
-        void **__si_lower = end_sigfault;
+        int *trapno = (int*)end_sigfault;
+        /* skip _trapno and _addr_lsb */
+        void **__si_lower = (void**)(trapno + 2);
 
         return __si_lower;
 }
@@ -331,7 +359,7 @@ static inline void *__si_bounds_lower(siginfo_t *si)
 
 static inline void *__si_bounds_upper(siginfo_t *si)
 {
-        return (*__si_bounds_hack(si)) + sizeof(void *);
+        return *(__si_bounds_hack(si) + 1);
 }
 #endif
 
diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c
index bc1b0735bb50..f15aa5a76fe3 100644
--- a/tools/testing/selftests/x86/protection_keys.c
+++ b/tools/testing/selftests/x86/protection_keys.c
@@ -393,34 +393,6 @@ pid_t fork_lazy_child(void)
         return forkret;
 }
 
-void davecmp(void *_a, void *_b, int len)
-{
-        int i;
-        unsigned long *a = _a;
-        unsigned long *b = _b;
-
-        for (i = 0; i < len / sizeof(*a); i++) {
-                if (a[i] == b[i])
-                        continue;
-
-                dprintf3("[%3d]: a: %016lx b: %016lx\n", i, a[i], b[i]);
-        }
-}
-
-void dumpit(char *f)
-{
-        int fd = open(f, O_RDONLY);
-        char buf[100];
-        int nr_read;
-
-        dprintf2("maps fd: %d\n", fd);
-        do {
-                nr_read = read(fd, &buf[0], sizeof(buf));
-                write(1, buf, nr_read);
-        } while (nr_read > 0);
-        close(fd);
-}
-
 #define PKEY_DISABLE_ACCESS    0x1
 #define PKEY_DISABLE_WRITE     0x2
 
diff --git a/tools/testing/selftests/x86/single_step_syscall.c b/tools/testing/selftests/x86/single_step_syscall.c
index a48da95c18fd..ddfdd635de16 100644
--- a/tools/testing/selftests/x86/single_step_syscall.c
+++ b/tools/testing/selftests/x86/single_step_syscall.c
@@ -119,7 +119,9 @@ static void check_result(void)
 
 int main()
 {
+#ifdef CAN_BUILD_32
         int tmp;
+#endif
 
         sethandler(SIGTRAP, sigtrap, 0);
 
@@ -139,12 +141,13 @@ int main()
                       : : "c" (post_nop) : "r11");
         check_result();
 #endif
-
+#ifdef CAN_BUILD_32
         printf("[RUN]\tSet TF and check int80\n");
         set_eflags(get_eflags() | X86_EFLAGS_TF);
         asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)
                         : INT80_CLOBBERS);
         check_result();
+#endif
 
         /*
          * This test is particularly interesting if fast syscalls use
diff --git a/tools/testing/selftests/x86/test_mremap_vdso.c b/tools/testing/selftests/x86/test_mremap_vdso.c
index bf0d687c7db7..64f11c8d9b76 100644
--- a/tools/testing/selftests/x86/test_mremap_vdso.c
+++ b/tools/testing/selftests/x86/test_mremap_vdso.c
@@ -90,8 +90,12 @@ int main(int argc, char **argv, char **envp)
                         vdso_size += PAGE_SIZE;
                 }
 
+#ifdef __i386__
                 /* Glibc is likely to explode now - exit with raw syscall */
                 asm volatile ("int $0x80" : : "a" (__NR_exit), "b" (!!ret));
+#else /* __x86_64__ */
+                syscall(SYS_exit, ret);
+#endif
         } else {
                 int status;
 
diff --git a/tools/testing/selftests/x86/test_vdso.c b/tools/testing/selftests/x86/test_vdso.c
index 29973cde06d3..235259011704 100644
--- a/tools/testing/selftests/x86/test_vdso.c
+++ b/tools/testing/selftests/x86/test_vdso.c
@@ -26,20 +26,59 @@
 # endif
 #endif
 
+/* max length of lines in /proc/self/maps - anything longer is skipped here */
+#define MAPS_LINE_LEN 128
+
 int nerrs = 0;
 
+typedef long (*getcpu_t)(unsigned *, unsigned *, void *);
+
+getcpu_t vgetcpu;
+getcpu_t vdso_getcpu;
+
+static void *vsyscall_getcpu(void)
+{
 #ifdef __x86_64__
-# define VSYS(x) (x)
+        FILE *maps;
+        char line[MAPS_LINE_LEN];
+        bool found = false;
+
+        maps = fopen("/proc/self/maps", "r");
+        if (!maps) /* might still be present, but ignore it here, as we test vDSO not vsyscall */
+                return NULL;
+
+        while (fgets(line, MAPS_LINE_LEN, maps)) {
+                char r, x;
+                void *start, *end;
+                char name[MAPS_LINE_LEN];
+
+                /* sscanf() is safe here as strlen(name) >= strlen(line) */
+                if (sscanf(line, "%p-%p %c-%cp %*x %*x:%*x %*u %s",
+                           &start, &end, &r, &x, name) != 5)
+                        continue;
+
+                if (strcmp(name, "[vsyscall]"))
+                        continue;
+
+                /* assume entries are OK, as we test vDSO here not vsyscall */
+                found = true;
+                break;
+        }
+
+        fclose(maps);
+
+        if (!found) {
+                printf("Warning: failed to find vsyscall getcpu\n");
+                return NULL;
+        }
+        return (void *) (0xffffffffff600800);
 #else
-# define VSYS(x) 0
+        return NULL;
 #endif
+}
 
-typedef long (*getcpu_t)(unsigned *, unsigned *, void *);
-
-const getcpu_t vgetcpu = (getcpu_t)VSYS(0xffffffffff600800);
-getcpu_t vdso_getcpu;
 
-void fill_function_pointers()
+static void fill_function_pointers()
 {
         void *vdso = dlopen("linux-vdso.so.1",
                             RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);
@@ -54,6 +93,8 @@ void fill_function_pointers()
         vdso_getcpu = (getcpu_t)dlsym(vdso, "__vdso_getcpu");
         if (!vdso_getcpu)
                 printf("Warning: failed to find getcpu in vDSO\n");
+
+        vgetcpu = (getcpu_t) vsyscall_getcpu();
 }
 
 static long sys_getcpu(unsigned * cpu, unsigned * node,
diff --git a/tools/testing/selftests/x86/test_vsyscall.c b/tools/testing/selftests/x86/test_vsyscall.c
index 7a744fa7b786..be81621446f0 100644
--- a/tools/testing/selftests/x86/test_vsyscall.c
+++ b/tools/testing/selftests/x86/test_vsyscall.c
@@ -33,6 +33,9 @@
 # endif
 #endif
 
+/* max length of lines in /proc/self/maps - anything longer is skipped here */
+#define MAPS_LINE_LEN 128
+
 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
                        int flags)
 {
@@ -98,7 +101,7 @@ static int init_vsys(void)
 #ifdef __x86_64__
         int nerrs = 0;
         FILE *maps;
-        char line[128];
+        char line[MAPS_LINE_LEN];
         bool found = false;
 
         maps = fopen("/proc/self/maps", "r");
@@ -108,10 +111,12 @@ static int init_vsys(void)
                 return 0;
         }
 
-        while (fgets(line, sizeof(line), maps)) {
+        while (fgets(line, MAPS_LINE_LEN, maps)) {
                 char r, x;
                 void *start, *end;
-                char name[128];
+                char name[MAPS_LINE_LEN];
+
+                /* sscanf() is safe here as strlen(name) >= strlen(line) */
                 if (sscanf(line, "%p-%p %c-%cp %*x %*x:%*x %*u %s",
                            &start, &end, &r, &x, name) != 5)
                         continue;